From f7eb3c3d8c3688a105637e53e6b78b7897894dfd Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Mon, 27 Sep 2010 11:16:18 -0700 Subject: [PATCH] Periodic elimination of trailing white space Signed-off-by: Tom Eastep --- Shorewall/Contrib/swping | 2 +- Shorewall/Contrib/swping.init | 4 +-- Shorewall/Macros/macro.BitTorrent | 2 +- Shorewall/Macros/macro.IPPserver | 2 +- Shorewall/Macros/macro.template | 6 ++-- Shorewall/Perl/Shorewall/Accounting.pm | 4 +-- Shorewall/Perl/Shorewall/Actions.pm | 2 +- Shorewall/Perl/Shorewall/Chains.pm | 40 +++++++++++++------------- Shorewall/Perl/Shorewall/Compiler.pm | 2 +- Shorewall/Perl/Shorewall/Config.pm | 6 ++-- Shorewall/Perl/Shorewall/IPAddrs.pm | 6 ++-- Shorewall/Perl/Shorewall/Policy.pm | 16 +++++------ Shorewall/Perl/Shorewall/Providers.pm | 10 +++---- Shorewall/Perl/Shorewall/Rules.pm | 34 +++++++++++----------- Shorewall/Perl/Shorewall/Tc.pm | 22 +++++++------- Shorewall/Perl/Shorewall/Zones.pm | 20 ++++++------- Shorewall/Perl/prog.footer6 | 6 ++-- Shorewall/Perl/prog.header | 2 +- Shorewall/Perl/prog.header6 | 2 +- Shorewall/configfiles/findgw | 4 +-- Shorewall/configfiles/restored | 2 +- Shorewall/configfiles/secmarks | 2 +- Shorewall/lib.cli | 2 +- Shorewall/lib.common | 2 +- Shorewall/releasenotes.txt | 26 ++++++++--------- 25 files changed, 113 insertions(+), 113 deletions(-) diff --git a/Shorewall/Contrib/swping b/Shorewall/Contrib/swping index 7385555ab..b246dd968 100644 --- a/Shorewall/Contrib/swping +++ b/Shorewall/Contrib/swping @@ -224,7 +224,7 @@ while : ; do # One of the interfaces changed state -- restart Shorewall # echo $if1_state > $VARDIR/${IF1}.status - echo $if2_state > $VARDIR/${IF2}.status + echo $if2_state > $VARDIR/${IF2}.status eval $COMMAND state_changed= fi diff --git a/Shorewall/Contrib/swping.init b/Shorewall/Contrib/swping.init index 7136e4910..afb90bfef 100755 --- a/Shorewall/Contrib/swping.init +++ b/Shorewall/Contrib/swping.init @@ -32,7 +32,7 @@ ### BEGIN INIT INFO # Provides: swping # Required-Start: shorewall -# Should-Start: +# Should-Start: # Required-Stop: # Default-Start: 2 3 5 # Default-Stop: 0 1 6 @@ -87,7 +87,7 @@ case "$command" in echo "swping is running" exit 0 else - echo "swping is stopped" + echo "swping is stopped" exit 3 fi ;; diff --git a/Shorewall/Macros/macro.BitTorrent b/Shorewall/Macros/macro.BitTorrent index 50a356adb..bf8b68aca 100644 --- a/Shorewall/Macros/macro.BitTorrent +++ b/Shorewall/Macros/macro.BitTorrent @@ -5,7 +5,7 @@ # # This macro handles BitTorrent traffic for BitTorrent 3.1 and earlier. # -# If you are running BitTorrent 3.2 or later, you should use the +# If you are running BitTorrent 3.2 or later, you should use the # BitTorrent32 macro. ############################################################################### #ACTION SOURCE DEST PROTO DEST SOURCE RATE USER/ diff --git a/Shorewall/Macros/macro.IPPserver b/Shorewall/Macros/macro.IPPserver index 6f83c789c..d870d87c4 100644 --- a/Shorewall/Macros/macro.IPPserver +++ b/Shorewall/Macros/macro.IPPserver @@ -15,7 +15,7 @@ # Example for a two-interface firewall which acts as a print # server for loc: # IPPserver/ACCEPT loc $FW -# +# # NOTE: If you want both to serve requests for local printers and # listen to requests for remote printers (i.e. your CUPS server is # also a client), you need to apply the rule twice, e.g. diff --git a/Shorewall/Macros/macro.template b/Shorewall/Macros/macro.template index 215405306..616afa18f 100644 --- a/Shorewall/Macros/macro.template +++ b/Shorewall/Macros/macro.template @@ -304,9 +304,9 @@ # #removed from Netfilter in kernel # #version 2.6.14). # -# MARK Specifies a MARK value to match. Must be empty