Complete removal of optimize level 4 when level 4 is set.

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/configure

@@ -56,7 +56,7 @@ getfileparams() {
 	esac
 
     done
-    
+
     return 0
 }
 
@@ -70,7 +70,7 @@ for p in $@; do
 	pv=${p#*=}
 
 	if [ -n "${pn}" ]; then
-	    
+
 	    case ${pn} in
 		VENDOR)
 		    pn=HOST
@@ -85,7 +85,7 @@ for p in $@; do
 		    pn=CONFDIR
 		    ;;
 	    esac
-    
+
 	    params[${pn}]="${pv}"
 	else
 	    echo "ERROR: Invalid option ($p)" >&2
@@ -102,7 +102,7 @@ if [ -z "$vendor" ]; then
 	    $params[HOST]=apple
 	    rcfile=shorewallrc.apple
 	    ;;
-	
+
 	cygwin*)
 	    $params[HOST]=cygwin
 	    rcfile=shorewallrc.cygwin
@@ -159,7 +159,7 @@ echo '#'                                                                 > shore
 echo "# Created by Shorewall Core version $VERSION configure - " `date` >> shorewallrc
 echo '#'                                                                >> shorewallrc
 
-if [ -n "$@" ]; then
+if [ $# -gt 0 ]; then
     echo "# Input: $@" >> shorewallrc
     echo '#'           >> shorewallrc
 fi
@@ -181,6 +181,7 @@ for on in \
     SYSTEMD \
     SYSCONFFILE \
     SYSCONFDIR \
+    SPARSE \
     ANNOTATED \
     VARDIR
 do

Shorewall-core/configure.pl

@@ -30,7 +30,7 @@ use strict;
 #
 # Build updates this
 #
-use constant { 
+use constant {
     VERSION => '4.5.2.1'
 };
 
@@ -131,7 +131,7 @@ for ( qw/ HOST
 	  PERLLIBDIR
 	  CONFDIR
 	  SBINDIR
-	  MANDIR 
+	  MANDIR
 	  INITDIR
 	  INITSOURCE
 	  INITFILE
@@ -140,6 +140,7 @@ for ( qw/ HOST
 	  SYSTEMD
 	  SYSCONFFILE
 	  SYSCONFDIR
+	  SPARSE
 	  ANNOTATED
 	  VARDIR / ) {
 

Shorewall-core/install.sh

@@ -33,7 +33,7 @@ usage() # $1 = exit status
     exit $1
 }
 
-fatal_error() 
+fatal_error()
 {
     echo "   ERROR: $@" >&2
     exit 1
@@ -91,7 +91,7 @@ install_file() # $1 = source $2 = target $3 = mode
     run_install $T $OWNERSHIP -m $3 $1 ${2}
 }
 
-require() 
+require()
 {
     eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
 }
@@ -307,6 +307,16 @@ chmod 755 ${DESTDIR}${SBINDIR}
 mkdir -p ${DESTDIR}${MANDIR}
 chmod 755 ${DESTDIR}${MANDIR}
 
+if [ -n "${INITFILE}" ]; then
+    mkdir -p ${DESTDIR}${INITDIR}
+    chmod 755 ${DESTDIR}${INITDIR}
+
+    if [ -n "$AUXINITSOURCE" -a -f "$AUXINITSOURCE" ]; then
+	install_file $AUXINITSOURCE ${DESTDIR}${INITDIR}/$AUXINITFILE 0544
+	[ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${INITDIR}/$AUXINITFILE
+	echo  "$Product script installed in ${DESTDIR}${INITDIR}/$AUXINITFILE"
+    fi
+fi
 #
 # Note: ${VARDIR} is created at run-time since it has always been
 #       a relocatable directory on a per-product basis

Shorewall-core/lib.base

@@ -28,7 +28,7 @@
 #
 
 SHOREWALL_LIBVERSION=40502
-SHOREWALL_CAPVERSION=40502
+SHOREWALL_CAPVERSION=40504
 
 [ -n "${g_program:=shorewall}" ]
 
@@ -41,6 +41,7 @@ if [ -z "$g_readrc" ]; then
     g_libexec="$LIBEXECDIR"
     g_sharedir="$SHAREDIR"/$g_program
     g_sbindir="$SBINDIR"
+    g_perllib="$PERLLIBDIR"
     g_vardir="$VARDIR"
     g_confdir="$CONFDIR"/$g_program
     g_readrc=1

Shorewall-core/lib.cli

@@ -31,9 +31,11 @@ if [ -z "$g_readrc" ]; then
     . /usr/share/shorewall/shorewallrc
 
     g_libexec="$LIBEXECDIR"
-    g_sbindir="$SBINDIR"
-    g_confdir="$CONFDIR"/$g_program
     g_sharedir="$SHAREDIR"/$g_program
+    g_sbindir="$SBINDIR"
+    g_perllib="$PERLLIBDIR"
+    g_vardir="$VARDIR"
+    g_confdir="$CONFDIR"/$g_program
     g_readrc=1
 fi
 
@@ -432,7 +434,7 @@ save_config() {
 # order we all know and love
 #
 sort_routes() {
-    local dest 
+    local dest
     local rest
     local crvsn
 
@@ -454,16 +456,28 @@ sort_routes() {
     done | sort -r | while read dest rest; do echo $rest; done
 }
 
+#
+# Isolate the table in the routing rules being read from stdin.
+# Piping through sed to remove trailing whitespace works around
+# recent 'features' in dash and ip.
+#
+find_tables() {
+    sed -r 's/[[:space:]]+$//' | while read rule; do
+	echo ${rule##* }
+    done
+}
+
 #
 # Show routing configuration
 #
 show_routing() {
+    local rule
+    local table
+
     if [ -n "$(ip -$g_family rule list)" ]; then
 	heading "Routing Rules"
 	ip -$g_family rule list
-	ip -$g_family rule list | while read rule; do
-	    echo ${rule##* }
-	done | sort -u | while read table; do
+	ip -$g_family rule list | find_tables | sort -u | while read table; do
 	    heading "Table $table:"
 	    if [ $g_family -eq 6 ]; then
 		ip -$g_family -o route list table $table | fgrep -v cache
@@ -1015,12 +1029,12 @@ perip_accounting() {
 
 	if [ -n "$hnames" ]; then
 	    for hname in $hnames; do
-		iptaccount -l $hname | egrep '^IP:|^Show' 
+		iptaccount -l $hname | egrep '^IP:|^Show'
 		echo
 	    done
 	else
 	    echo "   No IP Accounting Tables Defined"
-	    echo 
+	    echo
 	fi
     else
 	echo "   iptaccount is not installed"
@@ -1245,7 +1259,7 @@ do_dump_command() {
 	netstat -${g_family}tunap
     else
 	netstat -tunap
-    fi	
+    fi
 
     if [ -n "$TC_ENABLED" ]; then
 	heading "Traffic Control"
@@ -1980,6 +1994,7 @@ determine_capabilities() {
     IMQ_TARGET=
     DSCP_MATCH=
     DSCP_TARGET=
+    GEOIP_MATCH=
 
     chain=fooX$$
 
@@ -2022,11 +2037,11 @@ determine_capabilities() {
 	qt $g_tool -A $chain -m conntrack --ctorigdst 192.168.1.1 -j ACCEPT && CONNTRACK_MATCH=Yes
     else
 	qt $g_tool -A $chain -m conntrack --ctorigdst ::1 -j ACCEPT && CONNTRACK_MATCH=Yes
-    fi	
+    fi
 
     if [ -n "$CONNTRACK_MATCH" ]; then
 	qt $g_tool -A $chain -m conntrack -p tcp --ctorigdstport 22 -j ACCEPT && NEW_CONNTRACK_MATCH=Yes
-	
+
 	if [ $g_family -eq 4 ]; then
 	    qt $g_tool -A $chain -m conntrack ! --ctorigdst 1.2.3.4 || OLD_CONNTRACK_MATCH=Yes
 	else
@@ -2115,7 +2130,7 @@ determine_capabilities() {
 
 	qt $g_tool -t mangle -F $chain
 	qt $g_tool -t mangle -X $chain
-	
+
 	qt $g_tool -t mangle -L FORWARD -n && MANGLE_FORWARD=Yes
     fi
 
@@ -2188,6 +2203,7 @@ determine_capabilities() {
     qt $g_tool -A $chain -j NFLOG && NFLOG_TARGET=Yes
     qt $g_tool -A $chain -j MARK --set-mark 5 && MARK_ANYWHERE=Yes
     qt $g_tool -A $chain -m statistic --mode nth --every 2 --packet 1 && STATISTIC_MATCH=Yes
+    qt $g_tool -A $chain -m geoip --src-cc US && GEOIP_MATCH=Yes
 
     if [ $g_family -eq 4 ]; then
 	qt $g_tool -A $chain -j ACCOUNT --addr 192.168.1.0/29 --tname $chain && ACCOUNT_TARGET=Yes
@@ -2209,10 +2225,10 @@ determine_capabilities() {
     [ -n "$IP" ] && $IP rule add help 2>&1 | grep -q /MASK && FWMARK_RT_MASK=Yes
 
     CAPVERSION=$SHOREWALL_CAPVERSION
-   
+
     KERNELVERSION=$(uname -r 2> /dev/null | sed -e 's/-.*//')
 
-    case "$KERNELVERSION" in 
+    case "$KERNELVERSION" in
 	*.*.*)
 	    KERNELVERSION=$(printf "%d%02d%02d" $(echo $KERNELVERSION | sed -e 's/^\([0-9][0-9]*\)\.\([0-9][0-9]*\)\.\([0-9][0-9]*\).*$/\1 \2 \3/g'))
 	    ;;
@@ -2302,7 +2318,8 @@ report_capabilities() {
 	report_capability "IMQ Target (IMQ_TARGET)" $IMQ_TARGET
 	report_capability "DSCP Match (DSCP_MATCH)" $DSCP_MATCH
 	report_capability "DSCP Target (DSCP_TARGET)" $DSCP_TARGET
-	
+	report_capability "Geo IP match" $GEOIP_MATCH
+
 	if [ $g_family -eq 4 ]; then
 	    report_capability "iptables -S (IPTABLES_S)" $IPTABLES_S
 	else
@@ -2392,6 +2409,7 @@ report_capabilities1() {
     report_capability1 IMQ_TARGET
     report_capability1 DSCP_MATCH
     report_capability1 DSCP_TARGET
+    report_capability1 GEOIP_MATCH
 
     echo CAPVERSION=$SHOREWALL_CAPVERSION
     echo KERNELVERSION=$KERNELVERSION
@@ -2522,7 +2540,7 @@ forget_command() {
 ipcalc_command() {
     local address
     local vlsm
-    
+
     [ $g_family -eq 6 ] && usage 1
 
     if [ $# -eq 2 ]; then
@@ -2553,7 +2571,7 @@ iprange_command() {
 
     [ $g_family -eq 6 ] && usage 1
 
-    range=''	
+    range=''
 
     while [ $# -gt 0 ]; do
 	shift
@@ -2615,7 +2633,7 @@ get_config() {
     ensure_config_path
 
     config=$(find_file ${g_program}.conf)
-    
+
     if [ -f $config ]; then
 	if [ -r $config ]; then
 	    . $config
@@ -2662,7 +2680,7 @@ get_config() {
 		echo "   ERROR: The program specified in IPTABLES does not exist or is not executable" >&2
 		exit 2
 	    fi
-	else	 
+	else
 	    IPTABLES=$(mywhich iptables 2> /dev/null)
 	    if [ -z "$IPTABLES" ] ; then
 		echo "   ERROR: Can't find iptables executable" >&2
@@ -2677,7 +2695,7 @@ get_config() {
 		echo "   ERROR: The program specified in IP6TABLES does not exist or is not executable" >&2
 		exit 2
 	    fi
-	else	 
+	else
 	    IP6TABLES=$(mywhich ip6tables 2> /dev/null)
 	    if [ -z "$IP6TABLES" ] ; then
 		echo "   ERROR: Can't find ip6tables executable" >&2
@@ -2734,7 +2752,7 @@ verify_firewall_script() {
 	else
 	    echo "          The file $g_firewall does not exist" >&2
 	fi
-	
+
 	exit 2
     fi
 }
@@ -3175,7 +3193,7 @@ shorewall_cli() {
 	    [ $# -eq 1 ] || usage 1
 	    [ "$(id -u)" != 0 ] && fatal_error "The status command may only be run by root"
 	    get_config
-	    status_command 
+	    status_command
 	    ;;
 	dump)
 	    get_config Yes No Yes
@@ -3285,6 +3303,6 @@ shorewall_cli() {
 	    else
 		usage 1
 	    fi
-	    ;; 
+	    ;;
     esac
 }

Shorewall-core/lib.common

@@ -593,7 +593,7 @@ find_first_interface_address() # $1 = interface
 	#
 	[ -n "$addr" ] || startup_error "Can't determine the IP address of $1"
 	#
-	# Strip off the trailing VLSM mask (or the peer IP in case of a P-t-P link)	
+	# Strip off the trailing VLSM mask (or the peer IP in case of a P-t-P link)
 	# along with everything else on the line
 	#
 	echo $addr | sed 's/\s*inet //;s/\/.*//;s/ peer.*//'

Shorewall-core/shorewallrc.cygwin

@@ -16,5 +16,5 @@ INITSOURCE=                           #Unused on Cygwin
 ANNOTATED=                            #Unused on Cygwin
 SYSTEMD=                              #Unused on Cygwin
 SYSCONFDIR=                           #Unused on Cygwin
-SPARSE=Yes                            #Only install $PRODUCT/$PRODUCT.conf in $CONFDIR.                     
+SPARSE=Yes                            #Only install $PRODUCT/$PRODUCT.conf in $CONFDIR.
 VARDIR=/var/lib                       #Unused on Cygwin

Shorewall-core/shorewallrc.debian

@@ -9,7 +9,7 @@ LIBEXECDIR=${PREFIX}/share              #Directory for executable scripts.
 PERLLIBDIR=${PREFIX}/share/shorewall    #Directory to install Shorewall Perl module directory
 CONFDIR=/etc                            #Directory where subsystem configurations are installed
 SBINDIR=/sbin                           #Directory where system administration programs are installed
-MANDIR=${PREFIX}/man                    #Directory where manpages are installed.
+MANDIR=${PREFIX}/share/man              #Directory where manpages are installed.
 INITDIR=/etc/init.d                     #Directory where SysV init scripts are installed.
 INITFILE=$PRODUCT                       #Name of the product's installed SysV init script
 INITSOURCE=init.debian.sh               #Name of the distributed file to be installed as the SysV init script

Shorewall-core/shorewallrc.redhat

@@ -6,7 +6,7 @@ HOST=redhat
 PREFIX=/usr                             #Top-level directory for shared files, libraries, etc.
 SHAREDIR=${PREFIX}/share                #Directory for arch-neutral files.
 LIBEXECDIR=${PREFIX}/libexec            #Directory for executable scripts.
-PERLLIBDIR=/usr/share/perl5             #Directory to install Shorewall Perl module directory
+PERLLIBDIR=/usr/share/perl5/vendor_perl #Directory to install Shorewall Perl module directory
 CONFDIR=/etc                            #Directory where subsystem configurations are installed
 SBINDIR=/sbin                           #Directory where system administration programs are installed
 MANDIR=${SHAREDIR}/man                  #Directory where manpages are installed.

Shorewall-core/shorewallrc.slackware

@@ -11,10 +11,10 @@ CONFDIR=/etc                               #Directory where subsystem configurat
 SBINDIR=/sbin                              #Directory where system administration programs are installed
 MANDIR=${PREFIX}/man                       #Directory where manpages are installed.
 INITDIR=/etc/rc.d                          #Directory where SysV init scripts are installed.
-INITSOURCE=init.slackware.firewall         #Name of the distributed file to be installed as the SysV init script
-INITFILE=rc.firewall                       #Name of the product's installed SysV init script
-AUXINITSOURCE=init.slackware.$PRODUCT      #Name of the distributed file to be installed as a second SysV init script
-AUXINITFILE=rc.$PRODUCT                    #Name of the product's installed second init script
+AUXINITSOURCE=init.slackware.firewall.sh   #Name of the distributed file to be installed as the SysV init script
+AUXINITFILE=rc.firewall                    #Name of the product's installed SysV init script
+INITSOURCE=init.slackware.$PRODUCT.sh      #Name of the distributed file to be installed as a second SysV init script
+INITFILE=rc.$PRODUCT                       #Name of the product's installed second init script
 SYSTEMD=                                   #Name of the directory where .service files are installed (systems running systemd only)
 SYSCONFFILE=                               #Name of the distributed file to be installed in $SYSCONFDIR
 SYSCONFDIR=                                #Name of the directory where SysV init parameter files are installed.

Shorewall-lite/Makefile

@@ -3,9 +3,9 @@ VARDIR=$(shell /sbin/shorewall-lite show vardir)
 SHAREDIR=/usr/share/shorewall-lite
 RESTOREFILE?=.restore
 
-all: $(VARDIR)/${RESTOREFILE}
+all: $(VARDIR)/$(RESTOREFILE)
 
-$(VARDIR)/${RESTOREFILE}: $(VARDIR)/firewall
+$(VARDIR)/$(RESTOREFILE): $(VARDIR)/firewall
 	@/sbin/shorewall-lite -q save >/dev/null; \
 	if \
 	    /sbin/shorewall-lite -q restart >/dev/null 2>&1; \

Shorewall-lite/init.debian.sh

@@ -23,7 +23,7 @@ export SHOREWALL_INIT_SCRIPT
 test -x $SRWL || exit 0
 test -x $WAIT_FOR_IFUP || exit 0
 test -n "$INITLOG" || {
-	echo "INITLOG cannot be empty, please configure $0" ; 
+	echo "INITLOG cannot be empty, please configure $0" ;
 	exit 1;
 }
 
@@ -35,9 +35,9 @@ fi
 
 echo_notdone () {
 
-  if [ "$INITLOG" = "/dev/null" ] ; then 
+  if [ "$INITLOG" = "/dev/null" ] ; then
 	  echo "not done."
-  else 
+  else
 	  echo "not done (check $INITLOG)."
   fi
 

Shorewall-lite/init.fedora.sh

@@ -41,10 +41,10 @@ start() {
     echo -n $"Starting Shorewall: "
     $shorewall $OPTIONS start 2>&1 | $logger
     retval=${PIPESTATUS[0]}
-    if [[ $retval == 0 ]]; then 
+    if [[ $retval == 0 ]]; then
 	touch $lockfile
 	success
-    else 
+    else
 	failure
     fi
     echo
@@ -55,10 +55,10 @@ stop() {
     echo -n $"Stopping Shorewall: "
     $shorewall $OPTIONS stop 2>&1 | $logger
     retval=${PIPESTATUS[0]}
-    if [[ $retval == 0 ]]; then 
+    if [[ $retval == 0 ]]; then
 	rm -f $lockfile
 	success
-    else 
+    else
 	failure
     fi
     echo
@@ -71,7 +71,7 @@ restart() {
     echo -n $"Restarting Shorewall: "
     $shorewall $OPTIONS restart 2>&1 | $logger
     retval=${PIPESTATUS[0]}
-    if [[ $retval == 0 ]]; then 
+    if [[ $retval == 0 ]]; then
 	touch $lockfile
 	success
     else # Failed to start, clean up lock file if present

Shorewall-lite/install.sh

@@ -33,7 +33,7 @@ usage() # $1 = exit status
     exit $1
 }
 
-fatal_error() 
+fatal_error()
 {
     echo "   ERROR: $@" >&2
     exit 1
@@ -91,7 +91,7 @@ install_file() # $1 = source $2 = target $3 = mode
     run_install $T $OWNERSHIP -m $3 $1 ${2}
 }
 
-require() 
+require()
 {
     eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
 }
@@ -118,7 +118,7 @@ while [ $finished -eq 0 ] ; do
     case "$1" in
 	-*)
 	    option=${option#-}
-	    
+
 	    while [ -n "$option" ]; do
 		case $option in
 		    h)
@@ -268,7 +268,7 @@ if [ -n "$DESTDIR" ]; then
 	echo "Not setting file owner/group permissions, not running as root."
 	OWNERSHIP=""
     fi
-    
+
     install -d $OWNERSHIP -m 755 ${DESTDIR}/${SBINDIR}
     install -d $OWNERSHIP -m 755 ${DESTDIR}${INITDIR}
 
@@ -496,6 +496,7 @@ if [ -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${mac}" ]; then
 	echo "Set startup=1 in ${SYSCONFDIR}/$PRODUCT to enable"
 	touch /var/log/$PRODUCT-init.log
 	perl -p -w -i -e 's/^STARTUP_ENABLED=No/STARTUP_ENABLED=Yes/;s/^IP_FORWARDING=On/IP_FORWARDING=Keep/;s/^SUBSYSLOCK=.*/SUBSYSLOCK=/;' ${CONFDIR}/${PRODUCT}/${PRODUCT}.conf
+	update-rc.d $PRODUCT enable defaults
     elif [ -n "$SYSTEMD" ]; then
 	if systemctl enable $PRODUCT; then
 	    echo "$Product will start automatically at boot"

Shorewall-lite/shorewall-lite

@@ -4,7 +4,7 @@
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011 - 
+#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011 -
 #         Tom Eastep (teastep@shorewall.net)
 #
 #	Shorewall documentation is available at http://www.shorewall.net
@@ -35,6 +35,7 @@ g_program=shorewall-lite
 g_libexec="$LIBEXECDIR"
 g_sharedir="$SHAREDIR"/shorewall-lite
 g_sbindir="$SBINDIR"
+g_vardir="$VARDIR"
 g_confdir="$CONFDIR"/shorewall-lite
 g_readrc=1
 

Shorewall-lite/shorewall-lite.conf

@@ -1,5 +1,5 @@
 ###############################################################################
-#  /etc/shorewall-lite/shorewall-lite.conf Version 4 - Change the following 
+#  /etc/shorewall-lite/shorewall-lite.conf Version 4 - Change the following
 #  variables to override the values in the shorewall.conf file used to
 #  compile /var/lib/shorewall-lite/firewall. Those values may be found in
 #  /var/lib/shorewall-lite/firewall.conf.

Shorewall/Macros/macro.Amanda

@@ -11,6 +11,7 @@
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
 PARAM	-	-	udp	10080
+PARAM	-	-	tcp	10080
 #
 # You may also need this rule.  With AMANDA 2.4.4 on Linux kernel 2.6,
 # it should not be necessary to use this.  The ip_conntrack_amanda

Shorewall/Macros/macro.BLACKLIST

@@ -8,4 +8,8 @@
 ###############################################################################
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
-$BLACKLIST_DISPOSITION:$BLACKLIST_LOGLEVEL
+?IF $BLACKLIST_LOGLEVEL
+blacklog
+?ELSE
+$BLACKLIST_DISPOSITION
+?ENDIF

Shorewall/Macros/macro.MSSQL

@@ -0,0 +1,11 @@
+#
+# Shorewall version 4 - MSSQL Macro
+#
+# /usr/share/shorewall/macro.MSSQL
+#
+#	This macro handles MSSQL (Microsoft SQL Server)
+#
+###############################################################################
+#ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
+#				PORT(S)	PORT(S)	LIMIT	GROUP
+PARAM	-	-	tcp	1433

Shorewall/Makefile

@@ -3,9 +3,9 @@ VARDIR=$(shell /sbin/shorewall show vardir)
 CONFDIR=/etc/shorewall
 RESTOREFILE?=firewall
 
-all: $(VARDIR)/${RESTOREFILE}
+all: $(VARDIR)/$(RESTOREFILE)
 
-$(VARDIR)/${RESTOREFILE}: $(CONFDIR)/*
+$(VARDIR)/$(RESTOREFILE): $(CONFDIR)/*
 	@/sbin/shorewall -q save >/dev/null; \
 	if \
 	    /sbin/shorewall -q restart >/dev/null 2>&1; \

Shorewall/Perl/.includepath

@@ -1,3 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<includepath />
-

Shorewall/Perl/Shorewall/Accounting.pm

@@ -85,7 +85,7 @@ sub initialize() {
     # The section number is initialized to a value less thatn LEGACY. It will be set to LEGACY if a
     # the first non-commentary line in the accounting file isn't a section header
     #
-    # This allows the section header processor to quickly check for correct order 
+    # This allows the section header processor to quickly check for correct order
     #
     $asection           = -1;
     #
@@ -194,7 +194,7 @@ sub process_accounting_rule( ) {
     $ports  = ''    if $ports  eq 'any' || $ports  eq 'all';
     $sports = ''    if $sports eq 'any' || $sports eq 'all';
 
-    fatal_error "USER/GROUP may only be specified in the OUTPUT section" unless $user eq '-' || $asection == OUTPUT; 
+    fatal_error "USER/GROUP may only be specified in the OUTPUT section" unless $user eq '-' || $asection == OUTPUT;
 
     my $rule = do_proto( $proto, $ports, $sports ) . do_user ( $user ) . do_test ( $mark, $globals{TC_MASK} ) . do_headers( $headers );
     my $rule2 = 0;
@@ -250,7 +250,7 @@ sub process_accounting_rule( ) {
 
     if ( $source eq 'any' || $source eq 'all' ) {
         $source = ALLIP;
-    } else { 
+    } else {
 	fatal_error "MAC addresses only allowed in the INPUT and FORWARD sections" if $source =~ /~/ && ( $asection == OUTPUT || ! $asection );
     }
 
@@ -289,7 +289,7 @@ sub process_accounting_rule( ) {
 
     if ( ! $chainref ) {
 	if ( reserved_chain_name( $chain ) ) {
-	    fatal_error "May not use chain $chain in the $sectionname section" if $asection && $chain ne $defaultchain; 
+	    fatal_error "May not use chain $chain in the $sectionname section" if $asection && $chain ne $defaultchain;
 	    $chainref = ensure_accounting_chain $chain, 0 , $restriction;
 	} elsif ( $asection ) {
 	    fatal_error "Unknown accounting chain ($chain)";
@@ -312,7 +312,7 @@ sub process_accounting_rule( ) {
 	}
     } else {
 	fatal_error "$chain is not an accounting chain" unless $chainref->{accounting};
-    
+
 	if ( $ipsec ne '-' ) {
 	    $dir = $chainref->{ipsec};
 	    fatal_error "Adding an IPSEC rule into a non-IPSEC chain is not allowed" unless $dir;
@@ -338,7 +338,7 @@ sub process_accounting_rule( ) {
     }
 
     fatal_error "$chain is not an accounting chain" unless $chainref->{accounting};
-    
+
     $restriction = $dir eq 'in' ? INPUT_RESTRICT : OUTPUT_RESTRICT if $dir;
 
     expand_rule
@@ -394,7 +394,7 @@ sub setup_accounting() {
 
 	my $nonEmpty = 0;
 
-	$nonEmpty |= process_accounting_rule while read_a_line;
+	$nonEmpty |= process_accounting_rule while read_a_line( NORMAL_READ );
 
 	clear_comment;
 

Shorewall/Perl/Shorewall/Compiler.pm

@@ -354,7 +354,7 @@ sub generate_script_3($) {
 	    emit 'cat > ${VARDIR}/.modules << EOF';
 	    open_file $fn;
 
-	    emit_unindented $currentline while read_a_line;
+	    emit_unindented $currentline while read_a_line( NORMAL_READ );
 
 	    emit_unindented 'EOF';
 	    emit '', 'reload_kernel_modules < ${VARDIR}/.modules';
@@ -425,7 +425,7 @@ sub generate_script_3($) {
 	emit 'cat > ${VARDIR}/proxyarp << __EOF__';
     } else {
 	emit 'cat > ${VARDIR}/proxyndp << __EOF__';
-    } 
+    }
 
     dump_proxy_arp;
     emit_unindented '__EOF__';
@@ -493,7 +493,7 @@ EOF
 	  "        set_state Started $config_dir" ,
 	  '    else' ,
 	  '        setup_netfilter' );
-    
+
     setup_load_distribution;
 
     emit<<"EOF";
@@ -578,7 +578,7 @@ sub compiler {
 		  log           => { store => \$log },
 		  log_verbosity => { store => \$log_verbosity, validate => \&validate_verbosity } ,
 		  test          => { store => \$test },
-		  preview       => { store => \$preview,       validate=> \&validate_boolean    } ,    
+		  preview       => { store => \$preview,       validate=> \&validate_boolean    } ,
 		  confess       => { store => \$confess,       validate=> \&validate_boolean    } ,
 		  update        => { store => \$update,        validate=> \&validate_boolean    } ,
 		  convert       => { store => \$convert,       validate=> \&validate_boolean    } ,
@@ -812,12 +812,12 @@ sub compiler {
 
 	optimize_level0;
 
-	if ( $config{OPTIMIZE} & 0x1E ) {
+	if ( ( my $optimize = $config{OPTIMIZE} ) & 0x1E ) {
 	    progress_message2 'Optimizing Ruleset...';
 	    #
 	    # Optimize Policy Chains
 	    #
-	    optimize_policy_chains if $config{OPTIMIZE} & 2;
+	    optimize_policy_chains if $optimize & 6 == 2; # Level 2 but not 4
 	    #
 	    # More Optimization
 	    #

Shorewall/Perl/Shorewall/Config.pm

@@ -47,18 +47,19 @@ our @EXPORT = qw(
 		 warning_message
 		 fatal_error
 		 assert
-		 
+
 		 progress_message
 		 progress_message_nocompress
 		 progress_message2
 		 progress_message3
-		 
+
 		 supplied
-		 
+		 split_list
+
 		 get_action_params
 		 get_action_chain
 		 set_action_param
-		 
+
 		 have_capability
 		 require_capability
                 );
@@ -150,6 +151,15 @@ our %EXPORT_TAGS = ( internal => [ qw( create_temp_script
 
 				       MIN_VERBOSITY
 				       MAX_VERBOSITY
+
+				       PLAIN_READ
+				       EMBEDDED_ENABLED
+				       EXPAND_VARIABLES
+				       STRIP_COMMENTS
+				       SUPPRESS_WHITESPACE
+				       CONFIG_CONTINUATION
+				       DO_INCLUDE
+				       NORMAL_READ
 				     ) ] );
 
