ipcop-devel Mailing List for IPCop Firewall

Hi

I can't seem to initiate a connection from the web interface. However, I can
get the ADSL modem to connect by manually running /etc/rc.d/rc.red start at
a console.

Errors in /var/log/messages only say 'Dial failed: 512' or 'Dial failed:
6400'

The Disconnect button on index.cgi DID work though?!

Also, the 'Manual' radio button in the Reconnection section on the PPP setup
page also seems to be a bit flaky, sometimes on, sometimes refusing to
display, even though it was selected.

Not sure if the problems lie within dial.cgi, index.cgi, or pppsetup.cgi.
Any pointers to where I should be looking?

Regards.

Eric 

hi,
i tried to install 1.4.0a12. unfortunately isdn fails with error 512.

http-install
avm fritz pci 1.0
amd kIII-450

albi

__________________________________________________________________
Stiftung Warentest vergibt Note "gut" für Lycos Mail!
Top SPAM- und Virenschutz, 15MB Megaspeicher und SMS schon ab 5 Cent!  <br> Noch Fragen? http://mail.lycos.de

That's pretty much SOP here in the US as well for anyone who'll supply a 
static IP.  Most of the cable companies do the same as well even if you 
don't have a static.  If your MAC isn't in the list you won't get an IP 
from the DHCP server.



At 04:29 AM 2/27/2004, Markus A. Madlener wrote:
>same thing here in austria,
>some ISPs which give you a static ip through a cable modem, only allow
>this ip from a specific MAC address (mostly via DHCP),
>i don't know about the rest of the world, but almost all cable modem ISPs
>in austria in AT do this
>
>markus
>
>On 25-Feb-2004 Darren Critchley wrote:
> > Alan Hourihane wrote:
> >> On Tue, Feb 24, 2004 at 10:26:16PM -0000, ViRuZ wrote:
> >>> My ISP restricts its cable modem to a single MAC address. So to save
> >>> having to enter every MAC address for each new card I bought. I set
> >>> the MAC to 00:11:22:33:44:55 and each time I reinstall IPCop I've
> >>> got to edit the rc.netaddress.up and add 'iptables eth1 hw ether
> >>> 00:11:22:33:44:55' to the red section. Then reboot the machine so it
> >>> gets the address and sets its self up right.
> >>
> >> That's one seriously messed up ISP if you have to do that - which ISP
> >> is
> >> it for reference ?
> >
> > No it is not a messed up ISP, that is a common was of doing things in North
> > America - Canada in particular. The Cable companies will let you hook up
> > anything, but DSL companies usually require the registration of a MAC
> > adapter (to a maximum of two then you pay for more). It keeps people in
> > compliance with the number of computers live on the web.
> > This is also how many of the DSL companies hand out a static IP address (it
> > is actually handed out based on your MAC adapter using DHCP).
> >
> > I do not know if this same thing is going on in the States or not, but we
> > have a lot of it in Canada and the ability to spoof a MAC would be nice.
> >
> > Darren
> >
> >
> >
> > -------------------------------------------------------
> > SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> > Build and deploy apps & Web services for Linux with
> > a free DVD software kit from IBM. Click Now!
> > http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
> > _______________________________________________
> > IPCop-devel mailing list
> > IPC...@li...
> > https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>
>
>-------------------------------------------------------
>SF.Net is sponsored by: Speed Start Your Linux Apps Now.
>Build and deploy apps & Web services for Linux with
>a free DVD software kit from IBM. Click Now!
>http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
>_______________________________________________
>IPCop-devel mailing list
>IPC...@li...
>https://lists.sourceforge.net/lists/listinfo/ipcop-devel

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Whom computers would destroy, they must first drive mad.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Melvin Backus
Principal Wizard
Sleepy Dragon Enterprises
www.sleepydragon.net

Phil Barnett wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>On Saturday 28 February 2004 6:02 am, Peter Walker wrote:
>
>  
>
>>They have a 6 page firewall review which includes IPCop. Unfortunately
>>the IPCop review is not very well researched and IPCop only gets 6/10.
>>The review implies that IPCop is still vulnerable to the "do_brk"
>>exploit so it doesn't look like the reviewer installed any patches!
>>
>>It might be an idea for someone who knows what they are talking about to
>>try and get a more accurate review printed, maybe 1.4?
>>    
>>
>
>It might be a good idea if the parting message in the install tells the user 
>to make sure that all patches are applied and where to get them.
>

The official stable ISO of  IPCop is 10 months old.