or +# MARK Specifies a MARK value to match. Must be empty or # '-' if the macro is to be used within an action. -# +# # [!]value[/mask][:C] # # Defines a test on the existing packet or connection @@ -341,7 +341,7 @@ # [!]limit[:mask] # # May be used to limit the number of simultaneous -# connections from each individual host to limit +# connections from each individual host to limit # connections. Requires connlimit match in your kernel # and iptables. While the limit is only checked on rules # specifying CONNLIMIT, the number of current connections diff --git a/Shorewall/Perl/Shorewall/Accounting.pm b/Shorewall/Perl/Shorewall/Accounting.pm index c2b7b7b4a..05cc57b95 100644 --- a/Shorewall/Perl/Shorewall/Accounting.pm +++ b/Shorewall/Perl/Shorewall/Accounting.pm @@ -98,7 +98,7 @@ sub process_accounting_rule( ) { my $rule = do_proto( $proto, $ports, $sports ) . do_user ( $user ) . do_test ( $mark, $globals{TC_MASK} ); my $rule2 = 0; my $jump = 0; - + unless ( $action eq 'COUNT' ) { if ( $action eq 'DONE' ) { $target = 'RETURN'; @@ -166,7 +166,7 @@ sub process_accounting_rule( ) { fatal_error "Adding an IPSEC rule to an unreferenced accounting chain is not allowed"; } } else { - warning_message "Adding rule to unreferenced accounting chain $chain" unless reserved_chain_name( $chain ); + warning_message "Adding rule to unreferenced accounting chain $chain" unless reserved_chain_name( $chain ); $chainref->{ipsec} = $dir; } } elsif ( $ipsec ne '-' ) { diff --git a/Shorewall/Perl/Shorewall/Actions.pm b/Shorewall/Perl/Shorewall/Actions.pm index 6958f5e83..9d0b73ecb 100644 --- a/Shorewall/Perl/Shorewall/Actions.pm +++ b/Shorewall/Perl/Shorewall/Actions.pm @@ -195,7 +195,7 @@ sub split_action ( $ ) { $action = $2 ? $3 : ''; $max = 2; } - + my @a = split( /:/ , $action, 4 ); fatal_error "Invalid ACTION ($action)" if ( $action =~ /::/ ) || ( @a > $max ); $target = shift @a unless $target; diff --git a/Shorewall/Perl/Shorewall/Chains.pm b/Shorewall/Perl/Shorewall/Chains.pm index 2a95ac90d..5cc66f5f4 100644 --- a/Shorewall/Perl/Shorewall/Chains.pm +++ b/Shorewall/Perl/Shorewall/Chains.pm @@ -628,7 +628,7 @@ sub delete_reference( $$ ) { # # In the first function, the rule number is zero-relative. In the second function, # the rule number is one-relative. In the first function, if the rule number is < 0, then -# the rule is a jump to a blacklist chain (blacklst or blackout). The rule will be +# the rule is a jump to a blacklist chain (blacklst or blackout). The rule will be # inserted at the front of the chain and the chain's 'blacklist' member incremented. # sub insert_rule1($$$) @@ -733,7 +733,7 @@ sub move_rules( $$ ) { for ( @{$chain1->{rules}} ) { adjust_reference_counts( $tableref->{$1}, $name1, $name2 ) if / -[jg] ([^\s]+)/; } - + if ( $debug ) { my $rule = $blacklist; trace( $chain2, 'A', ++$rule, $_ ) for @{$chain1->{rules}}; @@ -754,7 +754,7 @@ sub move_rules( $$ ) { } else { shift @{$rules} while @{$rules} > 1 && $rules->[0] eq $rules->[1]; } - + delete_chain $chain1; $count; @@ -789,7 +789,7 @@ sub copy_rules( $$ ) { # Chains2 already has a blacklist jump -- delete the one at the head of chain1's rule list # my $rule = shift @rules1; - + $rule =~ / -j ([^\s])/; my $chainb = $1; @@ -814,7 +814,7 @@ sub copy_rules( $$ ) { trace( $chain2, 'A', 1 , $rules1[0]) if $debug; unshift @$rules2, shift @rules1; - + $chain1->{blacklist} = 0; $chain2->{blacklist} = 1; } @@ -823,7 +823,7 @@ sub copy_rules( $$ ) { my $rule = @$rules2; trace( $chain2, 'A', ++$rule, $_ ) for @rules1; } - + push @$rules2, @rules1; progress_message " $count rules from $chain1->{name} appended to $chain2->{name}"; @@ -1078,10 +1078,10 @@ sub