Merge branch '4.5.12'

Conflicts:
	Shorewall/Perl/Shorewall/Chains.pm

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall/Perl/Shorewall/ARP.pm

@@ -278,7 +278,7 @@ sub create_arptables_load( $ ) {
 	   'if [ $? != 0 ]; then',
 	   qq(    fatal_error "arptables-restore Failed. Input is in \${VARDIR}/.arptables-input"),
 	   "fi\n",
-	   "run_ip neigh flush nud noarp nud stale nud reachable\n",
+	   "run_ip neigh flush nud stale nud reachable\n",
 	   );    
 
     pop_indent;

Shorewall/Perl/Shorewall/Chains.pm

@@ -407,7 +407,7 @@ use constant {
 
 use constant { OPTIMIZE_MASK => OPTIMIZE_POLICY_MASK | OPTIMIZE_RULESET_MASK };
 
-use constant { DONT_OPTIMIZE => 1 , DONT_DELETE => 2, DONT_MOVE => 4 };
+use constant { DONT_OPTIMIZE => 1 , DONT_DELETE => 2, DONT_MOVE => 4, RETURNS => 8, RETURNS_DONT_MOVE => 12 };
 
 our %dscpmap = ( CS0  => 0x00,
 		 CS1  => 0x08,
@@ -462,6 +462,9 @@ use constant { NULL_MODE => 0 ,   # Emitting neither shell commands nor iptables
 	       CMD_MODE  => 2 };  # Emitting shell commands.
 
 our $mode;
+#
+# A reference to this rule is returned when we try to push a rule onto a 'complete' chain
+#
 our $dummyrule = { simple => 1, mode => CAT_MODE };
 
 #
@@ -664,9 +667,7 @@ sub initialize( $$$ ) {
     %isocodes  = ();
     %nfobjects = ();
     %switches  = ();
-    #
+
-    # Initialize this here so we can make it dynamic without moving the initialization
-    #
     %terminating = ( ACCEPT       => 1,
 		     DROP         => 1,
 		     RETURN       => 1,
@@ -680,6 +681,7 @@ sub initialize( $$$ ) {
 		     NOTRACK      => 1,
 		     REDIRECT     => 1,
 		     RAWDNAT      => 1,
+		     RAWSNAT      => 1,
 		     REJECT       => 1,
 		     SAME         => 1,
 		     SNAT         => 1,
@@ -1036,7 +1038,7 @@ sub push_rule( $$ ) {
 
     push @{$chainref->{rules}}, $ruleref;
     $chainref->{referenced} = 1;
-    $chainref->{optflags} |= DONT_MOVE if ( $ruleref->{target} || '' ) eq 'RETURN';
+    $chainref->{optflags} |= RETURNS_DONT_MOVE if ( $ruleref->{target} || '' ) eq 'RETURN';
     trace( $chainref, 'A', @{$chainref->{rules}}, "-A $chainref->{name} $_[1]" ) if $debug;
 
     $chainref->{complete} = 1 if $complete;
@@ -1053,7 +1055,7 @@ sub add_trule( $$ ) {
     assert( reftype $ruleref , $ruleref );
     push @{$chainref->{rules}}, $ruleref;
     $chainref->{referenced} = 1;
-    $chainref->{optflags} |= DONT_MOVE if ( $ruleref->{target} || '' ) eq 'RETURN';
+    $chainref->{optflags} |= RETURNS_DONT_MOVE if ( $ruleref->{target} || '' ) eq 'RETURN';
 
     trace( $chainref, 'A', @{$chainref->{rules}}, format_rule( $chainref, $ruleref ) ) if $debug;
 