Is the reasons, not to make a 1.3-ISO with all fixes included, only to 
avoid large downloads af whole ISO's from Sourceforge ?

 
--
mvh
Morten Christensen

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Saturday 28 February 2004 6:02 am, Peter Walker wrote:

> They have a 6 page firewall review which includes IPCop. Unfortunately
> the IPCop review is not very well researched and IPCop only gets 6/10.
> The review implies that IPCop is still vulnerable to the "do_brk"
> exploit so it doesn't look like the reviewer installed any patches!
>
> It might be an idea for someone who knows what they are talking about to
> try and get a more accurate review printed, maybe 1.4?

It might be a good idea if the parting message in the install tells the use=
r=20
to make sure that all patches are applied and where to get them.

=2D --=20

"The choices we make dictate the life we lead. To thine ownself be true." -=
=2D=20
William Shakespeare
KI4DPT
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAQKA+WMqSOYd58pwRArE+AJ0VfXv5M4VGWD5G+Iz1k3QweANKbQCePngh
1XbAjnOyFdbTUwwnqGurEFc=3D
=3Dis7X
=2D----END PGP SIGNATURE-----

They have a 6 page firewall review which includes IPCop. Unfortunately 
the IPCop review is not very well researched and IPCop only gets 6/10. 
The review implies that IPCop is still vulnerable to the "do_brk" 
exploit so it doesn't look like the reviewer installed any patches!

It might be an idea for someone who knows what they are talking about to 
try and get a more accurate review printed, maybe 1.4?

Cheers,

Pete

I managed to work out what the issue was..

The COM port in the laptop I was using seems to have some problems..

I tried the PCMCIA modem in my PCMCIA adapter, and the ping delays & 
timeouts have not occured..

It could well be some system fault..

Thanks all (Alan, et all) for your assistance!

-- 
cheers,

 > Brendan Borlase  |   ya...@ih...

On Fri, Feb 27, 2004 at 08:57:45PM +0100, Mark Wormgoor wrote:
> Hi,
> 
> > I can definately tell you Gilles - it's NOT! the installer. So save
> > yourself
> > the half an hour and rebuild without the 4GB option.
> >
> > The boot procedure hasn't even made it to loading the installer at the
> > point these error messages are popping up.
> 
> Unfortunately, it has nothing to do with the HIGHMEM settings either.
> It probably has something to do with the unix.o module getting moved to
> the network driver floppy to create some space.  Perhaps we better put it
> back in  (the /dev/log error is because unix sockets are not available,
> don't know about the modprobe loop though).

O.k. The unix.o module makes sense. But I knew it definately wasn't
the installer.

Now we've got space on the boot floppy again though, we should put unix.o
back into the standard kernel - I think.

Alan.

Hi,

IPCop 1.4.0 alpha12 is now up on SF.net for download
(http://prdownloads.sourceforge.net/ipcop/).  This is a test release! This
kernel has updated the kernel to 2.4.25 and ppp to 2.4.2.  Most of the
bugs should be ironed out by now.

When starting the installer, you will get messages about a runaway
modprobe loop and a message from syslog about /dev/log.  You can ignore
those and they won't cause any harm.  They will be fixed for a next
release.

