Add some decimal->hex convertions in routing rules.

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/configure

@@ -81,6 +81,9 @@ for p in $@; do
 		DATADIR)
 		    pn=SHAREDIR
 		    ;;
+		SYSCONFDIR)
+		    pn=CONFDIR
+		    ;;
 	    esac
 
 	    params[${pn}]="${pv}"
@@ -129,7 +132,7 @@ if [ -z "$vendor" ]; then
 
     vendor=${params[HOST]}
 elif [ $vendor = linux ]; then
-    rcfile=shorewallrc.default;
+    rcfile=$shorewallrc.default;
 else
     rcfile=shorewallrc.$vendor
     if [ ! -f $rcfile ]; then
@@ -178,7 +181,6 @@ for on in \
     SYSTEMD \
     SYSCONFFILE \
     SYSCONFDIR \
-    SPARSE \
     ANNOTATED \
     VARDIR
 do

Shorewall-core/configure.pl

@@ -39,7 +39,8 @@ my %options;
 
 my %aliases = ( VENDOR         => 'HOST',
 		SHAREDSTATEDIR => 'VARDIR',
-		DATADIR        => 'SHAREDIR' );
+		DATADIR        => 'SHAREDIR',
+		SYSCONFDIR     => 'CONFDIR' );
 
 for ( @ARGV ) {
     die "ERROR: Invalid option specification ( $_ )" unless /^(?:--)?(\w+)=(.*)$/;
@@ -139,7 +140,6 @@ for ( qw/ HOST
 	  SYSTEMD
 	  SYSCONFFILE
 	  SYSCONFDIR
-	  SPARSE
 	  ANNOTATED
 	  VARDIR / ) {
 

Shorewall-core/lib.base

@@ -28,7 +28,7 @@
 #
 
 SHOREWALL_LIBVERSION=40502
-SHOREWALL_CAPVERSION=40507
+SHOREWALL_CAPVERSION=40502
 
 [ -n "${g_program:=shorewall}" ]
 
@@ -130,6 +130,71 @@ combine_list()
     echo $o
 }
 
+#
+# Call this function to assert mutual exclusion with Shorewall. If you invoke the
+# /sbin/shorewall program while holding mutual exclusion, you should pass "nolock" as
+# the first argument. Example "shorewall nolock refresh"
+#
+# This function uses the lockfile utility from procmail if it exists.
+# Otherwise, it uses a somewhat race-prone algorithm to attempt to simulate the
+# behavior of lockfile.
+#
+mutex_on()
+{
+    local try
+    try=0
+    local lockf
+    lockf=${LOCKFILE:=${VARDIR}/lock}
+    local lockpid
+
+    MUTEX_TIMEOUT=${MUTEX_TIMEOUT:-60}
+
+    if [ $MUTEX_TIMEOUT -gt 0 ]; then
+
+	[ -d ${VARDIR} ] || mkdir -p ${VARDIR}
+
+	if [ -f $lockf ]; then
+	    lockpid=`cat ${lockf} 2> /dev/null`
+	    if [ -z "$lockpid" -o $lockpid = 0 ]; then
+		rm -f ${lockf}
+		error_message "WARNING: Stale lockfile ${lockf} removed"
+	    elif ! qt ps p ${lockpid}; then
+		rm -f ${lockf}
+		error_message "WARNING: Stale lockfile ${lockf} from pid ${lockpid} removed"
+	    fi
+	fi
+
+	if qt mywhich lockfile; then
+	    lockfile -${MUTEX_TIMEOUT} -r1 ${lockf}
+	    chmod u+w ${lockf}
+	    echo $$ > ${lockf}
+	    chmod u-w ${lockf}
+	else
+	    while [ -f ${lockf} -a ${try} -lt ${MUTEX_TIMEOUT} ] ; do
+		sleep 1
+		try=$((${try} + 1))
+	    done
+
+	    if  [ ${try} -lt ${MUTEX_TIMEOUT} ] ; then
+	        # Create the lockfile
+		echo $$ > ${lockf}
+	    else
+		echo "Giving up on lock file ${lockf}" >&2
+	    fi
+	fi
+    fi
+}
+
+#
+# Call this function to release mutual exclusion
+#
+mutex_off()
+{
+    rm -f ${LOCKFILE:=${VARDIR}/lock}
+}
+
+[ -z "$LEFTSHIFT" ] && . ${g_basedir}/lib.common
+
 #
 # Validate an IP address
 #
@@ -258,8 +323,6 @@ ip_range_explicit() {
     done
 }
 
-[ -z "$LEFTSHIFT" ] && . ${g_basedir}/lib.common
-
 #
 # Netmask to VLSM
 #

Shorewall-core/lib.cli

@@ -615,20 +615,6 @@ show_connections_filter() {
     fi
 }
 
-show_nfacct() {
-    if [ -n "$NFACCT" -a ! -x "$NFACCT" ]; then
-	error_message "WARNING: NFACCT=$NFACCT does not exist or is not executable"
-	NFACCT=
-    else
-	NFACCT=$(mywhich nfacct)
-	[ -n "$NFACCT" ] || echo "No NF Accounting defined (nfacct not found)"
-    fi
-
-    if [ -n "$NFACCT" ]; then
-	$NFACCT list
-	echo
-    fi
-}
 #
 # Show Command Executor
 #
@@ -934,12 +920,6 @@ show_command() {
 	    echo
 	    [ -f ${VARDIR}/marks ] && cat ${VARDIR}/marks;
 	    ;;
-	nfacct)
-	    [ $# -gt 1 ] && usage 1
-	    echo "$g_product $SHOREWALL_VERSION NF Accounting at $g_hostname - $(date)"
-	    echo
-	    show_nfacct
-	    ;;
 	*)
 	    case "$g_program" in
 		*-lite)
@@ -1216,17 +1196,12 @@ do_dump_command() {
 	brctl show
     fi
 
-    show_routing
-
     if [ $g_family -eq 4 ]; then
 	heading "Per-IP Counters"
 
 	perip_accounting
     fi
 
-    heading "NF Accounting"
-    show_nfacct
-
     if qt mywhich setkey; then
 	heading "PFKEY SPD"
 	setkey -DP
@@ -1254,6 +1229,8 @@ do_dump_command() {
 	done
     fi
 
+    show_routing
+
     if [ $g_family -eq 4 ]; then
 	heading "ARP"
 	arp -na
@@ -2017,24 +1994,6 @@ determine_capabilities() {
     IMQ_TARGET=
     DSCP_MATCH=
     DSCP_TARGET=
-    GEOIP_MATCH=
-    RPFILTER_MATCH=
-    NFACCT_MATCH=
-    AMANDA_HELPER=
-    FTP_HELPER=
-    FTP0_HELPER=
-    IRC_HELPER=
-    IRC0_HELPER=
-    NETBIOS_NS_HELPER=
-    H323_HELPER=
-    PPTP_HELPER=
-    SANE_HELPER=
-    SANE0_HELPER=
-    SIP_HELPER=
-    SIP0_HELPER=
-    SNMP_HELPER=
-    TFTP_HELPER=
-    TFTP0_HELPER=
 
     chain=fooX$$
 
@@ -2147,19 +2106,6 @@ determine_capabilities() {
 
     qt $g_tool -A $chain -j ACCEPT -m comment --comment "This is a comment" && COMMENTS=Yes
 
-    if [ -n "$NFACCT" -a ! -x "$NFACCT" ]; then
-	error_message "WARNING: NFACCT=$NFACCT does not exist or is not executable"
-	NFACCT=
-    else
-	NFACCT=$(mywhich nfacct)
-    fi
-
-    if [ -n "$NFACCT" ] && qt $NFACCT add $chain; then
-	qt $g_tool -A $chain -m nfacct --nfacct-name $chain && NFACCT_MATCH=Yes
-	qt $g_tool -D $chain -m nfacct --nfacct-name $chain
-	qt $NFACCT del $chain
-    fi
-
     if [ -n "$MANGLE_ENABLED" ]; then
 	qt $g_tool -t mangle -N $chain
 
@@ -2180,7 +2126,6 @@ determine_capabilities() {
 	qt $g_tool -t mangle -A $chain -j IMQ --todev 0 && IMQ_TARGET=Yes
 	qt $g_tool -t mangle -A $chain -m dscp --dscp 0 && DSCP_MATCH=Yes
 	qt $g_tool -t mangle -A $chain -j DSCP --set-dscp 0 && DSCP_TARGET=Yes
-	qt $g_tool -t mangle -A $chain -m rpfilter && RPFILTER_MATCH=Yes
 
 	qt $g_tool -t mangle -F $chain
 	qt $g_tool -t mangle -X $chain
@@ -2192,30 +2137,9 @@ determine_capabilities() {
     qt $g_tool -t rawpost -L -n && RAWPOST_TABLE=Yes
 
     if [ -n "$RAW_TABLE" ]; then
-	qt $g_tool -t raw -F $chain
-	qt $g_tool -t raw -X $chain
 	qt $g_tool -t raw -N $chain
-	
+	qt $g_tool -t raw -A $chain -j CT --notrack && CT_TARGET=Yes
-	if qt $g_tool -t raw -A $chain -j CT --notrack; then
+	qt $g_tool -t raw -N $chain
-	    CT_TARGET=Yes;
-
-	    qt $g_tool -t raw -A $chain -p udp --dport 10080 -j CT --helper amanda     && AMANDA_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p tcp --dport 21    -j CT --helper ftp        && FTP_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p tcp --dport 21    -j CT --helper ftp-0      && FTP0_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p udp --dport 1719  -j CT --helper RAS        && H323_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p tcp --dport 6667  -j CT --helper irc        && IRC_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p tcp --dport 6667  -j CT --helper irc-0      && IRC0_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p udp --dport 137   -j CT --helper netbios-ns && NETBIOS_NS_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p tcp --dport 1729  -j CT --helper pptp       && PPTP_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p tcp --dport 6566  -j CT --helper sane       && SANE_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p tcp --dport 6566  -j CT --helper sane-0     && SANE0_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p udp --dport 5060  -j CT --helper sip        && SIP_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p udp --dport 5060  -j CT --helper sip-0      && SIP0_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p udp --dport 161   -j CT --helper snmp       && SNMP_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p udp --dport 69    -j CT --helper tftp       && TFTP_HELPER=Yes
-	    qt $g_tool -t raw -A $chain -p udp --dport 69    -j CT --helper tftp-0     && TFTP0_HELPER=Yes
-	fi
-
 	qt $g_tool -t raw -F $chain
 	qt $g_tool -t raw -X $chain
     fi
@@ -2235,10 +2159,10 @@ determine_capabilities() {
 
 	    if [ -n "$have_ipset" ]; then
 		if qt $g_tool -A $chain -m set --match-set $chain src -j ACCEPT; then
-		    qt $g_tool -F $chain
+		    qt $g_tool -D $chain -m set --match-set $chain src -j ACCEPT
 		    IPSET_MATCH=Yes
 		elif qt $g_tool -A $chain -m set --set $chain src -j ACCEPT; then
-		    qt $g_tool -F $chain
+		    qt $g_tool -D $chain -m set --set $chain src -j ACCEPT
 		    IPSET_MATCH=Yes
 		    OLD_IPSET_MATCH=Yes
 		fi
@@ -2247,10 +2171,10 @@ determine_capabilities() {
 	elif qt ipset -N $chain hash:ip family inet6; then
 	    IPSET_V5=Yes
 	    if qt $g_tool -A $chain -m set --match-set $chain src -j ACCEPT; then
-		qt $g_tool -F $chain
+		qt $g_tool -D $chain -m set --match-set $chain src -j ACCEPT
 		IPSET_MATCH=Yes
 	    elif qt $g_tool -A $chain -m set --set $chain src -j ACCEPT; then
-		qt $g_tool -F $chain
+		qt $g_tool -D $chain -m set --set $chain src -j ACCEPT
 		IPSET_MATCH=Yes
 		OLD_IPSET_MATCH=Yes
 	    fi
@@ -2268,28 +2192,7 @@ determine_capabilities() {
     fi
     qt $g_tool -A $chain -j NFQUEUE --queue-num 4 && NFQUEUE_TARGET=Yes
     qt $g_tool -A $chain -m realm --realm 4 && REALM_MATCH=Yes
-
+    qt $g_tool -A $chain -m helper --helper "ftp" && HELPER_MATCH=Yes
-    #
-    # -m helper doesn't verify the existence of the specified helper :-(
-    #
-    if qt $g_tool -A $chain -p tcp --dport 21 -m helper --helper ftp; then
-	HELPER_MATCH=Yes
-
-	if [ -z "$CT_TARGET" ]; then
-	    AMANDA_HELPER=Yes
-	    FTP_HELPER=Yes
-	    FTP_HELPER=Yes
-	    H323_HELPER=Yes
-	    IRC_HELPER=Yes
-	    NS_HELPER=Yes
-	    PPTP_HELPER=Yes
-	    SANE_HELPER=Yes
-	    SIP_HELPER=Yes
-	    SNMP_HELPER=Yes
-	    TFTP_HELPER=Yes
-	fi
-    fi
-
     qt $g_tool -A $chain -m connlimit --connlimit-above 8 -j DROP && CONNLIMIT_MATCH=Yes
     qt $g_tool -A $chain -m time --timestart 23:00 -j DROP && TIME_MATCH=Yes
     qt $g_tool -A $chain -g $chain1 && GOTO_TARGET=Yes
@@ -2299,7 +2202,6 @@ determine_capabilities() {
     qt $g_tool -A $chain -j NFLOG && NFLOG_TARGET=Yes
     qt $g_tool -A $chain -j MARK --set-mark 5 && MARK_ANYWHERE=Yes
     qt $g_tool -A $chain -m statistic --mode nth --every 2 --packet 1 && STATISTIC_MATCH=Yes
-    qt $g_tool -A $chain -m geoip --src-cc US && GEOIP_MATCH=Yes
 
     if [ $g_family -eq 4 ]; then
 	qt $g_tool -A $chain -j ACCOUNT --addr 192.168.1.0/29 --tname $chain && ACCOUNT_TARGET=Yes
@@ -2414,24 +2316,6 @@ report_capabilities() {
 	report_capability "IMQ Target (IMQ_TARGET)" $IMQ_TARGET
 	report_capability "DSCP Match (DSCP_MATCH)" $DSCP_MATCH
 	report_capability "DSCP Target (DSCP_TARGET)" $DSCP_TARGET
-	report_capability "Geo IP match" $GEOIP_MATCH
-	report_capability "RPFilter match" $RPFILTER_MATCH
-	report_capability "NFAcct match" $NFACCT_MATCH
-	report_capability "Amanda Helper" $AMANDA_HELPER
-	report_capability "FTP Helper" $FTP_HELPER
-	report_capability "FTP-0 Helper" $FTP0_HELPER
-	report_capability "IRC Helper" $IRC_HELPER
-	report_capability "IRC-0 Helper" $IRC0_HELPER
-	report_capability "Netbios_ns Helper" $NETBIOS_NS_HELPER
-	report_capability "H323 Helper" $H323_HELPER
-	report_capability "PPTP Helper" $PPTP_HELPER
-	report_capability "SANE Helper" $SANE_HELPER
-	report_capability "SANE-0 Helper" $SANE0_HELPER
-	report_capability "SIP Helper" $SIP_HELPER
-	report_capability "SIP-0 Helper" $SIP0_HELPER
-	report_capability "SNMP Helper" $SNMP_HELPER
-	report_capability "TFTP Helper" $TFTP_HELPER
-	report_capability "TFTP-0 Helper" $TFTP0_HELPER
 
 	if [ $g_family -eq 4 ]; then
 	    report_capability "iptables -S (IPTABLES_S)" $IPTABLES_S
@@ -2441,9 +2325,6 @@ report_capabilities() {
 
 	report_capability "Basic Filter (BASIC_FILTER)" $BASIC_FILTER
 	report_capability "CT Target (CT_TARGET)" $CT_TARGET
-
-	echo "   Kernel Version (KERNELVERSION): $KERNELVERSION"
-	echo "   Capabilities Version (CAPVERSION): $CAPVERSION"
     fi
 
     [ -n "$PKTTYPE" ] || USEPKTTYPE=
@@ -2525,24 +2406,6 @@ report_capabilities1() {
     report_capability1 IMQ_TARGET
     report_capability1 DSCP_MATCH
     report_capability1 DSCP_TARGET
-    report_capability1 GEOIP_MATCH
-    report_capability1 RPFILTER_MATCH
-    report_capability1 NFACCT_MATCH
-    report_capability1 AMANDA_HELPER
-    report_capability1 FTP_HELPER
-    report_capability1 FTP0_HELPER
-    report_capability1 IRC_HELPER
-    report_capability1 IRC0_HELPER
-    report_capability1 NETBIOS_NS_HELPER
-    report_capability1 H323_HELPER
-    report_capability1 PPTP_HELPER
-    report_capability1 SANE_HELPER
-    report_capability1 SANE0_HELPER
-    report_capability1 SIP_HELPER
-    report_capability1 SIP0_HELPER
-    report_capability1 SNMP_HELPER
-    report_capability1 TFTP_HELPER
-    report_capability1 TFTP0_HELPER
 
     echo CAPVERSION=$SHOREWALL_CAPVERSION
     echo KERNELVERSION=$KERNELVERSION
@@ -3079,16 +2942,9 @@ usage() # $1 = exit status
     echo "   show connections"
     echo "   show filters"
     echo "   show ip"
-
-    if [ $g_family -eq 4 ]; then
-	echo "   show ipa"
-    fi
-
     echo "   show [ -m ] log [<regex>]"
-    echo "   show [ -x ] mangle|nat|raw|rawpost"
+    echo "   show [ -x ] mangle|nat|raw|rawpost|routing"
-    echo "   show nfacct"
     echo "   show policies"
-    echo "   show routing"
     echo "   show tc [ device ]"
     echo "   show vardir"
     echo "   show zones"

Shorewall-core/lib.common

@@ -717,69 +717,3 @@ truncate() # $1 = length
 {
     cut -b -${1}
 }
-
-#
-# Call this function to assert mutual exclusion with Shorewall. If you invoke the
-# /sbin/shorewall program while holding mutual exclusion, you should pass "nolock" as
-# the first argument. Example "shorewall nolock refresh"
-#
-# This function uses the lockfile utility from procmail if it exists.
-# Otherwise, it uses a somewhat race-prone algorithm to attempt to simulate the
-# behavior of lockfile.
-#
-mutex_on()
-{
-    local try
-    try=0
-    local lockf
-    lockf=${LOCKFILE:=${VARDIR}/lock}
-    local lockpid
-
-    MUTEX_TIMEOUT=${MUTEX_TIMEOUT:-60}
-
-    if [ $MUTEX_TIMEOUT -gt 0 ]; then
-
-	[ -d ${VARDIR} ] || mkdir -p ${VARDIR}
-
-	if [ -f $lockf ]; then
-	    lockpid=`cat ${lockf} 2> /dev/null`
-	    if [ -z "$lockpid" -o $lockpid = 0 ]; then
-		rm -f ${lockf}
-		error_message "WARNING: Stale lockfile ${lockf} removed"
-	    elif [ $lockpid -eq $$ ]; then
-                return 0
-	    elif ! qt ps p ${lockpid}; then
-		rm -f ${lockf}
-		error_message "WARNING: Stale lockfile ${lockf} from pid ${lockpid} removed"
-	    fi
-	fi
-
-	if qt mywhich lockfile; then
-	    lockfile -${MUTEX_TIMEOUT} -r1 ${lockf}
-	    chmod u+w ${lockf}
-	    echo $$ > ${lockf}
-	    chmod u-w ${lockf}
-	else
-	    while [ -f ${lockf} -a ${try} -lt ${MUTEX_TIMEOUT} ] ; do
-		sleep 1
-		try=$((${try} + 1))
-	    done
-
-	    if  [ ${try} -lt ${MUTEX_TIMEOUT} ] ; then
-	        # Create the lockfile
-		echo $$ > ${lockf}
-	    else
-		echo "Giving up on lock file ${lockf}" >&2
-	    fi
-	fi
-    fi
-}
-
-#
-# Call this function to release mutual exclusion
-#
-mutex_off()
-{
-    rm -f ${LOCKFILE:=${VARDIR}/lock}
-}
-

Shorewall-core/shorewallrc.suse

@@ -12,7 +12,7 @@ SBINDIR=/sbin                                         #Directory where system ad
 MANDIR=${SHAREDIR}/man/                               #Directory where manpages are installed.
 INITDIR=/etc/init.d                                   #Directory where SysV init scripts are installed.
 INITFILE=$PRODUCT                                     #Name of the product's SysV init script
-INITSOURCE=init.suse.sh                               #Name of the distributed file to be installed as the SysV init script
+INITSOURCE=init.sh                                    #Name of the distributed file to be installed as the SysV init script
 ANNOTATED=                                            #If non-zero, annotated configuration files are installed
 SYSTEMD=                                              #Directory where .service files are installed (systems running systemd only)
 SYSCONFFILE=                                          #Name of the distributed file to be installed in $SYSCONFDIR

Shorewall-init/ifupdown.sh

@@ -106,11 +106,15 @@ if [ -f /etc/debian_version ]; then
 	    else
 		exit 0
 	    fi
+
+	    case "$PHASE" in
+		pre-*)
+		    exit 0
+		    ;;
+	    esac
 	    ;;
     esac
 elif [ -f /etc/SuSE-release ]; then
-    PHASE=''
-
     case $0 in
 	/etc/ppp*)
 	    #
@@ -142,8 +146,6 @@ else
     #
     # Assume RedHat/Fedora/CentOS/Foobar/...
     #
-    PHASE=''
-
     case $0 in
 	/etc/ppp*)
 	    INTERFACE="$1"
@@ -184,12 +186,20 @@ else
     esac
 fi
 
-[ -n "$LOGFILE" ] || LOGFILE=/dev/null
-
 for PRODUCT in $PRODUCTS; do
+    #
+    # For backward compatibility, lib.base appends the product name to VARDIR
+    # Save it here and restore it below
+    #
+    save_vardir=${VARDIR}
     if [ -x $VARDIR/$PRODUCT/firewall ]; then
-	  ( ${VARDIR}/$PRODUCT/firewall -V0 $COMMAND $INTERFACE >> $LOGFILE 2>&1 ) || true
+	  ( . ${SHAREDIR}/shorewall/lib.base
+	    mutex_on
+	    ${VARDIR}/firewall -V0 $COMMAND $INTERFACE || echo_notdone
+	    mutex_off
+	  )
     fi
+    VARDIR=${save_vardir}
 done
 
 exit 0

Shorewall-init/init.suse.sh

@@ -1,115 +0,0 @@
-#! /bin/bash
-#     The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.5
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#     (c) 2010,2012 - Tom Eastep (teastep@shorewall.net)
-#
-#       On most distributions, this file should be called /etc/init.d/shorewall.
-#
-#       Complete documentation is available at http://shorewall.net
-#
-#       This program is free software; you can redistribute it and/or modify
-#       it under the terms of Version 2 of the GNU General Public License
-#       as published by the Free Software Foundation.
-#
-#       This program is distributed in the hope that it will be useful,
-#       but WITHOUT ANY WARRANTY; without even the implied warranty of
-#       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#       GNU General Public License for more details.
-#
-#       You should have received a copy of the GNU General Public License
-#       along with this program; if not, write to the Free Software
-#       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-#
-### BEGIN INIT INFO
-# Provides: shorewall-init
-# Required-Start: $local_fs
-# Required-Stop:  $local_fs
-# Default-Start:  2 3 5
-# Default-Stop:   0 1 6
-# Short-Description: Initialize the firewall at boot time
-# Description:       Place the firewall in a safe state at boot time
-#                    prior to bringing up the network.  
-### END INIT INFO
-
-if [ "$(id -u)" != "0" ]
-then
-  echo "You must be root to start, stop or restart \"Shorewall \"."
-  exit 1
-fi
-
-# check if shorewall-init is configured or not
-if [ -f "/etc/sysconfig/shorewall-init" ]
-then
-	. /etc/sysconfig/shorewall-init
-	if [ -z "$PRODUCTS" ]
-	then
-		exit 0
-	fi
-else
-	exit 0
-fi
-
-#
-# The installer may alter this
-#
-. /usr/share/shorewall/shorewallrc
-
-# Initialize the firewall
-shorewall_start () {
-  local PRODUCT
-  local VARDIR
-
-  echo -n "Initializing \"Shorewall-based firewalls\": "
-  for PRODUCT in $PRODUCTS; do
-      if [ -x ${VARDIR}/firewall ]; then
-	  if ! ${SBIN}/$PRODUCT status > /dev/null 2>&1; then
-	      ${VARDIR}/firewall stop || echo_notdone
-	  fi
-      fi
-  done
-
-  if [ -n "$SAVE_IPSETS" -a -f "$SAVE_IPSETS" ]; then
-      ipset -R < "$SAVE_IPSETS"
-  fi
-
-  return 0
-}
-
-# Clear the firewall
-shorewall_stop () {
-  local PRODUCT
-  local VARDIR
-
-  echo -n "Clearing \"Shorewall-based firewalls\": "
-  for PRODUCT in $PRODUCTS; do
-      if [ -x ${VARDIR}/firewall ]; then
-	  ${VARDIR}/firewall clear || exit 1
-      fi
-  done
-
-  if [ -n "$SAVE_IPSETS" ]; then
-      mkdir -p $(dirname "$SAVE_IPSETS")
-      if ipset -S > "${SAVE_IPSETS}.tmp"; then
-	  grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
-      fi
-  fi
-
-  return 0
-}
-
-case "$1" in
-  start)
-     shorewall_start
-     ;;
-  stop)
-     shorewall_stop
-     ;;
-  *)
-     echo "Usage: /etc/init.d/shorewall-init {start|stop}"
-     exit 1
-esac
-
-exit 0

Shorewall-init/install.sh

@@ -260,11 +260,6 @@ else
     first_install="Yes"
 fi
 
-if [ -n "$DESTDIR" ]; then
-    mkdir -p ${DESTDIR}${CONFDIR}/logrotate.d
-    chmod 755 ${DESTDIR}${CONFDIR}/logrotate.d
-fi
-
 #
 # Install the Firewall Script
 #
@@ -297,35 +292,27 @@ fi
 #
 # Create /usr/share/shorewall-init if needed
 #
-mkdir -p ${DESTDIR}${SHAREDIR}/shorewall-init
+mkdir -p ${DESTDIR}/usr/share/shorewall-init
-chmod 755 ${DESTDIR}${SHAREDIR}/shorewall-init
+chmod 755 ${DESTDIR}/usr/share/shorewall-init
-
-#
-# Install logrotate file
-#
-if [ -d ${DESTDIR}${CONFDIR}/logrotate.d ]; then
-    run_install $OWNERSHIP -m 0644 logrotate ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT
-    echo "Logrotate file installed as ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT"
-fi
 
 #
 # Create the version file
 #
-echo "$VERSION" > ${DESTDIR}/${SHAREDIR}/shorewall-init/version
+echo "$VERSION" > ${DESTDIR}/usr/share/shorewall-init/version
-chmod 644 ${DESTDIR}${SHAREDIR}/shorewall-init/version
+chmod 644 ${DESTDIR}/usr/share/shorewall-init/version
 
 #
 # Remove and create the symbolic link to the init script
 #
 if [ -z "$DESTDIR" ]; then
-    rm -f ${SHAREDIR}/shorewall-init/init
+    rm -f /usr/share/shorewall-init/init
     ln -s ${INITDIR}/${INITFILE} ${SHAREDIR}/shorewall-init/init
 fi
 
 if [ $HOST = debian ]; then
     if [ -n "${DESTDIR}" ]; then
 	mkdir -p ${DESTDIR}/etc/network/if-up.d/
-	mkdir -p ${DESTDIR}/etc/network/if-down.d/
+	mkdir -p ${DESTDIR}/etc/network/if-post-down.d/
     fi
 
     if [ ! -f ${DESTDIR}/etc/default/shorewall-init ]; then
@@ -360,7 +347,7 @@ fi
 
 cp ifupdown.sh ifupdown
 
-[ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ifupdown
+d[ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ifupdown
 
 mkdir -p ${DESTDIR}${LIBEXECDIR}/shorewall-init
 
@@ -373,7 +360,6 @@ fi
 case $HOST in
     debian)
 	install_file ifupdown ${DESTDIR}/etc/network/if-up.d/shorewall 0544
-	install_file ifupdown ${DESTDIR}/etc/network/if-down.d/shorewall 0544
 	install_file ifupdown ${DESTDIR}/etc/network/if-post-down.d/shorewall 0544
 	;;
     suse)
@@ -396,12 +382,12 @@ if [ -z "$DESTDIR" ]; then
     if [ -n "$first_install" ]; then
 	if [ $HOST = debian ]; then
 	    
-	    update-rc.d shorewall-init enable
+	    update-rc.d shorewall-init defaults
 
 	    echo "Shorewall Init will start automatically at boot"
 	else
 	    if [ -n "$SYSTEMD" ]; then
-		if systemctl enable shorewall-init.service; then
+		if systemctl enable shorewall-init; then
 		    echo "Shorewall Init will start automatically at boot"
 		fi
 	    elif [ -x ${SBINDIR}/insserv -o -x /usr${SBINDIR}/insserv ]; then

Shorewall-init/logrotate

@@ -1,5 +0,0 @@
-/var/log/shorewall-ifupdown.log {
-  missingok
-  notifempty
-  create 0600 root root
-}

Shorewall-init/sysconfig

@@ -16,8 +16,3 @@ IFUPDOWN=0
 # during 'start' and will save them there during 'stop'.
 #
 SAVE_IPSETS=""
-#
-# Where Up/Down events get logged
-#
-LOGFILE=/var/log/shorewall-ifupdown.log
-

Shorewall-lite/init.suse.sh

@@ -1,92 +0,0 @@
-#!/bin/sh
-#
-#     The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.5
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2012 - Tom Eastep (teastep@shorewall.net)
-#
-#	On most distributions, this file should be called /etc/init.d/shorewall.
-#
-#	Complete documentation is available at http://shorewall.net
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-#	If an error occurs while starting or restarting the firewall, the
-#	firewall is automatically stopped.
-#
-#	Commands are:
-#
-#	   shorewall start			  Starts the firewall
-#	   shorewall restart			  Restarts the firewall
-#	   shorewall reload			  Reload the firewall
-#						  (same as restart)
-#	   shorewall stop			  Stops the firewall
-#	   shorewall status			  Displays firewall status
-#
-
-
-### BEGIN INIT INFO
-# Provides:	  shorewall-lite
-# Required-Start: $network $remote_fs
-# Required-Stop:  
-# Default-Start:  2 3 5
-# Default-Stop:	  0 1 6
-# Description:	  starts and stops the shorewall firewall
-# Short-Description: Packet filtering firewall
-### END INIT INFO
-
-################################################################################
-# Give Usage Information						       #
-################################################################################
-usage() {
-    echo "Usage: $0 start|stop|reload|restart|status"
-    exit 1
-}
-
-################################################################################
-# Get startup options (override default)
-################################################################################
-OPTIONS=
-
-#
-# The installer may alter this
-#
-. /usr/share/shorewall/shorewallrc
-
-if [ -f ${SYSCONFDIR}/shorewall-lite ]; then
-    . ${SYSCONFDIR}/shorewall-lite
-fi
-
-SHOREWALL_INIT_SCRIPT=1
-
-################################################################################
-# E X E C U T I O N    B E G I N S   H E R E				       #
-################################################################################
-command="$1"
-
-case "$command" in
-    start)
-	exec ${SBINDIR}/shorewall-lite $OPTIONS start $STARTOPTIONS
-	;;
-    restart|reload)
-	exec ${SBINDIR}/shorewall-lite $OPTIONS restart $RESTARTOPTIONS
-	;;
-    status|stop)
-	exec ${SBINDIR}/shorewall-lite $OPTIONS $command $@
-	;;
-    *)
-	usage
-	;;
-esac

Shorewall-lite/install.sh

@@ -253,10 +253,7 @@ case "$HOST" in
     archlinux)
 	echo "Installing ArchLinux-specific configuration..."
 	;;
-    suse)
+    linux|suse)
-	echo "Installing Suse-specific configuration..."
-	;;
-    linux)
 	;;
     *)
 	echo "ERROR: Unknown HOST \"$HOST\"" >&2
@@ -306,8 +303,8 @@ if [ -z "$DESTDIR" -a -d ${CONFDIR}/$PRODUCT ]; then
 	mv -f ${CONFDIR}/$PRODUCT/shorewall.conf ${CONFDIR}/$PRODUCT/$PRODUCT.conf
 else
     rm -rf ${DESTDIR}${CONFDIR}/$PRODUCT
-    rm -rf ${DESTDIR}${SHAREDIR}/$PRODUCT
+    rm -rf ${DESTDIR}/usr/share/$PRODUCT
-    rm -rf ${DESTDIR}${VARDIR}/$PRODUCT
+    rm -rf ${DESTDIR}/var/lib/$PRODUCT
     [ "$LIBEXECDIR" = /usr/share ] || rm -rf ${DESTDIR}/usr/share/$PRODUCT/wait4ifup ${DESTDIR}/usr/share/$PRODUCT/shorecap
 fi
 
@@ -330,9 +327,9 @@ echo "$Product control program installed in ${DESTDIR}${SBINDIR}/$PRODUCT"
 # Create ${CONFDIR}/$PRODUCT, /usr/share/$PRODUCT and /var/lib/$PRODUCT if needed
 #
 mkdir -p ${DESTDIR}${CONFDIR}/$PRODUCT
-mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT
+mkdir -p ${DESTDIR}/usr/share/$PRODUCT
 mkdir -p ${DESTDIR}${LIBEXECDIR}/$PRODUCT
-mkdir -p ${DESTDIR}${VARDIR}/$PRODUCT
+mkdir -p ${DESTDIR}/var/lib/$PRODUCT
 
 chmod 755 ${DESTDIR}${CONFDIR}/$PRODUCT
 chmod 755 ${DESTDIR}/usr/share/$PRODUCT
@@ -406,7 +403,6 @@ echo "Common functions linked through ${DESTDIR}${SHAREDIR}/$PRODUCT/functions"
 #
 
 install_file shorecap ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shorecap 0755
-[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}/${LIBEXECDIR}/$PRODUCT/shorecap
 
 echo
 echo "Capability file builder installed in ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shorecap"
@@ -502,7 +498,7 @@ if [ -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${mac}" ]; then
 	perl -p -w -i -e 's/^STARTUP_ENABLED=No/STARTUP_ENABLED=Yes/;s/^IP_FORWARDING=On/IP_FORWARDING=Keep/;s/^SUBSYSLOCK=.*/SUBSYSLOCK=/;' ${CONFDIR}/${PRODUCT}/${PRODUCT}.conf
 	update-rc.d $PRODUCT enable defaults
     elif [ -n "$SYSTEMD" ]; then
-	if systemctl enable ${PRODUCT}.service; then
+	if systemctl enable $PRODUCT; then
 	    echo "$Product will start automatically at boot"
 	fi
     elif mywhich insserv; then

Shorewall-lite/shorecap

@@ -45,22 +45,17 @@
 #    used during firewall compilation, then the generated firewall program will likewise not
 #    require Shorewall to be installed.
 
-
+SHAREDIR=/usr/share/shorewall-lite
+VARDIR=/var/lib/shorewall-lite
+CONFDIR=/etc/shorewall-lite
 g_program=shorewall-lite
+g_product="Shorewall Lite"
+g_family=4
+g_base=shorewall
+g_basedir=/usr/share/shorewall-lite
 
-#
+. /usr/share/shorewall-lite/lib.base
-# This is modified by the installer when ${SHAREDIR} != /usr/share
+. /usr/share/shorewall/lib.cli
-#
-. /usr/share/shorewall/shorewallrc
-
-g_libexec="$LIBEXECDIR"
-g_sharedir="$SHAREDIR"/shorewall-lite
-g_sbindir="$SBINDIR"
-g_vardir="$VARDIR"
-g_confdir="$CONFDIR"/shorewall-lite
-g_readrc=1
-
-. ${SHAREDIR}/shorewall/lib.cli
 . /usr/share/shorewall-lite/configpath
 
 [ -n "$PATH" ] || PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin

Shorewall/Macros/macro.Amanda

@@ -8,16 +8,9 @@
 #	files from those nodes.
 #
 ###############################################################################
-FORMAT 2
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
-
+PARAM	-	-	udp	10080
-?if ( __CT_TARGET && ! $AUTOHELPERS && __AMANDA_HELPER )
- PARAM	-	-	udp	10080 ; helper=amanda
-?else
- PARAM	-	-	udp	10080
-?endif
-
 PARAM	-	-	tcp	10080
 #
 # You may also need this rule.  With AMANDA 2.4.4 on Linux kernel 2.6,

Shorewall/Macros/macro.BLACKLIST

@@ -8,8 +8,8 @@
 ###############################################################################
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
-?if $BLACKLIST_LOGLEVEL
+?IF $BLACKLIST_LOGLEVEL
 blacklog
-?else
+?ELSE
 $BLACKLIST_DISPOSITION
-?endif
+?ENDIF

Shorewall/Macros/macro.FTP

@@ -6,11 +6,6 @@
 #	This macro handles FTP traffic.
 #
 ###############################################################################
-FORMAT 2
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
-?if ( __CT_TARGET && ! $AUTOHELPERS && __FTP_HELPER  )
+PARAM	-	-	tcp	21
- PARAM	-	-	tcp	21 ; helper=ftp
-?else
- PARAM	-	-	tcp	21
-?endif

Shorewall/Macros/macro.IRC

@@ -6,12 +6,6 @@
 #	This macro handles IRC traffic (Internet Relay Chat).
 #
 ###############################################################################
-FORMAT 2
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
-
+PARAM	-	-	tcp	6667
-?if ( __CT_TARGET && ! $AUTOHELPERS && __IRC_HELPER  )
- PARAM	-	-	tcp	6667 ; helper=irc
-?else
- PARAM	-	-	tcp	6667
-?endif

Shorewall/Macros/macro.MSSQL

@@ -1,11 +0,0 @@
-#
-# Shorewall version 4 - MSSQL Macro
-#
-# /usr/share/shorewall/macro.MSSQL
-#
-#	This macro handles MSSQL (Microsoft SQL Server)
-#
-###############################################################################
-#ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
-#				PORT(S)	PORT(S)	LIMIT	GROUP
-PARAM	-	-	tcp	1433

Shorewall/Macros/macro.PPtP

@@ -6,14 +6,8 @@
 #	This macro handles PPTP traffic.
 #
 ###############################################################################
-?FORMAT 2
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
 PARAM	-	-	47
 PARAM	DEST	SOURCE	47
-
+PARAM	-	-	tcp	1723
-?if ( __CT_TARGET && ! $AUTOHELPERS && __PPTP_HELPER )
- PARAM	-	-	tcp	1723 ; helper=pptp
-?else
- PARAM	-	-	tcp	1723
-?endif

Shorewall/Macros/macro.SANE

@@ -6,16 +6,9 @@
 #	This macro handles SANE network scanning.
 #
 ###############################################################################
-FORMAT 2
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
-
+PARAM	-	-	tcp	6566
-?if ( __CT_TARGET && ! $AUTOHELPERS && __SANE_HELPER )
- PARAM	-	-	tcp	6566 ; helper=sane
-?else
- PARAM	-	-	tcp	6566
-?endif
-
 #
 # Kernels 2.6.23+ has nf_conntrack_sane module which will handle
 # sane data connection.

