From b7d2e8c6848671cf3d59768852b7fc4b414e9ecd Mon Sep 17 00:00:00 2001 From: paulgear Date: Wed, 7 Jun 2006 03:02:49 +0000 Subject: [PATCH] Import of shoregen 0.1.1 git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@3999 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb --- contrib/shoregen/AUTHORS | 1 + contrib/shoregen/BUGS | 6 + contrib/shoregen/COPYING | 340 +++++++++++ contrib/shoregen/README | 125 ++++ contrib/shoregen/TODO | 19 + contrib/shoregen/install_shoregen | 103 ++++ contrib/shoregen/samples/Makefile | 10 + contrib/shoregen/samples/example1.dia | Bin 0 -> 3388 bytes contrib/shoregen/samples/example1.png | Bin 0 -> 30197 bytes contrib/shoregen/samples/hosts/ig | 13 + contrib/shoregen/samples/hosts/mail | 7 + contrib/shoregen/samples/hosts/og | 7 + contrib/shoregen/samples/hosts/proxy | 7 + contrib/shoregen/samples/interfaces/ig | 5 + contrib/shoregen/samples/interfaces/mail | 3 + contrib/shoregen/samples/interfaces/og | 5 + contrib/shoregen/samples/interfaces/proxy | 3 + contrib/shoregen/samples/params/COMMON | 9 + contrib/shoregen/samples/policy | 112 ++++ contrib/shoregen/samples/rules | 187 ++++++ .../shoregen/samples/shorewall.conf/COMMON | 569 ++++++++++++++++++ contrib/shoregen/samples/shorewall.conf/ig | 2 + contrib/shoregen/samples/shorewall.conf/mail | 2 + contrib/shoregen/samples/shorewall.conf/og | 2 + contrib/shoregen/samples/shorewall.conf/proxy | 2 + contrib/shoregen/samples/zones | 10 + contrib/shoregen/shoregen | 373 ++++++++++++ contrib/shoregen/spec/description | 3 + contrib/shoregen/spec/files | 4 + contrib/shoregen/spec/header | 10 + contrib/shoregen/spec/install | 9 + contrib/shoregen/spec/type | 2 + 32 files changed, 1950 insertions(+) create mode 100644 contrib/shoregen/AUTHORS create mode 100644 contrib/shoregen/BUGS create mode 100644 contrib/shoregen/COPYING create mode 100644 contrib/shoregen/README create mode 100644 contrib/shoregen/TODO create mode 100644 contrib/shoregen/install_shoregen create mode 100644 contrib/shoregen/samples/Makefile create mode 100644 contrib/shoregen/samples/example1.dia create mode 100644 contrib/shoregen/samples/example1.png create mode 100644 contrib/shoregen/samples/hosts/ig create mode 100644 contrib/shoregen/samples/hosts/mail create mode 100644 contrib/shoregen/samples/hosts/og create mode 100644 contrib/shoregen/samples/hosts/proxy create mode 100644 contrib/shoregen/samples/interfaces/ig create mode 100644 contrib/shoregen/samples/interfaces/mail create mode 100644 contrib/shoregen/samples/interfaces/og create mode 100644 contrib/shoregen/samples/interfaces/proxy create mode 100644 contrib/shoregen/samples/params/COMMON create mode 100644 contrib/shoregen/samples/policy create mode 100644 contrib/shoregen/samples/rules create mode 100644 contrib/shoregen/samples/shorewall.conf/COMMON create mode 100644 contrib/shoregen/samples/shorewall.conf/ig create mode 100644 contrib/shoregen/samples/shorewall.conf/mail create mode 100644 contrib/shoregen/samples/shorewall.conf/og create mode 100644 contrib/shoregen/samples/shorewall.conf/proxy create mode 100644 contrib/shoregen/samples/zones create mode 100644 contrib/shoregen/shoregen create mode 100644 contrib/shoregen/spec/description create mode 100644 contrib/shoregen/spec/files create mode 100644 contrib/shoregen/spec/header create mode 100644 contrib/shoregen/spec/install create mode 100644 contrib/shoregen/spec/type diff --git a/contrib/shoregen/AUTHORS b/contrib/shoregen/AUTHORS new file mode 100644 index 000000000..3cedc2493 --- /dev/null +++ b/contrib/shoregen/AUTHORS @@ -0,0 +1 @@ +Paul Gear diff --git a/contrib/shoregen/BUGS b/contrib/shoregen/BUGS new file mode 100644 index 000000000..a7664840c --- /dev/null +++ b/contrib/shoregen/BUGS @@ -0,0 +1,6 @@ +Sat Apr 24 23:10:10 EST 2004: + +- The "minimal" in "Only the minimal information necessary for operation is + stored on each firewall" is a bit of an overstatement. This could + probably use some work. + diff --git a/contrib/shoregen/COPYING b/contrib/shoregen/COPYING new file mode 100644 index 000000000..5b6e7c66c --- /dev/null +++ b/contrib/shoregen/COPYING @@ -0,0 +1,340 @@ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc. + 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Library General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) year name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + , 1 April 1989 + Ty Coon, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Library General +Public License instead of this License. diff --git a/contrib/shoregen/README b/contrib/shoregen/README new file mode 100644 index 000000000..97c2cbcd7 --- /dev/null +++ b/contrib/shoregen/README @@ -0,0 +1,125 @@ +shoregen 0.1 +Shoreline Firewall configuration generator +(c) Copyright 2004 Paul D. Gear + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + + +SHOREWALL + +The quick plug: + + - I love shorewall. Shorewall is the only firewall i trust. + +The IT Manager plug: + + - Shorewall is a policy-driven firewall which lets you think about your + firewall at a higher level than iptables commands. + +The hard sell to you crazy people still maintaining manual firewall scripts: + + - Shorewall is a wrapper around the kernel iptables, so your existing + Linux firewall skills transfer. I converted from a 900-plus-line + ipchains shell script to around 50 lines of shorewall configuration in + less than 4 hours, with no prior experience. + + +ISSUES + + - I'm paranoid - i want more than one firewall between me and the world. + + - Configuring multiple firewalls separately is a recipe for getting your + rules out of sync, and allowing security problems to creep in. + + - IT Manager types (like me) like to know their policy is consistently + implemented. + + +SOLUTION + +Shoregen is a script that generates shorewall configurations for multiple +firewalls from a common set of rules and policies. Only the minimal +information necessary for operation is stored on each firewall, so, for +example, your DMZ server doesn't need to know about the rules on your +internal network, but at the same time, it gets consistent rules to your +outer guard. + + +PHILOSOPHY + +Shoregen assumes the X-Files approach to firewall design: trust no one. +That is, paranoia is a virtue. All access should be as limited as possible +for things to work. If you don't already agree with this philosophy, you +may find some of the things shoregen does frustrating, but then again, +you're probably not reading this document. :-) + + +DESIGN + +Shoregen distinguishes between two different types of shorewall +configurations. Most shorewall configuration files are simply concatenated +together from parts constructed from common and host-specific parts. These +are called simple configs, and shoregen doesn't substantially alter them, +and uses little information from them. + +Configs with which shoregen is more concerned are treated separately, and +additional features beyond the scope of shorewall itself are implemented. +Most importantly, two new policy/rule keywords are introduced: WARN and +BAN. These keywords are not included in shoregen's output, but when a +subsequent rule or policy is encountered which matches a rule or policy +marked WARN or BAN, an error message is issued. In the case of BAN, the +offending line is also dropped from the output, and a non-zero return code +issued. + + +PREREQUISITES + +The tools you will need to use shoregen are: + perl The main shoregen script is written in Perl + rsync Used to keep /etc/shorewall directories on your firewalls + in sync with the central repository + ssh Encrypted transport for rsync + make Optional, but saves a few keystrokes. + + +USAGE + +Put shoregen and install_shoregen in a directory on your PATH. + +Make a central directory for your configs. I recommend somewhere in a +trusted user's home directory or central system admin repository. This +directory should be on a trusted machine in the most secure part of your +network. Put all of your policies, rules, and zones together in the +correct order in files in the top level of this directory. + +For each of the simple configs you want to generate centrally, create a +directory, with a file called COMMON (if necessary) containing the content +you want to see in that file on all hosts, and a file named for each host +for host-specific content. I recommend that the default shorewall +configuration file be placed in the COMMON file of the corresponding +directory, with directives that are not appropriate commented out. + +When shoregen is run, it places the generated files in the directory +SPOOL/, where is the hostname of the target firewall. The +files in this directory are synchronised and the firewall checked and/or +restarted by a simple wrapper script called install_shoregen. + +See the samples directory for a starting point configuration. It provides +some suggested policies & rules for the network shown in example1.png. The +sample configuration has not been tested in any way. + +I hope you find shoregen useful. I welcome your comments, contributions, +criticisms, and questions. + diff --git a/contrib/shoregen/TODO b/contrib/shoregen/TODO new file mode 100644 index 000000000..7741da178 --- /dev/null +++ b/contrib/shoregen/TODO @@ -0,0 +1,19 @@ +As at Wed Apr 21 22:30:12 EST 2004: + +- Need to make it possible for a host to have the same $FW name as the zone + in which it belongs, and have shoregen automatically create appropriate + rules. + +- At the moment, if a fully-expanded policy file (such as is shown + +- Better documentation & samples. I'm sure there is room for improvement. + +- Better rule & policy sanitisation. Again, there is room for improvement. + +- The Makefile could be improved to detect changes in the lower level + config files and call shoregen automatically when they are out-of-date. + At the moment, shoregen is so simple (and thus fast) that the amount of + time that would be saved by a clever Makefile (in comparison to the + rsync, ssh, and shorewall steps) is probably not worth the trouble to + code. + diff --git a/contrib/shoregen/install_shoregen b/contrib/shoregen/install_shoregen new file mode 100644 index 000000000..13665bf08 --- /dev/null +++ b/contrib/shoregen/install_shoregen @@ -0,0 +1,103 @@ +#!