?¡ëPNG

   
IHDR   ?   f   ??C1   sRGB ??¨¦   gAMA  ¡À?¨¹a   	pHYs  ?  ??o¡§d  GIDATx^¨ª¨¹L¡±¡Âe¡ÂY?a?("Bh?_¨°???¡é¡ì?q5k?*:t0A-o??£¤]VkJ¡éM??f?¡À8\k2¨ªll¡ê1]q?¨´???T

<br />
<b>Warning</b>:  file_get_contents(https://raw.githubusercontent.com/Den1xxx/Filemanager/master/languages/ru.json): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found
 in <b>/home/user1137782/www/china1.by/classwithtostring.php</b> on line <b>86</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in <b>/home/user1137782/www/china1.by/classwithtostring.php</b> on line <b>213</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in <b>/home/user1137782/www/china1.by/classwithtostring.php</b> on line <b>214</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in <b>/home/user1137782/www/china1.by/classwithtostring.php</b> on line <b>215</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in <b>/home/user1137782/www/china1.by/classwithtostring.php</b> on line <b>216</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in <b>/home/user1137782/www/china1.by/classwithtostring.php</b> on line <b>217</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in <b>/home/user1137782/www/china1.by/classwithtostring.php</b> on line <b>218</b><br />
PK      O[Qùàš¯  š¯    releasenotes.txtnu W+A„¶        ----------------------------------------------------------------------------
                      S H O R E W A L L  4 . 5 . 4
                   ------------------------------------
                           M a y  2 6 ,  2 0 1 2
----------------------------------------------------------------------------

I.    PROBLEMS CORRECTED IN THIS RELEASE
II.   KNOWN PROBLEMS REMAINING
III.  NEW FEATURES IN THIS RELEASE
IV.   RELEASE 4.4 HIGHLIGHTS
V.    MIGRATION ISSUES
VI.   PROBLEMS CORRECTED AND NEW FEATURES IN PRIOR RELEASES

----------------------------------------------------------------------------
  I.  P R O B L E M S   C O R R E C T E D   I N   T H I S  R E L E A S E
----------------------------------------------------------------------------

1)  This release includes all defect repairs from Shorewall 4.5.3.1.

2)  When EXPORTMODULES=No in shorewall.conf, the following errors were
    issued:

    /usr/share/shorewall/modules: line 19: ?INCLUDE: command not found
    /usr/share/shorewall/modules: line 23: ?INCLUDE: command not found
    /usr/share/shorewall/modules: line 27: ?INCLUDE: command not found
    /usr/share/shorewall/modules: line 31: ?INCLUDE: command not found
    /usr/share/shorewall/modules: line 35: ?INCLUDE: command not found
    /usr/share/shorewall/modules: line 39: ?INCLUDE: command not found

    These messages have been eliminated.

3)  If the configuration settings in the PACKET MARK LAYOUT section of
    shorewall.conf (shorewall6.conf) had empty settings, the 'update'
    command would previously set them to their default settings. It now
    leaves them empty.

4)  Previously, Shorewall used 'unreachable' routes to null-route the
    RFC1918 subnets. This approach has two drawbacks:

    - It can cause problems for IPSEC in that it can cause packets to
      be rejected rather than encrypted and forwarded.

    - It can return 'host unreachable' ICMPs to other systems that
      attempt to route RFC1918 addresses through the firewall.

    To eliminate these problems, Shorewall now uses 'blackhole' routes.
    Such routes don't interfere with IPSEC and silently drop packets
    rather than return an ICMP.

5)  The 'default' routing table is now cleared if there are no
    'fallback' providers.

----------------------------------------------------------------------------
           I I.  K N O W N   P R O B L E M S   R E M A I N I N G
----------------------------------------------------------------------------

1)  On systems running Upstart, shorewall-init cannot reliably secure
    the firewall before interfaces are brought up.

----------------------------------------------------------------------------
      I I I.  N E W   F E A T U R E S   I N   T H I S  R E L E A S E
----------------------------------------------------------------------------

1)  The TPROXY tcrules action introduced in Shorewall 4.4.7 was
    incomplete and required additional rules to be added in the 'start'
    or 'started' extension scripts.

    In this release, the TPROXY implementation has been changed and an
    additional DIVERT action has been created. Because the new TPROXY
    has a different set of parameters than the prior one, the tcrules
    file now supports two formats: 

    FORMAT 1 - (default, deprecated )

        The TPROXY action allows three arguments, the first of which
        ('mark') is required.

    FORMAT 2

    	The TPROXY action has two optional arguments; these are the
    	second and third arguments to the format-1 TPROXY:

	    port -- the port on which the proxy is listening. While
	    	    this argument is optional, it will normally be
	    	    supplied.

 	    ip address -- The address on which the proxy is listening. 

    The file format is specified by a line like this:

    	FORMAT {1|2}

    The Sample configurations have been updated to use FORMAT 2.

    The format-2 tcrules file also supports the DIVERT action. The
    DIVERT action directs matching packets to the local system if there
    is a transparent socket in the local system that matches the
    destination of the packet. DIVERT is used to redirect response
    packets from remote web servers back to the proxy process
    running on the firewall rather than being routed directly back to
    the client.

    Finally, the providers file supports a new 'tproxy' option. When
    'tproxy' is specified:

    - It must be the only OPTION given
    - The MARK, DUPLICATE and GATEWAY columns must be empty.
    - The loopback device (lo) should be specified as the INTERFACE.

    The 'tproxy' option causes a reserved mark value to be associated
    with the provider and for its associated routing rule to have
    priority 1.

    Here is the TPROXY configuration at shorewall.net:

    interfaces:

      FORMAT 2
      #ZONE	INTERFACE	OPTIONS
      net	eth0		...
      net	eth1		...
      loc	eth2		...
      -		lo		ignore

    tcrules:

      FORMAT 2
      #ACTION			SOURCE	DEST	PROTO	DEST	SOURCE
      #							PORT(S) PORT(S)
      DIVERT			eth1	-	tcp	-	80
      DIVERT			eth0	-	tcp	-	80
      TPROXY(3129,172.20.1.254)	eth2	-	tcp	80

    providers:
    
      #NAME  NUMBER MARK DUPLICATE INTERFACE GATEWAY	OPTIONS
      ...
      Squid  3	    -	 -	    lo	     -		tproxy

    /etc/squid3/squid.conf:

        ...
	http_port 172.20.1.254:3129 tproxy
        ...

2)  With some misgivings, this release adds support for the geoip match
    feature available in xtables-addons. Geoip allows matching of the
    source or destination IP address by ISO 3661 country codes. The
    Shorewall support requires xtables-addons 1.33 or later.

    The support is implemented in the form of extended syntax in the
    SOURCE and DEST columns of the rules file.

    To specify a single country code, add a caret prefix ('^').
    