Shorewall/Macros/macro.SIP

@@ -1,17 +0,0 @@
-#
-# Shorewall version 4 - SIP Macro
-#
-# /usr/share/shorewall/macro.SIP
-#
-#	This macro handles SIP traffic.
-#
-###############################################################################
-FORMAT 2
-#ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
-#				PORT(S)	PORT(S)	LIMIT	GROUP
-
-?if ( __CT_TARGET && ! $AUTOHELPERS && __SIP_HELPER  )
- PARAM	-	-	udp	5060 ; helper=sip
-?else
- PARAM	-	-	udp	5060
-?endif

Shorewall/Macros/macro.SMB

@@ -10,17 +10,9 @@
 #	between hosts you fully trust.
 #
 ###############################################################################
-FORMAT 2
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
 PARAM	-	-	udp	135,445
-
+PARAM	-	-	udp	137:139
-?if ( __CT_TARGET && ! $AUTOHELPERS && __NETBIOS_NS_HELPER )
- PARAM	-	-	udp	137 ; helper=netbios-ns
- PARAM	-	-	udp	138:139
-?else
- PARAM	-	-	udp	137:139
-?endif
-
 PARAM	-	-	udp	1024:	137
 PARAM	-	-	tcp	135,139,445

Shorewall/Macros/macro.SMBBI

@@ -10,28 +10,13 @@
 #	allow SMB traffic between hosts you fully trust.
 #
 ###############################################################################
-FORMAT 2
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
 PARAM	-	-	udp	135,445
-
+PARAM	-	-	udp	137:139
-?if ( __CT_TARGET && ! $AUTOHELPERS && __NETBIOS_NS_HELPER )
- PARAM	-	-	udp	137 ; helper=netbios-ns
- PARAM	-	-	udp	138:139
-?else
- PARAM	-	-	udp	137:139
-?endif
-
 PARAM	-	-	udp	1024:	137
 PARAM	-	-	tcp	135,139,445
 PARAM	DEST	SOURCE	udp	135,445
-
+PARAM	DEST	SOURCE	udp	137:139
-?if ( __CT_TARGET && ! $AUTOHELPERS && __NETBIOS_NS_HELPER )
- PARAM	DEST	SOURCE	udp	137 ; helper=netbios-ns
- PARAM	DEST	SOURCE	udp	138:139
-?else
- PARAM	DEST	SOURCE	udp	137:139
-?endif
-
 PARAM	DEST	SOURCE	udp	1024:	137
 PARAM	DEST	SOURCE	tcp	135,139,445

Shorewall/Macros/macro.SNMP

@@ -6,15 +6,7 @@
 #	This macro handles SNMP traffic (including traps).
 #
 ###############################################################################
-FORMAT 2
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
-
+PARAM	-	-	udp	161:162
-?if ( __CT_TARGET && ! $AUTOHELPERS && __SNMP_HELPER )
- PARAM	-	-  	udp     161 ; helper=snmp
- PARAM	-	-	udp	162
-?else
- PARAM	-	-	udp	161:162
-?endif
-
 PARAM	-	-	tcp	161

Shorewall/Macros/macro.TFTP

@@ -8,12 +8,6 @@
 #	Internet.
 #
 ###############################################################################
-FORMAT 2
 #ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	RATE	USER/
 #				PORT(S)	PORT(S)	LIMIT	GROUP
-
+PARAM	-	-	udp	69
-?if ( __CT_TARGET && ! $AUTOHELPERS && __TFTP_HELPER )
- PARAM	-	-	udp	69 ; helper=tftp
-?else
- PARAM	-	-	udp	69
-?endif

Shorewall/Macros/macro.mDNS

@@ -1,11 +1,9 @@
 #
-# Shorewall version 4 - Multicast DNS Macro -- this macro assumes that only
+# Shorewall version 4 - Multicast DNS Macro
-#                       the DEST zone sends mDNS queries. If both zones send
-#                       queries, use the mDNSbi macro.
 #
 # /usr/share/shorewall/macro.mDNS
 #
-#	This macro handles multicast DNS traffic
+#	This macro handles multicast DNS traffic.
 #
 ###############################################################################
 #ACTION	SOURCE	DEST			PROTO	DEST	SOURCE	RATE	USER/

Shorewall/Macros/macro.mDNSbi

@@ -1,16 +0,0 @@
-#
-# Shorewall version 4 - Bi-directional Multicast DNS Macro.
-#
-# /usr/share/shorewall/macro.mDNSbi
-#
-#	This macro handles multicast DNS traffic
-#
-###############################################################################
-#ACTION	SOURCE	DEST			PROTO	DEST	SOURCE	RATE	USER/
-#						PORT(S)	PORT(S)	LIMIT	GROUP
-PARAM	-	224.0.0.251		udp	5353
-PARAM	-	-			udp	32768:	5353
-PARAM	-	224.0.0.251		2
-PARAM	DEST	SOURCE:224.0.0.251	udp	5353
-PARAM	DEST	SOURCE			udp	32768:	5353
-PARAM	DEST	SOURCE:224.0.0.251	2

Shorewall/Perl/Shorewall/Accounting.pm

@@ -46,7 +46,6 @@ my $jumpchainref;
 my %accountingjumps;
 my $asection;
 my $defaultchain;
-my $ipsecdir;
 my $defaultrestriction;
 my $restriction;
 my $accounting_commands = { COMMENT => 0, SECTION => 2 };
@@ -93,7 +92,6 @@ sub initialize() {
     # These are the legacy values
     #
     $defaultchain       = 'accounting';
-    $ipsecdir           = '';
     $defaultrestriction = NO_RESTRICT;
     $sectionname        = '';
 }
@@ -113,25 +111,20 @@ sub process_section ($) {
 
     if ( $sectionname eq 'INPUT' ) {
 	$defaultchain = 'accountin';
-	$ipsecdir     = 'in';
 	$defaultrestriction = INPUT_RESTRICT;
     } elsif ( $sectionname eq 'OUTPUT' ) {
 	$defaultchain = 'accountout';
-	$ipsecdir     = 'out';
 	$defaultrestriction = OUTPUT_RESTRICT;
     } elsif ( $sectionname eq 'FORWARD' ) {
 	$defaultchain = 'accountfwd';
-	$ipsecdir     = '';
 	$defaultrestriction = NO_RESTRICT;
      } else {
 	 fatal_error "The $sectionname SECTION is not allowed when ACCOUNTING_TABLE=filter" unless $acctable eq 'mangle';
 	 if ( $sectionname eq 'PREROUTING' ) {
 	     $defaultchain = 'accountpre';
-	     $ipsecdir     = 'in';
 	     $defaultrestriction = PREROUTE_RESTRICT;
 	 } else {
 	     $defaultchain = 'accountpost';
-	     $ipsecdir     = 'out';
 	     $defaultrestriction = POSTROUTE_RESTRICT;
 	 }
      }
@@ -236,11 +229,6 @@ sub process_accounting_rule( ) {
 	    }
 	} elsif ( $action =~ /^NFLOG/ ) {
 	    $target = validate_level $action;
-	} elsif ( $action =~ /^NFACCT\((\w+)\)$/ ) {
-	    require_capability 'NFACCT_MATCH', 'The NFACCT action', 's';
-	    $nfobjects{$1} = 1;
-	    $target = '';
-	    $rule .= "-m nfacct --nfacct-name $1 ";
 	} else {
 	    ( $action, my $cmd ) = split /:/, $action;
 
@@ -297,21 +285,7 @@ sub process_accounting_rule( ) {
     }
 
     my $chainref = $chain_table{$config{ACCOUNTING_TABLE}}{$chain};
-    my $dir = $ipsecdir;
+    my $dir;
-
-    if ( $asection && $ipsec ne '-' ) {
-	if ( $ipsecdir ) {
-	    fatal_error "Invalid IPSEC ($ipsec)" if $ipsec =~ /^(?:in|out)\b/;
-	} else {
-	    if ( $ipsec =~ s/^(?:(in|out)\b)// ) {
-		$dir = $1;
-	    } else {
-		fatal_error q(IPSEC rules in the $asection section require that the value begin with 'in' or 'out');
-	    }
-	}
-
-	$rule .= do_ipsec( $dir, $ipsec );
-    }
 
     if ( ! $chainref ) {
 	if ( reserved_chain_name( $chain ) ) {
@@ -323,7 +297,6 @@ sub process_accounting_rule( ) {
 	    $chainref = ensure_accounting_chain $chain, 0 , $restriction;
 	}
 
-	unless ( $asection ) {
 	$dir      = ipsec_chain_name( $chain );
 
 	if ( $ipsec ne '-' ) {
@@ -337,11 +310,9 @@ sub process_accounting_rule( ) {
 	    warning_message "Adding rule to unreferenced accounting chain $chain" unless reserved_chain_name( $chain );
 	    $chainref->{ipsec} = $dir;
 	}
-	}
     } else {
 	fatal_error "$chain is not an accounting chain" unless $chainref->{accounting};
 
-	unless ( $asection ) {
 	if ( $ipsec ne '-' ) {
 	    $dir = $chainref->{ipsec};
 	    fatal_error "Adding an IPSEC rule into a non-IPSEC chain is not allowed" unless $dir;
@@ -350,7 +321,6 @@ sub process_accounting_rule( ) {
 	    $restriction |= $chainref->{restriction};
 	}
     }
-    }
 
     set_optflags( $chainref, DONT_OPTIMIZE ) if $target eq 'RETURN';
 
@@ -396,6 +366,7 @@ sub process_accounting_rule( ) {
 	} else {
 	    $jumpchainref->{ipsec} = $chainref->{ipsec};
 	}
+
     }
 
     if ( $rule2 ) {

Shorewall/Perl/Shorewall/Compiler.pm

@@ -368,7 +368,6 @@ sub generate_script_3($) {
     emit '';
 
     load_ipsets;
-    create_nfobjects;
 
     if ( $family == F_IPV4 ) {
 	emit ( 'if [ "$COMMAND" = refresh ]; then' ,
@@ -666,6 +665,11 @@ sub compiler {
     #                           (Produces no output to the compiled script)
     #
     process_policies;
+    #
+    #                                       N O T R A C K
+    #                           (Produces no output to the compiled script)
+    #
+    setup_notrack;
 
     enable_script;
 
@@ -705,14 +709,6 @@ sub compiler {
     #
     setup_proxy_arp;
 
-    emit( "#\n# Disable automatic helper association on kernel 3.5.0 and later\n#" ,
-	  'if [ -f /proc/sys/net/netfilter/nf_conntrack_helper ]; then' ,
-	  '    progress_message "Disabling Kernel Automatic Helper Association"',
-	  "    echo 0 > /proc/sys/net/netfilter/nf_conntrack_helper",
-	  'fi',
-	  ''
-	);
-
     if ( $scriptfilename || $debug ) {
 	emit 'return 0';
 	pop_indent;
@@ -792,10 +788,6 @@ sub compiler {
     #
     process_rules( $convert );
     #
-    # Process the conntrack file
-    #
-    setup_conntrack;
-    #
     # Add Tunnel rules.
     #
     setup_tunnels;
@@ -820,16 +812,16 @@ sub compiler {
 
 	optimize_level0;
 
-	if ( ( my $optimize = $config{OPTIMIZE} ) & 0x1E ) {
+	if ( $config{OPTIMIZE} & 0x1E ) {
 	    progress_message2 'Optimizing Ruleset...';
 	    #
 	    # Optimize Policy Chains
 	    #
-	    optimize_policy_chains if ( $optimize & OPTIMIZE_POLICY_MASK2n4 ) == OPTIMIZE_POLICY_MASK; # Level 2 but not 4
+	    optimize_policy_chains if $config{OPTIMIZE} & 2;
 	    #
 	    # More Optimization
 	    #
-	    optimize_ruleset if $config{OPTIMIZE} & OPTIMIZE_RULESET_MASK;
+	    optimize_ruleset if $config{OPTIMIZE} & 0x1C;
 	}
 
 	enable_script;
@@ -885,16 +877,16 @@ sub compiler {
 
 	    optimize_level0;
 
-	    if ( ( my $optimize = $config{OPTIMIZE} & OPTIMIZE_MASK ) ) {
+	    if ( $config{OPTIMIZE} & OPTIMIZE_MASK ) {
 		progress_message2 'Optimizing Ruleset...';
 		#
 		# Optimize Policy Chains
 		#
-		optimize_policy_chains if ( $optimize & OPTIMIZE_POLICY_MASK2n4 ) == OPTIMIZE_POLICY_MASK; # Level 2 but not 4
+		optimize_policy_chains if $config{OPTIMIZE} & OPTIMIZE_POLICY_MASK;
 		#
 		# Ruleset Optimization
 		#
-		optimize_ruleset if $optimize & OPTIMIZE_RULESET_MASK;
+		optimize_ruleset if $config{OPTIMIZE} & OPTIMIZE_RULESET_MASK;
 	    }
 
 	    enable_script if $debug;

Shorewall/Perl/Shorewall/IPAddrs.pm

@@ -26,7 +26,7 @@
 #
 package Shorewall::IPAddrs;
 require Exporter;
-use Shorewall::Config qw( :DEFAULT split_list require_capability in_hex8 numeric_value F_IPV4 F_IPV6 :protocols );
+use Shorewall::Config qw( :DEFAULT split_list require_capability in_hex8 numeric_value F_IPV4 F_IPV6 );
 use Socket;
 
 use strict;
@@ -48,6 +48,14 @@ our @EXPORT = qw( ALLIPv4
 		  ALLIP
 		  NILIP
 		  ALL
+		  TCP
+		  UDP
+		  UDPLITE
+		  ICMP
+		  DCCP
+		  IPv6_ICMP
+		  SCTP
+		  GRE
 
 		  validate_address
 		  validate_net
@@ -107,7 +115,14 @@ use constant { ALLIPv4             => '0.0.0.0/0' ,
 	       IPv6_LINK_ALLRTRS   => 'ff01::2' ,
 	       IPv6_SITE_ALLNODES  => 'ff02::1' ,
 	       IPv6_SITE_ALLRTRS   => 'ff02::2' ,
-	   };
+	       ICMP                => 1,
+	       TCP                 => 6,
+	       UDP                 => 17,
+	       DCCP                => 33,
+	       GRE                 => 47,
+	       IPv6_ICMP           => 58,
+	       SCTP                => 132,
+	       UDPLITE             => 136 };
 
 my @rfc1918_networks = ( "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16" );
 

Shorewall/Perl/Shorewall/Misc.pm

@@ -151,7 +151,7 @@ sub setup_ecn()
 
 	while ( read_a_line( NORMAL_READ ) ) {
 
-	    my ($interface, $hosts ) = split_line1 'ecn file entry', { interface => 0, host => 1, hosts => 1 }, {}, 2;
+	    my ($interface, $hosts ) = split_line 'ecn file entry', { interface => 0, hosts => 1 };
 
 	    fatal_error 'INTERFACE must be specified' if $interface eq '-';
 	    fatal_error "Unknown interface ($interface)" unless known_interface $interface;
@@ -681,7 +681,7 @@ sub add_common_rules ( $ ) {
     my $chain;
     my $dynamicref;
 
-    my @state     = $config{BLACKLISTNEWONLY} ? have_capability( 'RAW_TABLE' ) ? state_imatch 'NEW,INVALID,UNTRACKED' : state_imatch 'NEW,INVALID' : ();
+    my @state     = $config{BLACKLISTNEWONLY} ? $globals{UNTRACKED} ? state_imatch 'NEW,INVALID,UNTRACKED' : state_imatch 'NEW,INVALID' : ();
     my $faststate = $config{RELATED_DISPOSITION} eq 'ACCEPT' && $config{RELATED_LOG_LEVEL} eq '' ? 'ESTABLISHED,RELATED' : 'ESTABLISHED';
     my $level     = $config{BLACKLIST_LOGLEVEL};
     my $rejectref = $filter_table->{reject};
@@ -749,7 +749,7 @@ sub add_common_rules ( $ ) {
 
 	my $interfaceref = find_interface $interface;
 
-	unless ( $interfaceref->{options}{ignore} & NO_SFILTER || $interfaceref->{options}{rpfilter} ) {
+	unless ( $interfaceref->{options}{ignore} ) {
 
 	    my @filters = @{$interfaceref->{filter}};
 
@@ -787,38 +787,6 @@ sub add_common_rules ( $ ) {
 	}
     }
 
-    $list = find_interfaces_by_option('rpfilter');
-
-    if ( @$list ) {
-	$policy   = $config{RPFILTER_DISPOSITION};
-	$level    = $config{RPFILTER_LOG_LEVEL};
-	$audit    = $policy =~ s/^A_//;
-	
-	if ( $level || $audit ) {
-	    #
-	    # Create a chain to log and/or audit and apply the policy
-	    #
-	    $chainref = ensure_mangle_chain 'rplog';
-
-	    log_rule $level , $chainref , $policy , '' if $level ne '';
-
-	    add_ijump( $chainref, j => 'AUDIT', targetopts => '--type ' . lc $policy ) if $audit;
-
-	    add_ijump $chainref, g => $policy eq 'REJECT' ? 'reject' : $policy;
-
-	    $target = 'rplog';
-	} else {
-	    $target = $policy eq 'REJECT' ? 'reject' : $policy;
-	}
-
-	add_ijump( ensure_mangle_chain( 'rpfilter' ),
-		   j        => $target,
-		   rpfilter => '--validmark --invert',
-		   state_imatch 'NEW,RELATED,INVALID',
-		   @ipsec
-		 );
-    }
-	    
     run_user_exit1 'initdone';
 
     if ( $upgrade ) {
@@ -882,7 +850,7 @@ sub add_common_rules ( $ ) {
 	    add_ijump( $chainref, g => $smurfdest, s => IPv6_MULTICAST );
 	}
 
-	my @state = have_capability( 'RAW_TABLE' ) ? state_imatch 'NEW,INVALID,UNTRACKED' : state_imatch 'NEW,INVALID';
+	my @state = $globals{UNTRACKED} ? state_imatch 'NEW,INVALID,UNTRACKED' : state_imatch 'NEW,INVALID';
 
 	for my $hostref  ( @$list ) {
 	    $interface     = $hostref->[0];
@@ -1187,7 +1155,7 @@ sub setup_mac_lists( $ ) {
 	    my @policy     = have_ipsec ? ( policy => "--pol $ipsec --dir in" ) : ();
 	    my @source     = imatch_source_net $hostref->[2];
 
-	    my @state = have_capability( 'RAW_TABLE' ) ? state_imatch 'NEW,UNTRACKED' : state_imatch 'NEW';
+	    my @state = $globals{UNTRACKED} ? state_imatch 'NEW,UNTRACKED' : state_imatch 'NEW';
 
 	    if ( $table eq 'filter' ) {
 		my $chainref = source_exclusion( $hostref->[3], $filter_table->{mac_chain $interface} );
@@ -1342,22 +1310,15 @@ sub generate_source_rules( $$$;@ ) {
 sub handle_loopback_traffic() {
     my @zones   = ( vserver_zones, firewall_zone );
     my $natout  = $nat_table->{OUTPUT};
-    my $rawout  = $raw_table->{OUTPUT};
     my $rulenum = 0;
 
     my $outchainref;
     my @rule;
 
     if ( @zones > 1 ) {
-	#
-	# We have a vserver zone -- route output through a separate chain
-	#
 	$outchainref = new_standard_chain 'loopback';
 	add_ijump $filter_table->{OUTPUT}, j => $outchainref, o => 'lo';
     } else {
-	#
-	# Only the firewall -- just use the OUTPUT chain
-	#
 	$outchainref = $filter_table->{OUTPUT};
 	@rule = ( o => 'lo');
     }
@@ -1366,48 +1327,20 @@ sub handle_loopback_traffic() {
 	my $z1ref            = find_zone( $z1 );
 	my $type1            = $z1ref->{type};
 	my $natref           = $nat_table->{dnat_chain $z1};
-	my $notrackref       = $raw_table->{notrack_chain( $z1 )};
+
-	#
-	# Add jumps in the 'output' chain to the rules chains
-	#
 	if ( $type1 == FIREWALL ) {
 	    for my $z2 ( @zones ) {
 		my $chain = rules_target( $z1, $z2 );
 
 		generate_dest_rules( $outchainref, $chain, $z2, @rule ) if $chain;
 	    }
-	    #
-	    # Handle conntrack 
-	    #
-	    if ( $notrackref ) {
-		add_ijump $rawout, j => $notrackref if $notrackref->{referenced};
-	    }
 	} else {
 	    for my $z2 ( @zones ) {
 		generate_source_rules( $outchainref, $z1, $z2, @rule );
 	    }
-	    #
-	    # Handle conntrack rules
-	    #
-	    if ( $notrackref->{referenced} ) {
-		for my $hostref ( @{defined_zone( $z1 )->{hosts}{ip}{'%vserver%'}} ) {
-		    my $exclusion   = source_exclusion( $hostref->{exclusions}, $notrackref);
-		    my @ipsec_match = match_ipsec_in $z1 , $hostref;
-
-		    for my $net ( @{$hostref->{hosts}} ) {
-			add_ijump( $rawout,
-				   j => $exclusion ,
-				   imatch_source_net $net,
-				   @ipsec_match );
-		    }
-		}
-	    }
 	}
 
 	if ( $natref && $natref->{referenced} ) {
-	    #
-	    # There are DNAT rules with this zone as the source --  add jumps from the nat OUTPUT chain
-	    #
 	    my $source_hosts_ref = defined_zone( $z1 )->{hosts};
 
 	    for my $typeref ( values %{$source_hosts_ref} ) {
@@ -1435,7 +1368,6 @@ sub add_interface_jumps {
     our %forward_jump_added;
     my  $lo_jump_added = 0;
     my @interfaces = grep $_ ne '%vserver%', @_;
-    my $dummy;
     #
     # Add Nat jumps
     #
@@ -1457,8 +1389,6 @@ sub add_interface_jumps {
 	    insert_ijump ( $raw_table->{PREROUTING},      j => prerouting_chain( $interface ),  0, imatch_source_dev( $interface) ) if $raw_table->{prerouting_chain $interface};
 	    insert_ijump ( $raw_table->{OUTPUT},          j => output_chain( $interface ),      0, imatch_dest_dev( $interface) )   if $raw_table->{output_chain $interface};
 	}
-
-	add_ijump( $mangle_table->{PREROUTING}, j => 'rpfilter' , imatch_source_dev( $interface ) ) if interface_has_option( $interface, 'rpfilter', $dummy );
     }
     #
     # Add the jumps to the interface chains from filter FORWARD, INPUT, OUTPUT
@@ -1513,16 +1443,46 @@ sub add_interface_jumps {
     handle_loopback_traffic;
 }
 
+# Generate the rules matrix.
 #
-# Do the initial matrix processing for a complex zone
+# Stealing a comment from the Burroughs B6700 MCP Operating System source, "generate_matrix makes a sow's ear out of a silk purse".
 #
-sub handle_complex_zone( $$ ) {
+# The biggest disadvantage of the zone-policy-rule model used by Shorewall is that it doesn't scale well as the number of zones increases (Order N**2 where N = number of zones).
-    my ( $zone, $zoneref ) = @_;
+# A major goal of the rewrite of the compiler in Perl was to restrict those scaling effects to this function and the rules that it generates.
+#
+# The function traverses the full "source-zone by destination-zone" matrix and generates the rules necessary to direct traffic through the right set of filter-table and
+# nat-table rules.
+#
+sub generate_matrix() {
+    my @interfaces = ( all_interfaces );
+    #
+    # Should this be the real PREROUTING chain?
+    #
+    my $preroutingref = ensure_chain 'nat', 'dnat';
 
-    our %input_jump_added;
+    my $fw       = firewall_zone;
-    our %output_jump_added;
+    my @zones    = off_firewall_zones;
-    our %forward_jump_added;
+    my @vservers = vserver_zones;
-    our %ipsec_jump_added;
+
+    my $notrackref = $raw_table->{notrack_chain $fw};
+    my @state = $config{BLACKLISTNEWONLY} ? $globals{UNTRACKED} ? state_imatch 'NEW,INVALID,UNTRACKED' : state_imatch 'NEW,INVALID' : ();
+    my $interface_jumps_added = 0;
+
+    our %input_jump_added   = ();
+    our %output_jump_added  = ();
+    our %forward_jump_added = ();
+    my  %ipsec_jump_added   = ();
+
+    progress_message2 'Generating Rule Matrix...';
+    progress_message  '  Handling complex zones...';
+
+    #
+    # Special processing for configurations with more than 2 off-firewall zones or with other special considerations like IPSEC.
+    #
+    for my $zone ( @zones ) {
+	my $zoneref = find_zone( $zone );
+
+	next if  @zones <= 2 && ! $zoneref->{complex};
 	#
 	# Complex zone or we have more than two off-firewall zones -- Shorewall::Rules::classic_blacklist created a zone forwarding chain
 	#
@@ -1536,7 +1496,7 @@ sub handle_complex_zone( $$ ) {
 
 	if ( have_ipsec ) {
 	    #
-	# In general, policy match can only match an 'in' or an 'out' policy (but not both), so we place the
+	    # Prior to KLUDGEFREE, policy match could only match an 'in' or an 'out' policy (but not both), so we place the
 	    # '--pol ipsec --dir in' rules at the front of the (interface) forwarding chains. Otherwise, decrypted packets
 	    # can match '--pol none --dir out' rules and send the packets down the wrong rules chain.
 	    #
@@ -1549,40 +1509,25 @@ sub handle_complex_zone( $$ ) {
 		my $interfaceref = find_interface $interface;
 
 		if ( use_forward_chain( $interface, $sourcechainref ) ) {
-		#
-		# Use the interface forward chain
-		#
 		    if ( $interfaceref->{ports} && $interfaceref->{options}{bridge} ) {
-		    #
-		    # This is a bridge with ports
-		    #
 			@interfacematch = imatch_source_dev $interface;
-		    #
-		    # Copy the rules from the interface forward chain to the zone forward chain unless they have already been copied
-		    #
 			copy_rules( $sourcechainref, $frwd_ref, 1 ) unless $ipsec_jump_added{$zone}++;
-		    #
-		    # Jump directly from FORWARD to the zone forward chain
-		    #
 			$sourcechainref = $filter_table->{FORWARD};
 		    } elsif ( $interfaceref->{options}{port} ) {
 			#
-		    # The forwarding chain for a bridge with ports is always used -- use physdev match for this interface
+			# The forwarding chain for a bridge with ports is always used
 			#
 			add_ijump( $filter_table->{ forward_chain $interfaceref->{bridge} } ,
 				   j => $sourcechainref ,
 				   imatch_source_dev( $interface , 1 ) )
 			    unless $forward_jump_added{$interface}++;
 		    } else {
-		    #
-		    # Add jump from FORWARD to the intrface forward chain
-		    #
 			add_ijump $filter_table->{FORWARD} , j => $sourcechainref, imatch_source_dev( $interface ) unless $forward_jump_added{$interface}++;
 		    }
 		} else {
 		    if ( $interfaceref->{options}{port} ) {
 			#
-		    # The forwarding chain for a bridge with ports is always used -- use physdev match
+			# The forwarding chain for a bridge with ports is always used
 			#
 			$sourcechainref = $filter_table->{ forward_chain $interfaceref->{bridge} };
 			@interfacematch = imatch_source_dev $interface, 1;
@@ -1590,16 +1535,12 @@ sub handle_complex_zone( $$ ) {
 			$sourcechainref = $filter_table->{FORWARD};
 			@interfacematch = imatch_source_dev $interface;
 		    }
-		#
+
-		# copy any rules from the interface forward chain to the zone forward chain
-		#
 		    move_rules( $filter_table->{forward_chain $interface} , $frwd_ref );
 		}
 
 		my $arrayref = $source_ref->{$interface};
-	    #
+
-	    # Now add the jumps from the source chain (interface forward or FORWARD) to the zone forward chain
-	    #
 		for my $hostref ( @{$arrayref} ) {
 		    my @ipsec_match = match_ipsec_in $zone , $hostref;
 		    for my $net ( @{$hostref->{hosts}} ) {
@@ -1614,24 +1555,41 @@ sub handle_complex_zone( $$ ) {
 		}
 	    }
 	}
-}
+    }
 
-#
-# The passed zone is a sub-zone. We need to determine if
-#
-#   a) A parent zone defines DNAT/REDIRECT or notrack rules; and
-#   b) The current zone has a CONTINUE policy to some other zone.
-#
-# If a) but not b), then we must avoid sending packets from this
-# zone through the DNAT/REDIRECT or notrack chain for the parent.
-# 
-sub handle_nested_zone( $$ ) {
-    my ( $zone, $zoneref ) = @_;
     #
-    # Function returns this 3-tuple
+    # NOTRACK from firewall
     #
-    my ( $nested, $parenthasnat, $parenthasnotrack ) = ( 1, 0, 0 );
+    add_ijump $raw_table->{OUTPUT}, j => $notrackref if $notrackref->{referenced};
+    #
+    # Main source-zone matrix-generation loop
+    #
+    progress_message '  Entering main matrix-generation loop...';
 
+    for my $zone ( @zones ) {
+	my $zoneref          = find_zone( $zone );
+	my $source_hosts_ref = $zoneref->{hosts};
+	my $chain1           = rules_target firewall_zone , $zone;
+	my $chain2           = rules_target $zone, firewall_zone;
+	my $type             = $zoneref->{type};
+	my $frwd_ref         = $filter_table->{zone_forward_chain $zone};
+	my $chain            = 0;
+	my $dnatref          = ensure_chain 'nat' , dnat_chain( $zone );
+	my $notrackref       = ensure_chain 'raw' , notrack_chain( $zone );
+	my $nested           = @{$zoneref->{parents}};
+	my $parenthasnat     = 0;
+	my $parenthasnotrack = 0;
+
+	if ( $nested ) {
+	    #
+	    # This is a sub-zone. We need to determine if
+	    #
+	    #   a) A parent zone defines DNAT/REDIRECT or notrack rules; and
+	    #   b) The current zone has a CONTINUE policy to some other zone.
+	    #
+	    # If a) but not b), then we must avoid sending packets from this
+	    # zone through the DNAT/REDIRECT or notrack chain for the parent.
+	    #
 	    for my $parent ( @{$zoneref->{parents}} ) {
 		my $ref1 = $nat_table->{dnat_chain $parent} || {};
 		my $ref2 = $raw_table->{notrack_chain $parent} || {};
@@ -1657,102 +1615,78 @@ sub handle_nested_zone( $$ ) {
 		#
 		$nested = 0;
 	    }
+	}
+	#
+	# Take care of PREROUTING, INPUT and OUTPUT jumps
+	#
+	for my $typeref ( values %$source_hosts_ref ) {
+	    for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$typeref ) {
+		my $arrayref = $typeref->{$interface};
+		my $interfaceref = find_interface $interface;
+		my $isport = $interfaceref->{options}{port};
+		my $bridge = $interfaceref->{bridge};
 
-    ( $nested, $parenthasnat, $parenthasnotrack );
+		if ( get_physical( $interface ) eq '+' ) {
-}
+		    #
+		    # Insert the interface-specific jumps before this one which is not interface-specific
+		    #
+		    add_interface_jumps(@interfaces) unless $interface_jumps_added++;
+		}
 
-#
+		for my $hostref ( @$arrayref ) {
-# Add output jump to the passed zone:interface:hostref:net
+		    my @ipsec_in_match  = match_ipsec_in  $zone , $hostref;
-#
+		    my @ipsec_out_match = match_ipsec_out $zone , $hostref;
-sub add_output_jumps( $$$$$$$ ) {
+		    my $exclusions = $hostref->{exclusions};
-    my ( $zone, $interface, $hostref, $net, $exclusions, $isport, $bridge, ) = @_;
 
-    our @vservers;
+		    for my $net ( @{$hostref->{hosts}} ) {
-    our %output_jump_added;
+			my @dest   = imatch_dest_net $net;
 
-    my $chain1            = rules_target firewall_zone , $zone;
+			if ( $chain1 && ! ( zone_type( $zone) & BPORT ) ) {
 			    my $chain1ref = $filter_table->{$chain1};
 			    my $nextchain = dest_exclusion( $exclusions, $chain1 );
 			    my $outputref;
 			    my $interfacechainref = $filter_table->{output_chain $interface};
 			    my @interfacematch;
 			    my $use_output = 0;
-    my @dest              = imatch_dest_net $net;
-    my @ipsec_out_match   = match_ipsec_out $zone , $hostref;
 
 			    if ( @vservers || use_output_chain( $interface, $interfacechainref ) || ( @{$interfacechainref->{rules}} && ! $chain1ref ) ) {
-	#
-	# - There are vserver zones (so OUTPUT will have multiple source; or
-	# - We must use the interface output chain; or
-	# - There are rules in the interface chain and none in the rules chain
-	#
-	#   In any of these cases use the inteface output chain
-	#
 				$outputref = $interfacechainref;
 
 				if ( $isport ) {
-	    #
-	    # It is a bridge port zone -- use the bridges output chain and match the physdev
-	    #
 				    add_ijump( $filter_table->{ output_chain $bridge },
 					       j => $outputref ,
 					       imatch_dest_dev( $interface, 1 ) )
 					unless $output_jump_added{$interface}++;
 				} else {
-	    #
-	    # Not a bridge -- match the input interface
-	    #
 				    add_ijump $filter_table->{OUTPUT}, j => $outputref, imatch_dest_dev( $interface ) unless $output_jump_added{$interface}++;
 				}
 
 				$use_output = 1;
 
 				unless ( lc $net eq IPv6_LINKLOCAL ) {
-	    #
+				    for my $vzone ( vserver_zones ) {
-	    # Generate output rules for the vservers
-	    #
-	    for my $vzone ( @vservers ) {
 					generate_source_rules ( $outputref, $vzone, $zone, @dest );
 				    }
 				}
 			    } elsif ( $isport ) {
-	#
-	# It is a bridge port zone -- use the bridges output chain and match the physdev
-	#
 				$outputref = $filter_table->{ output_chain $bridge };
 				@interfacematch = imatch_dest_dev $interface, 1;
 			    } else {
-	#
-	# Just put the jump in the OUTPUT chain
-	#
 				$outputref = $filter_table->{OUTPUT};
 				@interfacematch = imatch_dest_dev $interface;
 			    }
-    #
+
-    #  Add the jump
-    # 
 			    add_ijump $outputref , j => $nextchain, @interfacematch, @dest, @ipsec_out_match;
-    #
+
-    #  Add jump for broadcast
-    #
 			    add_ijump( $outputref , j => $nextchain, @interfacematch, d => '255.255.255.255' , @ipsec_out_match )
 				if $family == F_IPV4 && $hostref->{options}{broadcast};
-    #
+
-    # Move the rules from the interface output chain if we didn't use it
-    #
 			    move_rules( $interfacechainref , $chain1ref ) unless $use_output;
-}
+			}
 
-#
+			clearrule;
-# Add prerouting jumps from the passed zone:interface:hostref:net
-#
-sub add_prerouting_jumps( $$$$$$$$ ) {
-    my ( $zone, $interface, $hostref, $net, $exclusions, $nested, $parenthasnat, $parenthasnotrack ) = @_;
 
-    my $dnatref         = $nat_table->{dnat_chain( $zone )};
+			next if $hostref->{options}{destonly};
-    my $preroutingref   = $nat_table->{PREROUTING};
-    my $notrackref      = ensure_chain 'raw' , notrack_chain( $zone );
-    my @ipsec_in_match  = match_ipsec_in  $zone , $hostref;
 
 			my @source = imatch_source_net $net;
 
@@ -1767,6 +1701,13 @@ sub add_prerouting_jumps( $$$$$$$$ ) {
 				       @source,
 				       @ipsec_in_match );
 
+			    if ( get_physical( $interface ) eq '+' ) {
+				#
+				# The jump from the PREROUTING chain to dnat may not have been added above
+				#
+				addnatjump 'PREROUTING', 'dnat' unless $preroutingref->{references}{PREROUTING};
+			    }
+
 			    check_optimization( $dnatref ) if @source;
 			}
 