/bin/sh +# +# $Id: install_shoregen,v 1.5 2004/04/22 11:12:51 paulgear Exp $ +# +# Wrapper script to install shoregen-generated shorewall configuration files. +# + +# +# (c) Copyright 2004 Paul D. Gear +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General +# Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA, or go to +# on the World Wide Web. + +VERBOSE=0 +RESTART=0 +CHECK=1 + +usage() +{ + echo "Usage: $0 [--verbose] [--restart] host ... + Generates and installs shorewall configuration on the given hosts" >&2 + exit 1 +} + +error() +{ + echo "$0: ERROR -" "$@" >&2 +} + +while :; do + case "$1" in + + -v|--verbose) + VERBOSE=1 + shift + ;; + + -r|--restart) + RESTART=1 + shift + ;; + + -c|--nocheck) + CHECK=0 + shift + ;; + + --) + shift + break 2 + ;; + + --*) + error "Unrecognised option $1" + usage + ;; + + *) + break 2 + ;; + + esac +done + +set -e +set -u + +if [ "$#" -lt 1 ]; then + usage +fi + +USER=root +RSYNC_ARGS="--recursive --backup --times --cvs-exclude --rsh=ssh" +#--progress +if [ "$VERBOSE" -gt 0 ]; then + RSYNC_ARGS="$RSYNC_ARGS --verbose" +fi +DIR=/etc/shorewall +SW_PATH=/sbin/shorewall + +PATH=$PATH: +for HOST; do + shoregen $HOST + rsync $RSYNC_ARGS SPOOL/$HOST/ $USER@$HOST:$DIR/ + if [ "$CHECK" -gt 0 ]; then + ssh -l $USER -t $HOST $SW_PATH check + fi + if [ "$RESTART" -gt 0 ]; then + ssh -l $USER -t $HOST $SW_PATH restart + fi +done diff --git a/contrib/shoregen/samples/Makefile b/contrib/shoregen/samples/Makefile new file mode 100644 index 000000000..2e74e1c28 --- /dev/null +++ b/contrib/shoregen/samples/Makefile @@ -0,0 +1,10 @@ +FLAGS=-c -r +HOSTS=ig proxy mail og + +default: $(HOSTS) + +$(HOSTS): + shoregen $@ + +install: + install_shoregen -c -r $(HOSTS) diff --git a/contrib/shoregen/samples/example1.dia b/contrib/shoregen/samples/example1.dia new file mode 100644 index 0000000000000000000000000000000000000000..92f26108433bbe89d11aa74220921094e457ddf6 GIT binary patch literal 3388 zcmV-C4a4#uiwFP!000001MOW~Z`;Nae$THEl$REe*L%NIO^P%{g91q#oaW#>8nngO zJf%s2qT;v@=eM6(lDSR{G&YD^Fw zkK*hspC#G(tMR`-{d%OwKfQkO<1C4OfWPNObUA`=WDEQ0)%c<;=RX`DUtL|H^m-AM zd4bYoi5Btk|DrUFj-k=<`1Om?=za&YsEq8j=4w=yMRK|<<53n}#;?Yw(b-?;MZU~t zjy!Rrj*`1ho_4;^)DjzFQV`- zB3Ycw^P()Gq+Azsn&)X8WwoTTSjPS3EY6}7OlFfRq<`<9ld{Yox&O~my4Xg6`tt4Q zdFn_!FOu2jf%u?BM=w{&th_k+>gjRSytov)n?p@#WGMUAT zN8a?qHXS`(G|i45Q+&1Ewi?uzR!FK6kw({X(RBaw9X*YjXWR_>dru)h{cn6$HtPLZ zM%gSXW}~Cg`y`9UcXSJ6o6KH~|G*EQ&#Fey8=%kH1DfZzFOqU3iO~~=s5XkM>c0L` zyTqKHu1YCDktjP)<6B8WaA74;&c&1(gb6hhfe7PD^pkv+XW2=d%_@z0>Dkg$Bg2)1 z8^h9Y)9=Qz<>lFY^?urh&!$eTcJL74jW1Suy8F%O0&K)u5|~7pgGn$t9^L&KWQjFp zTfR+hzAYYp8?TRsm3yi$*LJ&wA%D!%>keZk&c-~%o7>KqHPV`j2}MjY!KO@raT`_} zvylBH&*9OWJZ{NdO0GAByW)mZxJyp8^l5Y5R`a;YanBalVQtja+8Dg@i9#H6qCA=! zLtGh20J*f{SWXqvSV(OptKO!zHEy;mx!z78#RQ-^1LFjAKQzz; zyr1AWjW18m@*-Q0yNA}X5>>hN>w4b0^a#Xo;vnE6PR=jNZV3>K!cR|PTU_KCNiD+aP{iRCvX z3)-ULu896g4EHw8m$Mdnwx{+^OlNLn?*kbDpQ3+8p z*gQ6UAIIr(aZ+2yrn@3l8c|et)iS|#za>K$^ZNd^-q=#XLuP6s9%)3el$DN5ZsaDy z>;7)v*~VuF3TZo2BZ)L#r)pLRhdpVSuF#d-=F7bKGVL=-ByYaVIurDRAjF%|FY)59 zGM|q=zHNaD?Ftpv2qs4Y^$m8nLJ2EGSSe!4km42ZfDy{x47*(>!d16z5)lkp8Z{ns z5d<;&6LJxUm5X@lF#iwyXHiBK$b87Nq=fKweY_jj@s1IpFcdY=gl0ZtHH@&T1ql!Y z{Y`nhF+YTU+l_mW<8jnG^dH9jp^W*B)K0MbSXY*3y;3`d@oj~ODZgQM=AYRe zH4DTZ2Kk;5J8>>DBsKFX@61kWW>*cfbIa`9KeG>^Utsny==Xrxsry*3631Sdom9-u zfZ4?jvs3@f?x!CnRr~Wx-EG3Jiz-a75F?1?S12OF~FRgP_`CVbKKD?0a@e4m&==3!tz4>DKo zlWZI)R(R)fcudO5si~X+l^g$5K7ew8$-{u(115Jalp{c`UWd04Frtmkwl_>pyfb-! zodT7Ik-cwJZro?pEZa%%R8A@?mkpJ3pmOlqG4VaI=B!+x@-X1N4fuPjyFS^qxGfta z;QIf-^ekua27F~%;Nn%+t!_T&C9VSfMS_pm2N|7FZ=M)n+5Fw=j21#=fL z5cgR(#OrA>pTNKn*VJy1#t2trS_{>P*iZWp3-6Zkq71;`01Pcg7J$JkFt``mam1zO zb{)U*92DG2B0>?Zrgs-ibz%PzB5Zup4;VU)ENpx-L;~Sm43ROs&bQDvbWx1H`;=eB z#rJK1;asanY%#n~n4os6lY0FupAvzvk#<8AfwAzMK zPp>`ZwH-UXY6sj_Z8m`s6_Sgk^8gjo5+}7;jW)NdS%fM|ra)X@D&LOyedIsHvXushej-yEAn5Z2i18SEg5 zFe9r{ccaCW+RP^Ac6uKRuV=6iqGLFNJxuN&^5p&>;S6>Mh64yO7OE7-;RN=bdBN_R zDpO?SPTXJ$ZWgUhDy;qBJIROT2Zw0c1tq%7Ekw&+al*L{o=PO@C{}nb0J2`MFw`C| zT^9gpgcaZhvt`kTfD_+UBkH%0FTgb_;>99fd>9>7dysQQdv8#(Ezc=k3nLVS z8OwB3G7io%(2pdZscsNWw_5_ni15mFlC$24?!a|n7lg38&r=!BSfAVgQgJ3pAh>}O zKOgh-`hAkcZ6xQss^jL}LA0-gHqaZv7(5;icFb+xI{qo&$a0roXp|joK*Vs z({jBn+!cr0vA0F_mNasfXBj99?`E-vRX4vGUBDYna7GQr9)E{`WwtC6Njvh_Uk_ z+MXpHFydR;|ESf}f*au#BiIm&3c0OuWyR z1~_sH+il?OZibwBodP8cyiG%_D6O=l_BJ=!Y`+i4COt9De&{XX+2%$BdYGeeV_IL`;3DIHN^ZD;^^w7Y9=in6(oU8Q&kT$nV zY{ADDe)m7C1lgPek!mUtqeR=?(E3+m>=+lqChZQm&}C-X;NF&`ycXxwGNjD-0f=YLnC@mqNbV@fUrSzHG z=XuZn{r%4Qa6X*tgWNaleeHFvHP@J9jycv2S5lC|!6L^(AP_jxPm#(91bPYrffjrH z3jC(p7M&h`pgTX3R=s}x`qaGQPXvM%A&rz!^+?~Eao1HDJH`CPbc0ss$uoT7C#pom zOtKQ<)@nr6NrKus#UvWl#UnMil&)1Z)iv7I<=WLd9BNk29PeT9v*IFa0 z8SF<$UzdLBM7Za9InVa+;p#L~>hGm#=Yjd_7*}2hws&+KZcn9bGm|e3=c^cZMVktt zMvEX`te`^uLJB-)ipJ5Pd!5oCXZ^A8TAt}6U0t} z`sspKp^5rADDv;V2=PC(5vXzf|M3Fj&u)k)buTY3C8b+zp$hWyyQ9To&fe2?jxv9o zH-_`ejk^k%{|!g2Rg)d{p=;EU9R(V-cDR>k&Z*nXM11Z$t-pS;*+{`7Bb1m-%F`V7 zmevy!d0;Lgl9EQMELFy%QK67U-EA}?OG`_Kg(E^r=9#pux%53hf$HD04f=H(@pk?A z@uRadWSeF9qJReL)g`wb@lYT4>vm8h+KPmda$sujsLTR_0OYF_x^vK zn;Jh#+$nt2Uq8Qz?LfUOU`K)k8}*9@Os)Suj7d4_|FgXRKfmDqb0I`5ors7CGjmwd zqYFQ1wNcUbln&pFE>^rB7%Dc2t@w(L%(Pi9c_&E&u9AMR#FAGu6)zG zP3;%Fjhfc1I0%w$h4jBn3=C25>wg0 zE_c$^&=}Ki_9}O>@H8xB# z_@-?wEU1j-Ffe@Z5j9Boje0+#V*KRy@mXuDAnEwRZx2l-V)&hS8|9O4 zw70I?%{Gw{5IAiNvlz-hc<`fkc5i*6vTL$h%<8Tj>L$%W?CK=w=;+qg))TIhQRKW< z!+ByCf9V++SJsAdLh)$6efuWr%6c%Iuhfrm1KyAoTD7pj`OVr%J-HGyxWSedH*|4+ zzTEQ1$G*P4wY9YYvCAe?*^beae|zlM@(D?AA6t^YTfT`AYjtt5MU` zP|DJ%qKinP32lpuOTxmqvaMC2>P?55atj|9SN)af3W()2EjOw%5l9X@+CKd;QJ3>%WpAE{@VoKUFai{(&D+TzZ97C@zT@N-?{T{{v2+O2r#p-C(*GFVfEJI zU{IgI!aAAkxBcAYX|S@g5-u`alCeD?R;rO#yRFPK=AHF;R3#>fu4kR`2qa=gmTp^S^Gl$nEr&^xc7py$gM{R(MY zTaL_u6tB9yJ*@JcCr_U2VWOjk!VUM)*-b4ZC|)Y1ANdkAHC1K#1eu>t_9J(ov~Y6F zpj6oRgx$H(c8X6+Yv6a+-s;04Pd643RIWWs0L-+Pw#cI=D5)Pf3ryGxBs71*5?J8t~{w>3$1PNP-`M^%GcDSPP_Tak=r)CC5 z#>Tq8!-p2q()kYI|Kq2-iEe=xMUys{Axmy8S$8&2SLha;K@$Zb52A<$EW&8EaI=cYx}hkCMdg#Awun-QD%czKi(ku z6}gZbQD*5;sT_LHr9s%w;rs_%z=CXTar5u=2s{)&&9dmR95!r&RuV%lPgy4e*)FiMzA_)sHomR%)Vnph|@Xa z#THya1P~-@aj74C$C+m>?t7eF|50<6MT^-pKXkl&L+~X*;rE{Pp&X`CePZU}_gPu7 zVJ}{Ma&xA*XFr<~|G0j8a^m7_-z)e;PC+3<%)i{?>(Ta9RAeO41~Q?n>Pp@%WgSRH zp{<)8Ju3RU4C+{Fv5spYVyvB=AFDrn2tGRu?;ak0X}R|Exq-g^Gi_}~^>_cp2}8h% zN=Y)FFJgpxd70SMbip#u zrni zaxRTmEbo10d;49pkr#b^He@4d{Pv>-NxaVUX-R4kliH%^_Ez~>4Gk;Hy*^18=vj}; z;MRz4JS}$oXQ8-MlvGqnrwfqA*jZTcIgS@1Xg$d}b!sdoDxN6Qcpa>Lt#eFBx_(W3 z>`pL1+rv8%40MxCo|WHiyP_ya2?$!JcSZ`kB1r3vhy`6Na&-s7!@qKJin@wuD=V|= zE{L}YP(}wo$x!j@?djnqyJ<1olf#Nx8%vb`O8Ik=pv7Ie&FS zdmqu3va)YiYdnOhbsno<2^5!nKDZVf5;FVAcWO{6NmlvS@mX408lKqMEfgc`26W=v zn5=e|>$^%ujB(`)@bJZjoqZ4Cd1XjKW^Ey!F_g#ZrTPl26W11ilA8~_#lyxX-N6{D z%4fhQCL!6LZT23{d&WJft*y-`j2P6;5OSZbvP{4dij0oFxH#Qa8^7}({#}h9(^Xkv z#o4G3L86W{v9?ZldlAV3m&kwEg0pj_sIM0p1qGXz?)D3MaU3l*@pY5b71CXKseF>66ZmF2JUKherGg6MOR6iHK z8*Dso)xwaJlmw!1bVSwMB%CPFzCGo>JL7%Nu(giYI@wS~D|Y_-2U$~7(~loNI*q0X z4lQ4tpGJ^K8x%nn5x-_q&PsUeUi9{@i_qTXTX6|0e;8yxsb(J!h}k#0?@EN?ZpXGh zYWDH*N#idyKZ>y7GWevbb`QmFVmk`@hH`S9ob+P_`MW=i8JE-e{Q6p~>0!|{mr~`o)NJ{;8ew z+dn*1^Lz?-_%{QQji;Y`WID_uB&E7mR#yvIsH+Q#i{+m_RVuM{bS$?DLaSL?St&7S znf)wY9)n*VUe?jk0pn4()P*|$hcD=ZB=S1hPBv`!nd3g=V1qH@aQZy2iU)cw#YH6+ie9kpd2E;%sCm;;tO5l>( zEG2H&=g+hp969foqAZKd%*=3ckA$f;_B4^h_0CL>A3qL$`{Gew-;y3R4a|i&A1sQB zzW%#4yY#-0@@!n{>DiC+Y;-d6@|mK(5_&i-7hWG6IL2#ir|$hQc~WipsGiVc!YH4U zR%niNfBWWn!lN~$uB^Dp_VeCy$ zyKbttvIn-!Yip)r3wd4$GYOp@1ArFm)Edd`%y?&w7B&_X6pV~Lgn_LQo0Q{>eDd{{ zl9F2POyGX-01yHxOTu|GK6k#tG$NTpN7cSsB50b9?%U|$S|GaAkMG>6S~zlhf~Gw; zJ)=u_q`FG1woxl_fC-#n65jK_pnIayyHK5@gVkkiP~o_HgPwPP#i?FFp~uFYR>#cD z&F_LO$sK#Er?*$9#m^UgteTmHYQDi4%mc>BTcNVytc;mliVAP zIvUzS74w>Oo@?|bbCl}?LYD>i0zpDuSdaf#EnRkl%@z$2;B=2mosCk&YvXvIl7U=i zM}#dXLe`%&;B;y**oNx2 zp3P(8QL_v&S=47|XFm?b1sLXkpOBbHq}Bm|=5PnJX7oHk1KL<3zrJ3G;@-L&}W zRi2-p&x!@XbAVl;S$xlJi&@lQTf>Ut_AlgaGzGt)$oa&t`A^8I=U+5RBOJd7SP=b_ zXqHjKHy_aV_)V8mUp!cWjGV)as=Bj5CNSx zwAfEaizYrp4I{HL(^xCqR=&Qz4lDL&cdoRk=x#Q|j=A}&ghJ5H-P!fQ+MpBE+a#}R zvA+>?S^K%R*1b@$%fP@eF)`sIIyXFAWjj>^Mb`x%PTRag8Ab7IK~a%zwG}Zwm5|$3 zM+E6Ej&JGQkGGJVZMtCPpa^4s!)HI+=XTxY^l1COaVKaoWaQ+q_--4+;oD(ZLj*HJ zK?AGy6BT*>mracF$x~CtK}I03-LBB|9V<0x86O`X%8{CDbRU?R5xIM}ePkqQJ4>8D z_05~mmoIrNzrUYN`|#nz`RN}nPENBgkMpJD+ zC(6ye*ZgM|8yg$a-b|zWuF!5%o10P=`ZYXiVUJ(W8OU*O-wO!qjC}n}P0iHAssw~B^Ov-6FX=!PNg{LPc zPqrp1-@bi2@K(fF2(_6Ij@?EQSnlqB#>X|Kq`F|t4fXYqbjzvmElLj#4jOi_FkVDP z-khJ&fKr8+_&=q=9e9(VxA$qGMyZ##w>j)3FE5~kEjCgZ+N^?t+6Q*3s)@h&G6!P9 z!