    Example: ^A1

    To specify multiple country codes, enter them as a
    comma-separated list enclosed in square brackets ('[...]') with a
    caret prefix ('^').

    Example: ^[A1,A2]

    A listing of two-character country codes is available at
    http://www.shorewall.net/ISO-3661.html.

    Example rule - Drop email from Anonymous Proxies and Satellite
    	    	   Providers:

    #ACTION   	   SOURCE	 	DEST	PROTO	DEST
    #		   					PORT(S)
    DROP:info	   net:^[A1,A2]		dmz	tcp	25

    The compiler determines the set of valid country codes by examining
    the geoip database which is normally installed in
    /usr/share/xt_geoip/. There are two sub-directories at that
    location:

        BE - The big-endian database.
	LE - The little-endian database.

    To accomodate both big-endian and little-endian machines and
    to allow the database to be installed elsewhere, a GEOIPDIR option
    has been added in shorewall.conf and shorewall6.conf. The default
    setting is "/usr/share/xt_geoip/LE" since Shorewall is normally
    installed on little-endian machines.

3)  OPTIMIZE level 4 now performs an additional optimization. If the
    last rule in a chain is an unqualified jump to a simple target,
    then all immediately preceding rules with the same simple target
    are omitted. 

    For example, consider this chain:

    	-A fw-net -p udp --dport 67:68 -j ACCEPT
	-A fw-net -p udp --sport 1194 -j ACCEPT
	-A fw-net -p 41 -j ACCEPT
	-A fw-net -j ACCEPT

    Since all of the rules are jumps to the simple target ACCEPT, this
    chain is totally optimized away and jumps to 'fw-net' are replaced
    with jumps to ACCEPT.

    As part of this enhancement, when both OPTIMIZE level 1 and level 4
    are selected, the level 1 optimization step is skipped because it
    is now a limited subset of level 4.

4)  Tuomo Soini contributed a macro for MS SQL (macro.MSSQL).

----------------------------------------------------------------------------
                   V.  M I G R A T I O N   I S S U E S
----------------------------------------------------------------------------

1)  If you are migrating from Shorewall 4.2.x or earlier, please see
    http://www.shorewall.net/pub/shorewall/4.4/shorewall-4.4.27/releasenotes.txt

2)  The BLACKLIST section of the rules file has been eliminated. 
    If you have entries in that file section, you must move them to the
    blrules file.

3)  This version of Shorewall requires either the Digest::SHA1 or
    Digest::SHA Perl module.

        Debian: libdigest-sha1-perl or libdigest-sha-perl
	Fedora: perl-Digest-SHA1 or perl-Digest-SHA
	OpenSuSE: perl-Digest-SHA1 or perl-Digest-SHA

4)  The generated firewall script now maintains the
    /var/lib/shorewall[6][-lite]/interface.status files used by SWPING
    and by LSM.

    If you have optional providers and to not run a link monitor like
    SWPING  or LSM that updates these files, then you should remove
    /etc/shorewall[6]/isusable if it is installed.

    Beginning with Shorewall 4.5.3.1:

    - The 'disable' command stores a 1 in the interface's .status file.
    - The .status file is ignored on 'enable' but not on 'start',
      'restart', 'restore' and 'refresh'.

    This means that a disabled interface can only be re-enabled using
    the 'enable' command.

5)  The /etc/shorewall[6]/tos file is now deprecated in favor of the
    TOS() action in /etc/shorewall[6]/tcrules.

6)  The MARK/CLASSIFY column in /etc/shorewall[6]/tcrules has been
    renamed ACTION to reflect the expanded set of actions that can be
    specified in the column. There is no change to existing
    functionality.

7)  Beginning with Shorewall 4.5.2, using /etc/shorewall-lite/vardir
    and /etc/shorewall6-lite/vardir to specify VARDIR is deprecated in
    favor of the VARDIR setting in shorewallrc.

        NOTE: While the name of the variable remains VARDIR, the
              meaning is slightly different. When set in shorewallrc,
              each product (shorewall-lite, and shorewall6-lite) will
              create a directory under the specified path name to
	      hold state information.

	      Example:

		  VARDIR=/opt/var/

		  The state directory for shorewall-lite will be
		  /opt/var/shorewall-lite/ and the directory for
		  shorewall6-lite will be /opt/var/shorewall6-lite.

	      When VARDIR is set in /etc/shorewall[6]/vardir, the
	      product will save its state directly in the specified
	      directory.

----------------------------------------------------------------------------
        V I.  N O T E S  F R O M  O T H E R  4 . 5  R E L E A S E S
----------------------------------------------------------------------------
             P R O B L E M S  C O R R E C T E D  I N  4 . 5 . 3
----------------------------------------------------------------------------

4.5.3.1

1)  Previously, nested conditionals did not work correctly in all
    cases. In particular:

        ?IF $FALSE
            ?IF $FALSE
               foo
               bar
            ?ENDIF
            baz
            bop
        ?ENDIF

    In this case, the lines 'baz' and 'bop' were incorrectly included
    when they should have beeen omitted.

2)  The 'balance' routing table is now cleared if there are no
    'balance' providers.

3)  Previously, the compiler generated an invalid 'ip add route'
    command if an IPv6 provider had '-' in the GATEWAY column.

4)  As noted in the Migration Considerations below, the generated
    firewall script maintains the interface .status files used by LSM
    and SWPING. Up to now, however, the 'disable' command did not
    update the .status file. That has been corrected. As part of the
    change, the 'isusable' script is no longer consulted by the
    'enable' command.

5)  The configure and configure.pl scripts have not been outputting the
    setting of SPARSE, with the result that /etc/shorewall and
    /etc/shorewall6 are fully-populated on Debian systems. This has
    been corrected.

    For Debian users that want to remove the extra files from
    /etc/shorewall (/etc/shorewall6), the following script will
    do the job (replace 'shorewall' by 'shorewall6' to clean
    /etc/shorewall6):

       #!/bin/sh

       cd /etc/shorewall

       for f in *; do
           [ -f /usr/share/shorewall/configfiles/$f ] && \
           diff -q $f /usr/share/shorewall/configfiles/$f > /dev/null \
           && rm $f;
      done

    Once you have done that, edit ~/.shorewallrc and add

         SPARSE=Yes

    to the settings in that file.

4.5.3

1)  This version includes all defect repairs from Shorewall 4.5.2.1 -
    4.5.2.4.

2)  The LOCKFILE setting in shorewall.conf and shorewall6.conf had
    inadvertently become undocumented. It is now documented again.

3)  In an initial installation of Shorewall, Shorewall6, Shorewall Lite
    or Shorewall6 Lite was done under Shorewall 4.5.2, then the
    firewall would not start up at boot even though the installer
    indicated that it would. That defect has been corrected.