@@ -1233,7 +1235,7 @@ sub push_irule( $$$;@ ) {
     if ( $jump ) {
 	$ruleref->{jump}       = $jump;
 	$ruleref->{target}     = $target;
-	$chainref->{optflags} |= DONT_MOVE if $target eq 'RETURN';
+	$chainref->{optflags} |= RETURNS_DONT_MOVE if $target eq 'RETURN';
 	$ruleref->{targetopts} = $targetopts if $targetopts;
     } else {
 	$ruleref->{target} = '';
@@ -2850,6 +2852,7 @@ sub optimize_level4( $$ ) {
     # The search continues until no short chains remain
     # Chains with 'DONT_OPTIMIZE' are exempted from optimization
     #
+
     while ( $progress ) {
 	$progress = 0;
 	$passes++;
@@ -2888,11 +2891,23 @@ sub optimize_level4( $$ ) {
 			delete_references $chainref;
 			$progress = 1;
 		    }
-		} elsif ( $numrules == 1) {
+		} else {
-		    my $firstrule = $chainref->{rules}[0];
+		    #
+		    # The chain has rules -- determine if it is terminating
+		    #
+		    my $name    = $chainref->{name};
+		    my $lastref = $chainref->{rules}[-1];
+
+		    unless ( $chainref->{optflags} & RETURNS || $terminating{$name} ) {
+			$progress = 1 if $terminating{$name} = ( ( $terminating{$lastref->{target} || ''} ) || ( $lastref->{jump} || '' ) eq 'g' );
+		    }
+
+		    if ( $numrules == 1) {
 			#
 			# Chain has a single rule
 			#
+			my $firstrule = $lastref;
+
 			if ( $firstrule ->{simple} ) {
 			    #
 			    # Easy case -- the rule is a simple jump
@@ -2948,7 +2963,6 @@ sub optimize_level4( $$ ) {
 			# all immediately preceding rules that have the same target
 			#
 			my $rulesref = $chainref->{rules};
-		    my $lastref = $rulesref->[-1];
 
 			if ( $lastref->{simple} && $lastref->{target} && ! $lastref->{targetopts} ) {
 			    my $target = $lastref->{target};
@@ -2981,7 +2995,8 @@ sub optimize_level4( $$ ) {
 				$count++;
 			    }
 
-			progress_message "   $count $target rules deleted from chain $chainref->{name}" if $count;
+			    progress_message "   $count $target rules deleted from chain $name" if $count;
+			}
 		    }
 		}
 	    }

Shorewall/Perl/Shorewall/Nat.pm

@@ -724,8 +724,6 @@ sub handle_nonat_rule( $$$$$$$$$$ ) {
 	}
     }
 
-    set_optflags( $nonat_chain, DONT_MOVE | DONT_OPTIMIZE ) if $tgt eq 'RETURN';
-
     expand_rule( $nonat_chain ,
 		 PREROUTE_RESTRICT ,
 		 $rule ,

Shorewall/Perl/Shorewall/Rules.pm

@@ -2475,8 +2475,6 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 	if ( $actiontype & ACTION ) {
 	    $action = $usedactions{$normalized_target}{name};
 	    $loglevel = '';
-	} else {
-	    set_optflags( $chainref , DONT_MOVE | DONT_OPTIMIZE ) if $action eq 'RETURN';
 	}
 
 	if ( $origdest ) {

Shorewall/Perl/lib.core

@@ -216,8 +216,8 @@ get_routed_networks() # $1 = interface name, $2-n = Fatal error message
 delete_tc1()
 {
     clear_one_tc() {
-        $TC qdisc del dev $1 root 2> /dev/null
+        $TC qdisc del dev ${1%@*} root 2> /dev/null
-        $TC qdisc del dev $1 ingress 2> /dev/null
+        $TC qdisc del dev ${1%@*} ingress 2> /dev/null
 
     }
 

Shorewall/manpages/shorewall-tcrules.xml

@@ -1051,10 +1051,10 @@ Normal-Service       =&gt; 0x00</programlisting>
         role="bold">:</emphasis>[<emphasis>max</emphasis>]]</term>
 