|`Y3<>mYP`icsHF9tk{?Rb;{WSp9WgbzeMh+u#J%Q^qcjO~9s;{x==ZX*+uD&V7P zh3cScdG4?H9xtc(h-PkQp~egE_Z6W028{X7)`YQ%$-(}Bm}2U^cSS{!|6U+IcPHX% zyUYs0m+S%FR(TJM-n~gyO zcrdi+=;-qD@|~R>K(nB0I9Pai=KuMt3jFo{=;-MD{5%>O+SRL9>7}BltF1|=@BxJb zL?4l0V?DTk{~;s}4Fg}$qRxMJ(EtO~rM*=~g;FxtNKMMKZgQqH8n%V}{P`RmJ;-%) zwE6Pl6bP&hCJKqXFtpg2x$fQj)%W@Vpb%g;C7;cBZweQzr6w&O!N9!3MghxFY+A^# zhm;C>_Z^UVi-SOoq`QsYNzD44Zg+QgL!~J7P_?TD3-aaFWFO4th1u^lh0VE1GSdpcd5 z9mA9Dg6h)Xx;Y+wefWb`r5OYf>+aFn@xDfhZd@*7Xd8YLV>**KUFFr6uGb$x?jYxa zS>hI^wgcGt6egA3iA%O`GsroIEcY!}hvz%c_uY8Xt%)4S}_#Zr&sQ ztfx}dJ~pOtP!bap^NTN~mx|jY?3dl@w~XzrtqrU0WhbZ!1wHpnJX>#tDKYy6bV_i~ z5Q)&=5mvdQCBLT{qUp?wiJK(@Gj`Y+P33*OXG%fw=GU)Z(6j(?0Tv;zGX#f1PF_AL zD(VR~C~zucdbpuK8eFaC^#CnYRDLv&gXjs;tFiH7Ru(OB7tUbVb@Sd~S#C9A>xgt> zmkhKiH1S2A=br;$ql$^O{Qc_zo7Vs0*!<_`K!_b2V#wG&e}BQ21(0V_e4AIcT2#co z5|WZKHs2NssWLJ$(qx$QoICkamMX#Y-Tk=zq=CB?t|Le~Y(e>1MSlbX5edmP42*O! z|JmVTm$^^Ai(N4g_)4=dbi0`bUYqf<;o)J}@=&Jb)m)~fk*^TPzj@;gzzeVJ&13gu zOnkpxK+7H{r~i8hv*GE{Zf!$_TDiJv*QUV*%}a##6)r8M(v6Lcdgs-h@$#VF<%_?I zG1#P>sEGRhACZ}pFGF0uM7Q3^-oC}GpB#r0TRgP;o7D1GqbE~66O`iChWhMzDevAv z58&c>#(nMv#tW{NGba$NK%anlz)BFLSNCmdYFaWV1+_iTLA`Joy9wcf>*o;|LMiIw zFG5$J;iXsi z&^WpW%{~kzwscX1eDA;jjhLSg68SPXxC0haDw^`Eov>5M#QWOSNvP{n?;F?Yy7~PE zR6>n^;&HK@3n7o}Q@u`Md*ZZ3 zUU@E&z$kyTGebc{q^hGMWd1E3a`XPN4-Tb<)8>;Q5sD|9w-i3)Cl*|!x^Cx5(_Mxu zvvuQU&9V$($v*}d?iVM)-umevFb9ZLqSpwa>36c88xRn%x98MPso~c1qQ6~Dw%T8M zXpTZTMtLl!qAgYrO~~yE!U7s&pFhTko~!|?SkE>chZ8bEx$WfSH0+Bk@AXC_dJ)cm zKuop;Y=ee={P!_!KwS?jnltOMr@82WeF#@DR z;b!#;Qyl$X2|{}w9_ixZVyr~Z8W_&+#V%i8-w{WmawO7&BW0Kut6g&D-u2vc=mB+f zbw1B%vzjh$5f=G zOh-z<6qYahJJmz8$QU4Vbs!UV zZrak)5{!k<^83r}I&sf5vIw=!6N_xZXTK`3cve97Jw86(8|JxxA2!&+biFesE+w=7 zrKhJSsE3#5f9BZO*ut5am~v+~tub-P@A_XN$OG6(s=fhz0Ze98NU!t1ynwhNWKw`8 z@(ZABY}XT>mM{A~Ve$_9_{Jzd*W{fr@%tmZEF3vGxyf34du!`A85vYWM0Xo2hUcC` z)(4IYw9~^dh!Ya`q{UJkRb@uR|LtdZw5p+$c6LL1;CG*y$)qGUk|LNq@?s}dS+Er#CI){-ER85Jy&5W zYq$zk2vkaaGn12(XJvk)0XiUxfImX}?r=zo zM*7J4cyC$$4Ii)NcN3_g;;qRU@7^uaEQeaqXr=FU-=q6lTJRM86*V=IFb6lRi2{x) zs;i@52KM)RdwU_%jsxhRh@|+Bm$}^3qCRzAhgO^^Q&5=0eIYSxRgovOLVo_<+q(%Z z+jzF-dn`pcIrNaVtF4m8E3V05$sz$uE)T~Hxb&OyI&(3y=m1%Z&Ft)`2?+Kk%rhaV zT=$l~!X=x`ZuvYjek?WO?QV(nR@r<+_{M7Wb{#X8I0Hyv>c!foW@aR0WE0s>uoV>t zU<5$+xta3!_V$w5wUnXvPENkDy)9zamkRC#M}c(ELt`z0+<=7g5r9U&-id*qf9%H( zXCO7!V

@)ol3CEGp3~Zyg^Oprgx%Tk7lUw_KbQ1_q*ibmGN@8bMJ;Mh1dNMuy-z zhAwBVbOIw(yAICI&Q4AXPOcu}gj(ztLew#TrtDi>ccwjuvY*JNaLUWb0C{@z?%g{A zJ?Z`r?VM|I8H+t@>K-_;CIzo3aS`O*pf8V)*A*3^3L7YTKsW>THa(s0Sp^?KLP7$& z0g5TmB4Mw9aspvCJ`LC4U|C&V9k2x09!*Wt?d|Qu!-<}dn&GN~kYZx$YHxoJcl-SL zb8G91;ME(f@fjJuJFv@Ody4ss^7Cs{v;s>E?;aobfZ`7Lai-r1%#b`Uwb|qK#hFsaP{b5I+`jp66e^@7zm|NT>Sts^eqSdZ)32kfivUS20K6xeF*%9_^_x<9^u-}hEThdtPIy4l+u!U{6U=4f%k^kRUt z36x?f96F=5_6Br4-@Zwb6taE){=Eh!&bSNLtRD*k$=-e!wi%Qmx}9D2mX_sF&zY)H|Ewbj~8KATprG*t&IP1ndnI{C3PkLF2vpM>Af%9UI+w zA2aRw%|`VeJ-RX#h*-M~IJ!dLF+2Mkha1xV z*4mr}8zN85$%(rW&BWZik^<2k8y~;0z1<9%2ACeCba*USjpNf(HZPHo=H_!CZm%;k z&H=y@Q&JS)@NNH46oWRRvdVbD3w9D0MS!CVNB}Wn7j;!t2SD-8ms1SJqr;vWFx?!M z4d4aUdUz3)j!zE4U%djfYIc}!jiZ;kn}VkPG=hYq#(wS-Oe_#-z^IeIe=UyfZx=m7 z2!0(Lbb$DWq@)jUMQY#^mza3a%hdu3X3c^G7B-?_d39AoS-I7X$bN06k$>vW=Sx{x z+5O+YSy)-UPPc1gC?6VGTILtLHSbFuf+xY)6fWeDAnym-i%Li9(waQM0t)#Ge`U(kP&&9U^%(=)&xXa*XlmhO09h@MnWV? zAF{LQ@bF@w%4#|s)dBG6DHdhX@${?@4VBW>O|PwW*VIgfG}VJQ3iio6RA7eX{zSy=%T*7%*D zyn7s)_WHFiYy*G*n60;vi)sAN;$mYzy9H!jL9sK~OX=z9(bOUZ(L~8%FlGhNpRBE+ z#95xGG%sAdg_9c-^my>^T}H-}<70qQnEne0A%X1=A`LF)9=wMQl zlIHI0Hcr*rdwY5&B`04TO`)nomCf?RERJ3AfNNebo;t@x$ZPBz9I#M(@PbMz{9E{- zV%}w7fQE{yxjGGoN5U4)@%TBeysRuX9$t&bZ{YTSfsh3+!YSKdG9uZ>deT*WIYva z2etU`yrQCXQQs3N0C8^KguPCF`!>iqKw(_s`4rs-dV3pP)(IYLoxuDUdQR2YLN&6n zxhVuA0AL;)Nhhl|{XW5_Q37SR@?Rw&p|4#=r=}V~FWB%U&nhY?U}a+~tf;8?`}Z%k zh?m7m7Gy1m3#iWY%Z-A~qM3mw59VFRc#)Nr1#iM10!88wHj`t0>RJCsP*s`WVqhr$ z2uaP- z(h^{MY}|1(n4N_D9g3Kz@fJ2Tc(uN~;eUBv3)8-q1M*9O?*ul+3pDg=7ORJEia;XQ zR@f*j)V$NIV7}guR4>-DfxbHcSZd$lWVJPP!Q|>e`^u6CO6{vQXz?r1HZ1%2aRnx` z@3yU~s;Z?Wi^{iUCqVPp_qDmWxQIDdF?zJho_~R5djYNY^CKO3Y9Iy=SXo&?1)Q5R z_{IqA@WzcB_4V~2P(sbP{O@X|07-+7kFVz6<>uxFq)&Na!yKktAUHG>B}HXreeUn) zxO?|KC|GjGd!;S2`&0JY9o!1^^c9sk1*|>YSz|$zuK3<3X{RY^G|8u@>!l zwzjubl$GNX5*+bwbX)#j&76ygBIa6l`r7_dKUW>=D+jZO*d0T|naV53U73EP%{0BN zJ@({*)wyQxl-H}|WMnM5T%(^qgGzuVx3aObV`pPi)EXoMia>+kxnROjXL~!$#r3we zxfZd6AzX4E;2?6vh5@R5gW~Yg!ootvm|l|sNGiH@4)2z7;89~}#1uTXza}uje{gbg zCb#%Q!3*5$&f^dupxz!H-4j?KC}~6TI@sTrm6xxst;GZG?Bb$(F`|(Rmb<2^st*>; zJ2UGGPpp1~e9O!&H_mU;y?9K?c=94Igc(=Mh6)6lN68%eK5MmeHR`HOaoTQc;$mmw z{b@t+q&`z{W}>b8dE7SJu~mTjmUrY*w%td*^W)w10o0 zv%CWk1=ku-Veq~+IWC4c$SQ+7iwnT+3zllL$t+)aTEY23B+d7w!X~{QmQ&#qZn;@?2*$ zxhvCMq;RmS%lqDxd{^raD&x*bd%_uU5}i;eGCqLL{r(&i9XXj&|R*;MrJ&!E9UrGf${T7pc8(IT>maiu3$KYSPwN)cDZdB*aL`I#b} zj!C&IY<8zKUgOSsbWC-1)iAE5N?#!@t)ZF5DnsrGjmtO!f8gNxgyIP?08OXlRH;Vk8W`(szKmL)2oBcBSVY zvBK2VPAEm8<1T92lL(TC^5u~`SZ9*`LL7pA7*;ST@-kPps}S2IDA zkwb!VHC<--STCpoh4_TmF@VeBV_^ET9*>6;F8vfIWE@Oj!a5|AAd)%Y!Uy9gbSt{U zyXGVBTG6Rb77#xaBE;8gdRi)V5%%=$gZ!BAQNm+F+mzQG@$K0d@xgbUTvNtv%hlrn zlCpDhUK@@93}bb1_4oIK5S4mg!`$3FV|HYBxi`d7$r>8_BhC zXjLqMEDq)oO=IIJ>=#hKb9b6;Ekb0xZrhV;1c&iHMY5zD6A45H`m|AGqstB!o9fzCPp>}XQ;wGj)x$?pG2f5(U%3ecbSH-iP;Sg-P>Uu$Q?bHj)neAB^G4*=)SzOo&n9qf&0>D! z85lD91ePK5>gnlG^uPWC&5fr0Z_ql~$HiY>TDo4V@l;L@Oo|8KH+n4ybW2Wh3WCmu zkvViiybjU}x#$iMW;^gu7VGc>n~tJ7Sd0;Kb8)$O{W_3>PG|vKp6-f$rFjItZ}Oji z<}8nFv@1il1rXxoxS=(+^mJbo#qv*;t_1#ssBRT`4$^R{6BN0n24alPhX)5X2V;k| zb~9c;wm|ow%LYZ~eoC-jg9{4>$2QbJper+F1NPh_D=sbNI{K)7T}O*Ov~7K^1zZ*~ zNKgRz?Ppz_oCN(Z&Y&~`RAN_0(_#-$hS`}&FdO)|=hQP`E=0Z^T(0^2M?3?MHHqy^ z!62_8mb9XxIrkVCWX#OXu~D3%wa*#SY@8RPDoqtwR>4^gl^R3#(vr#iZCiEqQJ{3d zK#|DpsajIIKx=dJF1K#&V#tIrc~HATb!5|(4MGDSR8bU=wxNgtU8^JB5~NCg(euPl zCo)a3^%#H8JiVH;>zYb*;f8rl>1XHCMxOZ4H4A=-fiy0-48 zUaM5BT)D+MEDuz8B?yK#MV`OTFM&+nx(CfDtQ1nz^I@#Z_#-^TV-HsLor1 zv9s}@(bH^bDebz=QPS?j*Pr%Gnc(;&era!u_KIq5(w2) zV_U>TyoP@b%E-zFdw&LllZJ=1AK)+;i(mH<{}5SjFKXv8|3(S@Z5o<^n}aC106Iqx zA9{90Qz4h2TX}O3`dvCYI+auvAJsH8K=!+YP=?rOa9osBP*8aG48JlwU?rE(A_#Og zs5}im`8;G}lRY5Ct+jILJ&QAso_;mK^o(1yabY1fk`H>2{~}Usw#Jr1MXK&<$s^g=jdTEDsONWKn*rQ$Ce^59KwC32Gjj#q zSPv?HsVH*Sh4yejPXFH>q^(Yl#NGFn}m1Lc3!I{>#5TU}GC{Vp9lvlm!R>U1)9C1kToSel!Jv2Of*?u(o-Z%~4xm zG<|dLA@hO*Sasw@k)TyiA`6p3x&UMwIQcNhoNjiNqiYKd^e|9UxMX(FfJ-Zp{0SI& z42^tH```j~DZi+w$!(kbfg~9Gd(%xW*K;#(;^1K3y!|PF=wTUuJ`>yLrH0>}g>$U)OLfZULsL{no-_7^AyfE+)*e}B0Q zq_9tT490IYMP25V2bckv3>VOOb}p`%=x8(UNq}-7V{jE2w0weBl$4b8B^koM@@Zka zZ{KA=pCRbQ3zW|eWFK&60LXJ`mSurhXVdlJ1B@Bw&=;l>`anQxKB7#2c~qT7hk@hj zCGmLo$IlH_G&Mbzdx)X)H)C1=tOZ6_{vv;r`~H10Q1zga56c57hL!czYu8&qjqp)d zxzz|O7!mRC@XR9Jpt0n-t=rQ88By`A@G*=4+UkLUfiRM;ikpWU6O~Lb^GV!1svb$4 zzAwr(&+pW8u|4K#Ty_wk#1#_C`iH|2P=RTA)b>s#CMmGFBxus+omSpaGCl!a$|pSzhkYB^#|YSF90D zgk2;VO-Y82|7F<;lvrXSqL-P9dz(W!n9Z}FBLmq<#I(B=K zh3$JRM3nD)EN#hMTqLGQaT%}@N4v#5&%f>_Vj+h#sOqy_Nn$yXG25}~*yY3x_4^yx z8Tl@Xf`xuDH`CAP!R_ZkQBnOMJAIUU{RjyqTWcgAJ^doI=%iw(8M0BJUi%q{zJ|3h zFuqgR;?UzaHZnSJ-hXk;h|k%NWiKOwo#dc1o}tPvBikjOC-35oR0jB)=oXAqczyN9yI#N;@>HI(4FrE*}QS0@H{8KTPW2beY z!O`BCbN}_CJakNE{uI%RRPF~!YZZaJ$b2!G4;N{~t#6(fQ~tX|kCzAo#ec00(KBX% z?B%4bJ^2sbX62DU5%BE-r+!@>D<~{Pzj6f%G11elO6XY?{Cv2^07VIS0Dxh_9ydF@ zfx_HRr_rBI6`Fos_yRLX&tMVNFUHhZyq?Tyk*J8JYCppIJ2P5Afya?f#6vt3k8OG? zf|SQkSWPvLRWSIeFIU954{`Irvt(J&a-y8lIC=pxyGwa#e>FDS{t-62T z5dw%3Hy2Q(&(!d7$W6l#bmD5z%%PGJzp z#isIj;qojcHmw$Oj4RrW>P`1(0~i(FhvHfGlP_OUk6t0{={&(!4~5elz)`{f!}aNJ zHn6_`sm6!@X`McGVEO}=)#z?-7CGA6D|@j$ox0@O@rqcxVlpM#sAiS-{(byp)ET|% zwlU{L+VlguCRu{@6bHMT%@6%0i;_xi`3l~>PbhAq9BXoCjhQ-z-vK}i9nHqKKt$Hkq{0DV=@*5N|`ns9NjqLvz8+cDaqvT(eyXySZWtOG3bmF6ULVQLwh)}QODFXEY#nav-=AoL z@F~81;D8}}Q?yYccf>U=+2ksN{zlZINC{J9R1`>3aKXs*w6)2psQM#^W*c1D1W}h4 zXwA@60<(%7s(=IQO#2q^GN&gR9fgUmQQmp!XNUp(xHW2zHn6GPtvDDp*k2_juQltJXSy13 zJ!4RyE%P8Vf|3gVaQ%lAYW!JfX?!2b?vdYru`N&qnJAFg%#6nfBSYZbXwY*{G!b)4 z%ZK2c2LvH}=I3_-;$JHA2+$iOS>ugvf0op1PfL#S&Oz1!TL+xpJ3Bjj84P1iG<_~^ zXt=Z?BcE1Ag@t%(Y^N|k@3M;fA-Aw>tl?wlhPnd6$_PxX%gagW>AGra3@7m(`NNzs zHgUc;=-KvfDZCZd($$>?E!Y$o2Sf(~Av_)S(8L`Z2^AMhFNYd3^18#iq^uo=kw=TYFv-!P( zb4t4E=eY4{WR+5d^Pnq8U0=R@LD7i3JlbrCdEmSB3=F2A3=Cw7nF}@Wci)aK-gGh{ z@h=1W0yKT2!=PcxpdHOl!Xve%Z16R7!%LNS*8c&i0l-QP6HOCY(<;SMZe{JFgrmlL^bg#DbIe*Kc<7DgJ6q*1P}j$`v%%B-bY*E zQBlxgMw^NoRb-bQiLb{5ZK%n8SHID1J5}UmFwE!5u%*j_F-f^4}lzEzE|LL7ZDUodf!`yV%Imi+(f`UNYZ9OxpEiZo!rX&!W zp&R_t6{JQ9Bszt%FPXH@aSwW9dpMv z{7rmiJ0&?)!!lh^m)h5#ufbJbp1zFqzm;)^j!q{Ve1VYW3K$hQavERPezz4nS<3+^ z0p5xoI$kZdB01=GB1JP)W%+)M>2uyQ9!r7@5m`*US7M1tPiTC^yO9z&&;x+gC#9tH z*_{=kTX3oe*vsU#9tF<^5V#IjchFCvB?kb+Z#V7W>S{`_-(fMbTMMBBgsZ-$1|^Ns z-!1t7y;)X9K7R3ot#`ko?zm|b&fcSy+&U{2y~oSTkPQVoD7;bIng`tncw+B;Pl@bC zKjO%zA@QgOXPXP6Ff(OoM}V{j1qFc(QBzx623f3Kod#zzo^fo>FcbyA{%XPE`@86q1s)34y2B>;8l@Kr}A75Wk3)AD` zegn6ofPX+GXS#)La5c#6G!6P;iQ}9xpR>1e9Dk0$qbT7dv1$9^> z_$>3$jM+(4i)Qh3ClW9<{X@|M-X@%^zn?u;$m&>FSb#7A|EYnlt{f7|g|oGs7_e1B z#IpJ`K{rz!>OQ=!KGM4j&&T678wb+Wac**mjJDwq=JXz4y1>p?l z4n#6z8So>)2tW-RME>S&eZyl}0Tm-ut`Os%=Z1iqB9d?D14|-?7ry+P;WMq1PHHP5P zlqliVHDIesALuCkea$9Fn7*NZ48|p ze+-g}HRy%7#zu=-xZ`#8EPsmUe+lzl=@yev;_gj3!yuG(+hmQ)y^}Wrbpt7jF)8$f2kzU5du{eLPX}eaL|z(t)rZMfQO4&K(K0nGGI#`W&#De}g^< z^z-ND#Ds-)->ra0f;eH{TD%JRm}bImy{%;l*@t2>X;N%%-3;o!Qt}! zViFw_HyzLjG%YY947&_M9kjH%dI^47U=u?