Fix syntax error in the generated script

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/install.sh

@@ -30,6 +30,8 @@ usage() # $1 = exit status
     echo "usage: $ME"
     echo "       $ME -v"
     echo "       $ME -h"
+    echo "       $ME -s"
+    echo "       $ME -f"
     exit $1
 }
 
@@ -85,13 +87,6 @@ install_file() # $1 = source $2 = target $3 = mode
     run_install $T $OWNERSHIP -m $3 $1 ${2}
 }
 
-cd "$(dirname $0)"
-
-#
-# Load packager's settings if any
-#
-[ -f ../shorewall-pkg.config ] && . ../shorewall-pkg.config
-
 [ -n "$DESTDIR" ] || DESTDIR="$PREFIX"
 
 #
@@ -103,13 +98,13 @@ T="-T"
 
 [ -n "${LIBEXEC:=/usr/share}" ]
 [ -n "${PERLLIB:=/usr/share/shorewall}" ]
+MACHOST=
 
 case "$LIBEXEC" in
     /*)
 	;;
     *)
-	echo "The LIBEXEC setting must be an absolute path name" >&2
+	LIBEXEC=/usr/${LIBEXEC}
-	exit 1
 	;;
 esac
 
@@ -117,41 +112,14 @@ case "$PERLLIB" in
     /*)
 	;;
     *)
-	echo "The PERLLIB setting must be an absolute path name" >&2
+	PERLLIB=/usr/${PERLLIB}
-	exit 1
 	;;
 esac
 
 INSTALLD='-D'
 
-if [ -z "$BUILD" ]; then
+case $(uname) in
-    case $(uname) in
+    CYGWIN*)
-	cygwin*)
-	    BUILD=cygwin
-	    ;;
-	Darwin)
-	    BUILD=apple
-	    ;;
-	*)
-	    if [ -f /etc/debian_version ]; then
-		BUILD=debian
-	    elif [ -f /etc/redhat-release ]; then
-		BUILD=redhat
-	    elif [ -f /etc/slackware-version ] ; then
-		BUILD=slackware
-	    elif [ -f /etc/SuSE-release ]; then
-		BUILD=suse
-	    elif [ -f /etc/arch-release ] ; then
-		BUILD=archlinux
-	    else
-		BUILD=linux
-	    fi
-	    ;;
-    esac
-fi
-
-case $BUILD in
-    cygwin*)
 	if [ -z "$DESTDIR" ]; then
 	    DEST=
 	    INIT=
@@ -159,16 +127,18 @@ case $BUILD in
 
 	OWNER=$(id -un)
 	GROUP=$(id -gn)
+	CYGWIN=Yes
 	;;
-    apple)
+    Darwin)
 	if [ -z "$DESTDIR" ]; then
 	    DEST=
 	    INIT=
-	    SPARSE=Yes
 	fi
 
 	[ -z "$OWNER" ] && OWNER=root
 	[ -z "$GROUP" ] && GROUP=wheel
+	MAC=Yes
+        MACHOST=Yes
 	INSTALLD=
 	T=
 	;;
@@ -198,6 +168,14 @@ while [ $finished -eq 0 ]; do
 			echo "Shorewall Firewall Installer Version $VERSION"
 			exit 0
 			;;
+		    a*)
+			ANNOTATED=Yes
+			option=${option#a}
+			;;
+		    p*)
+			ANNOTATED=
+			option=${option#p}
+			;;
 		    *)
 			usage 1
 			;;
@@ -219,30 +197,43 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 # Determine where to install the firewall script
 #
 
-[ -n "$HOST" ] || HOST=$BUILD
-
-case "$HOST" in
-    cygwin)
-	echo "Installing Cygwin-specific configuration..."
-	;;
-    apple)
-	echo "Installing Mac-specific configuration...";
-	;;
-    debian|redhat|slackware|archlinux|linux|suse)
-	;;
-    *)
-	echo "ERROR: Unknown HOST \"$HOST\"" >&2
-	exit 1;
-	;;
-esac
-
 if [ -n "$DESTDIR" ]; then
-    if [ $BUILD != cygwin ]; then
+    if [ -z "$CYGWIN" ]; then
 	if [ `id -u` != 0 ] ; then
 	    echo "Not setting file owner/group permissions, not running as root."
 	    OWNERSHIP=""
 	fi
     fi
+
+    install -d $OWNERSHIP -m 755 ${DESTDIR}/sbin
+    install -d $OWNERSHIP -m 755 ${DESTDIR}${DEST}
+
+    CYGWIN=
+    MAC=
+else
+    if [ -n "$CYGWIN" ]; then
+	echo "Installing Cygwin-specific configuration..."
+    elif [ -n "$MAC" ]; then
+	echo "Installing Mac-specific configuration..."
+    else
+	if [ -f /etc/debian_version ]; then
+	    echo "Installing Debian-specific configuration..."
+	    DEBIAN=yes
+	elif [ -f /etc/redhat-release ]; then
+	    echo "Installing Redhat/Fedora-specific configuration..."
+	    FEDORA=yes
+	elif [ -f /etc/slackware-version ] ; then
+	    echo "Installing Slackware-specific configuration..."
+	    DEST="/etc/rc.d"
+	    MANDIR="/usr/man"
+	    SLACKWARE=yes
+	elif [ -f /etc/arch-release ] ; then
+	    echo "Installing ArchLinux-specific configuration..."
+	    DEST="/etc/rc.d"
+	    INIT="shorewall"
+	    ARCHLINUX=yes
+	fi
+    fi
 fi
 
 #
@@ -256,12 +247,7 @@ echo "Installing Shorewall Core Version $VERSION"
 # Create /usr/share/shorewall
 #
 mkdir -p ${DESTDIR}${LIBEXEC}/shorewall
-chmod 755 ${DESTDIR}${LIBEXEC}/shorewall
+chmod 755 ${DESTDIR}/usr/share/shorewall
-
-if [ $LIBEXEC != /usr/shorewall/ ]; then
-    mkdir -p ${DESTDIR}/usr/share/shorewall
-    chmod 755 ${DESTDIR}/usr/share/shorewall
-fi
 #
 # Install wait4ifup
 #
@@ -278,7 +264,7 @@ for f in lib.* ; do
     echo "Library ${f#*.} file installed as ${DESTDIR}/usr/share/shorewall/$f"
 done
 
-if [ $BUILD != apple ]; then
+if [ -z "$MACHOST" ]; then
     eval sed -i \'s\|g_libexec=.\*\|g_libexec=$LIBEXEC\|\' ${DESTDIR}/usr/share/shorewall/lib.cli
     eval sed -i \'s\|g_perllib=.\*\|g_perllib=$PERLLIB\|\' ${DESTDIR}/usr/share/shorewall/lib.cli
 else

Shorewall-core/lib.cli

@@ -1112,7 +1112,7 @@ do_dump_command() {
 	echo "   Shorewall $(cat /usr/share/shorewall/version)"
 	echo
     fi
-    show_status
+    
     show_reset
     host=$(echo $g_hostname | sed 's/\..*$//')
     $g_tool -L $g_ipt_options
@@ -1957,8 +1957,6 @@ determine_capabilities() {
     CT_TARGET=
     STATISTIC_MATCH=
     IMQ_TARGET=
-    DSCP_MATCH=
-    DSCP_TARGET=
 
     chain=fooX$$
 
@@ -2083,14 +2081,10 @@ determine_capabilities() {
 	qt $g_tool -t mangle -A $chain -j CLASSIFY --set-class 1:1 && CLASSIFY_TARGET=Yes
 	qt $g_tool -t mangle -A $chain -j IPMARK --addr src && IPMARK_TARGET=Yes
 	qt $g_tool -t mangle -A $chain -p tcp -j TPROXY --on-port 0 --tproxy-mark 1 && TPROXY_TARGET=Yes
-	qt $g_tool -t mangle -A $chain -j IMQ --todev 0 && IMQ_TARGET=Yes
-	qt $g_tool -t mangle -A $chain -m dscp --dscp 0 && DSCP_MATCH=Yes
-	qt $g_tool -t mangle -A $chain -j DSCP --set-dscp 0 && DSCP_TARGET=Yes
-
 	qt $g_tool -t mangle -F $chain
 	qt $g_tool -t mangle -X $chain
-	
 	qt $g_tool -t mangle -L FORWARD -n && MANGLE_FORWARD=Yes
+	qt $g_tool -t mangle -A $chain -j IMQ --todev 0 && IMQ_TARGET=Yes
     fi
 
     qt $g_tool -t raw	    -L -n && RAW_TABLE=Yes
@@ -2273,8 +2267,6 @@ report_capabilities() {
 	report_capability "Condition Match" $CONDITION_MATCH
 	report_capability "Statistic Match" $STATISTIC_MATCH
 	report_capability "IMQ Target" $IMQ_TARGET
-	report_capability "DSCP Match" $DSCP_MATCH
-	report_capability "DSCP Target" $DSCP_TARGET
 	
 	if [ $g_family -eq 4 ]; then
 	    report_capability "iptables -S" $IPTABLES_S
@@ -2362,14 +2354,14 @@ report_capabilities1() {
     report_capability1 CT_TARGET
     report_capability1 STATISTIC_MATCH
     report_capability1 IMQ_TARGET
-    report_capability1 DSCP_MATCH
-    report_capability1 DSCP_TARGET
 
     echo CAPVERSION=$SHOREWALL_CAPVERSION
     echo KERNELVERSION=$KERNELVERSION
 }
 
-show_status() {
+status_command() {
+    echo "${g_product}-$SHOREWALL_VERSION Status at $g_hostname - $(date)"
+    echo
     if product_is_started ; then
 	echo "$g_product is running"
 	status=0
@@ -2389,12 +2381,6 @@ show_status() {
 	state=Unknown
     fi
     echo "State:$state"
-}
-
-status_command() {
-    echo "${g_product}-$SHOREWALL_VERSION Status at $g_hostname - $(date)"
-    echo
-    show_status
     echo
     exit $status
 }

Shorewall-init/ifupdown.sh

@@ -185,7 +185,7 @@ for PRODUCT in $PRODUCTS; do
     VARDIR=/var/lib/$PRODUCT
     [ -f /etc/$PRODUCT/vardir ] && . /etc/$PRODUCT/vardir
     if [ -x $VARDIR/firewall ]; then
-	  ( . /usr/share/shorewall/lib.base
+	  ( . /usr/share/$PRODUCT/lib.base
 	    mutex_on
 	    ${VARDIR}/firewall -V0 $COMMAND $INTERFACE || echo_notdone
 	    mutex_off

Shorewall-init/install.sh

@@ -86,15 +86,22 @@ install_file() # $1 = source $2 = target $3 = mode
     run_install $T $OWNERSHIP -m $3 $1 ${2}
 }
 
-cd "$(dirname $0)"
-
-#
-# Load packager's settings if any
-#
-[ -f ../shorewall-pkg.config ] && . ../shorewall-pkg.config
-
 [ -n "$DESTDIR" ] || DESTDIR="$PREFIX"
 
+# DEST is the SysVInit script directory
+# INIT is the name of the script in the $DEST directory
+# ARGS is "yes" if we've already parsed an argument
+#
+ARGS=""
+
+if [ -z "$DEST" ] ; then
+	DEST="/etc/init.d"
+fi
+
+if [ -z "$INIT" ] ; then
+	INIT="shorewall-init"
+fi
+
 while [ $# -gt 0 ] ; do
     case "$1" in
 	-h|help|?)
@@ -109,6 +116,7 @@ while [ $# -gt 0 ] ; do
 	    ;;
     esac
     shift
+    ARGS="yes"
 done
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
@@ -119,112 +127,75 @@ case "$LIBEXEC" in
     /*)
 	;;
     *)
-	echo "The LIBEXEC setting must be an absolute path name" >&2
+	LIBEXEC=/usr/${LIBEXEC}
-	exit 1
 	;;
 esac
 
-INITFILE="shorewall-init"
+#
+# Determine where to install the firewall script
+#
 
-if [ -z "$BUILD" ]; then
+case $(uname) in
-    case $(uname) in
-	cygwin*)
-	    BUILD=cygwin
-	    ;;
     Darwin)
-	    BUILD=apple
+	[ -z "$OWNER" ] && OWNER=root
-	    ;;
+	[ -z "$GROUP" ] && GROUP=wheel
-	*)
-	    if [ -f /etc/debian_version ]; then
-		BUILD=debian
-	    elif [ -f /etc/redhat-release ]; then
-		BUILD=redhat
-	    elif [ -f /etc/SuSE-release ]; then
-		BUILD=suse
-	    elif [ -f /etc/slackware-version ] ; then
-		BUILD=slackware
-	    elif [ -f /etc/arch-release ] ; then
-		BUILD=archlinux
-	    else
-		BUILD=linux
-	    fi
-	    ;;
-    esac
-fi
-
-[ -n "$OWNER" ] || OWNER=$(id -un)
-[ -n "$GROUP" ] || GROUP=$(id -gn)
-
-case $BUILD in
-    apple)
 	T=
 	;;	
-    debian|redhat|suse|slackware|archlinux)
-	;;
     *)
-	[ -n "$BUILD" ] && echo "ERROR: Unknown BUILD environment ($BUILD)" >&2 || echo "ERROR: Unknown BUILD environment"
+	[ -z "$OWNER" ] && OWNER=root
-	exit 1
+	[ -z "$GROUP" ] && GROUP=root
 	;;
 esac
 
 OWNERSHIP="-o $OWNER -g $GROUP"
 
-[ -n "$HOST" ] || HOST=$BUILD
-
-case "$HOST" in
-    debian)
-	echo "Installing Debian-specific configuration..."
-	SPARSE=yes
-	;;
-    redhat|redhat)
-	echo "Installing Redhat/Fedora-specific configuration..."
-	[ -n "$INITDIR" ] || INITDIR=/etc/rc.d/init.d
-	;;
-    slackware)
-	echo "Shorewall-init is currently not supported on Slackware" >&2
-	exit 1
-	;;
-    archlinux)
-	echo "Shorewall-init is currently not supported on Arch Linux" >&2
-	exit 1
-	;;
-    suse|suse)
-	echo "Installing SuSE-specific configuration..."
-	;;
-    linux)
-	echo "ERROR: Shorewall-init is not supported on this system" >&2
-	;;
-    *)
-	echo "ERROR: Unsupported HOST distribution: \"$HOST\"" >&2
-	exit 1;
-	;;
-esac
-
-[ -z "$TARGET" ] && TARGET=$HOST
-
-if [ -z "$INITDIR" -a -n "$INITFILE" ] ; then
-    INITDIR="/etc/init.d"
-fi
-
 if [ -n "$DESTDIR" ]; then
     if [ `id -u` != 0 ] ; then
 	echo "Not setting file owner/group permissions, not running as root."
 	OWNERSHIP=""
     fi
     
-    install -d $OWNERSHIP -m 755 ${DESTDIR}${INITDIR}
+    install -d $OWNERSHIP -m 755 ${DESTDIR}${DEST}
+elif [ -f /etc/debian_version ]; then
+    DEBIAN=yes
+elif [ -f /etc/SuSE-release ]; then
+    SUSE=Yes
+elif [ -f /etc/redhat-release ]; then
+    FEDORA=Yes
+elif [ -f /etc/slackware-version ] ; then
+    echo "Shorewall-init is currently not supported on Slackware" >&2
+    exit 1
+#   DEST="/etc/rc.d"
+#   INIT="rc.firewall"
+elif [ -f /etc/arch-release ] ; then
+    echo "Shorewall-init is currently not supported on Arch Linux" >&2
+    exit 1
+#   DEST="/etc/rc.d"
+#   INIT="shorewall-init"
+#   ARCHLINUX=yes
+elif [ -d /etc/sysconfig/network-scripts/ ]; then
+    #
+    # Assume RedHat-based
+    #
+    REDHAT=Yes
+else
+    echo "Unknown distribution: Shorewall-init support is not available" >&2
+    exit 1
 fi
 
 if [ -z "$DESTDIR" ]; then
-    if [ -d /lib/systemd/system ]; then
+    if [ -f /lib/systemd/system ]; then
 	SYSTEMD=Yes
-	INITFILE=
     fi
 elif [ -n "$SYSTEMD" ]; then
     mkdir -p ${DESTDIR}/lib/systemd/system
-    INITFILE=
 fi
 
+#
+# Change to the directory containing this script
+#
+cd "$(dirname $0)"
+
 echo "Installing Shorewall Init Version $VERSION"
 
 #
@@ -236,36 +207,33 @@ else
     first_install="Yes"
 fi
 
-if [ -n "$INITFILE" ]; then
+#
-    #
+# Install the Init Script
-    # Install the Init Script
+#
-    #
+if [ -z "$SYSTEMD" ]; then
-    case $TARGET in
+    if [ -n "$DEBIAN" ]; then
-	debian)
+	install_file init.debian.sh ${DESTDIR}/etc/init.d/shorewall-init 0544
-	    install_file init.debian.sh ${DESTDIR}${INITDIR}/${INITFILE} 0544
+    elif [ -n "$FEDORA" ]; then
-	    ;;
+	install_file init.fedora.sh ${DESTDIR}/etc/init.d/shorewall-init 0544
-	redhat)
+    #elif [ -n "$ARCHLINUX" ]; then
-	    install_file init.fedora.sh ${DESTDIR}${INITDIR}/${INITFILE} 0544
+    #    install_file init.archlinux.sh ${DESTDIR}${DEST}/$INIT 0544
-	    ;;
+    else
-	*)
+	install_file init.sh ${DESTDIR}${DEST}/$INIT 0544
-	    install_file init.sh ${DESTDIR}${INITDIR}/${INITFILE} 0544
+    fi
-	    ;;
-    esac
 
-    echo  "Shorewall-init script installed in ${DESTDIR}${INITDIR}/${INITFILE}"
+    echo  "Shorewall Init script installed in ${DESTDIR}${DEST}/$INIT"
-fi
+else
-#
+    #
-# Install the .service file
+    # Install the .service file
-#
+    #
-if [ -n "$SYSTEMD" ]; then
     run_install $OWNERSHIP -m 600 shorewall-init.service ${DESTDIR}/lib/systemd/system/shorewall-init.service
     echo "Service file installed as ${DESTDIR}/lib/systemd/system/shorewall-init.service"
     if [ -n "$DESTDIR" ]; then
 	mkdir -p ${DESTDIR}/sbin/
-        chmod 755 ${DESTDIR}/sbin
+	chmod 755 ${DESTDIR}/sbin/
+	run_install $OWNERSHIP -m 600 shorewall-init ${DESTDIR}/sbin/shorewall-init
+	echo "CLI installed as ${DESTDIR}/lib/systemd/system/shorewall-init.service"
     fi
-    run_install $OWNERSHIP -m 700 shorewall-init ${DESTDIR}/sbin/shorewall-init
-    echo "CLI installed as ${DESTDIR}/sbin/shorewall-init"
 fi
 
 #
@@ -285,10 +253,10 @@ chmod 644 ${DESTDIR}/usr/share/shorewall-init/version
 #
 if [ -z "$DESTDIR" ]; then
     rm -f /usr/share/shorewall-init/init
-    ln -s ${INITDIR}/${INITFILE} /usr/share/shorewall-init/init
+    ln -s ${DEST}/${INIT} /usr/share/shorewall-init/init
 fi
 
-if [ $HOST = debian ]; then
+if [ -n "$DEBIAN" ]; then
     if [ -n "${DESTDIR}" ]; then
 	mkdir -p ${DESTDIR}/etc/network/if-up.d/
 	mkdir -p ${DESTDIR}/etc/network/if-post-down.d/
@@ -306,7 +274,7 @@ else
 	mkdir -p ${DESTDIR}/etc/sysconfig
 
 	if [ -z "$RPM" ]; then
-	    if [ $HOST = suse ]; then
+	    if [ -n "$SUSE" ]; then
 		mkdir -p ${DESTDIR}/etc/sysconfig/network/if-up.d
 		mkdir -p ${DESTDIR}/etc/sysconfig/network/if-down.d
 	    else
@@ -332,30 +300,24 @@ if [ -d ${DESTDIR}/etc/NetworkManager ]; then
     install_file ifupdown.sh ${DESTDIR}/etc/NetworkManager/dispatcher.d/01-shorewall 0544
 fi
 
-case $HOST in
+if [ -n "$DEBIAN" ]; then
-    debian)
     install_file ifupdown.sh ${DESTDIR}/etc/network/if-up.d/shorewall 0544
     install_file ifupdown.sh ${DESTDIR}/etc/network/if-post-down.d/shorewall 0544
-	;;
+elif [ -n "$SUSE" ]; then
-    suse)
-	if [ -z "$RPM" ]; then
     install_file ifupdown.sh ${DESTDIR}/etc/sysconfig/network/if-up.d/shorewall 0544
     install_file ifupdown.sh ${DESTDIR}/etc/sysconfig/network/if-down.d/shorewall 0544
-	fi
+elif [ -n "$REDHAT" ]; then
-	;;
-    redhat)
     if [ -f ${DESTDIR}/sbin/ifup-local -o -f ${DESTDIR}/sbin/ifdown-local ]; then
 	echo "WARNING: /sbin/ifup-local and/or /sbin/ifdown-local already exist; up/down events will not be handled"
-	elif [ -z "$DESTDIR" ]; then
+    else
 	install_file ifupdown.sh ${DESTDIR}/sbin/ifup-local 0544
 	install_file ifupdown.sh ${DESTDIR}/sbin/ifdown-local 0544
     fi
-	;;
+fi
-esac
 
 if [ -z "$DESTDIR" ]; then
     if [ -n "$first_install" ]; then
-	if [ $HOST = debian ]; then
+	if [ -n "$DEBIAN" ]; then
 	    
 	    update-rc.d shorewall-init defaults
 
@@ -384,7 +346,7 @@ if [ -z "$DESTDIR" ]; then
 		else
 		    cant_autostart
 		fi
-	    else
+	    elif [ "$INIT" != rc.firewall ]; then #Slackware starts this automatically
 		cant_autostart
 	    fi
 