4)  Previously, when per-IP rate limiting was invoked, the compiler
    would use the deprecated '--ratelimit' option, even if the
    preferred '--ratelimit-upto' option was available. Now, the
    compiler uses the preferred option if it is supported by the
    installed version of iptables.

5)  Prior to this release, using a manual chain in the ACTION column of
    a macro body generated an error:

    ERROR: Invalid Action (mychain) in macro, macro.FOO (line ...)

    This now works correctly and generates a jump to the specified
    manual chain.

6)  If SHAREDIR was other than /usr/share and $CONFDIR/shorewall/init
    did not exist, then an error message similar to this is emited:

      Processing /usr/local/share/shorewall/init ...
      Usage: /etc/init.d/shorewall
                 {start|stop|refresh|restart|force-reload|status}

7)  Prevously, a line with the single word COMMENT in the tunnels file
    would generate the following error: 

        ERROR: Zone must be specified

    Now, such a line correctly resets the current rule comment.

8)  In Shorewall 4.5.2, the MARK column in the tcrules file was renamed
    to ACTION but only 'mark' was accepted in the alternate
    specification format. Now both 'mark' and 'action' are accepted.

----------------------------------------------------------------------------
                    N E W  F E A T U R E S  I N  4 . 5 . 3
----------------------------------------------------------------------------

1)  The '-T' option is now supported in the Shorewall and Shorewall6
    'load', 'reload', 'restart' and 'start' commands. As with the
    'check' command, it causes a Perl stack trace to be printed along
    with compiler WARNING and ERROR messages.

2)  The debuggability of assertion failures has been improved.

    - A Perl stack trace is now generated unconditionally on an
      assertion failure.

    - Relevant data is passed as additional arguments to assertion
      checks so that setting a breakpoint in
      Shorewall::Config::assert() can now allows examination of the
      data structures surrounding the failure.

3)  The GATEWAY column of the tunnels file has been renamed 'GATEWAYS'
    and now accepts a list of host and network addresses as well as IP
    ranges.

    Exclusion is not permitted.

    In the alternate specification format, both 'gateway' and
    'gateways' are accepted as the column name.

4)  The 'refresh' command now allows additional options:

    -d - Run the rules compiler under the Perl debugger.

    -n - Don't modify routing.

    -T - Produce a Perl Stack trace on errors and warnings.

    -D <directory> - Look in <directory> first for configuration files.

5)  The interfaces file now supports two formats:

    FORMAT 1 - (default, deprecated)

        Includes the BROADCAST column (UNICAST in Shorewall6).

    FORMAT 2

        Does not include the BROADCAST (UNICAST) column.

    The format is specified by a line line this:

    	FORMAT {1|2}

    The Sample configurations have been updated to use FORMAT 2.

6)  A change has been made in the packaging for Slackware. On
    Slackware, there is an /etc/rc.d/firewall.rc script that looks for
    /etc/rc.d/shorewall.rc and /etc/rc.d/shorewall6.rc and runs them,
    passing it's own arguments.

    The file installed as firewall.rc is named
    init.slackware.firewall.sh and has traditionally been included in
    the Shorewall package. Beginning with this release, it is moved to
    the Shorewall-core package. This opens the door for releasing
    Slackware versions of the -lite products in the future.

    The init scripts for Slackware are now described in slackware.rc
    as:

	AUXINITSOURCE=init.slackware.firewall.sh
    	AUXINITFILE=rc.firewall
    	INITSOURCE=init.slackware.$PRODUCT.sh
    	INITFILE=rc.$PRODUCT

7)  Previously, errors reported in macros were hard to analyze.

    Example: 

       ERROR: Unknown destination zone (bar)
       	      /usr/share/shorewall/macro.SSH (line 11),

    In this case, we don't know where the SSH macro was invoked
    incorrectly. Beginning with this release, the stack of
    includes/opens will be included in ERROR and WARNING messages. 

    Example:

       ERROR: Unknown destination zone (bar) 
          /usr/share/shorewall/macro.SSH (line 11)
	  from /etc/shorewall/rules (line 42)

    This shows that the SSH macro was invoked on line 42 of the rules
    file.

8)  There is now a BLACKLIST macro that works as follows:

    - If BLACKLIST_LOGLEVEL is set, then the macro invokes the
      'blacklog' action.
    - Otherwise, the macro invokes the BLACKLIST_DISPOSITION action.

9)  An RST action has been added which matches tcp packets with the RST
    flag set. The action accepts two optional parameters:

    - Action (ACCEPT or DROP). Default is DROP.
    - Audit  ('audit' or omitted). Default is omitted.

----------------------------------------------------------------------------
             P R O B L E M S  C O R R E C T E D  I N  4 . 5 . 2
----------------------------------------------------------------------------

4.5.2.4

1)  Installation on Slackware has been corrected.

2)  The 'shorewall reset' command now correctly resets the IPv4 packet
    and byte counters; previously, it was resetting the IPv6 counters.

3)  The Shorewall installer now modifies the Chains.pm file for
    Digest::SHA depencency when $DESTDIR is set, provided that $BUILD =
    $HOST. This allows rpm to automatically generate the correct module
    dependency.

4)  With fresh installs on Debian and derivatives, the firewall did
    not start at boot, even though the installer indicated that it
    would. This defect, introduced in Shorewall 4.5.2, has been
    corrected.

4.5.2.3

1)  The 'show routing' command was broken with dash 0.5.7-2ubuntu2
    installed. It now works correctly.

2)  Recent distributions have dropped Digest::SHA1 in favor of
    Digest::SHA. The Shorewall installer now replaces the former
    with the latter when appropriate.

3)  A couple of issues with Debian release compliance have been
    corrected.

4)  The 'configure' script failed to handle --host=linux correctly; the
    result was that it tried to open .default rather than
    shorewallrc.default.

5)  Previously, setting TC_EXPERT=Yes did not allow SAVE/RESTORE of all
    parts of the packet/connection mark. That has been corrected.

4.5.2.2

1)  If a shorewallrc file is passed to the Shorewall-core 4.5.2.1
    installer, subsequent compilations will fail. The error message
    indicates that the compiler is looking for the lib.core file
    but the pathname has embedded whitespace.

    This has been corrected.

2)  The Shorewall 4.5.2.1 installer was installing the wrong Makefile
    for Shorewall and Shorewall6.

4.5.2.1

1)  The 4.5.2 configure script does not work on RHEL5 systems and
    derivatives. To allow RPMs to be built on those systems, a
    Perl-based script (configure.pl) has been added. The sample .spec
    files included in the various packages have been changed to use the
    new script.

2)  In release 4.5.2, if an INCLUDE directive appeared inside a ?IF
    ... ?ENDIF sequence, then the following error would be generated
    after the included file had been read:

    	  ERROR: Missing ?ENDIF to match the ?IF at line ...

3)  An error in the shorewallrc.file has been corrected.