_ptrhf{0MZp9@BLSa$2444&Y&D42?ga z77+g42@;^yQGe!2Axn8>Jf#0%vTxSlnK0`mYoo)p4ToYLYFb86QR3<~Y3{zpaonE7 z$CrOA7vJmPcSKfgEyZs)SlXhjHu5I)J2INtoQ_TLu~IQe6CmUHf;<3S7bKiFz7Mi9 zEcoH(nBq+6%5RVV7-BV{4+*3nW#4}Ov7o1mvQ$L=gMOuJt%I-E>lVGiMbo>qF zJ6K^rwjF_9fTuP}Fp5i-B;|TV+RzaHnoO@z^23K$hi<#nGxd*yFjY)H6kJio^ud0? z`THR86S{5lWc8_mAX`CEBptow2y1)|TE#HsvyFOePX&vo-yD{k^o4b7NQyKy_INPV z@=Ho^pG z4iZ{g6N+NzDBUtSF%b@aBu?Bd!UuuJ|NKxxUw;;$nIF#ML$&WY`U1>zUdESxlPv~K z_e9^Or(3MZy^1lXXXI@akN$p-q!%|Zz{jWEJ?rr3<4EE9o~d@d@;vSX?zIT64S_^) z0SYyC$D-QUb%~AZg}+M5aKEOL7Aie%%AlZQU|0t914r{1)cmLuq%NR%LXGU?=xE45 z4JA9ua7)3@2~{X;KSst*XsMt5{S7Px{_ySV*Lo<$P{i(?5na!~fH{K#4)9`7Ze8G1 z6Sc6%Eh3@=z?tDGpw@YBmoQ7lJ8GP2l=JGhs5gf5T5fNU@1YGU$Hgr$6zdS;FRv&g zUs~ZYxH=V_1#^2Pv>-36veLn|@WA{V_~0{PCFm|fcf%@B;wZoGBxPF~twhvkf_3 z%};115>(R|^ZXq0vY%w$`I*$&?e1r3e$gETha-77pj<+->~tgQ`FyHz1I{{telQN+ z3^OxE{MV_e7;s&?2EDbg?ZMeWFo{964%v4XPz;n1*lJ)Tg2pXMwu4#)I=abeX+5gO zLdyMQkRekH{OS$cLcsm-7q~;kDlwElY6Y7*N?SM6(u>zlqcx8&Sq+!?oIXujONdg56=jN}OF@cfM(YGSrd;$W0LE8rr1vw1; zTQCQKIcl({=hgO_$@*+_Dm5(>2SMOd6uk; zi`=7MjQPvi4BXl*suBm{8{TeFNuw9cRDq*+n;4ipYWL(}JG?Hf8I);2axV63Hsb6MC1 zE39zRQG(xMx8Z?;!opZiK=hB!6fz!7GqV+#R_}wgxTK_Nz*nFapWwR-0D(XI*DAmf ze`xtY3n4lqW9Ahx8(6$SJl})pGchrt6mWRn9ebzY!nq1gU4{V{o4`f>kc*`^B(;kq^wA$l4Kg5YG;Iyl%NLvrag@Hj3YIa9nr zBdneE>IGL51l4GQ^=FC%P^f_2fBW*qussYPJlXJdAYd|uAwGTjR1@5j)z!RHXaym& z3IvNz^`N!f$%cK`TktX813`}Tpi_<@(89*X!eg?wE+{q?B2r=qbW^Onc2z(?$wR<( zSHbs``zrXtrlw9o)di6TWoUx~?T|`7o$d7kEripA=OB4)bz&bvcOOnI>^A?=hyFk^ zr(PO-O98YF09ZkPr+nyS0up`HRz_hhoPY+`?5&{>vMDCRUv9b&QhfV%x1LLOe+7wL z>CsUl8byA)Fp+Ucx4@8m_xt%F3qt@w zV{rOElE@6GHPBzpbH!6uQUF|o-`3jCy-iJhiiCiG42pO2Cb+cgBAZKHs1iDQ-cn3z zLWLO`20d}pVem<&4aPq4d9S}xbW^NF&^=49QgVJ4lqHa^coJuQYaO`+3qw&5h#MLo z-~MNZo0oxZZ$GDsCs>G5C^?NkcTnkMF{VKw6E$Ij6^ zc_LEMUI82szf`5EBK|(L8Rok$`E0V%(!4e&r>5YFwz9yg#o59 zn94{Beg!0Q&O=V>xJG*ag z0^}X@4t2VmnFFP8(q$7T3>NEvV*Tp+(gae{sS=Iq}p&enR$!Yd<(Oxg!3U*>SQeD`rWm1OlM=50A(jTJg0{XXMU$eou0_X@Vus`~CMv}o~03^Vs@dMctEUw_E`T^hR14&pRQ$>?*W2}@0U$5CKX8n{PgJ)_r}^G8~OnfYI`70yhDr(kBI}46QmX+NjBus!3sWK^?o~NVZKJNSWbN#OI{eH&zInVPtdF9G1P{ez|!9n$XeI6(*0E(cla}3A`0W3wZ z6A4YzMBz(&ITm)X#&CaddzJwz;v_+1V`pavP0kBQCY~R^44PQbspass5HVF^^?2lL z5H|uZ61vm_`(WgQTUx}q_4_7F;P-)_YA46Is+Z*e4<845X&IU2IH&3hojE(^?QkYo zAFJXD1S;I=3R)6MkDb3gye@AI5Ib8RibnwGu81?%r~*U?CQ~yrbZqyhOg5r{=So3D zhn5clA#6WUeFZE7OxnT0?4DI|?0*pvXjbkR1NLAA5BM7Kzddh(O)XaTGyIeShGtOc zw6Y-&-$E_@XK4n!#-j5e>9lfrjs_APPNn-i$T#o*LWY+|aA**M$ed9vJEbn~Vghsh z!IaWQK+OkIu#4z4Q9xn!$dA%>zkY3t$VR_R?+#tN{qG-G2)~Sgc7*7tt2clFph9E? z#O6bvhI}4?Ak3A597pD){{9F@BbFcd%?)j4PcMTD)Yj2qQ2xypgyCLPJ0P(5p7Vip zU;$4VeEbs5*ar>u^+lzn+$o@CkvSUTWn2Q!g9dIpf(*1<#+iHmr6Z^z^Xq*T^FCSc zs~Em~Xe!zo$3e~Sa7T$hrJjmULc6_VgO;w?Q&APcb||5q+x6y8$1T~br?{6nAKfR( zbX8sdDwjb)MM~h4y(x~xEh1twdoo+(n?3AhT>N8Z#tOy8jx;jtw7)gq`X#amueuD_=ME#@!!M<&@~R(k|FqUb=J% ziWjs=*_!*pzIPg1$zS>6qs8;>kU_OMm`ShhP+iKlsHQ=e*$i5u8^mbU-yCWeX9iE@ zYgfbOsoFNQ;cQ3b1<=bK=*&@pMHpKqughWDRJ}YJ2WDY{ps}H0bE144dnY`dVX@`W%M+7);w|iIX|+;<+kyJecJBOW_kIt(BSPJS;-}**|`hhY!MmMrxIj; zz2k7wN!1wsQ1!~u=DLDJtu2bK1v6LVQxG`|3k%2O#4i?k{kcBQD(AiCY00wETjgrV!;kt2VxB0e-Xr_UTcEF*aOfLM2S zS#M^1+l<;&q2{l&a{4T7&fRgW^vWjyJ)j1E>e%bNG;N_An3{S9bTBL%t!mFI z(JhTh{oUPB!P-TbVPaLI5BT}}=NaWd$h13s43z4Szi6hSeLB=~kOCR-+gU{|TluV0>+o(z3G5q+q9CE&vO}Ra zTDYYor~O49S$Lf)X7J|;Z@|161W`ke+;K$tcXf4fXLtDF79&9d zrSx0yKo&yhb{nP?VncSA@s$(^WY+4p_a2gD^BQ=zF8g%}kGy98xs@ew~Y{!eQ3hn3mPu zXH%iRdgY49mzU5t^9~6GcP^i8my$2mkQFod<}G-fr+CwP3?NpcJd>kNCR5YX3Mh*} z=fA)&9MyPQJX9kc6?gm*chOb(ylQiEb4bQgvADG@bV~n9BV3z;nX&o}bD>I*4WjRz z*^Ln<(o?1aD~;c4HZgm!_pAz;b}fQq0JgW&c;R2Dc{v8HF={}MJ3UbK2cY@>nfa31 zs1rpz0P;GFS}?Z;bs>&Iut;6ty#Hp}{LK-y4lmqp%cp0Cv~5$DkkW&-2=DgM_qJtH zjcaKXKXD&tK)oV1#=On!msbEO^%6#*ZMwB+nys|=itW+Desd@f4ZlTcq(cnbn5CQQ z`&vZE`b#%ewJYL!Y{y3LdM=Xcmp(eJWvoAv)^I< zh;9hK! zN?CMIzxIeRMTa-KM5g!Dvr=2xv5Z{7C*7X5lHQz=2g^3*wWE-Gi5_gvt>4MW?TlYX zMnGbBf|~rJupP!rO`obHplo^=5|W_cCHqUTwd-7w@TX3i9>guq{w<-H74`HN5)PunF zptqGY6>!TEFyaa4M30FH3h=7O4QG8r36)@NEkPT%JV7UL6p`iS+OI+oRp5dX6%lb* z7=s{O9qSHo#UK+~S~JkoQy%m`u$>m=FXjP?=rQ##30`zA|IJL3pJ2d`z)WcOl=hk+ zfFDfqRQ4v@ksx!>*tBIQ2Q8Uy_O**^zn{8TtFKO*BsN(<-Dz{ z1N&Q-(i+#|J>e}QErIq3WWn%- zfv)aV#97d%+PCexfQ6623vmo2C2B6#?Iy@|X>+f$oLQMQP z*5@~5g4#3BhNzi!YOgFrQ!)_vz$+D1AnKE0*^~Qw@pMWZFb2T@O8)v}bVoeR`uVtjl%Z7rz#nc8v3qn05{%g(1gw(lcCRLtO<6*4H4Mje;Li6%tEW`h?W zBs2;NiHw9I*?HuBYb!8UDIDvtx2N(6C8ZjaDPjPi!Mcl{4WKFsYdDML048lw$L8Az~HPj$7HxXDr@ih?&H_ID@pUASX@+Q=S?bsouF@AWm`P%uk( zwg*L@>vIC9VsC5l$laJF2Hr8ksz@=eE-n{8 zl~18&2AS&^HKAMvwetA!cWA`+Zl^_yg_ZtgYzzbWr?$1U<88nxgjj;XC3SXj0V<$D zjgi_W*9$1-Hr)1!RsJ?HG4bU~(dB+wk8Qfjfl7O$G2|-iIVk*cGihq!nK6@(6*e_s zi|qV-dQ300wIv$FIsHbDZWoLqUDM;;j-%`*>;H{mI9xXy{mrw3+-D|v;??is#Ph%9 zc_Tg=|x2t<^il5Tk`m1j7=r^b_Lasku5nQz}!Jy?ulsm5BfnWoG2} z6rqN*qR-7QqoYH4^bGwVpNu%e2Pqjh{I?nN?>kziRtZeKIZ&TXy z=Q2VPcOYcSuE2)$Nvb0K2CBAhvX!XpAQOu9ErT4rx#rd z)fmRia_9w+{CF*h<^=dBFrYCon6L32ITHV(A{QFL0|)&21X!OK7S#%{n1w+;*=>1q z3cV!=Xo`Pl-+(py`vG-cQuaGr3N1ggPatB1DG-`ToJ*FVCoo??HMv!){RIV!ZTN!w zA zXrj#L6%hC;M{5L$uA)l@Iai}>pW^!8dDO#LeyHCc$Hz~Cf#s&!dN1F!#D8@u4T01* z6bkUb=P4B#$-Ss7a)fGNNNaCBVd`iIH$BRw;lz$>`7oL84GFgYv zRQ>$<({ZtxvUQ)B*gR%g9rS&U($dnqWUrmL$u=%Ii`}z7nCiiOc8Q#fjN>=iMm4q~ z{0;)^F*0H)Q#y*|3a}AWNtz&4W$K@ci;3X<-e(hocj$Xj(izFe6e5(TKiKjC)LdL# z9F?OD0Wq_rq(pE`f%2q;xOh{%j2IuEIyW<6Y65_SVvy-}1iHgd&#tD@a5ObEEY~Tn z*}UFF@wlhA7akrZ!h6ti?bzXp>_)^81XO4|kw^pu1%;~?^ibGHM9^!jJa>e&9KX|=sdhjLeDZPeXQ$bn=aDzYxJ>iDZ`W{`A9ikH8jb)5N2~HU! zV@*5!oRAjvvn}x(I}1m@U*F;@2j11Iy?^t6dXjQ|1z2wIL^ZCj zExja&s=lEZ1v(*R^$2c~hC_wO{+HJId3ha{O6~Vbn&@AMTXa6kDK@P)nlgH7t-a-U zrOD2|}KB3NKzv6WB2=K>cMS=8WOwroz$iq6l2Wqa%&C+^hvAz)!qW=EnUuCEBy zG&Yq25*b=E8O%=rE8*m7JiaLGo_O;&&Ot*ZMD;_KWIk{xkdYsUhKgM36UU>7)7RA{199K) zCgK5_J%EkNO2=ethk4&vXB3?{cPYH>h;j8BiZ3k1CL-Y=fM6&K<|E`knQ3WTc1efM z1lF*)dw38k>iURsWV_TVQi8mQKCK6v@i?>C2c7pa2B(SzltQ18cqn}Y0ppHdL9vT~ z+zppfe}BkaR#sMUPe}pd=}b9eG3PqEM5{?A6yy6D=UwRHk1+Jxs?PlgQ$$Ru zPY6X7T2x3LKCIi=l0?d<8tA{xy1;ItK{>nN-f7!Jsa=RY@BKsf^5Lt3PW z8NB&}h<5}?Bef)3ks^01-XcaTa&oDbE6^KeY8|dq-0su6*WIs++B9!SRE#0vh&z&y ziTh~GW&3(t(4+@FCh`$9?y07L#rG8xl;Ia@Brn(Rt*^FBz?a>JZEvtd7l>~t|9Tz| z+eyq}qa!todDh>8zXW=4XtW?V0jvQ8yV3O_V!w4`Xf69iR4&Mgo@&XuXnL<-m+Y>B z_al(ag3{8C4g{m?Cn#Zak1m^p~P;USdr~G&6vs7ouH5#t2zc9l` z{Rx4>Z%90w<7L8U2sf>o46OZrl$}KW0OSnB912w;yAsi#L@M73?~woqM$mrGVwi?n zqp`X97^Ki75>Z^ApGR^0kW;Q4?s{e2mU6D+1}KS^|GA3!FgEd$w7HoZ05LrUkMp)t zkwa$=ct|uwZ-q*40bXqe+E&v3vn_MAcMU4n@J;Zy^2g}f0T88Dw8#+RkS+NJat=zR zukhDur>3Q~ec2QV3#PXB#mqs&ZBv>yRj;L~;cdNeSD?$2m=$4tTfPwD=ijWH z3k<`eu)S}E9T=%65-oBu+XJXw2S8LpgNOvDMg5KYn3Sy|E2p0?ko6l}@SGcb9>-8`kICkoUc zbMcXKvWSaFAN=BOjW+Rls!`M^J~ywv(Ef;ma<`mJzQ<_HUIbfGk!!u}a#)P}_u+J4_~V;`{gQL#uJxJbn**U(CD`4E_*; zd>J2whGH4kWSrI145si z{)!ErN;_UM7pAG!v)#zHita|0*OT^je)EctnO4g>mvy~YStAgecbb=F_6n@HKfRV8iV`DXzj6n6ifU*i8M9{_{?VCYdtL8u7;v+<2)*mVLWkwQq1L!E=Ui=?E8pj-?hDgMx1S)qhe->yohAbEn|($+$W0Z`qGb+wXJz7sN~8owDW{Z5s-5DQ?vyFrYu5FLowR2rEfz z5}c~SoSd&Ic5rTskKYxf`g$%Exhpyp$I`mF$c<8pN%`JAjR8;nZ^pM9Bl9t;NO>UV zIwvIPl~vwzE-7DE+o24jsp)tbx?e#!)mI3%y&%UNxP{CL` z>_l2NpgK>K$X1{bVe;Evhd651Ys4}EP3!dZaq6qCt{*MTP6WnVUbw9z6+}aw?8Gup zY|)vVyRS$!WncoC3$Vz^$Q(We&D%u}UPfwJP>U6>xwy3Jg%RK$#F;Rz$^qsUCvYB* z?NxcP$!h(&+lfLKpM(mMSrj@kAdbb@)ce9dzi@5z6$I9$o8%k-pNi<{KzC#Wd;8O- zlliCJ5|3na`<{>GR=V)1JR~aWAeZW1MhF}&dBO>hEm=7kcy2^QyjBqo5Qb6EQT{ihb67k2u48LchhoV$!mtT_LXU$PdKDaFns%w;V) z?_L+bcy#B^{|zbans7U`>SzfZ**c2%twhIgew;OAcd0PGt@K2`&hT`CP+__3AEB(W zg2x5pe|}kc{ykpx{^G%?#)}T(LPZCdgG$r7O$+piPnJ4G~*iz}@$Bq`hfRdA8Pb5c|@E^Bl zv$GUKLzMR&HVq4MF>3@bmza#wTMFo(DqFh2*1A>S(eZw@ArT8|9+|Fq zko&riTgP-bum?*_G4e^Upc0v!ADgG)I&gsDyJkn*cjA-Q{C)7NK6biS-|Sdpk&uC! zO=kgLZn#XHZMq&`nMvNya9&c4Z>fMn{(O#}`Ws7BNHwKv#g+nMztW5^qzfH((N3?_ z|HU0~Imf8G*RMLatvFeS_t7K0#>PEty$=?JsJWP!Y!)he_IPW3?-n-6#(;{7Om07X zjKzo5kwx;O)SlYMZY0v~Ri`Qw!<;eK0o!zA3PB4F?+89wkNf5=%ho{&34sbHwfnuN z%@g%**F8+S!bwRwpZTL*^iS;{6Cr=>Q1g-ncQQ{{gzNCfRNATmM>wxo8W<=C?tWef zpSILgl?y*q{zbq6-3>l|x^m4VedI?0UpqVUt|}?j<7@fPO)5daPSrA2`n4mC-5HsCo)DohBcmZ_WwJzqo<1Z^qEZdS zn782@9cksWl^VH?BO9r(M6De69mOml)hWWFVv#T5s*6kdrfX1@U+ZRN-j_MJPW?-W z&-$~#=#So`gQ29FrYo$hB%cE%YXXZyZ{|KdrTdkiF6*bHIJeH(Hgore;>My~eVc7# zqA#A=Ur5}zuB6%mt93v1zUQtJE#U_vd>OUFH}YQUyK%$aomqL~hND2?>_la_RC%}a zZ>P;RFf%o^dt^;gvN90Ou{*XQJ$IqMoQ8od9 zGO4INyu~N|?5TR>A3ok^;SsLCzr5PNaFTKN?rGmpIOBm+3~=nYriGiE+qZuOn8c zj;tYIA+opr8tCXKX=`5sD+Uhu^p^=Q_Zr90S~FP>^YZHIwT|qPcTznWA$9d(Z-`Ue zXX|r<+pKCu|Jx^`^AQolOoaPDx`L-kK}mGj;IDuH25N>qPpa%TZ@w9%+Lx-f#HErb z_9U2&b?xSlwoaODwq1o*LE3hxI-Zo_O=BvKj#~z~{@&J*zqxd4amL%qQR!D<^~z#f zdM-4|gqswJWJC&f%~i`UEpwkYj)*WE8F|=aEIzpe@hHn~1?%yS-mwp3C`_kWbXjSs zeE-_@m?Z18#_hydJ|b#j_YL9=7+)Zyaupdf$ur4>b= zua?_Tfvc$nw6z8Jh9-HR6x(|;{Km?{1s$DGiXBuNUSS^j=WDQV>=AC_C}p9wM_MedmjdJ_hD7@Yr&meN4?c%pOwe|TVtFh5UV}1cfYK#Q! z&(#g>@mO6EZb@8Cs8}Sf*?=p!^VRTO-mJ32a?*9m8LIC^Pk zW9hk5cb-0F$s5<7k5bF3FcTi z71g1P%X{dksWq3Ff!mcu$AKPl;Y9}(Zf4zW9QZUTkGa_7Qdi;n zXYMJKaCobOhH~IIH$?`fasN-)%XW3}Q%*+p>u>MnSxLjy(sGhh&f}w-8_mWIqfPw* z42_NNcPn@pd?cr`y26Q$X9;ZRX?)x5DAfBxV{e1LA!S0+Ll60=&FF?f?C_4V@qo-qalu6r`^C z=gin01+Tk0U?(@3rr))Db;O}_uN&nr=cG#LcPQ?2mm0+3mxvz5h zP_@clUq-SCSkH>FmA#$0irQL#YloYWU`XG&hyS%GcwHW_75opMuK)7}#8QQ5*2d(t zw2rwsHS;Cr-3oh;c#^uS@DUP$+3f7A6h$umnyRYNEo74*)wyOV z8lIVz@y-bzC!(G7fqC$*;&`$NY}R4)5nX8t+oFCy;sDY8r*FlbF83F`dszr&-?fMI9V(VaS4geE`=SzwE!