 Exporter::export_ok_tags('internal');
@@ -292,11 +302,12 @@ my  %capdesc = ( NAT_ENABLED     => 'NAT',
 		 IPTABLES_S      => 'iptables -S',
 		 BASIC_FILTER    => 'Basic Filter',
 		 CT_TARGET       => 'CT Target',
-		 STATISTIC_MATCH => 
+		 STATISTIC_MATCH =>
 		                    'Statistics Match',
 		 IMQ_TARGET      => 'IMQ Target',
 		 DSCP_MATCH      => 'DSCP Match',
 		 DSCP_TARGET     => 'DSCP Target',
+		 GEOIP_MATCH     => 'GeoIP Match' ,
 		 CAPVERSION      => 'Capability Version',
 		 KERNELVERSION   => 'Kernel Version',
 	       );
@@ -380,13 +391,14 @@ our $currentfilename;        # File NAME
 my  $currentlinenumber;      # Line number
 my  $perlscript;             # File Handle Reference to current temporary file being written by an in-line Perl script
 my  $perlscriptname;         # Name of that file.
+my  $embedded;               # True if we're in an embedded perl script
 my  @tempfiles;              # Files that need unlinking at END
 my  $first_entry;            # Message to output or function to call on first non-blank line of a file
 
 my $shorewall_dir;           # Shorewall Directory; if non-empty, search here first for files.
 
 our $debug;                  # Global debugging flag
-my  $confess;                # If true, use Carp to report errors with stack trace.   
+my  $confess;                # If true, use Carp to report errors with stack trace.
 
 our $family;                 # Protocol family (4 or 6)
 our $toolname;               # Name of the tool to use (iptables or iptables6)
@@ -438,6 +450,20 @@ my $ifstack;
 # From .shorewallrc
 #
 our %shorewallrc;
+#
+# read_a_line options
+#
+use constant { PLAIN_READ          => 0,     # No read_a_line options
+               EMBEDDED_ENABLED    => 1,     # Look for embedded Shell and Perl
+	       EXPAND_VARIABLES    => 2,     # Expand Shell variables
+	       STRIP_COMMENTS      => 4,     # Remove comments
+	       SUPPRESS_WHITESPACE => 8,     # Ignore blank lines
+	       CHECK_GUNK          => 16,    # Look for unprintable characters
+	       CONFIG_CONTINUATION => 32,    # Suppress leading whitespace if
+                                             # continued line ends in ',' or ':'
+	       DO_INCLUDE          => 64,    # Look for INCLUDE <filename>
+               NORMAL_READ         => -1     # All options
+	   };
 
 sub process_shorewallrc($);
 #
@@ -471,12 +497,12 @@ sub initialize( $;$ ) {
     $indent         = '';      # Current total indentation
     ( $dir, $file ) = ('',''); # Script's Directory and Filename
     $tempfile       = '';      # Temporary File Name
-    $sillyname      = 
+    $sillyname      =
     $sillyname1     = '';      # Temporary ipchains
     $omitting       = 0;
     $ifstack        = 0;
     @ifstack        = ();
-
+    $embedded       = 0;
     #
     # Misc Globals
     #
@@ -490,7 +516,7 @@ sub initialize( $;$ ) {
 		    STATEMATCH => '-m state --state',
 		    UNTRACKED  => 0,
 		    VERSION    => "4.4.22.1",
-		    CAPVERSION => 40502 ,
+		    CAPVERSION => 40504 ,
 		  );
     #
     # From shorewall.conf file
@@ -533,6 +559,7 @@ sub initialize( $;$ ) {
 	  RESTOREFILE => undef,
 	  IPSECFILE => undef,
 	  LOCKFILE => undef,
+	  GEOIPDIR => undef,
 	  #
 	  # Default Actions/Macros
 	  #
@@ -721,6 +748,7 @@ sub initialize( $;$ ) {
 	       IMQ_TARGET => undef,
 	       DSCP_MATCH => undef,
 	       DSCP_TARGET => undef,
+	       GEOIP_MATCH => undef,
 	       CAPVERSION => undef,
 	       KERNELVERSION => undef,
 	       );
@@ -747,7 +775,7 @@ sub initialize( $;$ ) {
 
     $debug = 0;
     $confess = 0;
-    
+
     %params = ();
 
     %compiler_params = ();
@@ -759,35 +787,73 @@ sub initialize( $;$ ) {
 		    CONFDIR  => '/etc/',
 		    );
 
-    if ( $shorewallrc ) {
-	process_shorewallrc( $shorewallrc );
+    process_shorewallrc( $shorewallrc ) if $shorewallrc;
 
-	$globals{SHAREDIRPL} = "$shorewallrc{SHAREDIR}/shorewall/";
+    $globals{SHAREDIRPL} = "$shorewallrc{SHAREDIR}/shorewall/";
 
-	if ( $family == F_IPV4 ) {
-	    $globals{SHAREDIR}      = "$shorewallrc{SHAREDIR}/shorewall";
-	    $globals{CONFDIR}       = "$shorewallrc{CONFDIR}/shorewall";
-	    $globals{PRODUCT}       = 'shorewall';
-	    $config{IPTABLES}       = undef;
-	    $validlevels{ULOG}      = 'ULOG';
-	} else {
-	    $globals{SHAREDIR}      = "$shorewallrc{SHAREDIR}/shorewall6";
-	    $globals{CONFDIR}       = "$shorewallrc{CONFDIR}/shorewall6";
-	    $globals{PRODUCT}       = 'shorewall6';
-	    $config{IP6TABLES}      = undef;
-	}
+    if ( $family == F_IPV4 ) {
+	$globals{SHAREDIR}      = "$shorewallrc{SHAREDIR}/shorewall";
+	$globals{CONFDIR}       = "$shorewallrc{CONFDIR}/shorewall";
+	$globals{PRODUCT}       = 'shorewall';
+	$config{IPTABLES}       = undef;
+	$validlevels{ULOG}      = 'ULOG';
+    } else {
+	$globals{SHAREDIR}      = "$shorewallrc{SHAREDIR}/shorewall6";
+	$globals{CONFDIR}       = "$shorewallrc{CONFDIR}/shorewall6";
+	$globals{PRODUCT}       = 'shorewall6';
+	$config{IP6TABLES}      = undef;
     }
 }
 
 my @abbr = qw( Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec );
 
+#
+# Create 'currentlineinfo'
+#
+sub currentlineinfo() {
+    my $linenumber = $currentlinenumber || 1;
+
+    if ( $currentfile ) {
+	my $lineinfo = " $currentfilename ";
+	
+	if ( $linenumber eq 'EOF' ) {
+	    $lineinfo .= '(EOF)'
+	} else {
+	    $lineinfo .= "(line $linenumber)";
+	}
+	#
+	# Unwind the current include stack
+	#
+	for ( my $i = @includestack - 1; $i >= 0; $i-- ) {
+	    my $info = $includestack[$i];
+	    $linenumber = $info->[2] || 1;
+	    $lineinfo .= "\n      from $info->[1] (line $linenumber)";
+	}
+	#
+	# Now unwind the open stack; each element is an include stack
+	#
+	for ( my $i = @openstack - 1; $i >= 0; $i-- ) {
+	    my $istack = $openstack[$i];
+	    for ( my $j = ( @$istack - 1 ); $j >= 0; $j-- ) {
+		my $info = $istack->[$j];
+		$linenumber = $info->[2] || 1;
+		$lineinfo .= "\n      from $info->[1] (line $linenumber)";
+	    }
+	}
+
+	$lineinfo;
+
+    } else {
+	'';
+    }
+}
+
 #
 # Issue a Warning Message
 #
 sub warning_message
 {
-    my $linenumber = $currentlinenumber || 1;
-    my $currentlineinfo = $currentfile ?  " : $currentfilename " . ( $linenumber eq 'EOF' ? '(EOF)' : "(line $linenumber)" ) : '';
+    my $currentlineinfo = currentlineinfo;
     our @localtime;
 
     $| = 1; #Reset output buffering (flush any partially filled buffers).
@@ -815,6 +881,30 @@ sub cleanup() {
     close  $script, $script = undef         if $script;
     close  $perlscript, $perlscript = undef if $perlscript;
     close  $log, $log = undef               if $log;
+
+    if ( $currentfile ) {
+	#
+	# We have a current input file; close it
+	#
+	close $currentfile;
+	#
+	# Unwind the current include stack
+	#
+	for ( my $i = @includestack - 1; $i >= 0; $i-- ) {
+	    my $info = $includestack[$i];
+	    close $info->[0];
+	}
+	#
+	# Now unwind the open stack; each element is an include stack
+	#
+	for ( my $i = @openstack - 1; $i >= 0; $i-- ) {
+	    my $istack = $openstack[$i];
+	    for ( my $j = ( @$istack - 1 ); $j >= 0; $j-- ) {
+		my $info = $istack->[$j];
+		close $info->[0];
+	    }
+	}
+    }
     #
     # Unlink temporary files
     #
@@ -842,8 +932,7 @@ sub cleanup() {
 # Issue fatal error message and die
 #
 sub fatal_error	{
-    my $linenumber = $currentlinenumber || 1;
-    my $currentlineinfo = $currentfile ?  " : $currentfilename " . ( $linenumber eq 'EOF' ? '(EOF)' : "(line $linenumber)" ) : '';
+    my $currentlineinfo = currentlineinfo;
 
     $| = 1; #Reset output buffering (flush any partially filled buffers).
 
@@ -862,8 +951,14 @@ sub fatal_error	{
     }
 
     cleanup;
-    confess "   ERROR: @_$currentlineinfo" if $confess;
-    die "   ERROR: @_$currentlineinfo\n";
+
+    if ( $embedded ) {
+	confess "@_$currentlineinfo" if $confess;
+	die "@_$currentlineinfo\n";
+    }  else {
+	confess "   ERROR: @_$currentlineinfo" if $confess;
+	die "   ERROR: @_$currentlineinfo\n";
+    }
 }
 
 sub fatal_error1 {
@@ -889,13 +984,16 @@ sub fatal_error1 {
 }
 
 #
-# C/C++-like assertion checker
+# C/C++-like assertion checker -- the optional arguments are not used but will
+#                                 appear in the stack trace
 #
-sub assert( $;$ ) {
+sub assert( $;@ ) {
     unless ( $_[0] ) {
 	my @caller0 = caller 0; # Where assert() was called
 	my @caller1 = caller 1; # Who called assert()
 
+	$confess = 1;
+
 	fatal_error "Internal error in $caller1[3] at $caller0[1] line $caller0[2]";
     }
 }
@@ -943,7 +1041,9 @@ sub normalize_hex( $ ) {
 # Return the argument expressed in Hex
 #
 sub in_hex( $ ) {
-    sprintf '0x%x', $_[0];
+    my $value = $_[0];
+
+    $value =~ /^0x/ ? $value : sprintf '0x%x', $_[0];
 }
 
 sub in_hex2( $ ) {
@@ -1334,9 +1434,7 @@ sub find_file($)
 
     return $filename if $filename =~ '/';
 
-    my $directory;
-
-    for $directory ( @config_path ) {
+    for my $directory ( @config_path ) {
 	my $file = "$directory$filename";
 	return $file if -f $file;
     }
@@ -1344,10 +1442,10 @@ sub find_file($)
     "$config_path[0]$filename";
 }
 
-sub split_list( $$ ) {
-    my ($list, $type ) = @_;
+sub split_list( $$;$ ) {
+    my ($list, $type, $origlist ) = @_;
 
-    fatal_error "Invalid $type list ($list)" if $list =~ /^,|,$|,,|!,|,!$/;
+    fatal_error( "Invalid $type list (" . ( $origlist ? $origlist : $list ) . ')' ) if $list =~ /^,|,$|,,|!,|,!$/;
 
     split /,/, $list;
 }
@@ -1405,11 +1503,13 @@ sub supplied( $ ) {
 #    supply '-' in omitted trailing columns.
 #    Handles all of the supported forms of column/pair specification
 #
-sub split_line1( $$;$ ) {
-    my ( $description, $columnsref, $nopad) = @_;
+sub split_line1( $$;$$ ) {
+    my ( $description, $columnsref, $nopad, $maxcolumns ) = @_;
 
-    my @maxcolumns = ( keys %$columnsref );
-    my $maxcolumns = @maxcolumns;
+    unless ( defined $maxcolumns ) {
+	my @maxcolumns = ( keys %$columnsref );
+	$maxcolumns = @maxcolumns;
+    }
     #
     # First see if there is a semicolon on the line; what follows will be column/value paris
     #
@@ -1472,7 +1572,7 @@ sub split_line1( $$;$ ) {
 	    fatal_error "Non-ASCII gunk in the value of the $column column" if $columns =~ /[^\s[:print:]]/;
 	    $line[$column] = $value;
 	}
-    }   
+    }
 
     @line;
 }
@@ -1574,7 +1674,7 @@ sub process_conditional( $$$ ) {
 
 	fatal_error "Invalid IF variable ($rest)" unless ($rest =~ s/^\$// || $rest =~ /^__/ ) && $rest =~ /^\w+$/;
 
-	push @ifstack, [ 'IF', $lastomit, $omitting, $linenumber ];
+	push @ifstack, [ 'IF', $omitting, $omitting, $linenumber ];
 
 	if ( $rest eq '__IPV6' ) {
 	    $omitting = $family == F_IPV4;
@@ -1585,8 +1685,8 @@ sub process_conditional( $$$ ) {
 
 	    $cap =~ s/^__//;
 
-	    $omitting = ! ( exists $ENV{$rest}    ? $ENV{$rest}    : 
-			    exists $params{$rest} ? $params{$rest} : 
+	    $omitting = ! ( exists $ENV{$rest}    ? $ENV{$rest}    :
+			    exists $params{$rest} ? $params{$rest} :
 			    exists $config{$rest} ? $config{$rest} :
 			    exists $capdesc{$cap} ? have_capability( $cap ) : 0 );
 	}
@@ -1607,7 +1707,7 @@ sub process_conditional( $$$ ) {
     }
 
     $omitting;
-}   
+}
 
 #
 # Functions for copying a file into the script
@@ -1676,7 +1776,7 @@ sub copy1( $ ) {
 	my ( $do_indent, $here_documents ) = ( 1, '');
 
 	open_file( $_[0] );
-	
+
 	while ( $currentfile ) {
 	    while ( <$currentfile> ) {
 		$currentlinenumber++;
@@ -1748,7 +1848,7 @@ sub copy1( $ ) {
 
 			next;
 		    }
-			
+
 		    if ( $indent ) {
 			s/^(\s*)/$indent1$1$indent2/;
 			s/        /\t/ if $indent2;
@@ -1877,7 +1977,7 @@ EOF
 #
 sub push_open( $ ) {
 
-    push @includestack, [ $currentfile, $currentfilename, $currentlinenumber, $ifstack ];
+    push @includestack, [ $currentfile, $currentfilename, $currentlinenumber, $ifstack ] if $currentfile;
     my @a = @includestack;
     push @openstack, \@a;
     @includestack = ();
@@ -1930,12 +2030,10 @@ sub shorewall {
 sub first_entry( $ ) {
     $first_entry = $_[0];
     my $reftype = reftype $first_entry;
-    if ( $reftype ) {
-	fatal_error "Invalid argument to first_entry()" unless $reftype eq 'CODE';
-    }
+    assert( $reftype eq 'CODE' ) if $reftype;
 }
 
-sub read_a_line(;$$$$);
+sub read_a_line($);
 
 sub embedded_shell( $ ) {
     my $multiline = shift;
@@ -1952,7 +2050,7 @@ sub embedded_shell( $ ) {
 
 	my $last = 0;
 
-	while ( read_a_line( 0, 0, 0, 0 ) ) {
+	while ( read_a_line( PLAIN_READ ) ) {
 	    last if $last = $currentline =~ s/^\s*END(\s+SHELL)?\s*;?//;
 	    $command .= "$currentline\n";
 	}
@@ -1986,7 +2084,7 @@ sub embedded_perl( $ ) {
 
 	my $last = 0;
 
-	while ( read_a_line( 0, 0, 0, 0 ) ) {
+	while ( read_a_line( PLAIN_READ ) ) {
 	    last if $last = $currentline =~ s/^\s*END(\s+PERL)?\s*;?//;
 	    $command .= "$currentline\n";
 	}
@@ -1995,6 +2093,8 @@ sub embedded_perl( $ ) {
 	fatal_error ( "Invalid END PERL directive" ) unless $currentline =~ /^\s*$/;
     }
 
+    $embedded++;
+
     unless (my $return = eval $command ) {
 	#
 	# Perl found the script offensive or the script itself died
@@ -2012,6 +2112,8 @@ sub embedded_perl( $ ) {
 	fatal_error "Perl Script Returned False";
     }
 
+    $embedded--;
+
     if ( $perlscript ) {
 	fatal_error "INCLUDEs nested too deeply" if @includestack >= 4;
 
@@ -2100,11 +2202,11 @@ sub set_action_param( $$ ) {
 }
 
 #
-# Expand Shell Variables in the passed buffer using %params and @actparms
+# Expand Shell Variables in the passed buffer using @actparms, %params, %shorewallrc and %config, 
 #
 sub expand_variables( \$ ) {
     my ( $lineref, $count ) = ( $_[0], 0 );
-    #                    $1      $2   $3      -     $4
+    #                         $1      $2   $3      -     $4
     while ( $$lineref =~ m( ^(.*?) \$({)? (\w+) (?(2)}) (.*)$ )x ) {
 
 	my ( $first, $var, $rest ) = ( $1, $3, $4);
@@ -2142,7 +2244,7 @@ sub handle_first_entry() {
 }
 
 #
-# Read a line from the current include stack.
+# Read a line from the current include stack. Based on the passed options, it will conditionally:
 #
 #   - Ignore blank or comment-only lines.
 #   - Remove trailing comments.
@@ -2153,11 +2255,8 @@ sub handle_first_entry() {
 #   - Handle ?IF, ?ELSE, ?ENDIF
 #
 
-sub read_a_line(;$$$$) {
-    my $embedded_enabled    = defined $_[0] ? shift : 1;
-    my $expand_variables    = defined $_[0] ? shift : 1;
-    my $strip_comments      = defined $_[0] ? shift : 1;
-    my $suppress_whitespace = defined $_[0] ? shift : 1;
+sub read_a_line($) {
+    my $options = $_[0];
 
     while ( $currentfile ) {
 
@@ -2172,12 +2271,12 @@ sub read_a_line(;$$$$) {
 	    #
 	    # Suppress leading whitespace in certain continuation lines
 	    #
-	    s/^\s*// if $currentline =~ /[,:]$/ && $suppress_whitespace;
+	    s/^\s*// if $currentline =~ /[,:]$/ && $options & CONFIG_CONTINUATION;
 	    #
 	    # If this is a continued line with a trailing comment, remove comment. Note that
 	    # the result will now end in '\'.
 	    #
-	    s/\s*#.*$// if $strip_comments && /[\\]\s*#.*$/;
+	    s/\s*#.*$// if ($options & STRIP_COMMENTS) && /[\\]\s*#.*$/;
 	    #
 	    # Continuation
 	    #
@@ -2189,8 +2288,8 @@ sub read_a_line(;$$$$) {
 		$omitting = process_conditional( $omitting, $currentline, $currentlinenumber );
 		$currentline='';
 		next;
-	    }		
-		    
+	    }
+
 	    if ( $omitting ) {
 		print "OMIT=> $currentline\n" if $debug;
 		$currentline='';
@@ -2200,7 +2299,7 @@ sub read_a_line(;$$$$) {
 	    #
 	    # Must check for shell/perl before doing variable expansion
 	    #
-	    if ( $embedded_enabled ) {
+	    if ( $options & EMBEDDED_ENABLED ) {
 		if ( $currentline =~ s/^\s*(BEGIN\s+)?SHELL\s*;?// ) {
 		    handle_first_entry if $first_entry;
 		    embedded_shell( $1 );
@@ -2214,13 +2313,20 @@ sub read_a_line(;$$$$) {
 		}
 	    }
 	    #
-	    # Now remove concatinated comments
+	    # Now remove concatinated comments if asked
 	    #
-	    $currentline =~ s/\s*#.*$// if $strip_comments;
-	    #
-	    # Ignore ( concatenated ) Blank Lines after comments are removed.
-	    #
-	    $currentline = '', $currentlinenumber = 0, next if $currentline =~ /^\s*$/ && $suppress_whitespace;
+	    $currentline =~ s/\s*#.*$// if $options & STRIP_COMMENTS;
+
+	    if ( $options & SUPPRESS_WHITESPACE ) {
+		#
+		# Ignore (concatinated) blank lines
+		#
+		$currentline = '', $currentlinenumber = 0, next if $currentline =~ /^\s*$/;
+		#
+		# Eliminate trailing whitespace
+		#
+		$currentline =~ s/\s*$//;
+	    }
 	    #
 	    # Line not blank -- Handle any first-entry message/capabilities check
 	    #
@@ -2228,9 +2334,9 @@ sub read_a_line(;$$$$) {
 	    #
 	    # Expand Shell Variables using %params and @actparms
 	    #
-	    expand_variables( $currentline ) if $expand_variables;
+	    expand_variables( $currentline ) if $options & EXPAND_VARIABLES;
 
-	    if ( $currentline =~ /^\s*\??INCLUDE\s/ ) {
+	    if ( ( $options & DO_INCLUDE ) && $currentline =~ /^\s*\??INCLUDE\s/ ) {
 
 		my @line = split ' ', $currentline;
 
@@ -2252,6 +2358,7 @@ sub read_a_line(;$$$$) {
 
 		$currentline = '';
 	    } else {
+		fatal_error "Non-ASCII gunk in file" if ( $options && CHECK_GUNK ) && $currentline =~ /[^\s[:print:]]/;
 		print "IN===> $currentline\n" if $debug;
 		return 1;
 	    }
@@ -2261,33 +2368,13 @@ sub read_a_line(;$$$$) {
     }
 }
 
-#
-# Simple version of the above. Doesn't do line concatenation, shell variable expansion or INCLUDE processing
-#
-sub read_a_line1() {
-    while ( $currentfile ) {
-	while ( $currentline = <$currentfile> ) {
-	    next if $currentline =~ /^\s*#/;
-	    chomp $currentline;
-	    next if $currentline =~ /^\s*$/;
-	    $currentline =~ s/#.*$//;       # Remove Trailing Comments
-	    fatal_error "Non-ASCII gunk in file" if $currentline =~ /[^\s[:print:]]/;
-	    $currentlinenumber = $.;
-	    print "IN===> $currentline\n" if $debug;
-	    return 1;
-	}
-
-	close_file;
-    }
-}
-
 sub process_shorewallrc( $ ) {
     my $shorewallrc = shift;
 
     $shorewallrc{PRODUCT} = $family == F_IPV4 ? 'shorewall' : 'shorewall6';
 
     if ( open_file $shorewallrc ) {
-	while ( read_a_line1 ) {
+	while ( read_a_line( STRIP_COMMENTS | SUPPRESS_WHITESPACE | CHECK_GUNK ) ) {
 	    if ( $currentline =~ /^([a-zA-Z]\w*)=(.*)$/ ) {
 		my ($var, $val) = ($1, $2);
 		$val = $1 if $val =~ /^\"([^\"]*)\"$/;
@@ -2542,7 +2629,7 @@ sub load_kernel_modules( ) {
 	$modulesdir = "/lib/modules/$uname/kernel/net/ipv4/netfilter:/lib/modules/$uname/kernel/net/ipv6/netfilter:/lib/modules/$uname/kernel/net/netfilter:/lib/modules/$uname/extra:/lib/modules/$uname/extra/ipset";
     }
 
-    my @moduledirectories; 
+    my @moduledirectories;
 
     for ( split /:/, $modulesdir ) {
 	push @moduledirectories, $_ if -d $_;
@@ -2568,7 +2655,7 @@ sub load_kernel_modules( ) {
 
 	my @suffixes = split /\s+/ , $config{MODULE_SUFFIX};
 
-	while ( read_a_line ) {
+	while ( read_a_line( NORMAL_READ ) ) {
 	    fatal_error "Invalid modules file entry" unless ( $currentline =~ /^loadmodule\s+([a-zA-Z]\w*)\s*(.*)$/ );
 	    my ( $module, $arguments ) = ( $1, $2 );
 	    unless ( $loadedmodules{ $module } ) {
@@ -2581,7 +2668,7 @@ sub load_kernel_modules( ) {
 			    } else {
 				system( "modprobe $module $arguments" );
 			    }
-				    
+
 			    $loadedmodules{ $module } = 1;
 			}
 		    }
@@ -3003,6 +3090,10 @@ sub Dscp_Target() {
     have_capability 'MANGLE_ENABLED' && qt1( "$iptables -t mangle -A $sillyname -j DSCP --set-dscp 0" );
 }
 
+sub GeoIP_Match() {
+    qt1( "$iptables -A $sillyname -m geoip --src-cc US" );
+}
+
 our %detect_capability =
     ( ACCOUNT_TARGET =>\&Account_Target,
       AUDIT_TARGET => \&Audit_Target,
@@ -3022,6 +3113,7 @@ our %detect_capability =
       EXMARK => \&Exmark,
       FLOW_FILTER => \&Flow_Filter,
       FWMARK_RT_MASK => \&Fwmark_Rt_Mask,
+      GEOIP_MATCH => \&GeoIP_Match,
       GOTO_TARGET => \&Goto_Target,
       HASHLIMIT_MATCH => \&Hashlimit_Match,
       HEADER_MATCH => \&Header_Match,
@@ -3199,7 +3291,7 @@ sub determine_capabilities() {
 	$capabilities{IMQ_TARGET}      = detect_capability( 'IMQ_TARGET' );
 	$capabilities{DSCP_MATCH}      = detect_capability( 'DSCP_MATCH' );
 	$capabilities{DSCP_TARGET}     = detect_capability( 'DSCP_TARGET' );
-
+	$capabilities{GEOIP_MATCH}     = detect_capability( 'GEOIP_MATCH' );
 
 	qt1( "$iptables -F $sillyname" );
 	qt1( "$iptables -X $sillyname" );
@@ -3245,7 +3337,7 @@ sub ensure_config_path() {
 
 	add_param( CONFDIR => $globals{CONFDIR} );
 
-	while ( read_a_line ) {
+	while ( read_a_line( NORMAL_READ ) ) {
 	    if ( $currentline =~ /^\s*([a-zA-Z]\w*)=(.*?)\s*$/ ) {
 		my ($var, $val) = ($1, $2);
 		$config{$var} = ( $val =~ /\"([^\"]*)\"$/ ? $1 : $val ) if exists $config{$var};
@@ -3313,10 +3405,10 @@ sub update_config_file( $ ) {
     #
     # Establish default values for the mark layout items
     #
-    $config{TC_BITS}         = ( $wide ? 14 : 8 )             unless supplied $config{TC_BITS};
-    $config{MASK_BITS}       = ( $wide ? 16 : 8 )             unless supplied $config{MASK_BITS};
-    $config{PROVIDER_OFFSET} = ( $high ? $wide ? 16 : 8 : 0 ) unless supplied $config{PROVIDER_OFFSET};
-    $config{PROVIDER_BITS}   = 8                              unless supplied $config{PROVIDER_BITS};
+    $config{TC_BITS}         = ( $wide ? 14 : 8 )             unless defined $config{TC_BITS};
+    $config{MASK_BITS}       = ( $wide ? 16 : 8 )             unless defined $config{MASK_BITS};
+    $config{PROVIDER_OFFSET} = ( $high ? $wide ? 16 : 8 : 0 ) unless defined $config{PROVIDER_OFFSET};
+    $config{PROVIDER_BITS}   = 8                              unless defined $config{PROVIDER_BITS};
 
     my $fn;
 
@@ -3324,7 +3416,7 @@ sub update_config_file( $ ) {
 	#
 	# Debian or derivative
 	#
-	$fn = $annotate ? "/usr/share/doc/${product}/default-config/${product}.conf.annotated" : "/usr/share/doc/${product}/default-config/${product}.conf";
+	$fn = $annotate ? "$shorewallrc{SHAREDIR}/doc/${product}/default-config/${product}.conf.annotated" : "$shorewallrc{SHAREDIR}/doc/${product}/default-config/${product}.conf";
     } else {
 	#
 	# The rest of the World
@@ -3336,7 +3428,7 @@ sub update_config_file( $ ) {
 
 	open $template, '<' , $fn or fatal_error "Unable to open $fn: $!";
 
-	unless ( open $output, '>', "$configfile.updated" ) { 
+	unless ( open $output, '>', "$configfile.updated" ) {
 	    close $template;
 	    fatal_error "Unable to open $configfile.updated for output: $!";
 	}
@@ -3407,7 +3499,7 @@ EOF
 
 	fatal_error "Can't rename $configfile to $configfile.bak: $!"     unless rename $configfile, "$configfile.bak";
 	fatal_error "Can't rename $configfile.updated to $configfile: $!" unless rename "$configfile.updated", $configfile;
-	
+
 	if ( system( "diff -q $configfile $configfile.bak > /dev/null" ) ) {
 	    progress_message3 "Configuration file $configfile updated - old file renamed $configfile.bak";
 	} else {
@@ -3443,14 +3535,14 @@ sub process_shorewall_conf( $$ ) {
 	    #
 	    # Don't expand shell variables or allow embedded scripting
 	    #
-	    while ( read_a_line1 ) {
+	    while ( read_a_line( STRIP_COMMENTS | SUPPRESS_WHITESPACE  | CHECK_GUNK ) ) {
 		if ( $currentline =~ /^\s*([a-zA-Z]\w*)=(.*?)\s*$/ ) {
 		    my ($var, $val) = ($1, $2);
 
 		    warning_message "Unknown configuration option ($var) ignored", next unless exists $config{$var};
 