@@ -392,7 +354,7 @@ if [ -z "$DESTDIR" ]; then
     fi
 else
     if [ -n "$first_install" ]; then
-	if [ $HOST = debian ]; then
+	if [ -n "$DEBIAN" ]; then
 	    if [ -n "${DESTDIR}" ]; then
 		mkdir -p ${DESTDIR}/etc/rcS.d
 	    fi
@@ -404,14 +366,12 @@ else
 fi
 
 if [ -f ${DESTDIR}/etc/ppp ]; then
-    case $HOST in
+    if [ -n "$DEBIAN" ] -o -n "$SUSE" ]; then
-	debian|suse)
 	for directory in ip-up.d ip-down.d ipv6-up.d ipv6-down.d; do
 	    mkdir -p ${DESTDIR}/etc/ppp/$directory #SuSE doesn't create the IPv6 directories
 	    cp -fp ${DESTDIR}${LIBEXEC}/shorewall-init/ifupdown ${DESTDIR}/etc/ppp/$directory/shorewall
 	done
-	    ;;
+    elif [ -n "$REDHAT" ]; then
-	redhat)
 	#
 	# Must use the dreaded ip_xxx.local file
 	#
@@ -428,9 +388,9 @@ if [ -f ${DESTDIR}/etc/ppp ]; then
 		cp -fp ${DESTDIR}${LIBEXEC}/shorewall-init/ifupdown $FILE
 	    fi
 	done
-	    ;;
+    fi
-    esac
 fi
+
 #
 #  Report Success
 #

Shorewall-init/shorewall-init

@@ -23,6 +23,12 @@
 #       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
 #########################################################################################
+if [ "$(id -u)" != "0" ]
+then
+  echo "You must be root to start, stop or restart \"Shorewall \"."
+  exit 1
+fi
+
 # check if shorewall-init is configured or not
 if [ -f "/etc/sysconfig/shorewall-init" ]; then
     . /etc/sysconfig/shorewall-init
@@ -51,10 +57,6 @@ shorewall_start () {
       fi
   done
 
-  if [ -n "$SAVE_IPSETS" -a -f "$SAVE_IPSETS" ]; then
-      ipset -R < "$SAVE_IPSETS"
-  fi
-
   return 0
 }
 
@@ -72,13 +74,6 @@ shorewall_stop () {
       fi
   done
 
-  if [ -n "$SAVE_IPSETS" ]; then
-      mkdir -p $(dirname "$SAVE_IPSETS")
-      if ipset -S > "${SAVE_IPSETS}.tmp"; then
-	  grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
-      fi
-  fi
-
   return 0
 }
 

Shorewall-lite/Makefile

@@ -12,7 +12,7 @@ $(VARDIR)/${RESTOREFILE}: $(VARDIR)/firewall
 	then \
 	    /sbin/shorewall-lite -q save >/dev/null; \
 	else \
-	    /sbin/shorewall-lite -q restart 2>&1 | tail >&2; exit 1; \
+	    /sbin/shorewall-lite -q restart 2>&1 | tail >&2; \
 	fi
 
 # EOF

Shorewall-lite/install.sh

@@ -90,11 +90,6 @@ install_file() # $1 = source $2 = target $3 = mode
 #
 cd "$(dirname $0)"
 
-#
-# Load packager's settings if any
-#
-[ -f ../shorewall-pkg.config ] && . ../shorewall-pkg.config
-
 if [ -f shorewall-lite ]; then
     PRODUCT=shorewall-lite
     Product="Shorewall Lite"
@@ -108,6 +103,17 @@ fi
 #
 # Parse the run line
 #
+# DEST is the SysVInit script directory
+# INIT is the name of the script in the $DEST directory
+#
+if [ -z "$DEST" ] ; then
+	DEST="/etc/init.d"
+fi
+
+if [ -z "$INIT" ] ; then
+	INIT="$PRODUCT"
+fi
+
 while [ $# -gt 0 ] ; do
     case "$1" in
 	-h|help|?)
@@ -132,53 +138,28 @@ case "$LIBEXEC" in
     /*)
 	;;
     *)
-	echo "The LIBEXEC setting must be an absolute path name" >&2
+	LIBEXEC=/usr/${LIBEXEC}
-	exit 1
 	;;
 esac
 
 #
 # Determine where to install the firewall script
 #
-cygwin=
+CYGWIN=
 INSTALLD='-D'
-INITFILE=$PRODUCT
 T='-T'
 
-if [ -z "$BUILD" ]; then
+case $(uname) in
-    case $(uname) in
+    CYGWIN*)
-	cygwin*)
+	if [ -z "$DESTDIR" ]; then
-	    BUILD=cygwin
+	    DEST=
-	    ;;
+	    INIT=
-	Darwin)
-	    BUILD=apple
-	    ;;
-	*)
-	    if [ -f /etc/debian_version ]; then
-		BUILD=debian
-	    elif [ -f /etc/redhat-release ]; then
-		BUILD=redhat
-	    elif [ -f /etc/SuSE-release ]; then
-		BUILD=suse
-	    elif [ -f /etc/slackware-version ] ; then
-		BUILD=slackware
-	    elif [ -f /etc/arch-release ] ; then
-		BUILD=archlinux
-	    else
-		BUILD=linux
 	fi
-	    ;;
-    esac
-fi
 
-case $BUILD in
-    cygwin*)
 	OWNER=$(id -un)
 	GROUP=$(id -gn)
 	;;
-    apple)
+    Darwin)
-	[ -z "$OWNER" ] && OWNER=root
-	[ -z "$GROUP" ] && GROUP=wheel
 	INSTALLD=
 	T=
 	;;	   
@@ -190,45 +171,6 @@ esac
 
 OWNERSHIP="-o $OWNER -g $GROUP"
 
-[ -n "$HOST" ] || HOST=$BUILD
-
-case "$HOST" in
-    cygwin)
-	echo "$PRODUCT is not supported on Cygwin" >&2
-	exit 1
-	;;
-    apple)
-	echo "$PRODUCT is not supported on OS X" >&2
-	exit 1
-	;;
-    debian)
-	echo "Installing Debian-specific configuration..."
-	SPARSE=yes
-	;;
-    redhat)
-	echo "Installing Redhat/Fedora-specific configuration..."
-	[ -n "$INITDIR" ]  || INITDIR=/etc/rc.d/init.d
-	;;
-    slackware)
-	echo "Installing Slackware-specific configuration..."
-	[ -n "$INITDIR" ]  || INITDIR="/etc/rc.d"
-	[ -n "$INITFILE" ] || INITFILE="rc.firewall"
-	[ -n "$MANDIR=" ]  || MANDIR=/usr/man
-	;;
-    archlinux)
-	echo "Installing ArchLinux-specific configuration..."
-	[ -n "$INITDIR" ]  || INITDIR="/etc/rc.d"
-	;;
-    linux|suse)
-	;;
-    *)
-	echo "ERROR: Unknown HOST \"$HOST\"" >&2
-	exit 1;
-	;;
-esac
-
-[ -z "$INITDIR" ] && INITDIR="/etc/init.d"
-
 if [ -n "$DESTDIR" ]; then
     if [ `id -u` != 0 ] ; then
 	echo "Not setting file owner/group permissions, not running as root."
@@ -236,13 +178,21 @@ if [ -n "$DESTDIR" ]; then
     fi
     
     install -d $OWNERSHIP -m 755 ${DESTDIR}/sbin
-    install -d $OWNERSHIP -m 755 ${DESTDIR}${DESTFILE}
+    install -d $OWNERSHIP -m 755 ${DESTDIR}${DEST}
+elif [ -d /etc/apt -a -e /usr/bin/dpkg ]; then
+    DEBIAN=yes
+elif [ -f /etc/redhat-release ]; then
+    FEDORA=yes
+elif [ -f /etc/slackware-version ] ; then
+    DEST="/etc/rc.d"
+    INIT="rc.firewall"
+elif [ -f /etc/arch-release ] ; then
+      DEST="/etc/rc.d"
+      INIT="$PRODUCT"
+      ARCHLINUX=yes
+fi
 
-    if [ -n "$SYSTEMD" ]; then
+if [ -z "$DESTDIR" ]; then
-	mkdir -p ${DESTDIR}/lib/systemd/system
-	INITFILE=
-    fi
-else
     if [ ! -f /usr/share/shorewall/coreversion ]; then
 	echo "$PRODUCT $VERSION requires Shorewall Core which does not appear to be installed" >&2
 	exit 1
@@ -250,8 +200,9 @@ else
 
     if [ -f /lib/systemd/system ]; then
 	SYSTEMD=Yes
-	INITFILE=
     fi
+elif [ -n "$SYSTEMD" ]; then
+    mkdir -p ${DESTDIR}/lib/systemd/system
 fi
 
 echo "Installing $Product Version $VERSION"
@@ -271,7 +222,7 @@ else
     rm -rf ${DESTDIR}/etc/$PRODUCT
     rm -rf ${DESTDIR}/usr/share/$PRODUCT
     rm -rf ${DESTDIR}/var/lib/$PRODUCT
-    [ "$LIBEXEC" = /usr/share ] || rm -rf ${DESTDIR}/usr/share/$PRODUCT/wait4ifup ${DESTDIR}/usr/share/$PRODUCT/shorecap
+    [ "$LIBEXEC" = /usr/share ] || rm -rf /usr/share/$PRODUCT/wait4ifup /usr/share/$PRODUCT/shorecap
 fi
 
 #
@@ -289,6 +240,21 @@ install_file $PRODUCT ${DESTDIR}/sbin/$PRODUCT 0544
 
 echo "$Product control program installed in ${DESTDIR}/sbin/$PRODUCT"
 
+#
+# Install the Firewall Script
+#
+if [ -n "$DEBIAN" ]; then
+    install_file init.debian.sh ${DESTDIR}/etc/init.d/$PRODUCT 0544
+elif [ -n "$FEDORA" ]; then
+    install_file init.fedora.sh ${DESTDIR}/etc/init.d/$PRODUCT 0544
+elif [ -n "$ARCHLINUX" ]; then
+    install_file init.archlinux.sh ${DESTDIR}/${DEST}/$INIT 0544
+else
+    install_file init.sh ${DESTDIR}/${DEST}/$INIT 0544
+fi
+
+echo  "$Product script installed in ${DESTDIR}${DEST}/$INIT"
+
 #
 # Create /etc/$PRODUCT, /usr/share/$PRODUCT and /var/lib/$PRODUCT if needed
 #
@@ -303,28 +269,8 @@ chmod 755 ${DESTDIR}/usr/share/$PRODUCT
 if [ -n "$DESTDIR" ]; then
     mkdir -p ${DESTDIR}/etc/logrotate.d
     chmod 755 ${DESTDIR}/etc/logrotate.d
-    mkdir -p ${DESTDIR}${INITDIR}
-    chmod 755 ${DESTDIR}${INITDIR}
 fi
 
-if [ -n "$INITFILE" ]; then
-    case $HOST in
-	debian)
-	    install_file init.debian.sh ${DESTDIR}${INITDIR}/${INITFILE} 0544
-	    ;;
-	redhat)
-	    install_file init.fedora.sh ${DESTDIR}${INITDIR}/${INITFILE} 0544
-	    ;;
-	archlinux)
-	    install_file init.archlinux.sh ${DESTDIR}${INITDIR}/${INITFILE} 0544
-	    ;;
-	*)
-	    install_file init.sh ${DESTDIR}${INITDIR}/${INITFILE} 0544
-	    ;;
-    esac
-
-    echo  "$Product init script installed in ${DESTDIR}${INITDIR}/${INITFILE}"
-fi
 #
 # Install the .service file
 #
@@ -341,7 +287,7 @@ if [ ! -f ${DESTDIR}/etc/$PRODUCT/$PRODUCT.conf ]; then
    echo "Config file installed as ${DESTDIR}/etc/$PRODUCT/$PRODUCT.conf"
 fi
 
-if [ $HOST = archlinux ] ; then
+if [ -n "$ARCHLINUX" ] ; then
    sed -e 's!LOGFILE=/var/log/messages!LOGFILE=/var/log/messages.log!' -i ${DESTDIR}/etc/$PRODUCT/$PRODUCT.conf
 fi
 
@@ -441,7 +387,7 @@ chmod 644 ${DESTDIR}/usr/share/$PRODUCT/version
 
 if [ -z "$DESTDIR" ]; then
     rm -f /usr/share/$PRODUCT/init
-    ln -s ${INITDIR}/${INITFILE} /usr/share/$PRODUCT/init
+    ln -s ${DEST}/${INIT} /usr/share/$PRODUCT/init
 fi
 
 delete_file ${DESTDIR}/usr/share/$PRODUCT/lib.common
@@ -452,7 +398,7 @@ if [ -z "$DESTDIR" ]; then
     touch /var/log/$PRODUCT-init.log
 
     if [ -n "$first_install" ]; then
-	if [ $HOST = debian ]; then
+	if [ -n "$DEBIAN" ]; then
 	    run_install $OWNERSHIP -m 0644 default.debian /etc/default/$PRODUCT
 
 	    update-rc.d $PRODUCT defaults
@@ -488,7 +434,7 @@ if [ -z "$DESTDIR" ]; then
 		else
 		    cant_autostart
 		fi
-	    elif [ "$INITFILE" != rc.firewall ]; then #Slackware starts this automatically
+	    elif [ "$INIT" != rc.firewall ]; then #Slackware starts this automatically
 		cant_autostart
 	    fi
 	fi

Shorewall/Makefile

@@ -2,7 +2,6 @@
 VARDIR=$(shell /sbin/shorewall show vardir)
 CONFDIR=/etc/shorewall
 RESTOREFILE?=firewall
-
 all: $(VARDIR)/${RESTOREFILE}
 
 $(VARDIR)/${RESTOREFILE}: $(CONFDIR)/*
@@ -12,12 +11,11 @@ $(VARDIR)/${RESTOREFILE}: $(CONFDIR)/*
 	then \
 	    /sbin/shorewall -q save >/dev/null; \
 	else \
-	    /sbin/shorewall -q restart 2>&1 | tail >&2; exit 1; \
+	    /sbin/shorewall -q restart 2>&1 | tail >&2; \
 	fi
 
 clean:
 	@rm -f $(CONFDIR)/*~ $(CONFDIR)/.*~
-
 .PHONY: clean
 
 # EOF

Shorewall/Perl/Shorewall/Accounting.pm

@@ -322,7 +322,7 @@ sub process_accounting_rule( ) {
 	}
     }
 
-    set_optflags( $chainref, DONT_OPTIMIZE ) if $target eq 'RETURN';
+    dont_optimize( $chainref ) if $target eq 'RETURN';
 
     if ( $jumpchainref ) {
 	if ( $asection ) {
@@ -407,7 +407,7 @@ sub setup_accounting() {
 		}
 
 		if ( $tableref->{accounting} ) {
-		    set_optflags( 'accounting' , DONT_OPTIMIZE );
+		    dont_optimize( 'accounting' );
 		    for my $chain ( qw/INPUT FORWARD/ ) {
 			insert_ijump( $tableref->{$chain}, j => 'accounting', 0 );
 		    }
@@ -429,7 +429,7 @@ sub setup_accounting() {
 		    insert_ijump( $tableref->{POSTROUTING}, j => 'accountpost', 0 );
 		}
 	    } elsif ( $tableref->{accounting} ) {
-		set_optflags( 'accounting' , DONT_OPTIMIZE );
+		dont_optimize( 'accounting' );
 		for my $chain ( qw/INPUT FORWARD OUTPUT/ ) {
 		    insert_ijump( $tableref->{$chain}, j => 'accounting', 0 );
 		}

Shorewall/Perl/Shorewall/Chains.pm

@@ -36,10 +36,6 @@ use strict;
 
 our @ISA = qw(Exporter);
 our @EXPORT = qw(
-		    DONT_OPTIMIZE
-		    DONT_DELETE
-		    DONT_MOVE
-
 		    add_rule
 		    add_irule
 		    add_jump
@@ -66,11 +62,6 @@ our @EXPORT = qw(
 		    require_audit
 		    newlogchain
 		    log_rule_limit
-		    allow_optimize
-		    allow_delete
-		    allow_move
-		    set_optflags
-		    reset_optflags
 		    dont_optimize
 		    dont_delete
 		    dont_move
@@ -191,7 +182,6 @@ our %EXPORT_TAGS = (
 				       do_time
 				       do_user
 				       do_length
-				       decode_tos
 				       do_tos
 				       do_connbytes
 				       do_helper
@@ -199,7 +189,6 @@ our %EXPORT_TAGS = (
 				       do_headers
 				       do_probability
 				       do_condition
-				       do_dscp
 				       have_ipset_rules
 				       record_runtime_address
 				       conditional_rule
@@ -239,7 +228,6 @@ our %EXPORT_TAGS = (
 				       create_chainlist_reload
 				       create_stop_load
 				       %targets
-				       %dscpmap
 				     ) ],
 		   );
 
@@ -258,7 +246,9 @@ our $VERSION = 'MODULEVERSION';
 #                                               builtin      => undef|1 -- If 1, one of Netfilter's built-in chains.
 #                                               manual       => undef|1 -- If 1, a manual chain.
 #                                               accounting   => undef|1 -- If 1, an accounting chain
-#                                               optflags     => <optimization flags>
+#                                               dont_optimize=> undef|1 -- Don't optimize away if this chain is 'short'
+#                                               dont_delete  => undef|1 -- Don't delete if this chain is not referenced
+#                                               dont_move    => undef|1 -- Don't copy the rules of this chain somewhere else
 #                                               log          => <logging rule number for use when LOGRULENUMBERS>
 #                                               policy       => <policy>
 #                                               policychain  => <name of policy chain> -- self-reference if this is a policy chain
@@ -370,37 +360,6 @@ use constant {
 
 use constant { OPTIMIZE_MASK => OPTIMIZE_POLICY_MASK | OPTIMIZE_RULESET_MASK };
 
-use constant { DONT_OPTIMIZE => 1 , DONT_DELETE => 2, DONT_MOVE => 4 };
-
-our %dscpmap = ( CS0  => 0x00,
-		 CS1  => 0x08,
-		 CS2  => 0x10,
-		 CS3  => 0x18,
-		 CS4  => 0x20,
-		 CS5  => 0x28,
-		 CS6  => 0x30,
-		 CS7  => 0x38,
-		 BE   => 0x00,
-		 AF11 => 0x0a,
-		 AF12 => 0x0c,
-		 AF13 => 0x0e,
-		 AF21 => 0x12,
-		 AF22 => 0x14,
-		 AF23 => 0x16,
-		 AF31 => 0x1a,
-		 AF32 => 0x1c,
-		 AF33 => 0x1e,
-		 AF41 => 0x22,
-		 AF42 => 0x24,
-		 AF43 => 0x26,
-		 EF   => 0x2e,
-	       );
-
-our %tosmap = ( 'Minimize-Delay'       => 0x10,
-		'Maximize-Throughput'  => 0x08,
-		'Maximize-Reliability' => 0x04,
-		'Minimize-Cost'        => 0x02,
-		'Normal-Service'       => 0x00 );
 #
 # These hashes hold the shell code to set shell variables. The key is the name of the variable; the value is the code to generate the variable's contents
 #
@@ -724,7 +683,8 @@ sub set_rule_option( $$$ ) {
 	assert( defined( my $value1 = $ruleref->{$option} ) );
 
 	if ( $opttype == MATCH ) {
-	    if ( $globals{KLUDGEFREE} ) {
+	    assert( $globals{KLUDGEFREE} );
+
 	    unless ( reftype $value1 ) {
 		unless ( reftype $value ) {
 		    return if $value1 eq $value;
@@ -734,9 +694,6 @@ sub set_rule_option( $$$ ) {
 	    }
 
 	    push @{$ruleref->{$option}}, ( reftype $value ? @$value : $value );
-	    } else {
-		$ruleref->{$option} = join(' ', $value1, $value );
-	    }
 	} elsif ( $opttype == EXCLUSIVE ) {
 	    $ruleref->{$option} .= ",$value";
 	} elsif ( $opttype == UNIQUE ) {
@@ -1194,7 +1151,7 @@ sub push_matches {
 	}
     }
 
-    DONT_OPTIMIZE if $dont_optimize;
+    $dont_optimize;
 }
 
 sub push_irule( $$$;@ ) {
@@ -1223,7 +1180,7 @@ sub push_irule( $$$;@ ) {
     $chainref->{referenced} = 1;
 
     unless ( $ruleref->{simple} = ! @matches ) {
-	$chainref->{optflags} |= push_matches( $ruleref, @matches );
+	$chainref->{dont_optimize} = 1 if push_matches( $ruleref, @matches );
     }
 
     push @{$chainref->{rules}}, $ruleref;
@@ -1337,7 +1294,7 @@ sub insert_irule( $$$$;@ ) {
     }
 
     unless ( $ruleref->{simple} = ! @matches ) {
-	$chainref->{optflags} |= push_matches( $ruleref, @matches );
+	$chainref->{dont_optimize} = 1 if push_matches( $ruleref, @matches );
     }
 
     if ( $comment ) {
@@ -1910,8 +1867,7 @@ sub new_chain($$)
 		     log            => 1,
 		     cmdlevel       => 0,
 		     references     => {},
-		     filtered       => 0,
+		     filtered       => 0
-		     optflags       => 0,
 		   };
 
     trace( $chainref, 'N', undef, '' ) if $debug;
@@ -1972,7 +1928,7 @@ sub add_jump( $$$;$$$ ) {
 
     my $param = $goto_ok && $toref && have_capability( 'GOTO_TARGET' ) ? 'g' : 'j';
 