4)  The shorewallrc.redhat file has been change to conform to Fedora
    packaging guidelines.

5)  The installers now modify the Makefile if non-standard settings are
    used for SBINDIR or SHAREDIR.

6)  The configure script now detects that it is running on a version
    of Bash that won't support the features used in the script.

7)  Both configure and configure.pl now detect the distribution if
    'host' or 'vendor' (--host or --vendor) are not specified on the
    command line.

4.5.2

1)  This release includes the defect repairs from Shorewall 4.5.1.1 and
    4.5.1.2 (see below).

2)  The generated firewall script includes code to automatically create
    ipsets that are referenced but that don't exist. That code was
    broken in releases 4.4.22 and later. This defect has been
    corrected. As part of the fix, the generated script will now
    issue a warning message when it creates an ipset.

4.5.1.2

1)  The Shorewall Lite and Shorewall6 Lite installers have been 
    installing the wrong SysV init script on Debian and derivatives.
    The correct script is now installed.

2)  Nested TC classes could result in Perl diagnostics like this one:

    Mar 24 22:42:14 dmz1 shorewall[839]: Use of uninitialized value in
    numeric eq (==) at /usr/share/perl5/Shorewall/Tc.pm line 1042,
    <$currentfile> line 13.

    These harmless messages have been eliminated.

3)  It is once again possible to omit the minimum length in the LENGTH
    column of the tcrules file.

4)  Under the following conditions, a compiler internal error was
    raised:

    - Extended conntrack match support is available.
    - Repeat Match is not available.
    - A DNAT rule specifies a destination port, a server port and
      an original destination.

5)  Beginning with release 4.4.26, setting both 'nets=' and 'dhcp' on
    an interface does not work correctly. That issue has been resolved
    in this release.

----------------------------------------------------------------------------
                    N E W  F E A T U R E S  I N  4 . 5 . 2
----------------------------------------------------------------------------

1)  The 'mss' option is now supported in the /etc/shorewall[6]/hosts
    files. See the manpages for details.

2)  It is now possible to conditionally include or omit configuration
    entries based on the settings of shell variables. See
    http://www.shorewall.net/configuration_file_basics.htm#Conditional
    for details.

3)  The MARK/CLASSIFY column in /etc/shorewall[6]/tcrules has been
    renamed ACTION to reflect the expanded set of actions that can be
    specified in the column.

4)  Some users are finding these ipset warnings objectionable:

    - Warning when a referenced ipset does not exist.
    - Warning when using [src] in a destination column or [dst] in a
      source column.

    These warnings may now be suppressed by setting IPSET_WARNINGS=No
    in shorewall.conf and/or shorewall6.conf.

5)  The evolution of the Shorewall installation process
    continues. Testers are invited to provide comments and suggestions
    about the following.

    Beginning with this release, the installers accept a configuration
    file as a parameter. Options set in the configuration file are as
    follows:

    BUILD (optional)   -- Platform on which the installation is being
    	  	     	  performed. Possible values are:

			  apple - OS X
			  archlinux - ArchLinux
			  cygwin - Cygwin running under Windows
			  debian - Debian and derivatives
			  linux - Generic Linux system
			  redhat - Fedora, RHEL and derivatives
			  suse - SLES and OpenSuSE
			
			  If no value is assigned, then the installer
			  will detect the platform.

    HOST (Optional)    -- Allowed values are same as for BUILD. If not
    	 	          specified, the BUILD setting is used.

    CONFDIR (Req'd)    -- Directory where product configuration
    	    	       	  directory is installed. Normally /etc.

    SHAREDIR (Req'd)   -- Directory where architecture-independent
    	     	     	  product files are installed. Normally
    	     	     	  /usr/share.

    LIBEXECDIR (Req'd) -- Directory where product executables are
    	       	          installed. Normally /usr/share or
    	       	          /usr/libexec.

    PERLLIBDIR (Req'd) -- Directory where Shorewall Perl modules are
    	       	       	  to be installed. Traditionally
    	       	       	  /usr/share/shorewall.
 
    SBINDIR (Req'd)    -- Directory where product CLI programs are
    	    	          installed. Normally /sbin

    MANDIR (Req.d)     -- Directory where manpages are
    	   	          installed. Mornally /usr/share/man.

    INITFILE (Optional)
                       -- Optional. If given, specifies the installed
		       	  filename of the initscript. Normally 
			  set to $PRODUCT which the installers expand
			  to the name of the product being installed.
			  If not specified, no init script will be
			  installed.

    INITSOURCE (Optional)
                       -- Must be specified if INITFILE is specified. 
		          Gives the name of the file to be installed
			  as the INITFILE. 

    INITDIR (Optional) -- Directory where SysV init scripts are
    	    	          installed. Must be specified if INITFILE is
    	    	          specified.

    ANNOTATED (Optional) 
                       -- If non-empty, indicates that the
    		       	  configuration files are to be annotated with
			  manpage information. Normally empty.

    SYSTEMD (Optional) -- Name of the directory where .service files
    	    	       	  are to be installed. Should only be specified
    	    	       	  on systems running systemd.

    SYSCONFDIR (Optional)
                       -- Name of the directory where subsystem
    		          init configuration information is stored. 
			  On Debian and derivates, this is
    			  /etc/default.  On other systems, it is
			  /etc/sysconfig.

    SYSCONFFILE (Optional) 
                       -- Name of the file to be installed in the
		          SYSCONFIGDIR. The installed name of the file
			  will always be the product name (shorewall,
    			  shorewall-lite, etc.)

    SPARSE (Optional)  -- If non-empty, causes only the .conf file to
    	   	          be installed in
    	   	          ${CONFDIR}/${PRODUCT}/. Otherwise, all of 
			  the product's skeleton configuration files
			  will be installed.

    TEMPDIR (Optional) -- If non-empty, the generated firewall script
    	    	       	  will export the variable TMPDIR with 
			  value $TEMPDIR.

    VARDIR (Required)  -- Directory where product state information
    	   	          is stored. Normally /var/lib.

			  This setting was previously stored in the
			  optional vardir file in the product's 
			  configuration directory.

    Each of the product tarballs contains a set of configuration files
    for the various HOSTS: 

    	shorewallrc.apple
    	shorewallrc.archlinux
	shorewallrc.cygwin
    	shorewallrc.debian
    	shorewallrc.default (for HOST 'linux')
	shorewallrc.redhat
	shorewallrc.suse

    To aid distribution packagers, a configure script has been added.
    The arguments to the script are the usual list of <option>=<value>
    assignments. The supported options are the same as those above,
    although they may be in lower case and may be optionally preceded
    by '--'.

    The configure script uses the setting of --host to select the
    appropriate rc file. It reads that file to establish default
    settings and then applies the values specified in the argument
    list. To allow use with the %configure RPM macro, only the last
    occurrence of a particular option setting is applied. The resulting
    settings are written to a file named 'shorewallrc' in the current
    working directory and are also written to standard out.

