Implement ADD and DEL in the mangle file.

- Also document the parameter to SAME

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/lib.cli

@@ -25,7 +25,7 @@
 # loaded after this one and replaces some of the functions declared here.
 #
 
-SHOREWALL_CAPVERSION=40600
+SHOREWALL_CAPVERSION=40606
 
 [ -n "${g_program:=shorewall}" ]
 
@@ -1959,7 +1959,7 @@ add_command() {
 		ipset=6_${zone}_${interface};
 	    fi
 
-	    ipset=$(echo $ipset | sed 's/./_/g');
+	    ipset=$(echo $ipset | sed 's/\./_/g');
 
 	    if ! qt $IPSET -L $ipset; then
 		fatal_error "Zone $zone, interface $interface does not have a dynamic host list"
@@ -2392,6 +2392,8 @@ determine_capabilities() {
     MASQUERADE_TGT=
     UDPLITEREDIRECT=
     NEW_TOS_MATCH=
+    TARPIT_TARGET=
+    IFACE_MATCH=
 
     AMANDA_HELPER=
     FTP_HELPER=
@@ -2545,6 +2547,10 @@ determine_capabilities() {
 	qt $NFACCT del $chain
     fi
 
+    qt $g_tool -A $chain -p tcp -j TARPIT && TARPIT_TARGET=Yes
+
+    qt $g_tool -A $chain -m iface --iface lo --loopback && IFACE_MATCH=Yes
+
     if [ -n "$MANGLE_ENABLED" ]; then
 	qt $g_tool -t mangle -N $chain
 
@@ -2822,6 +2828,8 @@ report_capabilities_unsorted() {
     report_capability "MASQUERADE Target" $MASQUERADE_TGT
     report_capability "UDPLITE Port Redirection" $UDPLITEREDIRECT
     report_capability "New tos Match" $NEW_TOS_MATCH
+    report_capability "TARPIT Target" $TARPIT_TARGET
+    report_capability "Iface Match" $IFACE_MATCH
 
     report_capability "Amanda Helper" $AMANDA_HELPER
     report_capability "FTP Helper" $FTP_HELPER
@@ -2949,6 +2957,8 @@ report_capabilities_unsorted1() {
     report_capability1 MASQUERADE_TGT
     report_capability1 UDPLITEREDIRECT
     report_capability1 NEW_TOS_MATCH
+    report_capability1 TARPIT_TARGET
+    report_capability1 IFACE_MATCH
 
     report_capability1 AMANDA_HELPER
     report_capability1 FTP_HELPER
@@ -3390,11 +3400,6 @@ get_config() {
 
     g_hostname=$(hostname 2> /dev/null)
 
-    IP=$(mywhich ip 2> /dev/null)
-    if [ -z "$IP" ] ; then
-	fatal_error "Can't find ip executable"
-    fi
-
     if [ -n "$IPSET" ]; then
 	case "$IPSET" in
 	    */*)
@@ -3416,6 +3421,10 @@ get_config() {
 
     TC=tc
 
+    IP=$(mywhich ip 2> /dev/null)
+
+    g_loopback=$(find_loopback_interfaces)
+
 }
 
 #
@@ -3719,6 +3728,7 @@ shorewall_cli() {
     g_inline=
     g_tcrules=
     g_counters=
+    g_loopback=
 
     VERBOSE=
     VERBOSITY=1

Shorewall-core/lib.common

@@ -374,7 +374,7 @@ reload_kernel_modules() {
 	moduleloader=insmod
     fi
 
-    [ -n "${MODULE_SUFFIX:=ko ko.gz o o.gz gz}" ]
+    [ -n "${MODULE_SUFFIX:=ko ko.gz ko.xz o o.gz o.xz gz xz}" ]
 
     [ -z "$MODULESDIR" ] && \
 	uname=$(uname -r) && \
@@ -413,7 +413,7 @@ load_kernel_modules() # $1 = Yes, if we are to save moduleinfo in $VARDIR
 	moduleloader=insmod
     fi
 
-    [ -n "${MODULE_SUFFIX:=o gz ko o.gz ko.gz}" ]
+    [ -n "${MODULE_SUFFIX:=o gz xz ko o.gz o.xz ko.gz ko.xz}" ]
 
     [ -z "$MODULESDIR" ] && \
 	uname=$(uname -r) && \
@@ -645,6 +645,24 @@ find_first_interface_address_if_any() # $1 = interface
     fi
 }
 
+#
+#Determines if the passed interface is a loopback interface
+#
+loopback_interface() { #$1 = Interface name
+    [ "$1" = lo ] || $IP link show $1 | fgrep -q LOOPBACK
+}
+
+#
+# Find Loopback Interfaces
+#
+find_loopback_interfaces() {
+    local interfaces
+
+    [ -x "$IP" ] && interfaces=$($IP link show | fgrep LOOPBACK | sed 's/://g' | cut -d ' ' -f 2)
+
+    [ -n "$interfaces" ] && echo $interfaces || echo lo
+}
+
 #
 # Internal version of 'which'
 #

Shorewall-init/ifupdown.debian.sh

@@ -28,7 +28,7 @@ setstatedir() {
 	statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR )
     fi
 
-    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARDIR}/${PRODUCT}
+    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
     if [ ! -x $STATEDIR/firewall ]; then
 	if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then

Shorewall-init/ifupdown.fedora.sh

@@ -31,7 +31,7 @@ setstatedir() {
 	statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR )
     fi
 
-    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARDIR}/${PRODUCT}
+    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
     if [ ! -x "$STATEDIR/firewall" ]; then
 	if [ $PRODUCT == shorewall -o $PRODUCT == shorewall6 ]; then

Shorewall-init/ifupdown.suse.sh

@@ -28,7 +28,7 @@ setstatedir() {
 	statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR )
     fi
 
-    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARDIR}/${PRODUCT}
+    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
     if [ ! -x $STATEDIR/firewall ]; then
 	if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then

Shorewall-init/init.debian.sh

@@ -71,7 +71,7 @@ setstatedir() {
 	statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR )
     fi
 
-    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARDIR}/${PRODUCT}
+    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
     if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then
 	${SBINDIR}/$PRODUCT ${OPTIONS} compile -c || echo_notdone

Shorewall-init/init.fedora.sh

@@ -42,7 +42,7 @@ setstatedir() {
 	statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR )
     fi
 
-    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARDIR}/${PRODUCT}
+    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
     if [ $PRODUCT == shorewall -o $PRODUCT == shorewall6 ]; then
 	${SBINDIR}/$PRODUCT $OPTIONS compile -c

Shorewall-init/init.sh

@@ -67,7 +67,7 @@ setstatedir() {
 	statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR )
     fi
 
-    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARDIR}/${PRODUCT}
+    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
     if [ ! -x $STATEDIR/firewall ]; then
 	if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then

Shorewall-init/init.suse.sh

@@ -77,7 +77,7 @@ setstatedir() {
 	statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR )
     fi
 
-    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARDIR}/${PRODUCT}
+    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
     if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then
 	${SBINDIR}/$PRODUCT ${OPTIONS} compile -c || exit

Shorewall-init/shorewall-init

@@ -30,7 +30,7 @@ setstatedir() {
 	statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR )
     fi
 
-    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARDIR}/${PRODUCT}
+    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
     if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then
 	${SBINDIR}/$PRODUCT ${OPTIONS} compile -c || exit 1

Shorewall-lite/manpages/shorewall-lite.xml

@@ -116,6 +116,8 @@
       <arg><option>-l</option></arg>
 
       <arg><option>-m</option></arg>
+
+      <arg><option>-c</option></arg>
     </cmdsynopsis>
 
     <cmdsynopsis>
@@ -355,7 +357,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-b</option></arg>
 
@@ -377,7 +379,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-x</option></arg>
 
@@ -391,7 +393,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-f</option></arg>
 
@@ -405,7 +407,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg
       choice="req"><option>classifiers|connections|config|events|filters|ip|ipa|zones|policies|marks</option></arg>
@@ -418,7 +420,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg choice="plain"><option>event</option><arg
       choice="plain"><replaceable>event</replaceable></arg></arg>
@@ -431,11 +433,11 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
-      <arg><option>-x</option></arg>
+      <arg><option>-c</option></arg>
 