@@ -1777,6 +1718,7 @@ sub add_prerouting_jumps( $$$$$$$$ ) {
 			    #
 			    add_ijump $raw_table->{PREROUTING}, j => source_exclusion( $exclusions, $notrackref), imatch_source_dev( $interface), @source, @ipsec_in_match;
 			}
+
 			#
 			# If this zone has parents with DNAT/REDIRECT or notrack rules and there are no CONTINUE polcies with this zone as the source
 			# then add a RETURN jump for this source network.
@@ -1785,157 +1727,90 @@ sub add_prerouting_jumps( $$$$$$$$ ) {
 			    add_ijump $preroutingref,           j => 'RETURN', imatch_source_dev( $interface), @source, @ipsec_in_match if $parenthasnat;
 			    add_ijump $raw_table->{PREROUTING}, j => 'RETURN', imatch_source_dev( $interface), @source, @ipsec_in_match if $parenthasnotrack;
 			}
-}
 
-#
-# Add input jump from the passed zone:interface:hostref:net
-#
-sub add_input_jumps( $$$$$$$$ ) {
-    my ( $zone, $interface, $hostref, $net, $exclusions, $frwd_ref, $isport, $bridge ) = @_;
-
-    our @vservers;
-    our %input_jump_added;
-
-    my $chain2            = rules_target $zone, firewall_zone;
 			my $chain2ref = $filter_table->{$chain2};
 			my $inputchainref;
 			my $interfacechainref = $filter_table->{input_chain $interface};
 			my @interfacematch;
 			my $use_input;
-    my @source            = imatch_source_net $net;
-    my @ipsec_in_match    = match_ipsec_in  $zone , $hostref;
 
 			if ( @vservers || use_input_chain( $interface, $interfacechainref ) || ! $chain2 || ( @{$interfacechainref->{rules}} && ! $chain2ref ) ) {
-	#
-	# - There are vserver zones (so INPUT will have multiple destinations; or
-	# - We must use the interface input chain; or
-	# - The zone->firewall policy is CONTINUE; or
-	# - There are rules in the interface chain and none in the rules chain
-	#
-	#   In any of these cases use the inteface input chain
-	#
 			    $inputchainref = $interfacechainref;
 
 			    if ( $isport ) {
-	    #
-	    # It is a bridge port zone -- use the bridges input chain and match the physdev
-	    #
 				add_ijump( $filter_table->{ input_chain $bridge },
 					   j => $inputchainref ,
 					   imatch_source_dev($interface, 1) )
 				    unless $input_jump_added{$interface}++;
 			    } else {
-	    #
-	    # Not a bridge -- match the input interface
-	    #
 				add_ijump $filter_table->{INPUT}, j => $inputchainref, imatch_source_dev($interface) unless $input_jump_added{$interface}++;
 			    }
 
 			    $use_input = 1;
 
 			    unless ( lc $net eq IPv6_LINKLOCAL ) {
-	    #
-	    # Generate input rules for the vservers
-	    #
 				for my $vzone ( @vservers ) {
 				    my $target = rules_target( $zone, $vzone );
 				    generate_dest_rules( $inputchainref, $target, $vzone, @source, @ipsec_in_match ) if $target;
 				}
 			    }
 			} elsif ( $isport ) {
-	#
-	# It is a bridge port zone -- use the bridges input chain and match the physdev
-	#
 			    $inputchainref = $filter_table->{ input_chain $bridge };
 			    @interfacematch = imatch_source_dev $interface, 1;
 			} else {
-	#
-	# Just put the jump in the INPUT chain
-	#
 			    $inputchainref = $filter_table->{INPUT};
 			    @interfacematch = imatch_source_dev $interface;
 			}
 
 			if ( $chain2 ) {
-	#
-	# Add the jump from the input chain to the rules chain
-	#
 			    add_ijump $inputchainref, j => source_exclusion( $exclusions, $chain2 ), @interfacematch, @source, @ipsec_in_match;
 			    move_rules( $interfacechainref , $chain2ref ) unless $use_input;
 			}
-}
-
-#
-# This function is called when there is forwarding and this net isn't IPSEC protected. It adds the jump for this net to the zone forwarding chain.
-#
-sub add_forward_jump( $$$$$$$$ ) {
-    my ( $zone, $interface, $hostref, $net, $exclusions, $frwd_ref, $isport, $bridge ) = @_;
-
-    our %forward_jump_added;
-
-    my @source            = imatch_source_net $net;
-    my @ipsec_in_match    = match_ipsec_in  $zone , $hostref;
 
+			if ( $frwd_ref && $hostref->{ipsec} ne 'ipsec' ) {
 			    my $ref = source_exclusion( $exclusions, $frwd_ref );
 			    my $forwardref = $filter_table->{forward_chain $interface};
 
 			    if ( use_forward_chain $interface, $forwardref ) {
-	#
-	# We must use the interface forwarding chain -- add the jump from the interface forward chain to the zone forward chain.
-	#
 				add_ijump $forwardref , j => $ref, @source, @ipsec_in_match;
 
 				if ( $isport ) {
-	    #
-	    # It is a bridge port zone -- use the bridges input chain and match the physdev
-	    #
 				    add_ijump( $filter_table->{ forward_chain $bridge } ,
 					       j => $forwardref ,
 					       imatch_source_dev( $interface , 1 ) )
 					unless $forward_jump_added{$interface}++;
 				} else {
-	    #
-	    # Not a bridge -- match the input interface
-	    #
 				    add_ijump $filter_table->{FORWARD} , j => $forwardref, imatch_source_dev( $interface ) unless $forward_jump_added{$interface}++;
 				}
 			    } else {
 				if ( $isport ) {
-	    #
-	    # It is a bridge port zone -- use the bridges input chain and match the physdev
-	    #
 				    add_ijump( $filter_table->{ forward_chain $bridge } ,
 					       j => $ref ,
 					       imatch_source_dev( $interface, 1 ) ,
 					       @source,
 					       @ipsec_in_match );
 				} else {
-	    #
-	    # Not a bridge -- match the input interface
-	    #
 				    add_ijump $filter_table->{FORWARD} , j => $ref, imatch_source_dev( $interface ) , @source, @ipsec_in_match;
 				}
 
 				move_rules ( $forwardref , $frwd_ref );
 			    }
-}
+			}
+		    }
+		}
+	    }
+	}
 
-#
+	#
-# Generate the list of destination zones from the passed source zone when optimization level 1 is selected
+	#                           F O R W A R D I N G
-#
+	#
-# - Drop zones where the policy to that zone is 'NONE'
-# - Drop this zone if it has only one interface without 'routeback'
-# - Drop BPORT zones that are not on the same bridge
-# - Eliminate duplicate zones that have the same '2all' (-all) rules chain.
-#
-sub optimize1_zones( $$@ ) {
-    my $zone    = shift;
-    my $zoneref = shift;
-    my $last_chain = '';
 	my @dest_zones;
+	my $last_chain = '';
+
+	if ( $config{OPTIMIZE} & 1 ) {
 	    my @temp_zones;
 
-    for my $zone1 ( @_ )  {
+	    for my $zone1 ( @zones )  {
 		my $zone1ref = find_zone( $zone1 );
 		my $policy = $filter_table->{rules_chain( ${zone}, ${zone1} )}->{policy};
 
@@ -1975,131 +1850,12 @@ sub optimize1_zones( $$@ ) {
 		push @dest_zones, @temp_zones;
 		$last_chain = '';
 	    }
-
-    ( $last_chain, @dest_zones );
-}
-
-# Generate the rules matrix.
-#
-# Stealing a comment from the Burroughs B6700 MCP Operating System source, "generate_matrix makes a sow's ear out of a silk purse".
-#
-# The biggest disadvantage of the zone-policy-rule model used by Shorewall is that it doesn't scale well as the number of zones increases (Order N**2 where N = number of zones).
-# A major goal of the rewrite of the compiler in Perl was to restrict those scaling effects to this function and the rules that it generates.
-#
-# The function traverses the full "source-zone by destination-zone" matrix and generates the rules necessary to direct traffic through the right set of filter-table and
-# nat-table rules.
-#
-sub generate_matrix() {
-    my @interfaces = ( all_interfaces );
-    #
-    # Should this be the real PREROUTING chain?
-    #
-    my @zones     = off_firewall_zones;
-    our @vservers = vserver_zones;
-
-    my $interface_jumps_added = 0;
-
-    our %input_jump_added   = ();
-    our %output_jump_added  = ();
-    our %forward_jump_added = ();
-    our %ipsec_jump_added   = ();
-
-    progress_message2 'Generating Rule Matrix...';
-    progress_message  '  Handling complex zones...';
-    #
-    # Special processing for configurations with more than 2 off-firewall zones or with other special considerations like IPSEC.
-    # Don't be tempted to move this logic into the zone loop below -- it won't work.
-    #
-    for my $zone ( @zones ) {
-	my $zoneref = find_zone( $zone );
-	if ( @zones > 2 || $zoneref->{complex} ) {
-	    handle_complex_zone( $zone, $zoneref );
-	} else {
-	    new_standard_chain zone_forward_chain( $zone ) if @zones > 1;
-	}
-    }
-    #
-    # Main source-zone matrix-generation loop
-    #
-    progress_message '  Entering main matrix-generation loop...';
-
-    for my $zone ( @zones ) {
-	my $zoneref          = find_zone( $zone );
-	my $source_hosts_ref = $zoneref->{hosts};
-	my $frwd_ref         = $filter_table->{zone_forward_chain $zone};
-	my $nested           = @{$zoneref->{parents}};
-	my $parenthasnat     = 0;
-	my $parenthasnotrack = 0;
-	#
-	# Create the zone's dnat chain
-	#
-	ensure_chain 'nat', dnat_chain( $zone );
-
-	( $nested, $parenthasnat, $parenthasnotrack) = handle_nested_zone( $zone, $zoneref ) if $nested;
-	#
-	# Take care of PREROUTING, INPUT and OUTPUT jumps
-	#
-	for my $typeref ( values %$source_hosts_ref ) {
-	    for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$typeref ) {
-		if ( get_physical( $interface ) eq '+' ) {
-		    #
-		    # Insert the interface-specific jumps before this one which is not interface-specific
-		    #
-		    add_interface_jumps(@interfaces) unless $interface_jumps_added++;
-		}
-
-		my $interfaceref  = find_interface $interface;
-		my $isport        = $interfaceref->{options}{port};
-		my $bridge        = $interfaceref->{bridge};
-
-		for my $hostref ( @{$typeref->{$interface}} ) {
-		    my $exclusions = $hostref->{exclusions};
-
-		    for my $net ( @{$hostref->{hosts}} ) {
-			#
-			# OUTPUT
-			#
-			if ( rules_target( firewall_zone, $zone ) && ! ( zone_type( $zone) & BPORT ) ) {
-			    #
-			    # Policy from the firewall to this zone is not 'CONTINUE' and this isn't a bport zone
-			    #
-			    add_output_jumps( $zone, $interface, $hostref, $net, $exclusions, $isport, $bridge );
-			}
-
-			clearrule;
-
-			unless( $hostref->{options}{destonly} ) {
-			    #
-			    # PREROUTING
-			    #
-			    add_prerouting_jumps( $zone, $interface, $hostref, $net, $exclusions, $nested, $parenthasnat, $parenthasnotrack );
-			    #
-			    # INPUT
-			    #
-			    add_input_jumps( $zone, $interface, $hostref, $net, $exclusions, $frwd_ref, $isport, $bridge );
-			    #
-			    # FORWARDING Jump for non-IPSEC host group
-			    #
-			    add_forward_jump( $zone, $interface, $hostref, $net, $exclusions, $frwd_ref, $isport, $bridge ) if $frwd_ref && $hostref->{ipsec} ne 'ipsec';
-			}
-		    } # Subnet Loop
-		} # Hostref Loop
-	    } # Interface Loop
-	} #Type Loop
-
-	if ( $frwd_ref ) {
-	    #
-	    #                                            F O R W A R D I N G
-	    #
-	    my @dest_zones;
-	    my $last_chain = '';
-
-	    if ( $config{OPTIMIZE} & 1 ) {
-		( $last_chain , @dest_zones ) = optimize1_zones($zone, $zoneref, @zones );
 	} else {
 	    @dest_zones =  @zones ;
 	}
 	#
+	# Here it is -- THE BIG UGLY!!!!!!!!!!!!
+	#
 	# We now loop through the destination zones creating jumps to the rules chain for each source/dest combination.
 	# @dest_zones is the list of destination zones that we need to handle from this source zone
 	#
@@ -2124,6 +1880,10 @@ sub generate_matrix() {
 
 	    my $chainref = $filter_table->{$chain}; #Will be null if $chain is a Netfilter Built-in target like ACCEPT
 
+	    if ( $frwd_ref ) {
+		#
+		# Simple case -- the source zone has it's own forwarding chain
+		#
 		for my $typeref ( values %{$zone1ref->{hosts}} ) {
 		    for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$typeref ) {
 			for my $hostref ( @{$typeref->{$interface}} ) {
@@ -2138,6 +1898,81 @@ sub generate_matrix() {
 			}
 		    }
 		}
+	    } else {
+		#
+		# More compilcated case. If the interface is associated with a single simple zone, we try to combine the interface's forwarding chain with the rules chain
+		#
+		for my $typeref ( values %$source_hosts_ref ) {
+		    for my $interface ( keys %$typeref ) {
+			my $interfaceref = find_interface $interface;
+			my $chain3ref;
+			my @match_source_dev;
+			my $forwardchainref = $filter_table->{forward_chain $interface};
+
+			if ( use_forward_chain( $interface , $forwardchainref ) || ( @{$forwardchainref->{rules} } && ! $chainref ) ) {
+			    #
+			    # Either we must use the interface's forwarding chain or that chain has rules and we have nowhere to move them
+			    #
+			    $chain3ref = $forwardchainref;
+
+			    if ( $interfaceref->{options}{port} ) {
+				add_ijump( $filter_table->{ forward_chain $interfaceref->{bridge} } ,
+					   j => $chain3ref,
+					   imatch_source_dev( $interface , 1 ) )
+				    unless $forward_jump_added{$interface}++;
+			    } else {
+				add_ijump $filter_table->{FORWARD} , j => $chain3ref, imatch_source_dev( $interface ) unless $forward_jump_added{$interface}++;
+			    }
+			} else {
+			    #
+			    # Don't use the interface's forward chain -- move any rules in that chain to this rules chain
+			    #
+			    if ( $interfaceref->{options}{port} ) {
+				$chain3ref  = $filter_table->{ forward_chain $interfaceref->{bridge} };
+				@match_source_dev = imatch_source_dev $interface, 1;
+			    } else {
+				$chain3ref  = $filter_table->{FORWARD};
+				@match_source_dev = imatch_source_dev $interface;
+			    }
+
+			    move_rules $forwardchainref, $chainref;
+			}
+
+			for my $hostref ( @{$typeref->{$interface}} ) {
+			    next if $hostref->{options}{destonly};
+			    my $excl3ref = source_exclusion( $hostref->{exclusions}, $chain3ref );
+			    for my $net ( @{$hostref->{hosts}} ) {
+				for my $type1ref ( values %{$zone1ref->{hosts}} ) {
+				    for my $interface1 ( keys %$type1ref ) {
+					my $array1ref = $type1ref->{$interface1};
+					for my $host1ref ( @$array1ref ) {
+					    next if $host1ref->{options}{sourceonly};
+					    my @ipsec_out_match = match_ipsec_out $zone1 , $host1ref;
+					    my $dest_exclusion  = dest_exclusion( $host1ref->{exclusions}, $chain );
+					    for my $net1 ( @{$host1ref->{hosts}} ) {
+						unless ( $interface eq $interface1 && $net eq $net1 && ! $host1ref->{options}{routeback} ) {
+						    #
+						    # We defer evaluation of the source net match to accomodate systems without $capabilities{KLUDEFREE};
+						    #
+						    add_ijump(
+							      $excl3ref ,
+							      j => $dest_exclusion,
+							      @match_source_dev,
+							      imatch_dest_dev($interface1),
+							      imatch_source_net($net),
+							      imatch_dest_net($net1),
+							      @ipsec_out_match
+							     );
+						}
+					    }
+					}
+				    }
+				}
+			    }
+			}
+		    }
+		}
+	    }
 	}
 	#
 	#                                      E N D   F O R W A R D I N G
@@ -2145,8 +1980,7 @@ sub generate_matrix() {
 	# Now add an unconditional jump to the last unique policy-only chain determined above, if any
 	#
 	add_ijump $frwd_ref , g => $last_chain if $frwd_ref && $last_chain;
-	} # Forwarding required
+    }
-    } # Source Zone Loop
 
     progress_message '  Finishing matrix...';
 
@@ -2340,14 +2174,6 @@ EOF
     deletechain shorewall
 
     run_stop_exit
-
-    #
-    # Enable automatic helper association on kernel 3.5.0 and later
-    #
-    if [ -f /proc/sys/net/netfilter/nf_conntrack_helper ]; then
-        echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper
-    fi
-
 EOF
 
     if ( have_capability( 'NAT_ENABLED' ) ) {

Shorewall/Perl/Shorewall/Nat.pm

@@ -35,11 +35,7 @@ use strict;
 
 our @ISA = qw(Exporter);
 our @EXPORT = qw( setup_masq setup_nat setup_netmap add_addresses );
-our %EXPORT_TAGS = ( rules => [ qw ( handle_nat_rule handle_nonat_rule ) ] );
 our @EXPORT_OK = ();
-
-Exporter::export_ok_tags('rules');
-
 our $VERSION = 'MODULEVERSION';
 
 my @addresses_to_add;
@@ -58,8 +54,8 @@ sub initialize() {
 #
 sub process_one_masq( )
 {
-    my ($interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition, $origdest ) =
+    my ($interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition ) =
-	split_line1 'masq file', { interface => 0, source => 1, address => 2, proto => 3, port => 4, ipsec => 5, mark => 6, user => 7, switch => 8, origdest => 9 };
+	split_line1 'masq file', { interface => 0, source => 1, address => 2, proto => 3, port => 4, ipsec => 5, mark => 6, user => 7, switch => 8 };
 
     if ( $interfacelist eq 'COMMENT' ) {
 	process_comment;
@@ -237,7 +233,7 @@ sub process_one_masq( )
 		     $baserule . $rule ,
 		     $networks ,
 		     $destnets ,
-		     $origdest ,
+		     '' ,
 		     $target ,
 		     '' ,
 		     '' ,
@@ -518,227 +514,6 @@ sub setup_netmap() {
 
 }
 
-#
-# Called from process_rule1 to add a rule to the NAT table
-#
-sub handle_nat_rule( $$$$$$$$$$$$ ) {
-    my ( $dest,           # <server>[:port]
-	 $proto,          # Protocol
-	 $ports,          # Destination port list
-	 $origdest,       # Original Destination
-	 $action_target,  # If the target is an action, the name of the log action chain to jump to
-	 $action,         # The Action
-	 $sourceref,      # Reference to the Source Zone's table entry in the Zones module
-	 $action_chain,   # Name of the action chain if the rule is in an action
-	 $rule,           # Matches 
-	 $source,         # Source Address
-	 $loglevel,       # [<level>[:<tag>]]
-	 $log_action,     # Action name to include in the log message
-       ) = @_;
-
-    my ( $server, $serverport , $origdstports ) = ( '', '', '' );
-    my $randomize = $dest =~ s/:random$// ? ' --random' : '';
-
-    #
-    # Isolate server port
-    #
-    if ( $dest =~ /^(.*)(?::(.+))$/ ) {
-	#
-	# Server IP and Port
-	#
-	$server = $1;      # May be empty
-	$serverport = $2;  # Not Empty due to RE
-
-	$origdstports = validate_port( $proto, $ports )	if $ports && $ports ne '-' && port_count( $ports ) == 1;
-
-	if ( $serverport =~ /^(\d+)-(\d+)$/ ) {
-	    #
-	    # Server Port Range
-	    #
-	    fatal_error "Invalid port range ($serverport)" unless $1 < $2;
-	    my @ports = ( $1, $2 );
-	    $_ = validate_port( proto_name( $proto ), $_) for ( @ports );
-	    ( $ports = $serverport ) =~ tr/-/:/;
-	} else {
-	    $serverport = $ports = validate_port( proto_name( $proto ), $serverport );
-	}
-    } elsif ( $dest ne ':' ) {
-	#
-	# Simple server IP address (may be empty or "-")
-	#
-	$server = $dest;
-    }
-    #
-    # Generate the target
-    #
-    my $target = '';
-
-    if ( $action eq 'REDIRECT' ) {
-	fatal_error "A server IP address ($server) may not be specified in a REDIRECT rule" if $server;
-	$target  = 'REDIRECT';
-	$target .= " --to-port $serverport" if $serverport;
-	if ( $origdest eq '' || $origdest eq '-' ) {
-	    $origdest = ALLIP;
-	} elsif ( $origdest eq 'detect' ) {
-	    fatal_error 'ORIGINAL DEST "detect" is invalid in an action' if $action_chain;
-
-	    if ( $config{DETECT_DNAT_IPADDRS} ) {
-		my $interfacesref = $sourceref->{interfaces};
-		my @interfaces = keys %$interfacesref;
-		$origdest = @interfaces ? "detect:@interfaces" : ALLIP;
-	    } else {
-		$origdest = ALLIP;
-	    }
-	}
-    } elsif ( $action_target ) {
-	fatal_error "A server port ($serverport) is not allowed in $action rule" if $serverport;
-	$target = $action_target;
-    } else {
-	if ( $server eq '' ) {
-	    fatal_error "A server and/or port must be specified in the DEST column in $action rules" unless $serverport;
-	} elsif ( $server =~ /^(.+)-(.+)$/ ) {
-	    validate_range( $1, $2 );
-	} else {
-	    unless ( $server eq ALLIP ) {
-		my @servers = validate_address $server, 1;
-		$server = join ',', @servers;
-	    }
-	}
-
-	if ( $action eq 'DNAT' ) {
-	    $target = $action;
-	    if ( $server ) {
-		$serverport = ":$serverport" if $serverport;
-		for my $serv ( split /,/, $server ) {
-		    $target .= " --to-destination ${serv}${serverport}";
-		}
-	    } else {
-		$target .= " --to-destination :$serverport";
-	    }
-	}
-
-	unless ( $origdest && $origdest ne '-' && $origdest ne 'detect' ) {
-	    if ( ! $action_chain && $config{DETECT_DNAT_IPADDRS} ) {
-		my $interfacesref = $sourceref->{interfaces};
-		my @interfaces = keys %$interfacesref;
-		$origdest = @interfaces ? "detect:@interfaces" : ALLIP;
-	    } else {
-		$origdest = ALLIP;
-	    }
-	}
-    }
-
-    $target .= $randomize;
-    #
-    # And generate the nat table rule(s)
-    #
-    my $firewallsource = $sourceref && ( $sourceref->{type} & ( FIREWALL | VSERVER ) );
-
-    expand_rule ( ensure_chain ('nat' ,
-				( $action_chain   ? $action_chain :
-				  $firewallsource ? 'OUTPUT' :
-				  dnat_chain $sourceref->{name} ) ) ,
-		  $firewallsource ? OUTPUT_RESTRICT : PREROUTE_RESTRICT ,
-		  $rule ,
-		  $source ,
-		  $origdest ,
-		  '' ,
-		  $target ,
-		  $loglevel ,
-		  $log_action ,
-		  $serverport ? do_proto( $proto, '', '' ) : '',
-		);
-
-    ( $ports, $origdstports, $server );
-}
-
-#
-# Called from process_rule1() to handle the nat table part of the NONAT and ACCEPT+ actions
-#
-sub handle_nonat_rule( $$$$$$$$$$ ) {
-    my ( $action, $source, $dest, $origdest, $sourceref, $inaction, $chain, $loglevel, $log_action, $rule ) = @_;
-
-    my $sourcezone = $sourceref->{name};
-    #
-    # NONAT or ACCEPT+ may not specify a destination interface
-    #
-    fatal_error "Invalid DEST ($dest) in $action rule" if $dest =~ /:/;
-
-    $origdest = '' unless $origdest and $origdest ne '-';
-
-    if ( $origdest eq 'detect' ) {
-	my $interfacesref = $sourceref->{interfaces};
-	my $interfaces = [ ( keys %$interfacesref ) ];
-	$origdest = $interfaces ? "detect:@$interfaces" : ALLIP;
-    }
-
-    my $tgt = 'RETURN';
-
-    my $nonat_chain;
-
-    my $chn;
-
-    if ( $inaction ) {
-	$nonat_chain = ensure_chain( 'nat', $chain );
-    } elsif ( $sourceref->{type} == FIREWALL ) {
-	$nonat_chain = $nat_table->{OUTPUT};
-    } else {
-	$nonat_chain = ensure_chain( 'nat', dnat_chain( $sourcezone ) );
-
-	my @interfaces = keys %{zone_interfaces $sourcezone};
-
-	for ( @interfaces ) {
-	    my $ichain = input_chain $_;
-
-	    if ( $nat_table->{$ichain} ) {
-		#
-		# Static NAT is defined on this interface
-		#
-		$chn = new_chain( 'nat', newnonatchain ) unless $chn;
-		add_ijump $chn, j => $nat_table->{$ichain}, @interfaces > 1 ? imatch_source_dev( $_ )  : ();
-	    }
-	}
-
-	if ( $chn ) {
-	    #
-	    # Call expand_rule() to correctly handle logging. Because
-	    # the 'logname' argument is passed, expand_rule() will
-	    # not create a separate logging chain but will rather emit
-	    # any logging rule in-line.
-	    #
-	    expand_rule( $chn,
-			 PREROUTE_RESTRICT,
-			 '', # Rule
-			 '', # Source
-			 '', # Dest
-			 '', # Original dest
-			 'ACCEPT',
-			 $loglevel,
-			 $log_action,
-			 '',
-			 dnat_chain( $sourcezone  ) );
-	    $loglevel = '';
-	    $tgt = $chn->{name};
-	} else {
-	    $tgt = 'ACCEPT';
-	}
-    }
-
-    set_optflags( $nonat_chain, DONT_MOVE | DONT_OPTIMIZE ) if $tgt eq 'RETURN';
-
-    expand_rule( $nonat_chain ,
-		 PREROUTE_RESTRICT ,
-		 $rule ,
-		 $source ,
-		 $dest ,
-		 $origdest ,
-		 $tgt,
-		 $loglevel ,
-		 $log_action ,
-		 '',
-	       );
-}
-
 sub add_addresses () {
     if ( @addresses_to_add ) {
 	my @addrs = @addresses_to_add;

Shorewall/Perl/Shorewall/Providers.pm

@@ -39,9 +39,7 @@ our @EXPORT = qw( process_providers
 		  @routemarked_interfaces
 		  handle_stickiness
 		  handle_optional_interfaces
-		  compile_updown
 		  setup_load_distribution
-		  have_providers
 	       );
 our @EXPORT_OK = qw( initialize lookup_provider );
 our $VERSION = '4.4_24';
@@ -62,11 +60,9 @@ my  @load_interfaces;
 
 my $balancing;
 my $fallback;
-my $metrics;
 my $first_default_route;
 my $first_fallback_route;
 my $maxload;
-my $tproxies;
 
 my %providers;
 
@@ -99,11 +95,9 @@ sub initialize( $ ) {
     @load_interfaces        = ();
     $balancing              = 0;
     $fallback               = 0;
-    $metrics                = 0;
     $first_default_route    = 1;
     $first_fallback_route   = 1;
     $maxload                = 0;
-    $tproxies               = 0;
 
     %providers  = ( local   => { number => LOCAL_TABLE   , mark => 0 , optional => 0 ,routes => [], rules => [] } ,
 		    main    => { number => MAIN_TABLE    , mark => 0 , optional => 0 ,routes => [], rules => [] } ,
@@ -121,7 +115,7 @@ sub setup_route_marking() {
 
     require_capability( $_ , q(The provider 'track' option) , 's' ) for qw/CONNMARK_MATCH CONNMARK/;
 
-    add_ijump $mangle_table->{$_} , j => 'CONNMARK', targetopts => "--restore-mark --mask $mask" for qw/PREROUTING OUTPUT/;
+    add_ijump $mangle_table->{$_} , j => 'CONNMARK', targetopts => "--restore-mark --mask $mask", connmark => "! --mark 0/$mask" for qw/PREROUTING OUTPUT/;
 
     my $chainref  = new_chain 'mangle', 'routemark';
 
@@ -402,8 +396,8 @@ sub process_a_provider() {
 	$gateway = '';
     }
 
-    my ( $loose, $track,                   $balance , $default, $default_balance,                $optional,                           $mtu, $tproxy , $local, $load ) =
+    my ( $loose, $track,                   $balance , $default, $default_balance,                $optional,                           $mtu, $local , $load ) =
-	(0,      $config{TRACK_PROVIDERS}, 0 ,        0,        $config{USE_DEFAULT_RT} ? 1 : 0, interface_is_optional( $interface ), ''  , 0       , 0,      0 );
+	(0,      $config{TRACK_PROVIDERS}, 0 ,        0,        $config{USE_DEFAULT_RT} ? 1 : 0, interface_is_optional( $interface ), ''  , 0      , 0 );
 
     unless ( $options eq '-' ) {
 	for my $option ( split_list $options, 'option' ) {
@@ -441,12 +435,7 @@ sub process_a_provider() {
 		$default = -1;
 		$default_balance = 0;
 	    } elsif ( $option eq 'local' ) {
-		warning_message q(The 'local' provider option is deprecated in favor of 'tproxy');
+		$local = 1;
-		$local = $tproxy = 1;
-		$track  = 0           if $config{TRACK_PROVIDERS};
-		$default_balance = 0  if $config{USE_DEFAULT_RT};
-	    } elsif ( $option eq 'tproxy' ) {
-		$tproxy = 1;
 		$track = 0           if $config{TRACK_PROVIDERS};
 		$default_balance = 0 if $config{USE_DEFAULT_RT};
 	    } elsif ( $option =~ /^load=(0?\.\d{1,8})/ ) {
@@ -470,13 +459,7 @@ sub process_a_provider() {
 	fatal_error "GATEWAY not valid with 'local' provider" unless $gatewaycase eq 'none';
 	fatal_error "'track' not valid with 'local'"          if $track;
 	fatal_error "DUPLICATE not valid with 'local'"        if $duplicate ne '-';
-    } elsif ( $tproxy ) {
+	fatal_error "MARK required with 'local'"              unless $mark;
-	fatal_error "Only one 'tproxy' provider is allowed"    if $tproxies++;
-	fatal_error "GATEWAY not valid with 'tproxy' provider" unless $gatewaycase eq 'none';
-	fatal_error "'track' not valid with 'tproxy'"          if $track;
-	fatal_error "DUPLICATE not valid with 'tproxy'"        if $duplicate ne '-';
-	fatal_error "MARK not allowed with 'tproxy'"           if $mark ne '-';
-	$mark = $globals{TPROXY_MARK};
     }
 
     my $val = 0;
@@ -488,10 +471,6 @@ sub process_a_provider() {
 
 	require_capability( 'MANGLE_ENABLED' , 'Provider marks' , '' );
 
-	if ( $tproxy && ! $local ) {
-	    $val = $globals{TPROXY_MARK};
-	    $pref = 1;
-	} else {
 	$val = numeric_value $mark;
 
 	fatal_error "Invalid Mark Value ($mark)" unless defined $val && $val;
@@ -506,10 +485,9 @@ sub process_a_provider() {
 	    fatal_error "Duplicate mark value ($mark)" if numeric_value( $providerref->{mark} ) == $val;
 	}
 
-	    $lastmark = $val;
-	    
 	$pref = 10000 + $number - 1;
-	}
+
+	$lastmark = $val;
 
     }
 
@@ -549,7 +527,6 @@ sub process_a_provider() {
 			   duplicate   => $duplicate ,
 			   address     => $address ,
 			   local       => $local ,
-			   tproxy      => $tproxy ,
 			   load        => $load ,
 			   rules       => [] ,
 			   routes      => [] ,
@@ -602,7 +579,6 @@ sub add_a_provider( $$ ) {
     my $duplicate   = $providerref->{duplicate};
     my $address     = $providerref->{address};
     my $local       = $providerref->{local};
-    my $tproxy      = $providerref->{tproxy};
     my $load        = $providerref->{load};
 
     my $dev         = chain_base $physical;
@@ -624,7 +600,7 @@ sub add_a_provider( $$ ) {
 	$provider_interfaces{$interface} = $table;
 
 	if ( $gatewaycase eq 'none' ) {
-	    if ( $tproxy ) {
+	    if ( $local ) {
 		emit 'run_ip route add local ' . ALLIP . " dev $physical table $number";
 	    } else {
 		emit "run_ip route add default dev $physical table $number";
@@ -657,7 +633,7 @@ CEOF
 
     if ( $mark ne '-' ) {
 	my $hexmark = in_hex( $mark );
-	my $mask = have_capability 'FWMARK_RT_MASK' ? '/' . in_hex( $globals{ $tproxy && ! $local ? 'TPROXY_MARK' : 'PROVIDER_MASK' } ) : '';
+	my $mask = have_capability 'FWMARK_RT_MASK' ? '/' . in_hex $globals{PROVIDER_MASK} : '';
 
 	emit ( "qt \$IP -$family rule del fwmark ${hexmark}${mask}" ) if $config{DELETE_THEN_ADD};
 
@@ -702,20 +678,19 @@ CEOF
 	emit '';
 	if ( $gateway ) {
 	    if ( $family == F_IPV4 ) {
-		emit qq(run_ip route replace $gateway/32 dev $physical table ) . DEFAULT_TABLE;
+		emit qq(run_ip route replace $gateway dev $physical table ) . DEFAULT_TABLE;
 		emit qq(run_ip route replace default via $gateway src $address dev $physical table ) . DEFAULT_TABLE . qq( metric $number);
 	    } else {
 		emit qq(qt \$IP -6 route del default via $gateway src $address dev $physical table ) . DEFAULT_TABLE . qq( metric $number);
 		emit qq(run_ip route add default via $gateway src $address dev $physical table ) . DEFAULT_TABLE . qq( metric $number);
 	    }
 	    emit qq(echo "qt \$IP -$family route del default via $gateway table ) . DEFAULT_TABLE . qq(" >> \${VARDIR}/undo_${table}_routing);
-	    emit qq(echo "qt \$IP -4  route del $gateway/32 dev $physical table ) . DEFAULT_TABLE . qq(" >> \${VARDIR}/undo_${table}_routing) if $family == F_IPV4;
 	} else {
 	    emit qq(run_ip route add default table ) . DEFAULT_TABLE . qq( dev $physical metric $number);
 	    emit qq(echo "qt \$IP -$family route del default dev $physical table ) . DEFAULT_TABLE . qq(" >> \${VARDIR}/undo_${table}_routing);
 	}
 
-	$metrics = 1;
+	$fallback = 1;
     }
 
     emit( qq(\n) ,
@@ -723,7 +698,7 @@ CEOF
 	  qq(    qt \$IP -6 rule add from all table ) . DEFAULT_TABLE . qq( prio 32767\n) ,
 	  qq(fi) ) if $family == F_IPV6;
 
-    unless ( $tproxy ) {
+    unless ( $local ) {
 	emit '';
 
 	if ( $loose ) {
@@ -787,7 +762,7 @@ CEOF
 		if ( $gateway ) {
 		    emit qq(add_gateway "via $gateway dev $physical $realm" ) . $tbl;
 		} else {
-		    emit qq(add_gateway "dev $physical $realm" ) . $tbl;
+		    emit qq(add_gateway "nexthop dev $physical $realm" ) . $tbl;
 		}
 	    }
 	    	} else {
@@ -889,8 +864,7 @@ CEOF
 		  "qt \$TC qdisc del dev $physical ingress\n" ) if $tcdevices->{$interface};
 	}
 
-	emit( "echo 1 > \${VARDIR}/${physical}.status",
+	emit( "progress_message2 \"   Provider $table ($number) stopped\"" );
-	      "progress_message2 \"   Provider $table ($number) stopped\"" );
 
 	pop_indent;
 
@@ -1053,8 +1027,8 @@ sub setup_null_routing() {
     emit "> \${VARDIR}/undo_rfc1918_routing\n";
     for ( rfc1918_networks ) {
 	emit( qq(if ! \$IP -4 route ls | grep -q '^$_.* dev '; then),
-	      qq(    run_ip route replace blackhole $_),
+	      qq(    run_ip route replace unreachable $_),
-	      qq(    echo "qt \$IP -4 route del blackhole $_" >> \${VARDIR}/undo_rfc1918_routing),
+	      qq(    echo "qt \$IP -4 route del unreachable $_" >> \${VARDIR}/undo_rfc1918_routing),
 	      qq(fi\n) );
     }
 }
@@ -1143,10 +1117,6 @@ sub finish_providers() {
 	       '# We don\'t have any \'balance\' providers so we restore any default route that we\'ve saved',
 	       '#',
 	       "restore_default_route $config{USE_DEFAULT_RT}" ,
-	       '#',
-	       '# And delete any routes in the \'balance\' table',
-	       '#',
-	       "qt \$IP -$family route del default table " . BALANCE_TABLE,
 	       '' );
     }
 