-    $fromref->{optflags} |= DONT_OPTIMIZE if $predicate =~ /! -[piosd] /;
+    $fromref->{dont_optimize} = 1 if $predicate =~ /! -[piosd] /;
 
     if ( defined $index ) {
 	assert( ! $expandports );
@@ -2096,70 +2052,49 @@ sub delete_jumps ( $$ ) {
     }
 }
 
-sub reset_optflags( $$ ) {
-    my ( $chain, $flags ) = @_;
-
-    my $chainref = reftype $chain ? $chain : $filter_table->{$chain};
-
-    $chainref->{optflags} ^= $flags;
-
-    trace( $chainref, '!O', undef, '' ) if $debug;
-
-    $chainref;
-}
-
-sub set_optflags( $$ ) {
-    my ( $chain, $flags ) = @_;
-
-    my $chainref = reftype $chain ? $chain : $filter_table->{$chain};
-
-    $chainref->{optflags} |= $flags;
-
-    trace( $chainref, '!O', undef, '' ) if $debug;
-
-    $chainref;
-}
-
-#
-# Reset the dont_optimize flag for a chain
-#
-sub allow_optimize( $ ) {
-    reset_optflags( shift, DONT_OPTIMIZE );
-}
-
-#
-# Reset the dont_delete flags for a chain
-#
-sub allow_delete( $ ) {
-    reset_optflags( shift, DONT_DELETE );
-}
-
-#
-# Reset the dont_move flag for a chain
-#
-sub allow_move( $ ) {
-    reset_optflags( shift, DONT_MOVE );
-}
-
 #
 # Set the dont_optimize flag for a chain
 #
 sub dont_optimize( $ ) {
-    set_optflags( shift, DONT_OPTIMIZE );
+    my $chain = shift;
+
+    my $chainref = reftype $chain ? $chain : $filter_table->{$chain};
+
+    $chainref->{dont_optimize} = 1;
+
+    trace( $chainref, '!O', undef, '' ) if $debug;
+
+    $chainref;
 }
 
 #
 # Set the dont_optimize and dont_delete flags for a chain
 #
 sub dont_delete( $ ) {
-    set_optflags( shift, DONT_OPTIMIZE | DONT_DELETE );
+    my $chain = shift;
+
+    my $chainref = reftype $chain ? $chain : $filter_table->{$chain};
+
+    $chainref->{dont_optimize} = $chainref->{dont_delete} = 1;
+
+    trace( $chainref, '!OD', undef, '' ) if $debug;
+
+    $chainref;
 }
 
 #
 # Set the dont_move flag for a chain
 #
 sub dont_move( $ ) {
-    set_optflags( shift, DONT_MOVE );
+    my $chain = shift;
+
+    my $chainref = reftype $chain ? $chain : $filter_table->{$chain};
+
+    $chainref->{dont_move} = 1;
+
+    trace( $chainref, '!M', undef, '' ) if $debug;
+
+    $chainref;
 }
 
 #
@@ -2201,7 +2136,7 @@ sub ensure_accounting_chain( $$$ )
 	$chainref->{restriction} = $restriction;
 	$chainref->{restricted}  = NO_RESTRICT;
 	$chainref->{ipsec}       = $ipsec;
-	$chainref->{optflags}   |= DONT_OPTIMIZE unless $config{OPTIMIZE_ACCOUNTING};
+	$chainref->{dont_optimize} = 1 unless $config{OPTIMIZE_ACCOUNTING};
 
 	unless ( $chain eq 'accounting' ) {
 	    my $file = find_file $chain;
@@ -2273,7 +2208,7 @@ sub new_builtin_chain($$$)
     $chainref->{referenced}  = 1;
     $chainref->{policy}      = $policy;
     $chainref->{builtin}     = 1;
-    $chainref->{optflags}    = DONT_DELETE;
+    $chainref->{dont_delete} = 1;
     $chainref;
 }
 
@@ -2701,7 +2636,7 @@ sub conditionally_copy_rules( $$ ) {
 
     my $targetref = $chain_table{$chainref->{table}}{$basictarget};
 
-    if ( $targetref && ! ( $targetref->{optflags} & DONT_MOVE ) ) {
+    if ( $targetref && ! $targetref->{dont_move} ) {
 	#
 	# Move is safe -- start with an empty rule list
 	#
@@ -2743,7 +2678,7 @@ sub optimize_level0() {
 	    #
 	    # If the chain isn't branched to, then delete it
 	    #
-	    unless ( $chainref->{optflags} & DONT_DELETE || keys %{$chainref->{references}} ) {
+	    unless ( $chainref->{dont_delete} || keys %{$chainref->{references}} ) {
 		delete_chain $chainref if $chainref->{referenced};
 	    }
 	}
@@ -2761,7 +2696,7 @@ sub optimize_level4( $$ ) {
     # When a chain with a single entry is found, replace it's references by its contents
     #
     # The search continues until no short chains remain
-    # Chains with 'DONT_OPTIMIZE' are exempted from optimization
+    # Chains with 'dont_optimize = 1' are exempted from optimization
     #
     while ( $progress ) {
 	$progress = 0;
@@ -2773,16 +2708,15 @@ sub optimize_level4( $$ ) {
 	progress_message "\n Table $table pass $passes, $chains referenced chains, level 4a...";
 
 	for my $chainref ( @chains ) {
-	    my $optflags = $chainref->{optflags};
 	    #
 	    # If the chain isn't branched to, then delete it
 	    #
-	    unless ( ( $optflags & DONT_DELETE ) || keys %{$chainref->{references}} ) {
+	    unless ( $chainref->{dont_delete} || keys %{$chainref->{references}} ) {
 		delete_chain $chainref if $chainref->{referenced};
 		next;
 	    }
 
-	    unless ( $optflags & DONT_OPTIMIZE ) {
+	    unless ( $chainref->{dont_optimize} ) {
 		my $numrules = @{$chainref->{rules}};
 
 		if ( $numrules == 0 ) {
@@ -2793,7 +2727,7 @@ sub optimize_level4( $$ ) {
 			#
 			# Built-in -- mark it 'dont_optimize' so we ignore it in follow-on passes
 			#
-			$chainref->{optflags} |= DONT_OPTIMIZE;
+			$chainref->{dont_optimize} = 1;
 		    } else {
 			#
 			# Not a built-in -- we can delete it and it's references
@@ -2824,7 +2758,7 @@ sub optimize_level4( $$ ) {
 				#
 				# Target was a built-in. Ignore this chain in follow-on passes
 				#
-				$chainref->{optflags} |= DONT_OPTIMIZE;
+				$chainref->{dont_optimize} = 1;
 			    }
 			} else {
 			    #
@@ -2840,9 +2774,9 @@ sub optimize_level4( $$ ) {
 			if ( $chainref->{builtin} || ! $globals{KLUDGEFREE} ) {
 			    #
 			    # This case requires a new rule merging algorithm. Ignore this chain for
-			    # now on.
+			    # now.
 			    #
-			    $chainref->{optflags} |= DONT_OPTIMIZE;
+			    $chainref->{dont_optimize} = 1;
 			} else {
 			    #
 			    # Replace references to this chain with the target and add the matches
@@ -2932,7 +2866,7 @@ sub optimize_level8( $$$ ) {
 	#
 	for my $chainref1 ( @chains1 ) {
 	    next unless @{$chainref1->{rules}};
-	    next if $chainref1->{optflags} & DONT_DELETE;
+	    next if $chainref1->{dont_delete};
 	    if ( $chainref->{digest} eq $chainref1->{digest} ) {
 		progress_message "  Chain $chainref1->{name} combined with $chainref->{name}";
 		replace_references $chainref1, $chainref->{name}, undef;
@@ -4077,56 +4011,13 @@ sub do_user( $ ) {
     $rule;
 }
 
-
-
 #
 # Create a "-m tos" match for the passed TOS
 #
-# This helper is also used during tos file processing
-#
-sub decode_tos( $$ ) {
-    my ( $tos, $set ) = @_;
-
-    if ( $tos eq '-' ) {
-	fatal_error [ '',                                            # 0
-		      'A value must be supplied in the TOS column',  # 1
-		      'Invalid TOS() parameter (-)',                 # 2
-		    ]->[$set] if $set;
-	return '';
-    }
-
-    my $mask = 0xff;
-    my $value;
-
-    if ( $tos =~ m"^(.+)/(.+)$" ) {
-	$value = numeric_value $1;
-	$mask  = numeric_value $2;
-    } elsif ( ! defined ( $value = numeric_value( $tos ) ) ) {
-	$value = $tosmap{$tos};
-	$mask  = '';
-    }
-
-    fatal_error( [ 'Invalid TOS column value',
-		   'Invalid TOS column value',
-		   'Invalid TOS() parameter', ]->[$set] . " ($tos)" )
-	unless ( defined $value &&
-		 $value <= 0xff &&
-		 ( $mask eq '' ||
-		   ( defined $mask &&
-		     $mask <= 0xff ) ) );
-
-    unless ( $mask eq '' ) {
-	warning_message "Unmatchable TOS ($tos)" unless $set || $value & $mask;
-    }
-
-    $tos = $mask ? in_hex( $value) . '/' . in_hex( $mask ) . ' ' : in_hex( $value ) . ' ';
-
-    $set ? " --set-tos $tos" : "-m tos --tos $tos ";
-
-}
-
 sub do_tos( $ ) {
-    decode_tos( $_[0], 0 );
+    my $tos = $_[0];
+
+    $tos ne '-' ? "-m tos --tos $tos " : '';
 }
 
 my %dir = ( O => 'original' ,
@@ -4207,33 +4098,8 @@ sub do_helper( $ ) {
 sub do_length( $ ) {
     my $length = $_[0];
 
-    return '' if $length eq '-';
-
     require_capability( 'LENGTH_MATCH' , 'A Non-empty LENGTH' , 's' );
-
+    $length ne '-' ? "-m length --length $length " : '';
-    my ( $max, $min );
-
-    if ( $length =~ /^\d+$/ ) {
-	fatal_error "Invalid LENGTH ($length)" unless $length < 65536;
-	$min = $max = $1;
-    } else {
-	if ( $length =~ /^:(\d+)$/ ) {
-	    $min = 0;
-	    $max = $1;
-	} elsif ( $length =~ /^(\d+):$/ ) {
-	    $min = $1;
-	    $max = 65535;
-	} elsif ( $length =~ /^(\d+):(\d+)$/ ) {
-	    $min = $1;
-	    $max = $2;
-	} else {
-	    fatal_error "Invalid LENGTH ($length)";
-	}
-
-	fatal_error "First length must be < second length" unless $min < $max;
-    }
-
-    "-m length --length $length ";
 }
 
 #
@@ -4320,26 +4186,6 @@ sub do_condition( $ ) {
     "-m condition ${invert}--condition $condition "
 }
 
-#
-# Generate a -m dscp match
-#
-sub do_dscp( $ ) {
-    my $dscp = shift;
-
-    return '' if $dscp eq '-';
-
-    require_capability 'DSCP_MATCH', 'A non-empty DSCP column', 's';
-
-    my $invert = $dscp =~ s/^!// ? '! ' : '';
-    my $value  = numeric_value( $dscp );
-
-    $value = $dscpmap{$value} unless defined $value;
-
-    fatal_error( "Invalid DSCP ($dscp)" ) unless defined $value && $value < 0x2f && ! ( $value & 1 );
-
-    "-m dscp ${invert}--dscp $value ";
-}
-
 #
 # Match Source Interface
 #
@@ -4467,13 +4313,6 @@ sub get_set_flags( $$ ) {
     } elsif ( $setname =~ /^(.*)\[((src|dst)(,(src|dst))*)\]$/ ) {
 	$setname = $1;
 	$options = $2;
-
-	my @options = split /,/, $options;
-	my %typemap = ( src => 'Source', dst => 'Destination' );
-
-	for ( @options ) {
-	    warning_message( "The '$_' ipset flag is used in a $typemap{$option} column" ), last unless $_ eq $option;
-	}
     }
 
     $setname =~ s/^\+//;
@@ -4485,6 +4324,7 @@ sub get_set_flags( $$ ) {
 
 	$ipset_exists{$setname} = 1; # Suppress subsequent checks/warnings
     }
+
     fatal_error "Invalid ipset name ($setname)" unless $setname =~ /^(6_)?[a-zA-Z]\w*/;
 
     have_capability 'OLD_IPSET_MATCH' ? "--set $setname $options " : "--match-set $setname $options ";
@@ -4497,21 +4337,11 @@ sub have_ipset_rules() {
 
 sub get_interface_address( $ );
 
-sub record_runtime_address( $$;$ ) {
+sub record_runtime_address( $ ) {
-    my ( $addrtype, $interface, $protect ) = @_;
+    my $interface = shift;
     fatal_error "Unknown interface address variable (&$interface)" unless known_interface( $interface );
     fatal_error "Invalid interface address variable (&$interface)" if $interface =~ /\+$/;
-
+    get_interface_address( $interface ) . ' ';
-    my $addr;
-
-    if ( $addrtype eq '&' ) {
-	$addr = get_interface_address( $interface );
-    } else {
-	$addr = get_interface_gateway( $interface, $protect );
-    }
-
-    $addr . ' ';
-   
 }
 
 #
@@ -4523,19 +4353,12 @@ sub record_runtime_address( $$;$ ) {
 sub conditional_rule( $$ ) {
     my ( $chainref, $address ) = @_;
 
-    if ( $address =~ /^!?([&%])(.+)$/ ) {
+    if ( $address =~ /^!?&(.+)$/ ) {
-	my ($type, $interface) = ($1, $2);
+	my $interface = $1;
 	if ( my $ref = known_interface $interface ) {
 	    if ( $ref->{options}{optional} ) {
-		my $variable;
+		my $variable = get_interface_address( $interface );
-		if ( $type eq '&' ) {
-		    $variable = get_interface_address( $interface );
 		add_commands( $chainref , "if [ $variable != " . NILIP . ' ]; then' );
-		} else {
-		    $variable = get_interface_gateway( $interface );
-		    add_commands( $chainref , qq(if [ -n "$variable" ]; then) );
-		}
-
 		incr_cmd_level $chainref;
 		return 1;
 	    }
@@ -4599,16 +4422,16 @@ sub match_source_net( $;$\$ ) {
     }
 
     if ( $net =~ s/^!// ) {
-	if ( $net =~ /^([&%])(.+)/ ) {
+	if ( $net =~ /^&(.+)/ ) {
-	    return '! -s ' . record_runtime_address $1, $2;
+	    return '! -s ' . record_runtime_address $1;
 	}
 
 	validate_net $net, 1;
 	return "! -s $net ";
     }
 
-    if ( $net =~ /^([&%])(.+)/ ) {
+    if ( $net =~ /^&(.+)/ ) {
-	return '-s ' . record_runtime_address $1, $2;
+	return '-s ' . record_runtime_address $1;
     }
 
     validate_net $net, 1;
@@ -4653,16 +4476,16 @@ sub imatch_source_net( $;$\$ ) {
     }
 
     if ( $net =~ s/^!// ) {
-	if ( $net =~ /^([&%])(.+)/ ) {
+	if ( $net =~ /^&(.+)/ ) {
-	    return  ( s => '! ' . record_runtime_address( $1, $2, 1 ) );
+	    return  ( s => '! ' . record_runtime_address $1 );
 	}
 
 	validate_net $net, 1;
 	return ( s => "! $net " );
     }
 
-    if ( $net =~ /^([&%])(.+)/ ) {
+    if ( $net =~ /^&(.+)/ ) {
-	return ( s =>  record_runtime_address( $1, $2, 1 ) );
+	return ( s =>  record_runtime_address $1 );
     }
 
     validate_net $net, 1;
@@ -4702,16 +4525,16 @@ sub match_dest_net( $ ) {
     }
 
     if ( $net =~ s/^!// ) {
-	if ( $net =~ /^([&%])(.+)/ ) {
+	if ( $net =~ /^&(.+)/ ) {
-	    return '! -d ' . record_runtime_address $1, $2;
+	    return '! -d ' . record_runtime_address $1;
 	}
 	
 	validate_net $net, 1;
 	return "! -d $net ";
     }
 
-    if ( $net =~ /^([&%])(.+)/ ) {
+    if ( $net =~ /^&(.+)/ ) {
-	return '-d ' . record_runtime_address $1, $2;
+	return '-d ' . record_runtime_address $1;
     }
 
     validate_net $net, 1;
@@ -4749,16 +4572,16 @@ sub imatch_dest_net( $ ) {
     }
 
     if ( $net =~ s/^!// ) {
-	if ( $net =~ /^([&%])(.+)/ ) {
+	if ( $net =~ /^&(.+)/ ) {
-	    return ( d => '! ' . record_runtime_address( $1, $2, 1 ) );
+	    return ( d => '! ' . record_runtime_address $1 );
 	}
 	
 	validate_net $net, 1;
 	return ( d => "! $net " );
     }
 
-    if ( $net =~ /^([&%])(.+)/ ) {
+    if ( $net =~ /^&(.+)/ ) {
-	return ( d => record_runtime_address( $1, $2, 1 ) );
+	return ( d => record_runtime_address $1 );
     }
 
     validate_net $net, 1;
@@ -4776,7 +4599,7 @@ sub match_orig_dest ( $ ) {
 
     if ( $net =~ s/^!// ) {
 	if ( $net =~ /^&(.+)/ ) {
-	    $net = record_runtime_address '&', $1;
+	    $net = record_runtime_address $1;
 	} else {
 	    validate_net $net, 1;
 	}
@@ -4784,7 +4607,7 @@ sub match_orig_dest ( $ ) {
 	have_capability( 'OLD_CONNTRACK_MATCH' ) ? "-m conntrack --ctorigdst ! $net " : "-m conntrack ! --ctorigdst $net ";
     } else {
 	if ( $net =~ /^&(.+)/ ) {
-	    $net = record_runtime_address '&', $1;
+	    $net = record_runtime_address $1;
 	} else {
 	    validate_net $net, 1;
 	}
@@ -5232,8 +5055,8 @@ sub interface_gateway( $ ) {
 #
 # Record that the ruleset requires the gateway address on the passed interface
 #
-sub get_interface_gateway ( $;$ ) {
+sub get_interface_gateway ( $ ) {
-    my ( $logical, $protect ) = @_;
+    my ( $logical ) = $_[0];
 
     my $interface = get_physical $logical;
     my $variable = interface_gateway( $interface );
@@ -5250,7 +5073,7 @@ sub get_interface_gateway ( $;$ ) {
 );
     }
 
-    $protect ? "\${$variable:-" . NILIP . '}' : "\$$variable";
+    "\$$variable";
 }
 
 #
@@ -5560,7 +5383,7 @@ sub expand_rule( $$$$$$$$$$;$ )
 	    } else {
 		$inets = $source;
 	    }
-	} elsif ( $source =~ /(?:\+|&|%|~|\..*\.)/ ) {
+	} elsif ( $source =~ /(?:\+|&|~|\..*\.)/ ) {
 	    $inets = $source;
 	} else {
 	    $iiface = $source;
@@ -5645,7 +5468,7 @@ sub expand_rule( $$$$$$$$$$;$ )
 	    if ( $dest =~ /^(.+?):(.+)$/ ) {
 		$diface = $1;
 		$dnets  = $2;
-	    } elsif ( $dest =~ /\+|&|%|~|\..*\./ ) {
+	    } elsif ( $dest =~ /\+|&|~|\..*\./ ) {
 		$dnets = $dest;
 	    } else {
 		$diface = $dest;

Shorewall/Perl/Shorewall/Config.pm

@@ -292,8 +292,6 @@ my  %capdesc = ( NAT_ENABLED     => 'NAT',
 		 STATISTIC_MATCH => 
 		                    'Statistics Match',
 		 IMQ_TARGET      => 'IMQ Target',
-		 DSCP_MATCH      => 'DSCP Match',
-		 DSCP_TARGET     => 'DSCP Target',
 		 CAPVERSION      => 'Capability Version',
 		 KERNELVERSION   => 'Kernel Version',
 	       );
@@ -391,8 +389,8 @@ my  $toolNAME;               # Tool name in CAPS
 our $product;                # Name of product that will run the generated script
 our $Product;                # $product with initial cap.
 