-      <arg choice="req"><option>mangle|nat|routing|raw|rawpost</option></arg>
+      <arg choice="plain"><option>routing</option></arg>
     </cmdsynopsis>
 
     <cmdsynopsis>
@@ -445,7 +447,21 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
+
+      <arg><option>-x</option></arg>
+
+      <arg choice="req"><option>mangle|nat|raw|rawpost</option></arg>
+    </cmdsynopsis>
+
+    <cmdsynopsis>
+      <command>shorewall-lite</command>
+
+      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>
+
+      <arg>-<replaceable>options</replaceable></arg>
+
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg choice="plain"><option>tc</option></arg>
     </cmdsynopsis>
@@ -457,7 +473,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-m</option></arg>
 
@@ -666,6 +682,9 @@
 
           <para>The <emphasis role="bold">-l</emphasis> option causes the rule
           number for each Netfilter rule to be displayed.</para>
+
+          <para>The <option>-c</option> option causes the route cache to be
+          dumped in addition to the other routing information.</para>
         </listitem>
       </varlistentry>
 
@@ -1083,7 +1102,9 @@
               <term><emphasis role="bold">routing</emphasis></term>
 
               <listitem>
-                <para>Displays the system's IPv4 routing configuration.</para>
+                <para>Displays the system's IPv4 routing configuration. The -c
+                option causes the route cache to be displayed in addition to
+                the other routing information.</para>
               </listitem>
             </varlistentry>
 

Shorewall-lite/shorecap

@@ -38,7 +38,7 @@
 #
 #        IPTABLES - iptables
 #        MODULESDIR - /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter
-#        MODULE_SUFFIX - "o gz ko o.gz ko.gz"
+#        MODULE_SUFFIX - "o gz xz ko o.gz o.xz ko.gz ko.xz"
 #
 #    Shorewall need not be installed on the target system to run shorecap. If the '-e' flag is
 #    used during firewall compilation, then the generated firewall program will likewise not

Shorewall-lite/shorewall-lite.service

@@ -5,7 +5,7 @@
 #
 [Unit]
 Description=Shorewall IPv4 firewall (lite)
-After=network.target
+After=network-online.target
 Conflicts=iptables.service firewalld.service
 
 [Service]

Shorewall/Macros/macro.ActiveDir

@@ -9,8 +9,10 @@
 #
 #
 ###############################################################################
-#ACTION SOURCE  DEST    PROTO   DEST    SOURCE  RATE    USER/
-#                               PORT(S) PORT(S) LIMIT   GROUP
+?FORMAT 2 
+###############################################################################
+#ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	ORIGIN	RATE	USER/
+#				PORT(S)	PORT(S)	DEST	LIMIT	GROUP
 PARAM   -       -       tcp     389 	#LDAP services
 PARAM   -       -       udp	389  
 PARAM   -       -       tcp     636	#LDAP SSL

Shorewall/Macros/macro.Goto-Meeting

@@ -7,6 +7,8 @@
 #       Assumes that ports 80 and 443 are already open
 #       If needed, use the macros that open Http and Https to reduce redundancy
 ####################################################################################
-#ACTION	   SOURCE	DEST    PROTO   DEST    SOURCE  RATE    USER/
-#                                       PORT(S) PORT(S) LIMIT   GROUP
-PARAM      -         	-       tcp     8200    # Goto Meeting only needed (TCP outbound)
+?FORMAT 2
+####################################################################################
+#ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	ORIGIN	RATE	USER/
+#				PORT(S)	PORT(S)	DEST	LIMIT	GROUP
+PARAM      -    -       tcp     8200    # Goto Meeting only needed (TCP outbound)

Shorewall/Macros/macro.Tinc

@@ -0,0 +1,11 @@
+#
+# Shorewall version 4 - tinc Macro
+#
+# /usr/share/shorewall/macro.Tinc Macro
+#
+#       This macro handles tinc traffic.
+#
+###############################################################################
+#ACTION SOURCE  DEST    PROTO   DEST    SOURCE  RATE    USER/
+#                               PORT(S) PORT(S) LIMIT   GROUP
+PARAM   -       -       udp     655

Shorewall/Macros/macro.Zabbix

@@ -0,0 +1,15 @@
+#
+# Shorewall version 4 - Zabbix Macro
+#
+# /usr/share/shorewall/macro.Zabbix
+#
+#	This macro handles Zabbix monitoring software server traffic to agent
+#	and trap traffic from agent to zabbix server.
+#
+###############################################################################
+?FORMAT 2
+###############################################################################
+#ACTION	SOURCE	DEST	PROTO	DEST	SOURCE	ORIGIN	RATE	USER/
+#				PORT(S)	PORT(S)	DEST	LIMIT	GROUP
+PARAM	-	-	tcp	10050	# zabbix_agent
+PARAM	DEST	SOURCE	tcp	10051	# zabbix_trap

Shorewall/Perl/Shorewall/Chains.pm

@@ -30,7 +30,7 @@ package Shorewall::Chains;
 require Exporter;
 
 use Scalar::Util 'reftype';
-use Digest::SHA qw(sha1);
+use Digest::SHA qw(sha1_hex);
 use File::Basename;
 use Shorewall::Config qw(:DEFAULT :internal);
 use Shorewall::Zones;
@@ -110,6 +110,7 @@ our @EXPORT = ( qw(
 		    INLINERULE
 		    OPTIONS
                     IPTABLES
+		    TARPIT
                     FILTER_TABLE
                     NAT_TABLE
                     MANGLE_TABLE
@@ -316,7 +317,7 @@ our $VERSION = '4.5_18';
 #                                               restriction  => Restrictions on further rules in this chain.
 #                                               audit        => Audit the result.
 #                                               filtered     => Number of filter rules at the front of an interface forward chain
-#                                               digest       => string representation of the chain's rules for use in optimization
+#                                               digest       => SHA1 digest of the string representation of the chain's rules for use in optimization
 #                                                               level 8.
 #                                               complete     => The last rule in the chain is a -g or a simple -j to a terminating target
 #                                                               Suppresses adding additional rules to the chain end of the chain
@@ -426,6 +427,7 @@ use constant { STANDARD     =>      0x1,       #defined by Netfilter
 	       INLINERULE   =>  0x40000,       #INLINE
 	       OPTIONS      =>  0x80000,       #Target Accepts Options
 	       IPTABLES     => 0x100000,       #IPTABLES or IP6TABLES
+	       TARPIT       => 0x200000,       #TARPIT
 
 	       FILTER_TABLE =>  0x1000000,
 	       MANGLE_TABLE =>  0x2000000,
@@ -647,6 +649,7 @@ our %opttype = ( rule          => CONTROL,
 		 simple        => CONTROL,
 		 matches       => CONTROL,
 		 complex       => CONTROL,
+		 t             => CONTROL,
 
 		 i             => UNIQUE,
 		 s             => UNIQUE,
@@ -889,6 +892,8 @@ sub set_rule_option( $$$ ) {
 	    }
 	} elsif ( $opttype == EXCLUSIVE ) {
 	    $ruleref->{$option} .= ",$value";
+	} elsif ( $opttype  == CONTROL ) {
+	    $ruleref->{$option} = $value;
 	} elsif ( $opttype == UNIQUE ) {
 	    #
 	    # Shorewall::Rules::perl_action_tcp_helper() can produce rules that have two -p specifications.
@@ -923,7 +928,7 @@ sub transform_rule( $;\$ ) {
 	my $option;
 	my $invert = '';
 
-	if ( $input =~ s/^(!\s+)?-([psdjgiom])\s+// ) {
+	if ( $input =~ s/^(!\s+)?-([psdjgiomt])\s+// ) {
 	    #
 	    # Normal case of single-character
 	    $invert = '!' if $1;
@@ -953,7 +958,7 @@ sub transform_rule( $;\$ ) {
 