 		    $config{$var} = ( $val =~ /\"([^\"]*)\"$/ ? $1 : $val );
-		    
+
 		    warning_message "Option $var=$val is deprecated"
 			if $deprecated{$var} && supplied $val && lc $config{$var} ne $deprecated{$var};
 		} else {
@@ -3483,7 +3575,7 @@ sub process_shorewall_conf( $$ ) {
 # Process the records in the capabilities file
 #
 sub read_capabilities() {
-    while ( read_a_line1 ) {
+    while ( read_a_line( STRIP_COMMENTS | SUPPRESS_WHITESPACE  | CHECK_GUNK ) ) {
 	if ( $currentline =~ /^([a-zA-Z]\w*)=(.*)$/ ) {
 	    my ($var, $val) = ($1, $2);
 	    unless ( exists $capabilities{$var} ) {
@@ -3606,7 +3698,7 @@ sub get_params() {
 	    print "Params:\n";
 	    print $_ for @params;
 	}
-	
+
 	my ( $variable , $bug );
 
 	if ( $params[0] =~ /^declare/ ) {
@@ -3635,7 +3727,7 @@ sub get_params() {
 		    } else {
 			warning_message "Param line ($_) ignored" unless $bug++;
 		    }
-		}	
+		}
 	    }
 	} elsif ( $params[0] =~ /^export .*?="/ || $params[0] =~ /^export [^\s=]+\s*$/ ) {
 	    #
@@ -3663,7 +3755,7 @@ sub get_params() {
 		    } else {
 			warning_message "Param line ($_) ignored" unless $bug++;
 		    }
-		}	
+		}
 	    }
 	} else {
 	    #
@@ -3677,7 +3769,7 @@ sub get_params() {
 
 	    for ( @params ) {
 		if ( /^export (.*?)='(.*'"'"')$/ ) {
-		    $params{$variable=$1}="${2}\n";		    
+		    $params{$variable=$1}="${2}\n";
 		} elsif ( /^export (.*?)='(.*)'$/ ) {
 		    $params{$1} = $2 unless $1 eq '_';
 		} elsif ( /^export (.*?)='(.*)$/ ) {
@@ -3689,7 +3781,7 @@ sub get_params() {
 			$params{$variable} .= $_;
 		    } else {
 			warning_message "Param line ($_) ignored" unless $bug++;
-		    }				
+		    }
 		}
 	    }
 	}
@@ -3986,7 +4078,7 @@ sub get_configuration( $$$ ) {
 
     default_yes_no 'ACCOUNTING'                 , 'Yes';
     default_yes_no 'OPTIMIZE_ACCOUNTING'        , '';
-    
+
     if ( supplied $config{ACCOUNTING_TABLE} ) {
 	my $value = $config{ACCOUNTING_TABLE};
 	fatal_error "Invalid ACCOUNTING_TABLE setting ($value)" unless $value eq 'filter' || $value eq 'mangle';
@@ -4022,9 +4114,10 @@ sub get_configuration( $$$ ) {
 	$globals{ZONE_OFFSET}     = $config{PROVIDER_BITS};
     }
 
-    fatal_error 'Invalid Packet Mark layout' if $config{ZONE_BITS} + $globals{ZONE_OFFSET} > 31;
-    
+    fatal_error 'Invalid Packet Mark layout' if $config{ZONE_BITS} + $globals{ZONE_OFFSET} > 30;
+
     $globals{EXCLUSION_MASK} = 1 << ( $globals{ZONE_OFFSET} + $config{ZONE_BITS} );
+    $globals{TPROXY_MARK}    = $globals{EXCLUSION_MASK} << 1;
     $globals{PROVIDER_MIN}   = 1 << $config{PROVIDER_OFFSET};
 
     $globals{TC_MAX}         = make_mask( $config{TC_BITS} );
@@ -4038,7 +4131,7 @@ sub get_configuration( $$$ ) {
     }
 
     if ( ( my $userbits = $config{PROVIDER_OFFSET} - $config{TC_BITS} ) > 0 ) {
-	
+
 	$globals{USER_MASK} = make_mask( $userbits ) << $config{TC_BITS};
     } else {
 	$globals{USER_MASK} = 0;
@@ -4078,7 +4171,7 @@ sub get_configuration( $$$ ) {
     default_log_level 'LOGALLNEW',           '';
 
     default_log_level 'SFILTER_LOG_LEVEL', 'info';
-    
+
     if ( $val = $config{SFILTER_DISPOSITION} ) {
 	fatal_error "Invalid SFILTER_DISPOSITION setting ($val)" unless $val =~ /^(A_)?(DROP|REJECT)$/;
 	require_capability 'AUDIT_TARGET' , "SFILTER_DISPOSITION=$val", 's' if $1;
@@ -4265,10 +4358,10 @@ sub append_file( $;$$ ) {
     my $user_exit = find_file $file;
     my $result = 0;
     my $save_indent = $indent;
-    
+
     $indent = '' if $unindented;
 
-    unless ( $user_exit =~ m(^/usr/share/shorewall6?/) ) {
+    unless ( $user_exit =~ m(^$shorewallrc{SHAREDIR}/shorewall6?/) ) {
 	if ( -f $user_exit ) {
 	    if ( $nomsg ) {
 		#
@@ -4327,8 +4420,9 @@ sub run_user_exit1( $ ) {
 	#
 	push_open $file;
 
-	if ( read_a_line1 ) {
+	if ( read_a_line( STRIP_COMMENTS | SUPPRESS_WHITESPACE  | CHECK_GUNK ) ) {
 	    close_file;
+	    pop_open;
 
 	    my $command = qq(package Shorewall::User;\n# line 1 "$file"\n) . `cat $file`;
 
@@ -4358,8 +4452,9 @@ sub run_user_exit2( $$ ) {
 	#
 	push_open $file;
 
-	if ( read_a_line1 ) {
+	if ( read_a_line( STRIP_COMMENTS | SUPPRESS_WHITESPACE  | CHECK_GUNK ) ) {
 	    close_file;
+	    pop_open;
 
 	    unless (my $return = eval `cat $file` ) {
 		fatal_error "Couldn't parse $file: $@" if $@;
@@ -4461,7 +4556,7 @@ sub dump_mark_layout() {
 	     $globals{TC_MAX} + 1,
 	     $globals{USER_MASK},
 	     $globals{USER_MASK} );
-    
+
     dumpout( "Provider",
 	     $config{PROVIDER_BITS},
 	     $globals{PROVIDER_MIN},
@@ -4479,7 +4574,7 @@ sub dump_mark_layout() {
 	     $globals{EXCLUSION_MASK},
 	     $globals{EXCLUSION_MASK},
 	     $globals{EXCLUSION_MASK} );
-}	
+}
 
 END {
     cleanup;

Shorewall/Perl/Shorewall/IPAddrs.pm

@@ -293,9 +293,9 @@ sub compare_nets( $$ ) {
 
     @net1 = decompose_net( $_[0] );
     @net2 = decompose_net( $_[1] );
-    
+
     $net1[0] eq $net2[0] && $net1[1] == $net2[1];
-}			    
+}
 
 sub allipv4() {
     @allipv4;
@@ -392,7 +392,7 @@ sub validate_portpair( $$ ) {
 	$what = 'port';
     }
 
-    fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, SCTP or DCCP" unless 
+    fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, SCTP or DCCP" unless
 	defined $protonum && ( $protonum == TCP  ||
 			       $protonum == UDP  ||
 			       $protonum == SCTP ||
@@ -423,7 +423,7 @@ sub validate_portpair1( $$ ) {
 	$what = 'port';
     }
 
-    fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, SCTP or DCCP" unless 
+    fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, SCTP or DCCP" unless
 	defined $protonum && ( $protonum == TCP  ||
 			       $protonum == UDP  ||
 			       $protonum == SCTP ||

Shorewall/Perl/Shorewall/Misc.pm

@@ -72,14 +72,14 @@ sub process_tos() {
 
 	my ( $pretosref, $outtosref );
 
-	first_entry( sub { progress_message2 "$doing $fn..."; 
+	first_entry( sub { progress_message2 "$doing $fn...";
 			   warning_message "Use of the tos file is deprecated in favor of the TOS target in tcrules";
-			   $pretosref = ensure_chain 'mangle' , $chain; 
+			   $pretosref = ensure_chain 'mangle' , $chain;
 			   $outtosref = ensure_chain 'mangle' , 'outtos';
 		       }
 		   );
 
-	while ( read_a_line ) {
+	while ( read_a_line( NORMAL_READ ) ) {
 
 	    my ($src, $dst, $proto, $ports, $sports , $tos, $mark ) = split_line 'tos file entry', { source => 0, dest => 1, proto => 2, dport => 3, sport => 4, tos => 5, mark => 6 } ;
 
@@ -149,9 +149,9 @@ sub setup_ecn()
 			   warning_message 'ECN will not be applied to forwarded packets' unless have_capability 'MANGLE_FORWARD';
 		       } );
 
-	while ( read_a_line ) {
+	while ( read_a_line( NORMAL_READ ) ) {
 
-	    my ($interface, $hosts ) = split_line 'ecn file entry', { interface => 0, hosts => 1 };
+	    my ($interface, $hosts ) = split_line1 'ecn file entry', { interface => 0, host => 1, hosts => 1 }, {}, 2;
 
 	    fatal_error 'INTERFACE must be specified' if $interface eq '-';
 	    fatal_error "Unknown interface ($interface)" unless known_interface $interface;
@@ -202,7 +202,7 @@ sub setup_blacklist() {
     my $audit       = $disposition =~ /^A_/;
     my $target      = $disposition eq 'REJECT' ? 'reject' : $disposition;
     my $orig_target = $target;
-    
+
     #
     # We go ahead and generate the blacklist chains and jump to them, even if they turn out to be empty. That is necessary
     # for 'refresh' to work properly.
@@ -216,7 +216,7 @@ sub setup_blacklist() {
 	} elsif ( $audit ) {
 	    require_capability 'AUDIT_TARGET', "BLACKLIST_DISPOSITION=$disposition", 's';
 	    $target = verify_audit( $disposition );
-	}	    
+	}
     }
 
   BLACKLIST:
@@ -227,7 +227,7 @@ sub setup_blacklist() {
 
 	    first_entry "$doing $fn...";
 
-	    while ( read_a_line ) {
+	    while ( read_a_line ( NORMAL_READ ) ) {
 
 		if ( $first_entry ) {
 		    unless  ( @$zones || @$zones1 ) {
@@ -253,7 +253,7 @@ sub setup_blacklist() {
 
 		for ( @options ) {
 		    $whitelist++ if $_ eq 'whitelist';
-		    $auditone++  if $_ eq 'audit'; 
+		    $auditone++  if $_ eq 'audit';
 		}
 
 		warning_message "Duplicate 'whitelist' option ignored" if $whitelist > 1;
@@ -268,7 +268,7 @@ sub setup_blacklist() {
 		    } else {
 			warning_message "Duplicate 'audit' option ignored" if $auditone > 1;
 
-			
+
 
 			$tgt = verify_audit( 'A_' . $target, $orig_target, $target );
 		    }
@@ -331,7 +331,7 @@ sub setup_blacklist() {
 }
 
 #
-# Remove instances of 'blacklist' from the passed file. 
+# Remove instances of 'blacklist' from the passed file.
 #
 sub remove_blacklist( $ ) {
     my $file = shift;
@@ -343,10 +343,10 @@ sub remove_blacklist( $ ) {
     my $oldfile = open_file $fn;
     my $newfile;
     my $changed;
-	
+
     open $newfile, '>', "$fn.new" or fatal_error "Unable to open $fn.new for output: $!";
 
-    while ( read_a_line(1,1,0) ) {
+    while ( read_a_line( EMBEDDED_ENABLED | EXPAND_VARIABLES ) ) {
 	my ( $rule, $comment ) = split '#', $currentline, 2;
 
 	if ( $rule =~ /blacklist/ ) {
@@ -358,12 +358,12 @@ sub remove_blacklist( $ ) {
 		$currentline = join( '#', $rule, $comment );
 	    } else {
 		$currentline =~ s/blacklist/         /g;
-	    }	    
+	    }
 	}
-   
+
 	print $newfile "$currentline\n";
     }
-	
+
     close $newfile;
 
     if ( $changed ) {
@@ -384,7 +384,7 @@ sub convert_blacklist() {
     my $target      = $disposition eq 'REJECT' ? 'reject' : $disposition;
     my $orig_target = $target;
     my @rules;
-    
+
     if ( @$zones || @$zones1 ) {
 	if ( supplied $level ) {
 	    $target = 'blacklog';
@@ -396,7 +396,7 @@ sub convert_blacklist() {
 
 	first_entry "Converting $fn...";
 
-	while ( read_a_line ) {
+	while ( read_a_line( NORMAL_READ ) ) {
 	    my ( $networks, $protocol, $ports, $options ) = split_line 'blacklist file', { networks => 0, proto => 1, port => 2, options => 3 };
 
 	    if ( $options eq '-' ) {
@@ -411,7 +411,7 @@ sub convert_blacklist() {
 
 	    for ( @options ) {
 		$whitelist++ if $_ eq 'whitelist';
-		$auditone++  if $_ eq 'audit'; 
+		$auditone++  if $_ eq 'audit';
 	    }
 
 	    warning_message "Duplicate 'whitelist' option ignored" if $whitelist > 1;
@@ -468,7 +468,7 @@ sub convert_blacklist() {
 		open $blrules, '>',  $fn1 or fatal_error "Unable to open $fn1: $!";
 		print $blrules <<'EOF';
 #
-# Shorewall version 5 - Blacklist Rules File
+# Shorewall version 4.5 - Blacklist Rules File
 #
 # For information about entries in this file, type "man shorewall-blrules"
 #
@@ -481,7 +481,7 @@ sub convert_blacklist() {
 EOF
 	    }
 
-	    print( $blrules 
+	    print( $blrules
 		   "#\n" ,
 		   "# Rules generated from blacklist file $fn by Shorewall $globals{VERSION} - $date\n" ,
 		   "#\n" );
@@ -509,10 +509,10 @@ EOF
 			    $rule .= "all\t\t\t$zone\t\t\t";
 			}
 		    }
-		
+
 		    $rule .= "\t$protocols" if $protocols ne '-';
 		    $rule .= "\t$ports"     if $ports     ne '-';
-		
+
 		    print $blrules "$rule\n";
 		}
 	    }
@@ -521,19 +521,19 @@ EOF
 	} else {
 	    warning_message q(There are interfaces or zones with the 'blacklist' option but the 'blacklist' file is empty or does not exist) unless @rules;
 	}
-	
+
 	if ( -f $fn ) {
 	    rename $fn, "$fn.bak";
 	    progress_message2 "Blacklist file $fn saved in $fn.bak";
 	}
-	
+
 	for my $file ( qw(zones interfaces hosts) ) {
 	    remove_blacklist $file;
 	}
 
 	progress_message2 "Blacklist successfully converted";
 
-	return 1;	    
+	return 1;
     } else {
 	my $fn = find_file 'blacklist';
 	if ( -f $fn ) {
@@ -554,7 +554,7 @@ sub process_routestopped() {
 
 	first_entry "$doing $fn...";
 
-	while ( read_a_line ) {
+	while ( read_a_line ( NORMAL_READ ) ) {
 
 	    my ($interface, $hosts, $options , $proto, $ports, $sports ) =
 		split_line 'routestopped file', { interface => 0, hosts => 1, options => 2, proto => 3, dport => 4, sport => 5 };
@@ -697,7 +697,7 @@ sub add_common_rules ( $ ) {
 
     if ( $config{FASTACCEPT} ) {
 	add_ijump( $filter_table->{OUTPUT} , j => 'ACCEPT', state_imatch $faststate )
-    } 
+    }
 
     my $policy   = $config{SFILTER_DISPOSITION};
     $level       = $config{SFILTER_LOG_LEVEL};
@@ -711,11 +711,11 @@ sub add_common_rules ( $ ) {
 	$chainref = new_standard_chain 'sfilter';
 
 	log_rule $level , $chainref , $policy , '' if $level ne '';
-	
+
 	add_ijump( $chainref, j => 'AUDIT', targetopts => '--type ' . lc $policy ) if $audit;
-	
+
 	add_ijump $chainref, g => $policy eq 'REJECT' ? 'reject' : $policy;
-	
+
 	$target = 'sfilter';
     } else {
 	$target = $policy eq 'REJECT' ? 'reject' : $policy;
@@ -731,11 +731,11 @@ sub add_common_rules ( $ ) {
 
 	add_ijump ( $chainref, j => 'RETURN', policy => '--pol ipsec --dir out' );
 	log_rule $level , $chainref , $policy , '' if $level ne '';
-	
+
 	add_ijump( $chainref, j => 'AUDIT', targetopts => '--type ' . lc $policy ) if $audit;
-	
+
 	add_ijump $chainref, g => $policy eq 'REJECT' ? 'reject' : $policy;
-	
+
 	$target1 = 'sfilter1';
     } else {
 	#
@@ -752,9 +752,9 @@ sub add_common_rules ( $ ) {
 	unless ( $interfaceref->{options}{ignore} ) {
 
 	    my @filters = @{$interfaceref->{filter}};
-	
+
 	    $chainref = $filter_table->{forward_option_chain $interface};
-	
+
 	    if ( @filters ) {
 		add_ijump( $chainref , @ipsec ? 'j' : 'g' => $target1, imatch_source_net( $_ ), @ipsec ), $chainref->{filtered}++ for @filters;
 	    } elsif ( $interfaceref->{bridge} eq $interface ) {
@@ -765,12 +765,12 @@ sub add_common_rules ( $ ) {
 			    $interfaceref->{physical} eq '+' );
 	    }
 
-	
+
 	    if ( @filters ) {
 		$chainref = $filter_table->{input_option_chain $interface};
 		add_ijump( $chainref , g => $target, imatch_source_net( $_ ), @ipsec ), $chainref->{filtered}++ for @filters;
 	    }
-	
+
 	    for ( option_chains( $interface ) ) {
 		add_ijump( $filter_table->{$_}, j => $dynamicref, @state ) if $dynamicref;
 		add_ijump( $filter_table->{$_}, j => 'ACCEPT', state_imatch $faststate ) if $config{FASTACCEPT};
@@ -915,13 +915,13 @@ sub add_common_rules ( $ ) {
 			     1 ) for input_option_chain( $interface ), output_option_chain( $interface );
 
 	    add_ijump( $filter_table->{forward_option_chain $interface} ,
-		       j => 'ACCEPT', 
+		       j => 'ACCEPT',
 		       p =>  "udp --dport $ports" ,
 		       imatch_dest_dev( $interface ) )
 		if get_interface_option( $interface, 'bridge' );
 
 	    unless ( $family == F_IPV6 || get_interface_option( $interface, 'allip' ) ) {
-		add_ijump( $filter_table->{input_chain( $interface ) } , 
+		add_ijump( $filter_table->{input_chain( $interface ) } ,
 			   j => 'ACCEPT' ,
 			   p => "udp --dport $ports" ,
 			   s => NILIPv4 . '/32' );
@@ -948,7 +948,7 @@ sub add_common_rules ( $ ) {
 	    $globals{LOGPARMS} = "$globals{LOGPARMS}--log-ip-options ";
 
 	    log_rule $level , $logflagsref , $config{TCP_FLAGS_DISPOSITION}, '';
-	    
+
 	    $globals{LOGPARMS} = $savelogparms;
 
 	    if ( $audit ) {
@@ -1097,7 +1097,7 @@ sub setup_mac_lists( $ ) {
 
 	    first_entry "$doing $fn...";
 
-	    while ( read_a_line ) {
+	    while ( read_a_line( NORMAL_READ ) ) {
 
 		my ( $original_disposition, $interface, $mac, $addresses  ) = split_line1 'maclist file', { disposition => 0, interface => 1, mac => 2, addresses => 3 };
 
@@ -1128,7 +1128,7 @@ sub setup_mac_lists( $ ) {
 			    my $source = match_source_net $address;
 			    log_rule_limit $level, $chainref , mac_chain( $interface) , $disposition, '', '', 'add' , "${mac}${source}"
 				if supplied $level;
-			    
+
 			    add_ijump( $chainref , j => 'AUDIT', targetopts => '--type ' . lc $disposition ) if $audit && $disposition ne 'ACCEPT';
 			    add_jump( $chainref , $targetref->{target}, 0, "${mac}${source}" );
 			}
@@ -1348,7 +1348,7 @@ sub handle_loopback_traffic() {
 		    my $exclusion   = source_exclusion( $hostref->{exclusions}, $natref);
 
 		    for my $net ( @{$hostref->{hosts}} ) {
-			insert_ijump( $natout, 
+			insert_ijump( $natout,
 				      j => $exclusion,
 				      $rulenum++,
 				      imatch_source_net( $net , 0, ) );
@@ -1383,7 +1383,7 @@ sub add_interface_jumps {
 	addnatjump 'PREROUTING'  , input_chain( $interface )  , imatch_source_dev( $interface );
 	addnatjump 'POSTROUTING' , output_chain( $interface ) , imatch_dest_dev( $interface );
 	addnatjump 'POSTROUTING' , masq_chain( $interface ) , imatch_dest_dev( $interface );
-	
+
 	if ( have_capability 'RAWPOST_TABLE' ) {
 	    insert_ijump ( $rawpost_table->{POSTROUTING}, j => postrouting_chain( $interface ), 0, imatch_dest_dev( $interface) )   if $rawpost_table->{postrouting_chain $interface};
 	    insert_ijump ( $raw_table->{PREROUTING},      j => prerouting_chain( $interface ),  0, imatch_source_dev( $interface) ) if $raw_table->{prerouting_chain $interface};
@@ -1403,14 +1403,15 @@ sub add_interface_jumps {
 
 	if ( $interfaceref->{options}{port} ) {
 	    my $bridge = $interfaceref->{bridge};
+
 	    add_ijump ( $filter_table->{forward_chain $bridge},
 			j => 'ACCEPT',
 			imatch_source_dev( $interface, 1),
 			imatch_dest_dev( $interface, 1)
-		     ) unless $interfaceref->{nets} || ! $interfaceref->{options}{bridge};
+		     ) unless $interfaceref->{nets};
 
 	    add_ijump( $filter_table->{forward_chain $bridge} ,
-		       j => $forwardref , 
+		       j => $forwardref ,
 		       imatch_source_dev( $interface, 1 )
 		     ) unless $forward_jump_added{$interface} || ! use_forward_chain $interface, $forwardref;
 
@@ -1449,7 +1450,7 @@ sub add_interface_jumps {
 # The biggest disadvantage of the zone-policy-rule model used by Shorewall is that it doesn't scale well as the number of zones increases (Order N**2 where N = number of zones).
 # A major goal of the rewrite of the compiler in Perl was to restrict those scaling effects to this function and the rules that it generates.
 #
-# The function traverses the full "source-zone by destination-zone" matrix and generates the rules necessary to direct traffic through the right set of filter-table and 
+# The function traverses the full "source-zone by destination-zone" matrix and generates the rules necessary to direct traffic through the right set of filter-table and
 # nat-table rules.
 #
 sub generate_matrix() {
@@ -1462,7 +1463,7 @@ sub generate_matrix() {
     my $fw       = firewall_zone;
     my @zones    = off_firewall_zones;
     my @vservers = vserver_zones;
-    
+
     my $notrackref = $raw_table->{notrack_chain $fw};
     my @state = $config{BLACKLISTNEWONLY} ? $globals{UNTRACKED} ? state_imatch 'NEW,INVALID,UNTRACKED' : state_imatch 'NEW,INVALID' : ();
     my $interface_jumps_added = 0;
@@ -1476,22 +1477,26 @@ sub generate_matrix() {
     progress_message  '  Handling complex zones...';
 
     #
-    # Special processing for complex configurations
+    # Special processing for configurations with more than 2 off-firewall zones or with other special considerations like IPSEC.
     #
     for my $zone ( @zones ) {
 	my $zoneref = find_zone( $zone );
-	
+
 	next if  @zones <= 2 && ! $zoneref->{complex};
 	#
-	# Complex zone or we have more than one non-firewall zone -- process_rules created a zone forwarding chain
+	# Complex zone or we have more than two off-firewall zones -- Shorewall::Rules::classic_blacklist created a zone forwarding chain
 	#
 	my $frwd_ref = $filter_table->{zone_forward_chain( $zone )};
 
+	assert( $frwd_ref, $zone );
+	#
+	# Add Zone mark if any
+	#
 	add_ijump( $frwd_ref , j => 'MARK --set-mark ' . in_hex( $zoneref->{mark} ) . '/' . in_hex( $globals{ZONE_MASK} ) ) if $zoneref->{mark};
 
 	if ( have_ipsec ) {
 	    #
-	    # Because policy match only matches an 'in' or an 'out' policy (but not both), we have to place the
+	    # Prior to KLUDGEFREE, policy match could only match an 'in' or an 'out' policy (but not both), so we place the
 	    # '--pol ipsec --dir in' rules at the front of the (interface) forwarding chains. Otherwise, decrypted packets
 	    # can match '--pol none --dir out' rules and send the packets down the wrong rules chain.
 	    #
@@ -1509,6 +1514,9 @@ sub generate_matrix() {
 			copy_rules( $sourcechainref, $frwd_ref, 1 ) unless $ipsec_jump_added{$zone}++;
 			$sourcechainref = $filter_table->{FORWARD};
 		    } elsif ( $interfaceref->{options}{port} ) {
+			#
+			# The forwarding chain for a bridge with ports is always used
+			#
 			add_ijump( $filter_table->{ forward_chain $interfaceref->{bridge} } ,
 				   j => $sourcechainref ,
 				   imatch_source_dev( $interface , 1 ) )
@@ -1518,6 +1526,9 @@ sub generate_matrix() {
 		    }
 		} else {
 		    if ( $interfaceref->{options}{port} ) {
+			#
+			# The forwarding chain for a bridge with ports is always used
+			#
 			$sourcechainref = $filter_table->{ forward_chain $interfaceref->{bridge} };
 			@interfacematch = imatch_source_dev $interface, 1;
 		    } else {
@@ -1689,14 +1700,14 @@ sub generate_matrix() {
 				       imatch_source_dev( $interface),
 				       @source,
 				       @ipsec_in_match );
-				      
+
 			    if ( get_physical( $interface ) eq '+' ) {
 				#
 				# The jump from the PREROUTING chain to dnat may not have been added above
-				# 
+				#
 				addnatjump 'PREROUTING', 'dnat' unless $preroutingref->{references}{PREROUTING};
 			    }
-				
+
 			    check_optimization( $dnatref ) if @source;
 			}
 
@@ -1725,7 +1736,7 @@ sub generate_matrix() {
 
 			if ( @vservers || use_input_chain( $interface, $interfacechainref ) || ! $chain2 || ( @{$interfacechainref->{rules}} && ! $chain2ref ) ) {
 			    $inputchainref = $interfacechainref;
-			    
+
 			    if ( $isport ) {
 				add_ijump( $filter_table->{ input_chain $bridge },
 					   j => $inputchainref ,
@@ -1762,7 +1773,7 @@ sub generate_matrix() {
 
 			    if ( use_forward_chain $interface, $forwardref ) {
 				add_ijump $forwardref , j => $ref, @source, @ipsec_in_match;
-				
+
 				if ( $isport ) {
 				    add_ijump( $filter_table->{ forward_chain $bridge } ,
 					       j => $forwardref ,
@@ -1843,8 +1854,6 @@ sub generate_matrix() {
 	    @dest_zones =  @zones ;
 	}
 	#
-	# Here it is -- THE BIG UGLY!!!!!!!!!!!!
-	#
 	# We now loop through the destination zones creating jumps to the rules chain for each source/dest combination.
 	# @dest_zones is the list of destination zones that we need to handle from this source zone
 	#
@@ -1903,7 +1912,7 @@ sub generate_matrix() {
 			    # Either we must use the interface's forwarding chain or that chain has rules and we have nowhere to move them
 			    #
 			    $chain3ref = $forwardchainref;
-			    
+
 			    if ( $interfaceref->{options}{port} ) {
 				add_ijump( $filter_table->{ forward_chain $interfaceref->{bridge} } ,
 					   j => $chain3ref,

Shorewall/Perl/Shorewall/Nat.pm

@@ -54,7 +54,7 @@ sub initialize() {
 #
 sub process_one_masq( )
 {
-    my ($interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition ) = 
+    my ($interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition ) =
 	split_line1 'masq file', { interface => 0, source => 1, address => 2, proto => 3, port => 4, ipsec => 5, mark => 6, user => 7, switch => 8 };
 
     if ( $interfacelist eq 'COMMENT' ) {
@@ -208,7 +208,7 @@ sub process_one_masq( )
 			    $addrlist .= "--to-source $addr ";
 			    $exceptionrule = do_proto( $proto, '', '' ) if $addr =~ /:/;
 			} else {
-			    my $ports = $addr; 
+			    my $ports = $addr;
 			    $ports =~ s/^://;
 			    validate_portpair1( $proto, $ports );
 			    $addrlist .= "--to-ports $ports ";
@@ -276,7 +276,7 @@ sub setup_masq()
 
 	first_entry( sub { progress_message2 "$doing $fn..."; require_capability 'NAT_ENABLED' , 'a non-empty masq file' , 's'; } );
 
-	process_one_masq while read_a_line;
+	process_one_masq while read_a_line( NORMAL_READ );
 
 	clear_comment;
     }
@@ -373,7 +373,7 @@ sub setup_nat() {
 
 	first_entry( sub { progress_message2 "$doing $fn..."; require_capability 'NAT_ENABLED' , 'a non-empty nat file' , 's'; } );
 
-	while ( read_a_line ) {
+	while ( read_a_line( NORMAL_READ ) ) {
 
 	    my ( $external, $interfacelist, $internal, $allints, $localnat ) = split_line1 'nat file', { external => 0, interface => 1, internal => 2, allints => 3, local => 4 };
 
@@ -409,7 +409,7 @@ sub setup_netmap() {
 
 	first_entry "$doing $fn...";
 
-	while ( read_a_line ) {
+	while ( read_a_line( NORMAL_READ ) ) {
 
 	    my ( $type, $net1, $interfacelist, $net2, $net3, $proto, $dport, $sport ) = split_line 'netmap file', { type => 0, net1 => 1, interface => 2, net2 => 3, net3 => 4, proto => 5, dport => 6, sport => 7 };
 
@@ -426,7 +426,7 @@ sub setup_netmap() {
 		unless ( $type =~ /:/ ) {
 		    my @rulein;
 		    my @ruleout;
-		    
+
 		    validate_net $net1, 0;
 		    validate_net $net2, 0;
 