Other than that, we're really hoping for beta's as much as everyone else ;)

MD5: 53ea97d1b9fc8d4653a1a9f140c881a2 
/home/software/IPCop/1.4.0/fcdsl-1.4.0a12.tgz
MD5: 4cfd4ef925fcf8a2a8a9ac2155901169 
/home/software/IPCop/1.4.0/ipcop-1.4.0a12.iso
MD5: 02ac6b855a5b6a191395370c9fb2d175 
/home/software/IPCop/1.4.0/ipcop-1.4.0a12.tar.gz

Kind regards,

Mark
-- 
***************************************************************
* |\    /|      |  /|  /       Mark Wormgoor                  *
* | \  / |      | / | /        mailto:ma...@wo...       *
* |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
***************************************************************

Hi,

> I can definately tell you Gilles - it's NOT! the installer. So save
> yourself
> the half an hour and rebuild without the 4GB option.
>
> The boot procedure hasn't even made it to loading the installer at the
> point these error messages are popping up.

Unfortunately, it has nothing to do with the HIGHMEM settings either.
It probably has something to do with the unix.o module getting moved to
the network driver floppy to create some space.  Perhaps we better put it
back in  (the /dev/log error is because unix sockets are not available,
don't know about the modprobe loop though).

I will release alpha12 as it is now, since I don't think there are any
serious results (the module gets loaded when the network drivers are
extracted).  But we need to fix this.

Kind regards,

Mark
-- 
***************************************************************
* |\    /|      |  /|  /       Mark Wormgoor                  *
* | \  / |      | / | /        mailto:ma...@wo...       *
* |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
***************************************************************

On Fri, 27 Feb 2004 08:47:40 -0000, 
"alan walters" <al...@ai...> wrote in message 
<BBC...@ba...>:
> > 
> > -----Original Message-----
> > From: alan walters 
> > Sent: Tuesday, 24 February 2004 2:12 p.m.
> > To: 'ipc...@li....'
> > Subject: Authentication on blue network
> > 
> > So does anyone know what happens to a user on the blue network that
> > does not have a valid ip or mac  address, I would like to be able to
> > redirect these people to another web site. But am having trouble
> > finding out what ipcop is doing to them when they are not
> > authenticated

..'tcpdump --help' for hints on how.  You use ssh for authentication?
 
..you possibly want to also test authentication on all "NEW" packages,
and "--forward-to" your auth. box, rather than "DROP" that traffic.
Once authenticated, you want that traffic "ESTABLISHED,RELATED",
read /etc/rc.d/rc.firewall and doodle the rules 'till you get it.

> Having a bit of trouble with SSH, am trying to ssh from the orange
> network o the ipcop box, any suggestions on how.

..feature, AFAIK, you're not supposed to.  'iptables --help' for ideas
to put in /etc/rc.d/rc.local , _if_ you wanna do this.

> Orange box windows 2003 server running web(which I can access fine)
> Ipcop 1.4.11 working fine otherwise
> 
> A second issue is I am using putty for windows for ssh login and want
> to setup public / private key login, have done the following
> 
> Create pub /private key
> Create root/.ssh/authorized_keys
> Copypub key to root and add key to authorized_keys file
> 
> Any reason this does not work, I have also tried with .ss2(directory)
> and the ssh2 pub key name for the key file still no go
> 
> Please help I really need this puppy working asap

..I dunno putty, if it is any good, the error messages should 
tell you the story.  Also consider setting up a debian box, for
documentation use, 'info tcpdump' and 'man iptables' is a _lot_ 
more helpful than ipcop's "--help".

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

At 11:40 AM +0100 2/27/04, BONIFACE,ERIC (HP-France,ex1) wrote:
>Hello all,
>
>Could someone give us a status regarding 1.4 documentation & translation ?
>
>We - french translation team - do not have a lot of informations on this.

Mark Wormgoor has requested that we hold off on documentation changes 
till the first beta release.  I am the first to recognize that this 
gives us much less time to get the documentation in shape before 
release, OTOH, considering how fluid the alpha's seem to be, it's 
probably not a bad idea.

Harry

Hello all,

Could someone give us a status regarding 1.4 documentation & translation ? 

We - french translation team - do not have a lot of informations on this.

Thanks for your reply.
Best Regards,
Eric.

