table entries in case of an error with commands adding new routing
entries was broken and left the machine with no routes at all.
Also, using mktemp to create temporary directory. If mktemp is not
available, fall back onto less secure but guaranteed to work method
where I generate randomized the name of the temporary directory using
process ID.
command to set /proc variable
/proc/sys/net/ipv4/conf/all/promote_secondaries that makes the kernel
"promote" secondary address to a "primary" status when primary address
is deleted. Default behavior in Linux kernel is to delete all
addresses when primary address is deleted.
command to set /proc variable
/proc/sys/net/ipv4/conf/all/promote_secondaries that makes the kernel
"promote" secondary address to a "primary" status when primary address
is deleted. Default behavior in Linux kernel is to delete all
addresses when primary address is deleted.
deprecated". Need to use --match-set instead of --set if iptables
version is >= 1.4.4. The fix done for #3059893 was only in the policy
compiler but needs to be done in both policy and nat compilers.
parent bridge interface. This allows us to correctly match which
bridge the packet comes through in configurations using wildcard
bridge port interfaces. For example, when br0 and br1 have "vnet+"
bridge port interface, iptables can still correctly match which bridge
the packet went through using "-o br0" or "-o br1" clause. This can be
useful in installations with many bridged interfaces that get created
and destroyed dynamically, e.g. with virtual machines. Note that the
"-i br0" / "-o br0" clause is only added when there is more than one
bridge interface and bridge port name ends with a wild card symbol "+"
iptables script uses "which" to check if all utilities it uses exist
on the machine. We should also check if "which" itself exists and
issue meaningful error message if not.
direct broadcast addresses. When interface of the firewall is
configured with netmask /31, policy compilers should not treat the
second address of this "subnet" as a broadcast.
iptables INPUT chain". Compiler was choosing chain INPUT with
direction "outbound" for rules that had old broadcast address in
"Source", this lead to invalid iptables configuration with chain INPUT
and "-o eth0" interface match clause.
fixed bug in the rule processor that replaces AddressRange object that
represents single address with an IPv4 object. Also eliminated code
redundancy.
row". Under certain circumstances, editing rule comment caused the GUI
to collapse corresponding row in the rule set view so that only the
first object of each rule element that contained several objects was
visible.
br0.5)". Currently fwbuilder can not generate script to configure vlan
subinterfaces of bridge interfaces, however if user did not request
this configuration script to be generated, compiler should not abort
when it encounters this combination.
for PF and iptables should include not only cluster interfaces, but
also interfaces of all members. This way, we can make compiler
generate configuration
"pass in quick on em0 route-to { ( em0 10.1.1.2 ) } ... "
for a rule of a PF cluster. Here "em0" is an interface of a member,
not the cluster.
macro "ESP" that happened during build on OpenSolaris
fixed unit test (ObjectMatcher matches ipv6 only when internal flag is
set accordingly)
set version to 5.0.1
config". Compiler for PF can now preserve names of object groups,
dynamic groups, compile-time AddressTable and compile-time DNSName
objects in the generated pf.conf file. This is optional and is
controlled by a checkbox in the firewall settings dialog.
ignored". Since we can not import address lists or tables that contain
a mix of negated and non-negated items, importer should display an
error when it enounters one of these and mark all rules that use it as
"broken" (rule is colored red and error message is added to the
comment).
macros". If pf.conf file uses an undefined macro (there is $macro
somewhere but the macro has never been defined), importer issues a
warning, creates run-time DNSName object with the name "$macro" and
marks all rules where it is used as broken, that is, rules are colored
red and the error message is added to the comment field. Using
run-time DNSName object makes compiler use "$macro" in the generated
pf rule which means fwbuilder generates exactly the same pf rule as
the one it tried to import.
where possible". Importer for PF recognizes macros that define lists
of ip addresses, interfaces or host names and creates object groups
with the same name from them. Only macros that contain at least one
ip address in the list are recognized.
are not supported". Importer for PF should interpret macro
definitions that use other macros. See #2545 "PF import error when
using macro names with same base name and incrementing digit
suffix". Importer should correctly interpret a macro that has name
of another macro as a substring of its own name.
compiler for PF does not need to generate protocol match "proto {tcp
udp icmp}" when service object used in the NAT rule is "any". The
reason this was done this way is lost in the mist of time; it's been
like this since very early versions of fwbuilder.
Vadim Kurland