@@ -439,7 +439,7 @@ sub setup_netmap() {
 		    require_capability 'NAT_ENABLED', 'Stateful NAT Entries', '';
 
 		    if ( $type eq 'DNAT' ) {
-			dest_iexclusion(  ensure_chain( 'nat' , input_chain $interface ) , 
+			dest_iexclusion(  ensure_chain( 'nat' , input_chain $interface ) ,
 					  j => 'NETMAP' ,
 					  "--to $net2",
 					  $net1 ,
@@ -465,10 +465,10 @@ sub setup_netmap() {
 		    validate_net $net2, 0;
 
 		    unless ( $interfaceref->{root} ) {
-			@match = imatch_dest_dev(  $interface ); 
+			@match = imatch_dest_dev(  $interface );
 			$interface = $interfaceref->{name};
 		    }
-			
+
 		    if ( $chain eq 'P' ) {
 			$chain = prerouting_chain $interface;
 			@match = imatch_source_dev( $iface ) unless $iface eq $interface;
@@ -481,7 +481,7 @@ sub setup_netmap() {
 
 		    my $chainref = ensure_chain( $table, $chain );
 
-		    
+
 		    if ( $target eq 'DNAT' ) {
 			dest_iexclusion( $chainref ,
 					 j => 'RAWDNAT' ,
@@ -504,7 +504,7 @@ sub setup_netmap() {
 		    fatal_error 'TYPE must be specified' if $type eq '-';
 		    fatal_error "Invalid TYPE ($type)";
 		}
-		
+
 		progress_message "   Network $net1 on $iface mapped to $net2 ($type)";
 	    }
 	}

Shorewall/Perl/Shorewall/Proc.pm

@@ -286,7 +286,7 @@ sub setup_interface_proc( $ ) {
     if ( interface_has_option( $interface, 'arp_filter' , $value ) ) {
 	push @emitted, "echo $value > /proc/sys/net/ipv4/conf/$physical/arp_filter";
     }
-	 
+
     if ( interface_has_option( $interface, 'arp_ignore' , $value ) ) {
 	push @emitted, "echo $value > /proc/sys/net/ipv4/conf/$physical/arp_ignore";
     }
@@ -315,6 +315,6 @@ sub setup_interface_proc( $ ) {
 	emit "fi\n";
     }
 }
-	 
+
 
 1;

Shorewall/Perl/Shorewall/Providers.pm

@@ -161,7 +161,7 @@ sub setup_route_marking() {
 	    my $chainref2 = new_chain( 'mangle', load_chain( $physical ) );
 
 	    set_optflags( $chainref2, DONT_OPTIMIZE | DONT_MOVE | DONT_DELETE );
-	
+
   	    add_ijump ( $chainref1,
 			j => $chainref2 ,
 		        mark => "--mark 0/$mask" );
@@ -171,7 +171,7 @@ sub setup_route_marking() {
 
 sub copy_table( $$$ ) {
     my ( $duplicate, $number, $realm ) = @_;
-    
+
     my $filter = $family == F_IPV6 ? q(fgrep -v ' cache ' | sed 's/ via :: / /' | ) : '';
 
     emit '';
@@ -186,7 +186,7 @@ sub copy_table( $$$ ) {
 	   '        default)',
 	   '            ;;',
 	   '        *)' );
-	   
+
     if ( $family == F_IPV4 ) {
 	emit ( '            case $net in',
 	       '                255.255.255.255*)',
@@ -218,7 +218,7 @@ sub copy_and_edit_table( $$$$ ) {
     # Shell and iptables use a different wildcard character
     #
     $copy =~ s/\+/*/g;
-    
+
     emit '';
 
     if ( $realm ) {
@@ -244,7 +244,7 @@ sub copy_and_edit_table( $$$$ ) {
 	     );
     } else {
 	emit (  "                    run_ip route add table $number \$net \$route $realm" );
-    } 
+    }
 
     emit (  '                    ;;',
 	    '            esac',
@@ -396,8 +396,8 @@ sub process_a_provider() {
 	$gateway = '';
     }
 
-    my ( $loose, $track,                   $balance , $default, $default_balance,                $optional,                           $mtu, $local , $load ) =
-	(0,      $config{TRACK_PROVIDERS}, 0 ,        0,        $config{USE_DEFAULT_RT} ? 1 : 0, interface_is_optional( $interface ), ''  , 0      , 0 );
+    my ( $loose, $track,                   $balance , $default, $default_balance,                $optional,                           $mtu, $tproxy , $local, $load ) =
+	(0,      $config{TRACK_PROVIDERS}, 0 ,        0,        $config{USE_DEFAULT_RT} ? 1 : 0, interface_is_optional( $interface ), ''  , 0       , 0,      0 );
 
     unless ( $options eq '-' ) {
 	for my $option ( split_list $options, 'option' ) {
@@ -435,9 +435,14 @@ sub process_a_provider() {
 		$default = -1;
 		$default_balance = 0;
 	    } elsif ( $option eq 'local' ) {
-		$local = 1;
-		$track = 0           if $config{TRACK_PROVIDERS};
-		$default_balance = 0 if $config{USE_DEFAULT_RT};
+		warning_message q(The 'local' provider option is deprecated in favor of 'tproxy');
+		$local = $tproxy = 1;
+		$track  = 0           if $config{TRACK_PROVIDERS};
+		$default_balance = 0  if $config{USE_DEFAULT_RT};
+	    } elsif ( $option eq 'tproxy' ) {
+		$tproxy = 1;
+		$track  = 0           if $config{TRACK_PROVIDERS};
+		$default_balance = 0  if $config{USE_DEFAULT_RT};
 	    } elsif ( $option =~ /^load=(0?\.\d{1,8})/ ) {
 		$load = $1;
 		require_capability 'STATISTIC_MATCH', "load=$load", 's';
@@ -459,7 +464,12 @@ sub process_a_provider() {
 	fatal_error "GATEWAY not valid with 'local' provider" unless $gatewaycase eq 'none';
 	fatal_error "'track' not valid with 'local'"          if $track;
 	fatal_error "DUPLICATE not valid with 'local'"        if $duplicate ne '-';
-	fatal_error "MARK required with 'local'"              unless $mark;
+    } elsif ( $tproxy ) {
+	fatal_error "GATEWAY not valid with 'tproxy' provider" unless $gatewaycase eq 'none';
+	fatal_error "'track' not valid with 'tproxy'"          if $track;
+	fatal_error "DUPLICATE not valid with 'tproxy'"        if $duplicate ne '-';
+	fatal_error "MARK not allowed with 'tproxy'"           if $mark ne '-';
+	$mark = $globals{TPROXY_MARK};
     }
 
     my $val = 0;
@@ -471,24 +481,29 @@ sub process_a_provider() {
 
 	require_capability( 'MANGLE_ENABLED' , 'Provider marks' , '' );
 
-	$val = numeric_value $mark;
+	if ( $tproxy && ! $local ) {
+	    $val = $globals{TPROXY_MARK};
+	    $pref = 1;
+	} else {
+	    $val = numeric_value $mark;
 
-	fatal_error "Invalid Mark Value ($mark)" unless defined $val && $val;
+	    fatal_error "Invalid Mark Value ($mark)" unless defined $val && $val;
 
-	verify_mark $mark;
+	    verify_mark $mark;
 
-	fatal_error "Invalid Mark Value ($mark)" unless ( $val & $globals{PROVIDER_MASK} ) == $val;
+	    fatal_error "Invalid Mark Value ($mark)" unless ( $val & $globals{PROVIDER_MASK} ) == $val;
 
-	fatal_error "Provider MARK may not be specified when PROVIDER_BITS=0" unless $config{PROVIDER_BITS};
+	    fatal_error "Provider MARK may not be specified when PROVIDER_BITS=0" unless $config{PROVIDER_BITS};
 
-	for my $providerref ( values %providers  ) {
-	    fatal_error "Duplicate mark value ($mark)" if numeric_value( $providerref->{mark} ) == $val;
+	    for my $providerref ( values %providers  ) {
+		fatal_error "Duplicate mark value ($mark)" if numeric_value( $providerref->{mark} ) == $val;
+	    }
+
+	    $lastmark = $val;
+	    
+	    $pref = 10000 + $number - 1;
 	}
 
-	$pref = 10000 + $number - 1;
-
-	$lastmark = $val;
-
     }
 
     unless ( $loose ) {
@@ -527,6 +542,7 @@ sub process_a_provider() {
 			   duplicate   => $duplicate ,
 			   address     => $address ,
 			   local       => $local ,
+			   tproxy      => $tproxy ,
 			   load        => $load ,
 			   rules       => [] ,
 			   routes      => [] ,
@@ -557,9 +573,9 @@ sub process_a_provider() {
 # Generate the start_provider_...() function for the passed provider
 #
 sub add_a_provider( $$ ) {
-  
+
     my ( $providerref, $tcdevices ) = @_;
-    
+
     my $table       = $providerref->{provider};
     my $number      = $providerref->{number};
     my $mark        = $providerref->{rawmark};
@@ -579,6 +595,7 @@ sub add_a_provider( $$ ) {
     my $duplicate   = $providerref->{duplicate};
     my $address     = $providerref->{address};
     my $local       = $providerref->{local};
+    my $tproxy      = $providerref->{tproxy};
     my $load        = $providerref->{load};
 
     my $dev         = chain_base $physical;
@@ -600,7 +617,7 @@ sub add_a_provider( $$ ) {
 	$provider_interfaces{$interface} = $table;
 
 	if ( $gatewaycase eq 'none' ) {
-	    if ( $local ) {
+	    if ( $tproxy ) {
 		emit 'run_ip route add local ' . ALLIP . " dev $physical table $number";
 	    } else {
 		emit "run_ip route add default dev $physical table $number";
@@ -608,16 +625,18 @@ sub add_a_provider( $$ ) {
 	}
     }
 
-    emit( qq(echo $load > \${VARDIR}/${physical}_load) ) if $load;
+    emit( "echo $load > \${VARDIR}/${physical}_load",
+	  'echo ' . in_hex( $mark ) . '/' . in_hex( $globals{PROVIDER_MASK} ) . " > \${VARDIR}/${physical}_mark" ) if $load;
 
-    emit( '', 
+    emit( '',
 	  "cat <<EOF >> \${VARDIR}/undo_${table}_routing" );
-    
+
     emit_unindented 'case \$COMMAND in';
     emit_unindented '    enable|disable)';
     emit_unindented '        ;;';
     emit_unindented '    *)';
     emit_unindented "        rm -f \${VARDIR}/${physical}_load" if $load;
+    emit_unindented "        rm -f \${VARDIR}/${physical}_mark" if $load;
     emit_unindented <<"CEOF", 1;
         rm -f \${VARDIR}/${physical}.status
         ;;
@@ -630,12 +649,13 @@ CEOF
     setup_interface_proc( $interface );
 
     if ( $mark ne '-' ) {
-	my $mask = have_capability 'FWMARK_RT_MASK' ? '/' . in_hex $globals{PROVIDER_MASK} : '';
+	my $hexmark = in_hex( $mark );
+	my $mask = have_capability 'FWMARK_RT_MASK' ? '/' . in_hex( $globals{ $tproxy && ! $local ? 'TPROXY_MARK' : 'PROVIDER_MASK' } ) : '';
 
-	emit ( "qt \$IP -$family rule del fwmark ${mark}${mask}" ) if $config{DELETE_THEN_ADD};
+	emit ( "qt \$IP -$family rule del fwmark ${hexmark}${mask}" ) if $config{DELETE_THEN_ADD};
 
-	emit ( "run_ip rule add fwmark ${mark}${mask} pref $pref table $number",
-	       "echo \"qt \$IP -$family rule del fwmark ${mark}${mask}\" >> \${VARDIR}/undo_${table}_routing"
+	emit ( "run_ip rule add fwmark ${hexmark}${mask} pref $pref table $number",
+	       "echo \"qt \$IP -$family rule del fwmark ${hexmark}${mask}\" >> \${VARDIR}/undo_${table}_routing"
 	     );
     }
 
@@ -686,7 +706,7 @@ CEOF
 	    emit qq(run_ip route add default table ) . DEFAULT_TABLE . qq( dev $physical metric $number);
 	    emit qq(echo "qt \$IP -$family route del default dev $physical table ) . DEFAULT_TABLE . qq(" >> \${VARDIR}/undo_${table}_routing);
 	}
-	
+
 	$fallback = 1;
     }
 
@@ -695,7 +715,7 @@ CEOF
 	  qq(    qt \$IP -6 rule add from all table ) . DEFAULT_TABLE . qq( prio 32767\n) ,
 	  qq(fi) ) if $family == F_IPV6;
 
-    unless ( $local ) {
+    unless ( $tproxy ) {
 	emit '';
 
 	if ( $loose ) {
@@ -724,19 +744,19 @@ CEOF
 	emit '';
 	emit $_ for @{$providers{$table}->{rules}};
     }
-    
+
     if ( @{$providerref->{routes}} ) {
 	emit '';
 	emit $_ for @{$providers{$table}->{routes}};
     }
 
     emit( '' );
-    
+
     my ( $tbl, $weight );
 
     emit( qq(echo 0 > \${VARDIR}/${physical}.status) );
 
-    if ( $optional ) {	
+    if ( $optional ) {
 	emit( '',
 	      'if [ $COMMAND = enable ]; then' );
 
@@ -759,7 +779,7 @@ CEOF
 		if ( $gateway ) {
 		    emit qq(add_gateway "via $gateway dev $physical $realm" ) . $tbl;
 		} else {
-		    emit qq(add_gateway "nexthop dev $physical $realm" ) . $tbl;
+		    emit qq(add_gateway "dev $physical $realm" ) . $tbl;
 		}
 	    }
 	    	} else {
@@ -775,7 +795,7 @@ CEOF
 	emit ( qq(progress_message2 "   Provider $table ($number) Started") );
 
 	pop_indent;
- 
+
 	emit( 'else' );
 	emit( qq(    echo $weight > \${VARDIR}/${physical}_weight) ,
 	      qq(    progress_message "   Provider $table ($number) Started"),
@@ -785,18 +805,18 @@ CEOF
 	emit( qq(echo 0 > \${VARDIR}/${physical}.status) );
 	emit( qq(progress_message "Provider $table ($number) Started") );
     }
-    
+
     pop_indent;
 
     emit 'else';
 
     push_indent;
-    
+
     emit( qq(echo 1 > \${VARDIR}/${physical}.status) );
 
     if ( $optional ) {
 	if ( $shared ) {
-	    emit ( "error_message \"WARNING: Gateway $gateway is not reachable -- Provider $table ($number) not Started\"" );	    
+	    emit ( "error_message \"WARNING: Gateway $gateway is not reachable -- Provider $table ($number) not Started\"" );
 	} else {
 	    emit ( "error_message \"WARNING: Interface $physical is not usable -- Provider $table ($number) not Started\"" );
 	}
@@ -839,7 +859,7 @@ CEOF
 
 	    if ( $gateway ) {
 		$via = "via $gateway dev $physical";
-	    } else {    
+	    } else {
 		$via = "dev $physical";
 	    }
 
@@ -856,12 +876,13 @@ CEOF
 	       "distribute_load $maxload @load_interfaces" ) if $load;
 
 	unless ( $shared ) {
-	    emit( '', 
+	    emit( '',
 		  "qt \$TC qdisc del dev $physical root",
 		  "qt \$TC qdisc del dev $physical ingress\n" ) if $tcdevices->{$interface};
 	}
 
-	emit( "progress_message2 \"   Provider $table ($number) stopped\"" );
+	emit( "echo 1 > \${VARDIR}/${physical}.status",
+	      "progress_message2 \"   Provider $table ($number) stopped\"" );
 
 	pop_indent;
 
@@ -928,7 +949,7 @@ sub add_an_rtrule( ) {
 	    validate_net ( $source, 0 );
 	    $source = "from $source";
 	} else {
-	    $source = "iif $source";
+	    $source = 'iif ' . physical_name $source;
 	}
     } elsif ( $source =~  /^(.+?):<(.+)>\s*$/ ||  $source =~  /^(.+?):\[(.+)\]\s*$/ ) {
 	my ($interface, $source ) = ($1, $2);
@@ -939,7 +960,7 @@ sub add_an_rtrule( ) {
 	validate_net ( $source, 0 );
 	$source = "from $source";
     } else {
-	$source = "iif $source";
+	$source = 'iif ' . physical_name $source;
     }
 
     my $mark = '';
@@ -1001,14 +1022,14 @@ sub add_a_route( ) {
     my $routes = $providerref->{routes};
 
     fatal_error "You may not add routes to the $provider table" if $number == LOCAL_TABLE || $number == UNSPEC_TABLE;
-    
+
     if ( $gateway ne '-' ) {
 	if ( $device ne '-' ) {
 	    push @$routes, qq(run_ip route add $dest via $gateway dev $physical table $number);
 	    emit qq(echo "qt \$IP -$family route del $dest via $gateway dev $physical table $number" >> \${VARDIR}/undo_${provider}_routing) if $number >= DEFAULT_TABLE;
 	} else {
 	    push @$routes, qq(run_ip route add $dest via $gateway table $number);
-	    emit qq(echo "\$IP -$family route del $dest via $gateway table $number" >> \${VARDIR}/undo_${provider}_routing) if $number >= DEFAULT_TABLE; 
+	    emit qq(echo "\$IP -$family route del $dest via $gateway table $number" >> \${VARDIR}/undo_${provider}_routing) if $number >= DEFAULT_TABLE;
 	}
     } else {
 	fatal_error "You must specify a device for this route" unless $physical;
@@ -1024,8 +1045,8 @@ sub setup_null_routing() {
     emit "> \${VARDIR}/undo_rfc1918_routing\n";
     for ( rfc1918_networks ) {
 	emit( qq(if ! \$IP -4 route ls | grep -q '^$_.* dev '; then),
-	      qq(    run_ip route replace unreachable $_),
-	      qq(    echo "qt \$IP -4 route del unreachable $_" >> \${VARDIR}/undo_rfc1918_routing),
+	      qq(    run_ip route replace blackhole $_),
+	      qq(    echo "qt \$IP -4 route del blackhole $_" >> \${VARDIR}/undo_rfc1918_routing),
 	      qq(fi\n) );
     }
 }
@@ -1055,7 +1076,7 @@ sub start_providers() {
     emit 'DEFAULT_ROUTE=';
     emit 'FALLBACK_ROUTE=';
     emit '';
-    
+
     for my $provider ( qw/main default/ ) {
 	emit '';
 	emit qq(> \${VARDIR}/undo_${provider}_routing );
@@ -1068,7 +1089,7 @@ sub start_providers() {
 
 sub finish_providers() {
     my $table = MAIN_TABLE;
-    
+
     if ( $config{USE_DEFAULT_RT} ) {
 	emit ( 'run_ip rule add from ' . ALLIP . ' table ' . MAIN_TABLE .    ' pref 999',
 	       'run_ip rule add from ' . ALLIP . ' table ' . BALANCE_TABLE . ' pref 32765',
@@ -1096,7 +1117,7 @@ sub finish_providers() {
 		    ''
 		  );
 	}
- 
+
 	emit  ( "    progress_message \"Default route '\$(echo \$DEFAULT_ROUTE | sed 's/\$\\s*//')' Added\"",
 		'else',
 		'    error_message "WARNING: No Default route added (all \'balance\' providers are down)"' );
@@ -1114,6 +1135,10 @@ sub finish_providers() {
 	       '# We don\'t have any \'balance\' providers so we restore any default route that we\'ve saved',
 	       '#',
 	       "restore_default_route $config{USE_DEFAULT_RT}" ,
+	       '#',
+	       '# And delete any routes in the \'balance\' table',
+	       '#',
+	       "qt \$IP -$family route del default table " . BALANCE_TABLE,
 	       '' );
     }
 
@@ -1127,10 +1152,15 @@ sub finish_providers() {
 	}
 
 	emit( "    progress_message \"Fallback route '\$(echo \$FALLBACK_ROUTE | sed 's/\$\\s*//')' Added\"",
+	      'else',
+	      '#',
+	      '# We don\'t have any \'fallback\' providers so we delete any default routes in the default table',
+	      '#',
+	      "    while qt \$IP -$family route del default table " . DEFAULT_TABLE . '; do true; done',
 	      'fi',
 	      '' );
     } elsif ( $config{USE_DEFAULT_RT} ) {
-	emit "qt \$IP -$family route del default table " . DEFAULT_TABLE;
+	emit "while qt \$IP -$family route del default table " . DEFAULT_TABLE . '; do true; done';
     }
 
     unless ( $config{KEEP_RT_TABLES} ) {
@@ -1163,8 +1193,8 @@ sub process_providers( $ ) {
     $lastmark = 0;
 
     if ( my $fn = open_file 'providers' ) {
-	first_entry "$doing $fn..."; 
-	process_a_provider, $providers++ while read_a_line;
+	first_entry "$doing $fn...";
+	process_a_provider, $providers++ while read_a_line( NORMAL_READ );
     }
 
     if ( $providers ) {
@@ -1180,10 +1210,10 @@ sub process_providers( $ ) {
 
 	if ( $fn ) {
 	    first_entry "$doing $fn...";
-	    
+
 	    emit '';
 
-	    add_an_rtrule while read_a_line;
+	    add_an_rtrule while read_a_line( NORMAL_READ );
 	}
 
 	$fn = open_file 'routes';
@@ -1191,12 +1221,12 @@ sub process_providers( $ ) {
 	if ( $fn ) {
 	    first_entry "$doing $fn...";
 	    emit '';
-	    add_a_route while read_a_line;
+	    add_a_route while read_a_line( NORMAL_READ );
 	}
     }
 
     add_a_provider( $providers{$_}, $tcdevices ) for @providers;
-    
+
     emit << 'EOF';;
 
 #
@@ -1221,7 +1251,7 @@ EOF
 		emit( "$providerref->{physical}|$provider)" );
 	    }
 
-	    emit ( "    if [ -z \"`\$IP -$family route ls table $providerref->{number}`\" ]; then", 
+	    emit ( "    if [ -z \"`\$IP -$family route ls table $providerref->{number}`\" ]; then",
 		   "        start_provider_$provider",
 		   '    else',
 		   "        startup_error \"Interface $providerref->{physical} is already enabled\"",
@@ -1257,7 +1287,7 @@ EOF
 	my $providerref = $providers{$provider};
 
 	emit( "$providerref->{physical}|$provider)",
-	      "    if [ -n \"`\$IP -$family route ls table $providerref->{number}`\" ]; then", 
+	      "    if [ -n \"`\$IP -$family route ls table $providerref->{number}`\" ]; then",
 	      "        stop_provider_$provider",
 	      '    else',
 	      "        startup_error \"Interface $providerref->{physical} is already disabled\"",
@@ -1284,11 +1314,11 @@ sub setup_providers() {
 
     if ( $providers ) {
 	emit "\nif [ -z \"\$g_noroutes\" ]; then";
-	
+
 	push_indent;
 
 	start_providers;
-	
+
 	emit '';
 
 	emit "start_provider_$_" for @providers;
@@ -1515,7 +1545,7 @@ sub handle_stickiness( $ ) {
 			$rule1 = clone_rule( $_ );
 
 			clear_rule_target( $rule1 );
-			set_rule_option( $rule1, 'mark', "--mark $mark\/$mask -m recent --name $list --set" ); 
+			set_rule_option( $rule1, 'mark', "--mark $mark\/$mask -m recent --name $list --set" );
 
 			$rule2 = '';
 		    }
@@ -1549,7 +1579,7 @@ sub handle_stickiness( $ ) {
 			while ( my ( $key, $value ) = each %$_ ) {
 			    $rule2->{$key} = $value;
 			}
-			
+
 			clear_rule_target( $rule2 );
 			set_rule_option  ( $rule2, 'mark', "--mark 0\/$mask -m recent --name $list --rdest --remove" );
 		    } else {
@@ -1584,7 +1614,7 @@ sub handle_stickiness( $ ) {
 sub setup_load_distribution() {
     emit ( '',
 	   "        distribute_load $maxload @load_interfaces" ,
-	   '' 
+	   ''
 	 ) if @load_interfaces;
 }
 

Shorewall/Perl/Shorewall/Proxyarp.pm

@@ -120,7 +120,7 @@ sub setup_proxy_arp() {
 
 	my ( %set, %reset );
 
-	while ( read_a_line ) {
+	while ( read_a_line( NORMAL_READ ) ) {
 
 	    my ( $address, $interface, $external, $haveroute, $persistent ) =
 		split_line $file_opt . 'file ', { address => 0, interface => 1, external => 2, haveroute => 3, persistent => 4 };

Shorewall/Perl/Shorewall/Raw.pm

@@ -105,7 +105,7 @@ sub process_notrack_rule( $$$$$$$ ) {
 		 '' ,
 		 $target ,
 		 $exception_rule );
-    
+
     progress_message "  Notrack rule \"$currentline\" $done";
 
     $globals{UNTRACKED} = 1;
@@ -130,36 +130,36 @@ sub setup_notrack() {
 
 	my $nonEmpty = 0;
 
-	while ( read_a_line ) {	    
+	while ( read_a_line( NORMAL_READ ) ) {
 	    my ( $source, $dest, $proto, $ports, $sports, $user );
 
 	    if ( $format == 1 ) {
 		( $source, $dest, $proto, $ports, $sports, $user ) = split_line1 'Notrack File', { source => 0, dest => 1, proto => 2, dport => 3, sport => 4, user => 5 };
-		
+
 		if ( $source eq 'FORMAT' ) {
 		    $format = process_format( $dest );
 		    next;
 		}
-		
+
 		if ( $source eq 'COMMENT' ) {
 		    process_comment;
 		    next;
-		}	    
+		}
 	    } else {
 		( $action, $source, $dest, $proto, $ports, $sports, $user ) = split_line1 'Notrack File', { action => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6 }, { COMMENT => 0, FORMAT => 2 };
-		
+
 		if ( $action eq 'FORMAT' ) {
 		    $format = process_format( $source );
 		    $action = 'NOTRACK';
 		    next;
 		}
-		
+
 		if ( $action eq 'COMMENT' ) {
 		    process_comment;
 		    next;
-		}	    
+		}
 	    }
-	    
+
 	    process_notrack_rule $action, $source, $dest, $proto, $ports, $sports, $user;
 	}
 

Shorewall/Perl/Shorewall/Rules.pm

@@ -341,7 +341,7 @@ sub process_a_policy() {
     fatal_error "Invalid default action ($default:$remainder)" if defined $remainder;
 
     ( $policy , my $queue ) = get_target_param $policy;
-    
+
     fatal_error "Invalid policy ($policy)" unless exists $validpolicies{$policy};
 
     if ( $audit ) {
@@ -492,7 +492,7 @@ sub process_policies()
 
     for my $option ( qw( DROP_DEFAULT REJECT_DEFAULT ACCEPT_DEFAULT QUEUE_DEFAULT NFQUEUE_DEFAULT) ) {
 	my $action = $config{$option};
-	
+
 	unless ( $action eq 'none' ) {
 	    my ( $act, $param ) = get_target_param( $action );
 
@@ -529,7 +529,7 @@ sub process_policies()
 
     if ( my $fn = open_file 'policy' ) {
 	first_entry "$doing $fn...";
-	process_a_policy while read_a_line;
+	process_a_policy while read_a_line( NORMAL_READ );
     } else {
 	fatal_error q(The 'policy' file does not exist or has zero size);
     }
@@ -552,7 +552,7 @@ sub policy_rules( $$$$$ ) {
 	add_ijump $chainref, j => $default if $default && $default ne 'none';
 	log_rule $loglevel , $chainref , $target , '' if $loglevel ne '';
 	fatal_error "Null target in policy_rules()" unless $target;
-	
+
 	add_ijump( $chainref , j => 'AUDIT', targetopts => '--type ' . lc $target ) if $chainref->{audit};
 	add_ijump( $chainref , g => $target eq 'REJECT' ? 'reject' : $target ) unless $target eq 'CONTINUE';
     }
@@ -685,7 +685,7 @@ sub setup_syn_flood_chains() {
 	my $limit = $chainref->{synparams};
 	if ( $limit && ! $filter_table->{syn_flood_chain $chainref} ) {
 	    my $level = $chainref->{loglevel};
-	    my $synchainref = @zones > 1 ? 
+	    my $synchainref = @zones > 1 ?
 		    new_chain 'filter' , syn_flood_chain $chainref :
 		    new_chain( 'filter' , '@' . $chainref->{name} );
 	    add_rule $synchainref , "${limit}-j RETURN";
@@ -763,7 +763,7 @@ sub finish_chain_section ($$) {
     my $chain               = $chainref->{name};
     my $related_level       = $config{RELATED_LOG_LEVEL};
     my $related_target      = $globals{RELATED_TARGET};
-    
+
     push_comment(''); #These rules should not have comments
 
     if ( $state =~ /RELATED/ && ( $related_level || $related_target ne 'ACCEPT' ) ) {
@@ -775,7 +775,7 @@ sub finish_chain_section ($$) {
 		      $config{RELATED_DISPOSITION},
 		      '' );
 	    add_ijump( $relatedref, g => $related_target );
-		    
+
 	    $related_target = $relatedref->{name};
 	}
 
@@ -863,9 +863,9 @@ sub split_action ( $ ) {
 #
 # Create a normalized action name from the passed pieces.
 #
-# Internally, action invocations are uniquely identified by a 4-tuple that 
+# Internally, action invocations are uniquely identified by a 4-tuple that
 # includes the action name, log level, log tag and params. The pieces of the tuple
-# are separated by ":". 
+# are separated by ":".
 #
 sub normalize_action( $$$ ) {
     my $action = shift;
@@ -904,7 +904,7 @@ sub externalize( $ ) {
     $target .= ":$tag"   if $tag;
     $target;
 }
-    
+
 #
 # Define an Action
 #
@@ -988,7 +988,7 @@ sub createsimpleactionchain( $ ) {
     my $normalized = normalize_action_name( $action );
 
     return createlogactionchain( $normalized, $action, 'none', '', '' ) if $filter_table->{$action} || $nat_table->{$action};
-	
+
     my $chainref = new_standard_chain $action;
 