       PARAM:
 	{
-	    while ( $input ne '' && $input !~ /^(?:!|-[psdjgiom])\s/ ) {
+	    while ( $input ne '' && $input !~ /^(?:!|-[psdjgiomt])\s/ ) {
 		last PARAM if $input =~ /^--([^\s]+)/ && $aliases{$1 || '' };
 		$input =~ s/^([^\s]+)\s*//;
 		my $token = $1;
@@ -1984,6 +1989,10 @@ sub zone_forward_chain($) {
 #
 sub use_forward_chain($$) {
     my ( $interface, $chainref ) = @_;
+    my @loopback_zones = loopback_zones;
+
+    return 0 if $interface eq loopback_interface && ! @loopback_zones;
+
     my $interfaceref = find_interface($interface);
     my $nets = $interfaceref->{nets};
 
@@ -2858,6 +2867,7 @@ sub initialize_chain_table($) {
 		    'HELPER'          => STANDARD + HELPER + NATONLY, #Actually RAWONLY
 		    'INLINE'          => INLINERULE,
 		    'IPTABLES'        => IPTABLES,
+		    'TARPIT'          => STANDARD + TARPIT + OPTIONS,
 		   );
 
 	for my $chain ( qw(OUTPUT PREROUTING) ) {
@@ -2923,6 +2933,7 @@ sub initialize_chain_table($) {
 		    'HELPER'          => STANDARD + HELPER + NATONLY, #Actually RAWONLY
 		    'INLINE'          => INLINERULE,
 		    'IP6TABLES'       => IPTABLES,
+		    'TARPIT'          => STANDARD + TARPIT + OPTIONS,
 		   );
 
 	for my $chain ( qw(OUTPUT PREROUTING) ) {
@@ -3054,7 +3065,7 @@ sub calculate_digest( $ ) {
 	}
     }
 
-    $chainref->{digest} = sha1 $digest;
+    $chainref->{digest} = sha1_hex $digest;
 }
 
 #
@@ -4437,6 +4448,7 @@ sub do_proto( $$$;$ )
 
 			if ( $ports =~ /^\+/ ) {
 			    $output .= $invert;
+			    $output .= '-m set ';
 			    $output .= get_set_flags( $ports, 'dst' );
 			} else {
 			    $sports = '', require_capability( 'MULTIPORT', "'=' in the SOURCE PORT(S) column", 's' ) if ( $srcndst = $sports eq '=' );
@@ -4476,7 +4488,8 @@ sub do_proto( $$$;$ )
 
 			if ( $ports =~ /^\+/ ) {
 			    $output .= $invert;
-			    $output .= get_set_flags( $ports, 'dst' );
+			    $output .= '-m set ';
+			    $output .= get_set_flags( $ports, 'src' );
 			} elsif ( $multiport ) {
 			    if ( port_count( $sports ) > 15 ) {
 				if ( $restricted ) {
@@ -4641,30 +4654,35 @@ sub do_iproto( $$$ )
 
 		    if ( $ports ne '' ) {
 			$invert  = $ports =~ s/^!// ? '! ' : '';
-			$sports = '', require_capability( 'MULTIPORT', "'=' in the SOURCE PORT(S) column", 's' ) if ( $srcndst = $sports eq '=' );
 
-			if ( $multiport || $ports =~ tr/,/,/ > 0 || $sports =~ tr/,/,/ > 0 ) {
-			    fatal_error "Port lists require Multiport support in your kernel/iptables" unless have_capability( 'MULTIPORT' , 1 );
+			if ( $ports =~ /^\+/ ) {
+			    push @output , set => ${invert} . get_set_flags( $ports, 'dst' );
+			} else {
+			    $sports = '', require_capability( 'MULTIPORT', "'=' in the SOURCE PORT(S) column", 's' ) if ( $srcndst = $sports eq '=' );
 
-			    if ( port_count ( $ports ) > 15 ) {
-				if ( $restricted ) {
-				    fatal_error "A port list in this file may only have up to 15 ports";
-				} elsif ( $invert ) {
-				    fatal_error "An inverted port list may only have up to 15 ports";
+			    if ( $multiport || $ports =~ tr/,/,/ > 0 || $sports =~ tr/,/,/ > 0 ) {
+				fatal_error "Port lists require Multiport support in your kernel/iptables" unless have_capability( 'MULTIPORT' , 1 );
+
+				if ( port_count ( $ports ) > 15 ) {
+				    if ( $restricted ) {
+					fatal_error "A port list in this file may only have up to 15 ports";
+				    } elsif ( $invert ) {
+					fatal_error "An inverted port list may only have up to 15 ports";
+				    }
 				}
-			    }
 
-			    $ports = validate_port_list $pname , $ports;
-			    push @output, multiport => ( $srcndst ? "${invert}--ports ${ports} " : "${invert}--dports ${ports} " );
-			    $multiport = 1;
-			}  else {
-			    fatal_error "Missing DEST PORT" unless supplied $ports;
-			    $ports   = validate_portpair $pname , $ports;
+				$ports = validate_port_list $pname , $ports;
+				push @output, multiport => ( $srcndst ? "${invert}--ports ${ports} " : "${invert}--dports ${ports} " );
+				$multiport = 1;
+			    }  else {
+				fatal_error "Missing DEST PORT" unless supplied $ports;
+				$ports   = validate_portpair $pname , $ports;
 
-			    if ( $srcndst ) {
-				push @output, multiport => "${invert}--ports ${ports}";
-			    } else {
-				push @output, dport => "${invert}${ports}";
+				if ( $srcndst ) {
+				    push @output, multiport => "${invert}--ports ${ports}";
+				} else {
+				    push @output, dport => "${invert}${ports}";
+				}
 			    }
 			}
 		    } else {
@@ -4674,8 +4692,10 @@ sub do_iproto( $$$ )
 		    if ( $sports ne '' ) {
 			fatal_error "'=' in the SOURCE PORT(S) column requires one or more ports in the DEST PORT(S) column" if $sports eq '=';
 			$invert = $sports =~ s/^!// ? '! ' : '';
-			if ( $multiport ) {
 
+			if ( $ports =~ /^\+/ ) {
+			    push @output, set => ${invert} . get_set_flags( $ports, 'src' );
+			} elsif ( $multiport ) {
 			    if ( port_count( $sports ) > 15 ) {
 				if ( $restricted ) {
 				    fatal_error "A port list in this file may only have up to 15 ports";
@@ -5493,7 +5513,7 @@ sub get_set_flags( $$ ) {
 
     my $rest = '';
 
-    if ( $setname =~ /^(.*)\[([1-6])(?:,(.*))\]$/ ) {
+    if ( $setname =~ /^(.*)\[([1-6])(?:,(.+))?\]$/ ) {
 	$setname  = $1;
 	my $count = $2;
 	$rest     = $3;
@@ -5518,7 +5538,7 @@ sub get_set_flags( $$ ) {
 	}
     }
 
-    if ( $rest ) {
+    if ( supplied $rest ) {
 	my @extensions = split_list($rest, 'ipset option');
 
 	for ( @extensions ) {
@@ -7665,7 +7685,7 @@ sub add_interface_options( $ ) {
 		}
 	    }
 
-	    $chainref->{digest} = sha1 $digest;
+	    $chainref->{digest} = sha1_hex $digest;
 	}
 	#
 	# Insert jumps to the interface chains into the rules chains

Shorewall/Perl/Shorewall/Compiler.pm

@@ -649,10 +649,7 @@ sub compiler {
 
     set_config_path( $config_path ) if $config_path;
 
-    if ( $directory ne '' ) {
-	fatal_error "$directory is not an existing directory" unless -d $directory;
-	set_shorewall_dir( $directory );
-    }
+    set_shorewall_dir( $directory ) if $directory ne '';
 
     $verbosity = 1 if $debug && $verbosity < 1;
 