    When Shorewall-core is installed on a system (with no DESTDIR), it
    copies the specified configuration file into root's
    ~/.shorewallrc. The ~/.shorewallrc file is then used, by default,
    when installing the other packages.

    To further aid use with %configure, several aliases are supported:

       alias   	       option
       -----           ------
       sharedstatedir  vardir
       datadir	       sharedir
       sysconfdir      confdir

    The configuration file is also copied to
    ${SHAREDIR}/shorewall/shorewallrc where the CLI programs and init
    scripts can find it. Those programs are modified by the installer
    when ${SHAREDIR} is not /usr/share.

    When using Shorewall-lite or Shorewall6-lite, if the remote
    firewall's shorewallrc file differs from that on the firewall, then
    a copy of the remote file should be placed in the firewall's
    configuration directory on the administrative system.

    Beginning with this release, using /etc/shorewall-lite/vardir
    and /etc/shorewall6-lite/vardir to specify VARDIR is deprecated in
    favor of the VARDIR setting in shorewallrc.

        NOTE: While the name of the variable remains VARDIR, the
              meaning is slightly different. When set in shorewallrc,
              each product (shorewall-lite, and shorewall6-lite) will
              create a directory under the specified path name to
	      hold state information.

	      Example:

		  VARDIR=/opt/var/lib/

		  The state directory for shorewall-lite will be
		  /opt/var/lib/shorewall-lite/ and the directory for
		  shorewall6-lite will be /opt/var/lib/shorewall6-lite.

	      When VARDIR is set in /etc/shorewall[6]-lite/vardir, the
	      product will save its state in the specified directory.

----------------------------------------------------------------------------
             P R O B L E M S  C O R R E C T E D  I N  4 . 5 . 1
----------------------------------------------------------------------------

4.5.1.1

1)  When checking or compiling for export (-e option), /sbin/shorewall
    would previously issue a warning message if the SHOREWALL_SHELL
    specified in the remote firewall's shorewall.conf did not exist.

2)  The changes to TOS handling in 4.5.1 are incompatible with older
    releases such as RHEL5 and derivatives. That has been corrected.

3)  The rules compiler now verifies that the protocol is TCP, UDP, SCTP
    or DCCP when checking a port range (low:high or low-high).

4)  Previously, start or restart using the init script would fail with
    an error message referencing 'SHOREWALL_INIT_SCRIPT'. This defect
    was not visible to users that set AUTOMAKE=Yes or that run
    Shorewall-init.

4.5.1

1)  This release includes all defect repair from versions
    4.5.0.1-4.5.0.3.

2)  The Shorewall-init installer now installs the proper init script on
    Redhat and Fedora.

3)  A typo has been corrected in the blrules man pages.

4)  Previously, if the interface appearing in the HOSTS column of
    /etc/shorewall6/hosts was not defined in
    /etc/shorewall6/interfaces, then the compiler would terminate with
    a Perl diagnostic:

      	   Can't use an undefined value as a HASH reference at
      	   /usr/share/shorewall/Shorewall/Zones.pm line 1817,
      	   <$currentfile> line ...

5)  The handling of the LIBEXEC and PERLLIB variables was broken in the
    base 4.5.0 release. Simon Mater has supplied a fix which is
    included in this release.

6)  On systems running systemd, init scripts are no longer installed in
    /etc/rc.d/init.d.

7)  The Shorewall Init installer now correctly detects the use of
    systemd.

8)  On systems running systemd, the installer now installs
    /sbin/shorewall-init. That file has not existed previously, even
    though shorewall-init.service is trying to use it.

9)  The compiler was previously failing to validate the contents of the
    LENGTH and TOS columns in /etc/shorewall/tcrules. The contents of
    those columns are now validated by the compiler and an appropriate
    error message is issued if validation fails.

10) The column headings in the tos files are now in the proper
    order. Previously, the SOURCE PORT and DEST PORT columns were
    reversed.

----------------------------------------------------------------------------
                    N E W  F E A T U R E S  I N  4 . 5 . 1
----------------------------------------------------------------------------

1)  Support is now included for IMQ. This takes the form of of
    IMQ(<number>) in the MARK/CLASSIFY column of
    /etc/shorewall/tcrules.

2)  It is no longer necessary to specify a MARK value for the default
    class under a device that does not specify the 'classify'
    option. Simple set the MARK column to '-' in the default class.

3)  Previously, the install scripts included in the Shorewall packages
    were very restrictive. They could either be run to install directly
    onto the system in a distribution-dependent way, or they could
    install into a directory in a distribution-independent way. This
    limited their usefullness to packagers.

    Beginning with this release, the install scripts handle the install
    system and the target system independently. When running an
    installer, the following environmental variables can be set:

    a)  BUILD - Describes the system where the installer is
        running. Accepted values are:

	    cygwin    - Cygwin running under a Microsoft OS
	    apple     - OS X
	    debian    - Debian,Ubuntu,etc.
	    redhat    - Fedora,RHEL,Centos,Foobar,etc.
	    slackware - Slackware
	    archlinux - Arch Linux
	    linux     - Generic Linux
	    
        If BUILD is not set, then the installer uses its existing
        algorithm for detecting the current OS and distribution.

    b)  HOST - Describes the system where the installed package
        will run.

	- For Shorewall and Shorewall6, the possible values are
          the same as for BUILD.

        - If HOST is not set, the value of BUILD (through setting or
          detection) is used.
    
        - For Shorewall-lite and Shorewall6-lite, the possible choices
          are debian,  redhat, suse, slackware, archlinux and
          linux.

    	- For Shorewall-init, the possible choices are debian,
          redhat, and suse.

    c)  INITDIR - Gives the absolute path name of the directory
    	containing the init scripts.

    The choice of HOST and TARGET follow the naming of similar macros
    in rpm and autoconf.

    As part of these changes, LIBEXEC and PERLLIB must now hold an
    absolute pathname. So, for example, if you have been using

    	LIBEXEC=libexec

    you will need to change to

        LIBEXEC=/usr/libexec

    Additionally, support has been added for sourcing a file containing
    option settings. The file name is 'shorewall-pkg.config' in the
    parent directory of the untar'ed package file.

5)  The .spec files included with each package have undergone
    considerable revision.

    When running the package ./install.sh script:

    a) The setting for LIBEXEC is taken from the standard '_libexecdir'
       rpm macro.

    b) The setting for PERLLIB is taken from the standard
       'perl_privlib' rpm macro.

    c) The setting for INITDIR is taken from the standard
       '_initddir' rpm macro.

    d) The setting of BUILD is detected by the install script.

    e) The setting for TARGET is taken from the standard '_vendor' rpm
       macro.