     $usedactions{$normalized} = $chainref;
@@ -1205,7 +1205,7 @@ sub dropBcast( $$$$ ) {
 		log_rule_limit $level, $chainref, 'dropBcast' , 'DROP', '', $tag, 'add', join( ' ', ' -d' , IPv6_MULTICAST , '-j DROP ' );
 	    }
 	}
-	
+
 	add_ijump $chainref, j => $target, addrtype => '--dst-type BROADCAST';
     } else {
 	if ( $family == F_IPV4 ) {
@@ -1394,7 +1394,7 @@ sub process_actions() {
     for my $file ( qw/actions.std actions/ ) {
 	open_file $file;
 
-	while ( read_a_line ) {
+	while ( read_a_line( NORMAL_READ ) ) {
 	    my ( $action ) = split_line 'action file' , { action => 0 };
 
 	    if ( $action =~ /:/ ) {
@@ -1454,7 +1454,7 @@ sub process_action( $) {
 
 	push_comment( '' );
 
-	while ( read_a_line ) {
+	while ( read_a_line( NORMAL_READ ) ) {
 
 	    my ($target, $source, $dest, $proto, $ports, $sports, $origdest, $rate, $user, $mark, $connlimit, $time, $headers, $condition );
 
@@ -1482,8 +1482,8 @@ sub process_action( $) {
 
 	    if ( $target eq 'DEFAULTS' ) {
 		default_action_params( $action, split_list $source, 'defaults' ), next if $format == 2;
-		fatal_error 'DEFAULTS only allowed in FORMAT-2 actions'; 
-	    }	      
+		fatal_error 'DEFAULTS only allowed in FORMAT-2 actions';
+	    }
 
 	    process_rule1( $chainref,
 			   merge_levels( "$action:$level:$tag", $target ),
@@ -1520,7 +1520,7 @@ sub process_action( $) {
 #
 sub use_policy_action( $ ) {
     my $ref = use_action( $_[0] );
-    
+
     process_action( $ref ) if $ref;
 }
 
@@ -1547,7 +1547,7 @@ sub process_macro ( $$$$$$$$$$$$$$$$$$ ) {
 
     push_open $macrofile;
 
-    while ( read_a_line ) {
+    while ( read_a_line( NORMAL_READ ) ) {
 
 	my ( $mtarget, $msource, $mdest, $mproto, $mports, $msports, $morigdest, $mrate, $muser, $mmark, $mconnlimit, $mtime, $mheaders, $mcondition );
 
@@ -1559,7 +1559,7 @@ sub process_macro ( $$$$$$$$$$$$$$$$$$ ) {
 	}
 
 	fatal_error 'TARGET must be specified' if $mtarget eq '-';
-	
+
 	if ( $mtarget eq 'COMMENT' ) {
 	    process_comment unless $nocomment;
 	    next;
@@ -1589,7 +1589,7 @@ sub process_macro ( $$$$$$$$$$$$$$$$$$ ) {
 
 	my $actiontype = $targets{$action} || find_macro( $action );
 
-	fatal_error "Invalid Action ($mtarget) in macro" unless $actiontype & ( ACTION +  STANDARD + NATRULE +  MACRO );
+	fatal_error "Invalid Action ($mtarget) in macro" unless $actiontype & ( ACTION +  STANDARD + NATRULE + MACRO + CHAIN );
 
 	if ( $msource ) {
 	    if ( $msource eq '-' ) {
@@ -1663,12 +1663,12 @@ sub verify_audit($;$$) {
 #
 # Once a rule has been expanded via wildcards (source and/or dest zone eq 'all'), it is processed by this function. If
 # the target is a macro, the macro is expanded and this function is called recursively for each rule in the expansion.
-# Similarly, if a new action tuple is encountered, this function is called recursively for each rule in the action 
+# Similarly, if a new action tuple is encountered, this function is called recursively for each rule in the action
 # body. In this latter case, a reference to the tuple's chain is passed in the first ($chainref) argument.
 #
 sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
     my ( $chainref,   #reference to Action Chain if we are being called from process_action(); undef otherwise
-	 $target, 
+	 $target,
 	 $current_param,
 	 $source,
 	 $dest,
@@ -1688,12 +1688,12 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
     my ( $action, $loglevel) = split_action $target;
     my ( $basictarget, $param ) = get_target_param $action;
     my $rule = '';
-    my $optimize = $wildcard ? ( $basictarget =~ /!$/ ? 0 : $config{OPTIMIZE} & 1 ) : 0;
+    my $optimize = $wildcard ? ( $basictarget =~ /!$/ ? 0 : $config{OPTIMIZE} & 5 ) : 0;
     my $inaction = '';
     my $normalized_target;
     my $normalized_action;
     my $blacklist = ( $section eq 'BLACKLIST' );
- 
+
     ( $inaction, undef, undef, undef ) = split /:/, $normalized_action = $chainref->{action}, 4 if defined $chainref;
 
     $param = '' unless defined $param;
@@ -1822,8 +1822,8 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
 
 			  CONTINUE => sub { $action = 'RETURN'; } ,
 
-			  WHITELIST => sub { 
-			      fatal_error "'WHITELIST' may only be used in the blrules file" unless $blacklist; 
+			  WHITELIST => sub {
+			      fatal_error "'WHITELIST' may only be used in the blrules file" unless $blacklist;
 			      $action = 'RETURN';
 			  } ,
 
@@ -1838,7 +1838,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
 	    $function->();
 	} elsif ( $actiontype & SET ) {
 	    my %xlate = ( ADD => 'add-set' , DEL => 'del-set' );
-	    
+
 	    my ( $setname, $flags, $rest ) = split ':', $param, 3;
 	    fatal_error "Invalid ADD/DEL parameter ($param)" if $rest;
 	    fatal_error "Expected ipset name ($setname)" unless $setname =~ s/^\+// && $setname =~ /^[a-zA-Z]\w*$/;
@@ -1864,7 +1864,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
 	    $sourcezone = $source;
 	    $source = ALLIP;
 	}
-   
+
 	if ( $dest =~ /^(.*?):(.*)/ ) {
 	    fatal_error "Missing DEST Qualifier ($dest)" if $2 eq '';
 	    $destzone = $1;
@@ -1927,7 +1927,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
         # We are generating rules in an action chain -- the chain name is the name of that action chain
         #
 	$chain = $chainref->{name};
-    } else { 
+    } else {
 	unless ( $actiontype & NATONLY ) {
 	    #
 	    # Check for illegal bridge port rule
@@ -1953,7 +1953,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
 	    #
 	    # Handle Optimization
 	    #
-	    if ( $optimize > 0 && $section eq 'NEW' ) {
+	    if ( $optimize == 1 && $section eq 'NEW' ) {
 		my $loglevel = $filter_table->{$chainref->{policychain}}{loglevel};
 		if ( $loglevel ne '' ) {
 		    return 0 if $target eq "${policy}:$loglevel}";
@@ -1971,7 +1971,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
 	    if ( $blacklist ) {
 		my $blacklistchain = blacklist_chain( ${sourcezone}, ${destzone} );
 		my $blacklistref = $filter_table->{$blacklistchain};
-		
+
 		unless ( $blacklistref  ) {
 		    my @state;
 		    $blacklistref = new_chain 'filter', $blacklistchain;
@@ -1979,7 +1979,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
 		    @state = state_imatch( 'NEW,INVALID' ) if $config{BLACKLISTNEWONLY};
 		    add_ijump( $chainref, j => $blacklistref, @state );
 		}
-		    
+
 		$chain = $blacklistchain;
 		$chainref = $blacklistref;
 	    }
@@ -2017,7 +2017,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
 
     unless ( $section eq 'NEW' || $inaction ) {
 	if ( $config{FASTACCEPT} ) {
-	    fatal_error "Entries in the $section SECTION of the rules file not permitted with FASTACCEPT=Yes" unless 
+	    fatal_error "Entries in the $section SECTION of the rules file not permitted with FASTACCEPT=Yes" unless
 		$section eq 'BLACKLIST' ||
 		( $section eq 'RELATED' && ( $config{RELATED_DISPOSITION} ne 'ACCEPT' || $config{RELATED_LOG_LEVEL} ) )
 	}
@@ -2407,7 +2407,7 @@ sub process_rule ( ) {
 	progress_message "Rule \"$currentline\" ignored.";
 	return 1;
     }
-    
+
     my $intrazone = 0;
     my $wild      = 0;
     my $thisline  = $currentline; #We must save $currentline because it is overwritten by macro expansion
@@ -2473,11 +2473,11 @@ sub classic_blacklist() {
     my @vservers = vserver_zones;
     my @state = $config{BLACKLISTNEWONLY} ? $globals{UNTRACKED} ? state_imatch 'NEW,INVALID,UNTRACKED' : state_imatch 'NEW,INVALID' : ();
     my $result;
-    
+
     for my $zone ( @zones ) {
 	my $zoneref = find_zone( $zone );
 	my $simple  =  @zones <= 2 && ! $zoneref->{complex};
-	
+
 	if ( $zoneref->{options}{in}{blacklist} ) {
 	    my $blackref = $filter_table->{blacklst};
 	    add_ijump ensure_rules_chain( rules_chain( $zone, $_ ) ) , j => $blackref , @state for firewall_zone, @vservers;
@@ -2567,7 +2567,7 @@ sub process_rules( $ ) {
 		     }
 		   );
 
-	process_rule while read_a_line;
+	process_rule while read_a_line( NORMAL_READ );
     }
 
     $section = '';
@@ -2585,7 +2585,7 @@ sub process_rules( $ ) {
 
 	first_entry "$doing $fn...";
 
-	process_rule while read_a_line;
+	process_rule while read_a_line( NORMAL_READ );
 
 	clear_comment;
     }

Shorewall/Perl/Shorewall/Tc.pm

@@ -163,13 +163,17 @@ my  @tcclasses;
 my  %tcclasses;
 
 my  %restrictions = ( tcpre      => PREROUTE_RESTRICT ,
+		      PREROUTING => PREROUTE_RESTRICT ,
 		      tcpost     => POSTROUTE_RESTRICT ,
 		      tcfor      => NO_RESTRICT ,
 		      tcin       => INPUT_RESTRICT ,
-		      tcout      => OUTPUT_RESTRICT );
+		      tcout      => OUTPUT_RESTRICT ,
+		    );
 
 my $family;
 
+my $divertref; # DIVERT chain
+
 #
 # Rather than initializing globals in an INIT block or during declaration,
 # we initialize them in a function. This is done for two reasons:
@@ -181,31 +185,34 @@ my $family;
 #      able to re-initialize its dependent modules' state.
 #
 sub initialize( $ ) {
-    $family   = shift;
-    %classids = ();
+    $family    = shift;
+    %classids  = ();
     @tcdevices = ();
     %tcdevices = ();
     @tcclasses = ();
     %tcclasses = ();
     @devnums   = ();
-    $devnum = 0;
-    $sticky = 0;
-    $ipp2p  = 0;
+    $devnum    = 0;
+    $sticky    = 0;
+    $ipp2p     = 0;
+    $divertref = 0;
 }
 
 sub process_tc_rule( ) {
     my ( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $headers, $probability , $dscp );
     if ( $family == F_IPV4 ) {
 	( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $probability, $dscp ) =
-	    split_line1 'tcrules file', { mark => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, probability => 12 , dscp => 13 };
+	    split_line1 'tcrules file', { mark => 0, action => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, probability => 12 , dscp => 13 }, { COMMENT => 0, FORMAT => 2 } , 14;
 	$headers = '-';
     } else {
-	( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $headers, $probability, $dscp ) = 
-	    split_line1 'tcrules file', { mark => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, headers => 12, probability => 13 , dscp => 14 };
+	( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $headers, $probability, $dscp ) =
+	    split_line1 'tcrules file', { mark => 0, action => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, headers => 12, probability => 13 , dscp => 14 },  { COMMENT => 0, FORMAT => 2 }, 15;
     }
 
     our @tccmd;
 
+    our $format;
+
     fatal_error 'MARK must be specified' if $originalmark eq '-';
 
     if ( $originalmark eq 'COMMENT' ) {
@@ -213,6 +220,15 @@ sub process_tc_rule( ) {
 	return;
     }
 
+    if ( $originalmark eq 'FORMAT' ) {
+	if ( $source =~ /^([12])$/ ) {
+	    $format = $1;
+	    return;
+	}
+
+	fatal_error "Invalid FORMAT ($source)";
+    }
+
     my ( $mark, $designator, $remainder ) = split( /:/, $originalmark, 3 );
 
     fatal_error "Invalid MARK ($originalmark)" unless supplied $mark;
@@ -220,13 +236,13 @@ sub process_tc_rule( ) {
     my $chain    = $globals{MARKING_CHAIN};
     my $classid  = 0;
 
-    if ( $remainder ) { 
+    if ( $remainder ) {
 	if ( $originalmark =~ /^\w+\(?.*\)$/ ) {
 	    $mark = $originalmark; # Most likely, an IPv6 address is included in the parameter list
 	} else {
-	    fatal_error "Invalid MARK ($originalmark)" 
+	    fatal_error "Invalid MARK ($originalmark)"
 		unless ( $mark =~ /^([0-9a-fA-F]+)$/ &&
-			 $designator =~ /^([0-9a-fA-F]+)$/ && 
+			 $designator =~ /^([0-9a-fA-F]+)$/ &&
 			 ( $chain = $designator{$remainder} ) );
 	    $mark    = join( ':', $mark, $designator );
 	    $classid = 1;
@@ -242,6 +258,7 @@ sub process_tc_rule( ) {
     my $restriction = 0;
     my $cmd;
     my $rest;
+    my $matches = '';
 
     my %processtcc = ( sticky => sub() {
 			                  if ( $chain eq 'tcout' ) {
@@ -287,29 +304,63 @@ sub process_tc_rule( ) {
 						  $val = numeric_value ($s);
 						  fatal_error "Invalid Shift Bits ($s)" unless defined $val && $val >= 0 && $val < 128;
 						  $shift = $s;
-					      }			    
+					      }
 					  } else {
 					      fatal_error "Invalid MARK/CLASSIFY ($cmd)" unless $cmd eq 'IPMARK';
 					  }
 
 					  $target = "IPMARK --addr $srcdst --and-mask $mask1 --or-mask $mask2 --shift $shift";
 				      },
+		       DIVERT => sub() {
+			                  fatal_error "Invalid MARK ($originalmark)"               unless $format == 2;
+			                  fatal_error "Invalid DIVERT specification( $cmd/$rest )" if $rest;
+
+					  $chain = 'PREROUTING';
+
+					  $mark = in_hex( $globals{TPROXY_MARK} ) . '/' . in_hex( $globals{TPROXY_MARK} );
+
+					  unless ( $divertref ) {
+					      $divertref = new_chain( 'mangle', 'divert' );
+					      add_ijump( $divertref , j => 'MARK', targetopts => "--set-mark $mark"  );
+					      add_ijump( $divertref , j => 'ACCEPT' );
+					  }
+
+					  $target = 'divert';
+
+					  $matches = '! --tcp-flags FIN,SYN,RST,ACK SYN  -m socket --transparent ';
+				      },					      
 		       TPROXY => sub() {
 			                  require_capability( 'TPROXY_TARGET', 'Use of TPROXY', 's');
 
 			                  fatal_error "Invalid TPROXY specification( $cmd/$rest )" if $rest;
 
-					  $chain = 'tcpre';
+					  $chain = 'PREROUTING';
 
 					  $cmd =~ /TPROXY\((.+?)\)$/;
 
 					  my $params = $1;
+					  my ( $port, $ip, $bad );
 
-					  fatal_error "Invalid TPROXY specification( $cmd )" unless defined $params;
+					  if ( $format == 1 ) {
+					      fatal_error "Invalid TPROXY specification( $cmd )" unless defined $params;
 
-					  ( $mark, my $port, my $ip, my $bad ) = split ',', $params;
+					      ( $mark, $port, $ip, $bad ) = split_list $params, 'Parameter';
 
-					  fatal_error "Invalid TPROXY specification( $cmd )" if defined $bad;
+					      fatal_error "Invalid TPROXY specification( $cmd )" if defined $bad;
+
+					      warning_message "TPROXY is deprecated in a format-1 tcrules file";
+					  } else {
+					      if ( $params ) {
+						  ( $port, $ip, $bad ) = split_list $params, 'Parameter';
+
+						  fatal_error "Invalid TPROXY specification( $cmd )" if defined $bad;
+					      
+					      } else {
+						  fatal_error "Invalid TPROXY specification ($cmd)" unless $cmd eq 'TPROXY' || $cmd eq 'TPROXY()';
+					      }
+
+					      $mark = in_hex( $globals{TPROXY_MARK} ) . '/' . in_hex( $globals{TPROXY_MARK} );
+					  }
 
 					  if ( $port ) {
 					      $port = validate_port( 'tcp', $port );
@@ -379,7 +430,7 @@ sub process_tc_rule( ) {
 				      },
 		       DSCP => sub() {
 			                  assert( $cmd =~ /^DSCP\((\w+)\)$/ );
-					  require_capability 'DSCP_TARGET', 'The DSCP action', 's'; 
+					  require_capability 'DSCP_TARGET', 'The DSCP action', 's';
 					  my $dscp = numeric_value( $1 );
 					  $dscp = $dscpmap{$1} unless defined $dscp;
 					  fatal_error( "Invalid DSCP ($1)" ) unless defined $dscp && $dscp <= 0x38 && ! ( $dscp & 1 );
@@ -526,11 +577,11 @@ sub process_tc_rule( ) {
 	}
     }
 
-    fatal_error "USER/GROUP only allowed in the OUTPUT chain" unless ( $user eq '-' || ( $chain eq 'tcout' || $chain eq 'tcpost' ) ); 
+    fatal_error "USER/GROUP only allowed in the OUTPUT chain" unless ( $user eq '-' || ( $chain eq 'tcout' || $chain eq 'tcpost' ) );
 
     if ( ( my $result = expand_rule( ensure_chain( 'mangle' , $chain ) ,
 				     $restrictions{$chain} | $restriction,
-				     do_proto( $proto, $ports, $sports) .
+				     do_proto( $proto, $ports, $sports) . $matches .
 				     do_user( $user ) .
 				     do_test( $testval, $globals{TC_MASK} ) .
 				     do_length( $length ) .
@@ -539,7 +590,7 @@ sub process_tc_rule( ) {
 				     do_helper( $helper ) .
 				     do_headers( $headers ) .
 				     do_probability( $probability ) .
-				     do_dscp( $dscp ),
+				     do_dscp( $dscp ) ,
 				     $source ,
 				     $dest ,
 				     '' ,
@@ -587,7 +638,7 @@ sub calculate_quantum( $$ ) {
 #
 sub process_in_bandwidth( $ ) {
     my $in_rate     = shift;
-    
+
     return 0 if $in_rate eq '-' or $in_rate eq '0';
 
     my $in_burst    = '10kb';
@@ -605,7 +656,7 @@ sub process_in_bandwidth( $ ) {
 	    fatal_error "Invalid IN-BANDWIDTH ($in_band)" unless supplied( $in_interval ) && supplied( $in_decay );
 	    fatal_error "Invalid Interval ($in_interval)" unless $in_interval =~ /^(?:(?:250|500)ms|(?:1|2|4|8)sec)$/;
 	    fatal_error "Invalid Decay ($in_decay)"       unless $in_decay    =~ /^(?:500ms|(?:1|2|4|8|16|32|64)sec)$/;
-	    
+
 	    if ( $in_decay =~ /ms/ ) {
 		fatal_error "Decay must be at least twice the interval" unless $in_interval eq '250ms';
 	    } else {
@@ -615,12 +666,12 @@ sub process_in_bandwidth( $ ) {
 		    $decay    =~ s/sec//;
 
 		    fatal_error "Decay must be at least twice the interval" unless $decay > $interval;
-		} 
+		}
 	    }
 	}
-	    
+
 	$in_avrate = rate_to_kbit( $in_rate );
-	$in_rate = 0; 
+	$in_rate = 0;
     } else {
 	if ( $in_band =~ /:/ ) {
 	    ( $in_band, $burst ) = split /:/, $in_rate, 2;
@@ -629,7 +680,7 @@ sub process_in_bandwidth( $ ) {
 	}
 
 	$in_rate = rate_to_kbit( $in_band );
-	
+
     }
 
     [ $in_rate, $in_burst, $in_avrate, $in_interval, $in_decay ];
@@ -643,7 +694,7 @@ sub handle_in_bandwidth( $$ ) {
     my ($in_rate, $in_burst, $in_avrate, $in_interval, $in_decay ) = @$arrayref;
 
     emit ( "run_tc qdisc add dev $physical handle ffff: ingress" );
-    
+
     if ( have_capability 'BASIC_FILTER' ) {
 	if ( $in_rate ) {
 	    emit( "run_tc filter add dev $physical parent ffff: protocol all prio 10 basic \\",
@@ -663,7 +714,7 @@ sub handle_in_bandwidth( $$ ) {
 	      "    police rate ${in_rate}kbit burst $in_burst drop flowid :1\n" );
     }
 }
-	
+
 sub process_flow($) {
     my $flow = shift;
 
@@ -774,7 +825,7 @@ sub process_simple_device() {
 	emit "run_tc filter add dev $physical protocol all prio 1 parent ${number}$i: handle ${number}${i} flow hash keys $type divisor 1024" if $type ne '-' && have_capability 'FLOW_FILTER';
 	emit '';
     }
-    
+
     emit( "run_tc filter add dev $physical parent $number:0 protocol all prio 1 u32" .
 	  "\\\n    match ip protocol 6 0xff" .
 	  "\\\n    match u8 0x05 0x0f at 0" .
@@ -1319,7 +1370,7 @@ sub process_tc_filter() {
 	} else {
 	    push @$filtersref, ( "\nrun_tc $rule\\" ,
 				 "   link $tnum:0 offset plus 40 eat" );
-	}    
+	}
 	#
 	# The rule to match the port(s) will be inserted into the new table
 	#
@@ -1452,10 +1503,10 @@ sub process_tcfilters() {
 
     if ( $fn ) {
 	my @family = ( $family );
-	
+
 	first_entry( "$doing $fn..." );
-	
-	while ( read_a_line ) {
+
+	while ( read_a_line( NORMAL_READ ) ) {
 	    if ( $currentline =~ /^\s*IPV4\s*$/ ) {
 		Shorewall::IPAddrs::initialize( $family = F_IPV4 ) unless $family == F_IPV4;
 	    } elsif ( $currentline =~ /^\s*IPV6\s*$/ ) {
@@ -1555,7 +1606,7 @@ sub process_tcinterfaces() {
 
     if ( $fn ) {
 	first_entry "$doing $fn...";
-	process_simple_device while read_a_line;
+	process_simple_device while read_a_line( NORMAL_READ );
     }
 }
 
@@ -1573,7 +1624,7 @@ sub process_tcpri() {
 		warning_message "There are entries in $fn1 but $fn was empty" unless @tcdevices || $family == F_IPV6;
 	    };
 
-	process_tc_priority while read_a_line;
+	process_tc_priority while read_a_line( NORMAL_READ );
 
 	clear_comment;
 
@@ -1584,9 +1635,15 @@ sub process_tcpri() {
 			  mark => '--mark 0/'   . in_hex( $globals{TC_MASK} )
 			);
 
+	    insert_irule( $mangle_table->{tcpost} ,
+			  j => 'RETURN', 
+			  1 ,
+			  mark => '! --mark 0/' . in_hex( $globals{TC_MASK} ) ,
+			);
+
 	    add_ijump( $mangle_table->{tcpost} ,
 		       j    => 'CONNMARK --save-mark --ctmask '    . in_hex( $globals{TC_MASK} ),
-		       mark => '! --mark 0/' . in_hex( $globals{TC_MASK} ) 
+		       mark => '! --mark 0/' . in_hex( $globals{TC_MASK} )
 		     );
 	}
     }
@@ -1604,7 +1661,7 @@ sub process_traffic_shaping() {
     if ( $fn ) {
 	first_entry "$doing $fn...";
 
-	validate_tc_device while read_a_line;
+	validate_tc_device while read_a_line( NORMAL_READ );
     }
 
     $devnum = $devnum > 10 ? 10 : 1;
@@ -1614,7 +1671,7 @@ sub process_traffic_shaping() {
     if ( $fn ) {
 	first_entry "$doing $fn...";
 
-	validate_tc_class while read_a_line;
+	validate_tc_class while read_a_line( NORMAL_READ );
     }
 
     process_tcfilters;
@@ -1711,7 +1768,7 @@ sub process_traffic_shaping() {
 
 		my $priority = $tcref->{priority} << 8;
 		my $parent   = in_hexp $tcref->{parent};
-		
+
 		emit ( "[ \$${dev}_mtu -gt $quantum ] && quantum=\$${dev}_mtu || quantum=$quantum" );
 
 		if ( $devref->{qdisc} eq 'htb' ) {
@@ -1758,7 +1815,7 @@ sub process_traffic_shaping() {
 		    my ( $tos, $mask ) = split q(/), $tospair;
 		    emit "run_tc filter add dev $device parent $devicenumber:0 protocol ip prio " . ( $priority | 10 ) . " u32 match ip tos $tos $mask flowid $classid";
 		}
-		
+
 		save_progress_message_short qq("   TC Class $classid defined.");
 		emit '';
 
@@ -1767,7 +1824,7 @@ sub process_traffic_shaping() {
 	    emit '';
 
 	    emit "$_" for @{$devref->{filters}};
-	
+
 	    save_progress_message_short qq("   TC Device $device defined.");
 
 	    pop_indent;
@@ -1819,7 +1876,7 @@ sub process_tc() {
     # enabled.
 
     my %empty;
-    
+
     $config{TC_ENABLED} eq 'Shared' ? \%empty : \%tcdevices;
 }
 
@@ -1959,13 +2016,13 @@ sub setup_tc() {
     if ( $config{TC_ENABLED} ) {
 	our  @tccmd = ( { match     => sub ( $ ) { $_[0] eq 'SAVE' } ,
 			  target    => 'CONNMARK --save-mark --mask' ,
-			  mark      => SMALLMARK ,
+			  mark      => $config{TC_EXPERT} ? HIGHMARK : SMALLMARK,
 			  mask      => in_hex( $globals{TC_MASK} ) ,
 			  connmark  => 1
 			} ,
 			{ match     => sub ( $ ) { $_[0] eq 'RESTORE' },
 			  target    => 'CONNMARK --restore-mark --mask' ,
-			  mark      => SMALLMARK ,
+			  mark      => $config{TC_EXPERT} ? HIGHMARK : SMALLMARK ,
 			  mask      => in_hex( $globals{TC_MASK} ) ,
 			  connmark  => 1
 			} ,
@@ -2002,6 +2059,11 @@ sub setup_tc() {
 			  mark      => HIGHMARK,
 			  mask      => '',
 			  connmark  => '' },
+			{ match     => sub( $ ) { $_[0] =~ /^DIVERT/ },
+			  target    => 'DIVERT',
+			  mark      => HIGHMARK,
+			  mask      => '',
+			  connmark  => '' },
 			{ match     => sub( $ ) { $_[0] =~ /^TTL/ },
 			  target    => 'TTL',
 			  mark      => NOMARK,
@@ -2036,11 +2098,14 @@ sub setup_tc() {
 
 	if ( my $fn = open_file 'tcrules' ) {
 
+	    our $format = 1;
+
 	    first_entry "$doing $fn...";
 
-	    process_tc_rule while read_a_line;
+	    process_tc_rule while read_a_line( NORMAL_READ );
 
 	    clear_comment;
+
 	}
     }
 
@@ -2049,7 +2114,7 @@ sub setup_tc() {
 
 	    first_entry "$doing $fn...";
 
-	    process_secmark_rule while read_a_line;
+	    process_secmark_rule while read_a_line( NORMAL_READ );
 
 	    clear_comment;
 	}

Shorewall/Perl/Shorewall/Tunnels.pm

@@ -234,7 +234,7 @@ sub setup_tunnels() {
     }
 
     sub setup_one_tunnel($$$$) {
-	my ( $kind , $zone, $gateway, $gatewayzones ) = @_;
+	my ( $kind , $zone, $gateways, $gatewayzones ) = @_;
 
 	my $zonetype = zone_type( $zone );
 
@@ -243,35 +243,42 @@ sub setup_tunnels() {
 	my $inchainref  = ensure_rules_chain( rules_chain( ${zone}, ${fw} ) );
 	my $outchainref = ensure_rules_chain( rules_chain( ${fw}, ${zone} ) );
 
-	$gateway = ALLIP if $gateway eq '-';
+	$gateways = ALLIP if $gateways eq '-';
 
-	my @source = imatch_source_net $gateway;
-	my @dest   = imatch_dest_net   $gateway;
+	my ( $net, $excl ) = handle_network_list( $gateways , 'src' );
+	( $net, $excl )    = handle_network_list( $gateways , 'dst' );
 
-	my %tunneltypes = ( 'ipsec'         => { function => \&setup_one_ipsec ,         params   => [ $kind, \@source, \@dest , $gatewayzones ] } ,
-			    'ipsecnat'      => { function => \&setup_one_ipsec ,         params   => [ $kind, \@source, \@dest , $gatewayzones ] } ,
-			    'ipip'          => { function => \&setup_one_other,          params   => [ \@source, \@dest , 4 ] } ,
-			    'gre'           => { function => \&setup_one_other,          params   => [ \@source, \@dest , 47 ] } ,
-			    '6to4'          => { function => \&setup_one_other,          params   => [ \@source, \@dest , 41 ] } ,
-			    '6in4'          => { function => \&setup_one_other,          params   => [ \@source, \@dest , 41 ] } ,
-			    'pptpclient'    => { function => \&setup_pptp_client,        params   => [ $kind, \@source, \@dest ] } ,
-			    'pptpserver'    => { function => \&setup_pptp_server,        params   => [ $kind, \@source, \@dest ] } ,
-			    'openvpn'       => { function => \&setup_one_openvpn,        params   => [ $kind, \@source, \@dest ] } ,
-			    'openvpnclient' => { function => \&setup_one_openvpn_client, params   => [ $kind, \@source, \@dest ] } ,
-			    'openvpnserver' => { function => \&setup_one_openvpn_server, params   => [ $kind, \@source, \@dest ] } ,
-			    'l2tp'          => { function => \&setup_one_l2tp ,          params   => [ $kind, \@source, \@dest ] } ,
-			    'generic'       => { function => \&setup_one_generic ,       params   => [ $kind, \@source, \@dest ] } ,
-			  );
+	fatal_error "Exclusion is not allowed in the GATEWAYS column" if $excl;
 