@@ -1160,17 +1130,10 @@ sub finish_providers() {
 	}
 
 	emit( "    progress_message \"Fallback route '\$(echo \$FALLBACK_ROUTE | sed 's/\$\\s*//')' Added\"",
-	      'else',
-	      '    #',
-	      '    # We don\'t have any \'fallback\' providers so we delete any default routes in the default table',
-	      '    #',
-	      '    delete_default_routes ' . DEFAULT_TABLE,
 	      'fi',
 	      '' );
     } elsif ( $config{USE_DEFAULT_RT} ) {
-	emit( 'delete_default_routes ' . DEFAULT_TABLE,
+	emit "qt \$IP -$family route del default table " . DEFAULT_TABLE;
-	      ''
-	    );
     }
 
     unless ( $config{KEEP_RT_TABLES} ) {
@@ -1208,13 +1171,11 @@ sub process_providers( $ ) {
     }
 
     if ( $providers ) {
-	fatal_error q(Either all 'fallback' providers must specify a weight or non of them can specify a weight) if $fallback && $metrics;
-
 	my $fn = open_file( 'route_rules' );
 
 	if ( $fn ){
 	    if ( -f ( my $fn1 = find_file 'rtrules' ) ) {
-		warning_message "Both $fn and $fn1 exist: $fn1 will be ignored";
+		warning_message "Both $fn and $fn1 exists: $fn1 will be ignored";
 	    }
 	} else {
 	    $fn = open_file( 'rtrules' );
@@ -1281,7 +1242,6 @@ EOF
             startup_error "$g_interface is not an optional provider or provider interface"
             ;;
     esac
-
 }
 
 #
@@ -1322,10 +1282,6 @@ EOF
 
 }
 
-sub have_providers() {
-    return our $providers;
-}
-
 sub setup_providers() {
     our $providers;
 
@@ -1371,228 +1327,6 @@ sub setup_providers() {
 
 }
 
-#
-# Emit the updown() function
-#
-sub compile_updown() {
-    emit( '',
-	  '#',
-	  '# Handle the "up" and "down" commands',
-	  '#',
-	  'updown() # $1 = interface',
-	  '{',
-	);
-
-    push_indent;
-
-    emit( 'local state',
-	  'state=cleared',
-	  ''
-	);
-
-    emit 'progress_message3 "$g_product $COMMAND triggered by $1"';
-    emit '';
-
-    if ( $family == F_IPV4 ) {
-	emit 'if shorewall_is_started; then';
-    } else {
-	emit 'if shorewall6_is_started; then';
-    }
-
-    emit( '    state=started',
-	  'elif [ -f ${VARDIR}/state ]; then',
-	  '    case "$(cat ${VARDIR}/state)" in',
-	  '        Stopped*)',
-	  '            state=stopped',
-	  '            ;;',
-	  '        Cleared*)',
-	  '            ;;',
-	  '        *)',
-	  '            state=unknown',
-	  '            ;;',
-	  '    esac',
-	  'else',
-	  '    state=unknown',
-	  'fi',
-	  ''
-	);
-
-    emit( 'case $1 in' );
-
-    push_indent;
-
-    my $ignore   = find_interfaces_by_option 'ignore', 1;
-    my $required = find_interfaces_by_option 'required';
-    my $optional = find_interfaces_by_option 'optional';
-
-    if ( @$ignore ) {
-	my $interfaces = join '|', map get_physical( $_ ), @$ignore;
-
-	$interfaces =~ s/\+/*/g;
-
-	emit( "$interfaces)",
-	      '    progress_message3 "$COMMAND on interface $1 ignored"',
-	      '    exit 0',
-	      '    ;;'
-	    );
-    }
-
-    my @nonshared = ( grep $providers{$_}->{optional},
-		      sort( { $providers{$a}->{number} <=> $providers{$b}->{number} } values %provider_interfaces ) );
-
-    if ( @nonshared ) {
-	my $interfaces = join( '|', map $providers{$_}->{physical}, @nonshared );
-
-	emit "$interfaces)";
-
-	push_indent;
-
-	emit( q(if [ "$state" = started ]; then) ,
-	      q(    if [ "$COMMAND" = up ]; then) , 
-	      q(        progress_message3 "Attempting enable on interface $1") ,
-	      q(        COMMAND=enable) ,
-	      q(        detect_configuration),        
-	      q(        enable_provider $1),
-	      q(    elif [ "$PHASE" != post-down ]; then # pre-down or not Debian) ,
-	      q(        progress_message3 "Attempting disable on interface $1") ,
-	      q(        COMMAND=disable) ,
-	      q(        detect_configuration),        
-	      q(        disable_provider $1) ,
-	      q(    fi) ,
-	      q(elif [ "$COMMAND" = up ]; then) ,
-	      q(    echo 0 > ${VARDIR}/${1}.status) ,
-	      q(    COMMAND=start),
-	      q(    progress_message3 "$g_product attempting start") ,
-	      q(    detect_configuration),
-	      q(    define_firewall),
-	      q(else),
-	      q(    progress_message3 "$COMMAND on interface $1 ignored") ,
-	      q(fi) ,
-	      q(;;) );
-
-	pop_indent;
-    }
-
-    if ( @$required ) {
-	my $interfaces = join '|', map get_physical( $_ ), @$required;
-
-	my $wildcard = ( $interfaces =~ s/\+/*/g );
-
-	emit( "$interfaces)",
-	      '    if [ "$COMMAND" = up ]; then' );
-
-	if ( $wildcard ) {
-	    emit( '        if [ "$state" = started ]; then',
-		  '            COMMAND=restart',
-		  '        else',
-		  '            COMMAND=start',
-		  '        fi' );
-	} else {
-	    emit( '        COMMAND=start' );
-	}
-
-	emit( '        progress_message3 "$g_product attempting $COMMAND"',
-	      '        detect_configuration',
-	      '        define_firewall',
-	      '    elif [ "$PHASE" != pre-down ]; then # Not Debian pre-down phase'
-	    );
-
-	push_indent;
-
-	if ( $wildcard ) {
-
-	    emit( '    if [ "$state" = started ]; then',
-		  '        progress_message3 "$g_product attempting restart"',
-		  '        COMMAND=restart',
-		  '        detect_configuration',
-		  '        define_firewall',
-		  '    fi' );
-
-	} else {
-	    emit( '    COMMAND=stop',
-		  '    progress_message3 "$g_product attempting stop"',
-		  '    detect_configuration',
-		  '    stop_firewall' );
-	}
-
-	pop_indent;
-
-	emit( '    fi',
-	      '    ;;'
-	    );
-    }
-
-    if ( @$optional ) {
-	my @interfaces = map( get_physical( $_ ), grep( ! $provider_interfaces{$_} , @$optional ) );
-	my $interfaces = join '|', @interfaces;
-
-	if ( $interfaces ) {
-	    if ( $interfaces =~ s/\+/*/g || @interfaces > 1 ) {
-		emit( "$interfaces)",
-		      '    if [ "$COMMAND" = up ]; then',
-		      '        echo 0 > ${VARDIR}/${1}.state',
-		      '    else',
-		      '        echo 1 > ${VARDIR}/${1}.state',
-		      '    fi' );
-	    } else {
-		emit( "$interfaces)",
-		      '    if [ "$COMMAND" = up ]; then',
-		      "        echo 0 > \${VARDIR}/$interfaces.state",
-		      '    else',
-		      "        echo 1 > \${VARDIR}/$interfaces.state",
-		      '    fi' );
-	    }
-
-	    emit( '',
-		  '    if [ "$state" = started ]; then',
-		  '        COMMAND=restart',
-		  '        progress_message3 "$g_product attempting restart"',
-		  '        detect_configuration',
-		  '        define_firewall',
-		  '    elif [ "$state" = stopped ]; then',
-		  '        COMMAND=start',
-		  '        progress_message3 "$g_product attempting start"',
-		  '        detect_configuration',
-		  '        define_firewall',
-		  '    else',
-		  '        progress_message3 "$COMMAND on interface $1 ignored"',
-		  '    fi',
-		  '    ;;',
-		);
-	}
-    }
-
-    if ( my @plain_interfaces = all_plain_interfaces ) {			
-	my $interfaces = join ( '|', @plain_interfaces );
-
-	$interfaces =~ s/\+/*/g;
-	
-	emit( "$interfaces)",
-	      '    case $state in',
-	      '        started)',
-	      '            COMMAND=restart',
-	      '            progress_message3 "$g_product attempting restart"',
-	      '            detect_configuration',
-	      '            define_firewall',
-	      '            ;;',
-	      '        *)',
-	      '            progress_message3 "$COMMAND on interface $1 ignored"',
-	      '            ;;',
-	      '    esac',
-	    );
-    }
-
-    pop_indent;
-
-    emit( 'esac' );
-
-    pop_indent;
-
-    emit( '}',
-	  '',
-	);
-}
-
 sub lookup_provider( $ ) {
     my $provider    = $_[0];
     my $providerref = $providers{ $provider };

Shorewall/Perl/Shorewall/Raw.pm

@@ -20,7 +20,7 @@
 #       along with this program; if not, write to the Free Software
 #       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-#   This module contains the code that handles the /etc/shorewall/conntrack file.
+#   This module contains the code that handles the /etc/shorewall/notrack file.
 #
 package Shorewall::Raw;
 require Exporter;
@@ -32,8 +32,8 @@ use Shorewall::Chains qw(:DEFAULT :internal);
 use strict;
 
 our @ISA = qw(Exporter);
-our @EXPORT = qw( setup_conntrack );
+our @EXPORT = qw( setup_notrack );
-our @EXPORT_OK = qw( handle_helper_rule );
+our @EXPORT_OK = qw( );
 our $VERSION = 'MODULEVERSION';
 
 my %valid_ctevent = ( new => 1, related => 1, destroy => 1, reply => 1, assured => 1, protoinfo => 1, helper => 1, mark => 1, natseqinfo => 1, secmark => 1 );
@@ -41,89 +41,54 @@ my %valid_ctevent = ( new => 1, related => 1, destroy => 1, reply => 1, assured
 #
 # Notrack
 #
-sub process_conntrack_rule( $$$$$$$$$ ) {
+sub process_notrack_rule( $$$$$$$ ) {
 
-    my ($chainref, $zoneref, $action, $source, $dest, $proto, $ports, $sports, $user ) = @_;
+    my ($action, $source, $dest, $proto, $ports, $sports, $user ) = @_;
-
-    require_capability 'RAW_TABLE', 'conntrack rules', '';
 
     $proto  = ''    if $proto  eq 'any';
     $ports  = ''    if $ports  eq 'any' || $ports  eq 'all';
     $sports = ''    if $sports eq 'any' || $sports eq 'all';
 
-    my $zone;
+    ( my $zone, $source) = split /:/, $source, 2;
-    my $restriction = PREROUTE_RESTRICT;
+    my $zoneref  = find_zone $zone;
+    my $chainref = ensure_raw_chain( notrack_chain $zone );
+    my $restriction = $zoneref->{type} == FIREWALL || $zoneref->{type} == VSERVER ? OUTPUT_RESTRICT : PREROUTE_RESTRICT;
 
-    unless ( $chainref ) {
-	#
-	# Entry in the conntrack file
-	#
-	if ( $zoneref ) {
-	    $zone = $zoneref->{name};
-	} else {
-	    ($zone, $source) = split /:/, $source, 2;
-	    $zoneref = find_zone ( $zone );
-	}
-
-	$chainref = ensure_raw_chain( notrack_chain $zone );
-	$restriction = OUTPUT_RESTRICT if $zoneref->{type} == FIREWALL || $zoneref->{type} == VSERVER;
     fatal_error 'USER/GROUP is not allowed unless the SOURCE zone is $FW or a Vserver zone' if $user ne '-' && $restriction != OUTPUT_RESTRICT;
-    }
+    require_capability 'RAW_TABLE', 'Notrack rules', '';
 
     my $target = $action;
     my $exception_rule = '';
     my $rule = do_proto( $proto, $ports, $sports ) . do_user ( $user );
 
-    if ( $action eq 'NOTRACK' ) {
+    unless ( $action eq 'NOTRACK' ) {
-	#
-	# A patch that deimplements the NOTRACK target has been posted on the
-	# Netfilter development list
-	#
-	$action = 'CT --notrack' if have_capability 'CT_TARGET';
-    } else {
 	(  $target, my ( $option, $args, $junk ) ) = split ':', $action, 4;
 
 	fatal_error "Invalid notrack ACTION ( $action )" if $junk || $target ne 'CT';
 
-	require_capability 'CT_TARGET', 'CT entries in the conntrack file', '';
+	require_capability 'CT_TARGET', 'CT entries in the notrack file', '';
 
 	if ( $option eq 'notrack' ) {
-	    fatal_error "Invalid conntrack ACTION ( $action )" if supplied $args;
+	    fatal_error "Invalid notrack ACTION ( $action )" if supplied $args;
 	    $action = 'CT --notrack';
 	} else {
 	    fatal_error "Invalid or missing CT option and arguments" unless supplied $option && supplied $args;
 
 	    if ( $option eq 'helper' ) {
-		my $modifiers = '';
-
-		if ( $args =~ /^([-\w.]+)\((.+)\)$/ ) {
-		    $args      = $1;
-		    $modifiers = $2;
-		}
-
 		fatal_error "Invalid helper' ($args)" if $args =~ /,/;
 		validate_helper( $args, $proto );
-		$action = "CT --helper $helpers_aliases{$args}";
+		$action = "CT --helper $args";
 		$exception_rule = do_proto( $proto, '-', '-' );
-
+	    } elsif ( $option eq 'ctevents' ) {
-		for my $mod ( split_list1( $modifiers, 'ctevents' ) ) {
+		for ( split ',', $args ) {
-		    fatal_error "Invalid helper option ($mod)" unless $mod =~ /^(\w+)=(.+)$/;
-		    $mod    = $1;
-		    my $val = $2;
-		    
-		    if ( $mod eq 'ctevents' ) {
-			for ( split_list( $val, 'ctevents' ) ) {
 		    fatal_error "Invalid 'ctevents' event ($_)" unless $valid_ctevent{$_};
 		}
 
-			$action .= " --ctevents $val";
+		$action = "CT --ctevents $args";
-		    } elsif ( $mod eq 'expevents' ) {
+	    } elsif ( $option eq 'expevent' ) {
-			fatal_error "Invalid expevent argument ($val)" unless $val eq 'new';
+		fatal_error "Invalid expevent argument ($args)" unless $args eq 'new';
-			$action .= ' --expevents new';
+	    } elsif ( $option eq 'zone' ) {
-		    } else {
+		fatal_error "Invalid zone id ($args)" unless $args =~ /^\d+$/;
-			fatal_error "Invalid helper option ($mod)";
-		    }
-		}
 	    } else {
 		fatal_error "Invalid CT option ($option)";
 	    }
@@ -141,60 +106,9 @@ sub process_conntrack_rule( $$$$$$$$$ ) {
 		 $target ,
 		 $exception_rule );
 
-    progress_message "  Conntrack rule \"$currentline\" $done";
+    progress_message "  Notrack rule \"$currentline\" $done";
-}
 
-sub handle_helper_rule( $$$$$$$$$$$ ) {
+    $globals{UNTRACKED} = 1;
-    my ( $helper, $source, $dest, $proto, $ports, $sports, $sourceref, $action_target, $actionchain, $user, $rule ) = @_;
-
-    if ( $helper ne '-' ) {
-	fatal_error "A HELPER is not allowed with this ACTION" if $action_target;
-	#
-	# This means that an ACCEPT or NAT rule with a helper is being processed
-	#
-	process_conntrack_rule( $actionchain ? ensure_raw_chain( $actionchain ) : undef ,
-				$sourceref ,
-				"CT:helper:$helper",
-				$source ,
-				$dest ,
-				$proto ,
-				$ports ,
-				$sports ,
-				$user );
-    } else {
-	assert( $action_target );
-	#
-	# The target is an action
-	#
-	if ( $actionchain ) {
-	    #
-	    # And the source is another action chain
-	    #
-	    expand_rule( ensure_raw_chain( $actionchain ) ,
-			 PREROUTE_RESTRICT ,
-			 $rule ,
-			 $source ,
-			 $dest ,
-			 '' ,
-			 $action_target ,
-			 '',
-			 'CT' ,
-			 '' );
-	} else {
-	    expand_rule( ensure_raw_chain( notrack_chain( $sourceref->{name} ) ) ,
-			 ( $sourceref->{type} == FIREWALL || $sourceref->{type} == VSERVER ?
-			   OUTPUT_RESTRICT :
-			   PREROUTE_RESTRICT ) ,
-			 $rule ,
-			 $source ,
-			 $dest ,
-			 '' ,
-			 $action_target ,
-			 '' ,
-			 'CT' ,
-			 '' );
-	}
-    }
 }
 
 sub process_format( $ ) {
@@ -205,72 +119,51 @@ sub process_format( $ ) {
     $format;
 }
 
-sub setup_conntrack() {
+sub setup_notrack() {
-
-    for my $name ( qw/notrack conntrack/ ) {
-
-	my $fn = open_file( $name );
-
-	if ( $fn ) {
 
     my $format = 1;
-
     my $action = 'NOTRACK';
 
-	    my $empty = 1;
+    if ( my $fn = open_file 'notrack' ) {
 
-	    first_entry( "$doing $fn..." );
+	first_entry "$doing $fn...";
+
+	my $nonEmpty = 0;
 
 	while ( read_a_line( NORMAL_READ ) ) {
 	    my ( $source, $dest, $proto, $ports, $sports, $user );
 
 	    if ( $format == 1 ) {
-		    ( $source, $dest, $proto, $ports, $sports, $user ) = split_line1 'Conntrack File', { source => 0, dest => 1, proto => 2, dport => 3, sport => 4, user => 5 };
+		( $source, $dest, $proto, $ports, $sports, $user ) = split_line1 'Notrack File', { source => 0, dest => 1, proto => 2, dport => 3, sport => 4, user => 5 };
 
 		if ( $source eq 'FORMAT' ) {
 		    $format = process_format( $dest );
 		    next;
 		}
+
+		if ( $source eq 'COMMENT' ) {
+		    process_comment;
+		    next;
+		}
 	    } else {
-		    ( $action, $source, $dest, $proto, $ports, $sports, $user ) = split_line1 'Conntrack File', { action => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6 }, { COMMENT => 0, FORMAT => 2 };
+		( $action, $source, $dest, $proto, $ports, $sports, $user ) = split_line1 'Notrack File', { action => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6 }, { COMMENT => 0, FORMAT => 2 };
 
 		if ( $action eq 'FORMAT' ) {
 		    $format = process_format( $source );
 		    $action = 'NOTRACK';
 		    next;
 		}
-		}
 
 		if ( $action eq 'COMMENT' ) {
 		    process_comment;
 		    next;
 		}
-
-		$empty = 0;
-
-		if ( $source eq 'all' ) {
-		    for my $zone (all_zones) {
-			process_conntrack_rule( undef, undef, $action, $zone, $dest, $proto, $ports, $sports, $user );
-		    }
-		} else {
-		    process_conntrack_rule( undef, undef, $action, $source, $dest, $proto, $ports, $sports, $user );
 	    }
+
+	    process_notrack_rule $action, $source, $dest, $proto, $ports, $sports, $user;
 	}
 
 	clear_comment;
-
-	    if ( $name eq 'notrack') {
-		if ( $empty ) {
-		    if ( unlink( $fn ) ) {
-			warning_message "Empty notrack file ($fn) removed";
-		    } else {
-			warning_message "Unable to remove empty notrack file ($fn): $!";
-		    }
-		} else {
-		    warning_message "Non-empty notrack file ($fn); please move its contents to the conntrack file";
-		}
-	    }
-	}
     }
 }
 

Shorewall/Perl/Shorewall/Rules.pm

@@ -33,8 +33,6 @@ use Shorewall::Config qw(:DEFAULT :internal);
 use Shorewall::Zones;
 use Shorewall::Chains qw(:DEFAULT :internal);
 use Shorewall::IPAddrs;
-use Shorewall::Nat qw(:rules);
-use Shorewall::Raw qw( handle_helper_rule );
 use Scalar::Util 'reftype';
 
 use strict;
@@ -92,9 +90,7 @@ my %rulecolumns = ( action    =>   0,
 		    connlimit =>  10,
 		    time      =>  11,
 		    headers   =>  12,
-		    switch    =>  13,
+		    switch    =>  13 );
-		    helper    =>  14,
-		  );
 
 use constant { MAX_MACRO_NEST_LEVEL => 5 };
 
@@ -1427,7 +1423,7 @@ sub process_actions() {
 
 }
 
-sub process_rule1 ( $$$$$$$$$$$$$$$$$$ );
+sub process_rule1 ( $$$$$$$$$$$$$$$$$ );
 
 #
 # Populate an action invocation chain. As new action tuples are encountered,
@@ -1460,14 +1456,14 @@ sub process_action( $) {
 
 	while ( read_a_line( NORMAL_READ ) ) {
 
-	    my ($target, $source, $dest, $proto, $ports, $sports, $origdest, $rate, $user, $mark, $connlimit, $time, $headers, $condition, $helper );
+	    my ($target, $source, $dest, $proto, $ports, $sports, $origdest, $rate, $user, $mark, $connlimit, $time, $headers, $condition );
 
 	    if ( $format == 1 ) {
 		($target, $source, $dest, $proto, $ports, $sports, $rate, $user, $mark ) =
 		    split_line1 'action file', { target => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, rate => 6, user => 7, mark => 8 }, $rule_commands;
-		$origdest = $connlimit = $time = $headers = $condition = $helper = '-';
+		$origdest = $connlimit = $time = $headers = $condition = '-';
 	    } else {
-		($target, $source, $dest, $proto, $ports, $sports, $origdest, $rate, $user, $mark, $connlimit, $time, $headers, $condition, $helper )
+		($target, $source, $dest, $proto, $ports, $sports, $origdest, $rate, $user, $mark, $connlimit, $time, $headers, $condition )
 		    = split_line1 'action file', \%rulecolumns, $action_commands;
 	    }
 
@@ -1505,7 +1501,6 @@ sub process_action( $) {
 			   $time,
 			   $headers,
 			   $condition,
-			   $helper,
 			   0 );
 	}
 
@@ -1535,8 +1530,8 @@ sub use_policy_action( $ ) {
 #
 # Expand a macro rule from the rules file
 #
-sub process_macro ( $$$$$$$$$$$$$$$$$$$) {
+sub process_macro ( $$$$$$$$$$$$$$$$$$ ) {
-    my ($macro, $chainref, $target, $param, $source, $dest, $proto, $ports, $sports, $origdest, $rate, $user, $mark, $connlimit, $time, $headers, $condition, $helper, $wildcard ) = @_;
+    my ($macro, $chainref, $target, $param, $source, $dest, $proto, $ports, $sports, $origdest, $rate, $user, $mark, $connlimit, $time, $headers, $condition, $wildcard ) = @_;
 
     my $nocomment = no_comment;
 
@@ -1554,13 +1549,13 @@ sub process_macro ( $$$$$$$$$$$$$$$$$$$) {
 
     while ( read_a_line( NORMAL_READ ) ) {
 
-	my ( $mtarget, $msource, $mdest, $mproto, $mports, $msports, $morigdest, $mrate, $muser, $mmark, $mconnlimit, $mtime, $mheaders, $mcondition, $mhelper);
+	my ( $mtarget, $msource, $mdest, $mproto, $mports, $msports, $morigdest, $mrate, $muser, $mmark, $mconnlimit, $mtime, $mheaders, $mcondition );
 
 	if ( $format == 1 ) {
 	    ( $mtarget, $msource, $mdest, $mproto, $mports, $msports, $mrate, $muser ) = split_line1 'macro file', \%rulecolumns, $rule_commands;
-	    ( $morigdest, $mmark, $mconnlimit, $mtime, $mheaders, $mcondition, $mhelper ) = qw/- - - - - - -/;
+	    ( $morigdest, $mmark, $mconnlimit, $mtime, $mheaders, $mcondition ) = qw/- - - - - -/;
 	} else {
-	    ( $mtarget, $msource, $mdest, $mproto, $mports, $msports, $morigdest, $mrate, $muser, $mmark, $mconnlimit, $mtime, $mheaders, $mcondition, $mhelper ) = split_line1 'macro file', \%rulecolumns, $rule_commands;
+	    ( $mtarget, $msource, $mdest, $mproto, $mports, $msports, $morigdest, $mrate, $muser, $mmark, $mconnlimit, $mtime, $mheaders, $mcondition ) = split_line1 'macro file', \%rulecolumns, $rule_commands;
 	}
 
 	fatal_error 'TARGET must be specified' if $mtarget eq '-';
@@ -1594,7 +1589,7 @@ sub process_macro ( $$$$$$$$$$$$$$$$$$$) {
 
 	my $actiontype = $targets{$action} || find_macro( $action );
 
-	fatal_error( "Invalid Action ($mtarget) in macro", $actiontype ) unless $actiontype & ( ACTION + STANDARD + NATRULE + MACRO + CHAIN );
+	fatal_error "Invalid Action ($mtarget) in macro" unless $actiontype & ( ACTION +  STANDARD + NATRULE + MACRO + CHAIN );
 
 	if ( $msource ) {
 	    if ( $msource eq '-' ) {
@@ -1639,7 +1634,6 @@ sub process_macro ( $$$$$$$$$$$$$$$$$$$) {
 				    merge_macro_column( $mtime,      $time ),
 				    merge_macro_column( $mheaders,   $headers ),
 				    merge_macro_column( $mcondition, $condition ),
-				    merge_macro_column( $mhelper,    $helper ),
 				    $wildcard
 				   );
 
@@ -1672,7 +1666,7 @@ sub verify_audit($;$$) {
 # Similarly, if a new action tuple is encountered, this function is called recursively for each rule in the action
 # body. In this latter case, a reference to the tuple's chain is passed in the first ($chainref) argument.
 #
-sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
+sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
     my ( $chainref,   #reference to Action Chain if we are being called from process_action(); undef otherwise
 	 $target,
 	 $current_param,
@@ -1689,13 +1683,12 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 	 $time,
 	 $headers,
 	 $condition,
-	 $helper,
 	 $wildcard ) = @_;
 
     my ( $action, $loglevel) = split_action $target;
     my ( $basictarget, $param ) = get_target_param $action;
     my $rule = '';
-    my $optimize = $wildcard ? ( $basictarget =~ /!$/ ? 0 : $config{OPTIMIZE} & 5 ) : 0;
+    my $optimize = $wildcard ? ( $basictarget =~ /!$/ ? 0 : $config{OPTIMIZE} & 1 ) : 0;
     my $inaction = '';
     my $normalized_target;
     my $normalized_action;
@@ -1741,7 +1734,6 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 				       $time,
 				       $headers,
 				       $condition,
-				       $helper,
 				       $wildcard );
 
 	$macro_nest_level--;
@@ -1765,7 +1757,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
     #
     # We can now dispense with the postfix character
     #
-    fatal_error "The +, - and ! modifiers are not allowed in the blrules file" if $action =~ s/[-+!]$// && $blacklist;
+    fatal_error "The +, - and ! modifiers are not allowed in the blrules file" if $action =~ s/[\+\-!]$// && $blacklist;
     #
     # Handle actions
     #
@@ -1783,13 +1775,12 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 	    #
 	    process_action( $ref );
 	    #
-	    # Processing the action may determine that the action or one of it's dependents does NAT or HELPER, so:
+	    # Processing the action may determine that the action or one of it's dependents does NAT, so:
 	    #
 	    #    - Refresh $actiontype
-	    #    - Create the associated nat and/or table chain if appropriate.
+	    #    - Create the associate nat table chain if appropriate.
 	    #
 	    ensure_chain( 'nat', $ref->{name} ) if ( $actiontype = $targets{$basictarget} ) & NATRULE;
-	    ensure_chain( 'raw', $ref->{name} ) if ( $actiontype & HELPER );
 	}
 
 	$action = $basictarget; # Remove params, if any, from $action.
@@ -1804,10 +1795,6 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 	$targets{$inaction} |= NATRULE if $inaction;
 	fatal_error "NAT rules are only allowed in the NEW section" unless $section eq 'NEW';
     }
-
-    if ( $actiontype & HELPER ) {
-	fatal_error "HELPER rules are only allowed in the NEW section" unless $section eq 'NEW';
-    }
     #
     # Take care of irregular syntax and targets
     #
@@ -1818,14 +1805,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 
 	$bt =~ s/[-+!]$//;
 
-	my %functions =
+	my %functions = ( ACCEPT => sub() { $action = 'RETURN' if $blacklist; } ,
-	    ( ACCEPT => sub() { 
-		  if ( $blacklist ) {
-		      $action = 'RETURN';
-		  } elsif ( $helper ne '-' ) {
-		      $actiontype |= HELPER if $section eq 'NEW';
-		  }
-	      } ,
 
 			  REDIRECT => sub () {
 			      my $z = $actiontype & NATONLY ? '' : firewall_zone;
@@ -1850,19 +1830,12 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 			  COUNT => sub { $action = ''; } ,
 
 			  LOG => sub { fatal_error 'LOG requires a log level' unless supplied $loglevel; } ,
-
-	      HELPER => sub { 
-		  fatal_error "HELPER requires require that the helper be specified in the HELPER column" if $helper eq '-';
-		  fatal_error "HELPER rules may only appear in the NEW section" unless $section eq 'NEW';
-		  $action = ''; } ,
 		     );
 
 	my $function = $functions{ $bt };
 
 	if ( $function ) {
 	    $function->();
-	} elsif ( $actiontype & NATRULE && $helper ne '-' ) {
-	    $actiontype |= HELPER;
 	} elsif ( $actiontype & SET ) {
 	    my %xlate = ( ADD => 'add-set' , DEL => 'del-set' );
 
@@ -1947,7 +1920,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
     #
     # Take care of chain
     #
-    my $chain;
+    my ( $chain, $policy );
 
     if ( $inaction ) {
         #
@@ -1971,7 +1944,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 	    # Ensure that the chain exists but don't mark it as referenced until after optimization is checked
 	    #
 	    $chainref = ensure_chain 'filter', $chain;
-	    my $policy = $chainref->{policy};
+	    $policy   = $chainref->{policy};
 
 	    if ( $policy eq 'NONE' ) {
 		return 0 if $wildcard;
@@ -1980,10 +1953,10 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 	    #
 	    # Handle Optimization
 	    #
-	    if ( $optimize == 1 && $section eq 'NEW' ) {
+	    if ( $optimize > 0 && $section eq 'NEW' ) {
 		my $loglevel = $filter_table->{$chainref->{policychain}}{loglevel};
 		if ( $loglevel ne '' ) {
-		    return 0 if $target eq "${policy}:${loglevel}";
+		    return 0 if $target eq "${policy}:$loglevel}";
 		} else {
 		    return 0 if $basictarget eq $policy;
 		}
@@ -2029,18 +2002,6 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 		      do_headers( $headers ) ,
 		      do_condition( $condition ) ,
 		    );
-    } elsif ( $section eq 'RELATED' ) {
-	$rule = join( '',
-		      do_proto($proto, $ports, $sports),
-		      do_ratelimit( $ratelimit, $basictarget ) ,
-		      do_user( $user ) ,
-		      do_test( $mark , $globals{TC_MASK} ) ,
-		      do_connlimit( $connlimit ),
-		      do_time( $time ) ,
-		      do_headers( $headers ) ,
-		      do_condition( $condition ) ,
-		      do_helper( $helper ) ,
-		    );
     } else {
 	$rule = join( '',
 		      do_proto($proto, $ports, $sports),
@@ -2064,53 +2025,137 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 	fatal_error "$basictarget rules are not allowed in the $section SECTION" if $actiontype & ( NATRULE | NONAT );
 	$rule .= "$globals{STATEMATCH} $section " unless $section eq 'ALL' || $blacklist;
     }
-    #
-    # Generate CT rules(s), if any
-    #
-    if ( $actiontype & HELPER ) {
-	handle_helper_rule( $helper,
-			    $source,
-			    $origdest ? $origdest : $dest,
-			    $proto,
-			    $ports,
-			    $sports,
-			    $sourceref,
-			    ( $actiontype & ACTION ) ? $usedactions{$normalized_target}->{name} : '',
-			    $inaction ? $chain : '' ,
-			    $user ,
-			    $rule ,
-			  );
-
-	$targets{$inaction} |= HELPER if $inaction; 
-    }
 
+    #
     # Generate NAT rule(s), if any
     #
     if ( $actiontype & NATRULE ) {
+	my ( $server, $serverport );
+	my $randomize = $dest =~ s/:random$// ? ' --random' : '';
+
 	require_capability( 'NAT_ENABLED' , "$basictarget rules", '' );
 	#
-	# Add the appropriate rule to the nat table
+	# Isolate server port
 	#
-	( $ports,
+	if ( $dest =~ /^(.*)(:(.+))$/ ) {
-	  $origdstports,
+	    #
-	  $dest ) = handle_nat_rule( $dest,
+	    # Server IP and Port
-				     $proto,
+	    #
-				     $ports,
+	    $server = $1;      # May be empty
-				     $origdest,
+	    $serverport = $3;  # Not Empty due to RE
-				     ( $actiontype & ACTION ) ? $usedactions{$normalized_target}->{name} : '',
+	    $origdstports = $ports;
-				     $action,
-				     $sourceref,
-				     $inaction ? $chain : '',
-				     $rule,
-				     $source,
-				     ( $actiontype & ACTION ) ? '' : $loglevel,
-				     $log_action,
-				   );
 
+	    if ( $origdstports && $origdstports ne '-' && port_count( $origdstports ) == 1 ) {
+		$origdstports = validate_port( $proto, $origdstports );
+	    } else {
+		$origdstports = '';
+	    }
+
+	    if ( $serverport =~ /^(\d+)-(\d+)$/ ) {
+		#
+		# Server Port Range
+		#
+		fatal_error "Invalid port range ($serverport)" unless $1 < $2;
+		my @ports = ( $1, $2 );
+		$_ = validate_port( proto_name( $proto ), $_) for ( @ports );
+		( $ports = $serverport ) =~ tr/-/:/;
+	    } else {
+		$serverport = $ports = validate_port( proto_name( $proto ), $serverport );
+	    }
+	} elsif ( $dest eq ':' ) {
+	    #
+	    # Rule with no server IP or port ( zone:: )
+	    #
+	    $server = $serverport = '';
+	} else {
+	    #
+	    # Simple server IP address (may be empty or "-")
+	    #
+	    $server = $dest;
+	    $serverport = '';
+	}
+
+	#
+	# Generate the target
+	#
+	my $target = '';
+
+	if ( $actiontype  & REDIRECT ) {
+	    fatal_error "A server IP address ($server) may not be specified in a REDIRECT rule" if $server;
+	    $target  = 'REDIRECT';
+	    $target .= " --to-port $serverport" if $serverport;
+	    if ( $origdest eq '' || $origdest eq '-' ) {
+		$origdest = ALLIP;
+	    } elsif ( $origdest eq 'detect' ) {
+		fatal_error 'ORIGINAL DEST "detect" is invalid in an action' if $inaction;
+
+		if ( $config{DETECT_DNAT_IPADDRS} && $sourcezone ne firewall_zone ) {
+		    my $interfacesref = $sourceref->{interfaces};
+		    my @interfaces = keys %$interfacesref;
+		    $origdest = @interfaces ? "detect:@interfaces" : ALLIP;
+ 		} else {
+		    $origdest = ALLIP;
+		}
+	    }
+	} elsif ( $actiontype & ACTION ) {
+	    fatal_error "A server port ($serverport) is not allowed in $action rule" if $serverport;
+	    $target = $usedactions{$normalized_target}->{name};
+	    $loglevel = '';
+	} else {
+	    if ( $server eq '' ) {
+		fatal_error "A server and/or port must be specified in the DEST column in $action rules" unless $serverport;
+	    } elsif ( $server =~ /^(.+)-(.+)$/ ) {
+		validate_range( $1, $2 );
+	    } else {
+		unless ( ( $actiontype & ACTION ) && $server eq ALLIP ) {
+		    my @servers = validate_address $server, 1;
+		    $server = join ',', @servers;
+		}
+	    }
+
+	    if ( $action eq 'DNAT' ) {
+		$target = 'DNAT';
+		if ( $server ) {
+		    $serverport = ":$serverport" if $serverport;
+		    for my $serv ( split /,/, $server ) {
+			$target .= " --to-destination ${serv}${serverport}";
+		    }
+		} else {
+		    $target .= " --to-destination :$serverport";
+		}
+	    }
+
+	    unless ( $origdest && $origdest ne '-' && $origdest ne 'detect' ) {
+		if ( ! $inaction && $config{DETECT_DNAT_IPADDRS} && $sourcezone ne firewall_zone ) {
+		    my $interfacesref = $sourceref->{interfaces};
+		    my @interfaces = keys %$interfacesref;
+		    $origdest = @interfaces ? "detect:@interfaces" : ALLIP;
+		} else {
+		    $origdest = ALLIP;
+		}
+	    }
+	}
+
+	$target .= $randomize;
+
+	#
+	# And generate the nat table rule(s)
+	#
+	expand_rule ( ensure_chain ('nat' , $inaction ? $chain : $sourceref->{type} == FIREWALL ? 'OUTPUT' : dnat_chain $sourcezone ),
+		      PREROUTE_RESTRICT ,
+		      $rule ,
+		      $source ,
+		      $origdest ,
+		      '' ,
+		      $target ,
+		      $loglevel ,
+		      $log_action ,
+		      $serverport ? do_proto( $proto, '', '' ) : '',
+		    );
 	#
 	# After NAT:
 	#   - the destination port will be the server port ($ports) -- we did that above
-	#   - the destination IP will be the server IP   ($dest)  -- also done above
+	#   - the destination IP   will be the server IP   ($dest)
 	#   - there will be no log level (we log NAT rules in the nat table rather than in the filter table).
 	#   - the target will be ACCEPT.
 	#
@@ -2123,24 +2168,88 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
 			  do_condition( $condition )
 			);
 	    $loglevel = '';
+	    $dest     = $server;
 	    $action   = 'ACCEPT';
 	    $origdest = ALLIP if  $origdest =~ /[+]/;
-	    $helper   = '-';
 	}
     } elsif ( $actiontype & NONAT ) {
 	#
-	# NONAT or ACCEPT+
+	# NONAT or ACCEPT+ -- May not specify a destination interface
 	#
-	handle_nonat_rule( $action,
+	fatal_error "Invalid DEST ($dest) in $action rule" if $dest =~ /:/;
-			   $source,
+
-			   $dest,
+	$origdest = '' unless $origdest and $origdest ne '-';
-			   $origdest,
+
-			   $sourceref,
+	if ( $origdest eq 'detect' ) {
-			   $inaction,
+	    my $interfacesref = $sourceref->{interfaces};
-			   $chain,
+	    my $interfaces = [ ( keys %$interfacesref ) ];
+	    $origdest = $interfaces ? "detect:@$interfaces" : ALLIP;
+	}
+
+	my $tgt = 'RETURN';
+
+	my $nonat_chain;
+
+	my $chn;
+
+	if ( $inaction ) {
+	    $nonat_chain = ensure_chain( 'nat', $chain );
+	} elsif ( $sourceref->{type} == FIREWALL ) {
+	    $nonat_chain = $nat_table->{OUTPUT};
+	} else {
+	    $nonat_chain = ensure_chain( 'nat', dnat_chain( $sourcezone ) );
+
+	    my @interfaces = keys %{zone_interfaces $sourcezone};
+
+	    for ( @interfaces ) {
+		my $ichain = input_chain $_;
+
+		if ( $nat_table->{$ichain} ) {
+		    #
+		    # Static NAT is defined on this interface
+		    #
+		    $chn = new_chain( 'nat', newnonatchain ) unless $chn;
+		    add_ijump $chn, j => $nat_table->{$ichain}, @interfaces > 1 ? imatch_source_dev( $_ )  : ();
+		}
+	    }
+
+	    if ( $chn ) {
+		#
+		# Call expand_rule() to correctly handle logging. Because
+		# the 'logname' argument is passed, expand_rule() will
+		# not create a separate logging chain but will rather emit
+		# any logging rule in-line.
+		#
+		expand_rule( $chn,
+			     PREROUTE_RESTRICT,
+			     '', # Rule
+			     '', # Source
+			     '', # Dest
+			     '', # Original dest
+			     'ACCEPT',
 			     $loglevel,
 			     $log_action,
-			   $rule
+			     '',
+			     dnat_chain( $sourcezone  ) );
+		$loglevel = '';
+		$tgt = $chn->{name};
+	    } else {
+		$tgt = 'ACCEPT';
+	    }
+	}
+
+	set_optflags( $nonat_chain, DONT_MOVE | DONT_OPTIMIZE ) if $tgt eq 'RETURN';
+
+	expand_rule( $nonat_chain ,
+		     PREROUTE_RESTRICT ,
+		     $rule ,
+		     $source ,
+		     $dest ,
+		     $origdest ,
+		     $tgt,
+		     $loglevel ,
+		     $log_action ,
+		     '',
 		   );
     }
 
