Hi Mathias,

...

lines 1460 and 1469: for CHAIN in $input_zones; do --> chain=input_$chain

should be "CHAIN=input_$CHAIN".

you should send that to suse directly, ASAP. to get the right adress: rpm -qi SuSEfirewall2 and you might want to add the current/latest maintainer in a cc: to see, use rpm -qi SuSEfirewall2 --changelog and look for the newest changelog entry, there should be an email adress with it.

done, thank you. Frank

These mistakes would probably be avoided if people used set -o nounset in their scripts. It is like using -w in perl: why get your customers to debug your scripts if the interpreter does it for free? Bob On Tue, 21 Jun 2005, [iso-8859-15] Jürgen Mell wrote:

Hi List,

On Tuesday 21 June 2005 14:38, Frank Stuehmer wrote:

...

Hi list,

just tried to use fresh installed Suse 9.3 updated with you.

SuSEfirewall2-3.3-18.2

/etc/sysconfig/SuSEfirewall2 with FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes"

Start FW complains, four lines "iptables: No chain/target/match by that name"

Reasons are in /sbin/SuSEfirewall lines 1460 and 1469: for CHAIN in $input_zones; do --> chain=input_$chain

should be "CHAIN=input_$CHAIN".

Frank Stuehmer

There is another typo in line 1629 (the line-wrapping is done by kmail - originally this is one long line)

$LAA $IPTABLES -A $chain -d $net1 $snet2 $proto $rport -i $dev -j LOG \ ${LOG}"-`rulelog $CHAIN`-ACC-MASQ " -m state --state ESTABLISHED,RELATED

should probably read

$LAA $IPTABLES -A $chain -d $net1 $snet2 $proto $rport -i $dev -j LOG \ ${LOG}"-`rulelog $chain`-ACC-MASQ " -m state --state ESTABLISHED,RELATED

Bye, Jürgen

============================================================== Bob Vickers R.Vickers@cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello! Marcus Meissner schrieb:

On Tue, Jun 21, 2005 at 06:45:14PM +0200, Jürgen Mell wrote:

...

Hi List,

On Tuesday 21 June 2005 14:38, Frank Stuehmer wrote:

...

Hi list,

just tried to use fresh installed Suse 9.3 updated with you.

SuSEfirewall2-3.3-18.2

/etc/sysconfig/SuSEfirewall2 with FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes"

Start FW complains, four lines "iptables: No chain/target/match by that name"

Reasons are in /sbin/SuSEfirewall lines 1460 and 1469: for CHAIN in $input_zones; do --> chain=input_$chain

should be "CHAIN=input_$CHAIN".

Frank Stuehmer

There is another typo in line 1629 (the line-wrapping is done by kmail - originally this is one long line)

$LAA $IPTABLES -A $chain -d $net1 $snet2 $proto $rport -i $dev -j LOG \ ${LOG}"-`rulelog $CHAIN`-ACC-MASQ " -m state --state ESTABLISHED,RELATED

should probably read

$LAA $IPTABLES -A $chain -d $net1 $snet2 $proto $rport -i $dev -j LOG \ ${LOG}"-`rulelog $chain`-ACC-MASQ " -m state --state ESTABLISHED,RELATED

I have opened a bugreport for these problems and we will be fixing this.

Ciao, Marcus

There is another bug (no real bugs but useless chains): If I got a Webserver and don't use the SuSE bux as a router but only as a firewall for the webserver or whatever single nic server you get unnecesary chains: forward and dmz rules If you don't need dmz rules there is no specific rule to not set them up. For that purpose I rewrote it kind'a' more suitible for me. Next thing is I setup special rulesets for me: block internal (machines with no access to internet, e.g. printserver, ) block external (machines which do malicious stuff, standard block groups, etc.) Would be a nice feature to implement that. Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQrlP+ENg1DRVIGjBAQInMgb/WwfRmVkBt7Ozqc9hdlmn/1RQt4Hjkhal l/r8iwCPYn5Dwa9fZQutHJ72gno5RI9juzoKuNBaZmj7xOLyjwuOkHbyU0eI7z6n z8UmNZPAAfEY9lA/bVUdKLICu3XPdWmZm5hD/I0t7sc32Oz+aPNC4gEYwzhcrL3h Rcbr8DfNwing57qo6Vi2Xj1/vVKR7XzSp09HRQCRZM9AKLCoS3/fiziuMkpP17LS ObO/2lmPE89pxdUD7KTxjVdphTyo+fsZPYu67pvhJOACmL1D6UjpPqcnoBqMwpRH bpEZgEsXAys= =bwaC -----END PGP SIGNATURE-----

Frank Stuehmer wrote:

just tried to use fresh installed Suse 9.3 updated with you.

SuSEfirewall2-3.3-18.2

/etc/sysconfig/SuSEfirewall2 with FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes"

Start FW complains, four lines "iptables: No chain/target/match by that name"

Reasons are in /sbin/SuSEfirewall lines 1460 and 1469: for CHAIN in $input_zones; do --> chain=input_$chain

should be "CHAIN=input_$CHAIN".

Thanks for the report. I've prepared an update, it will take a bit until it appears in YOU though. Btw, what's your use case for this variable? I was actually thinking about dropping it. cu Ludwig -- (o_ Ludwig Nussel //\ SUSE LINUX Products GmbH, Development V_/_ http://www.suse.de/

Hello, Am Dienstag, 28. Juni 2005 15:39 schrieb Ludwig Nussel:

Bob Vickers wrote:

...

These mistakes would probably be avoided if people used set -o nounset in their scripts. It is like using -w in perl: why get your customers to debug your scripts if the interpreter does it for free?

That doesn't help as it only checks the code that is exectuted and not the whole script. If it triggers it terminates the script instantly

OK, that's an argument against using it in production environment.

[...] Furthermore there are many valid uses of unset variables, e.g. optional parameters.

Hmm - when I hear about unset variables, I have to think to PHP's register_globals which is turned off by default now for security reasons. Are you _really_ sure that using unset / not initialized variables is a good idea? (I am not.) At least you should explicitly unset or initialize these variables to avoid trouble or possible attacks. Regards, Christian Boltz -- # GO AWAY ! # YOU DO NOT WANT TO SEE THIS SCRIPT !!! [from /opt/kde3/share/apps/krpmview/setup_temp_source]

Frank Stuehmer wrote:

Ludwig Nussel schrieb:

...

...

/etc/sysconfig/SuSEfirewall2 with FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes"

Btw, what's your use case for this variable? I was actually thinking about dropping it. to tell the truth I don't know anymore :-), I use the same configuration from version to version since 7.2. Could be it was named or ftp.

I've just switch to "no" and now wait for user complaints.

Ok, I've marked FW_ALLOW_INCOMING_HIGHPORTS_* as deprecated. Let me know if it turns out that they are still needed for something :-) cu Ludwig -- (o_ Ludwig Nussel //\ SUSE LINUX Products GmbH, Development V_/_ http://www.suse.de/

Am Donnerstag, 30. Juni 2005 10:52 schrieb Ludwig Nussel:

Ok, I've marked FW_ALLOW_INCOMING_HIGHPORTS_* as deprecated. Let me know if it turns out that they are still needed for something :-)

i use it as well, because of irc dcc and similar stuff. bye, MH