-our $sillyname;              # Name of temporary filter chains for testing capabilities
+my $sillyname;               # Name of temporary filter chains for testing capabilities
-our $sillyname1;
+my $sillyname1;
 my $iptables;                # Path to iptables/ip6tables
 my $tc;                      # Path to tc
 my $ip;                      # Path to ip
@@ -421,11 +419,6 @@ my %deprecated = ( LOGRATE            => '' ,
 		   HIGH_ROUTE_MARKS   => 'no'
 		 );
 #
-# Deprecated options that are eliminated via update
-#
-my %converted = ( WIDE_TC_MARKS => 1,
-		  HIGH_ROUTE_MARKS => 1 );
-#
 # Rather than initializing globals in an INIT block or during declaration,
 # we initialize them in a function. This is done for two reasons:
 #
@@ -699,8 +692,6 @@ sub initialize( $ ) {
 	       CT_TARGET => undef,
 	       STATISTIC_MATCH => undef,
 	       IMQ_TARGET => undef,
-	       DSCP_MATCH => undef,
-	       DSCP_TARGET => undef,
 	       CAPVERSION => undef,
 	       KERNELVERSION => undef,
 	       );
@@ -2787,15 +2778,7 @@ sub Statistic_Match() {
 }
 
 sub Imq_Target() {
-    have_capability 'MANGLE_ENABLED' && qt1( "$iptables -t mangle -A $sillyname -j IMQ --todev 0" );
+    qt1( "$iptables -t mangle -A $sillyname -j IMQ --todev 0" );
-}
-
-sub Dscp_Match() {
-    have_capability 'MANGLE_ENABLED' && qt1( "$iptables -t mangle -A $sillyname -m dscp --dscp 0" );
-}
-
-sub Dscp_Target() {
-    have_capability 'MANGLE_ENABLED' && qt1( "$iptables -t mangle -A $sillyname -j DSCP --set-dscp 0" );
 }
 
 our %detect_capability =
@@ -2811,8 +2794,6 @@ our %detect_capability =
       CONNMARK_MATCH => \&Connmark_Match,
       CONNTRACK_MATCH => \&Conntrack_Match,
       CT_TARGET => \&Ct_Target,
-      DSCP_MATCH => \&Dscp_Match,
-      DSCP_TARGET => \&Dscp_Target,
       ENHANCED_REJECT => \&Enhanced_Reject,
       EXMARK => \&Exmark,
       FLOW_FILTER => \&Flow_Filter,
@@ -2960,6 +2941,11 @@ sub determine_capabilities() {
 	$capabilities{IPMARK_TARGET}   = detect_capability( 'IPMARK_TARGET' );
 	$capabilities{TPROXY_TARGET}   = detect_capability( 'TPROXY_TARGET' );
 
+	if ( $capabilities{MANGLE_ENABLED} ) {
+	    qt1( "$iptables -t mangle -F $sillyname" );
+	    qt1( "$iptables -t mangle -X $sillyname" );
+	}
+
 	$capabilities{MANGLE_FORWARD}  = detect_capability( 'MANGLE_FORWARD' );
 	$capabilities{RAW_TABLE}       = detect_capability( 'RAW_TABLE' );
 	$capabilities{RAWPOST_TABLE}   = detect_capability( 'RAWPOST_TABLE' );
@@ -2989,8 +2975,6 @@ sub determine_capabilities() {
 	$capabilities{CT_TARGET}       = detect_capability( 'CT_TARGET' );
 	$capabilities{STATISTIC_MATCH} = detect_capability( 'STATISTIC_MATCH' );
 	$capabilities{IMQ_TARGET}      = detect_capability( 'IMQ_TARGET' );
-	$capabilities{DSCP_MATCH}      = detect_capability( 'DSCP_MATCH' );
-	$capabilities{DSCP_TARGET}     = detect_capability( 'DSCP_TARGET' );
 
 
 	qt1( "$iptables -F $sillyname" );
@@ -2998,16 +2982,6 @@ sub determine_capabilities() {
 	qt1( "$iptables -F $sillyname1" );
 	qt1( "$iptables -X $sillyname1" );
 
-	if ( $capabilities{MANGLE_ENABLED} ) {
-	    qt1( "$iptables -t mangle -F $sillyname" );
-	    qt1( "$iptables -t mangle -X $sillyname" );
-	}
-
-	if ( $capabilities{NAT_ENABLED} ) {
-	    qt1( "$iptables -t nat -F $sillyname" );
-	    qt1( "$iptables -t nat -X $sillyname" );
-	}
-
 	$sillyname = $sillyname1 = undef;
     }
 }
@@ -3171,7 +3145,7 @@ sub update_config_file( $ ) {
 
 	my $heading_printed;
 
-	for ( grep ! $converted{$_} , keys %deprecated ) {
+	for ( keys %deprecated ) {
 	    if ( supplied( my $val = $config{$_} ) ) {
 		if ( lc $val ne $deprecated{$_} ) {
 		    unless ( $heading_printed ) {
@@ -3207,7 +3181,7 @@ EOF
 		progress_message3 "No update required to configuration file $configfile; $configfile.bak not saved";
 	    } else {
 		warning_message "Unable to unlink $configfile.bak";
-		progress_message3 "No update required to configuration file $configfile";
+		progress_message3 "No update required to configuration file $configfile; $configfile.b";
 	    }
 
 	    exit 0 unless -f find_file 'blacklist';
@@ -3381,8 +3355,6 @@ sub unsupported_yes_no_warning( $ ) {
 sub get_params() {
     my $fn = find_file 'params';
 
-    my %reserved = ( COMMAND => 1, CONFDIR => 1, SHAREDIR => 1, VARDIR => 1 );
-
     if ( -f $fn ) {
 	progress_message2 "Processing $fn ...";
 
@@ -3486,13 +3458,6 @@ sub get_params() {
 	    }
 	}
 
-	for ( keys %params ) {
-	    unless ( $_ eq 'SHOREWALL_INIT_SCRIPT' ) {
-		fatal_error "The variable name $_ is reserved and may not be set in the params file"
-		    if /^SW_/ || /^SHOREWALL_/ || ( exists $config{$_} && ! exists $ENV{$_} ) || exists $reserved{$_};
-	    }
-	}
-
 	if ( $debug ) {
 	    print "PARAMS:\n";
 	    my $value;

Shorewall/Perl/Shorewall/IPAddrs.pm

@@ -76,7 +76,6 @@ our @EXPORT = qw( ALLIPv4
 		  proto_name
 		  validate_port
 		  validate_portpair
-		  validate_portpair1
 		  validate_port_list
 		  validate_icmp
 		  validate_icmp6
@@ -372,7 +371,6 @@ sub validate_port( $$ ) {
 
 sub validate_portpair( $$ ) {
     my ($proto, $portpair) = @_;
-    my $what;
 
     fatal_error "Invalid port range ($portpair)" if $portpair =~ tr/:/:/ > 1;
 
@@ -381,57 +379,16 @@ sub validate_portpair( $$ ) {
 
     my @ports = split /:/, $portpair, 2;
 
-    my $protonum = resolve_proto( $proto ) || 0;
+    $_ = validate_port( $proto, $_) for ( grep $_, @ports );
-
-    $_ = validate_port( $protonum, $_) for grep $_, @ports;
 
     if ( @ports == 2 ) {
-	$what = 'port range';
 	fatal_error "Invalid port range ($portpair)" unless $ports[0] < $ports[1];
-    } else {
-	$what = 'port';
     }
 
-    fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, SCTP or DCCP" unless 
-	defined $protonum && ( $protonum == TCP  ||
-			       $protonum == UDP  ||
-			       $protonum == SCTP ||
-			       $protonum == DCCP );
     join ':', @ports;
 
 }
 
-sub validate_portpair1( $$ ) {
-    my ($proto, $portpair) = @_;
-    my $what;
-
-    fatal_error "Invalid port range ($portpair)" if $portpair =~ tr/-/-/ > 1;
-
-    $portpair = "0$portpair"       if substr( $portpair,  0, 1 ) eq ':';
-    $portpair = "${portpair}65535" if substr( $portpair, -1, 1 ) eq ':';
-
-    my @ports = split /-/, $portpair, 2;
-
-    my $protonum = resolve_proto( $proto ) || 0;
-
-    $_ = validate_port( $protonum, $_) for grep $_, @ports;
-
-    if ( @ports == 2 ) {
-	$what = 'port range';
-	fatal_error "Invalid port range ($portpair)" unless $ports[0] < $ports[1];
-    } else {
-	$what = 'port';
-    }
-
-    fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, SCTP or DCCP" unless 
-	defined $protonum && ( $protonum == TCP  ||
-			       $protonum == UDP  ||
-			       $protonum == SCTP ||
-			       $protonum == DCCP );
-    join '-', @ports;
-
-}
-
 sub validate_port_list( $$ ) {
     my $result = '';
     my ( $proto, $list ) = @_;

Shorewall/Perl/Shorewall/Misc.pm

@@ -67,17 +67,18 @@ sub process_tos() {
     my $chain    = have_capability( 'MANGLE_FORWARD' ) ? 'fortos'  : 'pretos';
     my $stdchain = have_capability( 'MANGLE_FORWARD' ) ? 'FORWARD' : 'PREROUTING';
 
+    my %tosoptions = ( 'minimize-delay'       => 0x10 ,
+		       'maximize-throughput'  => 0x08 ,
+		       'maximize-reliability' => 0x04 ,
+		       'minimize-cost'        => 0x02 ,
+		       'normal-service'       => 0x00 );
+
     if ( my $fn = open_file 'tos' ) {
 	my $first_entry = 1;
 
 	my ( $pretosref, $outtosref );
 
-	first_entry( sub { progress_message2 "$doing $fn..."; 
+	first_entry( sub { progress_message2 "$doing $fn..."; $pretosref = ensure_chain 'mangle' , $chain; $outtosref = ensure_chain 'mangle' , 'outtos'; } );
-			   warning_message "Use of the tos file is deprecated in favor of the TOS target in tcrules";
-			   $pretosref = ensure_chain 'mangle' , $chain; 
-			   $outtosref = ensure_chain 'mangle' , 'outtos';
-		       }
-		   );
 
 	while ( read_a_line ) {
 
@@ -85,7 +86,14 @@ sub process_tos() {
 
 	    $first_entry = 0;
 
-	    $tos = decode_tos( $tos , 1 );
+	    fatal_error 'A value must be supplied in the TOS column' if $tos eq '-';
+
+	    if ( defined ( my $tosval = $tosoptions{"\L$tos"} ) ) {
+		$tos = $tosval;
+	    } else {
+		my $val = numeric_value( $tos );
+		fatal_error "Invalid TOS value ($tos)" unless defined( $val ) && $val < 0x1f;
+	    }
 
 	    my $chainref;
 
@@ -121,7 +129,7 @@ sub process_tos() {
 		$src ,
 		$dst ,
 		'' ,
-		'TOS' . $tos ,
+		"TOS --set-tos $tos" ,
 		'' ,
 		'TOS' ,
 		'';
@@ -208,8 +216,8 @@ sub setup_blacklist() {
     # for 'refresh' to work properly.
     #
     if ( @$zones || @$zones1 ) {
-	$chainref  = set_optflags( new_standard_chain( 'blacklst' ), DONT_OPTIMIZE | DONT_DELETE ) if @$zones;
+	$chainref  = dont_delete new_standard_chain 'blacklst' if @$zones;
-	$chainref1 = set_optflags( new_standard_chain( 'blackout' ), DONT_OPTIMIZE | DONT_DELETE ) if @$zones1;
+	$chainref1 = dont_delete new_standard_chain 'blackout' if @$zones1;
 
 	if ( supplied $level ) {
 	    $target = ensure_blacklog_chain ( $target, $disposition, $level, $audit );
@@ -687,9 +695,9 @@ sub add_common_rules ( $ ) {
     my $rejectref = $filter_table->{reject};
 
     if ( $config{DYNAMIC_BLACKLIST} ) {
-	add_rule_pair( set_optflags( new_standard_chain( 'logdrop' )  , DONT_OPTIMIZE | DONT_DELETE ), '' , 'DROP'   , $level );
+	add_rule_pair dont_delete( new_standard_chain( 'logdrop' ) ),   '' , 'DROP'   , $level ;
-	add_rule_pair( set_optflags( new_standard_chain( 'logreject' ), DONT_OPTIMIZE | DONT_DELETE ), '' , 'reject' , $level );
+	add_rule_pair dont_delete( new_standard_chain( 'logreject' ) ), '' , 'reject' , $level ;
-	$dynamicref =  set_optflags( new_standard_chain( 'dynamic' ) ,  DONT_OPTIMIZE );
+	$dynamicref = dont_optimize( new_standard_chain( 'dynamic' ) );
 	add_commands( $dynamicref, '[ -f ${VARDIR}/.dynamic ] && cat ${VARDIR}/.dynamic >&3' );
     }
 
@@ -919,13 +927,6 @@ sub add_common_rules ( $ ) {
 		       p =>  "udp --dport $ports" ,
 		       imatch_dest_dev( $interface ) )
 		if get_interface_option( $interface, 'bridge' );
-
-	    unless ( $family == F_IPV6 || get_interface_option( $interface, 'allip' ) ) {
-		add_ijump( $filter_table->{input_chain( $interface ) } , 
-			   j => 'ACCEPT' ,
-			   p => "udp --dport $ports" ,
-			   s => NILIPv4 . '/32' );
-	    }
 	}
     }
 
@@ -993,7 +994,7 @@ sub add_common_rules ( $ ) {
 	if ( @$list ) {
 	    progress_message2 "$doing UPnP";
 
-	    $chainref = set_optflags( new_nat_chain( 'UPnP' ), DONT_OPTIMIZE );
+	    $chainref = dont_optimize new_nat_chain( 'UPnP' );
 
 	    add_commands( $chainref, '[ -s /${VARDIR}/.UPnP ] && cat ${VARDIR}/.UPnP >&3' );
 
@@ -1012,10 +1013,9 @@ sub add_common_rules ( $ ) {
 	    for $interface ( @$list ) {
 		my $chainref = $filter_table->{input_option_chain $interface};
 		my $base     = uc chain_base get_physical $interface;
-		my $optional = interface_is_optional( $interface );
+		my $variable = get_interface_gateway $interface;
-		my $variable = get_interface_gateway( $interface, ! $optional );
 
-		if ( $optional ) {
+		if ( interface_is_optional $interface ) {
 		    add_commands( $chainref,
 				  qq(if [ -n "SW_\$${base}_IS_USABLE" -a -n "$variable" ]; then) );
 		    incr_cmd_level( $chainref );

Shorewall/Perl/Shorewall/Nat.pm

@@ -54,8 +54,8 @@ sub initialize() {
 #
 sub process_one_masq( )
 {
-    my ($interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition ) = 
+    my ($interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user ) = 
-	split_line1 'masq file', { interface => 0, source => 1, address => 2, proto => 3, port => 4, ipsec => 5, mark => 6, user => 7, switch => 8 };
+	split_line1 'masq file', { interface => 0, source => 1, address => 2, proto => 3, port => 4, ipsec => 5, mark => 6, user => 7 };
 
     if ( $interfacelist eq 'COMMENT' ) {
 	process_comment;
@@ -88,7 +88,7 @@ sub process_one_masq( )
 	$interfacelist = $1;
     } elsif ( $interfacelist =~ /^([^:]+):([^:]*)$/ ) {
 	my ( $one, $two ) = ( $1, $2 );
-	if ( $2 =~ /\./ || $2 =~ /^%/ ) {
+	if ( $2 =~ /\./ ) {
 	    $interfacelist = $one;
 	    $destnets = $two;
 	}
@@ -117,9 +117,9 @@ sub process_one_masq( )
     }
 
     #
-    # Handle Protocol, Ports and Condition
+    # Handle Protocol and Ports
     #
-    $baserule .= do_proto( $proto, $ports, '' ) . do_condition( $condition );
+    $baserule .= do_proto $proto, $ports, '';
     #
     # Handle Mark
     #
@@ -195,7 +195,7 @@ sub process_one_masq( )
 			    if ( $conditional = conditional_rule( $chainref, $addr ) ) {
 				$addrlist .= '--to-source ' . get_interface_address $1;
 			    } else {
-				$addrlist .= '--to-source ' . record_runtime_address( '&', $1 );
+				$addrlist .= '--to-source ' . record_runtime_address $1;
 			    }
 			} elsif ( $addr =~ /^.*\..*\..*\./ ) {
 			    $target = 'SNAT ';
@@ -210,7 +210,9 @@ sub process_one_masq( )
 			} else {
 			    my $ports = $addr; 
 			    $ports =~ s/^://;
-			    validate_portpair1( $proto, $ports );
+			    my $portrange = $ports;
+			    $portrange =~ s/-/:/;
+			    validate_portpair( $proto, $portrange );
 			    $addrlist .= "--to-ports $ports ";
 			    $exceptionrule = do_proto( $proto, '', '' );
 			}

Shorewall/Perl/Shorewall/Providers.pm

@@ -160,7 +160,9 @@ sub setup_route_marking() {
 
 	    my $chainref2 = new_chain( 'mangle', load_chain( $physical ) );
 
-	    set_optflags( $chainref2, DONT_OPTIMIZE | DONT_MOVE | DONT_DELETE );
+	    dont_optimize $chainref2;
+	    dont_move     $chainref2;
+	    dont_delete   $chainref2;
 	
   	    add_ijump ( $chainref1,
 			j => $chainref2 ,
@@ -916,7 +918,7 @@ sub add_an_rtrule( ) {
     if ( $source eq '-' ) {
 	$source = 'from ' . ALLIP;
     } elsif ( $source =~ s/^&// ) {
-	$source = 'from ' . record_runtime_address '&', $source;
+	$source = 'from ' . record_runtime_address $source;
     } elsif ( $family == F_IPV4 ) {
 	if ( $source =~ /:/ ) {
 	    ( my $interface, $source , my $remainder ) = split( /:/, $source, 3 );
@@ -1021,7 +1023,7 @@ sub add_a_route( ) {
 
 sub setup_null_routing() {
     save_progress_message "Null Routing the RFC 1918 subnets";
-    emit "> \${VARDIR}/undo_rfc1918_routing\n";
+    emit "> \${VARDIR}undo_rfc1918_routing\n";
     for ( rfc1918_networks ) {
 	emit( qq(if ! \$IP -4 route ls | grep -q '^$_.* dev '; then),
 	      qq(    run_ip route replace unreachable $_),

Shorewall/Perl/Shorewall/Rules.pm

@@ -963,7 +963,7 @@ sub createlogactionchain( $$$$$ ) {
 
     unless ( $targets{$action} & BUILTIN ) {
 
-	set_optflags( $chainref, DONT_OPTIMIZE );
+	dont_optimize $chainref;
 
 	my $file = find_file $chain;
 
@@ -997,7 +997,7 @@ sub createsimpleactionchain( $ ) {
 
     unless ( $targets{$action} & BUILTIN ) {
 
-	set_optflags( $chainref, DONT_OPTIMIZE );
+	dont_optimize $chainref;
 
 	my $file = find_file $action;
 
@@ -1306,7 +1306,7 @@ sub allowInvalid ( $$$$ ) {
 }
 
 sub forwardUPnP ( $$$$ ) {
-    my $chainref = set_optflags( 'forwardUPnP', DONT_OPTIMIZE );
+    my $chainref = dont_optimize 'forwardUPnP';
 
     add_commands( $chainref , '[ -f ${VARDIR}/.forwardUPnP ] && cat ${VARDIR}/.forwardUPnP >&3' );
 }
@@ -2238,7 +2238,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
 	    }
 	}
 
-	set_optflags( $nonat_chain, DONT_MOVE | DONT_OPTIMIZE ) if $tgt eq 'RETURN';
+	dont_move( dont_optimize( $nonat_chain ) ) if $tgt eq 'RETURN';
 
 	expand_rule( $nonat_chain ,
 		     PREROUTE_RESTRICT ,
@@ -2262,7 +2262,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
 	    $action = $usedactions{$normalized_target}{name};
 	    $loglevel = '';
 	} else {
-	    set_optflags( $chainref , DONT_MOVE | DONT_OPTIMIZE ) if $action eq 'RETURN';
+	    dont_move( dont_optimize ( $chainref ) ) if $action eq 'RETURN';
 	}
 
 	if ( $origdest ) {

Shorewall/Perl/Shorewall/Tc.pm

@@ -194,14 +194,14 @@ sub initialize( $ ) {
 }
 
 sub process_tc_rule( ) {
-    my ( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $headers, $probability , $dscp );
+    my ( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $headers, $probability );
     if ( $family == F_IPV4 ) {
-	( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $probability, $dscp ) =
+	( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $probability ) =
-	    split_line1 'tcrules file', { mark => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, probability => 12 , dscp => 13 };
+	    split_line1 'tcrules file', { mark => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, probability => 12 };
 	$headers = '-';
     } else {
-	( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $headers, $probability, $dscp ) = 
+	( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $headers, $probability ) = 
-	    split_line1 'tcrules file', { mark => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, headers => 12, probability => 13 , dscp => 14 };
+	    split_line1 'tcrules file', { mark => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, headers => 12, probability => 13 };
     }
 