@@ -2281,7 +2390,7 @@ sub build_zone_list( $$$\$\$ ) {
 # Process a Record in the rules file
 #
 sub process_rule ( ) {
-    my ( $target, $source, $dest, $protos, $ports, $sports, $origdest, $ratelimit, $user, $mark, $connlimit, $time, $headers, $condition, $helper )
+    my ( $target, $source, $dest, $protos, $ports, $sports, $origdest, $ratelimit, $user, $mark, $connlimit, $time, $headers, $condition )
 	= split_line1 'rules file', \%rulecolumns, $rule_commands;
 
     fatal_error 'ACTION must be specified' if $target eq '-';
@@ -2338,7 +2447,6 @@ sub process_rule ( ) {
 						 $time,
 						 $headers,
 						 $condition,
-						 $helper,
 						 $wild );
 		}
 	    }
@@ -2363,7 +2471,7 @@ sub classic_blacklist() {
     my $fw       = firewall_zone;
     my @zones    = off_firewall_zones;
     my @vservers = vserver_zones;
-    my @state = $config{BLACKLISTNEWONLY} ? have_capability( 'RAW_TABLE' ) ? state_imatch 'NEW,INVALID,UNTRACKED' : state_imatch 'NEW,INVALID' : ();
+    my @state = $config{BLACKLISTNEWONLY} ? $globals{UNTRACKED} ? state_imatch 'NEW,INVALID,UNTRACKED' : state_imatch 'NEW,INVALID' : ();
     my $result;
 
     for my $zone ( @zones ) {
@@ -2460,8 +2568,6 @@ sub process_rules( $ ) {
 		   );
 
 	process_rule while read_a_line( NORMAL_READ );
-
-	clear_comment;
     }
 
     $section = '';

Shorewall/Perl/Shorewall/Tc.pm

@@ -163,17 +163,13 @@ my  @tcclasses;
 my  %tcclasses;
 
 my  %restrictions = ( tcpre      => PREROUTE_RESTRICT ,
-		      PREROUTING => PREROUTE_RESTRICT ,
 		      tcpost     => POSTROUTE_RESTRICT ,
 		      tcfor      => NO_RESTRICT ,
 		      tcin       => INPUT_RESTRICT ,
-		      tcout      => OUTPUT_RESTRICT ,
+		      tcout      => OUTPUT_RESTRICT );
-		    );
 
 my $family;
 
-my $divertref; # DIVERT chain
-
 #
 # Rather than initializing globals in an INIT block or during declaration,
 # we initialize them in a function. This is done for two reasons:
@@ -195,24 +191,21 @@ sub initialize( $ ) {
     $devnum = 0;
     $sticky = 0;
     $ipp2p  = 0;
-    $divertref = 0;
 }
 
 sub process_tc_rule( ) {
     my ( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $headers, $probability , $dscp );
     if ( $family == F_IPV4 ) {
 	( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $probability, $dscp ) =
-	    split_line1 'tcrules file', { mark => 0, action => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, probability => 12 , dscp => 13 }, { COMMENT => 0, FORMAT => 2 } , 14;
+	    split_line1 'tcrules file', { mark => 0, action => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, probability => 12 , dscp => 13 }, undef , 14;
 	$headers = '-';
     } else {
 	( $originalmark, $source, $dest, $proto, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $headers, $probability, $dscp ) =
-	    split_line1 'tcrules file', { mark => 0, action => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, headers => 12, probability => 13 , dscp => 14 },  { COMMENT => 0, FORMAT => 2 }, 15;
+	    split_line1 'tcrules file', { mark => 0, action => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6, test => 7, length => 8, tos => 9, connbytes => 10, helper => 11, headers => 12, probability => 13 , dscp => 14 }, undef, 15;
     }
 
     our @tccmd;
 
-    our $format;
-
     fatal_error 'MARK must be specified' if $originalmark eq '-';
 
     if ( $originalmark eq 'COMMENT' ) {
@@ -220,15 +213,6 @@ sub process_tc_rule( ) {
 	return;
     }
 
-    if ( $originalmark eq 'FORMAT' ) {
-	if ( $source =~ /^([12])$/ ) {
-	    $format = $1;
-	    return;
-	}
-
-	fatal_error "Invalid FORMAT ($source)";
-    }
-
     my ( $mark, $designator, $remainder ) = split( /:/, $originalmark, 3 );
 
     fatal_error "Invalid MARK ($originalmark)" unless supplied $mark;
@@ -258,7 +242,6 @@ sub process_tc_rule( ) {
     my $restriction = 0;
     my $cmd;
     my $rest;
-    my $matches = '';
 
     my %processtcc = ( sticky => sub() {
 			                  if ( $chain eq 'tcout' ) {
@@ -311,57 +294,23 @@ sub process_tc_rule( ) {
 
 					  $target = "IPMARK --addr $srcdst --and-mask $mask1 --or-mask $mask2 --shift $shift";
 				      },
-		       DIVERT => sub() {
-			                  fatal_error "Invalid MARK ($originalmark)"               unless $format == 2;
-			                  fatal_error "Invalid DIVERT specification( $cmd/$rest )" if $rest;
-
-					  $chain = 'PREROUTING';
-
-					  $mark = in_hex( $globals{TPROXY_MARK} ) . '/' . in_hex( $globals{TPROXY_MARK} );
-
-					  unless ( $divertref ) {
-					      $divertref = new_chain( 'mangle', 'divert' );
-					      add_ijump( $divertref , j => 'MARK', targetopts => "--set-mark $mark"  );
-					      add_ijump( $divertref , j => 'ACCEPT' );
-					  }
-
-					  $target = 'divert';
-
-					  $matches = '! --tcp-flags FIN,SYN,RST,ACK SYN  -m socket --transparent ';
-				      },					      
 		       TPROXY => sub() {
 			                  require_capability( 'TPROXY_TARGET', 'Use of TPROXY', 's');
 
 			                  fatal_error "Invalid TPROXY specification( $cmd/$rest )" if $rest;
 
-					  $chain = 'PREROUTING';
+					  $chain = 'tcpre';
 
 					  $cmd =~ /TPROXY\((.+?)\)$/;
 
 					  my $params = $1;
-					  my ( $port, $ip, $bad );
 
-					  if ( $format == 1 ) {
 					  fatal_error "Invalid TPROXY specification( $cmd )" unless defined $params;
 
-					      ( $mark, $port, $ip, $bad ) = split_list $params, 'Parameter';
+					  ( $mark, my $port, my $ip, my $bad ) = split ',', $params;
 
 					  fatal_error "Invalid TPROXY specification( $cmd )" if defined $bad;
 
-					      warning_message "TPROXY is deprecated in a format-1 tcrules file";
-					  } else {
-					      if ( $params ) {
-						  ( $port, $ip, $bad ) = split_list $params, 'Parameter';
-
-						  fatal_error "Invalid TPROXY specification( $cmd )" if defined $bad;
-					      
-					      } else {
-						  fatal_error "Invalid TPROXY specification ($cmd)" unless $cmd eq 'TPROXY' || $cmd eq 'TPROXY()';
-					      }
-
-					      $mark = in_hex( $globals{TPROXY_MARK} ) . '/' . in_hex( $globals{TPROXY_MARK} );
-					  }
-
 					  if ( $port ) {
 					      $port = validate_port( 'tcp', $port );
 					  } else {
@@ -581,7 +530,7 @@ sub process_tc_rule( ) {
 
     if ( ( my $result = expand_rule( ensure_chain( 'mangle' , $chain ) ,
 				     $restrictions{$chain} | $restriction,
-				     do_proto( $proto, $ports, $sports) . $matches .
+				     do_proto( $proto, $ports, $sports) .
 				     do_user( $user ) .
 				     do_test( $testval, $globals{TC_MASK} ) .
 				     do_length( $length ) .
@@ -590,7 +539,7 @@ sub process_tc_rule( ) {
 				     do_helper( $helper ) .
 				     do_headers( $headers ) .
 				     do_probability( $probability ) .
-				     do_dscp( $dscp ) ,
+				     do_dscp( $dscp ),
 				     $source ,
 				     $dest ,
 				     '' ,
@@ -853,8 +802,6 @@ sub process_simple_device() {
     progress_message "  Simple tcdevice \"$currentline\" $done.";
 }
 
-my %validlinklayer = ( ethernet => 1, atm => 1, adsl => 1 );
-
 sub validate_tc_device( ) {
     my ( $device, $inband, $outband , $options , $redirected ) = split_line 'tcdevices', { interface => 0, in_bandwidth => 1, out_bandwidth => 2, options => 3, redirect => 4 };
 
@@ -889,8 +836,7 @@ sub validate_tc_device( ) {
     fatal_error "Duplicate INTERFACE ($device)"    if $tcdevices{$device};
     fatal_error "Invalid INTERFACE name ($device)" if $device =~ /[:+]/;
 
-    my ( $classify, $pfifo, $flow, $qdisc, $linklayer, $overhead, $mtu, $mpu, $tsize ) = 
+    my ( $classify, $pfifo, $flow, $qdisc )  = (0, 0, '', 'htb' );
-	(0,         0,      '',    'htb',  '',         0,         0,    0,    0);
 
     if ( $options ne '-' ) {
 	for my $option ( split_list1 $options, 'option' ) {
@@ -906,25 +852,6 @@ sub validate_tc_device( ) {
 		$qdisc = 'hfsc';
 	    } elsif ( $option eq 'htb' ) {
 		$qdisc = 'htb';
-	    } elsif ( $option =~ /^linklayer=([a-z]+)$/ ) {
-		$linklayer = $1;
-		fatal_error "Invalid linklayer ($linklayer)" unless $validlinklayer{ $linklayer };
-	    } elsif ( $option =~ /^overhead=(.+)$/ ) {
-		$overhead = numeric_value( $1 );
-		fatal_error "Invalid overhead ($1)" unless defined $overhead;
-		fatal_error q('overhead' requires 'linklayer') unless $linklayer; 
-	    } elsif ( $option =~ /^mtu=(.+)$/ ) {
-		$mtu = numeric_value( $1 );
-		fatal_error "Invalid mtu ($1)" unless defined $mtu;
-		fatal_error q('mtu' requires 'linklayer') unless $linklayer; 
-	    } elsif ( $option =~ /^mpu=(.+)$/ ) {
-		$mpu = numeric_value( $1 );
-		fatal_error "Invalid mpu ($1)" unless defined $mpu;
-		fatal_error q('mpu' requires 'linklayer') unless $linklayer;
-	    } elsif ( $option =~ /^tsize=(.+)$/ ) {
-		$tsize = numeric_value( $1 );
-		fatal_error "Invalid tsize ($1)" unless defined $tsize;
-		fatal_error q('tsize' requires 'linklayer') unless $linklayer; 
 	    } else {
 		fatal_error "Unknown device option ($option)";
 	    }
@@ -963,12 +890,7 @@ sub validate_tc_device( ) {
 			    guarantee     => 0,
 			    name          => $device,
 			    physical      => physical_name $device,
-			    filters       => [],
+			    filters       => []
-			    linklayer     => $linklayer,
-			    overhead      => $overhead,
-			    mtu           => $mtu,
-			    mpu           => $mpu,
-			    tsize         => $tsize,
 			  } ,
 
     push @tcdevices, $device;
@@ -1002,7 +924,7 @@ sub convert_delay( $ ) {
     my $delay = shift;
 
     return 0 unless $delay;
-    return $1 if $delay =~ /^(\d+(\.\d+)?)(ms)?$/;
+    return $1 if $delay =~ /^(\d+)(ms)?$/;
     fatal_error "Invalid Delay ($delay)";
 }
 
@@ -1031,18 +953,6 @@ sub dev_by_number( $ ) {
     ( $dev , $devref );
 }
 
-use constant { RED_INTEGER => 1, RED_FLOAT => 2, RED_NONE => 3 };
-
-my %validredoptions = ( min         => RED_INTEGER,
-			max         => RED_INTEGER,
-			limit       => RED_INTEGER,
-			burst       => RED_INTEGER,
-			avpkt       => RED_INTEGER,
-			bandwidth   => RED_INTEGER,
-			probability => RED_FLOAT,
-			ecn         => RED_NONE,
-		      );
-
 sub validate_tc_class( ) {
     my ( $devclass, $mark, $rate, $ceil, $prio, $options ) =
 	split_line 'tcclasses file', { interface => 0, mark => 1, rate => 2, ceil => 3, prio => 4, options => 5 };
@@ -1052,7 +962,6 @@ sub validate_tc_class( ) {
     my $occurs = 1;
     my $parentclass = 1;
     my $parentref;
-    my $lsceil = 0;
 
     fatal_error 'INTERFACE must be specified' if $devclass eq '-';
     fatal_error 'CEIL must be specified'      if $ceil eq '-';
@@ -1099,6 +1008,9 @@ sub validate_tc_class( ) {
     my $markval = 0;
 
     if ( $mark ne '-' ) {
+	if ( $devref->{classify} ) {
+	    warning_message "INTERFACE $device has the 'classify' option - MARK value ($mark) ignored";
+	} else {
 	    fatal_error "MARK may not be specified when TC_BITS=0" unless $config{TC_BITS};
 
 	    $markval = numeric_value( $mark );
@@ -1112,6 +1024,7 @@ sub validate_tc_class( ) {
 		$classnumber = $config{TC_BITS} >= 14 ? $devref->{nextclass}++ : hex_value( $devnum . $markval );
 		fatal_error "Duplicate MARK ($mark)" if $tcref->{$classnumber};
 	    }
+	}
     } else {
 	fatal_error "Duplicate Class NUMBER ($classnumber)" if $tcref->{$classnumber};
 	$markval = '-';
@@ -1125,9 +1038,7 @@ sub validate_tc_class( ) {
 	my $parentnum = in_hexp $parentclass;
 	fatal_error "Unknown Parent class ($parentnum)" unless $parentref && $parentref->{occurs} == 1;
 	fatal_error "The class ($parentnum) specifies UMAX and/or DMAX; it cannot serve as a parent" if $parentref->{dmax};
-	fatal_error "The class ($parentnum) specifies 'flow'; it cannot serve as a parent"           if $parentref->{flow};
+	fatal_error "The class ($parentnum) specifies flow; it cannot serve as a parent"             if $parentref->{flow};
-	fatal_error "The class ($parentnum) specifies 'red'; it cannot serve as a parent "           if $parentref->{red};
-	fatal_error "The class ($parentnum) has an 'ls' curve; it cannot serve as a parent "         if $parentref->{lsceil};
 	fatal_error "The default class ($parentnum) may not have sub-classes"                        if ( $devref->{default} || 0 ) == $parentclass;
 	$parentref->{leaf} = 0;
 	$ratemax  = $parentref->{rate};
@@ -1138,17 +1049,7 @@ sub validate_tc_class( ) {
 
     my ( $umax, $dmax ) = ( '', '' );
 
-    if ( $ceil =~ /^(.+):(.+)/ ) {
-	fatal_error "An LS rate may only be specified for HFSC classes" unless $devref->{qdisc} eq 'hfsc';
-	$lsceil = $1;
-	$ceil   = $2;
-    }
-
     if ( $devref->{qdisc} eq 'hfsc' ) {
-	if ( $rate eq '-' ) {
-	    fatal_error 'A RATE must be supplied' unless $lsceil;
-	    $rate = 0;
-	} else {
 	( my $trate , $dmax, $umax , my $rest ) = split ':', $rate , 4;
 
 	fatal_error "Invalid RATE ($rate)" if defined $rest;
@@ -1158,7 +1059,6 @@ sub validate_tc_class( ) {
 	$umax = convert_size( $umax );
 	fatal_error "DMAX must be specified when UMAX is specified" if $umax && ! $dmax;
 	$parentclass ||= 1;
-	}
     } else {
 	$rate = convert_rate ( $ratemax, $rate, 'RATE' , $ratename );
     }
@@ -1175,8 +1075,7 @@ sub validate_tc_class( ) {
 			       rate      => $rate ,
 			       umax      => $umax ,
 			       dmax      => $dmax ,
-			       ceiling   => $ceil   = ( supplied $ceil   ? convert_rate( $ceilmax, $ceil,   'CEIL'  , $ceilname ) : 0 ),
+			       ceiling   => convert_rate( $ceilmax, $ceil, 'CEIL' , $ceilname ) ,
-			       lsceil    => $lsceil = ( $lsceil          ? convert_rate( $ceilmax, $lsceil, 'LSCEIL', $ceilname ) : 0 ),
 			       priority  => $prio eq '-' ? 1 : $prio ,
 			       mark      => $markval ,
 			       flow      => '' ,
@@ -1190,9 +1089,7 @@ sub validate_tc_class( ) {
 
     $tcref = $tcref->{$classnumber};
 
-    fatal_error "RATE ($rate) exceeds CEIL ($ceil)" if $rate && $ceil && $rate > $ceil;
+    fatal_error "RATE ($tcref->{rate}) exceeds CEIL ($tcref->{ceiling})" if $tcref->{rate} > $tcref->{ceiling};
-
-    my ( $red, %redopts ) = ( 0, ( avpkt => 1000 ) );
 
     unless ( $options eq '-' ) {
 	for my $option ( split_list1 "\L$options", 'option' ) {
@@ -1217,11 +1114,9 @@ sub validate_tc_class( ) {
 		push @{$tcref->{tos}}, $option;
 	    } elsif ( $option =~ /^flow=(.*)$/ ) {
 		fatal_error "The 'flow' option is not allowed with 'pfifo'" if $tcref->{pfifo};
-		fatal_error "The 'flow' option is not allowed with 'red'"   if $tcref->{red};
 		$tcref->{flow} = process_flow $1;
 	    } elsif ( $option eq 'pfifo' ) {
-		fatal_error "The 'pfifo' option is not allowed with 'flow='" if $tcref->{flow};
+		fatal_error "The 'pfifo'' option is not allowed with 'flow='" if $tcref->{flow};
-		fatal_error "The 'pfifo' option is not allowed with 'red='"  if $tcref->{red};
 		$tcref->{pfifo} = 1;
 	    } elsif ( $option =~ /^occurs=(\d+)$/ ) {
 		my $val = $1;
@@ -1242,57 +1137,6 @@ sub validate_tc_class( ) {
 		warning_message "limit ignored with pfifo queuing" if $tcref->{pfifo};
 		fatal_error "Invalid limit ($1)" if $1 < 3 || $1 > 128;
 		$tcref->{limit} = $1;
-	    } elsif ( $option =~ s/^red=// ) {
-		fatal_error "The 'red=' option is not allowed with 'flow='" if $tcref->{flow};
-		fatal_error "The 'red=' option is not allowed with 'pfifo'" if $tcref->{pfifo};
-		$tcref->{red} = 1;
-		my $opttype;
-
-		for my $redopt ( split_list( $option , q('red' option list) ) ) {
-		    #
-		    #                            $2  ----------------------
-		    #              $1  ------       | $3 -------           |
-		    #                 |      |      |   |       |          |
-		    if ( $redopt =~ /^([a-z]+) (?:= (   ([01]?\.)?(\d{1,8})) )?$/x ) {
-			fatal_error "Invalid RED option ($1)" unless $opttype = $validredoptions{$1};
-			if ( $2 ) {
-			    #
-			    # '=<value>' supplied
-			    #
-			    fatal_error "The $1 option does not take a value" if $opttype == RED_NONE;
-			    if ( $3 ) {
-				#
-				# fractional value
-				#
-				fatal_error "The $1 option requires an integer value"  if $opttype == RED_INTEGER;
-				fatal_error "The value of $1 must be <= 1" if $2 > 1;
-			    } else {
-				#
-				# Integer value
-				#
-				fatal_error "The $1 option requires a value 0 <= value <= 1" if $opttype == RED_FLOAT;
-			    }
-			} else {
-			    #
-			    # No value supplied
-			    #
-			    fatal_error "The $1 option requires a value" unless $opttype == RED_NONE;
-			}
-
-			$redopts{$1} = $2;
-		    } else {
-			fatal_error "Invalid RED option specification ($redopt)";
-		    }
-		}
-
-		for ( qw/ limit min max avpkt burst probability / ) {
-		    fatal_error "The $_ 'red' option is required" unless $redopts{$_};
-		}
-
-		fatal_error "The 'max' red option must be at least 2 * 'min'"   unless $redopts{max}   >= 2 * $redopts{min};
-		fatal_error "The 'limit' red option must be at least 2 * 'max'" unless $redopts{limit} >= 2 * $redopts{min};
-		$redopts{ecn} = 1 if exists $redopts{ecn};
-		$tcref->{redopts} = \%redopts;
 	    } else {
 		fatal_error "Unknown option ($option)";
 	    }
@@ -1324,8 +1168,6 @@ sub validate_tc_class( ) {
 					       occurs   => 0,
 					       parent   => $parentclass,
 					       limit    => $tcref->{limit},
-					       red      => $tcref->{red},
-					       redopts  => $tcref->{redopts},
 					     };
 	push @tcclasses, "$device:$classnumber";
     };
@@ -1657,6 +1499,7 @@ sub process_tc_priority() {
 					   $interface eq '-' &&
 					   $helper    eq '-' );
 
+
     my $val = numeric_value $band;
 
     fatal_error "Invalid PRIORITY ($band)" unless $val && $val <= 3;
@@ -1741,14 +1584,8 @@ sub process_tcpri() {
 			  mark => '--mark 0/'   . in_hex( $globals{TC_MASK} )
 			);
 
-	    insert_irule( $mangle_table->{tcpost} ,
-			  j => 'RETURN', 
-			  1 ,
-			  mark => '! --mark 0/' . in_hex( $globals{TC_MASK} ) ,
-			);
-
 	    add_ijump( $mangle_table->{tcpost} ,
-		       j    => 'CONNMARK --save-mark --mask '    . in_hex( $globals{TC_MASK} ),
+		       j    => 'CONNMARK --save-mark --ctmask '    . in_hex( $globals{TC_MASK} ),
 		       mark => '! --mark 0/' . in_hex( $globals{TC_MASK} )
 		     );
 	}
@@ -1817,22 +1654,11 @@ sub process_traffic_shaping() {
 		   "${dev}_mtu1=\$(get_device_mtu1 $device)"
 		 );
 
-	    my $stab;
-
-	    if ( $devref->{linklayer} ) {
-		$stab =  "stab linklayer $devref->{linklayer} overhead $devref->{overhead} ";
-		$stab .= "mtu $devref->{mtu} "     if $devref->{mtu};
-		$stab .= "mpu $devref->{mpu} "     if $devref->{mpu};
-		$stab .= "tsize $devref->{tsize} " if $devref->{tsize};
-	    } else {
-		$stab = '';
-	    }
-
 	    if ( $devref->{qdisc} eq 'htb' ) {
-		emit ( "run_tc qdisc add dev $device ${stab}root handle $devnum: htb default $defmark r2q $r2q" ,
+		emit ( "run_tc qdisc add dev $device root handle $devnum: htb default $defmark r2q $r2q" ,
 		       "run_tc class add dev $device parent $devnum: classid $devnum:1 htb rate $devref->{out_bandwidth} \$${dev}_mtu1" );
 	    } else {
-		emit ( "run_tc qdisc add dev $device ${stab}root handle $devnum: hfsc default $defmark" ,
+		emit ( "run_tc qdisc add dev $device root handle $devnum: hfsc default $defmark" ,
 		       "run_tc class add dev $device parent $devnum: classid $devnum:1 hfsc sc rate $devref->{out_bandwidth} ul rate $devref->{out_bandwidth}" );
 	    }
 
@@ -1856,9 +1682,8 @@ sub process_traffic_shaping() {
 	    handle_in_bandwidth( $device, $devref->{in_bandwidth} );
 
 	    for my $rdev ( @{$devref->{redirected}} ) {
-		my $phyrdev = get_physical( $rdev );
+		emit ( "run_tc qdisc add dev $rdev handle ffff: ingress" );
-		emit ( "run_tc qdisc add dev $phyrdev handle ffff: ingress" );
+		emit( "run_tc filter add dev $rdev parent ffff: protocol all u32 match u32 0 0 action mirred egress redirect dev $device > /dev/null" );
-		emit( "run_tc filter add dev $phyrdev parent ffff: protocol all u32 match u32 0 0 action mirred egress redirect dev $device > /dev/null" );
 	    }
 
 	    for my $class ( @tcclasses ) {
@@ -1879,12 +1704,10 @@ sub process_traffic_shaping() {
 		my $mark     = $tcref->{mark};
 		my $devicenumber  = in_hexp $devref->{number};
 		my $classid  = join( ':', $devicenumber, $classnum);
-		my $rawrate  = $tcref->{rate};
+		my $rate     = "$tcref->{rate}kbit";
-		my $rate     = "${rawrate}kbit";
-		my $lsceil   = $tcref->{lsceil};
 		my $quantum  = calculate_quantum $rate, calculate_r2q( $devref->{out_bandwidth} );
 
-		$classids{$classid}=$devname;
+		$classids{$classid}=$device;
 
 		my $priority = $tcref->{priority} << 8;
 		my $parent   = in_hexp $tcref->{parent};
@@ -1895,42 +1718,16 @@ sub process_traffic_shaping() {
 		    emit ( "run_tc class add dev $device parent $devicenumber:$parent classid $classid htb rate $rate ceil $tcref->{ceiling}kbit prio $tcref->{priority} \$${dev}_mtu1 quantum \$quantum" );
 		} else {
 		    my $dmax = $tcref->{dmax};
-		    my $rule = "run_tc class add dev $device parent $devicenumber:$parent classid $classid hfsc";
 
 		    if ( $dmax ) {
 			my $umax = $tcref->{umax} ? "$tcref->{umax}b" : "\${${dev}_mtu}b";
-			$rule .= " sc umax $umax dmax ${dmax}ms";
+			emit ( "run_tc class add dev $device parent $devicenumber:$parent classid $classid hfsc sc umax $umax dmax ${dmax}ms rate $rate ul rate $tcref->{ceiling}kbit" );
-			$rule .= " rate $rate" if $rawrate;
 		    } else {
-			$rule .= " sc rate $rate" if $rawrate;
+			emit ( "run_tc class add dev $device parent $devicenumber:$parent classid $classid hfsc sc rate $rate ul rate $tcref->{ceiling}kbit" );
-		    }
-
-		    $rule .= " ls rate ${lsceil}kbit" if $lsceil;
-		    $rule .= " ul rate $tcref->{ceiling}kbit" if $tcref->{ceiling};
-
-		    emit $rule;
-		}
-
-		if ( $tcref->{leaf} ) {
-		    if ( $tcref->{red} ) {
-			1 while $devnums[++$sfq];
-			$sfqinhex = in_hexp( $sfq);
-
-			my ( $options, $redopts ) = ( '', $tcref->{redopts} );
-
-			while ( my ( $option, $type ) = each %validredoptions ) {
-			    if ( my $value = $redopts->{$option} ) {
-				if ( $type == RED_NONE ) {
-				    $options = join( ' ', $options, $option ) if $value;
-				} else {
-				    $options = join( ' ', $options, $option, $value );
-				}
 		    }
 		}
 
-			emit( "run_tc qdisc add dev $device parent $classid handle $sfqinhex: red${options}" );
+		if ( $tcref->{leaf} && ! $tcref->{pfifo} ) {
-
-		    } elsif ( $tcref->{leaf} && ! $tcref->{pfifo} ) {
 		    1 while $devnums[++$sfq];
 
 		    $sfqinhex = in_hexp( $sfq);
@@ -1940,7 +1737,6 @@ sub process_traffic_shaping() {
 			emit( "run_tc qdisc add dev $device parent $classid handle $sfqinhex: sfq limit $tcref->{limit} perturb 10" );
 		    }
 		}
-		}
 		#
 		# add filters
 		#
@@ -2002,14 +1798,14 @@ sub process_traffic_shaping() {
 		my $devicenumber  = in_hexp $devref->{number};
 		my $classid  = join( ':', $devicenumber, $classnum);
 
-		$classids{$classid}=$devname;
+		$classids{$classid}=$device;
 	    }
 	}
     }
 }
 
 #
-# Validate the TC configuration storing basic information in %tcdevices and %tcclasses (complex TC only)
+# Validate the TC configuration storing basic information in %tcdevices and %tcdevices
 #
 sub process_tc() {
     if ( $config{TC_ENABLED} eq 'Internal' || $config{TC_ENABLED} eq 'Shared' ) {
@@ -2157,10 +1953,10 @@ sub setup_tc() {
 	append_file $globals{TC_SCRIPT};
     } else {
 	process_tcpri if $config{TC_ENABLED} eq 'Simple';
-	setup_traffic_shaping if @tcdevices && $config{TC_ENABLED} ne 'Shared';
+	setup_traffic_shaping unless $config{TC_ENABLED} eq 'Shared';
     }
 
-    if ( $config{MANGLE_ENABLED} ) {
+    if ( $config{TC_ENABLED} ) {
 	our  @tccmd = ( { match     => sub ( $ ) { $_[0] eq 'SAVE' } ,
 			  target    => 'CONNMARK --save-mark --mask' ,
 			  mark      => $config{TC_EXPERT} ? HIGHMARK : SMALLMARK,
@@ -2206,11 +2002,6 @@ sub setup_tc() {
 			  mark      => HIGHMARK,
 			  mask      => '',
 			  connmark  => '' },
-			{ match     => sub( $ ) { $_[0] =~ /^DIVERT/ },
-			  target    => 'DIVERT',
-			  mark      => HIGHMARK,
-			  mask      => '',
-			  connmark  => '' },
 			{ match     => sub( $ ) { $_[0] =~ /^TTL/ },
 			  target    => 'TTL',
 			  mark      => NOMARK,
@@ -2245,16 +2036,15 @@ sub setup_tc() {
 
 	if ( my $fn = open_file 'tcrules' ) {
 
-	    our $format = 1;
-
 	    first_entry "$doing $fn...";
 
 	    process_tc_rule while read_a_line( NORMAL_READ );
 
 	    clear_comment;
-
+	}
     }
 
+    if ( $config{MANGLE_ENABLED} ) {
 	if ( my $fn = open_file 'secmarks' ) {
 
 	    first_entry "$doing $fn...";

Shorewall/Perl/Shorewall/Tunnels.pm

@@ -2,6 +2,7 @@
 # Shorewall 4.4 -- /usr/share/shorewall/Shorewall/Tunnels.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
+#
 #     (c) 2007,2008,2009,2010,2011 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
@@ -61,7 +62,7 @@ sub setup_tunnels() {
 	    }
 	}
 
-	my @options = have_capability( 'RAW_TABLE' ) ? state_imatch 'NEW,UNTRACKED' : state_imatch 'NEW';
+	my @options = $globals{UNTRACKED} ? state_imatch 'NEW,UNTRACKED' : state_imatch 'NEW';
 
 	add_tunnel_rule $inchainref,  p => 50, @$source;
 	add_tunnel_rule $outchainref, p => 50, @$dest;
@@ -125,9 +126,9 @@ sub setup_tunnels() {
     sub setup_pptp_server {
 	my ($inchainref, $outchainref, $kind, $source, $dest ) = @_;
 
-	add_tunnel_rule $inchainref,  p => 47, @$source;
+	add_tunnel_rule $inchainref,  p => 47, @$dest;
-	add_tunnel_rule $outchainref, p => 47, @$dest;
+	add_tunnel_rule $outchainref, p => 47, @$source;
-	add_tunnel_rule $inchainref,  p => 'tcp --dport 1723', @$source
+	add_tunnel_rule $inchainref,  p => 'tcp --dport 1723', @$dest
 	}
 
     sub setup_one_openvpn {
@@ -291,7 +292,7 @@ sub setup_tunnels() {
 
 	while ( read_a_line( NORMAL_READ ) ) {
 
-	    my ( $kind, $zone, $gateway, $gatewayzones ) = split_line1 'tunnels file', { type => 0, zone => 1, gateway => 2, gateways => 2, gateway_zone => 3 , gateway_zones => 3 }, undef, 4;
+	    my ( $kind, $zone, $gateway, $gatewayzones ) = split_line1 'tunnels file', { type => 0, zone => 1, gateway => 2, gateways => 2, gateway_zone => 3 }, undef, 4;
 
 	    fatal_error 'TYPE must be specified' if $kind eq '-';
 

Shorewall/Perl/Shorewall/Zones.pm

@@ -41,8 +41,6 @@ our @EXPORT = qw( NOTHING
 		  IP
 		  BPORT
 		  IPSEC
-		  NO_UPDOWN
-		  NO_SFILTER
 
 		  determine_zones
 		  zone_report
@@ -57,7 +55,6 @@ our @EXPORT = qw( NOTHING
 		  all_parent_zones
 		  complex_zones
 		  vserver_zones
-		  on_firewall_zones
 		  off_firewall_zones
 		  non_firewall_zones
 		  single_interface
@@ -65,7 +62,6 @@ our @EXPORT = qw( NOTHING
 		  validate_interfaces_file
 		  all_interfaces
 		  all_real_interfaces
-		  all_plain_interfaces
 		  all_bridges
 		  interface_number
 		  find_interface
@@ -76,7 +72,6 @@ our @EXPORT = qw( NOTHING
 		  port_to_bridge
 		  source_port_to_bridge
 		  interface_is_optional
-		  interface_is_required
 		  find_interfaces_by_option
 		  find_interfaces_by_option1
 		  get_interface_option
@@ -85,6 +80,7 @@ our @EXPORT = qw( NOTHING
 		  set_interface_provider
 		  interface_zones
 		  verify_required_interfaces
+		  compile_updown
 		  validate_hosts_file
 		  find_hosts_by_option
 		  find_zone_hosts_by_option
@@ -118,8 +114,7 @@ use constant { IN_OUT     => 1,
 #
 #     @zones contains the ordered list of zones with sub-zones appearing before their parents.
 #
-#     %zones{<zone1> => {name =>       <name>,
+#     %zones{<zone1> => {type =>       <zone type>       FIREWALL, IP, IPSEC, BPORT;
-#                        type =>       <zone type>       FIREWALL, IP, IPSEC, BPORT;
 #                        complex =>    0|1
 #                        super   =>    0|1
 #                        options =>    { in_out  => < policy match string >
@@ -178,7 +173,6 @@ my  %reservedName = ( all => 1,
 #                                     number      => <ordinal position in the interfaces file>
 #                                     physical    => <physical interface name>
 #                                     base        => <shell variable base representing this interface>
-#                                     provider    => <Provider Name, if interface is associated with a provider>
 #                                     zones       => { zone1 => 1, ... }
 #                                   }
 #                 }
@@ -225,14 +219,11 @@ use constant { SIMPLE_IF_OPTION   => 1,
 	       IF_OPTION_WILDOK   => 64
 	   };
 