_aesz8p08X3yz{313A0L}> z!Iw>d3rJr8+ifMjAx6WQn>Q=7qC#%9wWa0q-0)8k|ZuJi%iZ=PQE>1nWo1#kELuJ zXWqsph#&gwP-1CJ#@CNd;*CYZ?rgif)>rKy*=w^P)^E)<{BnBUout order), src zone (in->out +# order). +# + +#ACTION CLIENT(S) SERVER(S) PROTO PORT(S) CLIENT PORT(S) ADDRESS + +# +# Section 1: Rules that need to transcend WARN/BAN rules in section 2. +# +# Nearly all of these rules should be limited to system administration +# terminals. These would be better put in a separate zone. +# + +# ping (more below) +ACCEPT lan og icmp 8 + +# ssh (more below) +ACCEPT lan og tcp 22 +ACCEPT ig og tcp 22 + +# SNMP (more below) - for MRTG stats run from LAN +ACCEPT lan og udp 161 + +# syslog (more below) +ACCEPT ig lan udp 514 + +# Squid - this wouldn't be necessary except that a lot of OS updates are +# rather large... +ACCEPT mail proxy tcp 3128 + +# +# Section 2: WARN/BAN rule directives +# + +BAN ig lan +BAN mail proxy +BAN lan og +BAN ig og + +# +# Section 3: Drop noisy junk +# + +# auth - reverse of the SMTP rules below +REJECT mail lan tcp 113 +REJECT mail guest tcp 113 +REJECT mail ig tcp 113 +REJECT mail proxy tcp 113 +REJECT mail og tcp 113 +REJECT net og tcp 113 +REJECT mail net tcp 113 + +# KaZaA file sharing +DROP net og tcp 1214 + +# Gnutella server +REJECT net og tcp 6346,6347 + +# Half-Life +REJECT net og udp 27015,27016 + + +# +# Section 4: Normal traffic +# + +# ping (more above) +ACCEPT lan ig icmp 8 +ACCEPT lan proxy icmp 8 +ACCEPT lan mail icmp 8 +ACCEPT ig proxy icmp 8 +ACCEPT ig mail icmp 8 +ACCEPT og proxy icmp 8 +ACCEPT og mail icmp 8 +ACCEPT og net icmp 8 + +# FTP +ACCEPT proxy net tcp 21 + +# ssh (more above) +ACCEPT lan ig tcp 22 +ACCEPT lan proxy tcp 22 +ACCEPT lan mail tcp 22 +ACCEPT lan net tcp 22 +ACCEPT ig proxy tcp 22 +ACCEPT ig mail tcp 22 +ACCEPT proxy mail tcp 22 +ACCEPT proxy net tcp 22 + +# SMTP +ACCEPT lan mail tcp 25 +ACCEPT guest mail tcp 25 +ACCEPT ig mail tcp 25 +ACCEPT proxy mail tcp 25 +ACCEPT og mail tcp 25 +DNAT net mail:$MAIL tcp 25 +ACCEPT mail net tcp 25 + +# DNS - assumes split DNS, with internal DNS run in LAN, external DNS on +# proxy, and mail independent of the rest (proxy & mail should run their +# own caches). +ACCEPT lan proxy tcp 53 +ACCEPT lan proxy udp 53 +ACCEPT guest proxy tcp 53 +ACCEPT guest proxy udp 53 +ACCEPT ig proxy tcp 53 +ACCEPT ig proxy udp 53 +ACCEPT og proxy tcp 53 +ACCEPT og proxy udp 53 +ACCEPT proxy net tcp 53 +ACCEPT proxy net udp 53 +ACCEPT mail net tcp 53 +ACCEPT mail net udp 53 + +# HTTP +ACCEPT proxy net tcp 80 + +# POP3 - must be proxied through mail +ACCEPT mail net tcp 110 +ACCEPT lan mail tcp 110 + +# NNTP - application layer proxy (e.g. leafnode) on proxy +ACCEPT lan proxy tcp 119 +ACCEPT proxy net tcp 119 + +# NTP - we really need more than 2 servers, but this is only an example. :-) +ACCEPT lan proxy udp 123 +ACCEPT lan mail udp 123 +ACCEPT ig proxy udp 123 +ACCEPT ig mail udp 123 +ACCEPT proxy net udp 123 +ACCEPT mail net udp 123 +ACCEPT og proxy udp 123 +ACCEPT og mail udp 123 + +# IMAP +ACCEPT lan mail tcp 143 +ACCEPT guest mail tcp 143 + +# SNMP (more above) - for MRTG stats +ACCEPT lan ig udp 161 +ACCEPT lan proxy udp 161 +ACCEPT lan mail udp 161 + +# HTTPS +ACCEPT proxy net tcp 443 + +# syslog (more above) - DMZ & OG hosts log to mail, IG & LAN hosts log to LAN +ACCEPT og mail udp 514 +ACCEPT proxy mail udp 514 + +# Squid +ACCEPT lan proxy tcp 3128 +ACCEPT guest proxy tcp 3128 +ACCEPT ig proxy tcp 3128 +ACCEPT og proxy tcp 3128 + +# Webmin +ACCEPT lan proxy tcp 10000 +ACCEPT guest proxy tcp 10000 +ACCEPT ig proxy tcp 10000 +ACCEPT og proxy tcp 10000 + + +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/contrib/shoregen/samples/shorewall.conf/COMMON b/contrib/shoregen/samples/shorewall.conf/COMMON new file mode 100644 index 000000000..e3633936b --- /dev/null +++ b/contrib/shoregen/samples/shorewall.conf/COMMON @@ -0,0 +1,569 @@ +############################################################################## +# /etc/shorewall/shorewall.conf V1.4 - Change the following variables to +# match your setup +# +# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] +# +# This file should be placed in /etc/shorewall +# +# (c) 1999,2000,2001,2002,2003 - Tom Eastep (teastep@shorewall.net) +############################################################################## +# L O G G I N G +############################################################################## +# +# General note about log levels. Log levels are a method of describing +# to syslog (8) the importance of a message and a number of parameters +# in this file have log levels as their value. +# +# Valid levels are: +# +# 7 debug +# 6 info +# 5 notice +# 4 warning +# 3 err +# 2 crit +# 1 alert +# 0 emerg +# +# For most Shorewall logging, a level of 6 (info) is appropriate. Shorewall +# log messages are generated by NetFilter and are logged using facility +# 'kern' and the level that you specifify. If you are unsure of the level +# to choose, 6 (info) is a safe bet. You may specify levels by name or by +# number. +# +# If you have build your kernel with ULOG target support, you may also +# specify a log level of ULOG (must be all caps). Rather than log its +# messages to syslogd, Shorewall will direct netfilter to log the messages +# via the ULOG target which will send them to a process called 'ulogd'. +# ulogd is available from http://www.gnumonks.org/projects/ulogd and can be +# configured to log all Shorewall message to their own log file +################################################################################ +# +# LOG FILE LOCATION +# +# This variable tells the /sbin/shorewall program where to look for Shorewall +# log messages. If not set or set to an empty string (e.g., LOGFILE="") then +# /var/log/messages is assumed. +# +# WARNING: The LOGFILE variable simply tells the 'shorewall' program where to +# look for Shorewall messages.It does NOT control the destination for +# these messages. For information about how to do that, see +# +# http://www.shorewall.net/shorewall_logging.html + +LOGFILE=/var/log/messages + +# +# LOG FORMAT +# +# Shell 'printf' Formatting template for the --log-prefix value in log messages +# generated by Shorewall to identify Shorewall log messages. The supplied +# template is expected to accept either two or three arguments; the first is +# the chain name, the second (optional) is the logging rule number within that +# chain and the third is the ACTION specifying the disposition of the packet +# being logged. You must use the %d formatting type for the rule number; if your +# template does not contain %d then the rule number will not be included. +# +# If you want to integrate Shorewall with fireparse, then set LOGFORMAT as: +# +# LOGFORMAT="fp=%s:%d a=%s " +# +# If not specified or specified as empty (LOGFORMAT="") then the value +# "Shorewall:%s:%s:" is assumed. +# +# CAUTION: /sbin/shorewall uses the leading part of the LOGFORMAT string (up +# to but not including the first '%') to find log messages in the 'show log', +# 'status' and 'hits' commands. This part should not be omitted (the +# LOGFORMAT should not begin with "%") and the leading part should be +# sufficiently unique for /sbin/shorewall to identify Shorewall messages. + +LOGFORMAT="Shorewall:%s:%s:" + +# +# LOG RATE LIMITING +# +# The next two variables can be used to control the amount of log output +# generated. LOGRATE is expressed as a number followed by an optional +# `/second', `/minute', `/hour', or `/day' suffix and specifies the maximum +# rate at which a particular message will occur. LOGBURST determines the +# maximum initial burst size that will be logged. If set empty, the default +# value of 5 will be used. +# +# Example: +# +# LOGRATE=10/minute +# LOGBURST=5 +# +# If BOTH variables are set empty then logging will not be rate-limited. +# + +LOGRATE=10/minute +LOGBURST=5 + +# +# LEVEL AT WHICH TO LOG 'UNCLEAN' PACKETS +# +# This variable determines the level at which Mangled/Invalid packets are logged +# under the 'dropunclean' interface option. If you set this variable to an +# empty value (e.g., LOGUNCLEAN= ), Mangled/Invalid packets will be dropped +# silently. +# +# The value of this variable also determines the level at which Mangled/Invalid +# packets are logged under the 'logunclean' interface option. If the variable +# is empty, these packets will still be logged at the 'info' level. +# +# See the comment at the top of this section for a description of log levels +# + +LOGUNCLEAN=info + +# +# BLACKLIST LOG LEVEL +# +# Set this variable to the syslogd level that you want blacklist packets logged +# (beware of DOS attacks resulting from such logging). If not set, no logging +# of blacklist packets occurs. +# +# See the comment at the top of this section for a description of log levels +# +BLACKLIST_LOGLEVEL= + +# +# LOGGING 'New not SYN' rejects +# +# This variable only has an effect when NEWNOTSYN=No (see below). +# +# When a TCP packet that does not have the SYN flag set and the ACK and RST +# flags clear then unless the packet is part of an established connection, +# it will be rejected by the firewall. If you want these rejects logged, +# then set LOGNEWNOTSYN to the syslog log level at which you want them logged. +# +# See the comment at the top of this section for a description of log levels +# +# Example: LOGNEWNOTSYN=debug + + +LOGNEWNOTSYN=info + +# +# MAC List Log Level +# +# Specifies the logging level for connection requests that fail MAC +# verification. If set to the empty value (MACLIST_LOG_LEVEL="") then +# such