     our @tccmd;
@@ -239,157 +239,6 @@ sub process_tc_rule( ) {
     my $device   = '';
     my $fw       = firewall_zone;
     my $list;
-    my $restriction = 0;
-    my $cmd;
-    my $rest;
-
-    my %processtcc = ( sticky => sub() {
-			                  if ( $chain eq 'tcout' ) {
-					      $target = 'sticko';
-					  } else {
-					      fatal_error "SAME rules are only allowed in the PREROUTING and OUTPUT chains" if $chain ne 'tcpre';
-					  }
-
-					  $restriction = DESTIFACE_DISALLOW;
-
-					  ensure_mangle_chain($target);
-
-					  $sticky++;
-				      },
-		       IPMARK => sub() {
-			                  my ( $srcdst, $mask1, $mask2, $shift ) = ('src', 255, 0, 0 );
-
-					  require_capability 'IPMARK_TARGET', 'IPMARK', 's';
-
-					  if ( $cmd =~ /^IPMARK\((.+?)\)$/ ) {
-					      my $params = $1;
-					      my $val;
-
-					      my ( $sd, $m1, $m2, $s , $bad ) = split ',', $params;
-
-					      fatal_error "Invalid IPMARK parameters ($params)" if $bad;
-					      fatal_error "Invalid IPMARK parameter ($sd)" unless ( $sd eq 'src' || $sd eq 'dst' );
-					      $srcdst = $sd;
-
-					      if ( supplied $m1 ) {
-						  $val = numeric_value ($m1);
-						  fatal_error "Invalid Mask ($m1)" unless defined $val && $val && $val <= 0xffffffff;
-						  $mask1 = in_hex ( $val & 0xffffffff );
-					      }
-
-					      if ( supplied $m2 ) {
-						  $val = numeric_value ($m2);
-						  fatal_error "Invalid Mask ($m2)" unless defined $val && $val <= 0xffffffff;
-						  $mask2 = in_hex ( $val & 0xffffffff );
-					      }
-
-					      if ( defined $s ) {
-						  $val = numeric_value ($s);
-						  fatal_error "Invalid Shift Bits ($s)" unless defined $val && $val >= 0 && $val < 128;
-						  $shift = $s;
-					      }			    
-					  } else {
-					      fatal_error "Invalid MARK/CLASSIFY ($cmd)" unless $cmd eq 'IPMARK';
-					  }
-
-					  $target = "IPMARK --addr $srcdst --and-mask $mask1 --or-mask $mask2 --shift $shift";
-				      },
-		       TPROXY => sub() {
-			                  require_capability( 'TPROXY_TARGET', 'Use of TPROXY', 's');
-
-			                  fatal_error "Invalid TPROXY specification( $cmd/$rest )" if $rest;
-
-					  $chain = 'tcpre';
-
-					  $cmd =~ /TPROXY\((.+?)\)$/;
-
-					  my $params = $1;
-
-					  fatal_error "Invalid TPROXY specification( $cmd )" unless defined $params;
-
-					  ( $mark, my $port, my $ip, my $bad ) = split ',', $params;
-
-					  fatal_error "Invalid TPROXY specification( $cmd )" if defined $bad;
-
-					  if ( $port ) {
-					      $port = validate_port( 'tcp', $port );
-					  } else {
-					      $port = 0;
-					  }
-
-					  $target .= " --on-port $port";
-
-					  if ( supplied $ip ) {
-					      if ( $family == F_IPV6 ) {
-						  $ip = $1 if $ip =~ /^\[(.+)\]$/ || $ip =~ /^<(.+)>$/;
-					      }
-
-					      validate_address $ip, 1;
-					      $target .= " --on-ip $ip";
-					  }
-
-					  $target .= ' --tproxy-mark';
-				      },
-		       TTL => sub() {
-			                  fatal_error "TTL is not supported in IPv6 - use HL instead" if $family == F_IPV6;
-					  fatal_error "Invalid TTL specification( $cmd/$rest )" if $rest;
-					  fatal_error "Chain designator $designator not allowed with TTL" if $designator && ! ( $designator eq 'F' );
-
-					  $chain = 'tcfor';
-
-					  $cmd =~ /^TTL\(([-+]?\d+)\)$/;
-
-					  my $param =  $1;
-
-					  fatal_error "Invalid TTL specification( $cmd )" unless $param && ( $param = abs $param ) < 256;
-
-					  if ( $1 =~ /^\+/ ) {
-					      $target .= " --ttl-inc $param";
-					  } elsif ( $1 =~ /\-/ ) {
-					      $target .= " --ttl-dec $param";
-					  } else {
-					      $target .= " --ttl-set $param";
-					  }
-				      },
-		       HL => sub() {
-			                  fatal_error "HL is not supported in IPv4 - use TTL instead" if $family == F_IPV4;
-					  fatal_error "Invalid HL specification( $cmd/$rest )" if $rest;
-					  fatal_error "Chain designator $designator not allowed with HL" if $designator && ! ( $designator eq 'F' );
-
-					  $chain = 'tcfor';
-
-					  $cmd =~ /^HL\(([-+]?\d+)\)$/;
-
-					  my $param =  $1;
-
-					  fatal_error "Invalid HL specification( $cmd )" unless $param && ( $param = abs $param ) < 256;
-
-					  if ( $1 =~ /^\+/ ) {
-					      $target .= " --hl-inc $param";
-					  } elsif ( $1 =~ /\-/ ) {
-					      $target .= " --hl-dec $param";
-					  } else {
-					      $target .= " --hl-set $param";
-					  }
-				      },
-		       IMQ => sub() {
-			                  assert( $cmd =~ /^IMQ\((\d+)\)$/ );
-					  require_capability 'IMQ_TARGET', 'IMQ', 's';
-					  $target .= " --todev $1";
-				      },
-		       DSCP => sub() {
-			                  assert( $cmd =~ /^DSCP\((\w+)\)$/ );
-					  require_capability 'DSCP_TARGET', 'The DSCP action', 's'; 
-					  my $dscp = numeric_value( $1 );
-					  $dscp = $dscpmap{$1} unless defined $dscp;
-					  fatal_error( "Invalid DSCP ($1)" ) unless defined $dscp && $dscp <= 0x38 && ! ( $dscp & 1 );
-					  $target .= ' --set-dscp ' . in_hex( $dscp );
-				      },
-		       TOS => sub() {
-			                  assert( $cmd =~ /^TOS\((.+)\)$/ );
-					  $target .= decode_tos( $1 , 2 );
-				      },
-		     );
 
     if ( $source ) {
 	if ( $source eq $fw ) {
@@ -463,15 +312,12 @@ sub process_tc_rule( ) {
 	}
     }
 
-    if ( $mark =~ /^TOS/ ) {
+    my ($cmd, $rest) = split( '/', $mark, 2 );
-	$cmd = $mark;
-	$rest = '';
-    } else {
-	($cmd, $rest) = split( '/', $mark, 2 );
-    }
 
     $list = '';
 
+    my $restriction = 0;
+
     unless ( $classid ) {
       MARK:
 	{
@@ -490,8 +336,134 @@ sub process_tc_rule( ) {
 			$mark =~ s/^[|&]//;
 		    }
 
-		    if ( my $f = $processtcc{$target} ) {
+		    if ( $target eq 'sticky' ) {
-			$f->();
+			if ( $chain eq 'tcout' ) {
+			    $target = 'sticko';
+			} else {
+			    fatal_error "SAME rules are only allowed in the PREROUTING and OUTPUT chains" if $chain ne 'tcpre';
+			}
+
+			$restriction = DESTIFACE_DISALLOW;
+
+			ensure_mangle_chain($target);
+
+			$sticky++;
+		    } elsif ( $target eq 'IPMARK' ) {
+			my ( $srcdst, $mask1, $mask2, $shift ) = ('src', 255, 0, 0 );
+
+			require_capability 'IPMARK_TARGET', 'IPMARK', 's';
+
+			if ( $cmd =~ /^IPMARK\((.+?)\)$/ ) {
+			    my $params = $1;
+			    my $val;
+
+			    my ( $sd, $m1, $m2, $s , $bad ) = split ',', $params;
+
+			    fatal_error "Invalid IPMARK parameters ($params)" if $bad;
+			    fatal_error "Invalid IPMARK parameter ($sd)" unless ( $sd eq 'src' || $sd eq 'dst' );
+			    $srcdst = $sd;
+
+			    if ( supplied $m1 ) {
+				$val = numeric_value ($m1);
+				fatal_error "Invalid Mask ($m1)" unless defined $val && $val && $val <= 0xffffffff;
+				$mask1 = in_hex ( $val & 0xffffffff );
+			    }
+
+			    if ( supplied $m2 ) {
+				$val = numeric_value ($m2);
+				fatal_error "Invalid Mask ($m2)" unless defined $val && $val <= 0xffffffff;
+				$mask2 = in_hex ( $val & 0xffffffff );
+			    }
+
+			    if ( defined $s ) {
+				$val = numeric_value ($s);
+				fatal_error "Invalid Shift Bits ($s)" unless defined $val && $val >= 0 && $val < 128;
+				$shift = $s;
+			    }			    
+			} else {
+			    fatal_error "Invalid MARK/CLASSIFY ($cmd)" unless $cmd eq 'IPMARK';
+			}
+
+			$target = "IPMARK --addr $srcdst --and-mask $mask1 --or-mask $mask2 --shift $shift";
+		    } elsif ( $target eq 'TPROXY' ) {
+			require_capability( 'TPROXY_TARGET', 'Use of TPROXY', 's');
+
+			fatal_error "Invalid TPROXY specification( $cmd/$rest )" if $rest;
+
+			$chain = 'tcpre';
+
+			$cmd =~ /TPROXY\((.+?)\)$/;
+
+			my $params = $1;
+
+			fatal_error "Invalid TPROXY specification( $cmd )" unless defined $params;
+
+			( $mark, my $port, my $ip, my $bad ) = split ',', $params;
+
+			fatal_error "Invalid TPROXY specification( $cmd )" if defined $bad;
+
+			if ( $port ) {
+			    $port = validate_port( 'tcp', $port );
+			} else {
+			    $port = 0;
+			}
+
+			$target .= " --on-port $port";
+
+			if ( supplied $ip ) {
+			    if ( $family == F_IPV6 ) {
+				$ip = $1 if $ip =~ /^\[(.+)\]$/ || $ip =~ /^<(.+)>$/;
+			    }
+
+			    validate_address $ip, 1;
+			    $target .= " --on-ip $ip";
+			}
+
+			$target .= ' --tproxy-mark';
+		    } elsif ( $target eq 'TTL' ) {
+			fatal_error "TTL is not supported in IPv6 - use HL instead" if $family == F_IPV6;
+			fatal_error "Invalid TTL specification( $cmd/$rest )" if $rest;
+			fatal_error "Chain designator $designator not allowed with TTL" if $designator && ! ( $designator eq 'F' );
+
+			$chain = 'tcfor';
+
+			$cmd =~ /^TTL\(([-+]?\d+)\)$/;
+
+			my $param =  $1;
+
+			fatal_error "Invalid TTL specification( $cmd )" unless $param && ( $param = abs $param ) < 256;
+
+			if ( $1 =~ /^\+/ ) {
+			    $target .= " --ttl-inc $param";
+			} elsif ( $1 =~ /\-/ ) {
+			    $target .= " --ttl-dec $param";
+			} else {
+			    $target .= " --ttl-set $param";
+			}
+		    } elsif ( $target eq 'HL' ) {
+			fatal_error "HL is not supported in IPv4 - use TTL instead" if $family == F_IPV4;
+			fatal_error "Invalid HL specification( $cmd/$rest )" if $rest;
+			fatal_error "Chain designator $designator not allowed with HL" if $designator && ! ( $designator eq 'F' );
+
+			$chain = 'tcfor';
+
+			$cmd =~ /^HL\(([-+]?\d+)\)$/;
+
+			my $param =  $1;
+
+			fatal_error "Invalid HL specification( $cmd )" unless $param && ( $param = abs $param ) < 256;
+
+			if ( $1 =~ /^\+/ ) {
+			    $target .= " --hl-inc $param";
+			} elsif ( $1 =~ /\-/ ) {
+			    $target .= " --hl-dec $param";
+			} else {
+			    $target .= " --hl-set $param";
+			}
+		    } elsif ( $target eq 'IMQ' ) {
+			assert( $cmd =~ /^IMQ\((\d+)\)$/ );
+			require_capability 'IMQ_TARGET', 'IMQ', 's';
+			$target .= " --todev $1";
 		    }
 
 		    if ( $rest ) {
@@ -538,8 +510,7 @@ sub process_tc_rule( ) {
 				     do_connbytes( $connbytes ) .
 				     do_helper( $helper ) .
 				     do_headers( $headers ) .
-				     do_probability( $probability ) .
+				     do_probability( $probability ) ,
-				     do_dscp( $dscp ),
 				     $source ,
 				     $dest ,
 				     '' ,
@@ -884,7 +855,7 @@ sub validate_tc_device( ) {
 			    pfifo         => $pfifo,
 			    tablenumber   => 1 ,
 			    redirected    => \@redirected,
-			    default       => undef,
+			    default       => 0,
 			    nextclass     => 2,
 			    qdisc         => $qdisc,
 			    guarantee     => 0,
@@ -1027,7 +998,6 @@ sub validate_tc_class( ) {
 	}
     } else {
 	fatal_error "Duplicate Class NUMBER ($classnumber)" if $tcref->{$classnumber};
-	$markval = '-';
     }
 
     if ( $parentclass != 1 ) {
@@ -1039,7 +1009,7 @@ sub validate_tc_class( ) {
 	fatal_error "Unknown Parent class ($parentnum)" unless $parentref && $parentref->{occurs} == 1;
 	fatal_error "The class ($parentnum) specifies UMAX and/or DMAX; it cannot serve as a parent" if $parentref->{dmax};
 	fatal_error "The class ($parentnum) specifies flow; it cannot serve as a parent"             if $parentref->{flow};
-	fatal_error "The default class ($parentnum) may not have sub-classes"                        if defined $devref->{default} && $devref->{default} == $parentclass;
+	fatal_error "The default class ($parentnum) may not have sub-classes"                        if $devref->{default} == $parentclass;
 	$parentref->{leaf} = 0;
 	$ratemax  = $parentref->{rate};
 	$ratename = q(the parent class's RATE);
@@ -1144,11 +1114,9 @@ sub validate_tc_class( ) {
     }
 
     unless ( $devref->{classify} || $occurs > 1 ) {
-	if ( $mark ne '-' ) {
 	fatal_error "Missing MARK" if $mark eq '-';
 	warning_message "Class NUMBER ignored -- INTERFACE $device does not have the 'classify' option"	if $devclass =~ /:/;
     }
-    }
 
     $tcref->{flow}  = $devref->{flow}  unless $tcref->{flow};
     $tcref->{pfifo} = $devref->{pfifo} unless $tcref->{flow} || $tcref->{pfifo};
@@ -1628,7 +1596,7 @@ sub process_traffic_shaping() {
 	my $devnum  = in_hexp $devref->{number};
 	my $r2q     = int calculate_r2q $devref->{out_bandwidth};
 
-	fatal_error "No default class defined for device $devname" unless defined $devref->{default};
+	fatal_error "No default class defined for device $devname" unless $devref->{default};
 
 	my $device = physical_name $devname;
 
@@ -1740,7 +1708,7 @@ sub process_traffic_shaping() {
 		#
 		# add filters
 		#
-		unless ( $mark eq '-' ) {
+		unless ( $devref->{classify} ) {
 		    emit "run_tc filter add dev $device protocol all parent $devicenumber:0 prio " . ( $priority | 20 ) . " handle $mark fw classid $classid" if $tcref->{occurs} == 1;
 		}
 
@@ -2020,18 +1988,6 @@ sub setup_tc() {
 			  mask      => '',
 			  connmark  => 0
 			},
-			{ match     => sub( $ ) { $_[0] =~ /^DSCP\(\w+\)$/ },
-			  target    => 'DSCP',
-			  mark      => NOMARK,
-			  mask      => '',
-			  connmark  => 0
-			},
-			{ match     => sub( $ ) { $_[0] =~ /^TOS\(.+\)$/ },
-			  target    => 'TOS',
-			  mark      => NOMARK,
-			  mask      => '',
-			  connmark  => 0
-			},
 		      );
 
 	if ( my $fn = open_file 'tcrules' ) {

Shorewall/Perl/Shorewall/Zones.pm

@@ -227,25 +227,6 @@ my %maxoptionvalue = ( routefilter => 2, mss => 100000 , wait => 120 );
 
 my %validhostoptions;
 
-my %validzoneoptions = ( mss          => NUMERIC,
-			 nomark       => NOTHING,
-			 blacklist    => NOTHING,
-			 strict       => NOTHING,
-			 next         => NOTHING,
-			 reqid        => NUMERIC,
-			 spi          => NUMERIC,
-			 proto        => IPSECPROTO,
-			 mode         => IPSECMODE,
-			 "tunnel-src" => NETWORK,
-			 "tunnel-dst" => NETWORK,
-		       );
-
-use constant { UNRESTRICTED => 1, NOFW => 2 , COMPLEX => 8, IN_OUT_ONLY => 16 };
-#
-# Hash of options that have their own key in the returned hash.
-#
-my %zonekey = ( mss => UNRESTRICTED | COMPLEX , blacklist => NOFW, nomark => NOFW | IN_OUT_ONLY );
-
 #
 # Rather than initializing globals in an INIT block or during declaration,
 # we initialize them in a function. This is done for two reasons:
@@ -348,6 +329,25 @@ sub initialize( $$ ) {
 #
 sub parse_zone_option_list($$\$$)
 {
+    my %validoptions = ( mss          => NUMERIC,
+			 nomark       => NOTHING,
+			 blacklist    => NOTHING,
+			 strict       => NOTHING,
+			 next         => NOTHING,
+			 reqid        => NUMERIC,
+			 spi          => NUMERIC,
+			 proto        => IPSECPROTO,
+			 mode         => IPSECMODE,
+			 "tunnel-src" => NETWORK,
+			 "tunnel-dst" => NETWORK,
+		       );
+
+    use constant { UNRESTRICTED => 1, NOFW => 2 , COMPLEX => 8, IN_OUT_ONLY => 16 };
+    #
+    # Hash of options that have their own key in the returned hash.
+    #
+    my %key = ( mss => UNRESTRICTED | COMPLEX , blacklist => NOFW, nomark => NOFW | IN_OUT_ONLY );
+
     my ( $list, $zonetype, $complexref, $column ) = @_;
     my %h;
     my $options = '';
@@ -367,7 +367,7 @@ sub parse_zone_option_list($$\$$)
 		$e   = $1;
 	    }
 
-	    $fmt = $validzoneoptions{$e};
+	    $fmt = $validoptions{$e};
 
 	    fatal_error "Invalid Option ($e)" unless $fmt;
 
@@ -378,7 +378,7 @@ sub parse_zone_option_list($$\$$)
 		fatal_error "Invalid value ($val) for option \"$e\"" unless $val =~ /^($fmt)$/;
 	    }
 
-	    my $key = $zonekey{$e};
+	    my $key = $key{$e};
 
 	    if ( $key ) {
 		fatal_error "Option '$e' not permitted with this zone type " if $key & NOFW && ($zonetype & ( FIREWALL | VSERVER) );
@@ -403,7 +403,7 @@ sub parse_zone_option_list($$\$$)
 #
 # Set the super option on the passed zoneref and propagate to its parents
 #
-sub set_super( $ ); #required for recursion
+sub set_super( $ );
 
 sub set_super( $ ) {
     my $zoneref = shift;
@@ -769,24 +769,20 @@ sub add_group_to_zone($$$$$)
 
     my $gtype = $type & IPSEC ? 'ipsec' : 'ip';
 
-    $hostsref     = ( $zoneref->{hosts}      ||= {} );
+    $hostsref     = ( $zoneref->{hosts}           || ( $zoneref->{hosts} = {} ) );
-    $typeref      = ( $hostsref->{$gtype}    ||= {} );
+    $typeref      = ( $hostsref->{$gtype}         || ( $hostsref->{$gtype} = {} ) );
-    $interfaceref = ( $typeref->{$interface} ||= [] );
+    $interfaceref = ( $typeref->{$interface}      || ( $typeref->{$interface} = [] ) );
 
     fatal_error "Duplicate Host Group ($interface:" . ALLIP . ") in zone $zone" if $allip && @$interfaceref;
 
-    $zoneref->{options}{complex} = 1 if @$interfaceref || @newnetworks > 1 || @exclusions || $options->{routeback};
+    $zoneref->{options}{complex} = 1 if @$interfaceref || ( @newnetworks > 1 ) || ( @exclusions ) || $options->{routeback};
 
     push @{$interfaceref}, { options => $options,
 			     hosts   => \@newnetworks,
 			     ipsec   => $type & IPSEC ? 'ipsec' : 'none' ,
 			     exclusions => \@exclusions };
 
-    if ( $type != IPSEC ) {
+    $interfaces{$interface}{options}{routeback} ||= ( $type != IPSEC && $options->{routeback} );
-	my $optref = $interfaces{$interface}{options};
-	$optref->{routeback} ||= $options->{routeback};
-	$optref->{allip}     ||= $allip;
-    }
 }
 
 #
@@ -916,26 +912,9 @@ sub process_interface( $$ ) {
     my ( $nextinum, $export ) = @_;
     my $netsref   = '';
     my $filterref = [];
-    my ($zone, $originalinterface, $bcasts, $options );
+    my ($zone, $originalinterface, $bcasts, $options ) = split_line 'interfaces file', { zone => 0, interface => 1, broadcast => 2, options => 3 };
     my $zoneref;
     my $bridge = '';
-    our $format;
-
-    if ( $format == 1 ) {
-	($zone, $originalinterface, $bcasts, $options ) = split_line1 'interfaces file', { zone => 0, interface => 1, broadcast => 2, options => 3 }, { COMMENT => 0, FORMAT => 2 };
-    } else {
-	($zone, $originalinterface, $options ) = split_line1 'interfaces file', { zone => 0, interface => 1, options => 2 }, { COMMENT => 0, FORMAT => 2 };
-	$bcasts = '-';
-    }
-
-    if ( $zone eq 'FORMAT' ) {
-	if ( $originalinterface =~ /^([12])$/ ) {
-	    $format = $1;
-	    return;
-	}
-
-	fatal_error "Invalid FORMAT ($1)";
-    }
 
     if ( $zone eq '-' ) {
 	$zone = '';
@@ -1207,7 +1186,6 @@ sub process_interface( $$ ) {
 #
 sub validate_interfaces_file( $ ) {
     my $export = shift;
-    our $format = 1;
     
     my @ifaces;
     my $nextinum = 1;
@@ -1937,6 +1915,7 @@ sub validate_hosts_file()
     $have_ipsec = $ipsec || haveipseczones;
 
     $_->{options}{complex} ||= ( keys %{$_->{interfaces}} > 1 ) for values %zones;
+
 }
 
 #

Shorewall/action.Invalid

@@ -49,7 +49,7 @@ my $target           = require_audit ( $action , $audit );
 log_rule_limit $level, $chainref, 'Invalid' , $action, '', $tag, 'add', "$globals{STATEMATCH} INVALID " if $level ne '';
 add_jump $chainref , $target, 0, "$globals{STATEMATCH} INVALID ";
 
-allow_optimize( $chainref );
+$chainref->{dont_optimize} = 0;
 
 1;
 

