Changelog for shorewall-core-5.2.8-6.2.noarch.rpm :

* Mon Feb 26 2024 Dominique Leuenberger - Use %patch -P N instead of deprecated %patchN.
* Thu Jun 15 2023 Dominique Leuenberger - Fix parameters to systemd_postun: this macro still takes the service names as parameters.
* Thu Dec 08 2022 Thorsten Kukuk - Add /etc/sysconfig/network hierachy, as this don\'t exist by default anymore
* Sat Sep 03 2022 Bruno Friedmann - Add %dir %{_distconfdir} stop build failing on Leap
* Thu Sep 01 2022 Bruno Friedmann -
*
*Warning
*
* this is the last patch revision to shorewall. No migration to manage nft will happen upstream. Be prepared to package removal, and migrate to firewalld.- Add shorewall-fix-install-manpages.patch fix boo#1203006- Update spec copyright and macros- Move /etc to /usr for Networkmanager and logrotate- Update rpmlint check list
* Mon Nov 09 2020 Bruno Friedmann - Rework xt_geo_ip fixes by using dynamic patching with find which is less burden and confusing than manual patches series.- Add dynamic patching for
*.service with removing like upstream the obsolete StandardOutput=syslog until new release
* Sun Nov 08 2020 Togan Muftuoglu - Correct the xt_geo_ip locations- Correct output to journal
* Sat Sep 26 2020 Bruno Friedmann - Update to version 5.2.8 (Upgrade your configuration) https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.8/releasenotes.txt + Certain restrictions that apply to wildcard interfaces (interface name ends in \'+\') were previously not enforced when the logical interface name did not end in \'+\' but the physical interface name did end in \'+\'. That has been corrected. + To ensure that error messages appear in the correct place in the output stream, stderr is now redirected to stdout when the configured PAGER is used by a command. + Since Shorewall 5.1.0, the Shorewall uninstall.sh script has incorrectly removed ${SBINDIR}/shorewall, while the Shorewall-core uninstall.sh script has failed to remove that file. Both scripts have been corrected. + Previously, the Shorewall CLI included a spurious hyphen (\'-\') between the product name (e.g., \'Shorewall6\') and the version when printing a command output banner. + The shorewall-snat(5) manpage previously stated that a comma-separated list of IP address could be specified for SNAT. That statement was in error and has been removed. As part of this change, IPv4 Example 6 has been updated to use the PROBABILITY column. - New features + \'show tc\' command now shows the classifiers associated with each interface (as displayed by the \'show classifiers\' command). This integrated qdisc/filter information is also included in the output of the \'dump\' command. This change deprecates the \'show classifiers\' (\'show filters\') command, as that command\'s output is now included in the \'show tc\' output. + Shorewall6 has traditionally generated rules for IPv6 anycast addresses. These rules include: a) Packets with these destination IP addresses are dropped by REJECT rules. b) Packets with these source IP addresses are dropped by the \'nosmurfs\' interface option and by the \'dropSmurfs\' action. c) Packets with these destination IP addresses are not logged during policy enforcement. d) Packets with these destination IP addresses are processes by the \'Broadcast\' action. Beginning with this release, individual network interfaces can be excluded from this treatment through use of the \'omitanycast\' option in /etc/shorewall6/interfaces. Note: This option was named \'noanycast\' in earlier Beta releases. + Duplicate function names have been eliminated between the Shorewall-core lib.cli shell library and the Shorewall lib.cli-std library. + The \'status\' command in Shorewall[6]-lite now precedes the configuration directory name with the administrative host name separated with a colon (\":\"). + Tuomo Soini has contributed a macro that handles NFS v1.4 (no dynamic ports).- Packaging: + Add buildrequires for pkgconfig (missing) + Use macro for sbindir
* Sat Aug 22 2020 Bruno Friedmann - Update to version 5.2.7 +
*
*Upgrade your configuration
*
* https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.7/releasenotes.txt + Previously, it was not possible to classify traffic by destination IP address when using an Intermediate Functional Block (IFB) for traffic shaping. This is because such classification takes place before the traffic passes through the mangle PREROUTING chain. Such filtering is now possible by setting the \'connmark\' option in the tcdevices file. This option causes the current connection mark to be copied to the packet mark prior to filtering, thus allowing the packet mark to be used for classification. This change adds a new CONNMARK_ACTION capability which is required to be able to specify the \'connmark\' option. + The tcpri file now supports ?FORMAT 2 which inserts an SPORT column directly to the right of the PORT column. As part of this change, the PORT column is renamed to DPORT while allowing both \'port\' and \'dport\' to be used in the alternate input format. See shorewall-tcpri(5) and http://shorewall.org/simple_traffic_shaping.html for additional information. + The Simple TC document is now linked to FAQs 97 and 97a.
* Tue Jul 07 2020 Bruno Friedmann - Update to version 5.2.6 +
*
*Upgrade your configuration
*
* https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.6/releasenotes.txt + When compiling for export, the compiler generates a firewall.conf file which is later installed on the remote firewall system as ${VARDIR}/firewall.conf. Previously, the CLI on that firewall was not processing the file, resulting in some features not being available: - Default values for VERBOSITY, LOGFILE, LOGFORMAT, PATH, SHOREWALL_SHELL, SUBSYSLOCK, RESTOREFILE, RESTART, DYNAMIC_BLACKLIST and PAGER are not supplied. - scfilter file supplied at compile time. - dumpfilter file supplied at compile time. That has been corrected. + A bug in iptables (see https://git.netfilter.org/iptables/commit/?id=d1555a0906e35ba8d170613d5a43da64e527dbe1) prevents the \'--queue-cpu-fanout\' option from being applied unless that option is the last one specified. Unfortunately, Shorewall places the \'--queue-bypass\' option last if that option is also specified. This release works around this issue by ensuring that the \'--queue-cpu-fanout\' option appears last. + The -D \'compile\', \'check\', \'reload\' and \'Restart\' option was previously omitted from the output of \'shorewall help\'. It is now included. As part of this change, an incorrect and conflicting description of the -D option was removed from the \'remote-restart\' section of shorewall(8). + Previously, when EXPAND_POLICIES=No, chains that enforced ACCEPT policies were not completely optimized by optimize level 2 (ACCEPT rules preceding the final unconditional ACCEPT were not deleted). That has been corrected such that these rules are now optimized.