find_chain($$) { my ($table, $chain) = @_; assert( $table && $chain && $chain_table{$table} ); - + $chain_table{$table}{$chain}; } - + # # Create a chain if it doesn't exist already # @@ -2787,11 +2787,11 @@ sub do_ipsec($$) { fatal_error "Non-empty IPSEC column requires policy match support in your kernel and iptables" unless have_capability( 'POLICY_MATCH' ); my @options = split_list $ipsec, 'IPSEC options'; - + if ( @options == 1 ) { if ( lc( $options[0] ) =~ /^(yes|ipsec)$/ ) { return do_ipsec_options $dir, 'ipsec', ''; - } + } if ( lc( $options[0] ) =~ /^(no|none)$/ ) { return do_ipsec_options $dir, 'none', ''; @@ -2912,7 +2912,7 @@ sub mysplit( $ ) { fatal_error "Missing ']' ($element)" unless @input; $element .= ( ',' . shift @input ); } - + fatal_error "Mismatched [...] ($element)" unless $element =~ tr/[/[/ == $element =~ tr/]/]/; } @@ -3644,14 +3644,14 @@ sub expand_rule( $$$$$$$$$$;$ ) # # Log rule # - log_rule_limit( $loglevel , - $echainref , - $chain, + log_rule_limit( $loglevel , + $echainref , + $chain, $disposition eq 'reject' ? 'REJECT' : $disposition , - '' , - $logtag , + '' , + $logtag , 'add' , - '' ) + '' ) if $loglevel; # # Generate Final Rule @@ -3764,14 +3764,14 @@ sub promote_blacklist_rules() { # Copy 'blacklst''s references since they will change in the following loop # my @references = map $filter_table->{$_}, keys %{$chainbref->{references}}; - + for my $chain1ref ( @references ) { assert( $chain1ref->{blacklist} == 1 ); my $copied = 0; my $rule = $chain1ref->{rules}[0]; my $chain1 = $chain1ref->{name}; - + for my $chain2ref ( map $filter_table->{$_}, keys %{$chain1ref->{references}} ) { unless ( $chain2ref->{builtin} ) { # @@ -3984,7 +3984,7 @@ sub load_ipsets() { ' fi' , ' fi' , ); - + if ( @ipsets ) { emit ''; diff --git a/Shorewall/Perl/Shorewall/Compiler.pm b/Shorewall/Perl/Shorewall/Compiler.pm index d7282b1ae..635ad31ec 100644 --- a/Shorewall/Perl/Shorewall/Compiler.pm +++ b/Shorewall/Perl/Shorewall/Compiler.pm @@ -445,7 +445,7 @@ EOF my $config_dir = $globals{CONFIGDIR}; emit<<"EOF"; - set_state Started $config_dir + set_state Started $config_dir run_restored_exit else if [ \$COMMAND = refresh ]; then diff --git a/Shorewall/Perl/Shorewall/Config.pm b/Shorewall/Perl/Shorewall/Config.pm index 6cca30f33..252d97b94 100644 --- a/Shorewall/Perl/Shorewall/Config.pm +++ b/Shorewall/Perl/Shorewall/Config.pm @@ -1841,7 +1841,7 @@ sub read_a_line(;$) { embedded_perl( $1 ); next; } - } + } my $count = 0; # @@ -2928,12 +2928,12 @@ sub get_configuration( $ ) { if ( $units && $units ne 'sec' ) { my $expire = 60000; # 1 minute in milliseconds - + if ( $units ne 'min' ) { $expire *= 60; #At least an hour $expire *= 24 if $units eq 'day'; } - + $limit .= "--hashlimit-htable-expire $expire "; } } elsif ( $rate =~ /^((\d+)(\/(sec|min|hour|day))):(\d+)$/ ) { diff --git a/Shorewall/Perl/Shorewall/IPAddrs.pm b/Shorewall/Perl/Shorewall/IPAddrs.pm index 26f734211..7c2756bd8 100644 --- a/Shorewall/Perl/Shorewall/IPAddrs.pm +++ b/Shorewall/Perl/Shorewall/IPAddrs.pm @@ -189,7 +189,7 @@ sub validate_4net( $$ ) { if ( $1 ) { fatal_error "An ipset list ($net) is not allowed in this context"; } elsif ( $net =~ /^\+[a-zA-Z][-\w]*$/ ) { - fatal_error "An ipset name ($net) is not allowed in this context"; + fatal_error "An ipset name ($net) is not allowed in this context"; } else { fatal_error "Invalid ipset name ($net)"; } @@ -306,7 +306,7 @@ sub resolve_proto( $ ) { # Allow 'icmp' as a synonym for 'ipv6-icmp' in IPv6 compilations # $proto= 'ipv6-icmp' if $proto eq 'icmp' && $family == F_IPV6; - + defined( $number = $nametoproto{$proto} ) ? $number : scalar getprotobyname $proto; } } @@ -553,7 +553,7 @@ sub validate_6net( $$ ) { if ( $1 ) { fatal_error "An ipset list ($net) is not allowed in this context"; } elsif ( $net =~ /^\+[a-zA-Z][-\w]*$/ ) { - fatal_error "An ipset name ($net) is not allowed in this context"; + fatal_error "An ipset name ($net) is not allowed in this context"; } else { fatal_error "Invalid ipset name ($net)"; } diff --git a/Shorewall/Perl/Shorewall/Policy.pm b/Shorewall/Perl/Shorewall/Policy.pm index c884a4cde..e0fcbe148 100644 --- a/Shorewall/Perl/Shorewall/Policy.pm +++ b/Shorewall/Perl/Shorewall/Policy.pm @@ -341,7 +341,7 @@ sub validate_policy() add_or_modify_policy_chain( $zone, $zone1 ); add_or_modify_policy_chain( $zone1, $zone ); } - } + } } } @@ -496,13 +496,13 @@ sub setup_syn_flood_chains() { my $level = $chainref->{loglevel}; my $synchainref = new_chain 'filter' , syn_flood_chain $chainref; add_rule $synchainref , "${limit}-j RETURN"; - log_rule_limit( $level , - $synchainref , - $chainref->{name} , - 'DROP', - $globals{LOGLIMIT} || '-m limit --limit 5/min --limit-burst 5 ' , - '' , - 'add' , + log_rule_limit( $level , + $synchainref , + $chainref->{name} , + 'DROP', + $globals{LOGLIMIT} || '-m limit --limit 5/min --limit-burst 5 ' , + '' , + 'add' , '' ) if $level ne ''; add_rule $synchainref, '-j DROP'; diff --git a/Shorewall/Perl/Shorewall/Providers.pm b/Shorewall/Perl/Shorewall/Providers.pm index 7b5f83914..5fe6de0e3 100644 --- a/Shorewall/Perl/Shorewall/Providers.pm +++ b/Shorewall/Perl/Shorewall/Providers.pm @@ -849,7 +849,7 @@ sub handle_optional_interfaces( $ ) { if ( @$interfaces ) { my $require = $config{REQUIRE_INTERFACE}; - + verify_required_interfaces( shift ); emit( 'HAVE_INTERFACE=', '' ) if $require; @@ -860,9 +860,9 @@ sub handle_optional_interfaces( $ ) { if ( $wildcards ) { # - # We must consider all interfaces with an address in $family -- generate a list of such addresses. + # We must consider all interfaces with an address in $family -- generate a list of such addresses. # - emit( '', + emit( '', 'for interface in $(find_all_interfaces1); do', ); @@ -904,10 +904,10 @@ sub handle_optional_interfaces( $ ) { if ( $wildcards ) { emit( "$case)" ); push_indent; - + if ( $wild ) { emit( qq(if [ -z "\$SW_${base}_IS_USABLE" ]; then) ); - push_indent; + push_indent; emit ( 'if interface_is_usable $interface; then' ); } else { emit ( "if interface_is_usable $physical; then" ); diff --git a/Shorewall/Perl/Shorewall/Rules.pm b/Shorewall/Perl/Shorewall/Rules.pm index b782a34e5..1552ff39e 100644 --- a/Shorewall/Perl/Shorewall/Rules.pm +++ b/Shorewall/Perl/Shorewall/Rules.pm @@ -1064,7 +1064,7 @@ sub process_rule1 ( $$$$$$$$$$$$$ ) { $action = "NFQUEUE --queue-num $paramval"; } elsif ( $actiontype & SET ) { require_capability( 'IPSET_MATCH', 'SET and UNSET rules', '' ); - fatal_error "$action rules require a set name parameter" unless $param; + fatal_error "$action rules require a set name parameter" unless $param; } else { fatal_error "The $basictarget TARGET does not accept a parameter" unless $param eq ''; } @@ -1531,7 +1531,7 @@ sub process_section ($) { @sections{'ESTABLISHED','RELATED'} = ( 1, 1 ); finish_section ( ( $section eq 'RELATED' ) ? 