connection requests will not be logged. +# +# See the comment at the top of this section for a description of log levels +# + +MACLIST_LOG_LEVEL=info + +# +# TCP FLAGS Log Level +# +# Specifies the logging level for packets that fail TCP Flags +# verification. If set to the empty value (TCP_FLAGS_LOG_LEVEL="") then +# such packets will not be logged. +# +# See the comment at the top of this section for a description of log levels +# + +TCP_FLAGS_LOG_LEVEL=info + +# +# RFC1918 Log Level +# +# Specifies the logging level for packets that fail RFC 1918 +# verification. If set to the empty value (RFC1918_LOG_LEVEL="") then +# RFC1918_LOG_LEVEL=info is assumed. +# +# See the comment at the top of this section for a description of log levels +# + +RFC1918_LOG_LEVEL=info + +################################################################################ +# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S +################################################################################ +# +# PATH - Change this if you want to change the order in which Shorewall +# searches directories for executable files. +# +#PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin +PATH=/sbin:/bin:/usr/sbin:/usr/bin + +# +# SHELL +# +# The firewall script is normally interpreted by /bin/sh. If you wish to change +# the shell used to interpret that script, specify the shell here. + +SHOREWALL_SHELL=/bin/sh + +# SUBSYSTEM LOCK FILE +# +# Set this to the name of the lock file expected by your init scripts. For +# RedHat, this should be /var/lock/subsys/shorewall. If your init scripts don't +# use lock files, set this to "". +# + +SUBSYSLOCK=/var/lock/subsys/shorewall + +# +# SHOREWALL TEMPORARY STATE DIRECTORY +# +# This is the directory where the firewall maintains state information while +# it is running +# + +STATEDIR=/var/lib/shorewall + +# +# KERNEL MODULE DIRECTORY +# +# If your netfilter kernel modules are in a directory other than +# /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter then specify that +# directory in this variable. Example: MODULESDIR=/etc/modules. + +MODULESDIR= + +################################################################################ +# F I R E W A L L O P T I O N S +################################################################################ + +# NAME OF THE FIREWALL ZONE +# +# Name of the firewall zone -- if not set or if set to an empty string, "fw" +# is assumed. +# +#FW=fw + +# +# ENABLE IP FORWARDING +# +# If you say "On" or "on" here, IPV4 Packet Forwarding is enabled. If you +# say "Off" or "off", packet forwarding will be disabled. You would only want +# to disable packet forwarding if you are installing Shorewall on a +# standalone system or if you want all traffic through the Shorewall system +# to be handled by proxies. +# +# If you set this variable to "Keep" or "keep", Shorewall will neither +# enable nor disable packet forwarding. +# +#IP_FORWARDING=On + +# +# AUTOMATICALLY ADD NAT IP ADDRESSES +# +# If you say "Yes" or "yes" here, Shorewall will automatically add IP addresses +# for each NAT external address that you give in /etc/shorewall/nat. If you say +# "No" or "no", you must add these aliases youself. +# +ADD_IP_ALIASES=Yes + +# +# AUTOMATICALLY ADD SNAT IP ADDRESSES +# +# If you say "Yes" or "yes" here, Shorewall will automatically add IP addresses +# for each SNAT external address that you give in /etc/shorewall/masq. If you say +# "No" or "no", you must add these aliases youself. LEAVE THIS SET TO "No" unless +# you are sure that you need it -- most people don't!!! +# +ADD_SNAT_ALIASES=No + +# +# ENABLE TRAFFIC SHAPING +# +# If you say "Yes" or "yes" here, Traffic Shaping is enabled in the firewall. If +# you say "No" or "no" then traffic shaping is not enabled. If you enable traffic +# shaping you must have iproute[2] installed (the "ip" and "tc" utilities) and +# you must enable packet mangling above. +# +TC_ENABLED=No + +# +# Clear Traffic Shapping/Control +# +# If this option is set to 'No' then Shorewall won't clear the current +# traffic control rules during [re]start. This setting is intended +# for use by people that prefer to configure traffic shaping when +# the network interfaces come up rather than when the firewall +# is started. If that is what you want to do, set TC_ENABLED=Yes and +# CLEAR_TC=No and do not supply an /etc/shorewall/tcstart file. That +# way, your traffic shaping rules can still use the 'fwmark' +# classifier based on packet marking defined in /etc/shorewall/tcrules. +# +# If omitted, CLEAR_TC=Yes is assumed. + +CLEAR_TC=Yes + +# +# Mark Packets in the forward chain +# +# When processing the tcrules file, Shorewall normally marks packets in the +# PREROUTING chain. To cause Shorewall to use the FORWARD chain instead, set +# this to "Yes". If not specified or if set to the empty value (e.g., +# MARK_IN_FORWARD_CHAIN="") then MARK_IN_FORWARD_CHAIN=No is assumed. +# +# Marking packets in the FORWARD chain has the advantage that inbound +# packets destined for Masqueraded/SNATed local hosts have had their destination +# address rewritten so they can be marked based on their destination. When +# packets are marked in the PREROUTING chain, packets destined for +# Masqueraded/SNATed local hosts still have a destination address corresponding +# to the firewall's external interface. +# +# Note: Older kernels do not support marking packets in the FORWARD chain and +# setting this variable to Yes may cause startup problems. + +MARK_IN_FORWARD_CHAIN=No + +# +# MSS CLAMPING +# +# Set this variable to "Yes" or "yes" if you want the TCP "Clamp MSS to PMTU" +# option. This option is most commonly required when your internet +# interface is some variant of PPP (PPTP or PPPoE). Your kernel must +# have CONFIG_IP_NF_TARGET_TCPMSS set. +# +# [From the kernel help: +# +# This option adds a `TCPMSS' target, which allows you to alter the +# MSS value of TCP SYN packets, to control the maximum size for that +# connection (usually limiting it to your outgoing interface's MTU +# minus 40). +# +# This is used to overcome criminally braindead ISPs or servers which +# block ICMP Fragmentation Needed packets. The symptoms of this +# problem are that everything works fine from your Linux +# firewall/router, but machines behind it can never exchange large +# packets: +# 1) Web browsers connect, then hang with no data received. +# 2) Small mail works fine, but large emails hang. +# 3) ssh works fine, but scp hangs after initial handshaking. +# ] +# +# If left blank, or set to "No" or "no", the option is not enabled. +# +CLAMPMSS=No + +# +# ROUTE FILTERING +# +# Set this variable to "Yes" or "yes" if you want kernel route filtering on all +# interfaces started while Shorewall is started (anti-spoofing measure). +# +# If this variable is not set or is set to the empty value, "No" is assumed. +# Regardless of the setting of ROUTE_FILTER, you can still enable route filtering +# on individual interfaces using the 'routefilter' option in the +# /etc/shorewall/interfaces file. + +ROUTE_FILTER=yes + +# +# NAT BEFORE RULES +# +# Shorewall has traditionally processed static NAT rules before port forwarding +# rules. If you would like to reverse the order, set this variable to "No". +# +# If this variable is not set or is set to the empty value, "Yes" is assumed. + +NAT_BEFORE_RULES=Yes + +# DNAT IP ADDRESS DETECTION +# +# Normally when Shorewall encounters the following rule: +# +# DNAT net loc:192.168.1.3 tcp 80 +# +# it will forward TCP port 80 connections from the net to 192.168.1.3 +# REGARDLESS OF THE ORIGINAL DESTINATION ADDRESS. This behavior is +# convenient for two reasons: +# +# a) If the the network interface has a dynamic IP address, the +# firewall configuration will work even when the address +# changes. +# +# b) It saves having to configure the IP address in the rule +# while still allowing the firewall to be started before the +# internet interface is brought up. +# +# This default behavior can also have a negative effect. If the +# internet interface has more than one IP address then the above +# rule will forward connection requests on all of these addresses; +# that may not be what is desired. +# +# By setting DETECT_DNAT_IPADDRS=Yes, rules such as the above will apply +# only if the original destination address is the primary IP address of +# one of the interfaces associated with the source zone. Note that this +# requires all interfaces to the source zone to be up when the firewall +# is [re]started. + +DETECT_DNAT_IPADDRS=No + +# +# MUTEX TIMEOUT +# +# The value of this variable determines the number of seconds that programs +# will wait for exclusive access to the Shorewall lock file. After the number +# of seconds corresponding to the value of this variable, programs will assume +# that the last program to hold the lock died without releasing the lock. +# +# If not set or set to the empty value, a value of 60 (60 seconds) is assumed. +# +# An appropriate value for this parameter would be twice the length of time +# that it takes your firewall system to process a "shorewall restart" command. + +MUTEX_TIMEOUT=60 + +# +# NEWNOTSYN +# +# TCP connections are established using