Shorewall/action.NotSyn

@@ -49,7 +49,7 @@ my $target           = require_audit ( $action , $audit );
 log_rule_limit $level, $chainref, 'NotSyn' , $action, '', $tag, 'add', '-p 6 ! --syn ' if $level ne '';
 add_jump $chainref , $target, 0, '-p 6 ! --syn ';
 
-allow_optimize( $chainref );
+$chainref->{dont_optimize} = 0;
 
 1;
 

Shorewall/configfiles/interfaces

@@ -7,8 +7,4 @@
 # http://www.shorewall.net/manpages/shorewall-interfaces.html
 #
 ###############################################################################
-FORMAT 1
 #ZONE	INTERFACE	BROADCAST	OPTIONS
-
-FORMAT 2
-#ZONE		INTERFACE		OPTIONS

Shorewall/configfiles/masq

@@ -6,6 +6,6 @@
 # The manpage is also online at
 # http://www.shorewall.net/manpages/shorewall-masq.html
 #
-######################################################################################################
+#############################################################################################
-#INTERFACE:DEST		SOURCE		ADDRESS		PROTO	PORT(S)	IPSEC	MARK	USER/	SWITCH
+#INTERFACE:DEST		SOURCE		ADDRESS		PROTO	PORT(S)	IPSEC	MARK	USER/
 #											GROUP

Shorewall/configfiles/tcrules

@@ -9,7 +9,7 @@
 #
 # See http://shorewall.net/PacketMarking.html for a detailed description of
 # the Netfilter/Shorewall packet marking mechanism.
-##########################################################################################################################################
+######################################################################################################################################
-#MARK	SOURCE		DEST		PROTO	DEST	SOURCE	USER	TEST	LENGTH	TOS   CONNBYTES		HELPER    PROBABILITY DSCP
+#MARK	SOURCE		DEST		PROTO	DEST	SOURCE	USER	TEST	LENGTH	TOS   CONNBYTES		HELPER    PROBABILITY
 #						PORT(S)	PORT(S)
 

Shorewall/configfiles/tos

@@ -4,5 +4,5 @@
 # For information about entries in this file, type "man shorewall-tos"
 #
 ###############################################################################
-#SOURCE		DEST		PROTOCOL	DEST	SOURCE	TOS	MARK
+#SOURCE		DEST		PROTOCOL	SOURCE	DEST	TOS	MARK
 #						PORTS	PORTS

Shorewall/install.sh

@@ -92,11 +92,6 @@ install_file() # $1 = source $2 = target $3 = mode
 
 cd "$(dirname $0)"
 
-#
-# Load packager's settings if any
-#
-[ -f ../shorewall-pkg.config ] && . ../shorewall-pkg.config
-
 if [ -f shorewall ]; then
     PRODUCT=shorewall
     Product=Shorewall
@@ -110,15 +105,26 @@ fi
 #
 # Parse the run line
 #
+# DEST is the SysVInit script directory
+# INIT is the name of the script in the $DEST directory
 #
 T="-T"
 
+if [ -z "$DEST" ] ; then
+	DEST="/etc/init.d"
+fi
+
+if [ -z "$INIT" ] ; then
+	INIT="$PRODUCT"
+fi
+
 ANNOTATED=
+CYGWIN=
+MAC=
+MACHOST=
 MANDIR=${MANDIR:-"/usr/share/man"}
 SPARSE=
 INSTALLD='-D'
-INITFILE="$PRODUCT"
-
 [ -n "${LIBEXEC:=/usr/share}" ]
 [ -n "${PERLLIB:=/usr/share/shorewall}" ]
 
@@ -126,8 +132,7 @@ case "$LIBEXEC" in
     /*)
 	;;
     *)
-	echo "The LIBEXEC setting must be an absolute path name" >&2
+	LIBEXEC=/usr/${LIBEXEC}
-	exit 1
 	;;
 esac
 
@@ -135,45 +140,33 @@ case "$PERLLIB" in
     /*)
 	;;
     *)
-	echo "The PERLLIB setting must be an absolute path name" >&2
+	PERLLIB=/usr/${PERLLIB}
-	exit 1
 	;;
 esac
 
-if [ -z "$BUILD" ]; then
+case $(uname) in
-    case $(uname) in
+    CYGWIN*)
-	cygwin*)
+	if [ -z "$DESTDIR" ]; then
-	    BUILD=cygwin
+	    DEST=
-	    ;;
+	    INIT=
-	Darwin)
-	    BUILD=apple
-	    ;;
-	*)
-	    if [ -f /etc/debian_version ]; then
-		BUILD=debian
-	    elif [ -f /etc/redhat-release ]; then
-		BUILD=redhat
-	    elif [ -f /etc/slackware-version ] ; then
-		BUILD=slackware
-	    elif [ -f /etc/SuSE-release ]; then
-		BUILD=suse
-	    elif [ -f /etc/arch-release ] ; then
-		BUILD=archlinux
-	    else
-		BUILD=linux
 	fi
-	    ;;
-    esac
-fi
 
-case $BUILD in
-    cygwin*)
 	OWNER=$(id -un)
 	GROUP=$(id -gn)
+	CYGWIN=Yes
+	SPARSE=Yes
 	;;
-    apple)
+    Darwin)
+	if [ -z "$DESTDIR" ]; then
+	    DEST=
+	    INIT=
+	    SPARSE=Yes
+	fi
+
 	[ -z "$OWNER" ] && OWNER=root
 	[ -z "$GROUP" ] && GROUP=wheel
+	MAC=Yes
+	MACHOST=Yes
 	INSTALLD=
 	T=
 	;;
@@ -236,7 +229,21 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 # Determine where to install the firewall script
 #
 
-if [ $PRODUCT = shorewall -a -z "${DESTDIR}" ]; then
+if [ -n "$DESTDIR" ]; then
+    if [ -z "$CYGWIN" ]; then
+	if [ `id -u` != 0 ] ; then
+	    echo "Not setting file owner/group permissions, not running as root."
+	    OWNERSHIP=""
+	fi
+    fi
+
+    install -d $OWNERSHIP -m 755 ${DESTDIR}/sbin
+    install -d $OWNERSHIP -m 755 ${DESTDIR}${DEST}
+
+    CYGWIN=
+    MAC=
+else
+    if [ $PRODUCT = shorewall ]; then
         #
         # Verify that Perl is installed
         #
@@ -245,76 +252,44 @@ if [ $PRODUCT = shorewall -a -z "${DESTDIR}" ]; then
 	    echo "       Try perl -c $PWD/Perl/compiler.pl" >&2
 	    exit 1
 	fi
-fi
+    else
+	[ -x /usr/share/shorewall/compiler.pl ] || \
+	    { echo "   ERROR: Shorewall >= 4.3.5 is not installed" >&2; exit 1; }
+    fi
 
-[ -n "$HOST" ] || HOST=$BUILD
+    if [ -n "$CYGWIN" ]; then
-
-case "$HOST" in
-    cygwin)
 	echo "Installing Cygwin-specific configuration..."
-	INITFILE=
+    elif [ -n "$MAC" ]; then
-	;;
+	echo "Installing Mac-specific configuration..."
-    apple)
+    else
-	echo "Installing Mac-specific configuration...";
+	if [ -f /etc/debian_version ]; then
-	INITFILE=
-	;;
-    debian)
 	    echo "Installing Debian-specific configuration..."
+	    DEBIAN=yes
 	    SPARSE=yes
-	;;
+	elif [ -f /etc/redhat-release ]; then
-    redhat)
 	    echo "Installing Redhat/Fedora-specific configuration..."
-	[ -n "$INITDIR" ]  || INITDIR="/etc/rc.d/init.d"
+	    FEDORA=yes
-	;;
+	elif [ -f /etc/slackware-version ] ; then
-    suse)
-	echo "Installing SuSE-specific configuration...";
-	;;
-    slackware)
 	    echo "Installing Slackware-specific configuration..."
-	[ -n "$INITDIR" ]  || INITDIR="/etc/rc.d"
+	    DEST="/etc/rc.d"
-	[ -n "$MANDIR" ]   || MANDIR="/usr/man"
+	    MANDIR="/usr/man"
-	[ -n "$INITFILE" ] || INITFILE="rc.firewall"
+	    SLACKWARE=yes
-	;;
+	    INIT="rc.firewall"
-    archlinux)
+	elif [ -f /etc/arch-release ] ; then
 	    echo "Installing ArchLinux-specific configuration..."
-	[ -n "$INITDIR" ]  || INITDIR="/etc/rc.d"
+	    DEST="/etc/rc.d"
-	[ -n "$INITFILE" ] || INITFILE="$PRODUCT"
+	    INIT="$PRODUCT"
-	;;
+	    ARCHLINUX=yes
-    linux)
-	;;
-    *)
-	echo "ERROR: Unknown HOST \"$HOST\"" >&2
-	exit 1;
-	;;
-esac
-
-if [ -z "$INITDIR" -a -n "$INITFILE" ] ; then
-    INITDIR="/etc/init.d"
-fi
-
-if [ -n "$DESTDIR" ]; then
-    if [ $BUILD != cygwin ]; then
-	if [ `id -u` != 0 ] ; then
-	    echo "Not setting file owner/group permissions, not running as root."
-	    OWNERSHIP=""
 	fi
     fi
-
-    install -d $OWNERSHIP -m 755 ${DESTDIR}/sbin
-    install -d $OWNERSHIP -m 755 ${DESTDIR}${INITDIR}
-elif [ $PRODUCT != shorewall ]; then
-    [ -x ${LIBEXEC}/shorewall/compiler.pl ] || \
-	{ echo "   ERROR: Shorewall >= 4.5.0 is not installed" >&2; exit 1; }
 fi
 
 if [ -z "$DESTDIR" ]; then
     if [ -f /lib/systemd/system ]; then
 	SYSTEMD=Yes
-	INITFILE=
     fi
 elif [ -n "$SYSTEMD" ]; then
     mkdir -p ${DESTDIR}/lib/systemd/system
-    INITFILE=
 fi
 
 echo "Installing $Product Version $VERSION"
@@ -333,7 +308,7 @@ if [ -z "${DESTDIR}" -a $PRODUCT = shorewall -a ! -f /usr/share/$PRODUCT/corever
     exit 1
 fi
 
-if [ $HOST != cygwin ]; then
+if [ -z "$CYGWIN" ]; then
    install_file $PRODUCT ${DESTDIR}/sbin/$PRODUCT 0755
    echo "$PRODUCT control program installed in ${DESTDIR}/sbin/$PRODUCT"
 else
@@ -344,28 +319,21 @@ fi
 #
 # Install the Firewall Script
 #
-if [ -n "$INITFILE" ]; then
+if [ -n "$DEBIAN" ]; then
-    case $HOST in
+    install_file init.debian.sh ${DESTDIR}/etc/init.d/$PRODUCT 0544
-	debian)
+elif [ -n "$FEDORA" ]; then
-	    install_file init.debian.sh ${DESTDIR}${INITDIR}/${INITFILE} 0544
+    install_file init.fedora.sh ${DESTDIR}/etc/init.d/$PRODUCT 0544
-	    ;;
+elif [ -n "$ARCHLINUX" ]; then
-	redhat)
+    install_file init.archlinux.sh ${DESTDIR}${DEST}/$INIT 0544
-	    install_file init.fedora.sh ${DESTDIR}${INITDIR}/${INITFILE} 0544
+elif [ -n "$SLACKWARE" -a $PRODUCT = shorewall ]; then
-	    ;;
-	slackware)
-            if [ $PRODUCT = shorewall ]; then
 	install_file init.slackware.firewall.sh ${DESTDIR}${DEST}/rc.firewall 0644
 	install_file init.slackware.$PRODUCT.sh ${DESTDIR}${DEST}/rc.$PRODUCT 0644
-	    fi
+elif [ -n "$INIT" ]; then
-	    ;;
+    install_file init.sh ${DESTDIR}${DEST}/$INIT 0544
-	*)
-	    install_file init.sh ${DESTDIR}${INITDIR}/$INITFILE 0544
-	    ;;
-    esac
-
-    echo  "$Product script installed in ${DESTDIR}${INITDIR}/$INITFILE"
 fi
 
+[ -n "$INIT" ] && echo  "$Product script installed in ${DESTDIR}${DEST}/$INIT"
+
 #
 # Create /etc/$PRODUCT and /var/lib/$PRODUCT if needed
 #
@@ -459,7 +427,7 @@ run_install $OWNERSHIP -m 0644 $PRODUCT.conf.annotated ${DESTDIR}/usr/share/$PRO
 if [ ! -f ${DESTDIR}/etc/$PRODUCT/$PRODUCT.conf ]; then
    run_install $OWNERSHIP -m 0644 $PRODUCT.conf${suffix} ${DESTDIR}/etc/$PRODUCT/$PRODUCT.conf
 
-   if [ $HOST = debian ] && mywhich perl; then
+   if [ -n "$DEBIAN" ] && mywhich perl; then
        #
        # Make a Debian-like $PRODUCT.conf
        #
@@ -470,7 +438,7 @@ if [ ! -f ${DESTDIR}/etc/$PRODUCT/$PRODUCT.conf ]; then
 fi
 
 
-if [ $HOST = archlinux ] ; then
+if [ -n "$ARCHLINUX" ] ; then
    sed -e 's!LOGFILE=/var/log/messages!LOGFILE=/var/log/messages.log!' -i ${DESTDIR}/etc/$PRODUCT/$PRODUCT.conf
 fi
 
@@ -614,7 +582,7 @@ run_install $OWNERSHIP -m 0644 maclist.annotated ${DESTDIR}/usr/share/$PRODUCT/c
 
 if [ -z "$SPARSE" -a ! -f ${DESTDIR}/etc/$PRODUCT/maclist ]; then
     run_install $OWNERSHIP -m 0600 maclist${suffix} ${DESTDIR}/etc/$PRODUCT/maclist
-    echo "mac list file installed as ${DESTDIR}/etc/$PRODUCT/maclist"
+    echo "MAC list file installed as ${DESTDIR}/etc/$PRODUCT/maclist"
 fi
 
 if [ -f masq ]; then
@@ -920,6 +888,11 @@ fi
 # Install the Isusable file
 #
 run_install $OWNERSHIP -m 0644 isusable ${DESTDIR}/usr/share/$PRODUCT/configfiles/isusable
+
+if [ -z "$SPARSE" -a ! -f ${DESTDIR}/etc/$PRODUCT/isusable ]; then
+    run_install $OWNERSHIP -m 0600 isusable ${DESTDIR}/etc/$PRODUCT/isusable
+    echo "Isusable file installed as ${DESTDIR}/etc/$PRODUCT/isusable"
+fi
 #
 # Install the Refresh file
 #
@@ -1075,7 +1048,7 @@ chmod 644 ${DESTDIR}/usr/share/$PRODUCT/version
 
 if [ -z "$DESTDIR" ]; then
     rm -f /usr/share/$PRODUCT/init
-    ln -s ${INITDIR}/${INITFILE} /usr/share/$PRODUCT/init
+    ln -s ${DEST}/${INIT} /usr/share/$PRODUCT/init
 fi
 
 #
@@ -1107,8 +1080,8 @@ if [ -d ${DESTDIR}/etc/logrotate.d ]; then
     echo "Logrotate file installed as ${DESTDIR}/etc/logrotate.d/$PRODUCT"
 fi
 
-if [ -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${mac}" ]; then
+if [ -z "$DESTDIR" -a -n "$first_install" -a -z "${CYGWIN}${MAC}" ]; then
-    if [ $HOST = debian ]; then
+    if [ -n "$DEBIAN" ]; then
 	run_install $OWNERSHIP -m 0644 default.debian /etc/default/$PRODUCT
 
 	update-rc.d $PRODUCT defaults
@@ -1144,7 +1117,7 @@ if [ -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${mac}" ]; then
 	    else
 		cant_autostart
 	    fi
-	elif [ "$INITFILE" != rc.f ]; then #Slackware starts this automatically
+	elif [ "$INIT" != rc.firewall ]; then #Slackware starts this automatically
 	    cant_autostart
 	fi
     fi

Shorewall/lib.cli-std

@@ -239,7 +239,7 @@ get_config() {
 	LOG_VERBOSITY=-1
     fi
 
-    if [ -n "$SHOREWALL_SHELL" -a -z "$g_export" ]; then
+    if [ -n "$SHOREWALL_SHELL" ]; then
 	if [ ! -x "$SHOREWALL_SHELL" ]; then
 	    echo "   WARNING: The program specified in SHOREWALL_SHELL does not exist or is not executable; falling back to /bin/sh" >&2
 	    SHOREWALL_SHELL=/bin/sh

Shorewall/manpages/shorewall-accounting.xml

@@ -75,9 +75,12 @@
 
     <itemizedlist>
       <listitem>
-        <para>A jump to a user-defined accounting chain must appear before
+        <para>A jump to a user-defined accounting chain before entries that
-        entries that add rules to that chain. This eliminates loops and
+        add rules to that chain.</para>
-        unreferenced chains.</para>
+      </listitem>
+
+      <listitem>
+        <para>This eliminates loops and unreferenced chains.</para>
       </listitem>
 
       <listitem>

Shorewall/manpages/shorewall-masq.xml

@@ -35,8 +35,8 @@
       <para>If you have more than one ISP link, adding entries to this file
       will <emphasis role="bold">not</emphasis> force connections to go out
       through a particular link. You must use entries in <ulink
-      url="shorewall-rtrules.html">shorewall-rtrules</ulink>(5) or PREROUTING
+      url="shorewall-rtrules.html">shorewall-rtrules</ulink>(5) or
-      entries in <ulink
+      PREROUTING entries in <ulink
       url="shorewall-tcrules.html">shorewall-tcrules</ulink>(5) to do
       that.</para>
     </warning>
@@ -88,8 +88,7 @@
           addresses to indicate that you only want to change the source IP
           address for packets being sent to those particular destinations.
           Exclusion is allowed (see <ulink
-          url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)) as
+          url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
-          are ipset names preceded by a plus sign '+';</para>
 
           <para>If you wish to inhibit the action of ADD_SNAT_ALIASES for this
           entry then include the ":" but omit the digit:</para>
@@ -150,10 +149,6 @@
 
           <para>In that example traffic from eth1 would be masqueraded unless
           it came from 192.168.1.4 or 196.168.32.0/27</para>
-
-          <para>The preferred way to specify the SOURCE is to supply one or
-          more host or network addresses separated by comma. You may use ipset
-          names preceded by a plus sign (+) to specify a set of hosts.</para>
         </listitem>
       </varlistentry>
 
@@ -472,43 +467,6 @@
           </variablelist>
         </listitem>
       </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">SWITCH -
-        [!]<replaceable>switch-name</replaceable></emphasis></term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.1 and allows enabling and disabling the
-          rule without requiring <command>shorewall restart</command>.</para>
-
-          <para>The rule is enabled if the value stored in
-          <filename>/proc/net/nf_condition/<replaceable>switch-name</replaceable></filename>
-          is 1. The rule is disabled if that file contains 0 (the default). If
-          '!' is supplied, the test is inverted such that the rule is enabled
-          if the file contains 0. <replaceable>switch-name</replaceable> must
-          begin with a letter and be composed of letters, decimal digits,
-          underscores or hyphens. Switch names must be 30 characters or less
-          in length.</para>
-
-          <para>Switches are normally <emphasis role="bold">off</emphasis>. To
-          turn a switch <emphasis role="bold">on</emphasis>:</para>
-
-          <simplelist>
-            <member><command>echo 1 &gt;
-            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
-          </simplelist>
-
-          <para>To turn it <emphasis role="bold">off</emphasis> again:</para>
-
-          <simplelist>
-            <member><command>echo 0 &gt;
-            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
-          </simplelist>
-
-          <para>Switch settings are retained over <command>shorewall
-          restart</command>.</para>
-        </listitem>
-      </varlistentry>
     </variablelist>
   </refsect1>
 
@@ -590,19 +548,6 @@
           </warning>
         </listitem>
       </varlistentry>
-
-      <varlistentry>
-        <term>Example 6:</term>
-
-        <listitem>
-          <para>Connections leaving on eth0 and destined to any host defined
-          in the ipset <emphasis>myset</emphasis> should have the source IP
-          address changed to 206.124.146.177.</para>
-
-          <programlisting>        #INTERFACE              SOURCE          ADDRESS
-        eth0:+myset[dst]        -               206.124.146.177</programlisting>
-        </listitem>
-      </varlistentry>
     </variablelist>
   </refsect1>
 