         <listitem>
-          <para>Optional - packet Length. This field, if present allow you to
+          <para>Optional - packet payload length. This field, if present allow
-          match the length of a packet against a specific value or range of
+          you to match the length of a packet payload (Layer 4 data ) against
-          values. You must have iptables length support for this to work. A
+          a specific value or range of values. You must have iptables length
-          range is specified in the form
+          support for this to work. A range is specified in the form
           <emphasis>min</emphasis>:<emphasis>max</emphasis> where either
           <emphasis>min</emphasis> or <emphasis>max</emphasis> (but not both)
           may be omitted. If <emphasis>min</emphasis> is omitted, then 0 is

Shorewall6/manpages/shorewall6-tcrules.xml

@@ -913,10 +913,10 @@ Normal-Service       =&gt; 0x00</programlisting>
         role="bold">:</emphasis>[<emphasis>max</emphasis>]]</term>
 
         <listitem>
-          <para>Optional packet Length. This field, if present allow you to
+          <para>Optional - packet payload length. This field, if present allow
-          match the length of a packet against a specific value or range of
+          you to match the length of a packet payload (Layer 4 data ) against
-          values. You must have ip6tables length support for this to work. A
+          a specific value or range of values. You must have iptables length
-          range is specified in the form
+          support for this to work. A range is specified in the form
           <emphasis>min</emphasis>:<emphasis>max</emphasis> where either
           <emphasis>min</emphasis> or <emphasis>max</emphasis> (but not both)
           may be omitted. If <emphasis>min</emphasis> is omitted, then 0 is

docs/configuration_file_basics.xml

@@ -142,10 +142,16 @@
         </listitem>
 
         <listitem>
-          <para><filename>/etc/shorewall/blacklist</filename> - lists
+          <para><filename>/etc/shorewall/blacklist</filename> - Deprecated in
+          favor of <filename>/etc/shorewall/blrules</filename>. Lists
           blacklisted IP/subnet/MAC addresses.</para>
         </listitem>
 
+        <listitem>
+          <para><filename>/etc/shorewall/blrules</filename> — Added in
+          Shorewall 4.5.0. Define blacklisting and whitelisting.</para>
+        </listitem>
+
         <listitem>
           <para><filename>/etc/shorewall/init</filename> - commands that you
           wish to execute at the beginning of a <quote>shorewall start</quote>
@@ -258,6 +264,11 @@
           start/restart when LOAD_HELPERS_ONLY=Yes in
           <filename>shorewall.conf</filename>.</para>
         </listitem>
+
+        <listitem>
+          <para><filename>/usr/share/arprules</filename> — Added in Shorewall
+          4.5.12. Allows specification of arptables rules.</para>
+        </listitem>
       </itemizedlist></para>
 
     <para><emphasis role="bold">If you need to change a file in
@@ -297,6 +308,12 @@
       <programlisting># This is a comment
 ACCEPT  net     $FW      tcp     www     #This is an end-of-line comment</programlisting>
     </example>
+
+    <important>
+      <para>If a comment ends with a backslash ("\"), the next line will also
+      be treated as a comment. See <link linkend="Continuation">Line
+      Continuation</link> below.</para>
+    </important>
   </section>
 
   <section id="Names">
@@ -516,6 +533,19 @@ ACCEPT      net:\
       continuation line does not end with a comma or colon, the leading white
       space in the last line is not ignored.</para>
     </example>
+
+    <important>
+      <para>A trailing backslash is not ignored in a comment. So the continued
+      rule above can be commented out with a single '#' as follows:</para>
+
+      <programlisting>#ACTION     SOURCE          DEST            PROTO           DEST
+#                                                           PORT(S)
+<emphasis role="bold">#</emphasis>ACCEPT     net:\
+            206.124.146.177,\
+            206.124.146.178,\
+            206.124.146.180\
+                            dmz             tcp             873</programlisting>
+    </important>
   </section>
 
   <section id="Pairs">