the familiar three-way "handshake": +# +# CLIENT SERVER +# +# SYN--------------------> +# <------------------SYN,ACK +# ACK--------------------> +# +# The first packet in that exchange (packet with the SYN flag on and the ACK +# and RST flags off) is referred to in Netfilter terminology as a "syn" packet. +# A packet is said to be NEW if it is not part of or related to an already +# established connection. +# +# The NETNOTSYN option determines the handling of non-SYN packets (those with +# SYN off or with ACK or RST on) that are not associated with an already +# established connection. +# +# If NEWNOTSYN is set to "No" or "no", then non-SYN packets that are not +# part of an already established connection, it will be dropped by the +# firewall. The setting of LOGNEWNOTSYN above determines if these packets are +# logged before they are dropped. +# +# If NEWNOTSYN is set to "Yes" or "yes" then such packets will not be +# dropped but will pass through the normal rule/policy processing. +# +# Users with a High-availability setup with two firewall's and one acting +# as a backup should set NEWNOTSYN=Yes. Users with asymmetric routing may +# also need to select NEWNOTSYN=Yes. +# +# The behavior of NEWNOTSYN=Yes may also be enabled on a per-interface basis +# using the 'newnotsyn' option in /etc/shorewall/interfaces. +# +# I find that NEWNOTSYN=No tends to result in lots of "stuck" +# connections because any network timeout during TCP session tear down +# results in retries being dropped (Netfilter has removed the +# connection from the conntrack table but the end-points haven't +# completed shutting down the connection). I therefore have chosen +# NEWNOTSYN=Yes as the default value. + +NEWNOTSYN=Yes + +# +# FOR ADMINS THAT REPEATEDLY SHOOT THEMSELVES IN THE FOOT +# +# Normally, when a "shorewall stop" command is issued or an error occurs during +# the execution of another shorewall command, Shorewall puts the firewall into +# a state where only traffic to/from the hosts listed in +# /etc/shorewall/routestopped is accepted. +# +# When performing remote administration on a Shorewall firewall, it is +# therefore recommended that the IP address of the computer being used for +# administration be added to the firewall's /etc/shorewall/routestopped file. +# +# Some administrators have a hard time remembering to do this with the result +# that they get to drive across town in the middle of the night to restart +# a remote firewall (or worse, they have to get someone out of bed to drive +# across town to restart a very remote firewall). +# +# For those administrators, we offer ADMINISABSENTMINDED=Yes. With this setting, +# when the firewall enters the 'stopped' state: +# +# All traffic that is part of or related to established connections is still +# allowed and all OUTPUT traffic is allowed. This is in addition to traffic +# to and from hosts listed in /etc/shorewall/routestopped. +# +# If this variable is not set or it is set to the null value then +# ADMINISABSENTMINDED=No is assumed. +# +ADMINISABSENTMINDED=Yes + +# +# BLACKLIST Behavior +# +# Shorewall offers two types of blacklisting: +# +# - static blacklisting through the /etc/shorewall/blacklist file together +# with the 'blacklist' interface option. +# - dynamic blacklisting using the 'drop', 'reject' and 'allow' commands. +# +# The following variable determines whether the blacklist is checked for each +# packet or for each new connection. +# +# BLACKLISTNEWONLY=Yes Only consult blacklists for new connection +# requests +# +# BLACKLISTNEWONLY=No Consult blacklists for all packets. +# +# If the BLACKLISTNEWONLY option is not set or is set to the empty value then +# BLACKLISTNEWONLY=No is assumed. +# +BLACKLISTNEWONLY=Yes + +# MODULE NAME SUFFIX +# +# When loading a module named in /etc/shorewall/modules, Shorewall normally +# looks in the MODULES DIRECTORY (see MODULESDIR above) for files whose names +# end in ".o", ".ko", ".gz" or "o.gz". If your distribution uses a different +# naming convention then you can specify the suffix (extension) for module +# names in this variable. +# +# To see what suffix is used by your distribution: +# +# ls /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter +# +# All of the file names listed should have the same suffix (extension). Set +# MODULE_SUFFIX to that suffix. +# +# Examples: +# +# If all file names end with ".kzo" then set MODULE_SUFFIX="kzo" +# If all file names end with ".kz.o" then set MODULE_SUFFIX="kz.o" +# + +MODULE_SUFFIX= + +################################################################################ +# P A C K E T D I S P O S I T I O N +################################################################################ +# +# BLACKLIST DISPOSITION +# +# Set this variable to the action that you want to perform on packets from +# Blacklisted systems. Must be DROP or REJECT. If not set or set to empty, +# DROP is assumed. +# +BLACKLIST_DISPOSITION=DROP + +# +# MAC List Disposition +# +# This variable determines the disposition of connection requests arriving +# on interfaces that have the 'maclist' option and that are from a device +# that is not listed for that interface in /etc/shorewall/maclist. Valid +# values are ACCEPT, DROP and REJECT. If not specified or specified as +# empty (MACLIST_DISPOSITION="") then REJECT is assumed + +MACLIST_DISPOSITION=REJECT + +# +# TCP FLAGS Disposition +# +# This variable determins the disposition of packets having an invalid +# combination of TCP flags that are received on interfaces having the +# 'tcpflags' option specified in /etc/shorewall/interfaces. If not specified +# or specified as empty (TCP_FLAGS_DISPOSITION="") then DROP is assumed. + +TCP_FLAGS_DISPOSITION=DROP + +#LAST LINE -- DO NOT REMOVE diff --git a/contrib/shoregen/samples/shorewall.conf/ig b/contrib/shoregen/samples/shorewall.conf/ig new file mode 100644 index 000000000..ffc52bd43 --- /dev/null +++ b/contrib/shoregen/samples/shorewall.conf/ig @@ -0,0 +1,2 @@ +FW=ig +IP_FORWARDING=On diff --git a/contrib/shoregen/samples/shorewall.conf/mail b/contrib/shoregen/samples/shorewall.conf/mail new file mode 100644 index 000000000..a6051a9af --- /dev/null +++ b/contrib/shoregen/samples/shorewall.conf/mail @@ -0,0 +1,2 @@ +FW=enoch +IP_FORWARDING=Off diff --git a/contrib/shoregen/samples/shorewall.conf/og b/contrib/shoregen/samples/shorewall.conf/og new file mode 100644 index 000000000..220ec2e8a --- /dev/null +++ b/contrib/shoregen/samples/shorewall.conf/og @@ -0,0 +1,2 @@ +FW=og +IP_FORWARDING=On diff --git a/contrib/shoregen/samples/shorewall.conf/proxy b/contrib/shoregen/samples/shorewall.conf/proxy new file mode 100644 index 000000000..b324a4fc7 --- /dev/null +++ b/contrib/shoregen/samples/shorewall.conf/proxy @@ -0,0 +1,2 @@ +FW=dmz +IP_FORWARDING=Off diff --git a/contrib/shoregen/samples/zones b/contrib/shoregen/samples/zones new file mode 100644 index 000000000..d84061bd5 --- /dev/null +++ b/contrib/shoregen/samples/zones @@ -0,0 +1,10 @@ +#ZONE DISPLAY COMMENTS +lan LAN Local network +guest Guest Untrusted LAN hosts +ig IG Inner Guard +og OG Outer Guard +mail Mail Mail server +proxy Proxy Proxy server +net Net Internet +other Other Basket for things that don't fit elsewhere +#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE diff --git a/contrib/shoregen/shoregen b/contrib/shoregen/shoregen new file mode 100644 index 000000000..bc4eed6f1 --- /dev/null +++ b/contrib/shoregen/shoregen @@ -0,0 +1,373 @@ +#!/usr/bin/perl -w +# +# $Id: shoregen,v 1.27 2004/04/24 12:31:18 paulgear Exp $ +# +# Generate shorewall configuration for a host from central configuration +# files. +# + +# +# (c) Copyright 2004 Paul D. Gear +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General +# Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA, or go to +# on the World Wide Web. +# + +use strict; + +my $VERBOSE = 1; +my $DEBUG = 1; +my $DATE = scalar localtime; +my $HEADER = "#\n# Shorewall %s - constructed by $0 on $DATE\n#\n\n"; + +if ($#ARGV != 0) { + print STDERR "Usage: $0 \n"; + exit 1; +} + +my $base = "."; +my $host = $ARGV[ 0 ]; +my $spool = "$base/SPOOL"; +my $dir = "$spool/$host"; + + +# +# Messaging routines for use by the program itself - any errors that are +# generated externally (e.g. file opening problems) are reported using the +# usual perl 'die' or 'warn' functions. +# + +sub warning +{ + print STDERR "$0: WARNING - @_\n"; +} + +sub fatal +{ + my $RET = shift; + print STDERR "$0: FATAL - @_\n"; + exit $RET; +} + +sub message +{ + print "$0: @_\n"; +} + + +# +# These bits make the files that actually get copied to the target host +# + +sub stripfile +{ + open( my $file, $_[ 0 ] ) or die "Can't open $_[ 0 ] for reading: $!"; + my @file; + + for (<$file>) { + s/\s*#.*$//g; # remove all comments + next if m/^\s*$/; # skip blank lines + push @file, $_; + } + + close $file or warn "Can't close $_[ 0 ] after reading: $!"; + + return @file; +} + + +sub constructfile +{ + my $confname = shift; + my $dst = shift; + my $foundone = 0; + + message "Constructing $confname" if $VERBOSE > 1; + + open( my $DST, ">$dst" ) or die "Can't create $dst: $!"; + printf $DST $HEADER, $confname; + + for my $file (@_) { + if (-r $file) { + $foundone = 1; + print $DST "##$file\n" if $DEBUG > 1; + print $DST stripfile $file; + } + } + + close $DST or warn "Can't close $dst: $!"; + + if (!