Shorewall/manpages/shorewall-tcrules.xml

@@ -468,112 +468,6 @@ SAME              $FW            0.0.0.0/0    tcp        80,443</programlisting>
               <replaceable>number</replaceable>. Requires IMQ Target support
               in your kernel and iptables.</para>
             </listitem>
-
-            <listitem>
-              <para><emphasis
-              role="bold">DSCP</emphasis>(<replaceable>dscp</replaceable>)</para>
-
-              <para>Added in Shorewall 4.5.1. Sets the
-              <firstterm>Differentiated Services Code Point</firstterm> field
-              in the IP header. The <replaceable>dscp</replaceable> value may
-              be given as an even number (hex or decimal) or as the name of a
-              DSCP class. Valid class names and their associated hex numeric
-              values are:</para>
-
-              <programlisting>    CS0  =&gt; 0x00
-    CS1  =&gt; 0x08
-    CS2  =&gt; 0x10
-    CS3  =&gt; 0x18
-    CS4  =&gt; 0x20
-    CS5  =&gt; 0x28
-    CS6  =&gt; 0x30
-    CS7  =&gt; 0x38
-    BE   =&gt; 0x00
-    AF11 =&gt; 0x0a
-    AF12 =&gt; 0x0c
-    AF13 =&gt; 0x0e
-    AF21 =&gt; 0x12
-    AF22 =&gt; 0x14
-    AF23 =&gt; 0x16
-    AF31 =&gt; 0x1a
-    AF32 =&gt; 0x1c
-    AF33 =&gt; 0x1e
-    AF41 =&gt; 0x22
-    AF42 =&gt; 0x24
-    AF43 =&gt; 0x26
-    EF   =&gt; 0x2e</programlisting>
-
-              <para>May be optionally followed by ':' and a capital letter
-              designating the chain where classification is to occur.</para>
-
-              <variablelist>
-                <varlistentry>
-                  <term>F</term>
-
-                  <listitem>
-                    <para>FORWARD chain.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>T</term>
-
-                  <listitem>
-                    <para>POSTROUTING chain (default).</para>
-                  </listitem>
-                </varlistentry>
-              </variablelist>
-            </listitem>
-
-            <listitem>
-              <para><emphasis
-              role="bold">TOS</emphasis>(<replaceable>tos</replaceable>[/<replaceable>mask</replaceable>])</para>
-
-              <para>Added in Shorewall 4.5.1. Sets the <firstterm>Type of
-              Service</firstterm> field in the IP header. The
-              <replaceable>tos</replaceable> value may be given as an number
-              (hex or decimal) or as the name of a TOS type. Valid type names
-              and their associated hex numeric values are:</para>
-
-              <programlisting>Minimize-Delay       =&gt; 0x10,
-Maximize-Throughput  =&gt; 0x08,
-Maximize-Reliability =&gt; 0x04,
-Minimize-Cost        =&gt; 0x02,
-Normal-Service       =&gt; 0x00</programlisting>
-
-              <para>When <replaceable>tos</replaceable> is given as a number,
-              it may be optionally followed by '/' and a
-              <replaceable>mask</replaceable>. When no
-              <replaceable>mask</replaceable> is given, the value 0xff is
-              assumed. When <replaceable>tos</replaceable> is given as a type
-              name, the <replaceable>mask</replaceable> 0x3f is
-              assumed.</para>
-
-              <para>The action performed is to zero out the bits specified by
-              the <replaceable>mask</replaceable>, then set the bits specified
-              by <replaceable>tos</replaceable>.</para>
-
-              <para>May be optionally followed by ':' and a capital letter
-              designating the chain where classification is to occur.</para>
-
-              <variablelist>
-                <varlistentry>
-                  <term>F</term>
-
-                  <listitem>
-                    <para>FORWARD chain.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>T</term>
-
-                  <listitem>
-                    <para>POSTROUTING chain (default).</para>
-                  </listitem>
-                </varlistentry>
-              </variablelist>
-            </listitem>
           </orderedlist>
         </listitem>
       </varlistentry>
@@ -946,7 +840,7 @@ Normal-Service       =&gt; 0x00</programlisting>
 
       <varlistentry>
         <term><emphasis role="bold">PROBABILITY</emphasis> -
-        [<replaceable>probability</replaceable>]</term>
+        [probability]</term>
 
         <listitem>
           <para>Added in Shorewall 4.5.0. When non-empty, requires the
@@ -958,44 +852,6 @@ Normal-Service       =&gt; 0x00</programlisting>
           at up to 8 decimal points of precision.</para>
         </listitem>
       </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">DSCP -</emphasis>
-        [[!]<replaceable>dscp</replaceable>]</term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.1. When non-empty, match packets whose
-          <firstterm>Differentiated Service Code Point</firstterm> field
-          matches the supplied value (when '!' is given, the rule matches
-          packets whose DSCP field does not match the supplied value). The
-          <replaceable>dscp</replaceable> value may be given as an even number
-          (hex or decimal) or as the name of a DSCP class. Valid class names
-          and their associated hex numeric values are:</para>
-
-          <programlisting>    CS0  =&gt; 0x00
-    CS1  =&gt; 0x08
-    CS2  =&gt; 0x10
-    CS3  =&gt; 0x18
-    CS4  =&gt; 0x20
-    CS5  =&gt; 0x28
-    CS6  =&gt; 0x30
-    CS7  =&gt; 0x38
-    BE   =&gt; 0x00
-    AF11 =&gt; 0x0a
-    AF12 =&gt; 0x0c
-    AF13 =&gt; 0x0e
-    AF21 =&gt; 0x12
-    AF22 =&gt; 0x14
-    AF23 =&gt; 0x16
-    AF31 =&gt; 0x1a
-    AF32 =&gt; 0x1c
-    AF33 =&gt; 0x1e
-    AF41 =&gt; 0x22
-    AF42 =&gt; 0x24
-    AF43 =&gt; 0x26
-    EF   =&gt; 0x2e</programlisting>
-        </listitem>
-      </varlistentry>
     </variablelist>
   </refsect1>
 

Shorewall/manpages/shorewall-tos.xml

@@ -23,9 +23,7 @@
   <refsect1>
     <title>Description</title>
 
-    <para>This file defines rules for setting Type Of Service (TOS). Its use
+    <para>This file defines rules for setting Type Of Service (TOS)</para>
-    is deprecated, beginning in Shorewall 4.5.1, in favor of the TOS target in
-    <ulink url="shorewall-tcrules.html">shorewall-tcrules</ulink> (5).</para>
 
     <para>The columns in the file are as follows (where the column name is
     followed by a different name in parentheses, the different name is used in

Shorewall/uninstall.sh

@@ -112,7 +112,7 @@ rm -rf /etc/shorewall
 rm -rf /etc/shorewall-*.bkout
 rm -rf /var/lib/shorewall
 rm -rf /var/lib/shorewall-*.bkout
-rm -rf ${PERLLIB}/Shorewall/*
+rm -rf $PERLLIB}/Shorewall/*
 rm -rf ${LIBEXEC}/shorewall
 rm -rf /usr/share/shorewall/configfiles/
 rm -rf /usr/share/shorewall/Samples/

Shorewall6-lite/Makefile

@@ -12,7 +12,7 @@ $(VARDIR)/${RESTOREFILE}: $(VARDIR)/firewall
 	then \
 	    /sbin/shorewall6-lite -q save >/dev/null; \
 	else \
-	    /sbin/shorewall6-lite -q restart 2>&1 | tail >&2; exit 1; \
+	    /sbin/shorewall6-lite -q restart 2>&1 | tail >&2; \
 	fi
 
 # EOF

Shorewall6/Makefile

@@ -2,7 +2,6 @@
 VARDIR=$(shell /sbin/shorewall6 show vardir)
 CONFDIR=/etc/shorewall6
 RESTOREFILE?=firewall
-
 all: $(VARDIR)/${RESTOREFILE}
 
 $(VARDIR)/${RESTOREFILE}: $(CONFDIR)/*
@@ -12,12 +11,11 @@ $(VARDIR)/${RESTOREFILE}: $(CONFDIR)/*
 	then \
 	    /sbin/shorewall6 -q save >/dev/null; \
 	else \
-	    /sbin/shorewall6 -q restart 2>&1 | tail >&2; exit 1; \
+	    /sbin/shorewall6 -q restart 2>&1 | tail >&2; \
 	fi
 
 clean:
 	@rm -f $(CONFDIR)/*~ $(CONFDIR)/.*~
-
 .PHONY: clean
 
 # EOF

Shorewall6/configfiles/interfaces

@@ -7,8 +7,4 @@
 # http://www.shorewall.net/manpages6/shorewall6-interfaces.html
 #
 ###############################################################################
-FORMAT 1
 #ZONE	INTERFACE	ANYCAST		OPTIONS
-
-FORMAT 2
-#ZONE		INTERFACE		OPTIONS

Shorewall6/configfiles/isusable

@@ -8,15 +8,13 @@
 #
 #	The script is invoked inside a function that accepts an interface
 #	name as a single argument. The file below is designed to work with
-#	both swping and lsm as described at
+#	both swping and lsm as described at http://www.shorewall.net/MultiISP.html
-#	http://www.shorewall.net/MultiISP.html
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.
 #
 ###############################################################################
-local status
+local status=0
-status=0
 
 [ -f ${VARDIR}/${1}.status ] && status=$(cat ${VARDIR}/${1}.status)
 

Shorewall6/configfiles/tcrules

@@ -9,6 +9,6 @@
 #
 # See http://shorewall.net/PacketMarking.html for a detailed description of
 # the Netfilter/Shorewall packet marking mechanism.
-###################################################################################################################################################
+##############################################################################################################################################
-#MARK	SOURCE		DEST		PROTO	DEST	SOURCE	USER	TEST	LENGTH	TOS   CONNBYTES		HELPER	HEADERS    PROBABILITY DSCP
+#MARK	SOURCE		DEST		PROTO	DEST	SOURCE	USER	TEST	LENGTH	TOS   CONNBYTES		HELPER	HEADERS    PROBABILITY
 #						PORT(S)	PORT(S)

Shorewall6/configfiles/tos

@@ -4,5 +4,5 @@
 # For information about entries in this file, type "man shorewall6-tos"
 #
 ###############################################################################
-#SOURCE		DEST		PROTOCOL	DEST	SOURCE	TOS	MARK
+#SOURCE		DEST		PROTOCOL	SOURCE	DEST	TOS	MARK
 #						PORTS	PORTS

Shorewall6/manpages/shorewall6-accounting.xml

@@ -75,9 +75,12 @@
 
     <itemizedlist>
       <listitem>
-        <para>A jump to a user-defined accounting chain must appear before
+        <para>A jump to a user-defined accounting chain before entries that
-        entries that add rules to that chain. This eliminates loops and
+        add rules to that chain.</para>
-        unreferenced chains.</para>
+      </listitem>
+
+      <listitem>
+        <para>This eliminates loops and unreferenced chains.</para>
       </listitem>
 
       <listitem>

Shorewall6/manpages/shorewall6-tcrules.xml

@@ -365,112 +365,6 @@ SAME              $FW            0.0.0.0/0    tcp        80,443</programlisting>
               <replaceable>number</replaceable>. Requires IMQ Target support
               in your kernel and ip6tables.</para>
             </listitem>
-
-            <listitem>
-              <para><emphasis
-              role="bold">DSCP</emphasis>(<replaceable>dscp</replaceable>)</para>
-
-              <para>Added in Shorewall 4.5.1. Sets the
-              <firstterm>Differentiated Services Code Point</firstterm> field
-              in the IP header. The <replaceable>dscp</replaceable> value may
-              be given as an even number (hex or decimal) or as the name of a
-              DSCP class. Valid class names and their associated hex numeric
-              values are:</para>
-
-              <programlisting>    CS0  =&gt; 0x00
-    CS1  =&gt; 0x08
-    CS2  =&gt; 0x10
-    CS3  =&gt; 0x18
-    CS4  =&gt; 0x20
-    CS5  =&gt; 0x28
-    CS6  =&gt; 0x30
-    CS7  =&gt; 0x38
-    BE   =&gt; 0x00
-    AF11 =&gt; 0x0a
-    AF12 =&gt; 0x0c
-    AF13 =&gt; 0x0e
-    AF21 =&gt; 0x12
-    AF22 =&gt; 0x14
-    AF23 =&gt; 0x16
-    AF31 =&gt; 0x1a
-    AF32 =&gt; 0x1c
-    AF33 =&gt; 0x1e
-    AF41 =&gt; 0x22
-    AF42 =&gt; 0x24
-    AF43 =&gt; 0x26
-    EF   =&gt; 0x2e</programlisting>
-
-              <para>May be optionally followed by ':' and a capital letter
-              designating the chain where classification is to occur.</para>
-
-              <variablelist>
-                <varlistentry>
-                  <term>F</term>
-
-                  <listitem>
-                    <para>FORWARD chain.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>T</term>
-
-                  <listitem>
-                    <para>POSTROUTING chain (default).</para>
-                  </listitem>
-                </varlistentry>
-              </variablelist>
-            </listitem>
-
-            <listitem>
-              <para><emphasis
-              role="bold">TOS</emphasis>(<replaceable>tos</replaceable>[/<replaceable>mask</replaceable>])</para>
-
-              <para>Added in Shorewall 4.5.1. Sets the <firstterm>Type of
-              Service</firstterm> field in the IP header. The
-              <replaceable>tos</replaceable> value may be given as an number
-              (hex or decimal) or as the name of a TOS type. Valid type names
-              and their associated hex numeric values are:</para>
-
-              <programlisting>Minimize-Delay       =&gt; 0x10,
-Maximize-Throughput  =&gt; 0x08,
-Maximize-Reliability =&gt; 0x04,
-Minimize-Cost        =&gt; 0x02,
-Normal-Service       =&gt; 0x00</programlisting>
-
-              <para>When <replaceable>tos</replaceable> is given as a number,
-              it may be optionally followed by '/' and a
-              <replaceable>mask</replaceable>. When no
-              <replaceable>mask</replaceable> is given, the value 0xff is
-              assumed. When <replaceable>tos</replaceable> is given as a type
-              name, the <replaceable>mask</replaceable> 0x3f is
-              assumed.</para>
-
-              <para>The action performed is to zero out the bits specified by
-              the <replaceable>mask</replaceable>, then set the bits specified
-              by <replaceable>tos</replaceable>.</para>
-
-              <para>May be optionally followed by ':' and a capital letter
-              designating the chain where classification is to occur.</para>
-
-              <variablelist>
-                <varlistentry>
-                  <term>F</term>
-
-                  <listitem>
-                    <para>FORWARD chain.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>T</term>
-
-                  <listitem>
-                    <para>POSTROUTING chain (default).</para>
-                  </listitem>
-                </varlistentry>
-              </variablelist>
-            </listitem>
           </orderedlist>
         </listitem>
       </varlistentry>

Shorewall6/manpages/shorewall6-tos.xml

@@ -23,10 +23,7 @@
   <refsect1>
     <title>Description</title>
 
-    <para>This file defines rules for setting Type Of Service (TOS). Its use
+    <para>This file defines rules for setting Type Of Service (TOS)</para>
-    is deprecated, beginning in Shorewall 4.5.1, in favor of the TOS target in
-    <ulink url="shorewall6-tcrules.html">shorewall6-tcrules</ulink>
-    (5).</para>
 
     <para>The columns in the file are as follows.</para>
 

docs/Anatomy.xml

@@ -106,7 +106,7 @@
 
       <para>The <filename>/sbin/shorewall</filename> shell program is used to
       interact with Shorewall. See <ulink
-      url="manpages/shorewall.html">shorewall</ulink>(8).</para>
+      url="manpages/shorewall.html">shorewall</ulink>(8). </para>
     </section>
 
     <section id="share-shorewall">

docs/Documentation_Index.xml

@@ -223,8 +223,8 @@
 
             <entry><ulink url="OpenVZ.html">OpenVZ</ulink></entry>
 
-            <entry><ulink url="upgrade_issues.htm">Upgrade
+            <entry><ulink url="LennyToSqueeze.html">Upgrading to Shorewall 4.4
-            Issues</ulink></entry>
+            (Upgrading Debian Lenny to Squeeze)</ulink></entry>
           </row>
 
           <row>
@@ -234,8 +234,7 @@
             <entry><ulink url="starting_and_stopping_shorewall.htm">Operating
             Shorewall</ulink></entry>
 
-            <entry><ulink url="LennyToSqueeze.html">Upgrading to Shorewall 4.4
+            <entry><ulink url="VPNBasics.html">VPN</ulink></entry>
-            (Upgrading Debian Lenny to Squeeze)</ulink></entry>
           </row>
 
           <row>
@@ -246,7 +245,7 @@
             <entry><ulink url="PacketMarking.html">Packet
             Marking</ulink></entry>
 
-            <entry><ulink url="VPNBasics.html">VPN</ulink></entry>
+            <entry><ulink url="VPN.htm">VPN Passthrough</ulink></entry>
           </row>
 
           <row>
@@ -256,7 +255,8 @@
             <entry><ulink url="PacketHandling.html">Packet Processing in a
             Shorewall-based Firewall</ulink></entry>
 
-            <entry><ulink url="VPN.htm">VPN Passthrough</ulink></entry>
+            <entry><ulink url="blacklisting_support.htm#whitelisting">White
+            List Creation</ulink></entry>
           </row>
 
           <row>
@@ -264,8 +264,8 @@
 
             <entry><ulink url="ping.html">'Ping' Management</ulink></entry>
 
-            <entry><ulink url="blacklisting_support.htm#whitelisting">White
+            <entry><ulink url="XenMyWay.html">Xen - Shorewall in a Bridged Xen
-            List Creation</ulink></entry>
+            DomU</ulink></entry>
           </row>
 
           <row>
@@ -275,8 +275,8 @@
             <entry><ulink url="two-interface.htm#DNAT">Port
             Forwarding</ulink></entry>
 
-            <entry><ulink url="XenMyWay.html">Xen - Shorewall in a Bridged Xen
+            <entry><ulink url="XenMyWay-Routed.html">Xen - Shorewall in Routed
-            DomU</ulink></entry>
+            Xen Dom0</ulink></entry>
           </row>
 
           <row>
@@ -285,8 +285,7 @@
 
             <entry><ulink url="ports.htm">Port Information</ulink></entry>
 
-            <entry><ulink url="XenMyWay-Routed.html">Xen - Shorewall in Routed
+            <entry/>
-            Xen Dom0</ulink></entry>
           </row>
 
           <row>

docs/FAQ.xml

@@ -247,7 +247,7 @@ DNAT    net:<emphasis>address</emphasis>   loc:<emphasis>local-IP-address</empha
         <itemizedlist>
           <listitem>
             <para>You are trying to test from inside your firewall (no, that
-            won't work -- see <xref linkend="faq2"/>).</para>
+            won't work -- see <xref linkend="faq2" />).</para>
           </listitem>
 
           <listitem>
@@ -2837,7 +2837,7 @@ Shorewall has detected the following iptables/netfilter capabilities:
    Persistent SNAT: Available
 gateway:~# </programlisting>
 
-      <para/>
+      <para></para>
     </section>
 
     <section id="faq19">
@@ -2982,53 +2982,5 @@ EXT_IF:192.168.1.1	     	0.0.0.0/0		192.168.1.254
         examples, macros, etc. easier.</para>
       </section>
     </section>
-
-    <section id="faq98">
-      <title>(FAQ 98) How do I Unsubscribe from the Mailing List</title>
-
-      <para><emphasis role="bold">Answer</emphasis>: There are two
-      ways:</para>
-
-      <orderedlist>
-        <listitem>
-          <para>On the web</para>
-
-          <para>Go to <ulink
-          url="https://lists.sourceforge.net/lists/listinfo/shorewall-users">https://lists.sourceforge.net/lists/listinfo/shorewall-users</ulink>.
-          At the bottom of the form is a section entitled "<emphasis
-          role="bold">Shorewall-users Subscribers</emphasis>". At the bottom
-          of that section find:</para>
-
-          <blockquote>
-            <para>"To <emphasis role="bold">unsubscribe</emphasis> from
-            Shorewall-users, get a password reminder, or change your
-            subscription options <emphasis role="bold">enter your subscription
-            email address</emphasis>:".</para>
-          </blockquote>
-
-          <para>Enter your email address in the box provided and click on the
-          "<emphasis role="bold"><ulink url="???">Unsubscribe or edit
-          options</ulink></emphasis>" button. That will take you to a second
-          form.</para>
-
-          <para>At the top of the second form is a box to <emphasis
-          role="bold">enter your password</emphasis> -- enter it there then
-          click the <emphasis role="bold">Unsubscribe</emphasis> button in the
-          center of the form. You will be unsubscribed.</para>
-
-          <para>If you <emphasis role="bold">don't remember your
-          password</emphasis>, click on the <emphasis
-          role="bold">Remind</emphasis> button at the bottom of the form and
-          your password will be emailed to you.</para>
-        </listitem>
-
-        <listitem>
-          <para>Via email using this link: <ulink
-          url="mailto:shorewall-users-request@lists.sourceforge.net?subject=unsubscribe">mailto:shorewall-users-request@lists.sourceforge.net?subject=unsubscribe</ulink>.
-          You will receive a confirmation email shortly; follow the
-          instructions in that email.</para>
-        </listitem>
-      </orderedlist>
-    </section>
   </section>
 </article>

docs/Install.xml

@@ -24,8 +24,6 @@
 
       <year>2009</year>
 
-      <year>2012</year>
-
       <holder>Thomas M. Eastep</holder>
     </copyright>
 
@@ -137,31 +135,11 @@
   <section id="Install_Tarball">
     <title>Install using tarball</title>
 
-    <para>Beginning with Shorewall-4.5.0, the Shorewall packages depend on
-    Shorewall-core. So the first step is to install that package:</para>
-
-    <orderedlist>
-      <listitem>
-        <para>unpack the tarballs:<programlisting><command>tar -jxf shorewall-core-4.5.0.tar.bz2</command></programlisting></para>
-      </listitem>
-
-      <listitem>
-        <para>cd to the shorewall directory (the version is encoded in the
-        directory name as in <quote>shorewall-core-4.5.0</quote>).</para>
-      </listitem>
-
-      <listitem>
-        <para>Type:</para>
-
-        <programlisting><command>./install.sh </command></programlisting>
-      </listitem>
-    </orderedlist>
-
     <para>To install Shorewall using the tarball and install script:</para>
 
     <orderedlist>
       <listitem>
-        <para>unpack the tarballs:<programlisting><command>tar -jxf shorewall-4.5.0.tar.bz2</command></programlisting></para>
+        <para>unpack the tarballs:<programlisting><command>tar -jxf shorewall-4.3.5.tar.bz2</command></programlisting></para>
       </listitem>
 