-	$kind = "\L$kind";
+	for my $gateway ( split_list $gateways, 'GATEWAYS' ) {
+	    my @source = imatch_source_net $gateway;
+	    my @dest   = imatch_dest_net   $gateway;
 
-	(my $type) = split /:/, $kind;
+	    my %tunneltypes = ( 'ipsec'         => { function => \&setup_one_ipsec ,         params   => [ $kind, \@source, \@dest , $gatewayzones ] } ,
+				'ipsecnat'      => { function => \&setup_one_ipsec ,         params   => [ $kind, \@source, \@dest , $gatewayzones ] } ,
+				'ipip'          => { function => \&setup_one_other,          params   => [ \@source, \@dest , 4 ] } ,
+				'gre'           => { function => \&setup_one_other,          params   => [ \@source, \@dest , 47 ] } ,
+				'6to4'          => { function => \&setup_one_other,          params   => [ \@source, \@dest , 41 ] } ,
+				'6in4'          => { function => \&setup_one_other,          params   => [ \@source, \@dest , 41 ] } ,
+				'pptpclient'    => { function => \&setup_pptp_client,        params   => [ $kind, \@source, \@dest ] } ,
+				'pptpserver'    => { function => \&setup_pptp_server,        params   => [ $kind, \@source, \@dest ] } ,
+				'openvpn'       => { function => \&setup_one_openvpn,        params   => [ $kind, \@source, \@dest ] } ,
+				'openvpnclient' => { function => \&setup_one_openvpn_client, params   => [ $kind, \@source, \@dest ] } ,
+				'openvpnserver' => { function => \&setup_one_openvpn_server, params   => [ $kind, \@source, \@dest ] } ,
+				'l2tp'          => { function => \&setup_one_l2tp ,          params   => [ $kind, \@source, \@dest ] } ,
+				'generic'       => { function => \&setup_one_generic ,       params   => [ $kind, \@source, \@dest ] } ,
+			      );
 
-	my $tunnelref = $tunneltypes{ $type };
+	    $kind = "\L$kind";
 
-	fatal_error "Tunnels of type $type are not supported" unless $tunnelref;
+	    (my $type) = split /:/, $kind;
 
-	$tunnelref->{function}->( $inchainref, $outchainref, @{$tunnelref->{params}} );
+	    my $tunnelref = $tunneltypes{ $type };
+
+	    fatal_error "Tunnels of type $type are not supported" unless $tunnelref;
+
+	    $tunnelref->{function}->( $inchainref, $outchainref, @{$tunnelref->{params}} );
+	}
 
 	progress_message "   Tunnel \"$currentline\" $done";
     }
@@ -283,16 +290,16 @@ sub setup_tunnels() {
 
 	first_entry "$doing $fn...";
 
-	while ( read_a_line ) {
+	while ( read_a_line( NORMAL_READ ) ) {
 
-	    my ( $kind, $zone, $gateway, $gatewayzones ) = split_line1 'tunnels file', { type => 0, zone => 1, gateway => 2, gateway_zone => 3 };
+	    my ( $kind, $zone, $gateway, $gatewayzones ) = split_line1 'tunnels file', { type => 0, zone => 1, gateway => 2, gateways => 2, gateway_zone => 3 , gateway_zones => 3 }, undef, 4;
 
 	    fatal_error 'TYPE must be specified' if $kind eq '-';
-	    fatal_error 'ZONE must be specified' if $zone eq '-';
 
 	    if ( $kind eq 'COMMENT' ) {
 		process_comment;
 	    } else {
+		fatal_error 'ZONE must be specified' if $zone eq '-';
 		setup_one_tunnel $kind, $zone, $gateway, $gatewayzones;
 	    }
 	}

Shorewall/Perl/Shorewall/Zones.pm

@@ -545,7 +545,7 @@ sub determine_zones()
 
     if ( my $fn = open_file 'zones' ) {
 	first_entry "$doing $fn...";
-	push @z, process_zone( $ip ) while read_a_line;
+	push @z, process_zone( $ip ) while read_a_line( NORMAL_READ );
     } else {
 	fatal_error q(The 'zones' file does not exist or has zero size);
     }
@@ -711,7 +711,7 @@ sub add_group_to_zone($$$$$)
     my $interfaceref;
     my $zoneref  = $zones{$zone};
     my $zonetype = $zoneref->{type};
-    
+
 
     $zoneref->{interfaces}{$interface} = 1;
 
@@ -934,9 +934,9 @@ sub process_interface( $$ ) {
 	    return;
 	}
 
-	fatal_error "Invalid FORMAT ($1)";
+	fatal_error "Invalid FORMAT ($originalinterface)";
     }
-	
+
     if ( $zone eq '-' ) {
 	$zone = '';
     } else {
@@ -992,7 +992,7 @@ sub process_interface( $$ ) {
 	$root = substr( $interface, 0, -1 );
 	$roots{$root} = $interface;
 	my $len = length $root;
-	
+
 	if ( $minroot ) {
 	    $minroot = $len if $minroot > $len;
 	} else {
@@ -1090,7 +1090,7 @@ sub process_interface( $$ ) {
 		    assert( 0 );
 		}
 	    } elsif ( $type == NUMERIC_IF_OPTION ) {
-		fatal_error "The '$option' option may not be specified on a wildcard interface" if $wildcard && ! $type && IF_OPTION_WILDOK; 
+		fatal_error "The '$option' option may not be specified on a wildcard interface" if $wildcard && ! $type && IF_OPTION_WILDOK;
 		$value = $defaultinterfaceoptions{$option} unless defined $value;
 		fatal_error "The '$option' option requires a value" unless defined $value;
 		my $numval = numeric_value $value;
@@ -1208,13 +1208,13 @@ sub process_interface( $$ ) {
 sub validate_interfaces_file( $ ) {
     my  $export = shift;
     our $format = 1;
-    
+
     my @ifaces;
     my $nextinum = 1;
 
     if ( my $fn = open_file 'interfaces' ) {
 	first_entry "$doing $fn...";
-	push @ifaces, process_interface( $nextinum++, $export ) while read_a_line;
+	push @ifaces, process_interface( $nextinum++, $export ) while read_a_line( NORMAL_READ );
     } else {
 	fatal_error q(The 'interfaces' file does not exist or has zero size);
     }
@@ -1297,7 +1297,7 @@ sub known_interface($)
     if ( $minroot ) {
 	while ( length $iface > $minroot ) {
 	    chop $iface;
-	
+
 	    if ( my $i = $roots{$iface} ) {
 		$interfaceref = $interfaces{$i};
 
@@ -1373,7 +1373,7 @@ sub physical_name( $ ) {
 
     $devref ? $devref->{physical} : $device;
 }
-    
+
 #
 # Returns true if there are bridge port zones defined in the config
 #
@@ -1479,7 +1479,7 @@ sub get_interface_option( $$ ) {
     assert( $ref = known_interface( $interface ) );
 
     $ref->{options}{$option};
-    
+
 }
 
 #
@@ -1742,7 +1742,7 @@ sub compile_updown() {
 
     if ( @$optional ) {
 	my @interfaces = map $interfaces{$_}->{physical}, @$optional;
-	my $interfaces = join '|', @interfaces; 
+	my $interfaces = join '|', @interfaces;
 
 	if ( $interfaces =~ s/\+/*/g || @interfaces > 1 ) {
 	    emit( "$interfaces)",
@@ -1808,7 +1808,7 @@ sub compile_updown() {
 #
 sub process_host( ) {
     my $ipsec = 0;
-    my ($zone, $hosts, $options ) = split_line 'hosts file', { zone => 0, hosts => 1, options => 2 };
+    my ($zone, $hosts, $options ) = split_line1 'hosts file', { zone => 0, host => 1, hosts => 1, options => 2 }, {}, 3;
 
     fatal_error 'ZONE must be specified'  if $zone eq '-';
     fatal_error 'HOSTS must be specified' if $hosts eq '-';
@@ -1838,7 +1838,7 @@ sub process_host( ) {
 
 	fatal_error "Unknown interface ($interface)" unless ($interfaceref = $interfaces{$interface}) && $interfaceref->{root};
     } else {
-	fatal_error "Invalid HOST(S) column contents: $hosts" 
+	fatal_error "Invalid HOST(S) column contents: $hosts"
     }
 
     if ( $hosts =~ /^!?\+/ ) {
@@ -1935,7 +1935,7 @@ sub validate_hosts_file()
 
     if ( my $fn = open_file 'hosts' ) {
 	first_entry "$doing $fn...";
-	$ipsec |= process_host while read_a_line;
+	$ipsec |= process_host while read_a_line( NORMAL_READ );
     }
 
     $have_ipsec = $ipsec || haveipseczones;

Shorewall/Perl/compiler.pl

@@ -37,6 +37,7 @@
 #         --log_verbosity=<number>    # Log Verbosity range -1 to 2
 #         --family=<number>           # IP family; 4 = IPv4 (default), 6 = IPv6
 #         --preview                   # Preview the ruleset.
+#         --shorewallrc=<path>        # Path to shorewallrc file.
 #         --config_path=<path-list>   # Search path for config files
 #
 use strict;
@@ -65,7 +66,7 @@ sub usage( $ ) {
     [ --annotate ]
     [ --update ]
     [ --convert ]
-    [ --shorewallrc ]
+    [ --shorewallrc=<pathname> ]
     [ --config_path=<path-list> ]
 ';
 

Shorewall/Perl/macro.BLACKLIST

@@ -1,11 +0,0 @@
-#
-# Shorewall version 4 - blacklist Macro
-#
-# /usr/share/shorewall/macro.blacklist
-#
-#	This macro handles blacklisting using BLACKLIST_DISPOSITION and BLACKLIST_LOGLEVEL
-#
-###############################################################################
-#ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
-#				PORT(S)	PORT(S)	LIMIT	GROUP
-$BLACKLIST_DISPOSITION:$BLACKLIST_LOGLEVEL

Shorewall/Perl/prog.footer

@@ -38,7 +38,7 @@ checkkernelversion() {
     if [ $g_family -eq 6 ]; then
 	kernel=$(uname -r 2> /dev/null | sed -e 's/-.*//')
 
-	case "$kernel" in 
+	case "$kernel" in
 	    *.*.*)
 		kernel=$(printf "%d%02d%02d" $(echo $kernel | sed -e 's/^\([0-9][0-9]*\)\.\([0-9][0-9]*\)\.\([0-9][0-9]*\).*$/\1 \2 \3/g'))
 		;;
@@ -235,8 +235,8 @@ case "$COMMAND" in
 	    status=2
 	elif checkkernelversion; then
 	    if [ $# -eq 1 ]; then
-		$IP6TABLES -Z
-		$IP6TABLES -t mangle -Z
+		$g_tool -Z
+		$g_tool -t mangle -Z
 		date > ${VARDIR}/restarted
 		status=0
 		progress_message3 "$g_product Counters Reset"
@@ -245,7 +245,7 @@ case "$COMMAND" in
 		status=0
 		for chain in $@; do
 		    if chain_exists $chain; then
-			if qt $IP6TABLES -Z $chain; then
+			if qt $g_tool-Z $chain; then
 			    progress_message3 "Filter $chain Counters Reset"
 			else
 			    error_message "ERROR: Reset of chain $chain failed"

Shorewall/Samples/LICENSE

@@ -55,7 +55,7 @@ modified by someone else and passed on, the recipients should know
 that what they have is not the original version, so that the original
 author's reputation will not be affected by problems that might be
 introduced by others.
-
+
   Finally, software patents pose a constant threat to the existence of
 any free program.  We wish to make sure that a company cannot
 effectively restrict the users of a free program by obtaining a
@@ -111,7 +111,7 @@ modification follow.  Pay close attention to the difference between a
 "work based on the library" and a "work that uses the library".  The
 former contains code derived from the library, whereas the latter must
 be combined with the library in order to run.
-
+
 		  GNU LESSER GENERAL PUBLIC LICENSE
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 
@@ -146,7 +146,7 @@ such a program is covered only if its contents constitute a work based
 on the Library (independent of the use of the Library in a tool for
 writing it).  Whether that is true depends on what the Library does
 and what the program that uses the Library does.
-  
+
   1. You may copy and distribute verbatim copies of the Library's
 complete source code as you receive it, in any medium, provided that
 you conspicuously and appropriately publish on each copy an
@@ -158,7 +158,7 @@ Library.
   You may charge a fee for the physical act of transferring a copy,
 and you may at your option offer warranty protection in exchange for a
 fee.
-
+
   2. You may modify your copy or copies of the Library or any portion
 of it, thus forming a work based on the Library, and copy and
 distribute such modifications or work under the terms of Section 1
@@ -216,7 +216,7 @@ instead of to this License.  (If a newer version than version 2 of the
 ordinary GNU General Public License has appeared, then you can specify
 that version instead if you wish.)  Do not make any other change in
 these notices.
-
+
   Once this change is made in a given copy, it is irreversible for
 that copy, so the ordinary GNU General Public License applies to all
 subsequent copies and derivative works made from that copy.
@@ -267,7 +267,7 @@ Library will still fall under Section 6.)
 distribute the object code for the work under the terms of Section 6.
 Any executables containing that work also fall under Section 6,
 whether or not they are linked directly with the Library itself.
-
+
   6. As an exception to the Sections above, you may also combine or
 link a "work that uses the Library" with the Library to produce a
 work containing portions of the Library, and distribute that work
@@ -329,7 +329,7 @@ restrictions of other proprietary libraries that do not normally
 accompany the operating system.  Such a contradiction means you cannot
 use both them and the Library together in an executable that you
 distribute.
-
+
   7. You may place library facilities that are a work based on the
 Library side-by-side in a single library together with other library
 facilities not covered by this License, and distribute such a combined
@@ -370,7 +370,7 @@ subject to these terms and conditions.  You may not impose any further
 restrictions on the recipients' exercise of the rights granted herein.
 You are not responsible for enforcing compliance by third parties with
 this License.
-
+
   11. If, as a consequence of a court judgment or allegation of patent
 infringement or for any other reason (not limited to patent issues),
 conditions are imposed on you (whether by court order, agreement or
@@ -422,7 +422,7 @@ conditions either of that version or of any later version published by
 the Free Software Foundation.  If the Library does not specify a
 license version number, you may choose any version ever published by
 the Free Software Foundation.
-
+
   14. If you wish to incorporate parts of the Library into other free
 programs whose distribution conditions are incompatible with these,
 write to the author to ask for permission.  For software which is
@@ -456,7 +456,7 @@ SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
 DAMAGES.
 
 		     END OF TERMS AND CONDITIONS
-
+
            How to Apply These Terms to Your New Libraries
 
   If you develop a new library, and you want it to be of the greatest

Shorewall/Samples/Universal/interfaces

@@ -7,6 +7,8 @@
 # http://www.shorewall.net/manpages/shorewall-interfaces.html
 #
 ###############################################################################
-#ZONE	INTERFACE	BROADCAST	OPTIONS
--	lo		-		ignore
-net	all		-		dhcp,physical=+,routeback,optional
+FORMAT 2
+###############################################################################
+#ZONE	INTERFACE	OPTIONS
+-	lo		ignore
+net	all		dhcp,physical=+,routeback,optional

Shorewall/Samples/Universal/shorewall.conf

@@ -55,12 +55,16 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
 
+GEOIPDIR=/usr/share/xt_geoip/LE
+
 IPTABLES=
 
 IP=
 
 IPSET=
 
+LOCKFILE=
+
 MODULESDIR=
 
 PERL=/usr/bin/perl

Shorewall/Samples/one-interface/interfaces

@@ -11,5 +11,7 @@
 #------------------------------------------------------------------------------
 # For information about entries in this file, type "man shorewall-interfaces"
 ###############################################################################
-#ZONE	INTERFACE	BROADCAST	OPTIONS
-net     eth0            detect          dhcp,tcpflags,logmartians,nosmurfs
+FORMAT 2
+###############################################################################
+#ZONE	INTERFACE	OPTIONS
+net     eth0            dhcp,tcpflags,logmartians,nosmurfs

Shorewall/Samples/one-interface/shorewall.conf

@@ -13,7 +13,7 @@
 #
 # For information about the settings in this file, type "man shorewall.conf"
 #
-# The manpage is also online at 
+# The manpage is also online at
 # http://shorewall.net/manpages/shorewall.conf.html
 #
 ###############################################################################
@@ -66,12 +66,16 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
 
+GEOIPDIR=/usr/share/xt_geoip/LE
+
 IPTABLES=
 
 IP=
 
 IPSET=
 
+LOCKFILE=
+
 MODULESDIR=
 
 PERL=/usr/bin/perl

Shorewall/Samples/three-interfaces/interfaces

@@ -11,7 +11,9 @@
 #------------------------------------------------------------------------------
 # For information about entries in this file, type "man shorewall-interfaces"
 ###############################################################################
-#ZONE	INTERFACE	BROADCAST	OPTIONS
-net     eth0            detect          tcpflags,dhcp,nosmurfs,routefilter,logmartians
-loc     eth1            detect          tcpflags,nosmurfs,routefilter,logmartians
-dmz     eth2            detect		tcpflags,nosmurfs,routefilter,logmartians
+FORMAT 2
+###############################################################################
+#ZONE	INTERFACE	OPTIONS
+net     eth0            tcpflags,dhcp,nosmurfs,routefilter,logmartians
+loc     eth1            tcpflags,nosmurfs,routefilter,logmartians
+dmz     eth2            tcpflags,nosmurfs,routefilter,logmartians

Shorewall/Samples/three-interfaces/shorewall.conf

@@ -14,7 +14,7 @@
 #
 # For information about the settings in this file, type "man shorewall.conf"
 #
-# The manpage is also online at 
+# The manpage is also online at
 # http://shorewall.net/manpages/shorewall.conf.html
 #
 ###############################################################################
@@ -64,12 +64,16 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
 
+GEOIPDIR=/usr/share/xt_geoip/LE
+
 IPTABLES=
 
 IP=
 
 IPSET=
 
+LOCKFILE=
+
 MODULESDIR=
 
 PERL=/usr/bin/perl

Shorewall/Samples/two-interfaces/interfaces

@@ -11,6 +11,8 @@
 #------------------------------------------------------------------------------
 # For information about entries in this file, type "man shorewall-interfaces"
 ###############################################################################
-#ZONE	INTERFACE	BROADCAST	OPTIONS
-net     eth0            detect          dhcp,tcpflags,nosmurfs,routefilter,logmartians
-loc     eth1            detect          tcpflags,nosmurfs,routefilter,logmartians
+FORMAT 2
+###############################################################################
+#ZONE	INTERFACE	OPTIONS
+net     eth0            dhcp,tcpflags,nosmurfs,routefilter,logmartians
+loc     eth1            tcpflags,nosmurfs,routefilter,logmartians

Shorewall/Samples/two-interfaces/shorewall.conf

@@ -3,7 +3,7 @@
 # Shorewall version 4.0 - Sample shorewall.conf for two-interface
 #                         configuration.
 # Copyright (C) 2006,2007 by the Shorewall Team
-#               2011 by Thomas M. Eastep            
+#               2011 by Thomas M. Eastep
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -14,7 +14,7 @@
 #
 # For information about the settings in this file, type "man shorewall.conf"
 #
-# The manpage is also online at 
+# The manpage is also online at
 # http://shorewall.net/manpages/shorewall.conf.html
 #
 ###############################################################################
@@ -67,12 +67,16 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
 
+GEOIPDIR=/usr/share/xt_geoip/LE
+
 IPTABLES=
 
 IP=
 
 IPSET=
 
+LOCKFILE=
+
 MODULESDIR=
 
 PERL=/usr/bin/perl

Shorewall/action.Broadcast

@@ -22,7 +22,7 @@
 #       along with this program; if not, write to the Free Software
 #       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-#   Broadcast[([<action>|-[,{audit|-}])] 
+#   Broadcast[([<action>|-[,{audit|-}])]
 #
 #       Default action is DROP
 #
@@ -51,7 +51,7 @@ if ( have_capability( 'ADDRTYPE' ) ) {
 	log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type BROADCAST ';
 	log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type MULTICAST ';
 	log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type ANYCAST ';
-    }	
+    }
 
     add_jump $chainref, $target, 0, '-m addrtype --dst-type BROADCAST ';
     add_jump $chainref, $target, 0, '-m addrtype --dst-type MULTICAST ';
@@ -64,7 +64,7 @@ if ( have_capability( 'ADDRTYPE' ) ) {
     decr_cmd_level $chainref;
     add_commands $chainref, 'done';
 }
-    
+
 log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d 224.0.0.0/4 ' if $level ne '';
 add_jump $chainref, $target, 0, '-d 224.0.0.0/4 ';
 

Shorewall/action.Drop

@@ -33,7 +33,7 @@
 ###############################################################################
 FORMAT 2
 #
-# The following magic provides different defaults for $2 thru $5, when $1 is 
+# The following magic provides different defaults for $2 thru $5, when $1 is
 # 'audit'.
 #
 BEGIN PERL;
@@ -41,7 +41,7 @@ use Shorewall::Config;
 
 my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
 
-if ( defined $p1 ) { 
+if ( defined $p1 ) {
     if ( $p1 eq 'audit' ) {
 	set_action_param( 2, 'A_REJECT')   unless supplied $p2;
 	set_action_param( 3, 'A_DROP')     unless supplied $p3;

Shorewall/action.DropSmurfs

@@ -41,15 +41,15 @@ if ( $level ne '-' || $audit ne '-' ) {
 	fatal_error "Invalid argument ($audit) to DropSmurfs" if $audit ne 'audit';
 	require_capability 'AUDIT_TARGET', q(Passing 'audit' to the DropSmurfs action), 's';
 	add_ijump( $logchainref, j => 'AUDIT --type DROP' );
-    } 
-	
+    }
+
     add_ijump( $logchainref, j => 'DROP' );
 
     $target = $logchainref;
 } else {
     $target = 'DROP';
 }
-		    
+
 if ( have_capability( 'ADDRTYPE' ) ) {
     if ( $family == F_IPV4 ) {
 	add_ijump $chainref , j => 'RETURN', s => '0.0.0.0';         ;
@@ -64,7 +64,7 @@ if ( have_capability( 'ADDRTYPE' ) ) {
     } else {
 	add_commands $chainref, 'for address in $ALL_ACASTS; do';
     }
-    
+
     incr_cmd_level $chainref;
     add_ijump( $chainref, g => $target, s => '$address' );
     decr_cmd_level $chainref;
@@ -80,6 +80,6 @@ if ( $family == F_IPV4 ) {
 END PERL;
 
 
-    
+
 
 

Shorewall/action.Invalid

@@ -22,7 +22,7 @@
 #       along with this program; if not, write to the Free Software
 #       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-#   Invalid[([<action>|-[,{audit|-}])] 
+#   Invalid[([<action>|-[,{audit|-}])]
 #
 #       Default action is DROP
 #

Shorewall/action.NotSyn

@@ -22,7 +22,7 @@
 #       along with this program; if not, write to the Free Software
 #       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-#   NotSyn[([<action>|-[,{audit|-}])] 
+#   NotSyn[([<action>|-[,{audit|-}])]
 #
 #       Default action is DROP
 #

Shorewall/action.RST

@@ -0,0 +1,55 @@
+#
+# Shorewall 4 - RST Action
+#
+#    /usr/share/shorewall/action.RST
+#
+#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
+#
+#     (c) 2012 - Tom Eastep (teastep@shorewall.net)
+#
+#       Complete documentation is available at http://shorewall.net
+#
+#       This program is free software; you can redistribute it and/or modify
+#       it under the terms of Version 2 of the GNU General Public License
+#       as published by the Free Software Foundation.
+#
+#       This program is distributed in the hope that it will be useful,
+#       but WITHOUT ANY WARRANTY; without even the implied warranty of
+#       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+#       GNU General Public License for more details.
+#
+#       You should have received a copy of the GNU General Public License
+#       along with this program; if not, write to the Free Software
+#       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+#   RST[([<action>|-[,{audit|-}])]
+#
+#       Default action is DROP
+#
+##########################################################################################
+FORMAT 2
+
+DEFAULTS DROP,-
+
+BEGIN PERL;
+
+use Shorewall::Config;
+use Shorewall::Chains;
+
+my ( $action, $audit ) = get_action_params( 2 );
+
+fatal_error "Invalid parameter ($audit) to action NotSyn"   if supplied $audit && $audit ne 'audit';
+fatal_error "Invalid parameter ($action) to action NotSyn"  unless $action =~ /^(?:ACCEPT|DROP)$/;
+
+my $chainref         = get_action_chain;
+my ( $level, $tag )  = get_action_logging;
+my $target           = require_audit ( $action , $audit );
+
+log_rule_limit $level, $chainref, 'RST' , $action, '', $tag, 'add', '-p 6 --tcp-flags RST RST ' if $level ne '';
+add_jump $chainref , $target, 0, '-p 6 --tcp-flags RST RST, ';
+
+allow_optimize( $chainref );
+
+1;
+
+END PERL;

Shorewall/action.Reject

@@ -29,7 +29,7 @@
 ###############################################################################
 FORMAT 2
 #
-# The following magic provides different defaults for $2 thru $5, when $1 is 
+# The following magic provides different defaults for $2 thru $5, when $1 is
 # 'audit'.
 #
 BEGIN PERL;
@@ -37,7 +37,7 @@ use Shorewall::Config;
 
 my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
 
-if ( defined $p1 ) { 
+if ( defined $p1 ) {
     if ( $p1 eq 'audit' ) {
 	set_action_param( 2, 'A_REJECT')  unless supplied $p2;
 	set_action_param( 3, 'A_REJECT')  unless supplied $p3;

Shorewall/action.TCPFlags

@@ -24,7 +24,7 @@ my ( $disposition, $audit ) = get_action_params( 2 );
 my $chainref        = get_action_chain;
 my ( $level, $tag ) = get_action_logging;
 
-fatal_error q(The first argument to 'TCPFlags' must be ACCEPT, REJECT, or DROP) unless $disposition =~ /^(ACCEPT|REJECT|DROP)$/; 
+fatal_error q(The first argument to 'TCPFlags' must be ACCEPT, REJECT, or DROP) unless $disposition =~ /^(ACCEPT|REJECT|DROP)$/;
 
 if ( $level ne '-' || $audit ne '-' ) {
     my $logchainref = ensure_filter_chain newlogchain( $chainref->{table} ), 0;
@@ -42,13 +42,13 @@ if ( $level ne '-' || $audit ne '-' ) {
 	fatal_error "Invalid argument ($audit) to TCPFlags" if $audit ne 'audit';
 	require_capability 'AUDIT_TARGET', q(Passing 'audit' to the TCPFlags action), 's';
 	add_ijump( $logchainref, j => 'AUDIT --type ' . lc $disposition );
-    } 
+    }
 
     add_ijump( $logchainref, g => $disposition );
 
     $disposition = $logchainref;
 }
-		    
+
 add_ijump $chainref , g => $disposition, p => 'tcp --tcp-flags ALL FIN,URG,PSH';
 add_ijump $chainref , g => $disposition, p => 'tcp --tcp-flags ALL NONE';
 add_ijump $chainref , g => $disposition, p => 'tcp --tcp-flags SYN,RST SYN,RST';
@@ -58,6 +58,6 @@ add_ijump $chainref , g => $disposition, p => 'tcp --syn --sport 0';
 END PERL;
 
 
-    
+
 
 

Shorewall/actions.std

@@ -41,4 +41,5 @@ DropSmurfs          # Drop smurf packets
 Invalid             # Handles packets in the INVALID conntrack state
 NotSyn              # Handles TCP packets which do not have SYN=1 and ACK=0
 Reject		    # Default Action for REJECT policy
+RST		    # Handle packets with RST set
 TCPFlags            # Handle bad flag combinations.