@@ -665,15 +662,6 @@ sub compiler {
     #
     get_configuration( $export , $update , $annotate , $directives , $inline );
     #
-    # Create a temp file to hold the script
-    #
-    if ( $scriptfilename ) {
-	set_command( 'compile', 'Compiling', 'Compiled' );
-	create_temp_script( $scriptfilename , $export );
-    } else {
-	set_command( 'check', 'Checking', 'Checked' );
-    }
-    #
     # Chain table initialization depends on shorewall.conf and capabilities. So it must be deferred until
     # now when shorewall.conf has been processed and the capabilities have been determined.
     #
@@ -683,6 +671,15 @@ sub compiler {
     #
     run_user_exit1 'compile';
     #
+    # Create a temp file to hold the script
+    #
+    if ( $scriptfilename ) {
+	set_command( 'compile', 'Compiling', 'Compiled' );
+	create_temp_script( $scriptfilename , $export );
+    } else {
+	set_command( 'check', 'Checking', 'Checked' );
+    }
+    #
     #                                     Z O N E   D E F I N I T I O N
     #                              (Produces no output to the compiled script)
     #
@@ -854,7 +851,7 @@ sub compiler {
     #
     # Apply Policies
     #
-    apply_policy_rules;
+    complete_policy_chains;
     #
     # Reject Action
     #

Shorewall/Perl/Shorewall/Config.pm

@@ -301,7 +301,7 @@ our %renamed = ( AUTO_COMMENT => 'AUTOCOMMENT', BLACKLIST_LOGLEVEL => 'BLACKLIST
 #
 # Config options and global settings that are to be copied to output script
 #
-our @propagateconfig = qw/ DISABLE_IPV6 MODULESDIR MODULE_SUFFIX LOAD_HELPERS_ONLY SUBSYSLOCK LOG_VERBOSITY/;
+our @propagateconfig = qw/ DISABLE_IPV6 MODULESDIR MODULE_SUFFIX LOAD_HELPERS_ONLY LOCKFILE SUBSYSLOCK LOG_VERBOSITY/;
 #
 # From parsing the capabilities file or detecting capabilities
 #
@@ -394,6 +394,8 @@ our %capdesc = ( NAT_ENABLED     => 'NAT',
 		 MASQUERADE_TGT  => 'MASQUERADE Target',
 		 UDPLITEREDIRECT => 'UDPLITE Port Redirection',
 		 NEW_TOS_MATCH   => 'New tos Match',
+		 TARPIT_TARGET   => 'TARPIT Target',
+		 IFACE_MATCH     => 'Iface Match',
 
 		 AMANDA_HELPER   => 'Amanda Helper',
 		 FTP_HELPER      => 'FTP Helper',
@@ -410,7 +412,7 @@ our %capdesc = ( NAT_ENABLED     => 'NAT',
 		 SIP0_HELPER     => 'SIP-0 Helper',
 		 SNMP_HELPER     => 'SNMP Helper',
 		 TFTP_HELPER     => 'TFTP Helper',
-		 TFTP0_HELPER     => 'TFTP-0 Helper',
+		 TFTP0_HELPER    => 'TFTP-0 Helper',
 		 #
 		 # Constants
 		 #
@@ -712,7 +714,7 @@ sub initialize( $;$$) {
 		    EXPORT                  => 0,
 		    KLUDGEFREE              => '',
 		    VERSION                 => "4.5.19-Beta1",
-		    CAPVERSION              => 40600 ,
+		    CAPVERSION              => 40606 ,
 		  );
     #
     # From shorewall.conf file
@@ -979,6 +981,8 @@ sub initialize( $;$$) {
 	       UDPLITEREDIRECT => undef,
 	       NEW_TOS_MATCH => undef,
 	       REAP_OPTION => undef,
+	       TARPIT_TARGET => undef,
+	       IFACE_MATCH => undef,
 
 	       AMANDA_HELPER => undef,
 	       FTP_HELPER => undef,
@@ -1268,9 +1272,7 @@ sub cleanup_iptables() {
 	qt1( "$iptables $iptablesw -t raw -X $sillyname" );
     }
 
-    $sillyname = $sillyname1 = undef;
-
-    $sillyname = '';
+    $sillyname = $sillyname1 = '';
 }
 
 #
@@ -1591,7 +1593,7 @@ sub set_command( $$$ ) {
 #
 # Print the current TOD to STDOUT.
 #
-sub timestamp() {
+sub get_localtime() {
     our @localtime = localtime;
     printf '%02d:%02d:%02d ', @localtime[2,1,0];
 }
@@ -1608,7 +1610,7 @@ sub progress_message {
 	$line =~ s/\s+/ /g;
 
 	if ( $verbosity > 1 ) {
-	    timestamp, $havelocaltime = 1 if $timestamp;
+	    get_localtime, $havelocaltime = 1 if $timestamp;
 	    #
 	    # We use this function to display messages containing raw config file images which may contains tabs (including multiple tabs in succession).
 	    # The following makes such messages look more readable and uniform
@@ -1631,7 +1633,7 @@ sub progress_message_nocompress {
     my $havelocaltime = 0;
 
     if ( $verbosity > 1 ) {
-	timestamp, $havelocaltime = 1 if $timestamp;
+	get_localtime, $havelocaltime = 1 if $timestamp;
 	print "@_\n";
     }
 
@@ -1652,7 +1654,7 @@ sub progress_message2 {
     my $havelocaltime = 0;
 
     if ( $verbosity > 0 ) {
-	timestamp, $havelocaltime = 1 if $timestamp;
+	get_localtime, $havelocaltime = 1 if $timestamp;
 	print "@_\n";
     }
 
@@ -1673,7 +1675,7 @@ sub progress_message3 {
     my $havelocaltime = 0;
 
     if ( $verbosity >= 0 ) {
-	timestamp, $havelocaltime = 1 if $timestamp;
+	get_localtime, $havelocaltime = 1 if $timestamp;
 	print "@_\n";
     }
 
@@ -1762,7 +1764,7 @@ sub create_temp_script( $$ ) {
 
 }
 
-# Generate the SHA1 digest of the (incomplete script)
+# Generate the SHA1 digest of the (incomplete) script
 #
 sub generate_sha1() {
     my $data = `cat $tempfile`;
@@ -1840,7 +1842,7 @@ sub set_config_path( $ ) {
 }
 
 #
-# Set $debug
+# Set $debug and $confess
 #
 sub set_debug( $$ ) {
     $debug   = shift;
@@ -1865,6 +1867,9 @@ sub find_file($)
     "$config_path[0]$filename";
 }
 
+#
+# Split a comma-separated list into a Perl array
+#
 sub split_list( $$;$ ) {
     my ($list, $type, $origlist ) = @_;
 
@@ -1873,6 +1878,9 @@ sub split_list( $$;$ ) {
     split /,/, $list;
 }
 
+#
+# This version handles parenthetical list elements with embedded commas. It removes the parentheses
+#
 sub split_list1( $$;$ ) {
     my ($list, $type, $keepparens ) = @_;
 
@@ -2024,6 +2032,9 @@ sub split_list3( $$ ) {
     @list2;
 }
 
+#
+# Splits the columns of a config file record
+#
 sub split_columns( $ ) {
     my ($list) = @_;
 
@@ -3388,7 +3399,7 @@ sub read_a_line($) {
 	    # Must check for shell/perl before doing variable expansion
 	    # 
 	    if ( $options & EMBEDDED_ENABLED ) {
-		if ( $currentline =~ s/^\s*\??(BEGIN\s+)SHELL\s*;?//i || $currentline =~ s/^\s*\??SHELL\s*//i ) {
+		if ( $currentline =~ s/^\s*\??(BEGIN\s+)SHELL\s*;?//i || $currentline =~ s/^\s*\?SHELL\s*//i || $currentline =~ s/^\s*SHELL\s+// ) {
 		    handle_first_entry if $first_entry;
 		    embedded_shell( $1 );
 		    next;
@@ -3851,7 +3862,7 @@ sub load_kernel_modules( ) {
 
 	close LSMOD;
 
-	$config{MODULE_SUFFIX} = 'o gz ko o.gz ko.gz' unless $config{MODULE_SUFFIX};
+	$config{MODULE_SUFFIX} = 'o gz xz ko o.gz o.xz ko.gz ko.xz' unless $config{MODULE_SUFFIX};
 
 	my @suffixes = split /\s+/ , $config{MODULE_SUFFIX};
 
@@ -4219,6 +4230,10 @@ sub Addrtype() {
     qt1( "$iptables $iptablesw -A $sillyname -m addrtype --src-type BROADCAST -j ACCEPT" );
 }
 