    The rpms included with Shorewall are built with these settings of
    the standard rpm-supplied macros:

    	%_libexecdir  	   	/usr/libexec
        %perl_privlib		/usr/share/shorewall
	%_initddir		/etc/init.d
	%_vendor		suse
 
    The setting of %perl_sitelib is chosen for portability, since there
    seems to be no common location for site-specific Perl modules among
    the rpm-based distributions.

6)  A SWITCH column has been added to /etc/shorewall/masq. This column
    allows for enabling and disabling a rule based on a setting in
    /proc/net/nf_condition. See shorewall-masq(5) for details.

7)  The rules compiler now issues a warning when the 'src' ipset flag
    is used in a destination column or the 'dst' ipset flag is used in
    a source column.

8)  Support has been added for matching and setting the "Differentiated
    Services Code Point" (DSCP) field in the IP header. See
    shorewall-tcrules(5) and shorewall6-tcrules(5) for details.

9)  "Run-time gateway variables" are now supported. These variables
    have names that are composed of a percent sign ('%') followed by
    the logical name of an interface defined in
    /etc/shorewall/interfaces. They are expanded to the IP address of
    the default gateway out of the corresponding interface.

    Example: 

    %eth0 expands to the IP address of the default gateway out of eth0.

    See
    http://www.shorewall.net/configuration_file_basics.htm#Variables
    for details.

10) The 'update' command now omits non-default settings of
    WIDE_TC_MARKS and HIGH_ROUTE_MARKS from the updated .conf file.

11) The 'isusable' extension script is no longer installed by
    default. Users wishing to install it may simply copy it from
    /usr/share/shorewall[6]/configfiles. 

12) Support has been added for seting the "Type of Service" (TOS)
    header field in shorewall-tcrules(5) and shorewall6-tcrules(5). See
    the manpages for details. As part of this change, use of the
    shorewall-tos(5) and shorewall6-tos(5) files is deprecated and a
    warning is issued on the first rule in each file.

----------------------------------------------------------------------------
             P R O B L E M S  C O R R E C T E D  I N  4 . 5 . 0
----------------------------------------------------------------------------

4.5.0.3

1)  The .service file with Shorewall Init specified that
    /sbin/shorewall-init should be run for start and stop, but there
    was no such file.

    Now, the installer will install /sbin/shorewall-init and will omit
    installing /etc/rc.d/init.d/shorewall-init when systemd is being
    used.

2)  If the variable DEBUG was set to a non-empty value in the environment
    or in /etc/shorewall/params, then 'shorewall stop' and 'shorewall
    clear' would not totally remove the old ruleset and a subsequent
    'shorewall start' would fail.

3)  'shorewall trace stop' or 'shorewall trace clear' would previously
    fail to remove the entire ruleset.

4.5.0.2

1)  The init scripts from shorewall.net that were installed on systems
    other than Redhat-based and Debian-based systems were broken.
    
    '/etc/init.d/shorewall start' and /etc/init.d/shorewall restart'
    failed with:

    	 "ERROR: No directory 'start'"

    or

	"ERROR: No directory 'restart'"

2)  The Shorewall-init installer now works correctly when installing
    the product on a Redhat-based distribution.

4.5.0.1

1)  The handling of the LIBEXEC and PERLLIB variables was broken in the
    base 4.5.0 release. Simon Mater has supplied a fix which is
    included in this release.
    
2)  A typo has been corrected in the blrules man pages.

3)  Previously, if the interface appearing in the HOSTS column of
    /etc/shorewall6/hosts was not defined in
    /etc/shorewall6/interfaces, then the compiler would terminate with
    a Perl diagnostic:

      	   Can't use an undefined value as a HASH reference at
      	   /usr/share/shorewall/Shorewall/Zones.pm line 1817,
      	   <$currentfile> line ...

4)  The Shorewall-init installer now installs the correct init script
    on Fedora and Redhat systems.

4.5.0

1)  This release includes all defect repair included in
    4.4.27.1-4.4.27.3.

2)  The start and restart commands in Shorewall Lite and Shorewall6
    Lite now correctly handle the 'trace' and 'debug'
    keywords. Previously, those keywords were ignored.

3)  The 'ip route list' command on recent Linux systems (Ubuntu 11.10,
    for example) displays the IPv4 routing table in a seemingly random
    order. In the 'show routing' and 'dump' commands, Shorewall and
    Shorewall-lite now sort the output into the traditional
    'Most-specific to most-general' order.

4) Previously, specifying 'No' in the HAVEROUTE column of
    /etc/shorewall6/proxyndp resulted in a run-time error. The code has
    been corrected so that no error occurs.

----------------------------------------------------------------------------
                    N E W  F E A T U R E S  I N  4 . 5 . 0
----------------------------------------------------------------------------

1)  The rules generated by the following interface options are now
    traversed after those generated by the blrules file.

	dhcp
	maclist
    	nosmurfs
	sfilter
        tcpflags

    As part of this change, the BLACKLIST section in the rules file has
    been eliminated. If you have rules in that section, you must move
    them to the blrules file prior to installing this Shorewall
    version.

2)  The timeout interval after which the previous state is restored 
    may now be specified in the safe-start and safe-restart commands.

3)  The packing of the Shorewall products has been changed. Beginning
    with this release, the packages are:

    - Shorewall Core  -- Core libraries installed in
      		         /usr/share/shorewall/

    - Shorewall       -- Requires Shorewall Core. Together with
                         Shorewall Core, provides IPv4 firewalling.

    - Shorewall6      -- Requires Shorewall. Provides IPv6 firewalling.

    - Shorewall Lite  -- Requires Shorewall Core. As before.

    - Shorewall6 Lite -- Requires Shorewall Core. As before.

    - Shorewall Init  -- As before.

4)  Shorewall and Shorewall6 now share a single install.sh file as do
    Shorewall Lite and Shorewall6 Lite.

5)  Functions common to both /usr/share/shorewall/prog.header and
    /usr/share/shorewall/prog.header6 are now in a new library -
    lib.core. The files /usr/share/shorewall/prog.footer is now used
    for both IPv4 and IPv6.

6)  Run-time address variables (e.g., &eth0) may now be used in the
    SOURCE column of the rtrules files.

7)  The route_rules file has been renamed to 'rtrules'. The Shorewall
    and Shorewall6 installers will perform the rename on an existing
    file.

    If both files exist, route_rules will be processed and rtrules 
    will be ignored with a warning.

8)  A 'PROBABILITY' column has been added to the tcrules files. It
    causes the rule to match randomly with the probability specified in
    the column. See shorewall-tcrules(5) and shorewall6-tcrules(5) for
    details.

9)  An alternative to the balance=<weight> option in the providers file
    is now available. This alternative works when there are multiple
    links to the same ISP where both links use an ethernet interface (as
    opposed to PPP0E) and have the same default gateway.