'RELATED' : 'ESTABLISHED,RELATED' ); } - + $section = $sect; } @@ -1698,13 +1698,13 @@ sub generate_dest_rules( $$$$ ) { if ( $type2 == VSERVER ) { for my $hostref ( @{$z2ref->{hosts}{ip}{'%vserver%'}} ) { - my $exclusion = dest_exclusion( $hostref->{exclusions}, $chain); + my $exclusion = dest_exclusion( $hostref->{exclusions}, $chain); for my $net ( @{$hostref->{hosts}} ) { - add_jump( $chainref, + add_jump( $chainref, $exclusion , 0, - join('', $match, match_dest_net( $net ) ) ) + join('', $match, match_dest_net( $net ) ) ) } } } else { @@ -1718,7 +1718,7 @@ sub generate_dest_rules( $$$$ ) { sub generate_source_rules( $$$$ ) { my ( $outchainref, $z1, $z2, $match ) = @_; my $chain = rules_target ( $z1, $z2 ); - + if ( $chain ) { # # Not a CONTINUE policy with no rules @@ -1726,16 +1726,16 @@ sub generate_source_rules( $$$$ ) { for my $hostref ( @{defined_zone( $z1 )->{hosts}{ip}{'%vserver%'}} ) { my $ipsec_match = match_ipsec_in $z1 , $hostref; my $exclusion = source_exclusion( $hostref->{exclusions}, $chain); - + for my $net ( @{$hostref->{hosts}} ) { generate_dest_rules( $outchainref, $exclusion, - $z2, + $z2, join('', match_source_net( $net ), $match , $ipsec_match ) ); - } + } } - } + } } # @@ -1780,11 +1780,11 @@ sub handle_loopback_traffic() { for my $typeref ( values %{$source_hosts_ref} ) { for my $hostref ( @{$typeref->{'%vserver%'}} ) { my $exclusion = source_exclusion( $hostref->{exclusions}, $natref); - + for my $net ( @{$hostref->{hosts}} ) { add_jump( $natout, $exclusion, 0, match_source_net( $net ), 0, $rulenum++ ); } - } + } } } } @@ -1873,7 +1873,7 @@ sub generate_matrix() { if ( $zoneref->{options}{in}{blacklist} ) { my $blackref = $filter_table->{blacklst}; add_jump ensure_filter_chain( rules_chain( $zone, $_ ), 1 ) , $blackref , 0, $state, 0, -1 for firewall_zone, @vservers; - + if ( $simple ) { # # We won't create a zone forwarding chain for this zone so we must add blacklisting jumps to the rules chains @@ -1881,7 +1881,7 @@ sub generate_matrix() { for my $zone1 ( @zones ) { my $ruleschain = rules_chain( $zone, $zone1 ); my $ruleschainref = $filter_table->{$ruleschain}; - + if ( ( $zone ne $zone1 || $ruleschainref->{referenced} ) && $ruleschainref->{policy} ne 'NONE' ) { add_jump( ensure_filter_chain( $ruleschain, 1 ), $blackref, 0, $state, 0, -1 ); } @@ -1899,12 +1899,12 @@ sub generate_matrix() { if ( ( $zone ne $zone1 || $ruleschainref->{referenced} ) && $ruleschainref->{policy} ne 'NONE' ) { add_jump( ensure_filter_chain( $ruleschain, 1 ), $blackref, 0, $state, 0, -1 ); - } + } } } next if $simple; - + # # Complex zone or we have more than one non-firewall zone -- create a zone forwarding chain # @@ -2028,7 +2028,7 @@ sub generate_matrix() { my $ipsec_in_match = match_ipsec_in $zone , $hostref; my $ipsec_out_match = match_ipsec_out $zone , $hostref; my $exclusions = $hostref->{exclusions}; - + for my $net ( @{$hostref->{hosts}} ) { my $dest = match_dest_net $net; diff --git a/Shorewall/Perl/Shorewall/Tc.pm b/Shorewall/Perl/Shorewall/Tc.pm index 0357cde39..b5da2c82b 100644 --- a/Shorewall/Perl/Shorewall/Tc.pm +++ b/Shorewall/Perl/Shorewall/Tc.pm @@ -297,7 +297,7 @@ sub process_tc_rule( ) { } $restriction = DESTIFACE_DISALLOW; - + ensure_mangle_chain($target); $sticky++; @@ -1462,7 +1462,7 @@ sub process_secmark_rule() { O => 'tcout' , ); my %state = ( N => 'NEW' , - E => 'ESTABLISHED' , + E => 'ESTABLISHED' , ER => 'ESTABLISHED,RELATED' ); my ( $chain , $state, $rest) = split ':', $chainin , 3; @@ -1470,7 +1470,7 @@ sub process_secmark_rule() { fatal_error "Invalid CHAIN:STATE ($chainin)" if $rest || ! $chain; my $chain1= $chns{$chain}; - + fatal_error "Invalid or missing CHAIN ( $chain )" unless $chain1; fatal_error "USER/GROUP may only be used in the OUTPUT chain" if $user ne '-' && $chain1 ne 'tcout'; @@ -1488,22 +1488,22 @@ sub process_secmark_rule() { $disposition =~ s/ .