$foundone) { + warning "\"$confname\" not present. " . + "Existing file on $host will be preserved." if $VERBOSE > 2; + unlink $dst; + } +} + +# +# main +# + +my $fw; # Firewall zone for this host +my @globalzones; # All known zones +my %globalzones; +my %hostzones; # zones applicable to this host +my $outfile; # filename holders +my $conf; # config file we're processing at present +my %warnban; # meta-rules/policies + + +# Change to the base configuration directory +die "Configuration directory $base doesn't exist!" if ! -d $base; +chdir $base or die "Can't change directory to $base: $!"; + +# Create spool directories if necessary +if (! -d "$spool") { + mkdir "$spool" or die "Can't create spool directory $spool: $!"; +} +if (! -d $dir) { + mkdir $dir or die "Can't create host spool directory $dir: $!"; +} + + +# +# Construct all the simple config files. +# + +# Config files for which the host-specific file is included *first* +my @hostfirstconfigs = qw( blacklist ecn hosts interfaces maclist masq nat + proxyarp rfc1918 routestopped start stop stopped tcrules tos tunnels ); + +# Config files for which the host-specific file is included *last* +my @hostlastconfigs = qw( common init modules params shorewall.conf ); + +for my $conf (@hostfirstconfigs) { + constructfile "$conf", "$dir/$conf", "$conf/$host", "$conf/COMMON"; +} + +for my $conf (@hostlastconfigs) { + constructfile "$conf", "$dir/$conf", "$conf/COMMON", "$conf/$host"; +} + +# +# The remaining config files (policy, rules, zones) are processed uniquely. +# + +# Find the firewall name of this host +open( my $infile, "$dir/shorewall.conf" ) or + die "Can't open $dir/shorewall.conf: $!"; + +for (<$infile>) { + next unless m/^\s*FW=(\S+)/; + $fw = $1; + last; +} + +close $infile; + + +# The firewall name must be defined +unless (defined $fw) { + fatal 1, "Can't find firewall name for $host in $dir/shorewall.conf"; +} + + +# Find all valid zones +unless (-r "zones") { + fatal 2, "You must provide a global zone file"; +} + + +for (stripfile "zones") { + chomp; + my ($zone, $details) = split /\s+/, $_, 2; + push @globalzones, $zone; + $globalzones{ $zone } = $details; +} + +# +# Work out which zones apply to this host from the combination of hosts & +# interfaces. The first field in both files is the zone name, and the +# second (minus any trailing ips) is the interface, which we save as well +# for later reference. +# + +for my $infile ("$dir/hosts", "$dir/interfaces") { + if (-r $infile) { + for (stripfile $infile) { + chomp; + my @F = split; + next if $#F < 0; + next if $F[ 0 ] eq "-"; + my @IF = split /:/, $F[ 1 ]; + $hostzones{ $F[ 0 ] } = $IF[ 0 ]; + } + } +} + +$conf = "zones"; + +# +# Create the zones file from the intersection of the above - note the order +# from the original zone file must be preserved, hence the need for the +# array as well as the hash. +# + +open( $outfile, ">$dir/$conf" ) or + die "Can't open $dir/$conf for writing: $!"; + +printf $outfile $HEADER, "$conf"; +my %tmpzones = %hostzones; # Take a copy of all the zones, + +for my $zone (@globalzones) { + if (exists $tmpzones{ $zone }) { + print $outfile "$zone $globalzones{ $zone }\n"; + delete $tmpzones{ $zone }; # deleting those found as we go along. + } +} + +close $outfile or warn "Can't close $dir/$conf after writing: $!"; + +for my $zone (sort keys %tmpzones) { # Warn if we've got any zones left now. + #next if $zone eq "-"; + warning "No entry for $zone in global zones file - ignored"; +} +undef %tmpzones; + + +my @tmp = sort keys %hostzones; +message "FW zone for $host: $fw" if $VERBOSE > 0; +message "Other zones for $host: @tmp" if $VERBOSE > 0; + +# +# Add 'all' as a valid source or destination. Added here so it doesn't get +# checked in %tmpzones check above. Also add firewall itself. (The +# numbers are not important as long as they are different.) +# + +$hostzones{"all"} = 1; +$hostzones{$fw} = 2; + +# +# Create the policy file, including only the applicable zones. +# + +$conf = "policy"; +if (! -r $conf) { + fatal 3, "You must provide a global \"$conf\" file"; +} + +open( $outfile, ">$dir/$conf" ) or + die "Can't open $dir/$conf for writing: $!"; +printf $outfile $HEADER, "$conf"; + +for (stripfile $conf) { + chomp; + + my ($src, $dst, $pol, $rest) = split /\s+/, $_, 4; + + print "$src, $dst, $pol, $rest\n" if $DEBUG > 3; + + # Both source and destination zones must be valid on this host for this + # policy to apply. + next unless defined $hostzones{$src} and defined $hostzones{$dst}; + + # Source and destination zones must be on different interfaces as well, + # except for the case of all2all. + #next if ($hostzones{$src} eq $hostzones{$dst} && $src ne "all"); + + # Save WARN & BAN details for later rules processing + if ($pol eq "WARN" or $pol eq "BAN") { + if (exists $warnban{$src}{$dst}) { + warning "Duplicate WARN/BAN rule: $src,$dst,$pol - possible typo?"; + } + $warnban{$src}{$dst} = $pol; + next; + } + + printf $outfile "%s\n", $_; +} +close $outfile or warn "Can't close $dir/$conf for writing: $!"; + + +# +# Create the rules file, only including the applicable zones and taking +# into account any WARN or BAN policies. +# + +$conf = "rules"; +if (! -r $conf) { + fatal 4, "You must provide a global \"$conf\" file"; +} + +open( $outfile, ">$dir/$conf" ) or + die "Can't open $dir/$conf for writing: $!"; +printf $outfile $HEADER, "$conf"; + +my $ret = 0; + +for (stripfile $conf) { + chomp; + + my ($act, $src, $dst, $rest) = split /\s+/, $_, 4; + + # strip down to only the main tag + $act =~ s/:.*//; + $src =~ s/:.*//; + $dst =~ s/:.*//; + print "$act, $src, $dst, $rest\n" if $DEBUG > 3; + + # Both source and destination zones must be valid on this host for this + # rule to apply. + next unless defined $hostzones{$src} and defined $hostzones{$dst}; + + # Source and destination zones must be on different interfaces as well, + # except for the case of all2all. + next if ($hostzones{$src} eq $hostzones{$dst} && $src ne "all"); + + # Save additional WARN/BAN rules + if ($act eq "WARN" or $act eq "BAN") { + if (exists $warnban{$src}{$dst}) { + warning "Duplicate WARN/BAN rule: $src,$dst,$act - possible typo?"; + } + $warnban{$src}{$dst} = $act; + next; + } + + # Check against WARN/BAN rules + if (exists $warnban{$src}{$dst} && $act =~ /^(ACCEPT|DNAT)\b/) { + if ($warnban{$src}{$dst} eq "WARN") { + warning "Rule contravenes WARN policy:\n\t$_"; + } + else { # $warnban{$src}{$dst} eq "BAN" + warning "Rule contravenes BAN policy (omitted):\n\t$_"; + ++$ret; + next; + } + } + + # Mangle DNAT rules if the destination is the local machine + if ($act =~ /^DNAT/ && $dst eq $fw) { + $_ =~ s/\bDNAT(-)?/ACCEPT/; # change rule type + $_ =~ s/\b$fw:\S+/$dst/; # strip trailing server address/port + } + + printf $outfile "%s\n", $_; +} +close $outfile or warn "Can't close $dir/$conf for writing: $!"; + + +# If we get here, everything's OK - return whatever we produced above... +exit $ret; diff --git a/contrib/shoregen/spec/description b/contrib/shoregen/spec/description new file mode 100644 index 000000000..e4f33e240 --- /dev/null +++ b/contrib/shoregen/spec/description @@ -0,0 +1,3 @@ +Shoregen is a script that generates Shoreline Firewall configurations for +multiple firewalls from a common set of rules and policies. Only the +minimal information necessary for operation is stored on each firewall. diff --git a/contrib/shoregen/spec/files b/contrib/shoregen/spec/files new file mode 100644 index 000000000..10685dd98 --- /dev/null +++ b/contrib/shoregen/spec/files @@ -0,0 +1,4 @@ +# $Id: files,v 1.2 2004/04/24 13:15:14 paulgear Exp $ +/usr/bin/%{name} +/usr/bin/install_%{name} +%doc /usr/share/doc/%{name}-%{version}/ diff --git a/contrib/shoregen/spec/header b/contrib/shoregen/spec/header new file mode 100644 index 000000000..c0c422fd7 --- /dev/null +++ b/contrib/shoregen/spec/header @@ -0,0 +1,10 @@ +# $Id: header,v 1.1 2004/04/24 12:53:04 paulgear Exp $ +Summary: Shoreline Firewall configuration generator +License: GPL +Group: Applications/System +BuildArch: noarch +URL: http://paulgear.webhop.net/linux/#shoregen +Packager: Paul Gear +Requires: openssh +Requires: perl +Requires: rsync diff --git a/contrib/shoregen/spec/install b/contrib/shoregen/spec/install new file mode 100644 index 000000000..12c63ae99 --- /dev/null +++ b/contrib/shoregen/spec/install @@ -0,0 +1,9 @@ +# $Id: install,v 1.6 2004/04/24 13:15:14 paulgear Exp $ + +install -d -m 0700 $RPM_BUILD_ROOT/usr/bin/ +install -m 0555 install_%{name} %{name} $RPM_BUILD_ROOT/usr/bin/ + +install -d -m 0755 $RPM_BUILD_ROOT/usr/share/doc/%{name}-%{version}/ +install -m 0444 AUTHORS BUGS COPYING README TODO $RPM_BUILD_ROOT/usr/share/doc/%{name}-%{version}/ +cp -r samples $RPM_BUILD_ROOT/usr/share/doc/%{name}-%{version}/ +chmod -R go=u-w $RPM_BUILD_ROOT/usr/share/doc/%{name}-%{version}/ diff --git a/contrib/shoregen/spec/type b/contrib/shoregen/spec/type new file mode 100644 index 000000000..1c561e982 --- /dev/null +++ b/contrib/shoregen/spec/type @@ -0,0 +1,2 @@ +install +# $Id: type,v 1.2 2004/04/24 13:13:57 paulgear Exp $