-use constant { NO_UPDOWN   => 1, 
-	       NO_SFILTER  => 2 };
-
 my %validinterfaceoptions;
 
 my %defaultinterfaceoptions = ( routefilter => 1 , wait => 60 );
 
-my %maxoptionvalue = ( routefilter => 2, mss => 100000 , wait => 120 , ignore => NO_UPDOWN );
+my %maxoptionvalue = ( routefilter => 2, mss => 100000 , wait => 120 );
 
 my %validhostoptions;
 
@@ -290,7 +281,6 @@ sub initialize( $$ ) {
 				  bridge      => SIMPLE_IF_OPTION,
 				  detectnets  => OBSOLETE_IF_OPTION,
 				  dhcp        => SIMPLE_IF_OPTION,
-				  ignore      => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
 				  maclist     => SIMPLE_IF_OPTION + IF_OPTION_HOST,
 				  logmartians => BINARY_IF_OPTION,
 				  nets        => IPLIST_IF_OPTION + IF_OPTION_ZONEONLY + IF_OPTION_VSERVER,
@@ -301,7 +291,6 @@ sub initialize( $$ ) {
 				  required    => SIMPLE_IF_OPTION,
 				  routeback   => SIMPLE_IF_OPTION + IF_OPTION_ZONEONLY + IF_OPTION_HOST + IF_OPTION_VSERVER,
 				  routefilter => NUMERIC_IF_OPTION ,
-				  rpfilter    => SIMPLE_IF_OPTION,
 				  sfilter     => IPLIST_IF_OPTION,
 				  sourceroute => BINARY_IF_OPTION,
 				  tcpflags    => SIMPLE_IF_OPTION + IF_OPTION_HOST,
@@ -327,7 +316,6 @@ sub initialize( $$ ) {
 	%validinterfaceoptions = (  blacklist   => SIMPLE_IF_OPTION + IF_OPTION_HOST,
 				    bridge      => SIMPLE_IF_OPTION,
 				    dhcp        => SIMPLE_IF_OPTION,
-				    ignore      => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
 				    maclist     => SIMPLE_IF_OPTION + IF_OPTION_HOST,
 				    nets        => IPLIST_IF_OPTION + IF_OPTION_ZONEONLY + IF_OPTION_VSERVER,
 				    nosmurfs    => SIMPLE_IF_OPTION + IF_OPTION_HOST,
@@ -335,7 +323,6 @@ sub initialize( $$ ) {
 				    proxyndp    => BINARY_IF_OPTION,
 				    required    => SIMPLE_IF_OPTION,
 				    routeback   => SIMPLE_IF_OPTION + IF_OPTION_ZONEONLY + IF_OPTION_HOST + IF_OPTION_VSERVER,
-				    rpfilter    => SIMPLE_IF_OPTION,
 				    sfilter     => IPLIST_IF_OPTION,
 				    sourceroute => BINARY_IF_OPTION,
 				    tcpflags    => SIMPLE_IF_OPTION + IF_OPTION_HOST,
@@ -496,8 +483,7 @@ sub process_zone( \$ ) {
 
     my $complex = 0;
 
-    my $zoneref = $zones{$zone} = { name       => $zone,
+    my $zoneref = $zones{$zone} = { type       => $type,
-				    type       => $type,
 				    parents    => \@parents,
 				    bridge     => '',
 				    options    => { in_out  => parse_zone_option_list( $options , $type, $complex , IN_OUT ) ,
@@ -579,7 +565,6 @@ sub determine_zones()
 		for ( @{$zones{$zone}{children}} ) {
 		    next ZONE unless $ordered{$_};
 		}
-
 		$ordered{$zone} = 1;
 		push @zones, $zone;
 		redo PUSHED;
@@ -587,7 +572,7 @@ sub determine_zones()
 	}
     }
 
-    assert( @zones == @z );
+    assert( scalar @zones == scalar @z );
 
 }
 
@@ -840,10 +825,6 @@ sub all_zones() {
     @zones;
 }
 
-sub on_firewall_zones() {
-   grep ( ( $zones{$_}{type} & ( FIREWALL | VSERVER ) )  ,  @zones );
-}
-
 sub off_firewall_zones() {
    grep ( ! ( $zones{$_}{type} & ( FIREWALL | VSERVER ) )  ,  @zones );
 }
@@ -1048,7 +1029,7 @@ sub process_interface( $$ ) {
 
     if ( $options eq 'ignore' ) {
 	fatal_error "Ignored interfaces may not be associated with a zone" if $zone;
-	$options{ignore} = NO_UPDOWN | NO_SFILTER;
+	$options{ignore} = 1;
 	$options = '-';
     }
 
@@ -1168,23 +1149,7 @@ sub process_interface( $$ ) {
 	    }
 	}
 
-	fatal_error q(The 'required', 'optional' and 'ignore' options are mutually exclusive)
+	fatal_error "Invalid combination of interface options" if $options{required} && $options{optional};
-	    if ( ( $options{required} && $options{optional} ) ||
-		 ( $options{required} && $options{ignore}   ) ||
-		 ( $options{optional} && $options{ignore}   ) );
-
-	if ( $options{rpfilter} ) {
-	    require_capability( 'RPFILTER_MATCH', q(The 'rpfilter' option), 's' ) ;
-	    fatal_error q(The 'routefilter', 'sfilter' and 'rpfilter' options are mutually exclusive) if $options{routefilter} || @$filterref;
-	} else {
-	    fatal_error q(The 'routefilter', 'sfilter' and 'rpfilter' options are mutually exclusive) if $options{routefilter} && @$filterref;
-	}
-
-	if ( supplied( my $ignore = $options{ignore} ) ) {
-	    fatal_error "Invalid value ignore=0" if ! $ignore;
-	} else {
-	    $options{ignore} = 0;
-	}
 
 	if ( $netsref eq 'dynamic' ) {
 	    my $ipset = $family == F_IPV4 ? "${zone}_" . chain_base $physical : "6_${zone}_" . chain_base $physical;
@@ -1206,10 +1171,6 @@ sub process_interface( $$ ) {
 	# No options specified -- auto-detect bridge
 	#
 	$hostoptionsref->{routeback} = $options{routeback} = is_a_bridge( $physical ) unless $export;
-	#
-	# And give the 'ignore' option a defined value
-	#
-	$options{ignore} ||= 0;
     }
 
     $physical{$physical} = $interfaces{$interface} = { name       => $interface ,
@@ -1455,65 +1416,11 @@ sub interface_is_optional($) {
     $optionsref && $optionsref->{optional};
 }
 
-#
-# Return the 'required' setting of the passed interface
-#
-sub interface_is_required($) {
-    my $optionsref = $interfaces{$_[0]}{options};
-    $optionsref && $optionsref->{required};
-}
-
-#
-# Return true if the interface is 'plain'
-#
-sub interface_is_plain($) {
-    my $interfaceref = $interfaces{$_[0]};
-    my $optionsref   = $interfaceref->{options};
-
-    $interfaceref->{bridge} eq $interfaceref->{name} && ! ( $optionsref && ( $optionsref->{required} || $optionsref->{optional} || $optionsref->{ignore} ) )
-}
-
-#
-# Return a minimal list of physical interfaces that are neither ignored, optional, required nor a bridge port.
-#
-sub all_plain_interfaces() {
-    my @plain1 = map get_physical($_), grep $_ ne '%vserver%' && interface_is_plain( $_ ), @interfaces;
-    my @plain2;
-    my @wild1;
-    my @wild2;
-   
-    for ( @plain1 ) {
-	if ( /\+$/ ) {
-	    return ( '+' ) if $_ eq '+';
-	    push @wild1, $_;
-	    chop;
-	    push @wild2, $_;
-	} else {
-	    push @plain2, $_;
-	}
-    }
-
-    return @plain2 unless @wild1;
-
-    @plain1 = ();
-
-NAME:
-    for my $name ( @plain2) {
-	for ( @wild2 ) {
-	    next NAME if substr( $name, 0, length( $_ ) ) eq $_;
-	}
-
-	push @plain1, $name;
-    }
-
-    ( @plain1, @wild1 );
-}
-
 #
 # Returns reference to array of interfaces with the passed option
 #
-sub find_interfaces_by_option( $;$ ) {
+sub find_interfaces_by_option( $ ) {
-    my ( $option , $nonzero ) = @_;
+    my $option = $_[0];
     my @ints = ();
 
     for my $interface ( @interfaces ) {
@@ -1522,11 +1429,7 @@ sub find_interfaces_by_option( $;$ ) {
 	next unless $interfaceref->{root};
 
 	my $optionsref = $interfaceref->{options};
-	if ( $nonzero ) {
+	if ( $optionsref && defined $optionsref->{$option} ) {
-	    if ( $optionsref && $optionsref->{$option} ) {
-		push @ints , $interface
-	    }
-	} elsif ( $optionsref && defined $optionsref->{$option} ) {
 	    push @ints , $interface
 	}
     }
@@ -1637,16 +1540,16 @@ sub verify_required_interfaces( $ ) {
 		my $physical = get_physical $interface;
 
 		if ( $physical =~ /\+$/ ) {
+		    my $base = uc chain_base $physical;
+
 		    $physical =~ s/\+$/*/;
 
-		    emit( "waittime=$wait",
+		    emit( 'for interface in $(find_all_interfaces); do',
-			  '',
-			  'for interface in $(find_all_interfaces); do',
 			  '    case $interface in',
 			  "        $physical)",
+			  "            waittime=$wait",
 			  '            while [ $waittime -gt 0 ]; do',
 			  '                interface_is_usable $interface && break',
-			  '                sleep 1',
 			  '                waittime=$(($waittime - 1))',
 			  '            done',
 			  '            ;;',
@@ -1659,8 +1562,8 @@ sub verify_required_interfaces( $ ) {
 		    emit qq(    waittime=$wait);
 		    emit  '';
 		    emit  q(    while [ $waittime -gt 0 ]; do);
-		    emit  q(        sleep 1);
 		    emit qq(        interface_is_usable $physical && break);
+		    emit  q(        sleep 1);
 		    emit   '        waittime=$(($waittime - 1))';
 		    emit  q(    done);
 		    emit  q(fi);
@@ -1731,12 +1634,181 @@ sub verify_required_interfaces( $ ) {
     $returnvalue;
 }
 
+#
+# Emit the updown() function
+#
+sub compile_updown() {
+    emit( '',
+	  '#',
+	  '# Handle the "up" and "down" commands',
+	  '#',
+	  'updown() # $1 = interface',
+	  '{',
+	);
+
+    push_indent;
+
+    emit( 'local state',
+	  'state=cleared',
+	  '' );
+
+    emit 'progress_message3 "$g_product $COMMAND triggered by $1"';
+    emit '';
+
+    if ( $family == F_IPV4 ) {
+	emit 'if shorewall_is_started; then';
+    } else {
+	emit 'if shorewall6_is_started; then';
+    }
+
+    emit( '    state=started',
+	  'elif [ -f ${VARDIR}/state ]; then',
+	  '    case "$(cat ${VARDIR}/state)" in',
+	  '        Stopped*)',
+	  '            state=stopped',
+	  '            ;;',
+	  '        Cleared*)',
+	  '            ;;',
+	  '        *)',
+	  '            state=unknown',
+	  '            ;;',
+	  '    esac',
+	  'else',
+	  '    state=unknown',
+	  'fi',
+	  ''
+	);
+
+    emit( 'case $1 in' );
+
+    push_indent;
+
+    my $ignore   = find_interfaces_by_option 'ignore';
+    my $required = find_interfaces_by_option 'required';
+    my $optional = find_interfaces_by_option 'optional';
+
+    if ( @$ignore ) {
+	my $interfaces = join '|', map $interfaces{$_}->{physical}, @$ignore;
+
+	$interfaces =~ s/\+/*/g;
+
+	emit( "$interfaces)",
+	      '    progress_message3 "$COMMAND on interface $1 ignored"',
+	      '    exit 0',
+	      '    ;;'
+	    );
+    }
+
+    if ( @$required ) {
+	my $interfaces = join '|', map $interfaces{$_}->{physical}, @$required;
+
+	my $wildcard = ( $interfaces =~ s/\+/*/g );
+
+	emit( "$interfaces)",
+	      '    if [ "$COMMAND" = up ]; then' );
+
+	if ( $wildcard ) {
+	    emit( '        if [ "$state" = started ]; then',
+		  '            COMMAND=restart',
+		  '        else',
+		  '            COMMAND=start',
+		  '        fi' );
+	} else {
+	    emit( '        COMMAND=start' );
+	}
+
+	emit( '        progress_message3 "$g_product attempting $COMMAND"',
+	      '        detect_configuration',
+	      '        define_firewall' );
+
+	if ( $wildcard ) {
+	    emit( '    elif [ "$state" = started ]; then',
+		  '        progress_message3 "$g_product attempting restart"',
+		  '        COMMAND=restart',
+		  '        detect_configuration',
+		  '        define_firewall' );
+	} else {
+	    emit( '    else',
+		  '        COMMAND=stop',
+		  '        progress_message3 "$g_product attempting stop"',
+		  '        detect_configuration',
+		  '        stop_firewall' );
+	}
+
+	emit( '    fi',
+	      '    ;;'
+	    );
+    }
+
+    if ( @$optional ) {
+	my @interfaces = map $interfaces{$_}->{physical}, @$optional;
+	my $interfaces = join '|', @interfaces;
+
+	if ( $interfaces =~ s/\+/*/g || @interfaces > 1 ) {
+	    emit( "$interfaces)",
+		  '    if [ "$COMMAND" = up ]; then',
+		  '        echo 0 > ${VARDIR}/${1}.state',
+		  '    else',
+		  '        echo 1 > ${VARDIR}/${1}.state',
+		  '    fi' );
+	} else {
+	    emit( "$interfaces)",
+		  '    if [ "$COMMAND" = up ]; then',
+		  "        echo 0 > \${VARDIR}/$interfaces.state",
+		  '    else',
+		  "        echo 1 > \${VARDIR}/$interfaces.state",
+		  '    fi' );
+	}
+
+	emit( '',
+	      '    if [ "$state" = started ]; then',
+	      '        COMMAND=restart',
+	      '        progress_message3 "$g_product attempting restart"',
+	      '        detect_configuration',
+	      '        define_firewall',
+	      '    elif [ "$state" = stopped ]; then',
+	      '        COMMAND=start',
+	      '        progress_message3 "$g_product attempting start"',
+	      '        detect_configuration',
+	      '        define_firewall',
+	      '    else',
+	      '        progress_message3 "$COMMAND on interface $1 ignored"',
+	      '    fi',
+	      '    ;;',
+	    );
+    }
+
+    emit( "*)",
+	  '    case $state in',
+	  '        started)',
+	  '            COMMAND=restart',
+	  '            progress_message3 "$g_product attempting restart"',
+	  '            detect_configuration',
+	  '            define_firewall',
+	  '            ;;',
+	  '        *)',
+	  '            progress_message3 "$COMMAND on interface $1 ignored"',
+	  '            ;;',
+	  '    esac',
+	);
+
+    pop_indent;
+
+    emit( 'esac' );
+
+    pop_indent;
+
+    emit( '}',
+	  '',
+	);
+}
+
 #
 # Process a record in the hosts file
 #
 sub process_host( ) {
     my $ipsec = 0;
-    my ($zone, $hosts, $options ) = split_line1 'hosts file', { zone => 0, host => 1, hosts => 1, options => 2 }, {}, 3;
+    my ($zone, $hosts, $options ) = split_line 'hosts file', { zone => 0, hosts => 1, options => 2 };
 
     fatal_error 'ZONE must be specified'  if $zone eq '-';
     fatal_error 'HOSTS must be specified' if $hosts eq '-';

Shorewall/Perl/prog.footer

@@ -348,9 +348,7 @@ case "$COMMAND" in
 	[ $# -eq 1 ] && exit 0
 	shift
 	[ $# -ne 1 ] && usage 2
-	mutex_on
+	updown $1
-	( updown $1 )
-	mutex_off
 	status=0
 	;;
     enable)

Shorewall/Samples/Universal/rules

@@ -6,13 +6,13 @@
 # The manpage is also online at
 # http://www.shorewall.net/manpages/shorewall-rules.html
 #
-##############################################################################################################################################################################################
+###################################################################################################################################################################################
-#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH     HELPER
+#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH
 #							PORT	PORT(S)		DEST		LIMIT		GROUP
 #SECTION ALL
 #SECTION ESTABLISHED
 #SECTION RELATED
 SECTION NEW
-Invalid(DROP)	net		$FW		tcp
+
 SSH(ACCEPT)	net		$FW
 Ping(ACCEPT)	net		$FW

Shorewall/Samples/Universal/shorewall.conf

@@ -41,8 +41,6 @@ MACLIST_LOG_LEVEL=info
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
-
 SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
@@ -57,8 +55,6 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
 
-GEOIPDIR=/usr/share/xt_geoip/LE
-
 IPTABLES=
 
 IP=
@@ -69,8 +65,6 @@ LOCKFILE=
 
 MODULESDIR=
 
-NFACCT=
-
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
@@ -114,9 +108,7 @@ ADD_SNAT_ALIASES=No
 
 ADMINISABSENTMINDED=Yes
 
-AUTOCOMMENT=Yes
+AUTO_COMMENT=Yes
-
-AUTOHELPERS=Yes
 
 AUTOMAKE=No
 
@@ -146,8 +138,6 @@ FASTACCEPT=Yes
 
 FORWARD_CLEAR_MARK=
 
-HELPERS=
-
 IMPLICIT_CONTINUE=No
 
 IPSET_WARNINGS=Yes
@@ -178,7 +168,7 @@ MUTEX_TIMEOUT=60
 
 NULL_ROUTE_RFC1918=No
 
-OPTIMIZE=31
+OPTIMIZE=15
 
 OPTIMIZE_ACCOUNTING=No
 
@@ -216,8 +206,6 @@ MACLIST_DISPOSITION=REJECT
 
 RELATED_DISPOSITION=ACCEPT
 
-RPFILTER_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
 SFILTER_DISPOSITION=DROP

Shorewall/Samples/one-interface/interfaces

@@ -14,4 +14,4 @@
 FORMAT 2
 ###############################################################################
 #ZONE	INTERFACE	OPTIONS
-net     eth0            dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0
+net     eth0            dhcp,tcpflags,logmartians,nosmurfs

Shorewall/Samples/one-interface/rules

@@ -10,18 +10,14 @@
 # See the file README.txt for further details.
 #------------------------------------------------------------------------------------------------------------
 # For information on entries in this file, type "man shorewall-rules"
-##############################################################################################################################################################################################
+######################################################################################################################################################################################
-#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH     HELPER
+#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH
 #							PORT	PORT(S)		DEST		LIMIT		GROUP
 #SECTION ALL
 #SECTION ESTABLISHED
 #SECTION RELATED
 SECTION NEW
 
-# Drop packets in the INVALID state
-
-Invalid(DROP)  net    	        $FW		tcp
-
 # Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
 
 Ping(DROP)	net		$FW

Shorewall/Samples/one-interface/shorewall.conf

@@ -52,8 +52,6 @@ MACLIST_LOG_LEVEL=info
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
-
 SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
@@ -68,8 +66,6 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
 
-GEOIPDIR=/usr/share/xt_geoip/LE
-
 IPTABLES=
 
 IP=
@@ -80,8 +76,6 @@ LOCKFILE=
 
 MODULESDIR=
 
-NFACCT=
-
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
@@ -125,9 +119,7 @@ ADD_SNAT_ALIASES=No
 
 ADMINISABSENTMINDED=Yes
 
-AUTOCOMMENT=Yes
+AUTO_COMMENT=Yes
-
-AUTOHELPERS=Yes
 
 AUTOMAKE=No
 
@@ -157,8 +149,6 @@ FASTACCEPT=No
 
 FORWARD_CLEAR_MARK=
 
-HELPERS=
-
 IMPLICIT_CONTINUE=No
 
 IPSET_WARNINGS=Yes
@@ -189,7 +179,7 @@ MUTEX_TIMEOUT=60
 
 NULL_ROUTE_RFC1918=No
 
-OPTIMIZE=31
+OPTIMIZE=1
 
 OPTIMIZE_ACCOUNTING=No
 
@@ -227,8 +217,6 @@ MACLIST_DISPOSITION=REJECT
 
 RELATED_DISPOSITION=ACCEPT
 
-RPFILTER_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
 SFILTER_DISPOSITION=DROP

Shorewall/Samples/three-interfaces/interfaces

@@ -14,6 +14,6 @@
 FORMAT 2
 ###############################################################################
 #ZONE	INTERFACE	OPTIONS
-net     eth0            tcpflags,dhcp,nosmurfs,routefilter,logmartians,sourceroute=0
+net     eth0            tcpflags,dhcp,nosmurfs,routefilter,logmartians
 loc     eth1            tcpflags,nosmurfs,routefilter,logmartians
 dmz     eth2            tcpflags,nosmurfs,routefilter,logmartians

Shorewall/Samples/three-interfaces/masq

@@ -10,9 +10,8 @@
 # See the file README.txt for further details.
 #------------------------------------------------------------------------------
 # For information about entries in this file, type "man shorewall-masq"
-################################################################################################################
+##############################################################################
-#INTERFACE:DEST		SOURCE		ADDRESS		PROTO	PORT(S)	IPSEC	MARK	USER/	SWITCH	ORIGINAL
+#INTERFACE		SOURCE		ADDRESS		PROTO	PORT(S)	IPSEC	MARK
-#											GROUP		DEST
 eth0			10.0.0.0/8,\
 			169.254.0.0/16,\
 			172.16.0.0/12,\

Shorewall/Samples/three-interfaces/rules

@@ -10,8 +10,8 @@
 # See the file README.txt for further details.
 #------------------------------------------------------------------------------------------------------------
 # For information about entries in this file, type "man shorewall-rules"
-##############################################################################################################################################################################################
+######################################################################################################################################################################################
-#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH     HELPER
+#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH
 #							PORT	PORT(S)		DEST		LIMIT		GROUP
 #SECTION ALL
 #SECTION ESTABLISHED
@@ -20,7 +20,7 @@ SECTION NEW
 
 #       Don't allow connection pickup from the net
 #
-Invalid(DROP)	net		all		tcp
+Invalid(DROP)	net		all
 #
 #	Accept DNS connections from the firewall to the Internet
 #

Shorewall/Samples/three-interfaces/shorewall.conf

@@ -50,8 +50,6 @@ MACLIST_LOG_LEVEL=info
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
-
 SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
@@ -66,8 +64,6 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
 
-GEOIPDIR=/usr/share/xt_geoip/LE
-
 IPTABLES=
 
 IP=
@@ -78,8 +74,6 @@ LOCKFILE=
 
 MODULESDIR=
 
-NFACCT=
-
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
@@ -123,9 +117,7 @@ ADD_SNAT_ALIASES=No
 
 ADMINISABSENTMINDED=Yes
 
-AUTOCOMMENT=Yes
+AUTO_COMMENT=Yes
-
-AUTOHELPERS=Yes
 
 AUTOMAKE=No
 
@@ -155,8 +147,6 @@ FASTACCEPT=No
 
 FORWARD_CLEAR_MARK=
 
-HELPERS=
-
 IMPLICIT_CONTINUE=No
 
 IPSET_WARNINGS=Yes
@@ -187,7 +177,7 @@ MUTEX_TIMEOUT=60
 
 NULL_ROUTE_RFC1918=No
 
-OPTIMIZE=31
+OPTIMIZE=1
 
 OPTIMIZE_ACCOUNTING=No
 
@@ -225,8 +215,6 @@ MACLIST_DISPOSITION=REJECT
 
 RELATED_DISPOSITION=ACCEPT
 
-RPFILTER_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
 SFILTER_DISPOSITION=DROP

Shorewall/Samples/two-interfaces/interfaces

@@ -14,5 +14,5 @@
 FORMAT 2
 ###############################################################################
 #ZONE	INTERFACE	OPTIONS
-net     eth0            dhcp,tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0
+net     eth0            dhcp,tcpflags,nosmurfs,routefilter,logmartians
 loc     eth1            tcpflags,nosmurfs,routefilter,logmartians

Shorewall/Samples/two-interfaces/masq

@@ -10,9 +10,8 @@
 # See the file README.txt for further details.
 #------------------------------------------------------------------------------
 # For information about entries in this file, type "man shorewall-masq"
-################################################################################################################
+###############################################################################
-#INTERFACE:DEST		SOURCE		ADDRESS		PROTO	PORT(S)	IPSEC	MARK	USER/	SWITCH	ORIGINAL
+#INTERFACE		SOURCE		ADDRESS		PROTO	PORT(S)	IPSEC	MARK
-#											GROUP		DEST
 eth0			10.0.0.0/8,\
 			169.254.0.0/16,\
 			172.16.0.0/12,\

Shorewall/Samples/two-interfaces/rules

@@ -10,8 +10,8 @@
 # See the file README.txt for further details.
 #------------------------------------------------------------------------------
 # For information about entries in this file, type "man shorewall-rules"
-##############################################################################################################################################################################################
+######################################################################################################################################################################################
-#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH     HELPER
+#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH
 #							PORT	PORT(S)		DEST		LIMIT		GROUP
 #SECTION ALL
 #SECTION ESTABLISHED
@@ -20,7 +20,7 @@ SECTION NEW
 
 #       Don't allow connection pickup from the net
 #
-Invalid(DROP)	net		all		tcp
+Invalid(DROP)	net		all
 #
 #	Accept DNS connections from the firewall to the network
 #

Shorewall/Samples/two-interfaces/shorewall.conf

@@ -53,8 +53,6 @@ MACLIST_LOG_LEVEL=info
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
-
 SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
@@ -69,8 +67,6 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
 
-GEOIPDIR=/usr/share/xt_geoip/LE
-
 IPTABLES=
 
 IP=
@@ -81,8 +77,6 @@ LOCKFILE=
 
 MODULESDIR=
 
-NFACCT=
-
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
@@ -126,9 +120,7 @@ ADD_SNAT_ALIASES=No
 
 ADMINISABSENTMINDED=Yes
 
-AUTOCOMMENT=Yes
+AUTO_COMMENT=Yes
-
-AUTOHELPERS=Yes
 
 AUTOMAKE=No
 
@@ -158,8 +150,6 @@ FASTACCEPT=No
 
 FORWARD_CLEAR_MARK=
 
-HELPERS=
-
 IMPLICIT_CONTINUE=No
 
 IPSET_WARNINGS=Yes
@@ -190,7 +180,7 @@ MUTEX_TIMEOUT=60
 
 NULL_ROUTE_RFC1918=No
 
-OPTIMIZE=31
+OPTIMIZE=1
 
 OPTIMIZE_ACCOUNTING=No
 
@@ -228,8 +218,6 @@ MACLIST_DISPOSITION=REJECT
 
 RELATED_DISPOSITION=ACCEPT
 
-RPFILTER_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
 SFILTER_DISPOSITION=DROP

Shorewall/action.Broadcast

@@ -31,7 +31,7 @@ FORMAT 2
 
 DEFAULTS DROP,-
 
-?BEGIN PERL;
+BEGIN PERL;
 
 use Shorewall::IPAddrs;
 use Shorewall::Config;
@@ -70,4 +70,4 @@ add_jump $chainref, $target, 0, '-d 224.0.0.0/4 ';
 
 1;
 
-?END PERL;
+END PERL;

Shorewall/action.Drop

@@ -36,7 +36,7 @@ FORMAT 2
 # The following magic provides different defaults for $2 thru $5, when $1 is
 # 'audit'.
 #
-?BEGIN PERL;
+BEGIN PERL;
 use Shorewall::Config;
 
 my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
@@ -54,7 +54,7 @@ if ( defined $p1 ) {
 
 1;
 
-?END PERL;
+END PERL;
 
 DEFAULTS -,REJECT,DROP,ACCEPT,DROP
 

Shorewall/action.DropSmurfs

@@ -13,7 +13,7 @@ FORMAT 2
 
 DEFAULTS -
 
-?BEGIN PERL;
+BEGIN PERL;
 use strict;
 use Shorewall::Config qw(:DEFAULT F_IPV4 F_IPV6);
 use Shorewall::Chains;
@@ -77,7 +77,7 @@ if ( $family == F_IPV4 ) {
     add_ijump( $chainref, g => $target, s => IPv6_MULTICAST );
 }
 
-?END PERL;
+END PERL;
 
 
 

Shorewall/action.Invalid

@@ -31,7 +31,7 @@ FORMAT 2
 
 DEFAULTS DROP,-
 
-?BEGIN PERL;
+BEGIN PERL;
 
 use Shorewall::IPAddrs;
 use Shorewall::Config;
@@ -53,4 +53,4 @@ allow_optimize( $chainref );
 
 1;
 
-?END PERL;
+END PERL;

Shorewall/action.NotSyn

@@ -31,7 +31,7 @@ FORMAT 2
 
 DEFAULTS DROP,-
 
-?BEGIN PERL;
+BEGIN PERL;
 
 use Shorewall::IPAddrs;
 use Shorewall::Config;
@@ -53,4 +53,4 @@ allow_optimize( $chainref );
 
 1;
 
-?END PERL;
+END PERL;

Shorewall/action.RST

@@ -5,7 +5,7 @@
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2012 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2011 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
@@ -31,15 +31,16 @@ FORMAT 2
 
 DEFAULTS DROP,-
 
-?BEGIN PERL;
+BEGIN PERL;
 
+use Shorewall::IPAddrs;
 use Shorewall::Config;
 use Shorewall::Chains;
 
 my ( $action, $audit ) = get_action_params( 2 );
 
 fatal_error "Invalid parameter ($audit) to action NotSyn"   if supplied $audit && $audit ne 'audit';
-fatal_error "Invalid parameter ($action) to action NotSyn"  unless $action =~ /^(?:ACCEPT|DROP)$/;
+fatal_error "Invalid parameter ($action) to action NotSyn"  unless $action =~ /^(?:ACCEPT|DROP|REJECT)$/;
 
 my $chainref         = get_action_chain;
 my ( $level, $tag )  = get_action_logging;
@@ -52,4 +53,4 @@ allow_optimize( $chainref );
 
 1;
 
-?END PERL;
+END PERL;

Shorewall/action.Reject

@@ -32,7 +32,7 @@ FORMAT 2
 # The following magic provides different defaults for $2 thru $5, when $1 is
 # 'audit'.
 #
-?BEGIN PERL;
+BEGIN PERL;
 use Shorewall::Config;
 
 my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
@@ -50,7 +50,7 @@ if ( defined $p1 ) {
 
 1;
 
-?END PERL;
+END PERL;
 
 DEFAULTS -,REJECT,REJECT,ACCEPT,DROP
 

Shorewall/action.TCPFlags

@@ -13,11 +13,12 @@ FORMAT 2
 
 DEFAULTS DROP,-
 
-?BEGIN PERL;
+BEGIN PERL;
 use strict;
 use Shorewall::Config qw(:DEFAULT F_IPV4 F_IPV6);
 use Shorewall::Chains;
 
+
 my ( $disposition, $audit ) = get_action_params( 2 );
 
 my $chainref        = get_action_chain;
@@ -54,7 +55,7 @@ add_ijump $chainref , g => $disposition, p => 'tcp --tcp-flags SYN,RST SYN,RST';
 add_ijump $chainref , g => $disposition, p => 'tcp --tcp-flags SYN,FIN SYN,FIN';
 add_ijump $chainref , g => $disposition, p => 'tcp --syn --sport 0';
 
-?END PERL;
+END PERL;
 
 
 

Shorewall/configfiles/blacklist

@@ -0,0 +1,11 @@
+#
+# Shorewall version 4 - Blacklist File
+#
+# For information about entries in this file, type "man shorewall-blacklist"
+#
+# Please see http://shorewall.net/blacklisting_support.htm for additional
+# information.
+#
+###############################################################################
+#ADDRESS/SUBNET		PROTOCOL	PORT	OPTIONS
+

Shorewall/configfiles/conntrack

@@ -1,53 +0,0 @@
-#
-# Shorewall version 4 - conntrack File
-#
-# For information about entries in this file, type "man shorewall-conntrack"
-#
-#############################################################################################
-FORMAT 2
-#ACTION			SOURCE		DESTINATION	PROTO	DEST		SOURCE	USER/
-#								PORT(S)		PORT(S)	GROUP
-?if $AUTOHELPERS && __CT_TARGET
-
-?if __AMANDA_HELPER
-CT:helper:amanda	all		-		udp	10080
-?endif
-
-?if __FTP_HELPER
-CT:helper:ftp		all		-		tcp	21
-?endif
-
-?if __H323_HELPER
-CT:helper:RAS		all		-		udp	1719
-CT:helper:Q.931		all		-		tcp	1720
-?endif
-
-?if __IRC_HELPER
-CT:helper:irc		all		-		tcp	6667
-?endif
-
-?if __NETBIOS_NS_HELPER
-CT:helper:netbios-ns	all		-		udp	137
-?endif
-
-?if __PPTP_HELPER
-CT:helper:pptp		all		-		tcp	1729
-?endif
-
-?if __SANE_HELPER
-CT:helper:sane		all		-		tcp	6566
-?endif
-
-?if __SIP_HELPER
-CT:helper:sip		all		-		udp	5060
-?endif
-
-?if __SNMP_HELPER
-CT:helper:snmp		all		-		udp	161
-?endif
-
-?if __TFTP_HELPER
-CT:helper:tftp		all		-		udp	69
-?endif
-
-?endif

Shorewall/configfiles/masq

@@ -6,6 +6,6 @@
 # The manpage is also online at
 # http://www.shorewall.net/manpages/shorewall-masq.html
 #
-################################################################################################################
+######################################################################################################
-#INTERFACE:DEST		SOURCE		ADDRESS		PROTO	PORT(S)	IPSEC	MARK	USER/	SWITCH	ORIGINAL
+#INTERFACE:DEST		SOURCE		ADDRESS		PROTO	PORT(S)	IPSEC	MARK	USER/	SWITCH
-#											GROUP		DEST
+#											GROUP

Shorewall/configfiles/notrack

@@ -0,0 +1,9 @@
+#
+# Shorewall version 4 - Notrack File
+#
+# For information about entries in this file, type "man shorewall-notrack"
+#
+#####################################################################################
+FORMAT 2
+#ACTION		SOURCE		DESTINATION	PROTO	DEST		SOURCE	USER/
+#							PORT(S)		PORT(S)	GROUP

Shorewall/configfiles/rules

@@ -6,8 +6,8 @@
 # The manpage is also online at
 # http://www.shorewall.net/manpages/shorewall-rules.html
 #
-#################################################################################################################################################################################################
+######################################################################################################################################################################################
-#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH        HELPER
+#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH
 #							PORT	PORT(S)		DEST		LIMIT		GROUP
 #SECTION ALL
 #SECTION ESTABLISHED

Shorewall/configfiles/shorewall.conf

@@ -41,8 +41,6 @@ MACLIST_LOG_LEVEL=info
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
-
 SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
@@ -57,8 +55,6 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
 
-GEOIPDIR=/usr/share/xt_geoip/LE
-
 IPTABLES=
 
 IP=
@@ -69,8 +65,6 @@ LOCKFILE=
 
 MODULESDIR=
 
-NFACCT=
-
 PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
 
 PERL=/usr/bin/perl
@@ -114,9 +108,7 @@ ADD_SNAT_ALIASES=No
 
 ADMINISABSENTMINDED=Yes
 
-AUTOCOMMENT=Yes
+AUTO_COMMENT=Yes
-
-AUTOHELPERS=Yes
 
 AUTOMAKE=No
 
@@ -146,8 +138,6 @@ FASTACCEPT=No
 
 FORWARD_CLEAR_MARK=
 
-HELPERS=
-
 IMPLICIT_CONTINUE=No
 
 IPSET_WARNINGS=Yes
@@ -216,8 +206,6 @@ MACLIST_DISPOSITION=REJECT
 
 RELATED_DISPOSITION=ACCEPT
 
-RPFILTER_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
 SFILTER_DISPOSITION=DROP

Shorewall/configfiles/tcrules

@@ -10,8 +10,6 @@
 # See http://shorewall.net/PacketMarking.html for a detailed description of
 # the Netfilter/Shorewall packet marking mechanism.
 ##########################################################################################################################################
-FORMAT 2
-##########################################################################################################################################
 #ACTION	SOURCE		DEST		PROTO	DEST	SOURCE	USER	TEST	LENGTH	TOS   CONNBYTES		HELPER    PROBABILITY DSCP
 #						PORT(S)	PORT(S)
 

Shorewall/configfiles/tunnels

@@ -7,5 +7,5 @@
 # http://www.shorewall.net/manpages/shorewall-tunnels.html
 #
 ###############################################################################
-#TYPE			ZONE	GATEWAY(S)			GATEWAY
+#TYPE			ZONE	GATEWAYS			GATEWAY
-#								ZONE(S)
+#								ZONES