*//; - expand_rule( ensure_mangle_chain( $chain1 ) , + expand_rule( ensure_mangle_chain( $chain1 ) , $restrictions{$chain1} , $state . do_proto( $proto, $dport, $sport ) . do_user( $user ) . do_test( $mark, $globals{TC_MASK} ) , - $source , - $dest , - '' , - $target , - '' , + $source , + $dest , + '' , + $target , + '' , $disposition, '' ); progress_message "Secmarks rule \"$currentline\" $done"; - + } # @@ -1622,7 +1622,7 @@ sub setup_tc() { first_entry "$doing $fn..."; process_secmark_rule while read_a_line; - + clear_comment; } diff --git a/Shorewall/Perl/Shorewall/Zones.pm b/Shorewall/Perl/Shorewall/Zones.pm index b8712dfeb..3c8030e48 100644 --- a/Shorewall/Perl/Shorewall/Zones.pm +++ b/Shorewall/Perl/Shorewall/Zones.pm @@ -160,7 +160,7 @@ our %reservedName = ( all => 1, # } # # The purpose of the 'base' member is to ensure that the base names associated with the physical interfaces are assigned in -# the same order as the interfaces are encountered in the configuration files. +# the same order as the interfaces are encountered in the configuration files. # our @interfaces; our %interfaces; @@ -804,7 +804,7 @@ sub chain_base($) { # return $name if $name; # - # Remember initial value + # Remember initial value # my $key = $chain; # @@ -882,7 +882,7 @@ sub process_interface( $$ ) { } else { $zoneref->{bridge} = $interface; } - + fatal_error "Vserver zones may not be associated with bridge ports" if $zoneref->{type} == VSERVER; } @@ -950,7 +950,7 @@ sub process_interface( $$ ) { if ( $zone ) { fatal_error qq(The "$option" option may not be specified for a Vserver zone") if $zoneref->{type} == VSERVER && ! ( $type & IF_OPTION_VSERVER ); - } else { + } else { fatal_error "The \"$option\" option may not be specified on a multi-zone interface" if $type & IF_OPTION_ZONEONLY; } @@ -1178,7 +1178,7 @@ sub map_physical( $$ ) { # # Returns true if passed interface matches an entry in /etc/shorewall/interfaces # -# If the passed name matches a wildcard and 'cache' is true, an entry for the name is added in +# If the passed name matches a wildcard and 'cache' is true, an entry for the name is added in # %interfaces. # sub known_interface($;$) @@ -1195,7 +1195,7 @@ sub known_interface($;$) my $root = $interfaceref->{root}; if ( $i ne $root && substr( $interface, 0, length $root ) eq $root ) { my $physical = map_physical( $interface, $interfaceref ); - + my $copyref = { options => $interfaceref->{options}, bridge => $interfaceref->{bridge} , name => $i , @@ -1392,7 +1392,7 @@ sub verify_required_interfaces( $ ) { my $wait = $interfaces{$interface}{options}{wait}; emit q() unless $first-- > 0; - + if ( $wait ) { my $physical = get_physical $interface; @@ -1431,7 +1431,7 @@ sub verify_required_interfaces( $ ) { } emit( ";;\n" ); - + pop_indent; pop_indent; @@ -1697,7 +1697,7 @@ sub process_host( ) { } elsif ( $zoneref->{bridge} ne $interfaces{$interface}{bridge} ) { fatal_error "Interface $interface is not a port on bridge $zoneref->{bridge}"; } - } + } my $optionsref = { dynamic => 0 }; @@ -1723,7 +1723,7 @@ sub process_host( ) { } } - fatal_error q(A host entry for a Vserver zone may not specify the 'ipsec' option) if $ipsec && $zoneref->{type} == VSERVER; + fatal_error q(A host entry for a Vserver zone may not specify the 'ipsec' option) if $ipsec && $zoneref->{type} == VSERVER; $optionsref = \%options; } diff --git a/Shorewall/Perl/prog.footer6 b/Shorewall/Perl/prog.footer6 index bbfd8f1d0..a1a0a7b2c 100644 --- a/Shorewall/Perl/prog.footer6 +++ b/Shorewall/Perl/prog.footer6 @@ -22,11 +22,11 @@ checkkernelversion() { local kernel kernel=$(printf "%2d%02d%02d" $(uname -r 2> /dev/null | sed -e 's/-.*//' -e 's/^\([0-9][0-9]*\)\.\([0-9][0-9]*\)\.\([0-9][0-9]*\).