Shorewall/configfiles/interfaces

@@ -7,8 +7,6 @@
 # http://www.shorewall.net/manpages/shorewall-interfaces.html
 #
 ###############################################################################
-FORMAT 1
-#ZONE	INTERFACE	BROADCAST	OPTIONS
-
 FORMAT 2
+###############################################################################
 #ZONE		INTERFACE		OPTIONS

Shorewall/configfiles/shorewall.conf

@@ -55,12 +55,16 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
 
+GEOIPDIR=/usr/share/xt_geoip/LE
+
 IPTABLES=
 
 IP=
 
 IPSET=
 
+LOCKFILE=
+
 MODULESDIR=
 
 PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"

Shorewall/configfiles/tcrules

@@ -10,6 +10,8 @@
 # See http://shorewall.net/PacketMarking.html for a detailed description of
 # the Netfilter/Shorewall packet marking mechanism.
 ##########################################################################################################################################
+FORMAT 2
+##########################################################################################################################################
 #ACTION	SOURCE		DEST		PROTO	DEST	SOURCE	USER	TEST	LENGTH	TOS   CONNBYTES		HELPER    PROBABILITY DSCP
 #						PORT(S)	PORT(S)
 

Shorewall/configfiles/tunnels

@@ -7,5 +7,5 @@
 # http://www.shorewall.net/manpages/shorewall-tunnels.html
 #
 ###############################################################################
-#TYPE			ZONE	GATEWAY		GATEWAY
-#						ZONE
+#TYPE			ZONE	GATEWAY(S)			GATEWAY
+#								ZONE(S)

Shorewall/init.fedora.sh

@@ -41,10 +41,10 @@ start() {
     echo -n $"Starting Shorewall: "
     $shorewall $OPTIONS start 2>&1 | $logger
     retval=${PIPESTATUS[0]}
-    if [[ $retval == 0 ]]; then 
+    if [[ $retval == 0 ]]; then
 	touch $lockfile
 	success
-    else 
+    else
 	failure
     fi
     echo
@@ -55,10 +55,10 @@ stop() {
     echo -n $"Stopping Shorewall: "
     $shorewall $OPTIONS stop 2>&1 | $logger
     retval=${PIPESTATUS[0]}
-    if [[ $retval == 0 ]]; then 
+    if [[ $retval == 0 ]]; then
 	rm -f $lockfile
 	success
-    else 
+    else
 	failure
     fi
     echo
@@ -71,7 +71,7 @@ restart() {
     echo -n $"Restarting Shorewall: "
     $shorewall $OPTIONS restart 2>&1 | $logger
     retval=${PIPESTATUS[0]}
-    if [[ $retval == 0 ]]; then 
+    if [[ $retval == 0 ]]; then
 	touch $lockfile
 	success
     else # Failed to start, clean up lock file if present

Shorewall/install.sh

@@ -38,7 +38,7 @@ usage() # $1 = exit status
     exit $1
 }
 
-fatal_error() 
+fatal_error()
 {
     echo "   ERROR: $@" >&2
     exit 1
@@ -95,7 +95,7 @@ install_file() # $1 = source $2 = target $3 = mode
     run_install $T $OWNERSHIP -m $3 $1 ${2}
 }
 
-require() 
+require()
 {
     eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
 }
@@ -248,12 +248,23 @@ OWNERSHIP="-o $OWNER -g $GROUP"
 # Determine where to install the firewall script
 #
 
-if [ $PRODUCT = shorewall -a -z "${DESTDIR}" ]; then
+if [ $PRODUCT = shorewall -a "$BUILD" = "$HOST" ]; then
     #
-    # Verify that Perl is installed
+    # Fix up 'use Digest::' if SHA is installed
+    #
+    if ! perl -e 'use Digest::SHA;' 2> /dev/null ; then
+	if perl -e 'use Digest::SHA1;' 2> /dev/null ; then
+	    sed -i 's/Digest::SHA/Digest::SHA1/' Perl/Shorewall/Chains.pm
+	else
+	    echo "ERROR: Shorewall $VERSION requires either Digest::SHA or Digest::SHA1" >&2
+	    exit 1
+	fi
+    fi
+    #
+    # Verify that Perl and all required modules are installed
     #
     if ! perl -c Perl/compiler.pl; then
-	echo "ERROR: $Product $VERSION requires Perl which either is not installed or is not able to compile the $Product Perl code" >&2
+	echo "ERROR: $Product $VERSION requires Perl which either is not installed or is not able to compile the Shorewall Perl code" >&2
 	echo "       Try perl -c $PWD/Perl/compiler.pl" >&2
 	exit 1
     fi
@@ -327,14 +338,11 @@ echo "$PRODUCT control program installed in ${DESTDIR}${SBINDIR}/$PRODUCT"
 # Install the Firewall Script
 #
 if [ -n "$INITFILE" ]; then
-    install_file $INITSOURCE ${DESTDIR}${INITDIR}/$INITFILE 0544
-    [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${INITDIR}/$INITFILE
-  
-    if [ -n "${AUXINITSOURCE}" ]; then
+    if [ -f "${INITSOURCE}" ]; then
 	install_file $INITSOURCE ${DESTDIR}${INITDIR}/$INITFILE 0544
+	[ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${INITDIR}/$INITFILE
+	echo  "$Product script installed in ${DESTDIR}${INITDIR}/$INITFILE"
     fi
-
-    echo  "$Product script installed in ${DESTDIR}${INITDIR}/$INITFILE"
 fi
 
 #
@@ -433,7 +441,7 @@ run_install $OWNERSHIP -m 0644 $PRODUCT.conf.annotated ${DESTDIR}${SHAREDIR}/$PR
 
 if [ ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf ]; then
     run_install $OWNERSHIP -m 0644 ${PRODUCT}.conf${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf
-    
+
     if [ "$SHAREDIR" != /usr/share -o "$CONFDIR" != /etc ]; then
 	if [ $PRODUCT = shorewall ]; then
 	    perl -p -w -i -e "s|^CONFIG_PATH=.*|CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall|;" ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf
@@ -957,11 +965,9 @@ echo "Standard actions file installed as ${DESTDIR}${SHAREDIR}d/$PRODUCT/actions
 # Install the  Makefiles
 #
 run_install $OWNERSHIP -m 0644 Makefile-lite ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles/Makefile
-[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}/${SHAREDIR}/$PRODUCT/configfiles/Makefile
-[ $SBINDIR = /sbin ]       || eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\'       ${DESTDIR}/${SHAREDIR}/$PRODUCT/configfiles/Makefile
 
 if [ -z "$SPARSE" ]; then
-    run_install $OWNERSHIP -m 0600 ${DESTDIR}/${SHAREDIR}/$PRODUCT/configfiles/Makefile ${DESTDIR}${CONFDIR}/$PRODUCT
+    run_install $OWNERSHIP -m 0600 Makefile ${DESTDIR}${CONFDIR}/$PRODUCT
     echo "Makefile installed as ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile"
 fi
 #
@@ -1068,13 +1074,13 @@ cd manpages
 [ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man5/ ${DESTDIR}${MANDIR}/man8/
 
 for f in *.5; do
-    gzip -c $f > $f.gz
+    gzip -9c $f > $f.gz
     run_install $INSTALLD  -m 0644 $f.gz ${DESTDIR}${MANDIR}/man5/$f.gz
     echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
 done
 
 for f in *.8; do
-    gzip -c $f > $f.gz
+    gzip -9c $f > $f.gz
     run_install $INSTALLD  -m 0644 $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz
     echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man8/$f.gz"
 done
@@ -1104,6 +1110,7 @@ if [ -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${mac}" ]; then
 	echo "Set startup=1 in ${CONFDIR}/default/$PRODUCT to enable"
 	touch /var/log/$PRODUCT-init.log
 	perl -p -w -i -e 's/^STARTUP_ENABLED=No/STARTUP_ENABLED=Yes/;s/^IP_FORWARDING=On/IP_FORWARDING=Keep/;s/^SUBSYSLOCK=.*/SUBSYSLOCK=/;' ${CONFDIR}/$PRODUCT/$PRODUCT.conf
+	update-rc.d $PRODUCT enable
     elif [ -n "$SYSTEMD" ]; then
 	if systemctl enable $PRODUCT; then
 	    echo "$Product will start automatically at boot"

Shorewall/lib.cli-std

@@ -34,7 +34,7 @@ get_config() {
 
     ensure_config_path
 
-    
+
 
     if [ "$1" = Yes ]; then
 	params=$(find_file params)
@@ -90,7 +90,7 @@ get_config() {
 		    exit 2
 		fi
 	    fi
-	    
+
 	    g_tool=$IPTABLES
 	else
 	    if [ -n "$IP6TABLES" ]; then
@@ -507,7 +507,11 @@ start_command() {
 			c*)
 			    AUTOMAKE=
 			    option=${option#c}
-			    ;;			    
+			    ;;
+			T*)
+			    g_confess=Yes
+			    option=${option#T}
+			    ;;
 			*)
 			    usage 1
 			    ;;
@@ -870,7 +874,7 @@ restart_command() {
 			c*)
 			    AUTOMAKE=
 			    option=${option#c}
-			    ;;			    
+			    ;;
 			n*)
 			    g_noroutes=Yes
 			    option=${option#n}
@@ -880,6 +884,10 @@ restart_command() {
 			    g_purge=Yes
 			    option=${option%p}
 			    ;;
+			T*)
+			    g_confess=Yes
+			    option=${option#T}
+			    ;;
 			*)
 			    usage 1
 			    ;;
@@ -964,6 +972,27 @@ refresh_command() {
 			    finished=1
 			    option=
 			    ;;
+			d*)
+			    g_debug=Yes
+			    option=${option#d}
+			    ;;
+			n*)
+			    g_noroutes=Yes
+			    option=${option#n}
+			    ;;
+			T*)
+			    g_confess=Yes
+			    option=${option#T}
+			    ;;
+			D)
+			    if [ $# -gt 1 ]; then
+				g_shorewalldir="$2"
+				option=
+				shift
+			    else
+				fatal_error "ERROR: the -D option requires a directory name"
+			    fi
+			    ;;
 			*)
 			    usage 1
 			    ;;
@@ -1341,6 +1370,10 @@ reload_command() # $* = original arguments less the command.
 			    option=
 			    shift
 			    ;;
+			T*)
+			    g_confess=Yes
+			    option=${option#T}
+			    ;;
 			*)
 			    usage 1
 			    ;;
@@ -1406,7 +1439,7 @@ reload_command() # $* = original arguments less the command.
 	fi
 
 	. $directory/$g_program.conf
-	
+
 	ensure_config_path
     fi
 
@@ -1538,7 +1571,7 @@ usage() # $1 = exit status
     echo "   allow <address> ..."
     echo "   check [ -e ] [ -r ] [ -p ] [ -r ] [ -T ] [ <directory> ]"
     echo "   clear"
-    echo "   compile [ -e ] [ -d ] [ <directory name> ] [ <path name> ]"
+    echo "   compile [ -e ] [ -p ] [ -t ] [ -d ] [ -T ] [ <directory name> ] [ <path name> ]"
     echo "   delete <interface>[:<host-list>] ... <zone>"
     echo "   disable <interface>"
     echo "   drop <address> ..."
@@ -1556,7 +1589,7 @@ usage() # $1 = exit status
     fi
 
     echo "   iptrace <iptables match expression>"
-    echo "   load [ -s ] [ -c ] [ -r <root user> ] [ <directory> ] <system>"
+    echo "   load [ -s ] [ -c ] [ -r <root user> ] [ -T ] [ <directory> ] <system>"
     echo "   logdrop <address> ..."
     echo "   logreject <address> ..."
     echo "   logwatch [<refresh interval>]"
@@ -1567,11 +1600,11 @@ usage() # $1 = exit status
 	echo "   noiptrace <ip6tables match expression>"
     fi
 
-    echo "   refresh [ <chain>... ]"
+    echo "   refresh [ -d ] [ -n ] [ -T ] [ -D <directory> ] [ <chain>... ]"
     echo "   reject <address> ..."
-    echo "   reload [ -s ] [ -c ] [ -r <root user> ] [ <directory> ] <system>"
+    echo "   reload [ -s ] [ -c ] [ -r <root user> ] [ -T ] [ <directory> ] <system>"
     echo "   reset [ <chain> ... ]"
-    echo "   restart [ -n ] [ -p ] [-d] [ -f ] [ -c ][ <directory> ]"
+    echo "   restart [ -n ] [ -p ] [-d] [ -f ] [ -c ] [ -T ] [ <directory> ]"
     echo "   restore [ -n ] [ <file name> ]"
     echo "   safe-restart [ -t <timeout> ] [ <directory> ]"
     echo "   safe-start [ -t <timeout> ] [ <directory> ]"
@@ -1585,7 +1618,7 @@ usage() # $1 = exit status
     echo "   show dynamic <zone>"
     echo "   show filters"
     echo "   show ip"
-    
+
     if [ $g_family -eq 4 ]; then
 	echo "   show ipa"
     fi
@@ -1599,7 +1632,7 @@ usage() # $1 = exit status
     echo "   show tc [ device ]"
     echo "   show vardir"
     echo "   show zones"
-    echo "   start [ -f ] [ -n ] [ -p ] [ -c ] [ <directory> ]"
+    echo "   start [ -f ] [ -n ] [ -p ] [ -c ] [ -T ] [ <directory> ]"
     echo "   status"
     echo "   stop"
     echo "   try <directory> [ <timeout> ]"

Shorewall/lib.core

@@ -171,28 +171,6 @@ interface_is_up() {
     [ -n "$($IP -$g_family link list dev $1 2> /dev/null | grep -e '[<,]UP[,>]')" ]
 }
 
-#
-# Determine if interface is usable from a Netfilter perspective
-#
-interface_is_usable() # $1 = interface
-{
-    [ "$1" = lo ] && return 0
-    interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != :: ] && run_isusable_exit $1
-}
-
-#
-# Find interface addresses--returns the set of addresses assigned to the passed
-# device
-#
-find_interface_addresses() # $1 = interface
-{
-    if [ $g_family -eq 4 ]; then
-	$IP -f inet addr show $1 2> /dev/null | grep inet\  | sed 's/\s*inet //;s/\/.*//;s/ peer.*//'
-    else
-	$IP -f inet6 addr show $1 2> /dev/null | grep 'inet6 2' | sed 's/\s*inet6 //;s/\/.*//;s/ peer.*//'
-    fi
-}
-
 #
 #  echo the list of networks routed out of a given interface
 #
@@ -203,7 +181,7 @@ get_routed_networks() # $1 = interface name, $2-n = Fatal error message
     local mask
 
     [ $g_family -eq 4 ] && mask=32 || mask=128
-    
+
 
     $IP -$g_family route show dev $1 2> /dev/null |
 	while read address rest; do
@@ -385,7 +363,7 @@ restore_default_route() # $1 = USE_DEFAULT_RT
 	done < ${VARDIR}/default_route
 
 	replace_default_route $1
-	
+
 	if [ $result = 1 ]; then
 	    #
 	    # We didn't restore a default route with metric 0
@@ -594,6 +572,7 @@ distribute_load() {
     local interface
     local totalload
     local load
+    local mark
     local maxload
 
     maxload=$1
@@ -605,6 +584,8 @@ distribute_load() {
 	if interface_up $interface; then
 	    load=$(cat ${VARDIR}/${interface}_load)
 	    eval ${interface}_load=$load
+	    mark=$(cat ${VARDIR}/${interface}_mark)
+	    eval ${interface}_mark=$mark
 	    totalload=$( bc <<EOF
 scale=8
 $totalload + $load
@@ -617,7 +598,8 @@ EOF
 	for interface in $@; do
 	    qt $g_tool -t mangle -F ~$interface
 	    eval load=\$${interface}_load
-	
+	    eval mark=\$${interface}_mark
+
 	    if [ -n "$load" ]; then
 		load=$(bc <<EOF
 scale=8
@@ -629,7 +611,7 @@ scale=8
 $totalload - $load
 EOF
 )
-		run_iptables -t mangle -A ~$interface -m statistic --mode random --probability $load
+		run_iptables -t mangle -A ~$interface -m statistic --mode random --probability $load -j MARK --set-mark $mark
 	    fi
 	done
     fi
@@ -639,9 +621,37 @@ EOF
 #################################################################################
 #                        IPv4-specific Functions
 #################################################################################
+#
+# Determine if interface is usable from a Netfilter perspective
+#
+interface_is_usable() # $1 = interface
+{
+    local status;
+    status=0
+
+    if [ "$1" != lo ]; then
+	if interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != 0.0.0.0 ]; then
+	    [ "$COMMAND" = enable ] || run_isusable_exit $1
+	    status=$?
+	else
+	    status=1
+	fi
+    fi
+
+    return $status
+}
+
+#
+# Find interface addresses--returns the set of addresses assigned to the passed device
+#
+find_interface_addresses() # $1 = interface
+{
+    $IP -f inet addr show $1 2> /dev/null | grep inet\  | sed 's/\s*inet //;s/\/.*//;s/ peer.*//'
+}
+
+#
 # Find the value 'weight' in the passed arguments then echo the next value
 #
-
 find_weight() {
     while [ $# -gt 1 ]; do
 	[ "x$1" = xweight ] && echo $2 && return
@@ -888,7 +898,7 @@ add_gateway() # $1 = Delta $2 = Table Number
     local weight
     local delta
     local dev
-    
+
     route=`$IP -4 -o route ls table $2 | grep ^default | sed 's/default //; s/[\]//g'`
 
     if [ -z "$route" ]; then
@@ -920,7 +930,7 @@ delete_gateway() # $! = Description of the Gateway $2 = table number $3 = device
 
     route=`$IP -4 -o route ls table $2 | grep ^default | sed 's/[\]//g'`
     gateway=$1
-  
+
     if [ -n "$route" ]; then
 	if echo $route | fgrep -q ' nexthop '; then
 	    gateway="nexthop $gateway"
@@ -1012,6 +1022,34 @@ get_all_bcasts()
 #################################################################################
 #                        IPv6-specific Functions
 #################################################################################
+#
+# Determine if interface is usable from a Netfilter perspective
+#
+interface_is_usable() # $1 = interface
+{
+    local status;
+    status=0
+
+    if [ "$1" != lo ]; then
+	if interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != :: ]; then
+	    [ "$COMMAND" = enable ] || run_isusable_exit $1
+	    status=$?
+	else
+	    status=1
+	fi
+    fi
+
+    return $status
+}
+
+#
+# Find interface addresses--returns the set of addresses assigned to the passed device
+#
+find_interface_addresses() # $1 = interface
+{
+    $IP -f inet6 addr show $1 2> /dev/null | grep 'inet6 2' | sed 's/\s*inet6 //;s/\/.*//;s/ peer.*//'
+}
+
 #
 # Get all interface addresses with VLSMs
 #
@@ -1214,7 +1252,7 @@ add_gateway() # $1 = Delta $2 = Table Number
     local weight
     local delta
     local dev
-    
+
     run_ip route add default scope global table $2 $1
 }
 
@@ -1229,7 +1267,7 @@ delete_gateway() # $! = Description of the Gateway $2 = table number $3 = device
 
     route=`$IP -6 -o route ls table $2 | grep ^default | sed 's/[\]//g'`
     gateway=$1
-  
+
     dev=$(find_device $route)
     [ "$dev" = "$3" ] && run_ip route delete default table $2
 }

Shorewall/manpages/shorewall-blrules.xml

@@ -60,7 +60,31 @@
 
           <variablelist>
             <varlistentry>
-              <term>blacklog</term>
+              <term><emphasis role="bold">BLACKLIST</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.5.3. This is actually a macro that
+                expands as follows:</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>If BLACKLIST_LOGLEVEL is specified in <ulink
+                    url="shorewall.conf.html">shorewall.conf</ulink>(5), then
+                    the macro expands to <emphasis
+                    role="bold">blacklog</emphasis>.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>Otherwise it expands to the action specified for
+                    BLACKLIST_DISPOSITION in <ulink
+                    url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
+                  </listitem>
+                </itemizedlist>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">blacklog</emphasis></term>
 
               <listitem>
                 <para>May only be used if BLACKLIST_LOGLEVEL is specified in

Shorewall/manpages/shorewall-interfaces.xml

@@ -27,6 +27,34 @@
     interfaces to Shorewall. The order of entries in this file is not
     significant in determining zone composition.</para>
 
+    <para>Beginning with Shorewall 4.5.3, the interfaces file supports two
+    different formats:</para>
+
+    <variablelist>
+      <varlistentry>
+        <term>FORMAT 1 (default - deprecated)</term>
+
+        <listitem>
+          <para>There is a BROADCAST column which can be used to specify the
+          broadcast address associated with the interface.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>FORMAT 2</term>
+
+        <listitem>
+          <para>The BROADCAST column is omitted.</para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+
+    <para>The format is specified by a line as follows:</para>
+
+    <blockquote>
+      <para><emphasis role="bold">FORMAT {1|2}</emphasis></para>
+    </blockquote>
+
     <para>The columns in the file are as follows.</para>
 
     <variablelist>
@@ -128,6 +156,8 @@ loc     eth2            -</programlisting>
         role="bold">detect</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...}</term>
 
         <listitem>
+          <para>Only available if FORMAT 1.</para>
+
           <para>If you use the special value <emphasis
           role="bold">detect</emphasis>, Shorewall will detect the broadcast
           address(es) for you if your iptables and kernel include Address Type
@@ -172,7 +202,7 @@ loc     eth2            -</programlisting>
                 changed; the value assigned to the setting will be the value
                 specified (if any) or 1 if no value is given.</para>
 
-                <para></para>
+                <para/>
 
                 <note>
                   <para>This option does not work with a wild-card
@@ -206,7 +236,7 @@ loc     eth2            -</programlisting>
 
                 <para>8 - do not reply for all local addresses</para>
 
-                <para></para>
+                <para/>
 
                 <note>
                   <para>This option does not work with a wild-card
@@ -214,7 +244,7 @@ loc     eth2            -</programlisting>
                   the INTERFACE column.</para>
                 </note>
 
-                <para></para>
+                <para/>
 
                 <warning>
                   <para>Do not specify <emphasis
@@ -355,7 +385,7 @@ loc     eth2            -</programlisting>
         1
         teastep@lists:~$ </programlisting>
 
-                <para></para>
+                <para/>
 
                 <note>
                   <para>This option does not work with a wild-card
@@ -629,7 +659,7 @@ loc     eth2            -</programlisting>
                 changed; the value assigned to the setting will be the value
                 specified (if any) or 1 if no value is given.</para>
 
-                <para></para>
+                <para/>
 
                 <note>
                   <para>This option does not work with a wild-card
@@ -705,11 +735,14 @@ loc     eth2            -</programlisting>
           connected to your local network and that your local subnet is
           192.168.1.0/24. The interface gets its IP address via DHCP from
           subnet 206.191.149.192/27. You have a DMZ with subnet 192.168.2.0/24
-          using eth2.</para>
+          using eth2. Your iptables and/or kernel do not support "Address Type
+          Match" and you prefer to specify broadcast addresses explicitly
+          rather than having Shorewall detect them.</para>
 
           <para>Your entries for this setup would look like:</para>
 
-          <programlisting>#ZONE   INTERFACE BROADCAST        OPTIONS
+          <programlisting>FORMAT 1
+#ZONE   INTERFACE BROADCAST        OPTIONS
 net     eth0      206.191.149.223  dhcp
 loc     eth1      192.168.1.255
 dmz     eth2      192.168.2.255</programlisting>
@@ -723,10 +756,11 @@ dmz     eth2      192.168.2.255</programlisting>
           <para>The same configuration without specifying broadcast addresses
           is:</para>
 
-          <programlisting>#ZONE   INTERFACE BROADCAST        OPTIONS
-net     eth0      detect           dhcp
-loc     eth1      detect
-dmz     eth2      detect</programlisting>
+          <programlisting>FORMAT 2
+#ZONE   INTERFACE OPTIONS
+net     eth0      dhcp
+loc     eth1      
+dmz     eth2</programlisting>
         </listitem>
       </varlistentry>
 
@@ -737,7 +771,8 @@ dmz     eth2      detect</programlisting>
           <para>You have a simple dial-in system with no ethernet
           connections.</para>
 
-          <programlisting>#ZONE   INTERFACE BROADCAST        OPTIONS
+          <programlisting>FORMAT 2
+#ZONE   INTERFACE OPTIONS
 net     ppp0      -</programlisting>
         </listitem>
       </varlistentry>
@@ -749,8 +784,9 @@ net     ppp0      -</programlisting>
           <para>You have a bridge with no IP address and you want to allow
           traffic through the bridge.</para>
 
-          <programlisting>#ZONE   INTERFACE BROADCAST        OPTIONS
--       br0       -                routeback</programlisting>
+          <programlisting>FORMAT 2
+#ZONE   INTERFACE OPTIONS
+-       br0       routeback</programlisting>
         </listitem>
       </varlistentry>
     </variablelist>
@@ -772,10 +808,9 @@ net     ppp0      -</programlisting>
     shorewall-blacklist(5), shorewall-hosts(5), shorewall-maclist(5),
     shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5),
     shorewall-params(5), shorewall-policy(5), shorewall-providers(5),
-    shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    shorewall-proxyarp(5), shorewall-rtrules(5), shorewall-routestopped(5),
+    shorewall-rules(5), shorewall.conf(5), shorewall-secmarks(5),
+    shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
+    shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-providers.xml

@@ -87,8 +87,7 @@
           being zero). Otherwise, the value must be between 1 and 255. Each
           provider must be assigned a unique mark value. This column may be
           omitted if you don't use packet marking to direct connections to a
-          particular provider and you don't specify <option>track</option> in
-          the OPTIONS column.</para>
+          particular provider.</para>
         </listitem>
       </varlistentry>
 
@@ -271,6 +270,19 @@
                 <filename>shorewall.conf</filename>.</para>
               </listitem>
             </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">tproxy</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.5.4. Used for supporting the TPROXY
+                action in shorewall-tcrules(5). See <ulink
+                url="http://www.shorewall.net/Shorewall_Squid_Usage.html">http://www.shorewall.net/Shorewall_Squid_Usage.html</ulink>.
+                When specified, the MARK, DUPLICATE and GATEWAY columns should
+                be empty, INTERFACE should be set to 'lo' and
+                <option>tproxy</option> should be the only OPTION.</para>
+              </listitem>
+            </varlistentry>
           </variablelist>
         </listitem>
       </varlistentry>

Shorewall/manpages/shorewall-rules.xml

@@ -563,7 +563,7 @@
         role="bold">-</emphasis>]}<emphasis
         role="bold">[:</emphasis><emphasis>interface</emphasis>][<emphasis
         role="bold">:</emphasis>{<emphasis>address-or-range</emphasis>[,<emphasis>address-or-range</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>|<emphasis
-        role="bold">+</emphasis><emphasis>ipset</emphasis>}</term>
+        role="bold">+</emphasis><emphasis>ipset</emphasis>|<replaceable>^countrycode-list</replaceable>}</term>
 
         <listitem>
           <para>Source hosts to which the rule applies. May be a
@@ -639,6 +639,18 @@
           url="shorewall-interfaces.html">shorewall-interfaces</ulink>
           (5).</para>
 
+          <para>Beginning with Shorewall 4.5.4, A
+          <replaceable>countrycode-list</replaceable> may be specified. A
+          countrycode-list is a comma-separated list of up to 15 two-character
+          ISO-3661 country codes enclosed in square brackets ('[...]') and
+          preceded by a caret ('^'). When a single country code is given, the
+          square brackets may be omitted. A list of country codes supported by
+          Shorewall may be found at <ulink
+          url="http://www.shorewall.net/ISO-3661.html">http://www.shorewall.net/ISO-3661.html</ulink>.
+          Specifying a <replaceable>countrycode-list</replaceable> requires
+          <firstterm>GeoIP Match</firstterm> support in your iptables and
+          Kernel.</para>
+
           <para>You may exclude certain hosts from the set already defined
           through use of an <emphasis>exclusion</emphasis> (see <ulink
           url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
@@ -726,7 +738,7 @@
         role="bold">+</emphasis>][<emphasis
         role="bold">-</emphasis>]}<emphasis
         role="bold">[:{</emphasis><emphasis>interface</emphasis>|<emphasis>address-or-range</emphasis>[,<emphasis>address-or-range</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>|<emphasis
-        role="bold">+</emphasis><emphasis>ipset</emphasis>}][<option>:</option><replaceable>port</replaceable>[:<emphasis
+        role="bold">+</emphasis><emphasis>ipset</emphasis>|<emphasis>^countrycode-list</emphasis>}][<option>:</option><replaceable>port</replaceable>[:<emphasis
         role="bold">random</emphasis>]]</term>
 
         <listitem>
@@ -744,6 +756,18 @@
           "+" to indicate that the rule is to apply to intra-zone traffic as
           well as inter-zone traffic.</para>
 
+          <para>Beginning with Shorewall 4.5.4, A
+          <replaceable>countrycode-list</replaceable> may be specified. A
+          countrycode-list is a comma-separated list of up to 15 two-character
+          ISO-3661 country codes enclosed in square brackets ('[...]') and
+          preceded by a caret ('^'). When a single country code is given, the
+          square brackets may be omitted. A list of country codes supported by
+          Shorewall may be found at <ulink
+          url="http://www.shorewall.net/ISO-3661.html">http://www.shorewall.net/ISO-3661.html</ulink>.
+          Specifying a <replaceable>countrycode-list</replaceable> requires
+          <firstterm>GeoIP Match</firstterm> support in your iptables and
+          Kernel.</para>
+
           <para>When <emphasis role="bold">none</emphasis> is used either in
           the <emphasis role="bold">SOURCE</emphasis> or <emphasis
           role="bold">DEST</emphasis> column, the rule is ignored.</para>
@@ -1505,7 +1529,7 @@
           SSH connection to the ipset S:</para>
 
           <programlisting>        #ACTION                       SOURCE           DEST           PROTO       DEST
-        #                                                             PORT(S)        
+        #                                                                         PORT(S)
         ADD(+S:dst,src,dst)           net              fw             tcp         22</programlisting>
         </listitem>
       </varlistentry>
@@ -1535,6 +1559,19 @@
         DNAT        net             dmz:$BACKUP tcp         80           -         -          -         -         -       -             -        -          primary_down</programlisting>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term>Example 13:</term>
+
+        <listitem>
+          <para>Drop all email from the <emphasis>Anonymous Proxy</emphasis>
+          and <emphasis>Satellite Provider</emphasis> address ranges:</para>
+
+          <programlisting>        #ACTION                       SOURCE           DEST           PROTO       DEST
+        #                                                                         PORT(S)
+        DROP                          net:^A1,A2       fw             tcp         22</programlisting>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 

Shorewall/manpages/shorewall-tcfilters.xml

@@ -204,7 +204,7 @@
           ALL cannot be used because IPv4 ICMP and IPv6 ICMP are two different
           protocols.</para>
 
-          <programlisting>       #CLASS    SOURCE    DEST         PROTO   DEST 
+          <programlisting>       #CLASS    SOURCE    DEST         PROTO   DEST
        #                                        PORT
 
        IPV4
@@ -213,7 +213,7 @@
        1:10      0.0.0.0/0 0.0.0.0/0    icmp    echo-reply
 
        IPV6
- 
+
        1:10      ::/0      ::/0         icmp6   echo-request
        1:10      ::/0      ::/0         icmp6   echo-reply</programlisting>
         </listitem>

Shorewall/manpages/shorewall-tcrules.xml

@@ -38,6 +38,34 @@
       url="http://shorewall.net/MultiISP.html">http://shorewall.net/MultiISP.html</ulink>.</para>
     </important>
 
+    <para>Beginning with Shorewall 4.5.4, the tcrules file supports two
+    different formats:</para>
+
+    <variablelist>
+      <varlistentry>
+        <term>FORMAT 1 (default - deprecated)</term>
+
+        <listitem>
+          <para>The older limited-function version of TPROXY is
+          supported.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>FORMAT 2</term>
+
+        <listitem>
+          <para>The newer version of TPROXY is supported.</para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+
+    <para>The format is specified by a line as follows:</para>
+
+    <blockquote>
+      <para><emphasis role="bold">FORMAT {1|2}</emphasis></para>
+    </blockquote>
+
     <para>The columns in the file are as follows (where the column name is
     followed by a different name in parentheses, the different name is used in
     the alternate specification syntax).</para>
@@ -407,9 +435,23 @@ SAME              $FW            0.0.0.0/0    tcp        80,443</programlisting>
               classes will have a value &gt; 256.</para>
             </listitem>
 