Shorewall/init.suse.sh

@@ -1,93 +0,0 @@
-#!/bin/sh
-#
-#     The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.2
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#     (c) 1999,2000,2001,2002,2003,2004,2005 - Tom Eastep (teastep@shorewall.net)
-#
-#	On most distributions, this file should be called /etc/init.d/shorewall.
-#
-#	Complete documentation is available at http://shorewall.net
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-#	If an error occurs while starting or restarting the firewall, the
-#	firewall is automatically stopped.
-#
-#	Commands are:
-#
-#	   shorewall start			  Starts the firewall
-#	   shorewall restart			  Restarts the firewall
-#	   shorewall reload			  Reload the firewall
-#						  (same as restart)
-#	   shorewall stop			  Stops the firewall
-#	   shorewall status			  Displays firewall status
-#
-
-### BEGIN INIT INFO
-# Provides:          shorewall
-# Required-Start:    $network $remote_fs
-# Required-Stop:     $network $remote_fs
-# Default-Start:     2 3 5
-# Default-Stop:      0 6
-# Short-Description: Configure the firewall at boot time
-# Description:       Configure the firewall according to the rules specified in
-#                    /etc/shorewall
-### END INIT INFO
-
-################################################################################
-# Give Usage Information						       #
-################################################################################
-usage() {
-    echo "Usage: $0 start|stop|reload|restart|status" >&2
-    exit 1
-}
-
-################################################################################
-# Get startup options (override default)
-################################################################################
-OPTIONS="-v0"
-
-#
-# The installer may alter this
-#
-. /usr/share/shorewall/shorewallrc
-
-if [ -f ${SYSCONFDIR}/shorewall ]; then
-    . ${SYSCONFDIR}/shorewall
-fi
-
-export SHOREWALL_INIT_SCRIPT=1
-
-################################################################################
-# E X E C U T I O N    B E G I N S   H E R E				       #
-################################################################################
-command="$1"
-shift
-
-case "$command" in
-    start)
-	exec $SBINDIR/shorewall $OPTIONS start $STARTOPTIONS
-	;;
-    restart|reload)
-	exec $SBINDIR/shorewall $OPTIONS restart $RESTARTOPTIONS
-	;;
-    status|stop)
-	exec $SBINDIR/shorewall $OPTIONS $command
-	;;
-    *)
-	usage
-	;;
-esac

Shorewall/install.sh

@@ -22,7 +22,7 @@
 #       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
 
-VERSION=4.5.5       #The Build script inserts the actual version
+VERSION=xxx       #The Build script inserts the actual version
 
 #
 # Change to the directory containing this script
@@ -244,6 +244,27 @@ esac
 
 OWNERSHIP="-o $OWNER -g $GROUP"
 
+#
+# Determine where to install the firewall script
+#
+
+if [ $PRODUCT = shorewall -a "$BUILD" = "$HOST" ]; then
+    #
+    # Fix up 'use Digest::' if SHA is installed
+    #
+    if perl -e 'use Digest::SHA;' 2> /dev/null ; then
+	sed -i 's/Digest::SHA1/Digest::SHA/' Perl/Shorewall/Chains.pm
+    fi
+    #
+    # Verify that Perl is installed
+    #
+    if ! perl -c Perl/compiler.pl; then
+	echo "ERROR: $Product $VERSION requires Perl which either is not installed or is not able to compile the Shorewall Perl code" >&2
+	echo "       Try perl -c $PWD/Perl/compiler.pl" >&2
+	exit 1
+    fi
+fi
+
 case "$HOST" in
     cygwin)
 	echo "Installing Cygwin-specific configuration..."
@@ -274,51 +295,6 @@ case "$HOST" in
 	;;
 esac
 
-if [ $PRODUCT = shorewall ]; then
-    if [ -n "$DIGEST" ]; then
-	#
-	# The user specified which digest to use
-	#
-	if [ "$DIGEST" != SHA ]; then
-	    if [ "$BUILD" = "$HOST" ] && ! eval perl -e \'use Digest::$DIGEST\;\' 2> /dev/null ; then
-		echo "ERROR: Perl compilation with Digest::$DIGEST failed" >&2
-		exit 1;
-	    fi
-
-	    eval sed -i \'s/Digest::SHA/Digest::$DIGEST/\' Perl/Shorewall/Chains.pm
-	fi
-    elif [ "$BUILD" = "$HOST" ]; then
-        #
-        # Fix up 'use Digest::' if SHA1 is installed
-        #
-	DIGEST=SHA
-	if ! perl -e 'use Digest::SHA;' 2> /dev/null ; then
-	    if perl -e 'use Digest::SHA1;' 2> /dev/null ; then
-		sed -i 's/Digest::SHA/Digest::SHA1/' Perl/Shorewall/Chains.pm
-		DIGEST=SHA1
-	    else
-		echo "ERROR: Shorewall $VERSION requires either Digest::SHA or Digest::SHA1" >&2
-		exit 1
-	    fi
-	fi
-    fi
-
-    if [ "$BUILD" = "$HOST" ]; then
-        #
-        # Verify that Perl and all required modules are installed
-        #
-	echo "Compiling the Shorewall Perl Modules with Digest::$DIGEST"
-
-	if ! perl -c Perl/compiler.pl; then
-	    echo "ERROR: $Product $VERSION requires Perl which either is not installed or is not able to compile the Shorewall Perl code" >&2
-	    echo "       Try perl -c $PWD/Perl/compiler.pl" >&2
-	    exit 1
-	fi
-    else
-	echo "Using Digest::$DIGEST"
-    fi
-fi
-
 if [ $BUILD != cygwin ]; then
     if [ `id -u` != 0 ] ; then
 	echo "Not setting file owner/group permissions, not running as root."
@@ -371,7 +347,7 @@ mkdir -p ${DESTDIR}/${CONFDIR}/$PRODUCT
 mkdir -p ${DESTDIR}${LIBEXECDIR}/$PRODUCT
 mkdir -p ${DESTDIR}${PERLLIBDIR}/Shorewall
 mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
-mkdir -p ${DESTDIR}${VARDIR}/$PRODUCT
+mkdir -p ${DESTDIR}/var/lib/$PRODUCT
 
 chmod 755 ${DESTDIR}${CONFDIR}/$PRODUCT
 chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT
@@ -634,14 +610,14 @@ if [ -f masq ]; then
     fi
 fi
 #
-# Install the Conntrack file
+# Install the Notrack file
 #
-run_install $OWNERSHIP -m 0644 conntrack           ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
+run_install $OWNERSHIP -m 0644 notrack           ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
-run_install $OWNERSHIP -m 0644 conntrack.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
+run_install $OWNERSHIP -m 0644 notrack.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
 
-if [ ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack ]; then
+if [ -z "$SPARSE" -a ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/notrack ]; then
-    run_install $OWNERSHIP -m 0600 conntrack${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack
+    run_install $OWNERSHIP -m 0600 notrack${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/notrack
-    echo "Conntrack file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack"
+    echo "Notrack file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/notrack"
 fi
 
 #
@@ -698,6 +674,10 @@ if [ -z "$SPARSE" -a ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/tunnels ]; then
     echo "Tunnels file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/tunnels"
 fi
 
+if [ -z "$SPARSE" -a ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/blacklist ]; then
+    run_install $OWNERSHIP -m 0600 blacklist${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/blacklist
+    echo "Blacklist file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/blacklist"
+fi
 #
 # Install the blacklist rules file
 #
@@ -970,6 +950,12 @@ fi
 
 cd ..
 
+#
+# Install the Standard Actions file
+#
+install_file actions.std ${DESTDIR}${SHAREDIR}/$PRODUCT/actions.std 0644
+echo "Standard actions file installed as ${DESTDIR}${SHAREDIR}d/$PRODUCT/actions.std"
+
 #
 # Install the  Makefiles
 #
@@ -999,9 +985,9 @@ cd ..
 #
 # Install the libraries
 #
-for f in lib.* Perl/lib.*; do
+for f in lib.* ; do
     if [ -f $f ]; then
-	install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$(basename $f) 0644
+	install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 0644
 	echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
     fi
 done
@@ -1121,7 +1107,7 @@ if [ -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${mac}" ]; then
 	perl -p -w -i -e 's/^STARTUP_ENABLED=No/STARTUP_ENABLED=Yes/;s/^IP_FORWARDING=On/IP_FORWARDING=Keep/;s/^SUBSYSLOCK=.*/SUBSYSLOCK=/;' ${CONFDIR}/$PRODUCT/$PRODUCT.conf
 	update-rc.d $PRODUCT enable
     elif [ -n "$SYSTEMD" ]; then
-	if systemctl enable ${PRODUCT}.service; then
+	if systemctl enable $PRODUCT; then
 	    echo "$Product will start automatically at boot"
 	fi
     elif mywhich insserv; then

Shorewall/lib.cli-std

@@ -181,7 +181,7 @@ get_config() {
 	if [ "$2" = Yes ]; then
 	    case $STARTUP_ENABLED in
 		No|no|NO)
-		    echo "   ERROR: $g_product startup is disabled. To enable startup, set STARTUP_ENABLED=Yes in ${g_confdir}/${g_program}.conf" >&2
+		    echo "   ERROR: $g_product startup is disabled. To enable startup, set STARTUP_ENABLED=Yes in ${CONFDIR}/${g_program}.conf" >&2
 		    exit 2
 		    ;;
 		Yes|yes|YES)
@@ -1571,7 +1571,7 @@ usage() # $1 = exit status
     echo "   allow <address> ..."
     echo "   check [ -e ] [ -r ] [ -p ] [ -r ] [ -T ] [ <directory> ]"
     echo "   clear"
-    echo "   compile [ -e ] [ -p ] [ -t ] [ -d ] [ -T ] [ <directory name> ] [ <path name> ]"
+    echo "   compile [ -e ] [ -d ] [ <directory name> ] [ <path name> ]"
     echo "   delete <interface>[:<host-list>] ... <zone>"
     echo "   disable <interface>"
     echo "   drop <address> ..."
@@ -1628,9 +1628,7 @@ usage() # $1 = exit status
     echo "   show macros"
     echo "   show marks"
     echo "   show [ -x ] mangle|nat|raw|rawpost|routing"
-    echo "   show nfacct"
     echo "   show policies"
-    echo "   show routing"
     echo "   show tc [ device ]"
     echo "   show vardir"
     echo "   show zones"

Shorewall/lib.core

@@ -171,6 +171,28 @@ interface_is_up() {
     [ -n "$($IP -$g_family link list dev $1 2> /dev/null | grep -e '[<,]UP[,>]')" ]
 }
 
+#
+# Determine if interface is usable from a Netfilter perspective
+#
+interface_is_usable() # $1 = interface
+{
+    [ "$1" = lo ] && return 0
+    interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != :: ] && run_isusable_exit $1
+}
+
+#
+# Find interface addresses--returns the set of addresses assigned to the passed
+# device
+#
+find_interface_addresses() # $1 = interface
+{
+    if [ $g_family -eq 4 ]; then
+	$IP -f inet addr show $1 2> /dev/null | grep inet\  | sed 's/\s*inet //;s/\/.*//;s/ peer.*//'
+    else
+	$IP -f inet6 addr show $1 2> /dev/null | grep 'inet6 2' | sed 's/\s*inet6 //;s/\/.*//;s/ peer.*//'
+    fi
+}
+
 #
 #  echo the list of networks routed out of a given interface
 #
@@ -182,6 +204,7 @@ get_routed_networks() # $1 = interface name, $2-n = Fatal error message
 
     [ $g_family -eq 4 ] && mask=32 || mask=128
 
+
     $IP -$g_family route show dev $1 2> /dev/null |
 	while read address rest; do
 	    case "$address" in
@@ -339,16 +362,6 @@ replace_default_route() # $1 = USE_DEFAULT_RT
     fi
 }
 
-#
-# Delete default routes with metric 0 from the passed routing table
-#
-delete_default_routes() # $1 = table number
-{
-    $IP -$g_family route ls table $1 | fgrep default | fgrep -v metric | while read route; do
-	qt $IP -$g_family route del $route
-    done
-} 
-
 restore_default_route() # $1 = USE_DEFAULT_RT
 {
     local result
@@ -630,37 +643,9 @@ EOF
 #################################################################################
 #                        IPv4-specific Functions
 #################################################################################
-#
-# Determine if interface is usable from a Netfilter perspective
-#
-interface_is_usable() # $1 = interface
-{
-    local status;
-    status=0
-
-    if [ "$1" != lo ]; then
-	if interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != 0.0.0.0 ]; then
-	    [ "$COMMAND" = enable ] || run_isusable_exit $1
-	    status=$?
-	else
-	    status=1
-	fi
-    fi
-
-    return $status
-}
-
-#
-# Find interface addresses--returns the set of addresses assigned to the passed device
-#
-find_interface_addresses() # $1 = interface
-{
-    $IP -f inet addr show $1 2> /dev/null | grep inet\  | sed 's/\s*inet //;s/\/.*//;s/ peer.*//'
-}
-
-#
 # Find the value 'weight' in the passed arguments then echo the next value
 #
+
 find_weight() {
     while [ $# -gt 1 ]; do
 	[ "x$1" = xweight ] && echo $2 && return
@@ -916,12 +901,7 @@ add_gateway() # $1 = Delta $2 = Table Number
 	delta=$1
 
 	if ! echo $route | fgrep -q ' nexthop '; then
-	    if echo $route | fgrep -q via; then
 	    route=`echo $route | sed 's/via/nexthop via/'`
-	    else
-		route="nexthop $route"
-	    fi
-
 	    dev=$(find_device $route)
 	    if [ -f ${VARDIR}/${dev}_weight ]; then
 		weight=`cat ${VARDIR}/${dev}_weight`
@@ -1036,34 +1016,6 @@ get_all_bcasts()
 #################################################################################
 #                        IPv6-specific Functions
 #################################################################################
-#
-# Determine if interface is usable from a Netfilter perspective
-#
-interface_is_usable() # $1 = interface
-{
-    local status;
-    status=0
-
-    if [ "$1" != lo ]; then
-	if interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != :: ]; then
-	    [ "$COMMAND" = enable ] || run_isusable_exit $1
-	    status=$?
-	else
-	    status=1
-	fi
-    fi
-
-    return $status
-}
-
-#
-# Find interface addresses--returns the set of addresses assigned to the passed device
-#
-find_interface_addresses() # $1 = interface
-{
-    $IP -f inet6 addr show $1 2> /dev/null | grep 'inet6 2' | sed 's/\s*inet6 //;s/\/.*//;s/ peer.*//'
-}
-
 #
 # Get all interface addresses with VLSMs
 #

Shorewall/manpages/shorewall-accounting.xml

@@ -294,25 +294,8 @@
             </varlistentry>
 
             <varlistentry>
-              <term><emphasis
+              <term>NFLOG[(nflog-parameters)] - Added in
-              role="bold">NFACCT</emphasis>(<replaceable>object</replaceable>)</term>
+              Shorewall-4.4.20.</term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.7. Provides a form of accounting
-                that survives <command>shorewall stop/shorewall</command>
-                start and <command>shorewall restart</command>. Requires the
-                NFaccnt Match capability in your kernel and iptables.
-                <replaceable>object</replaceable> names an nfacct object (see
-                man nfaccnt(8)). Multiple rules can specify the same
-                <replaceable>object</replaceable>; all packets that match any
-                of the rules increment the packet and bytes count of the
-                object.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">NFLOG</emphasis>[(nflog-parameters)]
-              - Added in Shorewall-4.4.20.</term>
 
               <listitem>
                 <para>Causes each matching packet to be sent via the currently
@@ -323,7 +306,7 @@
             </varlistentry>
 
             <varlistentry>
-              <term><emphasis role="bold">COMMENT</emphasis></term>
+              <term>COMMENT</term>
 
               <listitem>
                 <para>The remainder of the line is treated as a comment which
@@ -556,8 +539,7 @@
 
       <varlistentry>
         <term><emphasis role="bold">IPSEC - <emphasis>option-list</emphasis>
-        (Optional - Added in Shorewall 4.4.13 but broken until 4.5.4.1
+        (Optional - Added in Shorewall 4.4.13 )</emphasis></term>
-        )</emphasis></term>
 
         <listitem>
           <para>The option-list consists of a comma-separated list of options
@@ -671,52 +653,29 @@
                 match the rule.</para>
               </listitem>
             </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">in</emphasis></term>
-
-              <listitem>
-                <para>May only be used in the FORWARD section and must be the
-                first or the only item the list. Indicates that matching
-                packets have been decrypted in input.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">out</emphasis></term>
-
-              <listitem>
-                <para>May only be used in the FORWARD section and must be the
-                first or the only item in the list. Indicates that matching
-                packets will be encrypted on output.</para>
-              </listitem>
-            </varlistentry>
           </variablelist>
 
-          <para>If this column is non-empty and sections are not used,
+          <para>If this column is non-empty, then:</para>
-          then:</para>
 
           <itemizedlist>
             <listitem>
-              <para>A chain NAME appearing in the ACTION column must be a
+              <para>A chain NAME may appearing in the ACTION column must be a
               chain branched either directly or indirectly from the <emphasis
-              role="bold">accipsecin</emphasis> or <emphasis
+              role="bold">accountin</emphasis> or <emphasis
-              role="bold">accipsecout</emphasis> chain.</para>
+              role="bold">accountout</emphasis> chain.</para>
             </listitem>
 
             <listitem>
               <para>The CHAIN column must contain either <emphasis
-              role="bold">accipsecin</emphasis> or <emphasis
+              role="bold">accountin</emphasis> or <emphasis
-              role="bold">accipsecout</emphasis> or a chain branched either
+              role="bold">accountout</emphasis> or a chain branched either
               directly or indirectly from those chains.</para>
             </listitem>
+          </itemizedlist>
 
-            <listitem>
           <para>These rules will NOT appear in the <emphasis
           role="bold">accounting</emphasis> chain.</para>
         </listitem>
-          </itemizedlist>
-        </listitem>
       </varlistentry>
     </variablelist>
 

Shorewall/manpages/shorewall-blacklist.xml

@@ -23,10 +23,8 @@
   <refsect1>
     <title>Description</title>
 
-    <para>The blacklist file is used to perform static blacklisting by source
+    <para>The blacklist file is used to perform static blacklisting. You can
-    address (IP or MAC), or by application. The use of this file is deprecated
+    blacklist by source address (IP or MAC), or by application.</para>
-    and beginning with Shorewall 4.5.7, the file is no longer
-    installed.</para>
 
     <para>The columns in the file are as follows (where the column name is
     followed by a different name in parentheses, the different name is used in

Shorewall/manpages/shorewall-interfaces.xml

@@ -202,7 +202,7 @@ loc     eth2            -</programlisting>
                 changed; the value assigned to the setting will be the value
                 specified (if any) or 1 if no value is given.</para>
 
-                <para></para>
+                <para/>
 
                 <note>
                   <para>This option does not work with a wild-card
@@ -236,7 +236,7 @@ loc     eth2            -</programlisting>
 
                 <para>8 - do not reply for all local addresses</para>
 
-                <para></para>
+                <para/>
 
                 <note>
                   <para>This option does not work with a wild-card
@@ -244,7 +244,7 @@ loc     eth2            -</programlisting>
                   the INTERFACE column.</para>
                 </note>
 
-                <para></para>
+                <para/>
 
                 <warning>
                   <para>Do not specify <emphasis
@@ -343,22 +343,13 @@ loc     eth2            -</programlisting>
             </varlistentry>
 
             <varlistentry>
-              <term><emphasis role="bold">ignore[=1]</emphasis></term>
+              <term><emphasis role="bold">ignore</emphasis></term>
 
               <listitem>
                 <para>When specified, causes the generated script to ignore
                 up/down events from Shorewall-init for this device.
                 Additionally, the option exempts the interface from hairpin
-                filtering. When '=1' is omitted, the ZONE column must contain
+                filtering.</para>
-                '-' and <option>ignore</option> must be the only
-                OPTION.</para>
-
-                <para>Beginning with Shorewall 4.5.5, may be specified as
-                '<option>ignore=1</option>' which only causes the generated
-                script to ignore up/down events from Shorewall-init; hairpin
-                filtering is still applied. In this case, the above
-                restrictions on the ZONE and OPTIONS columns are
-                lifted.</para>
               </listitem>
             </varlistentry>
 
@@ -394,7 +385,7 @@ loc     eth2            -</programlisting>
         1
         teastep@lists:~$ </programlisting>
 
-                <para></para>
+                <para/>
 
                 <note>
                   <para>This option does not work with a wild-card
@@ -636,20 +627,6 @@ loc     eth2            -</programlisting>
               </listitem>
             </varlistentry>
 
-            <varlistentry>
-              <term>rpfilter</term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.7. This is an anti-spoofing
-                measure that requires the 'RPFilter Match' capability in your
-                iptables and kernel. It provides a more efficient alternative
-                to the <option>sfilter</option> option below. It performs a
-                function similar to <option>routefilter</option> (see above)
-                but works with Multi-ISP configurations that do now use
-                balanced routes.</para>
-              </listitem>
-            </varlistentry>
-
             <varlistentry>
               <term>sfilter=(<emphasis>net</emphasis>[,...])</term>
 
@@ -682,7 +659,7 @@ loc     eth2            -</programlisting>
                 changed; the value assigned to the setting will be the value
                 specified (if any) or 1 if no value is given.</para>
 
-                <para></para>
+                <para/>
 
                 <note>
                   <para>This option does not work with a wild-card

Shorewall/manpages/shorewall-masq.xml

@@ -509,22 +509,6 @@
           restart</command>.</para>
         </listitem>
       </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">ORIGINAL DEST</emphasis> (origdest) -
-        [<emphasis
-        role="bold">-</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>]</term>
-
-        <listitem>
-          <para>(Optional) Added in Shorewall 4.5.6. This column may be
-          included and may contain one or more addresses (host or network)
-          separated by commas. Address ranges are not allowed. When this
-          column is supplied, rules are generated that require that the
-          original destination address matches one of the listed addresses. It
-          is useful for specifying that SNAT should occur only for connections
-          that were acted on by a DNAT when they entered the firewall.</para>
-        </listitem>
-      </varlistentry>
     </variablelist>
   </refsect1>
 

Shorewall/manpages/shorewall-notrack.xml

@@ -3,34 +3,33 @@
 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
 <refentry>
   <refmeta>
-    <refentrytitle>shorewall6-conntrack</refentrytitle>
+    <refentrytitle>shorewall6-notrack</refentrytitle>
 
     <manvolnum>5</manvolnum>
   </refmeta>
 
   <refnamediv>
-    <refname>conntrack</refname>
+    <refname>notrack</refname>
 
-    <refpurpose>shorewall conntrack file</refpurpose>
+    <refpurpose>shorewall notrack file</refpurpose>
   </refnamediv>
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/conntrack</command>
+      <command>/etc/shorewall/notrack</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
   <refsect1>
     <title>Description</title>
 
-    <para>The original intent of the <emphasis role="bold">notrack</emphasis>
+    <para>The original intent of the notrack file was to exempt certain
-    file was to exempt certain traffic from Netfilter connection tracking.
+    traffic from Netfilter connection tracking. Traffic matching entries in
-    Traffic matching entries in the file were not to be tracked.</para>
+    this file were not to be tracked.</para>
 
     <para>The role of the file was expanded in Shorewall 4.4.27 to include all
-    rules that can be added in the Netfilter <emphasis
+    rules tht can be added in the Netfilter <emphasis
-    role="bold">raw</emphasis> table. In 4.5.7, the file's name was changed to
+    role="bold">raw</emphasis> table.</para>
-    <emphasis role="bold">conntrack</emphasis>.</para>
 
     <para>The file supports two different column layouts: FORMAT 1 and FORMAT
     2, FORMAT 1 being the default. The two differ in that FORMAT 2 has an
@@ -46,13 +45,6 @@
     <para>where <replaceable>format</replaceable> is either <emphasis
     role="bold">1</emphasis> or <emphasis role="bold">2</emphasis>.</para>
 
-    <para>Comments may be attached to Netfilter rules generated from entries
-    in this file through the use of COMMENT lines. These lines begin with the
-    word COMMENT; the remainder of the line is treated as a comment which is
-    attached to subsequent rules until another COMMENT line is found or until
-    the end of the file is reached. To stop adding comments to rules, use a
-    line with only the word COMMENT.</para>
-
     <para>The columns in the file are as follows (where the column name is
     followed by a different name in parentheses, the different name is used in
     the alternate specification syntax).</para>
@@ -61,132 +53,35 @@
       <varlistentry>
         <term><emphasis role="bold">ACTION</emphasis> - {<emphasis
         role="bold">NOTRACK</emphasis>|<emphasis
-        role="bold">CT</emphasis>:<emphasis
+        role="bold">CT</emphasis>:<replaceable>option</replaceable>[:<replaceable>arg,...</replaceable>]}</term>
-        role="bold">helper</emphasis>:<replaceable>name</replaceable>[(<replaceable>arg</replaceable>=<replaceable>val</replaceable>[,...])|<emphasis
-        role="bold">CT:notrack</emphasis>}</term>
 
         <listitem>
           <para>This column is only present when FORMAT = 2. Values other than
           NOTRACK require <firstterm>CT Target </firstterm>support in your
           iptables and kernel.</para>
 
+          <para>Possible values for <replaceable>option</replaceable> and
+          <replaceable>arg</replaceable>s are:</para>
+
           <itemizedlist>
             <listitem>
-              <para><option>NOTRACK</option> or
+              <para><option>notrack</option> (no
-              <option>CT:notrack</option></para>
+              <replaceable>arg</replaceable>)</para>
 
-              <para>Disables connection tracking for this packet.</para>
+              <para>Disables connection tracking for this packet, the same as
+              if NOTRACK has been specified in this column.</para>
             </listitem>
 
             <listitem>
               <para><option>helper</option>:<replaceable>name</replaceable></para>
 
-              <para>Attach the helper identified by the
+              <para>Use the helper identified by the name to this connection.
-              <replaceable>name</replaceable> to this connection. This is more
+              This is more flexible than loading the conntrack helper with
-              flexible than loading the conntrack helper with preset
+              preset ports.</para>
-              ports.</para>
-
-              <para>At this writing, the available helpers are:</para>
-
-              <variablelist>
-                <varlistentry>
-                  <term>amanda</term>
-
-                  <listitem>
-                    <para>Requires that the amanda netfilter helper is
-                    present.</para>
             </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>ftp</term>
 
             <listitem>
-                    <para>Requires that the FTP netfilter helper is
+              <para><option>ctevents</option>:<replaceable>event</replaceable>,...</para>
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>irc</term>
-
-                  <listitem>
-                    <para>Requires that the IRC netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>netbios-ns</term>
-
-                  <listitem>
-                    <para>Requires that the netbios_ns (sic) helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>RAS and Q.931</term>
-
-                  <listitem>
-                    <para>These require that the H323 netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>pptp</term>
-
-                  <listitem>
-                    <para>Requires that the pptp netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>sane</term>
-
-                  <listitem>
-                    <para>Requires that the SANE netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>sip</term>
-
-                  <listitem>
-                    <para>Requires that the SIP netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>snmp</term>
-
-                  <listitem>
-                    <para>Requires that the SNMP netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>tftp</term>
-
-                  <listitem>
-                    <para>Requires that the TFTP netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-              </variablelist>
-
-              <para>May be followed by an option list of
-              <replaceable>arg</replaceable>=<replaceable>val</replaceable>
-              pairs in parentheses:</para>
-
-              <itemizedlist>
-                <listitem>
-                  <para><option>ctevents</option>=<replaceable>event</replaceable>[,...]</para>
 
               <para>Only generate the specified conntrack events for this
               connection. Possible event types are: <emphasis
@@ -197,21 +92,24 @@
               role="bold">assured</emphasis>, <emphasis
               role="bold">protoinfo</emphasis>, <emphasis
               role="bold">helper</emphasis>, <emphasis
-                  role="bold">mark</emphasis> (this is connection mark, not
+              role="bold">mark</emphasis> (this is connection mark, not packet
-                  packet mark), <emphasis role="bold">natseqinfo</emphasis>,
+              mark), <emphasis role="bold">natseqinfo</emphasis>, and
-                  and <emphasis role="bold">secmark</emphasis>. If more than
+              <emphasis role="bold">secmark</emphasis>.</para>
-                  one <emphasis>event</emphasis> is listed, the
-                  <replaceable>event</replaceable> list must be enclosed in
-                  parentheses (e.g., ctevents=(new,related)).</para>
             </listitem>
 
             <listitem>
-                  <para><option>expevents</option><option>=new</option></para>
+              <para><option>expevents</option><option>:new</option></para>
 
-                  <para>Only generate a <emphasis role="bold">new</emphasis>
+              <para>Only generate a new expectation events for this
-                  expectation events for this connection.</para>
+              connection.</para>
             </listitem>
-              </itemizedlist>
+
+            <listitem>
+              <para><option>zone</option>:<replaceable>id</replaceable></para>
+
+              <para>Assign this packet to zone <replaceable>id</replaceable>
+              and only have lookups done in that zone. By default, packets
+              have zone 0.</para>
             </listitem>
           </itemizedlist>
 
@@ -232,9 +130,13 @@
           url="shorewall-exclusion.html">shorewall-exclusion</ulink>
           (5)).</para>
 
-          <para>Beginning with Shorewall 4.5.7, <option>all</option> can be
+          <para>Comments may be attached to Netfilter rules generated from
-          used as the <replaceable>zone</replaceable> name to mean
+          entries in this file through the use of COMMENT lines. These lines
-          <firstterm>all zones</firstterm>.</para>
+          begin with the word COMMENT; the remainder of the line is treated as
+          a comment which is attached to subsequent rules until another
+          COMMENT line is found or until the end of the file is reached. To
+          stop adding comments to rules, use a line with only the word
+          COMMENT.</para>
         </listitem>
       </varlistentry>
 
@@ -323,14 +225,6 @@
     </variablelist>
   </refsect1>
 
-  <refsect1>
-    <title>EXAMPLE</title>
-
-    <programlisting>#ACTION                       SOURCE            DEST               PROTO            DEST              SOURCE              USER/GROUP
-#                                                                                   PORT(S)           PORT(S)
-CT:helper:ftp(expevents=new)  fw                -                  tcp              21              </programlisting>
-  </refsect1>
-
   <refsect1>
     <title>FILES</title>
 

Shorewall/manpages/shorewall-providers.xml

@@ -270,20 +270,6 @@
                 <filename>shorewall.conf</filename>.</para>
               </listitem>
             </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">tproxy</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.4. Used for supporting the TPROXY
-                action in shorewall-tcrules(5). See <ulink
-                url="http://www.shorewall.net/Shorewall_Squid_Usage.html">http://www.shorewall.net/Shorewall_Squid_Usage.html</ulink>.
-                When specified, the MARK, DUPLICATE and GATEWAY columns should
-                be empty, INTERFACE should be set to 'lo' and
-                <option>tproxy</option> should be the only OPTION. Only one
-                <option>tproxy</option> provider is allowed.</para>
-              </listitem>
-            </varlistentry>
           </variablelist>
         </listitem>
       </varlistentry>

Shorewall/manpages/shorewall-rules.xml

@@ -503,19 +503,6 @@
                 rule, it is passed on to the next rule.</para>
               </listitem>
             </varlistentry>
-
-            <varlistentry>
-              <term>HELPER</term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.7. This action requires that the
-                HELPER column contains the name of the Netfilter helper to be
-                associated with connections matching this connection. May only
-                be specified in the NEW section and is useful for being able
-                to specify a helper when the applicable policy is ACCEPT. No
-                destination zone should be specified in HELPER rules.</para>
-              </listitem>
-            </varlistentry>
           </variablelist>
 
           <para>The <replaceable>target</replaceable> may optionally be
@@ -576,7 +563,7 @@
         role="bold">-</emphasis>]}<emphasis
         role="bold">[:</emphasis><emphasis>interface</emphasis>][<emphasis
         role="bold">:</emphasis>{<emphasis>address-or-range</emphasis>[,<emphasis>address-or-range</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>|<emphasis
-        role="bold">+</emphasis><emphasis>ipset</emphasis>|<replaceable>^countrycode-list</replaceable>}</term>
+        role="bold">+</emphasis><emphasis>ipset</emphasis>}</term>
 
         <listitem>
           <para>Source hosts to which the rule applies. May be a
@@ -652,18 +639,6 @@
           url="shorewall-interfaces.html">shorewall-interfaces</ulink>
           (5).</para>
 
-          <para>Beginning with Shorewall 4.5.4, A
-          <replaceable>countrycode-list</replaceable> may be specified. A
-          countrycode-list is a comma-separated list of up to 15 two-character
-          ISO-3661 country codes enclosed in square brackets ('[...]') and
-          preceded by a caret ('^'). When a single country code is given, the
-          square brackets may be omitted. A list of country codes supported by
-          Shorewall may be found at <ulink
-          url="http://www.shorewall.net/ISO-3661.html">http://www.shorewall.net/ISO-3661.html</ulink>.
-          Specifying a <replaceable>countrycode-list</replaceable> requires
-          <firstterm>GeoIP Match</firstterm> support in your iptables and
-          Kernel.</para>
-
           <para>You may exclude certain hosts from the set already defined
           through use of an <emphasis>exclusion</emphasis> (see <ulink
           url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
@@ -751,7 +726,7 @@
         role="bold">+</emphasis>][<emphasis
         role="bold">-</emphasis>]}<emphasis
         role="bold">[:{</emphasis><emphasis>interface</emphasis>|<emphasis>address-or-range</emphasis>[,<emphasis>address-or-range</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>|<emphasis
-        role="bold">+</emphasis><emphasis>ipset</emphasis>|<emphasis>^countrycode-list</emphasis>}][<option>:</option><replaceable>port</replaceable>[:<emphasis
+        role="bold">+</emphasis><emphasis>ipset</emphasis>}][<option>:</option><replaceable>port</replaceable>[:<emphasis
         role="bold">random</emphasis>]]</term>
 
         <listitem>
@@ -769,18 +744,6 @@
           "+" to indicate that the rule is to apply to intra-zone traffic as
           well as inter-zone traffic.</para>
 
-          <para>Beginning with Shorewall 4.5.4, A
-          <replaceable>countrycode-list</replaceable> may be specified. A
-          countrycode-list is a comma-separated list of up to 15 two-character
-          ISO-3661 country codes enclosed in square brackets ('[...]') and
-          preceded by a caret ('^'). When a single country code is given, the
-          square brackets may be omitted. A list of country codes supported by
-          Shorewall may be found at <ulink
-          url="http://www.shorewall.net/ISO-3661.html">http://www.shorewall.net/ISO-3661.html</ulink>.
-          Specifying a <replaceable>countrycode-list</replaceable> requires
-          <firstterm>GeoIP Match</firstterm> support in your iptables and
-          Kernel.</para>
-
           <para>When <emphasis role="bold">none</emphasis> is used either in
           the <emphasis role="bold">SOURCE</emphasis> or <emphasis
           role="bold">DEST</emphasis> column, the rule is ignored.</para>
@@ -819,7 +782,7 @@
             </orderedlist></para>
 
           <blockquote>
-            <para></para>
+            <para/>
 
             <para>Except when <emphasis role="bold">all</emphasis>[<emphasis
             role="bold">+]|[-</emphasis>] is specified, the server may be
@@ -1097,7 +1060,8 @@
       <varlistentry>
         <term><emphasis role="bold">USER/GROUP</emphasis> (user) - [<emphasis
         role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
-        role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>]</term>
+        role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
+        role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
 
         <listitem>
           <para>This optional column may only be non-empty if the SOURCE is
@@ -1138,11 +1102,15 @@
             </varlistentry>
 
             <varlistentry>
-              <term>2001-2099</term>
+              <term>+upnpd</term>
 
               <listitem>
-                <para>UIDs 2001 through 2099 (Shorewall 4.5.6 and
+                <para>program named upnpd</para>
-                later)</para>
+
+                <important>
+                  <para>The ability to specify a program name was removed from
+                  Netfilter in kernel version 2.6.14.</para>
+                </important>
               </listitem>
             </varlistentry>
           </variablelist>
@@ -1364,54 +1332,6 @@
           restart</command>.</para>
         </listitem>
       </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">HELPER</emphasis> - [helper]</term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.7.</para>
-
-          <para>In the NEW section, causes the named conntrack
-          <replaceable>helper</replaceable> to be associated with this
-          connection; the contents of this column are ignored unless ACTION is
-          ACCEPT*, DNAT* or REDIRECT*.</para>
-
-          <para>In the RELATED section, will only match if the related
-          connection has the named <replaceable>helper</replaceable>
-          associated with it.</para>
-
-          <para>The <replaceable>helper</replaceable> may be one of:</para>
-
-          <simplelist>
-            <member><option>amanda</option></member>
-
-            <member><option>ftp</option></member>
-
-            <member><option>irc</option></member>
-
-            <member><option>netbios-ns</option></member>
-
-            <member><option>pptp</option></member>
-
-            <member><option>Q.931</option></member>
-
-            <member><option>RAS</option></member>
-
-            <member><option>sane</option></member>
-
-            <member><option>sip</option></member>
-
-            <member><option>snmp</option></member>
-
-            <member><option>tftp</option></member>
-          </simplelist>
-
-          <para>If the HELPERS option is specified in <ulink
-          url="shorewall.conf.html">shorewall.conf</ulink>(5), then any module
-          specified in this column most be listed in the HELPERS
-          setting.</para>
-        </listitem>
-      </varlistentry>
     </variablelist>
   </refsect1>
 
@@ -1615,19 +1535,6 @@
         DNAT        net             dmz:$BACKUP tcp         80           -         -          -         -         -       -             -        -          primary_down</programlisting>
         </listitem>
       </varlistentry>
-
-      <varlistentry>
-        <term>Example 13:</term>
-
-        <listitem>
-          <para>Drop all email from the <emphasis>Anonymous Proxy</emphasis>
-          and <emphasis>Satellite Provider</emphasis> address ranges:</para>
-
-          <programlisting>        #ACTION                       SOURCE           DEST           PROTO       DEST
-        #                                                                         PORT(S)
-        DROP                          net:^A1,A2       fw             tcp         25</programlisting>
-        </listitem>
-      </varlistentry>
     </variablelist>
   </refsect1>
 
@@ -1644,10 +1551,7 @@
     url="http://www.shorewall.net/ipsets.html">http://www.shorewall.net/ipsets.html</ulink></para>
 