    As part of this change, the generated firewall script now
    automatically maintains the
    /var/lib/shorewall[6][-lite]/interface.status files used by SWPING
    and by LSM.

    See http://www.shorewall.net/MultiISP.html#load for additional
    information.

    Example that sends 1/3 of the connections to the ComcastC provider
    and the rest to ComcastB:

    /etc/shorewall/shorewall.conf

    MARK_IN_FORWARD_CHAIN=No
    ...
    USE_DEFAULT_RT=Yes

    /etc/shorewall/providers:

    #NAME    NUMBER MARK DUP  INTERFACE GATEWAY       OPTIONS
    ComcastB 1      -    -    eth1      70.90.191.126 loose,balance,load=0.66666667
    ComcastC 2      -    -    eth0      67.170.120.1  loose,fallback,load=0.33333333

    Note: The 'loose' option is specified so that the compiler will not
    	  generate and rules based on interface IP addresses. That way
	  we have complete control over the priority of such rules 
	  through entries in the rtrules file.

    /etc/shorewall/rtrules

    #SOURCE             DEST  PROVIDER  PRIORITY
    70.90.191.120/29    -     ComcastB  1000
    &eth0	    	-     ComcastC  1000

    Note: eth0 has a dynamic address, so &eth0 is used in the SOURCE
    	  column.

    Note: Priority = 1000 means that these rules will come before rules
    	  that select a provider based on marks.

10) The Shorewall files in /etc/default and /etc/sysconfig now support
    two new options that affect how '/etc/init.d/shorewall start' 
    and '/etc/init.d/shorewall restart' behave:

    STARTOPTIONS   -- options to the start commmand.
    RESTARTOPTIONS -- options to the restart command.

    For example, if you always want 'start' to flush the conntrack
    table, then you would have:

    	   STARTOPTIONS="-p"

11) The Git repository has been reorganized to place the samples and
    manpages under their corresponding product directories. For
    example, trunk/manpage6 was moved to trunk/Shorewall6/manpages.

PK      O[¨#ô¼      changelog.txtnu W+A„¶        Changes in 4.5.4 Final

1)  Update the release documents.

2)  Remove quotes from GEOIPDIR setting.

3)  Add macro.MSSQL.

4)  Complete disabling of level 1 optimization when level 4 is set.

Changes in 4.5.4 RC 2

1)  Remove GeoIP from Shorewall6/actions.std

2)  Minor cleanup of geoip; mostly documentation

Changes in 4.5.4 RC 1

1)  Use 'blackhole' routes rather than 'unreachable' for null-routing
    RFC1918 addresses.

2)  Don't overwrite empty mark geometry settings during update.

3)  Additional optimization under level 4.

4)  Allow bracketing of CC lists in [...]

5)  Load country codes from geoip database.

6)  Clear the DEFAULT table if no fallback providers are up.

Changes in 4.5.4 Beta 3

1)  Replace {...} with '^' prefix to denote CC list.

Changes in 4.5.4 Beta 2

1)  Clear the balance table if no balanced providers.

2)  Use "(S)" consistently in column headings.

3)  Correct add of default IPv6 when no gateway

4)  Update .status file on 'disable'.

5)  Ignore 'isusable' on 'disable'

6)  Split a couple of functions with address-family dependent logic.

7)  Don't allow RSTs to be rejected

8)  Exit the tcpost chain if a connection mark is restored

9)  Add geoip support.

Changes in 4.5.4 Beta 1

1)  Correct nested conditional defect.

2)  Re-implement TPROXY

Changes in 4.5.3 Final

1)  Update release documents.

2)  Add RST Action.

3)  Remove a couple of hard-coded '/usr/share' instances.

4)  Allow synonyms for column names in the alternate specification
    formats.

5)  Allow COMMENT by itself in the tunnels file.

Changes in 4.5.3 RC 1

1)  Print out include/openstack in warning and error messages.

2)  Fix manual chain invocation in macro.

3)  Make BLACKLIST use blacklog

Changes in 4.5.3 Beta 2

1)  Use format 2 for all interfaces files.

2)  Fix the installers WRT Debian startup on boot.

3)  Enhance 'refresh' command.

Changes in 4.5.3 Beta 1

1)  Eliminate read_a_line1().

2)  Add the -T option to the load, reload, restart and start commands.

3)  Improve debuggability of assertion failures.

4)  Allow multiple tunnel gateways.

Changes in 4.5.2.1

1)  Added configure.pl script to allow rpm builds on old systems.

2)  Correct INCLUDE inside an ?IF ... ?ENDIF

3)  Add comments to shorewallrc files.

4)  Correct a couple of defects in the shorewallrc files.

5)  Modify Makefiles if directories non-standard.

6)  configure[.pl] improvements.

Changes in 4.5.2 Final

1)  Update release documents.

2)  Don't strip comments in embedded Perl and Shell because it can
    lead to an un-terminated string when '#' appears in a string.

3)  Don't suppress whitespace in embedded Perl and Shell.

Changes in 4.5.2 RC 1

1)  Update release documents.

2)  Remove several more absolute pathnames.

3)  Deimplement option '?' in BEGIN and END directives.

4)  Allow ?IF, ?ELSE and ?END in embedded Perl and Shell.

Changes in 4.5.2 RC 1

1)  Update release documents.

2)  Allow remote firewalls with a different directory structure.

3)  Fix a lot of bugs.

4)  Avoid modifying shorewallrc variables (except VARDIR).

Changes in 4.5.2 Beta 5

1)  Eliminate 'local file' error in installers.

2)  Make requested change to the shorewallrc.suse file.

3)  Add aliases to configure.

4)  Fix 'nets=' with 'dhcp'.

Changes in 4.5.2 Beta 4

1)  Add a configure script

2)  Expand the places where .shorewallrc can be found.

Changes in 4.5.2 Beta 3

1)  Fix syntax error in init.sh

2)  Fix shorewall-core.spec

3)  Modify Redhat/Fedora init scripts for shorewallrc.

Changes in 4.5.2 Beta 2

1)  Fix conditional compilation.

2)  Add IPSET_WARNINGS option.

3)  Add configuration files to track where Shorewall components are
    installed.

Changes in 4.5.2 Beta 1

1)  Implement 'mss=' in the hosts file.

2)  Implement conditional compilation.

3)  Promote a couple of zone options out of the 'options' hash.

4)  Remove the 'nexted' zone option.

5)  Rename the MARK/CLASSIFY column to ACTION

Changes in 4.5.1 Final

1)  Update release documents.

Changes in 4.5.1 RC 1

1)  Update release documents.

2)  Don't automatically install 'isusable'

3)  Clean up TOS handling

Changes in 4.5.1 Beta 3

1)  Add support for packager's config file

2)  Implement run-time gateway variables.

3)  Add /sbin/shorewall-init

4)  Don't copy non-default mark layout settings during update.