*$/\1 \2 \3/g')) - + if [ $kernel -lt 20624 ]; then error_message "ERROR: $g_product requires Linux kernel 2.6.24 or later" return 1 - else + else return 0 fi } @@ -296,7 +296,7 @@ case "$COMMAND" in echo "$g_product is stopped" status=4 fi - + if [ -f ${VARDIR}/state ]; then state="$(cat ${VARDIR}/state)" case $state in diff --git a/Shorewall/Perl/prog.header b/Shorewall/Perl/prog.header index 3d85d6b32..f7908fdda 100644 --- a/Shorewall/Perl/prog.header +++ b/Shorewall/Perl/prog.header @@ -509,7 +509,7 @@ undo_routing() { # restore_default_route() { local result - + if [ -z "$g_noroutes" -a -f ${VARDIR}/default_route ]; then local default_route default_route= diff --git a/Shorewall/Perl/prog.header6 b/Shorewall/Perl/prog.header6 index 979a6ad65..774023dc6 100644 --- a/Shorewall/Perl/prog.header6 +++ b/Shorewall/Perl/prog.header6 @@ -497,7 +497,7 @@ undo_routing() { # restore_default_route() { local result - + if [ -z "$g_noroutes" -a -f ${VARDIR}/default_route ]; then local default_route default_route= diff --git a/Shorewall/configfiles/findgw b/Shorewall/configfiles/findgw index 781556876..e38bcd6e7 100644 --- a/Shorewall/configfiles/findgw +++ b/Shorewall/configfiles/findgw @@ -3,11 +3,11 @@ # # /etc/shorewall/findgw # -# The code in this file is executed when Shorewall is trying to detect the +# The code in this file is executed when Shorewall is trying to detect the # gateway through an interface in /etc/shorewall/providers that has GATEWAY # specified as 'detect'. # -# The function should echo the IP address of the gateway if it knows what +# The function should echo the IP address of the gateway if it knows what # it is; the name of the interface is in $1. # # See http://shorewall.net/shorewall_extension_scripts.htm for additional diff --git a/Shorewall/configfiles/restored b/Shorewall/configfiles/restored index 4f258a413..2cd6891fc 100644 --- a/Shorewall/configfiles/restored +++ b/Shorewall/configfiles/restored @@ -4,7 +4,7 @@ # /etc/shorewall/restored # # Add commands below that you want to be executed after shorewall has -# completed a 'restore' command. +# completed a 'restore' command. # # See http://shorewall.net/shorewall_extension_scripts.htm for additional # information. diff --git a/Shorewall/configfiles/secmarks b/Shorewall/configfiles/secmarks index 262ed3735..dc23f6c3b 100644 --- a/Shorewall/configfiles/secmarks +++ b/Shorewall/configfiles/secmarks @@ -10,4 +10,4 @@ - + diff --git a/Shorewall/lib.cli b/Shorewall/lib.cli index 16003b0cf..7ab084066 100644 --- a/Shorewall/lib.cli +++ b/Shorewall/lib.cli @@ -562,7 +562,7 @@ show_command() { if [ -z "$LOGFILE" ]; then LOGFILE=/var/log/messages - + if [ -n "$(syslog_circular_buffer)" ]; then g_logread="logread | tac" elif [ -r $LOGFILE ]; then diff --git a/Shorewall/lib.common b/Shorewall/lib.common index 0fa629282..df3ab723b 100644 --- a/Shorewall/lib.common +++ b/Shorewall/lib.common @@ -514,7 +514,7 @@ find_file() # # Set the Shorewall state # -set_state () # $1 = state $2 +set_state () # $1 = state $2 { if [ $# -gt 1 ]; then echo "$1 ($(date)) from $2" > ${VARDIR}/state diff --git a/Shorewall/releasenotes.txt b/Shorewall/releasenotes.txt index 0d2784bf5..388922101 100644 --- a/Shorewall/releasenotes.txt +++ b/Shorewall/releasenotes.txt @@ -31,7 +31,7 @@ VI. PROBLEMS CORRECTED AND NEW FEATURES IN PRIOR RELEASES ... Shorewall configuration compiled to /var/lib/shorewall6/.start ERROR: Shorewall6 requires Linux kernel 2.6.24 or later - /usr/share/shorewall6/lib.common: line 73: + /usr/share/shorewall6/lib.common: line 73: [: -lt: unary operator expected ERROR: Shorewall6 requires Linux kernel 2.6.24 or later [root@localhost shorewall6]# @@ -345,18 +345,18 @@ V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S defined as optional in the interfaces file. o If there were no references matching the wildcard, then the - 'optional' option was effectively ignored. + 'optional' option was effectively ignored. The