     <para><ulink
-    url="http://shorewall.net/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
+    url="http://shorewall.net/configuration_file_basics.htm#Pairs">http://shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
-
-    <para><ulink
-    url="http://www.shorewall.net/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink></para>
 
     <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
     shorewall-blacklist(5), shorweall-blrules(5), shorewall-hosts(5),

Shorewall/manpages/shorewall-tcclasses.xml

@@ -11,7 +11,7 @@
   <refnamediv>
     <refname>tcclasses</refname>
 
-    <refpurpose>Shorewall file to define HTB and HFSC classes</refpurpose>
+    <refpurpose>Shorewall file to define HTB classes</refpurpose>
   </refnamediv>
 
   <refsynopsisdiv>
@@ -166,8 +166,8 @@
           marking the traffic you want to fit in the classes defined in here.
           Must be specified as '-' if the <emphasis
           role="bold">classify</emphasis> option is given for the interface in
-          <ulink url="shorewall-tcdevices.html">shorewall-tcdevices</ulink>(5)
+          <ulink
-          and you are running Shorewall 4.5.5 or earlier.</para>
+          url="shorewall-tcdevices.html">shorewall-tcdevices</ulink>(5)</para>
 
           <para>You can use the same marks for different interfaces.</para>
         </listitem>
@@ -175,7 +175,7 @@
 
       <varlistentry>
         <term><emphasis role="bold">RATE</emphasis> -
-        {-|<emphasis>rate</emphasis>[:<emphasis>dmax</emphasis>[:<emphasis>umax</emphasis>]]}</term>
+        <emphasis>rate</emphasis>[:<emphasis>dmax</emphasis>[:<emphasis>umax</emphasis>]]</term>
 
         <listitem>
           <para>The minimum bandwidth this class should get, when the traffic
@@ -185,12 +185,11 @@
           class exceed the CEIL of the parent class, things don't work
           well.</para>
 
-          <para>When using the HFSC queuing discipline, this column specify
+          <para>When using the HFSC queuing discipline, leaf classes may
-          the real-time (RT) service curve. leaf classes may specify
+          specify <replaceable>dmax</replaceable>, the maximum delay in
-          <replaceable>dmax</replaceable>, the maximum delay in milliseconds
+          milliseconds that the first queued packet for this class should
-          that the first queued packet for this class should experience. May
+          experience. May be expressed as an integer, optionally followed by
-          be expressed as an integer, optionally followed by 'ms' with no
+          'ms' with no intervening white space (e.g., 10ms).</para>
-          intervening white space (e.g., 10ms).</para>
 
           <para>HFSC leaf classes may also specify
           <replaceable>umax</replaceable>, the largest packet expected in this
@@ -199,18 +198,12 @@
           followed by 'b' with no intervening white space (e.g., 800b).
           <replaceable>umax</replaceable> may only be given if
           <replaceable>dmax</replaceable> is also given.</para>
-
-          <para>Beginning with Shorewall 4.5.6, HFSC classes may omit this
-          column (e.g, '-' in the column), provided that an
-          <replaceable>lsrate</replaceable> is specified (see CEIL below).
-          These rates are used to arbitrate between classes of the same
-          priority.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><emphasis role="bold">CEIL</emphasis> -
-        [<emphasis>lsrate</emphasis>:]<emphasis>rate</emphasis></term>
+        <emphasis>rate</emphasis></term>
 
         <listitem>
           <para>The maximum bandwidth this class is allowed to use when the
@@ -221,9 +214,6 @@
           here for setting the maximum bandwidth to the RATE of the parent
           class, or the OUT-BANDWIDTH of the device if there is no parent
           class.</para>
-
-          <para>Beginning with Shorewall 4.5.6, you can also specify an
-          <replaceable>lsrate</replaceable> (link sharing rate).</para>
         </listitem>
       </varlistentry>
 
@@ -263,7 +253,7 @@
                 <para>This is the default class for that interface where all
                 traffic should go, that is not classified otherwise.</para>
 
-                <para/>
+                <para></para>
 
                 <note>
                   <para>You must define <emphasis
@@ -320,7 +310,7 @@
                 limited to 64 bytes because we want only packets WITHOUT
                 payload to match.</para>
 
-                <para/>
+                <para></para>
 
                 <note>
                   <para>This option is only valid for ONE class per
@@ -440,121 +430,6 @@
                 assumed.</para>
               </listitem>
             </varlistentry>
-
-            <varlistentry>
-              <term>red=(<replaceable>redoption</replaceable>=<replaceable>value</replaceable>,
-              ...)</term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.6. When specified on a leaf
-                class, causes the class to use the RED (Random Early
-                Detection) queuing discipline rather than SFQ. See tc-red (8)
-                for additional information.</para>
-
-                <para>Allowable redoptions are:</para>
-
-                <variablelist>
-                  <varlistentry>
-                    <term>min <replaceable>min</replaceable></term>
-
-                    <listitem>
-                      <para>Average queue size at which marking becomes a
-                      possibility.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>max <replaceable>max</replaceable></term>
-
-                    <listitem>
-                      <para>At this average queue size, the marking
-                      probability is maximal. Must be at least twice
-                      <replaceable>min</replaceable> to prevent synchronous
-                      retransmits, higher for low
-                      <replaceable>min</replaceable>.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>probability
-                    <replaceable>probability</replaceable></term>
-
-                    <listitem>
-                      <para>Maximum probability for marking, specified as a
-                      floating point number from 0.0 to 1.0. Suggested values
-                      are 0.01 or 0.02 (1 or 2%, respectively).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>limit <replaceable>limit</replaceable></term>
-
-                    <listitem>
-                      <para>Hard limit on the real (not average) queue size in
-                      bytes. Further packets are dropped. Should be set higher
-                      than
-                      <replaceable>max</replaceable>+<replaceable>burst</replaceable>.
-                      It is advised to set this a few times higher than
-                      <replaceable>max</replaceable>. Shorewall requires that
-                      <replaceable>limit</replaceable> be at least twice
-                      <replaceable>min</replaceable>.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>burst <replaceable>burst</replaceable></term>
-
-                    <listitem>
-                      <para>Used for determining how fast the average queue
-                      size is influenced by the real queue size. Larger values
-                      make the calculation more sluggish, allowing longer
-                      bursts of traffic before marking starts. Real life
-                      experiments support the following guide‐line:
-                      (<replaceable>min</replaceable>+<replaceable>min</replaceable>+<replaceable>max</replaceable>)/(3*<replaceable>avpkt</replaceable>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>avpkt <replaceable>avpkt</replaceable></term>
-
-                    <listitem>
-                      <para>Optional. Specified in bytes. Used with burst to
-                      determine the time constant for average queue size
-                      calculations. 1000 is a good value and is the Shorewall
-                      default.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>bandwidth
-                    <replaceable>bandwidth</replaceable></term>
-
-                    <listitem>
-                      <para>Optional. This rate is used for calculating the
-                      average queue size after some idle time. Should be set
-                      to the bandwidth of your interface. Does not mean that
-                      RED will shape for you!</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>ecn</term>
-
-                    <listitem>
-                      <para>RED can either 'mark' or 'drop'. Explicit
-                      Congestion Notification allows RED to notify remote
-                      hosts that their rate exceeds the amount of bandwidth
-                      available. Non-ECN capable hosts can only be notified by
-                      dropping a packet. If this parameter is specified,
-                      packets which indicate that their hosts honor ECN will
-                      only be marked and not dropped, unless the queue size
-                      hits <replaceable>limit</replaceable> bytes. Needs a tc
-                      binary with RED support compiled in. Recommended.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
           </variablelist>
         </listitem>
       </varlistentry>
@@ -628,10 +503,6 @@
     <para><ulink
     url="http://shorewall.net/configuration_file_basics.htm#Pairs">http://shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>tc-hfsc(7)</para>
-
-    <para>tc-red(8)</para>
-
     <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
     shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
     shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),

Shorewall/manpages/shorewall-tcdevices.xml

@@ -179,17 +179,7 @@
       <varlistentry>
         <term><emphasis role="bold">OPTIONS</emphasis> - {<emphasis
         role="bold">-</emphasis>|<emphasis
-        role="bold">{classify</emphasis>|<emphasis
+        role="bold">{classify</emphasis>|hfsc} ,...}</term>
-        role="bold">hfsc</emphasis>|<emphasis
-        role="bold">linklayer</emphasis>={<emphasis
-        role="bold">ethernet</emphasis>|<emphasis
-        role="bold">atm</emphasis>|<emphasis
-        role="bold">adsl</emphasis>}|<emphasis
-        role="bold">tsize</emphasis>=<replaceable>tsize</replaceable>|<emphasis
-        role="bold">mtu</emphasis>=<replaceable>mtu</replaceable>|<emphasis
-        role="bold">mpu</emphasis>=<replaceable>mpu</replaceable>|<emphasis
-        role="bold">overhead</emphasis>=<replaceable>overhead</replaceable>}
-        ,...}</term>
 
         <listitem>
           <para><option>classify</option> ― When specified, Shorewall will not
@@ -200,34 +190,7 @@
           <para><option>hfsc</option> - Shorewall normally uses the
           <firstterm>Hierarchical Token Bucket</firstterm> queuing discipline.
           When <option>hfsc</option> is specified, the <firstterm>Hierarchical
-          Fair Service Curves</firstterm> discipline is used instead (see
+          Fair Service Curves</firstterm> discipline is used instead.</para>
-          tc-hfsc (7)).</para>
-
-          <para><emphasis role="bold">linklayer</emphasis> - Added in
-          Shorewall 4.5.6. Type of link (ethernet, atm, adsl). When specified,
-          causes scheduler packet size manipulation as described in tc-stab
-          (8). When this option is given, the following options may also be
-          given after it:</para>
-
-          <blockquote>
-            <para><emphasis
-            role="bold">mtu</emphasis>=<replaceable>mtu</replaceable> - The
-            device MTU; default 2048 (will be rounded up to a power of
-            two)</para>
-
-            <para><emphasis
-            role="bold">mpu</emphasis>=<replaceable>mpubytes</replaceable> -
-            Minimum packet size used in calculations. Smaller packets will be
-            rounded up to this size</para>
-
-            <para><emphasis
-            role="bold">tsize</emphasis>=<replaceable>tablesize</replaceable>
-            - Size table entries; default is 512</para>
-
-            <para><emphasis
-            role="bold">overhead</emphasis>=<replaceable>overheadbytes</replaceable>
-            - Number of overhead bytes per packet.</para>
-          </blockquote>
         </listitem>
       </varlistentry>
 
@@ -277,8 +240,6 @@
   <refsect1>
     <title>See ALSO</title>
 
-    <para>tc-hfsc (7)</para>
-
     <para><ulink
     url="http://shorewall.net/traffic_shaping.htm">http://shorewall.net/traffic_shaping.htm</ulink></para>
 

Shorewall/manpages/shorewall-tcfilters.xml

@@ -35,7 +35,7 @@
         <term>IPV4</term>
 
         <listitem>
-          <para>Following entries apply to IPv4.</para>
+          <para>Following entriess apply to IPv4.</para>
         </listitem>
       </varlistentry>
 

Shorewall/manpages/shorewall-tcrules.xml

@@ -38,34 +38,6 @@
       url="http://shorewall.net/MultiISP.html">http://shorewall.net/MultiISP.html</ulink>.</para>
     </important>
 
-    <para>Beginning with Shorewall 4.5.4, the tcrules file supports two
-    different formats:</para>
-
-    <variablelist>
-      <varlistentry>
-        <term>FORMAT 1 (default - deprecated)</term>
-
-        <listitem>
-          <para>The older limited-function version of TPROXY is
-          supported.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>FORMAT 2</term>
-
-        <listitem>
-          <para>The newer version of TPROXY is supported.</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-
-    <para>The format is specified by a line as follows:</para>
-
-    <blockquote>
-      <para><emphasis role="bold">FORMAT {1|2}</emphasis></para>
-    </blockquote>
-
     <para>The columns in the file are as follows (where the column name is
     followed by a different name in parentheses, the different name is used in
     the alternate specification syntax).</para>
@@ -435,81 +407,6 @@ SAME              $FW            0.0.0.0/0    tcp        80,443</programlisting>
               classes will have a value &gt; 256.</para>
             </listitem>
 
-            <listitem>
-              <para><emphasis role="bold">DIVERT</emphasis></para>
-
-              <para>Added in Shorewall 4.5.4 and only available when FORMAT is
-              2. Two DIVERT rule should preceed the TPROXY rule and should
-              select DEST PORT tcp 80 and SOURCE PORT tcp 80 respectively
-              (assuming that tcp port 80 is being proxied). DIVERT avoids
-              sending packets to the TPROXY target once a socket connection to
-              Squid3 has been established by TPROXY. DIVERT marks the packet
-              with a unique mark and exempts it from any rules that
-              follow.</para>
-            </listitem>
-
-            <listitem>
-              <para><emphasis
-              role="bold">TPROXY</emphasis>(<replaceable>mark</replaceable>[,[<replaceable>port</replaceable>][,[<replaceable>address</replaceable>]]])
-              -- FORMAT 1</para>
-
-              <para>Transparently redirects a packet without altering the IP
-              header. Requires a local provider to be defined in <ulink
-              url="shorewall-providers.html">shorewall-providers</ulink>(5).</para>
-
-              <para>There are three parameters to TPROXY - only the first
-              (mark) is required:</para>
-
-              <itemizedlist>
-                <listitem>
-                  <para><replaceable>mark</replaceable> - the MARK value
-                  corresponding to the local provider in <ulink
-                  url="shorewall-providers.html">shorewall-providers</ulink>(5).</para>
-                </listitem>
-
-                <listitem>
-                  <para><replaceable>port</replaceable> - the port on which
-                  the proxy server is listening. If omitted, the original
-                  destination port.</para>
-                </listitem>
-
-                <listitem>
-                  <para><replaceable>address</replaceable> - a local (to the
-                  firewall) IP address on which the proxy server is listening.
-                  If omitted, the IP address of the interface on which the
-                  request arrives.</para>
-                </listitem>
-              </itemizedlist>
-            </listitem>
-
-            <listitem>
-              <para><emphasis
-              role="bold">TPROXY</emphasis>([<replaceable>port</replaceable>][,<replaceable>address</replaceable>])
-              -- FORMAT 2</para>
-
-              <para>Transparently redirects a packet without altering the IP
-              header. Requires a tproxy provider to be defined in <ulink
-              url="shorewall-providers.html">shorewall-providers</ulink>(5).</para>
-
-              <para>There are three parameters to TPROXY - neither is
-              required:</para>
-
-              <itemizedlist>
-                <listitem>
-                  <para><replaceable>port</replaceable> - the port on which
-                  the proxy server is listening. If omitted, the original
-                  destination port.</para>
-                </listitem>
-
-                <listitem>
-                  <para><replaceable>address</replaceable> - a local (to the
-                  firewall) IP address on which the proxy server is listening.
-                  If omitted, the IP address of the interface on which the
-                  request arrives.</para>
-                </listitem>
-              </itemizedlist>
-            </listitem>
-
             <listitem>
               <para><emphasis role="bold">TTL</emphasis>([<emphasis
               role="bold">-</emphasis>|<emphasis
@@ -573,9 +470,6 @@ SAME              $FW            0.0.0.0/0    tcp        80,443</programlisting>
     AF43 =&gt; 0x26
     EF   =&gt; 0x2e</programlisting>
 
-              <para>To indicate more than one class, add their hex values
-              together and specify the result.</para>
-
               <para>May be optionally followed by ':' and a capital letter
               designating the chain where classification is to occur.</para>
 
@@ -614,9 +508,6 @@ Maximize-Reliability =&gt; 0x04,
 Minimize-Cost        =&gt; 0x02,
 Normal-Service       =&gt; 0x00</programlisting>
 
-              <para>To indicate more than one class, add their hex values
-              together and specify the result.</para>
-
               <para>When <replaceable>tos</replaceable> is given as a number,
               it may be optionally followed by '/' and a
               <replaceable>mask</replaceable>. When no

Shorewall/manpages/shorewall-tos.xml

@@ -96,16 +96,13 @@
         <emphasis>tos</emphasis></term>
 
         <listitem>
-          <para>Must may one of the following;</para>
+          <para>Must be one of the following;</para>
 
           <programlisting>        <emphasis role="bold">tos-minimize-delay</emphasis> (16)
         <emphasis role="bold">tos-maximize-throughput</emphasis> (8)
         <emphasis role="bold">tos-maximize-reliability</emphasis> (4)
         <emphasis role="bold">tos-minimize-cost</emphasis> (2)
         <emphasis role="bold">tos-normal-service</emphasis> (0)</programlisting>
-
-          <para>To specify more than one flag, add their values together and
-          specify the numeric result.</para>
         </listitem>
       </varlistentry>
 

Shorewall/manpages/shorewall-tunnels.xml

@@ -125,9 +125,9 @@
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">GATEWAY</emphasis>(S) (gateway or
+        <term><emphasis role="bold">GATEWAY</emphasis>S -
-        gateways) - <emphasis>address-or-range</emphasis> <emphasis
+        <emphasis>address-or-range</emphasis> <emphasis role="bold">[ , ...
-        role="bold">[ , ... ]</emphasis></term>
+        ]</emphasis></term>
 
         <listitem>
           <para>The IP address of the remote tunnel gateway. If the remote
@@ -144,8 +144,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">GATEWAY ZONES</emphasis> (gateway_zone or
+        <term><emphasis role="bold">GATEWAY ZONES</emphasis> (gateway_zone) -
-        gateway_zones) - [<emphasis>zone</emphasis>[<emphasis
+        [<emphasis>zone</emphasis>[<emphasis
         role="bold">,</emphasis><emphasis>zone</emphasis>]...]</term>
 
         <listitem>

Shorewall/manpages/shorewall.conf.xml

@@ -96,7 +96,7 @@
         role="bold">none</emphasis>}</term>
 
         <listitem>
-          <para></para>
+          <para/>
         </listitem>
       </varlistentry>
 
@@ -106,7 +106,7 @@
         role="bold">none</emphasis>}</term>
 
         <listitem>
-          <para></para>
+          <para/>
         </listitem>
       </varlistentry>
 
@@ -116,7 +116,7 @@
         role="bold">none</emphasis>}</term>
 
         <listitem>
-          <para></para>
+          <para/>
         </listitem>
       </varlistentry>
 
@@ -126,7 +126,7 @@
         role="bold">none</emphasis>}</term>
 
         <listitem>
-          <para></para>
+          <para/>
         </listitem>
       </varlistentry>
 
@@ -283,14 +283,14 @@
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">AUTOCOMMENT=</emphasis>[<emphasis
+        <term><emphasis role="bold">AUTO_COMMENT=</emphasis>[<emphasis
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
 
         <listitem>
-          <para>Formerly named AUTO_COMMENT. If set, if there is not a current
+          <para>If set, if there is not a current comment when a macro is
-          comment when a macro is invoked, the behavior is as if the first
+          invoked, the behavior is as if the first line of the macro file was
-          line of the macro file was "COMMENT &lt;macro name&gt;". The
+          "COMMENT &lt;macro name&gt;". The AUTO_COMMENT option has a default
-          AUTO_COMMENT option has a default value of 'Yes'.</para>
+          value of 'Yes'.</para>
 
           <para>The setting of the AUTOMAKE option is ignored if the
           <command>start</command> or <command>restart</command> command
@@ -299,49 +299,6 @@
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term><emphasis role="bold">AUTOHELPERS=</emphasis>[<emphasis
-        role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.7. When set to <option>Yes</option>
-          (the default), the generated ruleset will automatically associate
-          helpers with applications that require them (FTP, IRC, etc.). When
-          configuring your firewall on systems running kernel 3.5 or later, it
-          is recommended that you:</para>
-
-          <orderedlist>
-            <listitem>
-              <para>Set AUTOHELPERS=No.</para>
-            </listitem>
-
-            <listitem>
-              <para>Either:</para>
-
-              <orderedlist numeration="loweralpha">
-                <listitem>
-                  <para>Modify <ulink
-                  url="shorewall-conntrack.html">shorewall-conntrack</ulink>
-                  (5) to only apply helpers where they are required; or</para>
-                </listitem>
-
-                <listitem>
-                  <para>Specify the appropriate helper in the HELPER column in
-                  <ulink url="shorewall-rules.html">shorewall-rules</ulink>
-                  (5).</para>
-
-                  <note>
-                    <para>The macros for those applications requiring a helper
-                    automatically specify the appropriate HELPER where
-                    required.</para>
-                  </note>
-                </listitem>
-              </orderedlist>
-            </listitem>
-          </orderedlist>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><emphasis role="bold">AUTOMAKE=</emphasis>[<emphasis
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
@@ -525,7 +482,7 @@
           </itemizedlist>
 
           <blockquote>
-            <para></para>
+            <para/>
 
             <para>If CONFIG_PATH is not given or if it is set to the empty
             value then the contents of /usr/share/shorewall/configpath are
@@ -712,81 +669,6 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term><emphasis
-        role="bold">GEOIPDIR</emphasis>=[<emphasis>pathname</emphasis>]</term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.4. Specifies the pathname of the
-          directory containing the <firstterm>GeoIP Match</firstterm>
-          database. See <ulink
-          url="http://www.shorewall.net/ISO-3661.html">http://www.shorewall.net/ISO-3661.html</ulink>.
-          If not specified, the default value is
-          <filename>/usr/share/xt_geoip/LE</filename> which is the default
-          location of the little-endian database.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis
-        role="bold">HELPERS</emphasis>=[<emphasis>helper</emphasis>[,<replaceable>helper</replaceable>...]]</term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.7. This option lists the Netfilter
-          application helps that are to be enabled. If not specified, the
-          default is to enable all helpers.</para>
-
-          <para>Possible values for <replaceable>helper</replaceable>
-          are:</para>
-
-          <itemizedlist>
-            <listitem>
-              <para>amanda</para>
-            </listitem>
-
-            <listitem>
-              <para>ftp</para>
-            </listitem>
-
-            <listitem>
-              <para>h323</para>
-            </listitem>
-
-            <listitem>
-              <para>irc</para>
-            </listitem>
-
-            <listitem>
-              <para>netbios-ns</para>
-            </listitem>
-
-            <listitem>
-              <para>pptp</para>
-            </listitem>
-
-            <listitem>
-              <para>sane</para>
-            </listitem>
-
-            <listitem>
-              <para>sip</para>
-            </listitem>
-
-            <listitem>
-              <para>snmp</para>
-            </listitem>
-
-            <listitem>
-              <para>tftp</para>
-            </listitem>
-          </itemizedlist>
-
-          <para>When HELPERS is specified on a system running Kernel 3.5.0 or
-          later, automatic association of helpers to connections is
-          disabled.</para>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><emphasis role="bold">HIGH_ROUTE_MARKS=</emphasis>{<emphasis
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>}</term>
@@ -932,7 +814,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
             </varlistentry>
           </variablelist>
 
-          <para></para>
+          <para/>
 
           <blockquote>
             <para>If this variable is not set or is given an empty value
@@ -1142,7 +1024,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
             </listitem>
           </itemizedlist>
 
-          <para></para>
+          <para/>
 
           <blockquote>
             <para>For example, using the default LOGFORMAT, the log prefix for
@@ -1159,7 +1041,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
               control your firewall after you enable this option.</para>
             </important>
 
-            <para></para>
+            <para/>
 
             <caution>
               <para>Do not use this option if the resulting log messages will
@@ -1540,17 +1422,6 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term><emphasis
-        role="bold">NFACCT=</emphasis>[<emphasis>pathname</emphasis>]</term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.7. Specifies the pathname of the nfacct
-          utiliity. If not specified, Shorewall will use the PATH settting to
-          find the program.</para>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><emphasis role="bold">NULL_ROUTE_RFC1918=</emphasis>[<emphasis
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
@@ -1667,23 +1538,6 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
                   chain are appended to it.</para>
                 </listitem>
               </itemizedlist>
-
-              <para>An additional optimization was added in Shorewall 4.5.4.
-              If the last rule in a chain is an unqualified jump to a simple
-              target, then all immediately preceding rules with the same
-              simple target are omitted.</para>
-
-              <para>For example, consider this chain:</para>
-
-              <programlisting>	-A fw-net -p udp --dport 67:68 -j ACCEPT
-	-A fw-net -p udp --sport 1194 -j ACCEPT
-	-A fw-net -p 41 -j ACCEPT
-	-A fw-net -j ACCEPT
-</programlisting>
-
-              <para>Since all of the rules are jumps to the simple target
-              ACCEPT, this chain is totally optimized away and jumps to the
-              chain are replace with jumps to ACCEPT.</para>
             </listitem>
 
             <listitem>
@@ -1823,7 +1677,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
         role="bold">"</emphasis></term>
 
         <listitem>
-          <para></para>
+          <para/>
         </listitem>
       </varlistentry>
 
@@ -1993,33 +1847,6 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term><emphasis role="bold">RPFILTER_DISPOSITION=</emphasis>[<emphasis
-        role="bold">DROP</emphasis>|<emphasis
-        role="bold">REJECT</emphasis>|A_DROP|A_REJECT]</term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.7. Determines the disposition of
-          packets entering from interfaces the <option>rpfilter</option>
-          option (see <ulink
-          url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)).
-          Packets disposed of by this option are those whose response packets
-          would not be sent through the same interface receiving the
-          packet.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis
-        role="bold">RPFILTER_LOG_LEVEL=</emphasis><emphasis>log-level</emphasis></term>
-
-        <listitem>
-          <para>Added in shorewall 4.5.7. Determines the logging of packets
-          disposed via the RPFILTER_DISPOSITION. The default value is
-          <option>info</option>.</para>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><emphasis role="bold">SAVE_IPSETS=</emphasis>{<emphasis
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>}</term>
@@ -2041,7 +1868,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
 
         <listitem>
           <para>Added in Shorewall 4.4.20. Determines the disposition of
-          packets matching the <option>sfilter</option> option (see <ulink
+          packets matching the <option>filter</option> option (see <ulink
           url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)) and
           of <firstterm>hairpin</firstterm> packets on interfaces without the
           <option>routeback</option> option.<footnote>
@@ -2057,7 +1884,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net2all'
 
         <listitem>
           <para>Added on Shorewall 4.4.20. Determines the logging of packets
-          matching the <option>sfilter</option> option (see <ulink
+          matching the <option>filter</option> option (see <ulink
           url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)) and
           of <firstterm>hairpin</firstterm> packets on interfaces without the
           <option>routeback</option> option.<footnote>

Shorewall/modules

@@ -16,24 +16,24 @@
 #
 # Essential Modules
 #
-INCLUDE modules.essential
+?INCLUDE modules.essential
 #
 # Other xtables modules
 #
-INCLUDE modules.xtables
+?INCLUDE modules.xtables
 #
 # Helpers
 #
-INCLUDE helpers
+?INCLUDE helpers
 #
 # Ipset
 #
-INCLUDE modules.ipset
+?INCLUDE modules.ipset
 #
 # Traffic Shaping
 #
-INCLUDE modules.tc
+?INCLUDE modules.tc
 #
 # Extensions
 #
-INCLUDE modules.extensions
+?INCLUDE modules.extensions

Shorewall6-lite/init.suse.sh

@@ -1,87 +0,0 @@
-#!/bin/sh
-#
-#     The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.5
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2012 - Tom Eastep (teastep@shorewall.net)
-#
-#	On most distributions, this file should be called /etc/init.d/shorewall.
-#
-#	Complete documentation is available at http://shorewall.net
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-#	If an error occurs while starting or restarting the firewall, the
-#	firewall is automatically stopped.
-#
-#	Commands are:
-#
-#	   shorewall6-lite start			  Starts the firewall
-#	   shorewall6-lite restart			  Restarts the firewall
-#	   shorewall6-lite reload			  Reload the firewall
-#						          (same as restart)
-#	   shorewall6-lite stop 			  Stops the firewall
-#	   shorewall6-lite status			  Displays firewall status
-#
-
-### BEGIN INIT INFO
-# Provides:	  shorewall6-lite
-# Required-Start: $local_fs $remote_fs $syslog $network
-# Required-Stop:  $network $remote_fs
-# Default-Start:  2 3 5
-# Default-Stop:	  0 1 6
-# Description:	  starts and stops the shorewall firewall
-# Short-Description: Packet filtering firewall
-### END INIT INFO
-
-################################################################################
-# Give Usage Information						       #
-################################################################################
-usage() {
-    echo "Usage: $0 start|stop|reload|restart|status"
-    exit 1
-}
-
-################################################################################
-# Get startup options (override default)
-################################################################################
-OPTIONS=
-
-#
-# The installer may alter this
-#
-. /usr/share/shorewall/shorewallrc
-
-export SHOREWALL_INIT_SCRIPT=1
-
-################################################################################
-# E X E C U T I O N    B E G I N S   H E R E				       #
-################################################################################
-command="$1"
-
-case "$command" in
-    start)
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS start $STARTOPTIONS
-	;;
-    restart|reload)
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS restart $RESTARTOPTIONS
-	;;
-    status|stop)
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command $@
-	;;
-    *)
-	usage
-	;;
-esac

Shorewall6-lite/shorecap

@@ -45,22 +45,17 @@
 #    used during firewall compilation, then the generated firewall program will likewise not
 #    require Shorewall to be installed.
 
-g_program=shorewall6-lite
+SHAREDIR=/usr/share/shorewall6-lite
+VARDIR=/var/lib/shorewall6-lite
+CONFDIR=/etc/shorewall6-lite
+g_product="Shorewall6 Lite"
+g_family=6
+g_base=shorewall6
+g_basedir=/usr/share/shorewall6-lite
 
-#
+. /usr/share/shorewall6-lite/lib.base
-# This is modified by the installer when ${SHAREDIR} != /usr/share
+. /usr/share/shorewall6/lib.cli
-#
+. /usr/share/shorewall6-lite/configpath
-. /usr/share/shorewall/shorewallrc
-
-g_libexec="$LIBEXECDIR"
-g_sharedir="$SHAREDIR"/shorewall6-lite
-g_sbindir="$SBINDIR"
-g_vardir="$VARDIR"
-g_confdir="$CONFDIR"/shorewall6-lite
-g_readrc=1
-
-. ${SHAREDIR}/shorewall/lib.cli
-. ${SHAREDIR}/shorewall-lite/configpath
 
 [ -n "$PATH" ] || PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 

Shorewall6/Samples6/Universal/interfaces

@@ -11,5 +11,5 @@ FORMAT 2
 ###############################################################################
 #ZONE	INTERFACE	OPTIONS
 -	lo		ignore
-net	all		dhcp,physical=+,routeback,sourceroute=0
+net	all		dhcp,physical=+,routeback
 

Shorewall6/Samples6/Universal/rules

@@ -6,14 +6,13 @@
 # The manpage is also online at
 # http://www.shorewall.net/manpages/shorewall-rules.html
 #
-######################################################################################################################################################################################
+###########################################################################################################################################################################
-#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME       HEADERS   SWITCH     HELPER
+#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME       HEADERS   SWITCH
 #							PORT	PORT(S)		DEST		LIMIT		GROUP
 #SECTION ALL
 #SECTION ESTABLISHED
 #SECTION RELATED
 SECTION NEW
 
-Invalid(DROP)	net		$FW		tcp
 SSH(ACCEPT)	net		$FW
 Ping(ACCEPT)	net		$FW

Shorewall6/Samples6/Universal/shorewall6.conf

@@ -40,8 +40,6 @@ MACLIST_LOG_LEVEL=info
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
-
 SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
@@ -56,8 +54,6 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
 
-GEOIPDIR=/usr/share/xt_geoip/LE
-
 IP6TABLES=
 
 IP=
@@ -68,8 +64,6 @@ LOCKFILE=
 
 MODULESDIR=
 
-NFACCT=
-
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
@@ -109,9 +103,7 @@ ACCOUNTING_TABLE=filter
 
 ADMINISABSENTMINDED=Yes
 
-AUTOCOMMENT=Yes
+AUTO_COMMENT=Yes
-
-AUTOHELPERS=Yes
 
 AUTOMAKE=No
 
@@ -137,8 +129,6 @@ FASTACCEPT=Yes
 
 FORWARD_CLEAR_MARK=
 
-HELPERS=
-
 IMPLICIT_CONTINUE=No
 
 IPSET_WARNINGS=Yes
@@ -163,7 +153,7 @@ MODULE_SUFFIX=ko
 
 MUTEX_TIMEOUT=60
 
-OPTIMIZE=31
+OPTIMIZE=15
 
 OPTIMIZE_ACCOUNTING=No
 
@@ -195,8 +185,6 @@ RELATED_DISPOSITION=ACCEPT
 
 SFILTER_DISPOSITION=DROP
 
-RPFILTER_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
 TCP_FLAGS_DISPOSITION=DROP

Shorewall6/Samples6/one-interface/rules

@@ -10,18 +10,14 @@
 # See the file README.txt for further details.
 #------------------------------------------------------------------------------------------------------------
 # For information on entries in this file, type "man shorewall6-rules"
-######################################################################################################################################################################################
+###########################################################################################################################################################################
-#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME       HEADERS   SWITCH     HELPER
+#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME       HEADERS   SWITCH
 #							PORT	PORT(S)		DEST		LIMIT		GROUP
 #SECTION ALL
 #SECTION ESTABLISHED
 #SECTION RELATED
 SECTION NEW
 
-# Drop packets in the INVALID state
-
-Invalid(DROP)  net    	        $FW		tcp
-
 # Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
 
 Ping(DROP)	net		$FW

Shorewall6/Samples6/one-interface/shorewall6.conf

@@ -40,8 +40,6 @@ MACLIST_LOG_LEVEL=info
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
-
 SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
@@ -56,8 +54,6 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
 
-GEOIPDIR=/usr/share/xt_geoip/LE
-
 IP6TABLES=
 
 IP=
@@ -68,8 +64,6 @@ LOCKFILE=
 
 MODULESDIR=
 
-NFACCT=
-
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
@@ -109,9 +103,7 @@ ACCOUNTING_TABLE=filter
 
 ADMINISABSENTMINDED=Yes
 
-AUTOCOMMENT=Yes
+AUTO_COMMENT=Yes
-
-AUTOHELPERS=Yes
 
 AUTOMAKE=No
 
@@ -137,8 +129,6 @@ FASTACCEPT=No
 
 FORWARD_CLEAR_MARK=
 
-HELPERS=
-
 IMPLICIT_CONTINUE=No
 
 IPSET_WARNINGS=Yes
@@ -163,7 +153,7 @@ MODULE_SUFFIX=ko
 
 MUTEX_TIMEOUT=60
 
-OPTIMIZE=31
+OPTIMIZE=1
 
 OPTIMIZE_ACCOUNTING=No
 
@@ -195,8 +185,6 @@ RELATED_DISPOSITION=ACCEPT
 
 SFILTER_DISPOSITION=DROP
 
-RPFILTER_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
 TCP_FLAGS_DISPOSITION=DROP

Shorewall6/Samples6/three-interfaces/interfaces

@@ -14,6 +14,6 @@
 FORMAT 2
 ###############################################################################
 #ZONE	INTERFACE	OPTIONS
-net     eth0            tcpflags,forward=1,sourceroute=0
+net     eth0            tcpflags,forward=1
 loc     eth1            tcpflags,forward=1
 dmz     eth2            tcpflags,forward=1

Shorewall6/Samples6/three-interfaces/rules

@@ -10,8 +10,8 @@
 # See the file README.txt for further details.
 #------------------------------------------------------------------------------------------------------------
 # For information about entries in this file, type "man shorewall6-rules"
-######################################################################################################################################################################################
+###########################################################################################################################################################################
-#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME       HEADERS   SWITCH     HELPER
+#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME       HEADERS   SWITCH
 #							PORT	PORT(S)		DEST		LIMIT		GROUP
 #SECTION ALL
 #SECTION ESTABLISHED
@@ -20,7 +20,7 @@ SECTION NEW
 
 #       Don't allow connection pickup from the net
 #
-Invalid(DROP)	net		all		tcp
+Invalid(DROP)	net		all
 #
 #	Accept DNS connections from the firewall to the Internet
 #

Shorewall6/Samples6/three-interfaces/shorewall6.conf

@@ -40,8 +40,6 @@ MACLIST_LOG_LEVEL=info
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
-
 SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
@@ -56,8 +54,6 @@ TCP_FLAGS_LOG_LEVEL=info
 
 CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
 
-GEOIPDIR=/usr/share/xt_geoip/LE
-
 IP6TABLES=
 
 IP=
@@ -68,8 +64,6 @@ LOCKFILE=
 
 MODULESDIR=
 
-NFACCT=
-
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
@@ -109,9 +103,7 @@ ACCOUNTING_TABLE=filter
 
 ADMINISABSENTMINDED=Yes
 
-AUTOCOMMENT=Yes
+AUTO_COMMENT=Yes
-
-AUTOHELPERS=Yes
 
 AUTOMAKE=No
 
@@ -137,8 +129,6 @@ FASTACCEPT=No
 
 FORWARD_CLEAR_MARK=
 
-HELPERS=
-
 IMPLICIT_CONTINUE=No
 
 IPSET_WARNINGS=Yes
@@ -163,7 +153,7 @@ MODULE_SUFFIX=ko
 
 MUTEX_TIMEOUT=60
 
-OPTIMIZE=31
+OPTIMIZE=1
 
 OPTIMIZE_ACCOUNTING=No
 
@@ -195,8 +185,6 @@ RELATED_DISPOSITION=ACCEPT
 
 SFILTER_DISPOSITION=DROP
 
-RPFILTER_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
 TCP_FLAGS_DISPOSITION=DROP