----
Eric Boniface - Hewlett Packard/IPG Partner Ops & BIM Infrastructure 
Tel.+33-456388339 
-- Want a good firewall ? Check http://www.ipcop.org 

Markus A. Madlener wrote:
> same thing here in austria,
> some ISPs which give you a static ip through a cable modem, only allow
> this ip from a specific MAC address (mostly via DHCP), 
> i don't know about the rest of the world, but almost all cable modem ISPs
> in austria in AT do this

Seems to be the case here in Switzerland too. And if you have a such a 
bad isp as me, who does not even care to answer the request to register 
a new mac, then there is no other option than to cheat. Or else what can 
you do if a nic dies on you, gets faulty, etc.

Kind regards

Roger

On Fri, Feb 27, 2004 at 10:57:55AM +0100, g....@fr... wrote:
> Selon Dave Roberts <da...@cz...>:
> 
> > > From: Alan Hourihane 
> > > Sent: 27 February 2004 08:43
> > >  
> > > Yes, I believe this is related to Mark's changes which give us access
> > > to 4GB using HIGHMEM.
> > > 
> > 
> > 4GB of RAM?  If yes, do we need access, what advantages?  Just curious.
> > 
> > Dave
> > 
> 
> I have peoples who ask to be be able to set a (very) big proxy cache size.
> 
> In previous but not last kernel 2.4.24 menuconfig, it was stated that the cost 
> in performance to allow bigmem was low for small config.
> That's why I ask Mark if we could allow this setting.
> 
> My first feeling (but not correlated at all to any technical knowledge) was 
> more that it's may related to kudzu withdrawal of the installer?
> 
> I will test this option first because it consume less compilation time and I 
> will have an answer in less than half an hour.

I can definately tell you Gilles - it's NOT! the installer. So save yourself
the half an hour and rebuild without the 4GB option.

The boot procedure hasn't even made it to loading the installer at the
point these error messages are popping up.

Alan.

On Fri, Feb 27, 2004 at 08:43:17AM +0000, Alan Hourihane wrote:
> > This does not like to be a tar archive (and more I had not time to write)
> 
> I'll double check this today.

O.k. I've got some more changes to suppress the errors, but just
running a test now. 

I'll check in the changes in about an hour.

Alan.

Markus A. Madlener wrote:
> same thing here in austria,
> some ISPs which give you a static ip through a cable modem, only allow
> this ip from a specific MAC address (mostly via DHCP),
> i don't know about the rest of the world, but almost all cable modem
> ISPs in austria in AT do this
>
> markus
>
> On 25-Feb-2004 Darren Critchley wrote:
>> Alan Hourihane wrote:
>>> On Tue, Feb 24, 2004 at 10:26:16PM -0000, ViRuZ wrote:
>>>> My ISP restricts its cable modem to a single MAC address. So to
>>>> save having to enter every MAC address for each new card I bought.
>>>> I set the MAC to 00:11:22:33:44:55 and each time I reinstall IPCop
>>>> I've got to edit the rc.netaddress.up and add 'iptables eth1 hw
>>>> ether 00:11:22:33:44:55' to the red section. Then reboot the
>>>> machine so it gets the address and sets its self up right.
>>>
>>> That's one seriously messed up ISP if you have to do that - which
>>> ISP is it for reference ?
>>
>> No it is not a messed up ISP, that is a common was of doing things
>> in North America - Canada in particular. The Cable companies will
>> let you hook up anything, but DSL companies usually require the
>> registration of a MAC adapter (to a maximum of two then you pay for
>> more). It keeps people in compliance with the number of computers
>> live on the web.
>> This is also how many of the DSL companies hand out a static IP
>> address (it is actually handed out based on your MAC adapter using
>> DHCP).
>>
>> I do not know if this same thing is going on in the States or not,
>> but we have a lot of it in Canada and the ability to spoof a MAC
>> would be nice.
>>
>> Darren

Markus do you refere to Chello (UPC)?

The major European cable operator uses MAC adr. as well, so it'n not just NA
ISP's.