       <listitem>
@@ -263,9 +241,6 @@
             <para>Beginning with Shorewall 4.4.20, you can specify an absolute
             path name for LIBEXEC, in which case the listed executables will
             be installed in ${LIBEXEC}/shorewall*.</para>
-
-            <para>Beginning with Shorewall 4.5.1, you must specify an absolute
-            pathname for LIBEXEC.</para>
           </listitem>
         </varlistentry>
 
@@ -283,302 +258,10 @@
             <para>Beginning with Shorewall 4.4.20, you can specify an absolute
             path name for PERLLIB, in which case the Shorewall Perl modules
             will be installed in ${PERLLIB}/Shorewall/.</para>
-
-            <para>Beginning with Shorewall 4.5.1, you must specify an absolute
-            pathname for PERLLIB.</para>
           </listitem>
         </varlistentry>
       </variablelist>
     </section>
-
-    <section id="Locations">
-      <title>Default Install Locations</title>
-
-      <para>The default install locations are distribution dependent as shown
-      in the following sections. These are the locations that are chosen by
-      the install.sh scripts.</para>
-
-      <section>
-        <title>All Distributions</title>
-
-        <informaltable>
-          <tgroup cols="2">
-            <tbody>
-              <row>
-                <entry><emphasis role="bold">COMPONENT</emphasis></entry>
-
-                <entry><emphasis role="bold">LOCATION</emphasis></entry>
-              </row>
-
-              <row>
-                <entry>man pages</entry>
-
-                <entry>/usr/share/man/ (may ve overridden using
-                MANDIR)</entry>
-              </row>
-
-              <row>
-                <entry>Shorewall Perl Modules</entry>
-
-                <entry>/usr/share/shorewall/ (may be overridden using
-                PERLLIB)</entry>
-              </row>
-
-              <row>
-                <entry>Executable helper scripts (compiler.pl, getparams,
-                wait4ifup)</entry>
-
-                <entry>/usr/share/shorewall/ (may be overridden using
-                LIBEXEC)</entry>
-              </row>
-
-              <row>
-                <entry>ifupdown.sh (from Shorewall-init)</entry>
-
-                <entry>/usr/share/shorewall-init/ (may be overridden using
-                LIBEXEC)</entry>
-              </row>
-            </tbody>
-          </tgroup>
-        </informaltable>
-      </section>
-
-      <section>
-        <title>Debian</title>
-
-        <informaltable>
-          <tgroup cols="2">
-            <tbody>
-              <row>
-                <entry><emphasis role="bold">COMPONENT</emphasis></entry>
-
-                <entry><emphasis role="bold">LOCATION</emphasis></entry>
-              </row>
-
-              <row>
-                <entry>CLI programs</entry>
-
-                <entry>/sbin/<replaceable>product</replaceable></entry>
-              </row>
-
-              <row>
-                <entry>Distribution-specific configuration file</entry>
-
-                <entry>/etc/default/<replaceable>product</replaceable></entry>
-              </row>
-
-              <row>
-                <entry>Init Scripts</entry>
-
-                <entry>/etc/init.d/<replaceable>product</replaceable></entry>
-              </row>
-
-              <row>
-                <entry>ifupdown scripts from Shorewall-init</entry>
-
-                <entry>/etc/network/if-up.d/shorewall,
-                /etc/network/if-post-down.d/shorewall</entry>
-              </row>
-
-              <row>
-                <entry>ppp ifupdown scripts from Shorewall-init</entry>
-
-                <entry>/etc/ppp/ip-up.d/shorewall,
-                /etc/ppp/ip-down.d/shorewall /etc/ppp/ipv6-up.d/shorewall
-                /etc/ppp/ipv6-down.d/shorewall</entry>
-              </row>
-            </tbody>
-          </tgroup>
-        </informaltable>
-      </section>
-
-      <section>
-        <title>Redhat and Derivatives</title>
-
-        <informaltable>
-          <tgroup cols="2">
-            <tbody>
-              <row>
-                <entry><emphasis role="bold">COMPONENT</emphasis></entry>
-
-                <entry><emphasis role="bold">LOCATION</emphasis></entry>
-              </row>
-
-              <row>
-                <entry>CLI programs</entry>
-
-                <entry>/sbin/<replaceable>product</replaceable></entry>
-              </row>
-
-              <row>
-                <entry>Distribution-specific configuration file</entry>
-
-                <entry>/etc/sysconfig/<replaceable>product</replaceable></entry>
-              </row>
-
-              <row>
-                <entry>Init Scripts</entry>
-
-                <entry>/etc/rc.d/init.d/<replaceable>product</replaceable></entry>
-              </row>
-
-              <row>
-                <entry>ifupdown scripts from Shorewall-init</entry>
-
-                <entry>/sbin/ifup-local, /sbin/ifdown-local</entry>
-              </row>
-
-              <row>
-                <entry>ppp ifupdown scripts from Shorewall-init</entry>
-
-                <entry>/etc/ppp/ip-up.local, /etc/ppp/ip-down.local</entry>
-              </row>
-            </tbody>
-          </tgroup>
-        </informaltable>
-      </section>
-
-      <section>
-        <title>SuSE</title>
-
-        <informaltable>
-          <tgroup cols="2">
-            <tbody>
-              <row>
-                <entry><emphasis role="bold">COMPONENT</emphasis></entry>
-
-                <entry><emphasis role="bold">LOCATION</emphasis></entry>
-              </row>
-
-              <row>
-                <entry>CLI programs</entry>
-
-                <entry>/sbin/<replaceable>product</replaceable></entry>
-              </row>
-
-              <row>
-                <entry>Distribution-specific configuration file</entry>
-
-                <entry>/etc/sysconfig/<replaceable>product</replaceable></entry>
-              </row>
-
-              <row>
-                <entry>Init Scripts</entry>
-
-                <entry>/etc/init.d/<replaceable>product</replaceable></entry>
-              </row>
-
-              <row>
-                <entry>ifupdown scripts from Shorewall-init</entry>
-
-                <entry>/etc/sysconfig/network/if-up.d/shorewall,
-                /etc/sysconfig/network/if-down.d/shorewall</entry>
-              </row>
-
-              <row>
-                <entry>ppp ifupdown scripts from Shorewall-init</entry>
-
-                <entry>/etc/ppp/ip-up.d/shorewall,
-                /etc/ppp/ip-down.d/shorewall /etc/ppp/ipv6-up.d/shorewall
-                /etc/ppp/ipv6-down.d/shorewall</entry>
-              </row>
-            </tbody>
-          </tgroup>
-        </informaltable>
-      </section>
-
-      <section>
-        <title>Cygwin</title>
-
-        <informaltable>
-          <tgroup cols="2">
-            <tbody>
-              <row>
-                <entry><emphasis role="bold">COMPONENT</emphasis></entry>
-
-                <entry><emphasis role="bold">LOCATION</emphasis></entry>
-              </row>
-
-              <row>
-                <entry>CLI programs</entry>
-
-                <entry>/bin/<replaceable>product</replaceable></entry>
-              </row>
-
-              <row>
-                <entry>Distribution-specific configuration file</entry>
-
-                <entry>N/A</entry>
-              </row>
-
-              <row>
-                <entry>Init Scripts</entry>
-
-                <entry>N/A</entry>
-              </row>
-
-              <row>
-                <entry>ifupdown scripts from Shorewall-init</entry>
-
-                <entry>N/A</entry>
-              </row>
-
-              <row>
-                <entry>ppp ifupdown scripts from Shorewall-init</entry>
-
-                <entry>N/A</entry>
-              </row>
-            </tbody>
-          </tgroup>
-        </informaltable>
-      </section>
-
-      <section>
-        <title>OS X</title>
-
-        <informaltable>
-          <tgroup cols="2">
-            <tbody>
-              <row>
-                <entry><emphasis role="bold">COMPONENT</emphasis></entry>
-
-                <entry><emphasis role="bold">LOCATION</emphasis></entry>
-              </row>
-
-              <row>
-                <entry>CLI programs</entry>
-
-                <entry>/sbin/<replaceable>product</replaceable></entry>
-              </row>
-
-              <row>
-                <entry>Distribution-specific configuration file</entry>
-
-                <entry>N/A</entry>
-              </row>
-
-              <row>
-                <entry>Init Scripts</entry>
-
-                <entry>N/A</entry>
-              </row>
-
-              <row>
-                <entry>ifupdown scripts from Shorewall-init</entry>
-
-                <entry>N/A</entry>
-              </row>
-
-              <row>
-                <entry>ppp ifupdown scripts from Shorewall-init</entry>
-
-                <entry>N/A</entry>
-              </row>
-            </tbody>
-          </tgroup>
-        </informaltable>
-      </section>
-    </section>
   </section>
 
   <section id="Debian">
@@ -723,37 +406,17 @@ Pin-Priority: 700</programlisting><emphasis role="bold"><emphasis>Then
         issues</ulink> for specific instructions.</para>
       </important></para>
 
-    <para>If you are upgrading to version 4.5.0 or later, you must first
-    install or upgrade the Shorewall-core package:</para>
-
-    <orderedlist>
-      <listitem>
-        <para>unpack the tarballs:<programlisting><command>tar -jxf shorewall-core-4.5.0.tar.bz2</command></programlisting></para>
-      </listitem>
-
-      <listitem>
-        <para>cd to the shorewall directory (the version is encoded in the
-        directory name as in <quote>shorewall-core-4.5.0</quote>).</para>
-      </listitem>
-
-      <listitem>
-        <para>Type:</para>
-
-        <programlisting><command>./install.sh </command></programlisting>
-      </listitem>
-    </orderedlist>
-
     <para>If you already have Shorewall installed and are upgrading to a new
     version using the tarball:</para>
 
     <orderedlist>
       <listitem>
-        <para>unpack the tarball:<programlisting><command>tar -jxf shorewall-4.5.0.tar.bz2</command></programlisting></para>
+        <para>unpack the tarball:<programlisting><command>tar -jxf shorewall-4.3.5.tar.bz2</command></programlisting></para>
       </listitem>
 
       <listitem>
         <para>cd to the shorewall-perl directory (the version is encoded in
-        the directory name as in <quote>shorewall-4.5.0</quote>).</para>
+        the directory name as in <quote>shorewall-4.3.5</quote>).</para>
       </listitem>
 
       <listitem>

docs/Introduction.xml

@@ -16,7 +16,7 @@
     <pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
 
     <copyright>
-      <year>2003-2012</year>
+      <year>2003-2009</year>
 
       <holder>Thomas M. Eastep</holder>
     </copyright>
@@ -385,14 +385,9 @@ ACCEPT     net           $FW       tcp        22</programlisting>
   <section id="Packages">
     <title>Shorewall Packages</title>
 
-    <para>Shorewall 4.5 and later consists of six packages.</para>
+    <para>Shorewall 4.3 and later consists of four packages.</para>
 
     <orderedlist>
-      <listitem>
-        <para><emphasis role="bold">Shorewall-core</emphasis>. All of the
-        other packages depend on this one.</para>
-      </listitem>
-
       <listitem>
         <para><emphasis role="bold">Shorewall</emphasis>. This package must be
         installed on at least one system in your network. It contains
@@ -422,13 +417,6 @@ ACCEPT     net           $FW       tcp        22</programlisting>
         scripts are generated. These scripts are copied to the firewall
         systems where they run under the control of Shorewall6-lite.</para>
       </listitem>
-
-      <listitem>
-        <para><emphasis role="bold">Shorewall-init</emphasis>. May be
-        installed with any of the other firewall packages. Allows the firewall
-        to be close prior to bringing up network interfaces. It can also react
-        to interface up/down events.</para>
-      </listitem>
     </orderedlist>
   </section>
 

docs/MultiISP.xml

@@ -117,7 +117,7 @@
           ISP.</para>
         </footnote> as in the following diagram.</para>
 
-      <graphic align="center" fileref="images/TwoISPs.png" valign="middle"/>
+      <graphic align="center" fileref="images/TwoISPs.png" valign="middle" />
 
       <itemizedlist>
         <listitem>
@@ -1578,11 +1578,8 @@ DOWN_COUNT=2</programlisting>
 return $status</programlisting></para>
 
         <para>The above script is installed in <filename
-        class="directory">/etc/shorewall</filename> in Shorewall releases
+        class="directory">/etc/shorewall</filename>, beginning with Shorewall
-        4.3.11 - 4.5.0. Beginning with Shorewall 4.5.1, it is no longer
+        4.3.11.</para>
-        installed in <filename class="directory">/etc/shorewall</filename>,
-        but may be copied there from <filename
-        class="directory">/usr/share/shorewall/configfiles</filename>.</para>
 
         <para>Also included is a sample init script
         (<filename>swping.init</filename>) to start the monitoring daemon.
@@ -2091,7 +2088,7 @@ exit 0
       on ursa that I will describe here</emphasis>.</para>
 
       <para>Below is a diagram of our network:<graphic align="center"
-      fileref="images/Network2008a.png"/></para>
+      fileref="images/Network2008a.png" /></para>
 
       <para>The local wired network in my office is connected to both gateways
       and uses the private (RFC 1918) network 172.20.1.0/24. The Comcast
@@ -2245,7 +2242,7 @@ wlan0                   192.168.0.0/24</programlisting><note>
 
     <para>The network is pictured in the following diagram:</para>
 
-    <graphic align="center" fileref="images/Network2009.png"/>
+    <graphic align="center" fileref="images/Network2009.png" />
 
     <para>Because of the speed of the cable provider, all traffic uses that
     provider unless there is a specific need for the traffic to use the DSL

docs/configuration_file_basics.xml

@@ -190,9 +190,9 @@
         </listitem>
 
         <listitem>
-          <para><filename>/etc/shorewall/rtrules</filename> - Defines routing
+          <para><filename>/etc/shorewall/rtrules</filename> - Defines
-          rules to be used in conjunction with the routing tables defined in
+          routing rules to be used in conjunction with the routing tables
-          <filename>/etc/shorewall/providers</filename>.</para>
+          defined in <filename>/etc/shorewall/providers</filename>.</para>
         </listitem>
 
         <listitem>
@@ -1287,11 +1287,6 @@ SHELL cat /etc/shorewall/rules.d/*.rules 2&gt; /dev/null || true</programlisting
         <para><ulink url="Macros.html">Macro</ulink> files</para>
       </listitem>
 
-      <listitem>
-        <para><ulink
-        url="manpages/shorewall-nat.html">shorewall-nat</ulink>(5)</para>
-      </listitem>
-
       <listitem>
         <para><ulink
         url="manpages/shorewall-rules.html">shorewall-rules</ulink> (5)</para>
@@ -1329,88 +1324,8 @@ SHELL cat /etc/shorewall/rules.d/*.rules 2&gt; /dev/null || true</programlisting
     </itemizedlist>
 
     <para>For optional interfaces, if the interface is not usable at the time
-    that the firewall starts, one of two approaches are taken, depending on
+    that the firewall starts the all-zero address will be used (0.0.0.0 in
-    the context:</para>
+    IPv4 and :: in IPv6), resulting in no packets matching the rule.</para>
-
-    <itemizedlist>
-      <listitem>
-        <para>the all-zero address will be used (0.0.0.0 in IPv4 and :: in
-        IPv6), resulting in no packets matching the rule (or all packets if
-        used with exclusion).</para>
-      </listitem>
-
-      <listitem>
-        <para>the entire rule is omitted from the ruleset.</para>
-      </listitem>
-    </itemizedlist>
-
-    <para>Beginning with Shorewall 4.5.1, <firstterm>Run-time Gateway
-    Variables</firstterm> in the form of a percent sign ('%') followed by a
-    logical interface name are also supported. These are expanded at run-time
-    to the gateway through the named interface. For optional interfaces, if
-    the interface is not usable at the time that the firewall starts, the nil
-    address will be used (0.0.0.0 in IPv4 and :: in IPv6), resulting in no
-    packets matching the rule. Run-time gateway variables may be used in the
-    SOURCE and DEST columns of the following configuration files:</para>
-
-    <itemizedlist>
-      <listitem>
-        <para><ulink
-        url="manapges/shorewall-accounting.html">shorewall-accounting</ulink>
-        (5)</para>
-      </listitem>
-
-      <listitem>
-        <para><ulink url="Actions.html">Action</ulink> files</para>
-      </listitem>
-
-      <listitem>
-        <para><ulink
-        url="manpages/shorewall-accounting.html">shorewall-blacklist</ulink>
-        (5)</para>
-      </listitem>
-
-      <listitem>
-        <para><ulink url="Macros.html">Macro</ulink> files</para>
-      </listitem>
-
-      <listitem>
-        <para><ulink
-        url="manpages/shorewall-nat.html">shorewall-nat</ulink>(5) (As a
-        qualifier to the INTERFACE).</para>
-      </listitem>
-
-      <listitem>
-        <para><ulink
-        url="manpages/shorewall-rules.html">shorewall-rules</ulink> (5)</para>
-      </listitem>
-
-      <listitem>
-        <para><ulink
-        url="manpages/shorewall-tcrules.html">shorewall-tcrules</ulink>
-        (5)</para>
-      </listitem>
-
-      <listitem>
-        <para><ulink url="manpages/shorewall-tos.html">shorewall-tos</ulink>
-        (5)</para>
-      </listitem>
-    </itemizedlist>
-
-    <variablelist>
-      <varlistentry>
-        <term>Example:</term>
-
-        <listitem>
-          <para><emphasis role="bold">%eth0</emphasis> would represent the IP
-          address of the gateway out of eth0.</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-
-    <para>If there is no gateway out of the named interface, the nil IP
-    address is used (0.0.0.0 in IPv4 and :: in IPv6). That way, the generated
-    rule will match no packets (or all packets if used with exclusion).</para>
 
     <para>Beginning with Shorewall 4.4.27, you may also use options in <ulink
     url="manpages/shorewall.conf.html">shorewall.conf</ulink> (5) (e.g.,
@@ -1418,7 +1333,7 @@ SHELL cat /etc/shorewall/rules.d/*.rules 2&gt; /dev/null || true</programlisting
 
     <note>
       <para>When an option is set to 'No' in shorewall.conf, the corresponding
-      shell variable will be empty.</para>
+      shell variable is will be empty.</para>
     </note>
 
     <note>
@@ -1438,9 +1353,7 @@ SHELL cat /etc/shorewall/rules.d/*.rules 2&gt; /dev/null || true</programlisting
     richer and more flexible extension capability.</para>
 
     <para>While inline scripts may be written in either Shell or Perl, those
-    written in Perl have a lot more power. They may be used in all
+    written in Perl have a lot more power.</para>
-    configuration files except <filename>/etc/shorewall/params</filename> and
-    <filename>/etc/shorewall/shorewall.conf</filename>.</para>
 
     <para>Embedded scripts can be either single-line or multi-line. Single
     line scripts take one of the following forms:</para>

docs/support.xml

@@ -85,7 +85,7 @@
     problem reporting process. It will ensure that you provide us with the
     information we need to solve your problem as quickly as possible.</para>
 
-    <graphic align="center" fileref="images/Troubleshoot.png"/>
+    <graphic align="center" fileref="images/Troubleshoot.png" />
 
     <orderedlist>
       <important>
@@ -203,7 +203,7 @@
         message produced by Shorewall is "done.":</para>
 
         <blockquote>
-          <para/>
+          <para></para>
 
           <programlisting>…
 Activating Rules...
@@ -457,7 +457,9 @@ State:Stopped (Thu Mar 30 14:08:11 PDT 2006)</programlisting>
   <section id="Unsubscribe">
     <title>Unsubscribing from Shorewall Mailing Lists</title>
 
-    <para>See <ulink url="FAQ.htm#faq98">Shorewall FAQ 98</ulink>.</para>
+    <para>If you are really dim-witted enough to have to ask -- you
+    unsubscribe at the same place that you subscribed. <emphasis
+    role="bold">Doh.......</emphasis></para>
   </section>
 
   <section id="Other">

docs/upgrade_issues.xml

@@ -31,11 +31,9 @@
 
       <year>2009</year>
 
-      <year>2012</year>
-
       <holder>Thomas M. Eastep</holder>
 
-      <holder/>
+      <holder></holder>
     </copyright>
 
     <legalnotice>
@@ -76,44 +74,6 @@
     zones.</para>
   </section>
 
-  <section>
-    <title>Versions &gt;= 4.5.0</title>
-
-    <orderedlist>
-      <listitem>
-        <para>Shorewall, Shorewall6, Shorewall-lite and Shorewall6-lite now
-        depend on the new package Shorewall-core. If you use the Shorewall
-        installers, you must install Shorewall-core prior to installing or
-        upgrading any of the other packages.</para>
-      </listitem>
-
-      <listitem>
-        <para>The BLACKLIST section of the rules file has been eliminated. If
-        you have entries in that file section, you must move them to the
-        blrules file.</para>
-      </listitem>
-
-      <listitem>
-        <para>This version of Shorewall requires the Digest::SHA1 Perl
-        module.</para>
-
-        <simplelist>
-          <member>Debian: libdigest-sha1-perl</member>
-
-          <member>Fedora: perl-Digest-SHA1</member>
-
-          <member>OpenSuSE: perl-Digest-SHA1</member>
-        </simplelist>
-      </listitem>
-
-      <listitem>
-        <para>The generated firewall script now maintains the
-        /var/lib/shorewall[6][-lite]/interface.status files used by SWPING and
-        by LSM.</para>
-      </listitem>
-    </orderedlist>
-  </section>
-
   <section>
     <title>Versions &gt;= 4.4.0</title>
 
@@ -358,7 +318,7 @@
       </listitem>
 
       <listitem>
-        <para>Beginning with Shorewall 4.4.17, the EXPORTPARAMS option is
+        <para> Beginning with Shorewall 4.4.17, the EXPORTPARAMS option is
         deprecated. With EXPORTPARAMS=No, the variables set by <ulink
         url="manpages/shorewall-params.html">/etc/shorewall/params</ulink>
         (<ulink