+sub Tarpit_Target() {
+    qt1( "$iptables $iptablesw -A $sillyname -p tcp -j TARPIT" );
+}
+
 sub Tcpmss_Match() {
     qt1( "$iptables $iptablesw -A $sillyname -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1000:1500 -j ACCEPT" );
 }
@@ -4449,6 +4464,12 @@ sub Arptables_JF() {
     }
 }
 
+sub Iface_Match() {
+    qt1( "$iptables $iptablesw -A $sillyname -m iface --iface lo --loopback" );
+}
+
+
+
 our %detect_capability =
     ( ACCOUNT_TARGET =>\&Account_Target,
       AMANDA_HELPER => \&Amanda_Helper,
@@ -4481,6 +4502,7 @@ our %detect_capability =
       HASHLIMIT_MATCH => \&Hashlimit_Match,
       HEADER_MATCH => \&Header_Match,
       HELPER_MATCH => \&Helper_Match,
+      IFACE_MATCH => \&Iface_Match,
       IMQ_TARGET => \&Imq_Target,
       IPMARK_TARGET => \&IPMark_Target,
       IPP2P_MATCH => \&Ipp2p_Match,
@@ -4533,6 +4555,7 @@ our %detect_capability =
       SIP0_HELPER => \&SIP0_Helper,
       SNMP_HELPER => \&SNMP_Helper,
       STATISTIC_MATCH => \&Statistic_Match,
+      TARPIT_TARGET => \&Tarpit_Target,
       TCPMSS_MATCH => \&Tcpmss_Match,
       TFTP_HELPER => \&TFTP_Helper,
       TFTP0_HELPER => \&TFTP0_Helper,
@@ -4685,6 +4708,8 @@ sub determine_capabilities() {
 	$capabilities{MASQUERADE_TGT}  = detect_capability( 'MASQUERADE_TGT' );
 	$capabilities{UDPLITEREDIRECT} = detect_capability( 'UDPLITEREDIRECT' );
 	$capabilities{NEW_TOS_MATCH}   = detect_capability( 'NEW_TOS_MATCH' );
+	$capabilities{TARPIT_TARGET}   = detect_capability( 'TARPIT_TARGET' );
+	$capabilities{IFACE_MATCH}     = detect_capability( 'IFACE_MATCH' );
 
 	unless ( have_capability 'CT_TARGET' ) {
 	    $capabilities{HELPER_MATCH} = detect_capability 'HELPER_MATCH';
@@ -4752,6 +4777,7 @@ sub ensure_config_path() {
 #
 sub set_shorewall_dir( $ ) {
     $shorewall_dir = shift;
+    fatal_error "$shorewall_dir is not an existing directory" unless -d $shorewall_dir;
     ensure_config_path;
 }
 
@@ -5814,7 +5840,7 @@ sub get_configuration( $$$$$ ) {
 	} elsif ( $val eq 'netlink' ) {
 	    $val = 'nfnetlink_log';
 	} elsif ( $val eq 'LOG' ) {
-	    $val = $family == F_IPV4 ? 'ipt_LOG' : 'ip6t_log';
+	    $val = $family == F_IPV4 ? 'ipt_LOG' : 'ip6t_LOG';
 	} else {
 	    fatal_error "Invalid LOG Backend ($val)";
 	}

Shorewall/Perl/Shorewall/Misc.pm

@@ -854,7 +854,7 @@ sub add_common_rules ( $$ ) {
 
 	my $interfaceref = find_interface $interface;
 
-	unless ( $interfaceref->{physical} eq 'lo' ) {
+	unless ( $interfaceref->{physical} eq loopback_interface ) {
 	    unless ( $interfaceref->{options}{ignore} & NO_SFILTER || $interfaceref->{options}{rpfilter} ) {
 
 		my @filters = @{$interfaceref->{filter}};
@@ -1452,7 +1452,7 @@ sub handle_loopback_traffic() {
     my $rawout   = $raw_table->{OUTPUT};
     my $rulenum  = 0;
     my $loopback = loopback_zones;
-    my $loref    = known_interface('lo');
+    my $loref    = known_interface(loopback_interface);
 
     my $unmanaged;
     my $outchainref;
@@ -1463,17 +1463,29 @@ sub handle_loopback_traffic() {
 	# We have a vserver zone -- route output through a separate chain
 	#
 	$outchainref = new_standard_chain 'loopback';
-	add_ijump $filter_table->{OUTPUT}, j => $outchainref, o => 'lo';
+
+	if ( have_capability 'IFACE_MATCH' ) {
+	    add_ijump $filter_table->{OUTPUT}, j => $outchainref, iface => '--dev-out --loopback';
+	} else {
+	    add_ijump $filter_table->{OUTPUT}, j => $outchainref, o => loopback_interface;
+	}
     } else {
 	#
 	# Only the firewall -- just use the OUTPUT chain
 	#
 	if ( $unmanaged = $loref && $loref->{options}{unmanaged} ) {
-	    add_ijump( $filter_table->{INPUT},  j => 'ACCEPT', i => 'lo' );
-	    add_ijump( $filter_table->{OUTPUT}, j => 'ACCEPT', o => 'lo' );
+	    if ( have_capability 'IFACE_MATCH' ) {
+		add_ijump( $filter_table->{OUTPUT}, j => 'ACCEPT', iface => '--dev-out --loopback' );
+	    } else {
+		add_ijump( $filter_table->{OUTPUT}, j => 'ACCEPT', o => loopback_interface );
+	    }
 	} else {
 	    $outchainref = $filter_table->{OUTPUT};
-	    @rule = ( o => 'lo');
+	    if ( have_capability 'IFACE_MATCH' ) {
+		@rule = ( iface => '--dev-out --loopback' );
+	    } else {
+		@rule = ( o => loopback_interface );
+	    }
 	}
     }
 
@@ -1552,7 +1564,7 @@ sub add_interface_jumps {
     our %forward_jump_added;
     my @interfaces = grep $_ ne '%vserver%', @_;
     my $dummy;
-    my $lo_jump_added = interface_zone( 'lo' ) && ! get_interface_option( 'lo', 'destonly' );
+    my $lo_jump_added = interface_zone( loopback_interface ) && ! get_interface_option( loopback_interface, 'destonly' );
     #
     # Add Nat jumps
     #
@@ -1582,7 +1594,13 @@ sub add_interface_jumps {
 	my $outputref    = $filter_table->{output_chain $interface};
 	my $interfaceref = find_interface($interface);
 
-	add_ijump $filter_table->{INPUT} , j => 'ACCEPT', i => 'lo' if $interfaceref->{physical} eq '+' && ! $lo_jump_added++;
+	if ( $interfaceref->{physical} eq '+' && ! $lo_jump_added++ ) {
+	    if ( have_capability 'IFACE_MATCH' ) {
+		add_ijump $filter_table->{INPUT} , j => 'ACCEPT', iface => '--dev-in --loopback';
+	    } else {
+		add_ijump $filter_table->{INPUT} , j => 'ACCEPT', i => loopback_interface;
+	    }
+	}
 
 	if ( $interfaceref->{options}{port} ) {
 	    my $bridge = $interfaceref->{bridge};
@@ -1621,7 +1639,13 @@ sub add_interface_jumps {
 	}
     }
 
-    add_ijump $filter_table->{INPUT} , j => 'ACCEPT', i => 'lo' unless $lo_jump_added++;
+    unless ( $lo_jump_added++ ) {
+	if ( have_capability 'IFACE_MATCH' ) {
+	    add_ijump $filter_table->{INPUT} , j => 'ACCEPT', iface => '--dev-in --loopback';
+	} else {
+	    add_ijump $filter_table->{INPUT} , j => 'ACCEPT', i => loopback_interface;
+	}
+    }
 
     handle_loopback_traffic;
 }
@@ -2551,8 +2575,13 @@ EOF
 
     process_routestopped unless process_stoppedrules;
 