/Mats

Selon Dave Roberts <da...@cz...>:

> > From: Alan Hourihane=20
> > Sent: 27 February 2004 08:43
> > =20
> > Yes, I believe this is related to Mark's changes which give us access
> > to 4GB using HIGHMEM.
> >=20
>=20
> 4GB of RAM?  If yes, do we need access, what advantages?  Just curious.
>=20
> Dave
>=20

I have peoples who ask to be be able to set a (very) big proxy cache size=
.

In previous but not last kernel 2.4.24 menuconfig, it was stated that the=
 cost=20
in performance to allow bigmem was low for small config.
That's why I ask Mark if we could allow this setting.

My first feeling (but not correlated at all to any technical knowledge) w=
as=20
more that it's may related to kudzu withdrawal of the installer?

I will test this option first because it consume less compilation time an=
d I=20
will have an answer in less than half an hour.
If nothing is better, I will test without 4GB option. But in this cas, I =
need=20
to compile the entire distribution.

Gilles

On Fri, Feb 27, 2004 at 10:26:12AM +0100, Mark Wormgoor wrote:
> Hi,
> 
> > On Fri, Feb 27, 2004 at 01:06:03AM +0100, Gilles Espinasse wrote:
> > > After
> > > VFS
> > > Freeing unused kernel memory : 84k freed
> > > kmod: runaway modprobe loop assumed and stoppped
> > > 
> > > this same line occur a few times
> >  
> > Yes, I believe this is related to Mark's changes which give us access
> > to 4GB using HIGHMEM.
> 
> If I remember correctly, that was Gilles' idea ;)
> My workstations don't even have > 1GB, so I don't need it. 

Right, thanks for the update Mark.

I suggest we back that out then. I don't think we need 4GB access in IPCop.

Alan.

> From: Alan Hourihane=20
> Sent: 27 February 2004 08:43
> =20
> Yes, I believe this is related to Mark's changes which give us access
> to 4GB using HIGHMEM.
>=20

4GB of RAM?  If yes, do we need access, what advantages?  Just curious.

Dave

same thing here in austria,
some ISPs which give you a static ip through a cable modem, only allow
this ip from a specific MAC address (mostly via DHCP), 
i don't know about the rest of the world, but almost all cable modem ISPs
in austria in AT do this

markus

On 25-Feb-2004 Darren Critchley wrote:
> Alan Hourihane wrote:
>> On Tue, Feb 24, 2004 at 10:26:16PM -0000, ViRuZ wrote:
>>> My ISP restricts its cable modem to a single MAC address. So to save
>>> having to enter every MAC address for each new card I bought. I set
>>> the MAC to 00:11:22:33:44:55 and each time I reinstall IPCop I've
>>> got to edit the rc.netaddress.up and add 'iptables eth1 hw ether
>>> 00:11:22:33:44:55' to the red section. Then reboot the machine so it
>>> gets the address and sets its self up right.
>>
>> That's one seriously messed up ISP if you have to do that - which ISP
>> is
>> it for reference ?
> 
> No it is not a messed up ISP, that is a common was of doing things in North
> America - Canada in particular. The Cable companies will let you hook up
> anything, but DSL companies usually require the registration of a MAC
> adapter (to a maximum of two then you pay for more). It keeps people in
> compliance with the number of computers live on the web.
> This is also how many of the DSL companies hand out a static IP address (it
> is actually handed out based on your MAC adapter using DHCP).
> 
> I do not know if this same thing is going on in the States or not, but we
> have a lot of it in Canada and the ability to spoof a MAC would be nice.
> 
> Darren
> 
> 
> 
> -------------------------------------------------------
> SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> Build and deploy apps & Web services for Linux with
> a free DVD software kit from IBM. Click Now!
> http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel

Hi,

> On Fri, Feb 27, 2004 at 01:06:03AM +0100, Gilles Espinasse wrote:
> > After
> > VFS
> > Freeing unused kernel memory : 84k freed
> > kmod: runaway modprobe loop assumed and stoppped
> > 
> > this same line occur a few times
>  
> Yes, I believe this is related to Mark's changes which give us access
> to 4GB using HIGHMEM.