new implementation: - Insures valid shell variable names. - + - Insures that shell variable names are unique. - Handles interface names appearing in the INTERFACE column of the providers file as a special case for 'optional'. If the name matches a wildcard entry in the interfaces file then the - usability of the specific interface is tracked individually. + usability of the specific interface is tracked individually. - Handles the availabilty of other interfaces matching a wildcard as a group; if there is one useable interface in the group then @@ -392,7 +392,7 @@ V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S state match rather than conntrack match for UNTRACKED state matching. -12) If the routestopped files contains NOTRACK rules, 'shorewall* clear' +12) If the routestopped files contains NOTRACK rules, 'shorewall* clear' did not clear the raw table. 13) An error message was incorrectly generated if a port range of the @@ -429,7 +429,7 @@ V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S The 'all' and 'any' keywords now support exclusion in the form of a comma-separated list of excluded zones. - Examples: + Examples: all!fw (same as all-). any+!dmz,loc (All zones except 'dmz' and 'loc' and @@ -554,7 +554,7 @@ V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S fatal compilation error in REDIRECT rules. 4) A number of problems associated with Shorewall-init and Upstart - have been corrected. + have been corrected. If you use Shorewall-init, then when upgrading to this version, be sure to recompile all firewall scripts before you take interfaces @@ -564,7 +564,7 @@ V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S /usr/share/shorewall/configfiles/Makefile and rather issued the following message: - install-file: command not found + install-file: command not found This caused the Makefile to be omitted from RPMs as well. @@ -592,7 +592,7 @@ V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S 2) Per-ip log rate limiting has been added in the form of the LOGLIMIT option in shorewall.conf. When LOGLIMIT is specified, LOGRATE and - LOGBURST are ignored. + LOGBURST are ignored. LOGRATE and LOGBURST are now deprecated. @@ -675,7 +675,7 @@ V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S Shorewall is running State:Started (Thu Aug 12 19:41:48 PDT 2010) from /etc/shorewall/ - gateway:/etc/shorewall# + gateway:/etc/shorewall# ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 4 . 4 . 1 1 @@ -708,7 +708,7 @@ V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S shorewall.conf and shorewall6.conf. It has been added. 6) Under some versions of Perl, a Perl run-time diagnostic was produced - when options were omitted from shorewall.conf or shorewall6.conf. + when options were omitted from shorewall.conf or shorewall6.conf. 7) If the following options were specified in /etc/shorewall/interfaces for an interface with '-' in the ZONE column, then these options @@ -729,7 +729,7 @@ V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S 9) Previously, if nets= was specified under Shorewall6, this error would result: - ERROR: Invalid IPv6 address (224.0.0.0) : + ERROR: Invalid IPv6 address (224.0.0.0) : /etc/shorewall6/interfaces (line 16) ---------------------------------------------------------------------------- @@ -744,7 +744,7 @@ V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S See http://www.shorewall.net/Vserver.html for details. 2) A new FORWARD_CLEAR_MARK option has been added to shorewall.conf - and shorewall6.conf. + and shorewall6.conf. Traditionally, Shorewall has cleared the packet mark in the first rule in the mangle FORWARD chain. This behavior is maintained with