-    add_ijump $input,  j => 'ACCEPT', i => 'lo';
-    add_ijump $output, j => 'ACCEPT', o => 'lo' unless $config{ADMINISABSENTMINDED};
+    if ( have_capability 'IFACE_MATCH' ) {
+	add_ijump $input,  j => 'ACCEPT', iface => '--dev-in --loopback';
+	add_ijump $output, j => 'ACCEPT', iface => '--dev-out --loopback' unless $config{ADMINISABSENTMINDED};
+    } else {
+	add_ijump $input,  j => 'ACCEPT', i => loopback_interface;
+	add_ijump $output, j => 'ACCEPT', o => loopback_interface unless $config{ADMINISABSENTMINDED};
+    }
 
     my $interfaces = find_interfaces_by_option 'dhcp';
 

Shorewall/Perl/Shorewall/Providers.pm

@@ -530,8 +530,9 @@ sub process_a_provider( $ ) {
 		$track = 0;
 	    } elsif ( $option =~ /^balance=(\d+)$/ ) {
 		fatal_error q('balance=<weight>' is not available in IPv6) if $family == F_IPV6;
+		fatal_error 'The balance setting must be non-zero' unless $1;
 		$balance = $1;
-	    } elsif ( $option eq 'balance' ) {
+	    } elsif ( $option eq 'balance' || $option eq 'primary') {
 		$balance = 1;
 	    } elsif ( $option eq 'loose' ) {
 		$loose   = 1;
@@ -2048,7 +2049,7 @@ sub handle_stickiness( $ ) {
 			$rule1 = clone_irule( $_ );
 
 			set_rule_target( $rule1, 'MARK',   "--set-mark $mark" );
-			set_rule_option( $rule1, 'recent', "--name $list --update --seconds 300 --reap" );
+			set_rule_option( $rule1, 'recent', "--name $list --update --seconds $rule1->{t} --reap" );
 
 			$rule2 = clone_irule( $_ );
 
@@ -2083,7 +2084,7 @@ sub handle_stickiness( $ ) {
 			$rule1 = clone_irule $_;
 
 			set_rule_target( $rule1, 'MARK',   "--set-mark $mark" );
-			set_rule_option( $rule1, 'recent', " --name $list --rdest --update --seconds 300 --reap" );
+			set_rule_option( $rule1, 'recent', " --name $list --rdest --update --seconds $rule1->{t} --reap" );
 
 			$rule2 = clone_irule $_;
 

Shorewall/Perl/Shorewall/Rules.pm

@@ -44,7 +44,7 @@ use strict;
 our @ISA = qw(Exporter);
 our @EXPORT = qw(
 		  process_policies
-		  apply_policy_rules
+		  complete_policy_chains
 		  complete_standard_chain
 		  setup_syn_flood_chains
 		  save_policies
@@ -348,44 +348,44 @@ sub new_policy_chain($$$$$)
 #
 sub set_policy_chain($$$$$$)
 {
-    my ($source, $dest, $chain1, $chainref, $policy, $intrazone) = @_;
+    my ( $chain, $source, $dest, $polchainref, $policy, $intrazone ) = @_;
 
-    my $chainref1 = $filter_table->{$chain1};
+    my $chainref = $filter_table->{$chain};
 
-    if ( $chainref1 ) {
-	if ( $intrazone && $source eq $dest && $chainref1->{provisional} ) {
-	    $chainref1->{policychain} = '';
-	    $chainref1->{provisional} = '';
+    if ( $chainref ) {
+	if ( $intrazone && $source eq $dest && $chainref->{provisional} ) {
+	    $chainref->{policychain} = '';
+	    $chainref->{provisional} = '';
 	}
     } else {
-	$chainref1 = new_rules_chain $chain1;
+	$chainref = new_rules_chain $chain;
     }
 
-    unless ( $chainref1->{policychain} ) {
+    unless ( $chainref->{policychain} ) {
 	if ( $config{EXPAND_POLICIES} ) {
 	    #
 	    # We convert the canonical chain into a policy chain, using the settings of the
 	    # passed policy chain.
 	    #
-	    $chainref1->{policychain} = $chain1;
-	    $chainref1->{loglevel}    = $chainref->{loglevel} if defined $chainref->{loglevel};
-	    $chainref1->{audit}       = $chainref->{audit}    if defined $chainref->{audit};
+	    $chainref->{policychain} = $chain;
+	    $chainref->{loglevel}    = $polchainref->{loglevel} if defined $polchainref->{loglevel};
+	    $chainref->{audit}       = $polchainref->{audit}    if defined $polchainref->{audit};
 
-	    if ( defined $chainref->{synparams} ) {
-		$chainref1->{synparams}   = $chainref->{synparams};
-		$chainref1->{synchain}    = $chainref->{synchain};
+	    if ( defined $polchainref->{synparams} ) {
+		$chainref->{synparams}   = $polchainref->{synparams};
+		$chainref->{synchain}    = $polchainref->{synchain};
 	    }
 
-	    $chainref1->{default}     = $chainref->{default} if defined $chainref->{default};
-	    $chainref1->{is_policy}   = 1;
-	    push @policy_chains, $chainref1;
+	    $chainref->{default}     = $polchainref->{default} if defined $polchainref->{default};
+	    $chainref->{is_policy}   = 1;
+	    push @policy_chains, $chainref;
 	} else {
-	    $chainref1->{policychain} = $chainref->{name};
+	    $chainref->{policychain} = $polchainref->{name};
 	}
 
-	$chainref1->{policy} = $policy;
-	$chainref1->{policypair} = [ $source, $dest ];
-	$chainref1->{origin} = $chainref->{origin};
+	$chainref->{policy}     = $policy;
+	$chainref->{policypair} = [ $source, $dest ];
+	$chainref->{origin}     = $polchainref->{origin};
     }
 }
 
@@ -582,19 +582,19 @@ sub process_a_policy() {
 	if ( $serverwild ) {
 	    for my $zone ( @zonelist ) {
 		for my $zone1 ( @zonelist ) {
-		    set_policy_chain $client, $server, rules_chain( ${zone}, ${zone1} ), $chainref, $policy, $intrazone;
+		    set_policy_chain rules_chain( ${zone}, ${zone1} ), $client, $server, $chainref, $policy, $intrazone;
 		    print_policy $zone, $zone1, $policy, $chain;
 		}
 	    }
 	} else {
 	    for my $zone ( all_zones ) {
-		set_policy_chain $client, $server, rules_chain( ${zone}, ${server} ), $chainref, $policy, $intrazone;
+		set_policy_chain rules_chain( ${zone}, ${server} ), $client, $server, $chainref, $policy, $intrazone;
 		print_policy $zone, $server, $policy, $chain;
 	    }
 	}
     } elsif ( $serverwild ) {
 	for my $zone ( @zonelist ) {
-	    set_policy_chain $client, $server, rules_chain( ${client}, ${zone} ), $chainref, $policy, $intrazone;
+	    set_policy_chain rules_chain( ${client}, ${zone} ), $client, $server, $chainref, $policy, $intrazone;
 	    print_policy $client, $zone, $policy, $chain;
 	}
 
@@ -670,8 +670,8 @@ sub process_policies()
 		unless ( $zone eq $zone1 ) {
 		    my $name  = rules_chain( $zone,  $zone1 );
 		    my $name1 = rules_chain( $zone1, $zone  );
-		    set_policy_chain( $zone,  $zone1, $name,  ensure_rules_chain( $name  ), 'NONE', 0 );
-		    set_policy_chain( $zone1, $zone,  $name1, ensure_rules_chain( $name1 ), 'NONE', 0 );
+		    set_policy_chain( $name,  $zone,  $zone1, ensure_rules_chain( $name  ), 'NONE', 0 );
+		    set_policy_chain( $name1, $zone1, $zone,  ensure_rules_chain( $name1 ), 'NONE', 0 );
 		}
 	    }
 	} elsif ( $type == LOOPBACK ) {
@@ -679,8 +679,8 @@ sub process_policies()
 		unless ( $zone eq $zone1 || zone_type( $zone1 ) == LOOPBACK ) {
 		    my $name  = rules_chain( $zone,  $zone1 );
 		    my $name1 = rules_chain( $zone1, $zone  );
-		    set_policy_chain( $zone,  $zone1, $name,  ensure_rules_chain( $name  ), 'NONE', 0 );
-		    set_policy_chain( $zone1, $zone,  $name1, ensure_rules_chain( $name1 ), 'NONE', 0 );
+		    set_policy_chain( $name,  $zone,  $zone1, ensure_rules_chain( $name  ), 'NONE', 0 );
+		    set_policy_chain( $name1, $zone1, $zone,  ensure_rules_chain( $name1 ), 'NONE', 0 );
 		}
 	    }
 	}
@@ -714,7 +714,7 @@ sub process_policies()
 #
 sub process_inline ($$$$$$$$$$$$$$$$$$$$$);
 