If I remember correctly, that was Gilles' idea ;)
My workstations don't even have > 1GB, so I don't need it. 

Kind regards,

Mark
-- 
***************************************************************
* |\    /|      |  /|  /       Mark Wormgoor                  *
* | \  / |      | / | /        mailto:ma...@wo...       *
* |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
***************************************************************

On Fri, Feb 27, 2004 at 01:06:03AM +0100, Gilles Espinasse wrote:
> After
> VFS
> Freeing unused kernel memory : 84k freed
> kmod: runaway modprobe loop assumed and stoppped
> 
> this same line occur a few times
 
Yes, I believe this is related to Mark's changes which give us access
to 4GB using HIGHMEM.

> a bit later
> syslodg Couldn't get file descriptor for socket /dev/log : Address family
> not supported by protocol
 
I'm not sure how this has appeared, and may be related to the above.

> restore backup from floppy work but with some warnings
> This does not like to be a tar archive (and more I had not time to write)

I'll double check this today.

Alan.

Having a bit of trouble with SSH, am trying to ssh from the orange
network o the ipcop box, any suggestions on how.

Orange box windows 2003 server running web(which I can access fine)
Ipcop 1.4.11 working fine otherwise

A second issue is I am using putty for windows for ssh login and want to
setup public / private key login, have done the following

Create pub /private key
Create root/.ssh/authorized_keys
Copypub key to root and add key to authorized_keys file

Any reason this does not work, I have also tried with .ss2(directory)
and the ssh2 pub key name for the key file still no go

Please help I really need this puppy working asap

Alan Walters =20
Business development & IT consultant
=20
Radiowave
Ph    +353 (65) 7077036
Fax  +353 (65) 7077107
Wireless radio specailists
=20

-----Original Message-----
From: alan walters=20
Sent: Tuesday, 24 February 2004 2:12 p.m.
To: 'ipc...@li....'
Subject: Authentication on blue network

So does anyone know what happens to a user on the blue network that does
not have a valid ip or mac  address, I would like to be able to redirect
these people to another web site. But am having trouble finding out what
ipcop is doing to them when they are not authenticated

thanks

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.587 / Virus Database: 371 - Release Date: 12/02/2004
=20

----- Original Message -----
From: "Drago=BA Cintez=E3" <Dra...@we...>
To: <ipc...@li...>
Cc: <ja...@gu...>
Sent: Friday, February 27, 2004 3:57 AM
Subject: RE: [IPCop-devel] Fixes included?


>
>
> jackb> Lack of information.
> jackb> jackb> Which version did you build?
> I  build  version  1.3  with ipcop-dev-v130-20040223.tar from CVS.
> jackb> jackb> Which  source  tree?
> jackb> jackb> What are you trying to do?
>  I enabled some extra modules in kernel, that I needed.
>  I'm refering  to fixes 1-8 that was released, do I need to apply them =
if
I
> build  from  the  ipcop-dev-v130-20040223.tar  source  that is release
> after  Fix8  ?  The  latest  kernel  patches is not yet released a fix
> probably  will  be released soon, and I don't expect to be allready in
> the CVS source.
>
Look there
http://cvs.sourceforge.net/viewcvs.py/ipcop/ipcop/src/patches/?only_with_=
tag
=3DIPCOP_v1_3_0
http://cvs.sourceforge.net/viewcvs.py/ipcop/ipcop/make.sh?r1=3D1.18.2.113=
.2.7&
r2=3D1.18.2.113.2.6&only_with_tag=3DIPCOP_v1_3_0

ther fix8 is really in the v1_3_0 tree
and you can't apply any standard official fix (particulary concerning the
kernel) if you build the version by yourself.
It will replace your kernel mod by the v1_3_0 standard settings.

Maybe the fix system should not ask for fixes already applied in the tree=
 ?
But it is not an easy question.
If you build by yourself, the easiest answer is that you have to know wha=
t
you do.
It's may be false security to integrate the fix level in the tree because=
 if
you have done some changes, you may not be able to apply a next fix witho=
ut
erasing your change.

Gilles