+            <listitem>
+              <para><emphasis role="bold">DIVERT</emphasis></para>
+
+              <para>Added in Shorewall 4.5.4 and only available when FORMAT is
+              2. Two DIVERT rule should preceed the TPROXY rule and should
+              select DEST PORT tcp 80 and SOURCE PORT tcp 80 respectively
+              (assuming that tcp port 80 is being proxied). DIVERT avoids
+              sending packets to the TPROXY target once a socket connection to
+              Squid3 has been established by TPROXY. DIVERT marks the packet
+              with a unique mark and exempts it from any rules that
+              follow.</para>
+            </listitem>
+
             <listitem>
               <para><emphasis
-              role="bold">TPROXY</emphasis>(<replaceable>mark</replaceable>[/<replaceable>mask</replaceable>][,[<replaceable>port</replaceable>][,[<replaceable>address</replaceable>]]])</para>
+              role="bold">TPROXY</emphasis>(<replaceable>mark</replaceable>[,[<replaceable>port</replaceable>][,[<replaceable>address</replaceable>]]])
+              -- FORMAT 1</para>
 
               <para>Transparently redirects a packet without altering the IP
               header. Requires a local provider to be defined in <ulink
@@ -440,6 +482,34 @@ SAME              $FW            0.0.0.0/0    tcp        80,443</programlisting>
               </itemizedlist>
             </listitem>
 
+            <listitem>
+              <para><emphasis
+              role="bold">TPROXY</emphasis>([<replaceable>port</replaceable>][,<replaceable>address</replaceable>])
+              -- FORMAT 2</para>
+
+              <para>Transparently redirects a packet without altering the IP
+              header. Requires a tproxy provider to be defined in <ulink
+              url="shorewall-providers.html">shorewall-providers</ulink>(5).</para>
+
+              <para>There are three parameters to TPROXY - neither is
+              required:</para>
+
+              <itemizedlist>
+                <listitem>
+                  <para><replaceable>port</replaceable> - the port on which
+                  the proxy server is listening. If omitted, the original
+                  destination port.</para>
+                </listitem>
+
+                <listitem>
+                  <para><replaceable>address</replaceable> - a local (to the
+                  firewall) IP address on which the proxy server is listening.
+                  If omitted, the IP address of the interface on which the
+                  request arrives.</para>
+                </listitem>
+              </itemizedlist>
+            </listitem>
+
             <listitem>
               <para><emphasis role="bold">TTL</emphasis>([<emphasis
               role="bold">-</emphasis>|<emphasis
@@ -569,7 +639,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                   <term>T</term>
 
                   <listitem>
-                    <para>POSTROUTING chain (default).</para>
+                    <para>POSTROUTING chain.</para>
                   </listitem>
                 </varlistentry>
               </variablelist>

Shorewall/manpages/shorewall-tunnels.xml

@@ -57,7 +57,7 @@
 
           <programlisting>        <emphasis role="bold">6to4</emphasis> or <emphasis
               role="bold">6in4</emphasis>  - 6to4 or 6in4 tunnel. The <emphasis
-              role="bold">6in4</emphasis> synonym was added in 4.4.24.        
+              role="bold">6in4</emphasis> synonym was added in 4.4.24.
         <emphasis role="bold">ipsec</emphasis>         - IPv4 IPSEC
         <emphasis role="bold">ipsecnat</emphasis>      - IPv4 IPSEC with NAT Traversal (UDP port 4500 encapsulation)
         <emphasis role="bold">ipip</emphasis>          - IPv4 encapsulated in IPv4 (Protocol 4)
@@ -125,8 +125,9 @@
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">GATEWAY</emphasis> -
-        <emphasis>address-or-range</emphasis></term>
+        <term><emphasis role="bold">GATEWAY</emphasis>(S) (gateway or
+        gateways) - <emphasis>address-or-range</emphasis> <emphasis
+        role="bold">[ , ... ]</emphasis></term>
 
         <listitem>
           <para>The IP address of the remote tunnel gateway. If the remote
@@ -134,12 +135,17 @@
           as <emphasis role="bold">0.0.0.0/0</emphasis>. May be specified as a
           network address and if your kernel and iptables include iprange
           match support then IP address ranges are also allowed.</para>
+
+          <para>Beginning with Shorewall 4.5.3, a list of addresses or ranges
+          may be given. Exclusion (<ulink
+          url="shorewall-exclusion.html">shorewall-exclusion</ulink> (5) ) is
+          not supported.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">GATEWAY ZONES</emphasis> (gateway_zone) -
-        [<emphasis>zone</emphasis>[<emphasis
+        <term><emphasis role="bold">GATEWAY ZONES</emphasis> (gateway_zone or
+        gateway_zones) - [<emphasis>zone</emphasis>[<emphasis
         role="bold">,</emphasis><emphasis>zone</emphasis>]...]</term>
 
         <listitem>
@@ -148,7 +154,7 @@
           comma-separated list of the names of the zones that the host might
           be in. This column only applies to IPSEC tunnels where it enables
           ISAKMP traffic to flow through the tunnel to the remote
-          gateway.</para>
+          gateway(s).</para>
         </listitem>
       </varlistentry>
     </variablelist>

Shorewall/manpages/shorewall.conf.xml

@@ -96,7 +96,7 @@
         role="bold">none</emphasis>}</term>
 
         <listitem>
-          <para></para>
+          <para/>
         </listitem>
       </varlistentry>
 
@@ -106,7 +106,7 @@
         role="bold">none</emphasis>}</term>
 
         <listitem>
-          <para></para>
+          <para/>
         </listitem>
       </varlistentry>
 
@@ -116,7 +116,7 @@
         role="bold">none</emphasis>}</term>
 
         <listitem>
-          <para></para>
+          <para/>
         </listitem>
       </varlistentry>
 
@@ -126,7 +126,7 @@
         role="bold">none</emphasis>}</term>
 
         <listitem>
-          <para></para>
+          <para/>
         </listitem>
       </varlistentry>
 
@@ -482,7 +482,7 @@
           </itemizedlist>
 
           <blockquote>
-            <para></para>
+            <para/>
 
             <para>If CONFIG_PATH is not given or if it is set to the empty
             value then the contents of /usr/share/shorewall/configpath are
@@ -669,6 +669,21 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><emphasis
+        role="bold">GEOIPDIR</emphasis>=[<emphasis>pathname</emphasis>]</term>
+
+        <listitem>
+          <para>Added in Shorewall 4.5.4. Specifies the pathname of the
+          directory containing the <firstterm>GeoIP Match</firstterm>
+          database. See <ulink
+          url="http://www.shorewall.net/ISOCODES.html">http://www.shorewall.net/ISOCODES.html</ulink>.
+          If not specified, the default value is
+          <filename>/usr/share/xt_geoip/LE</filename> which is the default
+          location of the little-endian database.</para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><emphasis role="bold">HIGH_ROUTE_MARKS=</emphasis>{<emphasis
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>}</term>
@@ -814,7 +829,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
             </varlistentry>
           </variablelist>
 
-          <para></para>
+          <para/>
 
           <blockquote>
             <para>If this variable is not set or is given an empty value
@@ -938,6 +953,19 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><emphasis
+        role="bold">LOCKFILE</emphasis>=[<emphasis>pathname</emphasis>]</term>
+
+        <listitem>
+          <para>Specifies the name of the Shorewall lock file, used to prevent
+          simultaneous state-changing commands. If not specified,
+          ${VARDIR}/shorewall/lock is assumed (${VARDIR} is normally /var/lib
+          but can be changed when Shorewall-core is installed -- see the
+          output of <command>shorewall show vardir</command>).</para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><emphasis role="bold">LOG_MARTIANS=</emphasis>[<emphasis
         role="bold">Yes</emphasis>|<emphasis
@@ -1011,7 +1039,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
             </listitem>
           </itemizedlist>
 
-          <para></para>
+          <para/>
 
           <blockquote>
             <para>For example, using the default LOGFORMAT, the log prefix for
@@ -1028,7 +1056,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
               control your firewall after you enable this option.</para>
             </important>
 
-            <para></para>
+            <para/>
 
             <caution>
               <para>Do not use this option if the resulting log messages will
@@ -1525,6 +1553,23 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
                   chain are appended to it.</para>
                 </listitem>
               </itemizedlist>
+
+              <para>An additional optimization was added in Shorewall 4.5.4.
+              If the last rule in a chain is an unqualified jump to a simple
+              target, then all immediately preceding rules with the same
+              simple target are omitted.</para>
+
+              <para>For example, consider this chain:</para>
+
+              <programlisting>	-A fw-net -p udp --dport 67:68 -j ACCEPT
+	-A fw-net -p udp --sport 1194 -j ACCEPT
+	-A fw-net -p 41 -j ACCEPT
+	-A fw-net -j ACCEPT
+</programlisting>
+
+              <para>Since all of the rules are jumps to the simple target
+              ACCEPT, this chain is totally optimized away and jumps to the
+              chain are replace with jumps to ACCEPT.</para>
             </listitem>
 
             <listitem>
@@ -1664,7 +1709,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
         role="bold">"</emphasis></term>
 
         <listitem>
-          <para></para>
+          <para/>
         </listitem>
       </varlistentry>
 

Shorewall/manpages/shorewall.xml

@@ -283,6 +283,8 @@
 
       <arg><option>-r</option> <replaceable>root-user-name</replaceable></arg>
 
+      <arg><option>-T</option></arg>
+
       <arg><replaceable>directory</replaceable></arg>
 
       <arg choice="plain"><replaceable>system</replaceable></arg>
@@ -349,7 +351,9 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="plain"><option>refresh</option><arg
+      <arg
+      choice="plain"><option>refresh</option><arg><option>-n</option></arg><arg><option>-d</option></arg><arg><option>-T</option></arg><arg>-<option>D</option>
+      <replaceable>directory</replaceable> </arg><arg
       rep="repeat"><replaceable>chain</replaceable></arg></arg>
     </cmdsynopsis>
 
@@ -381,6 +385,8 @@
 
       <arg><option>-r</option> <replaceable>root-user-name</replaceable></arg>
 
+      <arg><option>-T</option></arg>
+
       <arg><replaceable>directory</replaceable></arg>
 
       <arg choice="plain"><replaceable>system</replaceable></arg>
@@ -415,6 +421,8 @@
 
       <arg><option>-c</option></arg>
 
+      <arg><option>-T</option></arg>
+
       <arg><replaceable>directory</replaceable></arg>
     </cmdsynopsis>
 
@@ -599,6 +607,8 @@
 
       <arg><option>-c</option></arg>
 
+      <arg><option>-T</option></arg>
+
       <arg><replaceable>directory</replaceable></arg>
     </cmdsynopsis>
 
@@ -1038,6 +1048,10 @@
           <para>If <option>-r</option> is included, it specifies that the root
           user on <replaceable>system</replaceable> is named
           <replaceable>root-user-name</replaceable> rather than "root".</para>
+
+          <para>The <option>-T</option> option was added in Shorewall 4.5.3
+          and causes a Perl stack trace to be included with each
+          compiler-generated error and warning message.</para>
         </listitem>
       </varlistentry>
 
@@ -1113,6 +1127,20 @@
           list or until an entry in the list names another table. Built-in
           chains such as FORWARD may not be refreshed.</para>
 
+          <para>The <option>-n</option> option was added in Shorewall 4.5.3
+          causes Shorewall to avoid updating the routing table(s).</para>
+
+          <para>The <option>-d </option>option was added in Shorewall 4.5.3
+          causes the compiler to run under the Perl debugger.</para>
+
+          <para>The <option>-T</option> option was added in Shorewall 4.5.3
+          and causes a Perl stack trace to be included with each
+          compiler-generated error and warning message.</para>
+
+          <para>The -<option>D</option> option was added in Shorewall 4.5.3
+          and causes Shorewall to look in the given
+          <emphasis>directory</emphasis> first for configuration files.</para>
+
           <para>Example:<programlisting><command>shorewall refresh net2fw nat:net_dnat</command> #Refresh the 'net2loc' chain in the filter table and the 'net_dnat' chain in the nat table</programlisting></para>
 
           <para>The <emphasis role="bold">refresh</emphasis> command has
@@ -1166,6 +1194,10 @@
           <para>If <option>-r</option> is included, it specifies that the root
           user on <replaceable>system</replaceable> is named
           <replaceable>root-user-name</replaceable> rather than "root".</para>
+
+          <para>The <option>-T</option> option was added in Shorewall 4.5.3
+          and causes a Perl stack trace to be included with each
+          compiler-generated error and warning message.</para>
         </listitem>
       </varlistentry>
 
@@ -1210,6 +1242,10 @@
           url="shorewall.conf.html">shorewall.conf</ulink>(5). When both
           <option>-f</option> and <option>-c</option>are present, the result
           is determined by the option that appears last.</para>
+
+          <para>The <option>-T</option> option was added in Shorewall 4.5.3
+          and causes a Perl stack trace to be included with each
+          compiler-generated error and warning message.</para>
         </listitem>
       </varlistentry>
 
@@ -1541,6 +1577,10 @@
           url="shorewall.conf.html">shorewall.conf</ulink>(5). When both
           <option>-f</option> and <option>-c</option>are present, the result
           is determined by the option that appears last.</para>
+
+          <para>The <option>-T</option> option was added in Shorewall 4.5.3
+          and causes a Perl stack trace to be included with each
+          compiler-generated error and warning message.</para>
         </listitem>
       </varlistentry>
 

Shorewall/shorewall

@@ -4,7 +4,7 @@
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011 - 
+#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011 -
 #         Tom Eastep (teastep@shorewall.net)
 #
 #	Shorewall documentation is available at http://www.shorewall.net
@@ -36,6 +36,7 @@ g_libexec="$LIBEXECDIR"
 g_sharedir="$SHAREDIR"/shorewall
 g_sbindir="$SBINDIR"
 g_perllib="$PERLLIBDIR"
+g_vardir="$VARDIR"
 g_confdir="$CONFDIR"/shorewall
 g_readrc=1
 

Shorewall6-lite/Makefile

@@ -3,9 +3,9 @@ VARDIR=$(shell /sbin/shorewall6-lite show vardir)
 SHAREDIR=/usr/share/shorewall6-lite
 RESTOREFILE?=.restore
 
-all: $(VARDIR)/${RESTOREFILE}
+all: $(VARDIR)/$(RESTOREFILE)
 
-$(VARDIR)/${RESTOREFILE}: $(VARDIR)/firewall
+$(VARDIR)/$(RESTOREFILE): $(VARDIR)/firewall
 	@/sbin/shorewall6-lite -q save >/dev/null; \
 	if \
 	    /sbin/shorewall6-lite -q restart >/dev/null 2>&1; \

Shorewall6-lite/init.debian.sh

@@ -24,7 +24,7 @@ export SHOREWALL_INIT_SCRIPT
 test -x $SRWL || exit 0
 test -x $WAIT_FOR_IFUP || exit 0
 test -n "$INITLOG" || {
-	echo "INITLOG cannot be empty, please configure $0" ; 
+	echo "INITLOG cannot be empty, please configure $0" ;
 	exit 1;
 }
 
@@ -36,9 +36,9 @@ fi
 
 echo_notdone () {
 
-  if [ "$INITLOG" = "/dev/null" ] ; then 
+  if [ "$INITLOG" = "/dev/null" ] ; then
 	  echo "not done."
-  else 
+  else
 	  echo "not done (check $INITLOG)."
   fi
 

Shorewall6-lite/init.fedora.sh

@@ -41,10 +41,10 @@ start() {
     echo -n $"Starting Shorewall: "
     $shorewall $OPTIONS start 2>&1 | $logger
     retval=${PIPESTATUS[0]}
-    if [[ $retval == 0 ]]; then 
+    if [[ $retval == 0 ]]; then
 	touch $lockfile
 	success
-    else 
+    else
 	failure
     fi
     echo
@@ -55,10 +55,10 @@ stop() {
     echo -n $"Stopping Shorewall: "
     $shorewall $OPTIONS stop 2>&1 | $logger
     retval=${PIPESTATUS[0]}
-    if [[ $retval == 0 ]]; then 
+    if [[ $retval == 0 ]]; then
 	rm -f $lockfile
 	success
-    else 
+    else
 	failure
     fi
     echo
@@ -71,7 +71,7 @@ restart() {
     echo -n $"Restarting Shorewall: "
     $shorewall $OPTIONS restart 2>&1 | $logger
     retval=${PIPESTATUS[0]}
-    if [[ $retval == 0 ]]; then 
+    if [[ $retval == 0 ]]; then
 	touch $lockfile
 	success
     else # Failed to start, clean up lock file if present

Shorewall6-lite/shorewall6-lite

@@ -4,7 +4,7 @@
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011, 2012 - 
+#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011, 2012 -
 #         Tom Eastep (teastep@shorewall.net)
 #
 #	Shorewall documentation is available at http://www.shorewall.net
@@ -35,7 +35,7 @@ g_program=shorewall6-lite
 g_libexec="$LIBEXECDIR"
 g_sharedir="$SHAREDIR"/shorewall6-lite
 g_sbindir="$SBINDIR"
-g_perllib="$PERLLIBDIR"
+g_vardir="$VARDIR"
 g_confdir="$CONFDIR"/shorewall6-lite
 g_readrc=1
 

Shorewall6-lite/shorewall6-lite.conf

@@ -1,5 +1,5 @@
 ###############################################################################
-#  /etc/shorewall6-lite/shorewall6-lite.conf Version 4 - Change the following 
+#  /etc/shorewall6-lite/shorewall6-lite.conf Version 4 - Change the following
 #  variables to override the values in the shorewall.conf file used to
 #  compile /var/lib/shorewall-lite/firewall. Those values may be found in
 #  /var/lib/shorewall-lite/firewall.conf.

Shorewall6/Makefile

@@ -3,9 +3,9 @@ VARDIR=$(shell /sbin/shorewall6 show vardir)
 CONFDIR=/etc/shorewall6
 RESTOREFILE?=firewall
 
-all: $(VARDIR)/${RESTOREFILE}
+all: $(VARDIR)/$(RESTOREFILE)
 
-$(VARDIR)/${RESTOREFILE}: $(CONFDIR)/*
+$(VARDIR)/$(RESTOREFILE): $(CONFDIR)/*
 	@/sbin/shorewall6 -q save >/dev/null; \
 	if \
 	    /sbin/shorewall6 -q restart >/dev/null 2>&1; \

Shorewall6/Makefile-lite

@@ -23,10 +23,10 @@
 # to the name of the remote firewall corresponding to the directory.
 #
 #	To make the 'firewall' script, type "make".
-# 
+#
 #	Once the script is compiling correctly, you can install it by
 #	typing "make install".
-#  
+#
 ################################################################################
 #                             V A R I A B L E S
 #
@@ -55,7 +55,7 @@ all: firewall
 #
 # Only generate the capabilities file if it doesn't already exist
 #
-capabilities: 
+capabilities:
 	ssh root@$(HOST) "MODULESDIR=$(MODULESDIR) /usr/share/shorewall6-lite/shorecap > $(LITEDIR)/capabilities"
 	scp root@$(HOST):$(LITEDIR)/capabilities .
 #
@@ -78,5 +78,5 @@ save:
 #
 # Remove generated files
 #
-clean: 
+clean:
 	rm -f capabilities firewall firewall.conf reload

Shorewall6/Samples6/LICENSE

@@ -55,7 +55,7 @@ modified by someone else and passed on, the recipients should know
 that what they have is not the original version, so that the original
 author's reputation will not be affected by problems that might be
 introduced by others.
-
+
   Finally, software patents pose a constant threat to the existence of
 any free program.  We wish to make sure that a company cannot
 effectively restrict the users of a free program by obtaining a
@@ -111,7 +111,7 @@ modification follow.  Pay close attention to the difference between a
 "work based on the library" and a "work that uses the library".  The
 former contains code derived from the library, whereas the latter must
 be combined with the library in order to run.
-
+
 		  GNU LESSER GENERAL PUBLIC LICENSE
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 
@@ -146,7 +146,7 @@ such a program is covered only if its contents constitute a work based
 on the Library (independent of the use of the Library in a tool for
 writing it).  Whether that is true depends on what the Library does
 and what the program that uses the Library does.
-  
+
   1. You may copy and distribute verbatim copies of the Library's
 complete source code as you receive it, in any medium, provided that
 you conspicuously and appropriately publish on each copy an
@@ -158,7 +158,7 @@ Library.
   You may charge a fee for the physical act of transferring a copy,
 and you may at your option offer warranty protection in exchange for a
 fee.
-
+
   2. You may modify your copy or copies of the Library or any portion
 of it, thus forming a work based on the Library, and copy and
 distribute such modifications or work under the terms of Section 1
@@ -216,7 +216,7 @@ instead of to this License.  (If a newer version than version 2 of the
 ordinary GNU General Public License has appeared, then you can specify
 that version instead if you wish.)  Do not make any other change in
 these notices.
-
+
   Once this change is made in a given copy, it is irreversible for
 that copy, so the ordinary GNU General Public License applies to all
 subsequent copies and derivative works made from that copy.
@@ -267,7 +267,7 @@ Library will still fall under Section 6.)
 distribute the object code for the work under the terms of Section 6.
 Any executables containing that work also fall under Section 6,
 whether or not they are linked directly with the Library itself.
-
+
   6. As an exception to the Sections above, you may also combine or
 link a "work that uses the Library" with the Library to produce a
 work containing portions of the Library, and distribute that work
@@ -329,7 +329,7 @@ restrictions of other proprietary libraries that do not normally
 accompany the operating system.  Such a contradiction means you cannot
 use both them and the Library together in an executable that you
 distribute.
-
+
   7. You may place library facilities that are a work based on the
 Library side-by-side in a single library together with other library
 facilities not covered by this License, and distribute such a combined
@@ -370,7 +370,7 @@ subject to these terms and conditions.  You may not impose any further
 restrictions on the recipients' exercise of the rights granted herein.
 You are not responsible for enforcing compliance by third parties with
 this License.
-
+
   11. If, as a consequence of a court judgment or allegation of patent
 infringement or for any other reason (not limited to patent issues),
 conditions are imposed on you (whether by court order, agreement or
@@ -422,7 +422,7 @@ conditions either of that version or of any later version published by
 the Free Software Foundation.  If the Library does not specify a
 license version number, you may choose any version ever published by
 the Free Software Foundation.
-
+
   14. If you wish to incorporate parts of the Library into other free
 programs whose distribution conditions are incompatible with these,
 write to the author to ask for permission.  For software which is
@@ -456,7 +456,7 @@ SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
 DAMAGES.
 
 		     END OF TERMS AND CONDITIONS
-
+
            How to Apply These Terms to Your New Libraries
 
   If you develop a new library, and you want it to be of the greatest

Shorewall6/Samples6/Universal/interfaces

@@ -7,7 +7,9 @@
 # http://www.shorewall.net/manpages/shorewall-interfaces.html
 #
 ###############################################################################
-#ZONE	INTERFACE	BROADCAST	OPTIONS
--	lo		-		ignore
-net	all		-		dhcp,physical=+,routeback
+FORMAT 2
+###############################################################################
+#ZONE	INTERFACE	OPTIONS
+-	lo		ignore
+net	all		dhcp,physical=+,routeback
 

Shorewall6/Samples6/Universal/shorewall6.conf

@@ -54,12 +54,16 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
 
+GEOIPDIR=/usr/share/xt_geoip/LE
+
 IP6TABLES=
 
 IP=
 
 IPSET=
 
+LOCKFILE=
+
 MODULESDIR=
 
 PERL=/usr/bin/perl

Shorewall6/Samples6/one-interface/interfaces

@@ -11,5 +11,7 @@
 #------------------------------------------------------------------------------
 # For information about entries in this file, type "man shorewall6-interfaces"
 ###############################################################################
-#ZONE	INTERFACE	BROADCAST	OPTIONS
-net     eth0            detect          tcpflags
+FORMAT 2
+###############################################################################
+#ZONE	INTERFACE	OPTIONS
+net     eth0            tcpflags

Shorewall6/Samples6/one-interface/shorewall6.conf

@@ -54,12 +54,16 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
 
+GEOIPDIR=/usr/share/xt_geoip/LE
+
 IP6TABLES=
 
 IP=
 
 IPSET=
 
+LOCKFILE=
+
 MODULESDIR=
 
 PERL=/usr/bin/perl

Shorewall6/Samples6/three-interfaces/interfaces

@@ -11,7 +11,9 @@
 #------------------------------------------------------------------------------
 # For information about entries in this file, type "man shorewall6-interfaces"
 ###############################################################################
-#ZONE	INTERFACE	BROADCAST	OPTIONS
-net     eth0            detect          tcpflags,forward=1
-loc     eth1            detect          tcpflags,forward=1
-dmz     eth2            detect		tcpflags,forward=1
+FORMAT 2
+###############################################################################
+#ZONE	INTERFACE	OPTIONS
+net     eth0            tcpflags,forward=1
+loc     eth1            tcpflags,forward=1
+dmz     eth2            tcpflags,forward=1

Shorewall6/Samples6/three-interfaces/shorewall6.conf

@@ -54,12 +54,16 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
 
+GEOIPDIR=/usr/share/xt_geoip/LE
+
 IP6TABLES=
 
 IP=
 
 IPSET=
 
+LOCKFILE=
+
 MODULESDIR=
 
 PERL=/usr/bin/perl

Shorewall6/Samples6/two-interfaces/interfaces

@@ -11,6 +11,8 @@
 #------------------------------------------------------------------------------
 # For information about entries in this file, type "man shorewall6-interfaces"
 ###############################################################################
-#ZONE	INTERFACE	BROADCAST	OPTIONS
-net     eth0            detect          tcpflags,forward=1
-loc     eth1            detect          tcpflags,forward=1
+FORMAT 2
+###############################################################################
+#ZONE	INTERFACE	OPTIONS
+net     eth0            tcpflags,forward=1
+loc     eth1            tcpflags,forward=1

Shorewall6/Samples6/two-interfaces/shorewall6.conf

@@ -54,12 +54,16 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
 
+GEOIPDIR=/usr/share/xt_geoip/LE
+
 IP6TABLES=
 
 IP=
 
 IPSET=
 
+LOCKFILE=
+
 MODULESDIR=
 
 PERL=/usr/bin/perl

Shorewall6/action.A_AllowICMPs

@@ -7,7 +7,7 @@
 #
 ###############################################################################
 #TARGET		SOURCE		DEST	PROTO		DEST
-#							PORT(S)	
+#							PORT(S)
 COMMENT Needed ICMP types (RFC4890)
 
 A_ACCEPT	-		-	ipv6-icmp	destination-unreachable

Shorewall6/action.AllowICMPs

@@ -7,7 +7,7 @@
 #
 ###############################################################################
 #TARGET	SOURCE		DEST	PROTO		DEST
-#						PORT(S)	
+#						PORT(S)
 
 FORMAT 2
 DEFAULTS ACCEPT

Shorewall6/action.Broadcast

@@ -22,7 +22,7 @@
 #       along with this program; if not, write to the Free Software
 #       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-#   Broadcast[([<action>|-[,{audit|-}])] 
+#   Broadcast[([<action>|-[,{audit|-}])]
 #
 #       Default action is DROP
 #
@@ -49,7 +49,7 @@ if ( have_capability( 'ADDRTYPE' ) ) {
 	log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type BROADCAST ';
 	log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type MULTICAST ';
 	log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type ANYCAST ';
-    }	
+    }
 
     add_jump $chainref, $target, 0, '-m addrtype --dst-type BROADCAST ';
     add_jump $chainref, $target, 0, '-m addrtype --dst-type MULTICAST ';
@@ -62,7 +62,7 @@ if ( have_capability( 'ADDRTYPE' ) ) {
     decr_cmd_level $chainref;
     add_commands $chainref, 'done';
 }
-  
+
 log_rule_limit( $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', join( ' ', '-d', IPv6_MULTICAST . ' ' ) )  if $level ne '';
 add_jump $chainref, $target, 0, join( ' ', '-d', IPv6_MULTICAST . ' ' );
 

Shorewall6/action.Drop

@@ -33,7 +33,7 @@
 ###############################################################################
 FORMAT 2
 #
-# The following magic provides different defaults for $2 thru $5, when $1 is 
+# The following magic provides different defaults for $2 thru $5, when $1 is
 # 'audit'.
 #
 BEGIN PERL;
@@ -41,7 +41,7 @@ use Shorewall::Config;
 
 my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
 
-if ( defined $p1 ) { 
+if ( defined $p1 ) {
     if ( $p1 eq 'audit' ) {
 	set_action_param( 2, 'A_REJECT')   unless supplied $p2;
 	set_action_param( 3, 'A_DROP')     unless supplied $p3;

Shorewall6/action.Reject

@@ -29,7 +29,7 @@
 ###############################################################################
 FORMAT 2
 #
-# The following magic provides different defaults for $2 thru $5, when $1 is 
+# The following magic provides different defaults for $2 thru $5, when $1 is
 # 'audit'.
 #
 BEGIN PERL;
@@ -37,7 +37,7 @@ use Shorewall::Config;
 
 my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
 
-if ( defined $p1 ) { 
+if ( defined $p1 ) {
     if ( $p1 eq 'audit' ) {
 	set_action_param( 2, 'A_REJECT')  unless supplied $p2;
 	set_action_param( 3, 'A_REJECT')  unless supplied $p3;

Shorewall6/actions.std

@@ -8,7 +8,7 @@
 #
 # Builtin Actions are:
 #
-#    allowBcasts        # Accept multicast and anycast packets 
+#    allowBcasts        # Accept multicast and anycast packets
 #    dropBcasts         # Silently Drop multicast and anycast packets
 #    dropNotSyn		# Silently Drop Non-syn TCP packets
 #    rejNotSyn		# Silently Reject Non-syn TCP packets

Shorewall6/configfiles/interfaces

@@ -7,8 +7,6 @@
 # http://www.shorewall.net/manpages6/shorewall6-interfaces.html
 #
 ###############################################################################
-FORMAT 1
-#ZONE	INTERFACE	ANYCAST		OPTIONS
-
 FORMAT 2
+###############################################################################
 #ZONE		INTERFACE		OPTIONS

Shorewall6/configfiles/restored

@@ -4,7 +4,7 @@
 # /etc/shorewall6/restored
 #
 #	Add commands below that you want to be executed after shorewall6 has
-#	completed a 'restore' command. 
+#	completed a 'restore' command.
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.