-sub policy_rules( $$$$$ ) {
+sub add_policy_rules( $$$$$ ) {
     my ( $chainref , $target, $loglevel, $default, $dropmulticast ) = @_;
 
     unless ( $target eq 'NONE' ) {
@@ -774,7 +774,7 @@ sub report_syn_flood_protection() {
 #
 # Complete a policy chain - Add policy-enforcing rules and syn flood, if specified
 #
-sub default_policy( $$$ ) {
+sub complete_policy_chain( $$$ ) { #Chainref, Source Zone, Destination Zone
     my $chainref   = $_[0];
     my $policyref  = $filter_table->{$chainref->{policychain}};
     my $synparams  = $policyref->{synparams};
@@ -785,20 +785,20 @@ sub default_policy( $$$ ) {
     assert( $policyref );
 
     if ( $chainref eq $policyref ) {
-	policy_rules $chainref , $policy, $loglevel , $default, $config{MULTICAST};
+	add_policy_rules $chainref , $policy, $loglevel , $default, $config{MULTICAST};
     } else {
 	if ( $policy eq 'ACCEPT' || $policy eq 'QUEUE' || $policy =~ /^NFQUEUE/ ) {
 	    if ( $synparams ) {
 		report_syn_flood_protection;
-		policy_rules $chainref , $policy , $loglevel , $default, $config{MULTICAST};
+		add_policy_rules $chainref , $policy , $loglevel , $default, $config{MULTICAST};
 	    } else {
 		add_ijump $chainref,  g => $policyref;
 		$chainref = $policyref;
-		policy_rules( $chainref, $policy, $loglevel, $default, $config{MULTICAST} ) if $default =~/^macro\./;
+		add_policy_rules( $chainref, $policy, $loglevel, $default, $config{MULTICAST} ) if $default =~/^macro\./;
 	    }
 	} elsif ( $policy eq 'CONTINUE' ) {
 	    report_syn_flood_protection if $synparams;
-	    policy_rules $chainref , $policy , $loglevel , $default, $config{MULTICAST};
+	    add_policy_rules $chainref , $policy , $loglevel , $default, $config{MULTICAST};
 	} else {
 	    report_syn_flood_protection if $synparams;
 	    add_ijump $chainref , g => $policyref;
@@ -814,7 +814,7 @@ sub ensure_rules_chain( $ );
 #
 # Finish all policy Chains
 #
-sub apply_policy_rules() {
+sub complete_policy_chains() {
     progress_message2 'Applying Policies...';
 
     for my $chainref ( @policy_chains ) {
@@ -845,7 +845,7 @@ sub apply_policy_rules() {
 
 	    if ( $name =~ /^all[-2]|[-2]all$/ ) {
 		run_user_exit $chainref;
-		policy_rules $chainref , $policy, $loglevel , $default, $config{MULTICAST};
+		add_policy_rules $chainref , $policy, $loglevel , $default, $config{MULTICAST};
 	    }
 	}
     }
@@ -856,7 +856,7 @@ sub apply_policy_rules() {
 
 	    if ( $chainref->{referenced} ) {
 		run_user_exit $chainref;
-		default_policy $chainref, $zone, $zone1;
+		complete_policy_chain $chainref, $zone, $zone1;
 	    }
 	}
     }
@@ -890,7 +890,7 @@ sub complete_standard_chain ( $$$$ ) {
     }
 
 
-    policy_rules $stdchainref , $policy , $loglevel, $defaultaction, 0;
+    add_policy_rules $stdchainref , $policy , $loglevel, $defaultaction, 0;
 }
 
 #
@@ -1140,7 +1140,7 @@ sub normalize_action_name( $ ) {
 #
 # Produce a recognizable target from a normalized action
 #
-sub externalize( $ ) {
+sub external_name( $ ) {
     my ( $target, $level, $tag, $params ) = split /:/, shift, 4;
 
     $target  = join( '', $target, '(', $params , ')' ) if $params;
@@ -1748,15 +1748,31 @@ sub process_actions() {
 						    undef, #Columns
 						    1 );   #Allow inline matches
 
-	    my $type        = ( $action eq $config{REJECT_ACTION} ? INLINE : ACTION );
-	    my $noinline    = 0;
-	    my $nolog       = ( $type == INLINE ) || 0;
-	    my $builtin     = 0;
-	    my $raw         = 0;
-	    my $mangle      = 0;
-	    my $filter      = 0;
-	    my $nat         = 0;
-	    my $terminating = 0;
+	    my $type = ( $action eq $config{REJECT_ACTION} ? INLINE : ACTION );
+
+	    use constant { INLINE_OPT           => 1 ,
+			   NOINLINE_OPT         => 2 ,
+			   NOLOG_OPT            => 4 ,
+			   BUILTIN_OPT          => 8 ,
+			   RAW_OPT              => 16 ,
+			   MANGLE_OPT           => 32 ,
+			   FILTER_OPT           => 64 ,
+			   NAT_OPT              => 128 ,
+			   TERMINATING_OPT      => 256 ,
+		       };
+
+	    my %options = ( inline      => INLINE_OPT ,
+			    noinline    => NOINLINE_OPT ,
+			    nolog       => NOLOG_OPT ,
+			    builtin     => BUILTIN_OPT ,
+			    raw         => RAW_OPT ,
+			    mangle      => MANGLE_OPT ,
+			    filter      => FILTER_OPT ,
+			    nat         => NAT_OPT ,
+			    terminating => TERMINATING_OPT ,
+			  );
+
+	    my $opts = $type == INLINE ? NOLOG_OPT : 0;
 
 	    if ( $action =~ /:/ ) {
 		warning_message 'Default Actions are now specified in /etc/shorewall/shorewall.conf';
@@ -1767,31 +1783,14 @@ sub process_actions() {
 
 	    if ( $options ne '-' ) {
 		for ( split_list( $options, 'option' ) ) {
-		    if ( $_ eq 'inline' ) {
-			$type = INLINE;
-		    } elsif ( $_ eq 'noinline' ) {
-			$noinline = 1;
-		    } elsif ( $_ eq 'nolog' ) {
-			$nolog = 1;
-		    } elsif ( $_ eq 'builtin' ) {
-			$builtin = 1;
-		    } elsif ( $_ eq 'terminating' ) {
-			$terminating = 1;
-		    } elsif ( $_ eq 'mangle' ) {
-			$mangle = 1;
-		    } elsif ( $_ eq 'raw' ) {
-			$raw = 1;
-		    } elsif ( $_ eq 'filter' ) {
-			$filter = 1;
-		    } elsif ( $_ eq 'nat' ) {
-			$nat = 1;
-		    } else {
-			fatal_error "Invalid option ($_)";
-		    }
+		    fatal_error "Invalid option ($_)" unless $options{$_};
+		    $opts |= $options{$_};
 		}
+
+		$type = INLINE if $opts & INLINE_OPT;
 	    }
 
-	    fatal_error "Conflicting OPTIONS ($options)" if $noinline && $type == INLINE;
+	    fatal_error "Conflicting OPTIONS ($options)" if ( $opts & NOINLINE_OPT && $type == INLINE ) || ( $opts & INLINE_OPT && $opts & BUILTIN_OPT );
 
 	    if ( my $actiontype = $targets{$action} ) {
 		if ( ( $actiontype & ACTION ) && ( $type == INLINE ) ) {
@@ -1808,15 +1807,15 @@ sub process_actions() {
 		}
 	    }
 