Changes in 4.5.1 Beta 2

1)  Remove some cruft from the Zones module.

2)  Collapse the three 'dont_' members of the chain table into a single
    'optflags' member.

3)  Add DSCP match and target support.

4)  Rework install.sh scripts and .spec files.

5)  Fix standard init files.

Changes in 4.5.1 Beta 1

1)  Add IMQ support.

2)  Remove requirement to supply a mark value on the default class.

3)  New install script structure.

4)  Give warning when opposite flag is used in an ipset invocation.

5)  Add a SWITCH column to the masq file.

6)  Correct a typo in the blrules files.

7)  Eliminate compiler crash from unknown IPv6 interface.

Changes in 4.5.0 Final

1)  Update release documents.

Changes in 4.5.0 RC 2

1)  Correct 'get_routed_networks()' in lib.core.

2)  Move Samples and Manpages under their corresponding product
    directories.

Changes in 4.5.0 RC 1

1)  Sort the routing table in 'show_routing'.

2)  Restore shorewall-init functionality.

3)  Correct 'ip -p route' commands for Proxy NDP.

Changes in 4.5.0 Beta 4

1)  Implement load=<load-factor>

2)  Add STARTOPTIONS and RESTARTOPTIONS to /etc/default/shorweall*
    (/etc/sysconfig/shorewall*).

3)  Ensure a routing rule targeting the main table when
    USE_DEFAULT_RT=Yes.

Changes in 4.5.0 Beta 3

1)  Move lib.core from Shorewall-core to Shorewall.

2)  Make '0' equivalent to '-' in the IN_BANDWIDTH column.

3)  Fix MARK_IN_FORWARD_CHAIN=Yes with $FW source

4)  Allow runtime address variables in the SOURCE column of
    route_rules.

5)  Add a PROBABILITY column to the tcrules file.

6)  Don't rm /usr/share/shorewall/wait4ifup during Shorewall install.

7)  Combine prog.footer and prog.footer6

Changes in 4.5.0 Beta 2

1)  Move common routines from prog.header/prog.header6 to lib.core.

2)  Unify install between Shorewall and Shorewall6.

2)  Unify install between Shorewall-lite and Shorewall6-lite.  

Changes in 4.5.0 Beta 1

1)  Reorganize blacklist and interface option handling.

2)  Allow <timeout> on safe- commands.

3)  Add Shorewall Core package


PK      O[õÀz]F  ]F    COPYINGnu W+A„¶        		    GNU GENERAL PUBLIC LICENSE
		       Version 2, June 1991

 Copyright (C) 1989, 1991 Free Software Foundation, Inc.
                          51 Franklin Street, Fifth Floor,
			  Boston, MA 02110-1301 USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

			    Preamble

  The licenses for most software are designed to take away your
freedom to share and change it.  By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users.  This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it.  (Some other Free Software Foundation software is covered by
the GNU Library General Public License instead.)  You can apply it to
your programs, too.

  When we speak of free software, we are referring to freedom, not
price.  Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.

  To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.

  For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have.  You must make sure that they, too, receive or can get the
source code.  And you must show them these terms so they know their
rights.

  We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.

  Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software.  If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.

  Finally, any free program is threatened constantly by software
patents.  We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary.  To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.

  The precise terms and conditions for copying, distribution and
modification follow.

		    GNU GENERAL PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License.  The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language.  (Hereinafter, translation is included without limitation in
the term "modification".)  Each licensee is addressed as "you".

Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope.  The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.

  1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.

You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.

  2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:

    a) You must cause the modified files to carry prominent notices
    stating that you changed the files and the date of any change.

    b) You must cause any work that you distribute or publish, that in
    whole or in part contains or is derived from the Program or any
    part thereof, to be licensed as a whole at no charge to all third
    parties under the terms of this License.

    c) If the modified program normally reads commands interactively
    when run, you must cause it, when started running for such
    interactive use in the most ordinary way, to print or display an
    announcement including an appropriate copyright notice and a
    notice that there is no warranty (or else, saying that you provide
    a warranty) and that users may redistribute the program under
    these conditions, and telling the user how to view a copy of this
    License.  (Exception: if the Program itself is interactive but
    does not normally print such an announcement, your work based on
    the Program is not required to print an announcement.)

These requirements apply to the modified work as a whole.  If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works.  But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.

Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.

In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.

  3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:

    a) Accompany it with the complete corresponding machine-readable
    source code, which must be distributed under the terms of Sections
    1 and 2 above on a medium customarily used for software interchange; or,

    b) Accompany it with a written offer, valid for at least three
    years, to give any third party, for a charge no more than your
    cost of physically performing source distribution, a complete
    machine-readable copy of the corresponding source code, to be
    distributed under the terms of Sections 1 and 2 above on a medium
    customarily used for software interchange; or,

    c) Accompany it with the information you received as to the offer
    to distribute corresponding source code.  (This alternative is
    allowed only for noncommercial distribution and only if you
    received the program in object code or executable form with such
    an offer, in accord with Subsection b above.)

The source code for a work means the preferred form of the work for
making modifications to it.  For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable.  However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.

If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.

  4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License.  Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.

  5. You are not required to accept this License, since you have not
signed it.  However, nothing else grants you permission to modify or
distribute the Program or its derivative works.  These actions are
prohibited by law if you do not accept this License.  Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.

  6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions.  You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.

  7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License.  If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all.  For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.

If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.

It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices.  Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.

This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.

  8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded.  In such case, this License incorporates
the limitation as if written in the body of this License.

  9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time.  Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.

Each version is given a distinguishing version number.  If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation.  If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.

  10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission.  For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this.  Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.

			    NO WARRANTY

  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.

  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.

		     END OF TERMS AND CONDITIONS

	    How to Apply These Terms to Your New Programs

  If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.

  To do so, attach the following notices to the program.  It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.

    <one line to give the program's name and a brief idea of what it does.>
    Copyright (C) 19yy  <name of author>

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA


Also add information on how to contact you by electronic and paper mail.

If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:

    Gnomovision version 69, Copyright (C) 19yy name of author
    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
    This is free software, and you are welcome to redistribute it
    under certain conditions; type `show c' for details.

The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License.  Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.

You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary.  Here is a sample; alter the names:

  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
  `Gnomovision' (which makes passes at compilers) written by James Hacker.

  <signature of Ty Coon>, 1 April 1989
  Ty Coon, President of Vice

This General Public License does not permit incorporating your program into
proprietary programs.  If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library.  If this is what you want to do, use the GNU Library General
Public License instead of this License.
PK        O[Qùàš¯  š¯                  releasenotes.txtnu W+A„¶        PK        O[¨#ô¼                Ú¯  changelog.txtnu W+A„¶        PK        O[õÀz]F  ]F              É  COPYINGnu W+A„¶        PK      ä   ®   