-	    if ( $builtin ) {
+	    if ( $opts & BUILTIN_OPT ) {
 		my $actiontype = USERBUILTIN | OPTIONS;
-		$actiontype   |= MANGLE_TABLE if $mangle;
-		$actiontype   |= RAW_TABLE    if $raw;
-		$actiontype   |= NAT_TABLE    if $nat;
+		$actiontype   |= MANGLE_TABLE if $opts & MANGLE_OPT;
+		$actiontype   |= RAW_TABLE    if $opts & RAW_OPT;
+		$actiontype   |= NAT_TABLE    if $opts & NAT_OPT;
 		#
 		# For backward compatibility, we assume that user-defined builtins are valid in the filter table
 		#
-		$actiontype |= FILTER_TABLE if $filter || ! ($mangle || $raw || $nat);
+		$actiontype |= FILTER_TABLE if $opts & FILTER_OPT || ! ( $opts & ( MANGLE_OPT | RAW_OPT | NAT_OPT ) );
 
 		if ( $builtin_target{$action} ) {
 		    $builtin_target{$action} |= $actiontype;
@@ -1826,16 +1825,17 @@ sub process_actions() {
 
 		$targets{$action} = $actiontype;
 
-		make_terminating( $action ) if $terminating;
+		make_terminating( $action ) if $opts & TERMINATING_OPT
 	    } else {
-		fatal_error "Table names are only allowed for builtin actions" if $mangle || $raw || $nat || $filter;
-		new_action $action, $type, $noinline, $nolog;
+		fatal_error "Table names are only allowed for builtin actions" if $opts & ( MANGLE_OPT | RAW_OPT | NAT_OPT | FILTER_OPT );
+
+		new_action $action, $type, ( $opts & NOINLINE_OPT ) != 0 , ( $opts & NOLOG_OPT ) != 0;
 
 		my $actionfile = find_file( "action.$action" );
 
 		fatal_error "Missing Action File ($actionfile)" unless -f $actionfile;
 
-		$inlines{$action} = { file => $actionfile, nolog => $nolog } if $type == INLINE;
+		$inlines{$action} = { file => $actionfile, nolog => $opts & NOLOG_OPT } if $type == INLINE;
 	    }
 	}
     }
@@ -2211,6 +2211,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$ ) {
     my $blacklist   = ( $section == BLACKLIST_SECTION );
     my $matches     = $rule;
     my $raw_matches = '';
+    my $exceptionrule = '';
 
     if ( $inchain = defined $chainref ) {
 	( $inaction, undef, undef, undef ) = split /:/, $normalized_action = $chainref->{action}, 4 if $chainref->{action};
@@ -2284,7 +2285,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$ ) {
 	validate_level( $action );
 	$loglevel = supplied $loglevel ? join( ':', $action, $loglevel ) : $action;
 	$action   = 'LOG';
-    } elsif ( ! ( $actiontype & (ACTION | INLINE | IPTABLES ) ) ) {
+    } elsif ( ! ( $actiontype & (ACTION | INLINE | IPTABLES | TARPIT ) ) ) {
 	fatal_error "'builtin' actions may only be used in INLINE rules" if $actiontype == USERBUILTIN;
 	fatal_error "The $basictarget TARGET does not accept a parameter" unless $param eq '';
     }
@@ -2294,7 +2295,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$ ) {
     #
     fatal_error "The +, - and ! modifiers are not allowed in the blrules file" if $action =~ s/[-+!]$// && $blacklist;
     
-    unless ( $actiontype & ( ACTION | INLINE | IPTABLES ) ) {
+    unless ( $actiontype & ( ACTION | INLINE | IPTABLES | TARPIT ) ) {
 	#
 	# Catch empty parameter list
 	#
@@ -2398,6 +2399,22 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$ ) {
 		      $action = '';
 		  }
 	      },
+
+	      TARPIT => sub {
+		  require_capability 'TARPIT_TARGET', 'TARPIT', 's';
+
+		  fatal_error "TARPIT is only valid with PROTO tcp (6)" if ( resolve_proto( $proto ) || 0 ) != TCP;
+
+		  if ( supplied $param ) {
+		      fatal_error "TARPIT Parameter must be 'tarpit', 'honeypot' or 'reset'" unless $param =~ /^(tarpit|honeypot|reset)$/;
+		      $action     = "TARPIT --$param";
+		      $log_action = 'TARPIT';
+		  } else {
+		      $action = $log_action = 'TARPIT';
+		  }
+
+		  $exceptionrule = '-p 6 ';
+	      },
 	    );
 
 	my $function = $functions{ $bt };
@@ -2466,11 +2483,9 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$ ) {
 		$destzone = '';
 	    }
 	}
-    } else {
-	unless ( $inchain ) {
-	    fatal_error "Missing destination zone" if $destzone eq '-' || $destzone eq '';
-	    fatal_error "Unknown destination zone ($destzone)" unless $destref = defined_zone( $destzone );
-	}
+    } elsif ( ! $inchain ) {
+	fatal_error "Missing destination zone" if $destzone eq '-' || $destzone eq '';
+	fatal_error "Unknown destination zone ($destzone)" unless $destref = defined_zone( $destzone );
     }
 
     my $restriction = NO_RESTRICT;
@@ -2590,7 +2605,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$ ) {
 	#
 	$normalized_target = normalize_action( $basictarget, $loglevel, $param );
 
-	fatal_error( "Action $basictarget invoked Recursively (" .  join( '->', map( externalize( $_ ), @actionstack , $normalized_target ) ) . ')' ) if $active{$basictarget};
+	fatal_error( "Action $basictarget invoked Recursively (" .  join( '->', map( external_name( $_ ), @actionstack , $normalized_target ) ) . ')' ) if $active{$basictarget};
 
 	if ( my $ref = use_action( $normalized_target ) ) {
 	    #
@@ -2833,7 +2848,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$ ) {
 		     $action ,
 		     $loglevel ,
 		     $log_action ,
-		     '' )
+		     $exceptionrule )
 	    unless unreachable_warning( $wildcard || $section == DEFAULTACTION_SECTION, $chainref );
     }
 

Shorewall/Perl/Shorewall/Tc.pm

@@ -225,6 +225,7 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
     my  $device         = '';
     our $cmd;
     our $designator;
+    our $ttl            = 0;
     my $fw              = firewall_zone;
 
     sub handle_mark_param( $$ ) {
@@ -260,6 +261,8 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
 	    $chain ||= $designator;
 	    $chain ||= $default_chain;
 
+	    $option ||= ( $and_or eq '|' ? '--or-mark' : $and_or ? '--and-mark' : '--set-mark' );
+
 	    my $chainref = ensure_chain( 'mangle', $chain = $chainnames{$chain} );
 
 	    for ( my $packet = 0; $packet < $marks; $packet++, $markval += $increment ) {
@@ -331,7 +334,31 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
 	}
     }
 
+    sub ipset_command() {
+	my %xlate = ( ADD => 'add-set' , DEL => 'del-set' );
+
+	require_capability( 'IPSET_MATCH', "$cmd rules", '' );
+	fatal_error "$cmd rules require a set name parameter" unless $params;
+
+	my ( $setname, $flags, $rest ) = split ':', $params, 3;
+	fatal_error "Invalid ADD/DEL parameter ($params)" if $rest;
+	$setname =~ s/^\+//;
+	fatal_error "Expected ipset name ($setname)" unless $setname =~ /^(6_)?[a-zA-Z][-\w]*$/;
+	fatal_error "Invalid flags ($flags)" unless defined $flags && $flags =~ /^(dst|src)(,(dst|src)){0,5}$/;
+	$target = join( ' ', 'SET --' . $xlate{$cmd} , $setname , $flags );
+    }
+
     my %commands = (
+	ADD       => {
+	    defaultchain   => PREROUTING,
+	    allowedchains  => ALLCHAINS,
+	    minparams      => 1,
+	    maxparams      => 1,
+	    function       => sub() {
+		ipset_command();
+	    }
+	},
+
 	CHECKSUM   => {
 	    defaultchain   => 0,
 	    allowedchains  => ALLCHAINS,
@@ -394,6 +421,16 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
 	    },
 	},
 
+	DEL       => {
+	    defaultchain   => PREROUTING,
+	    allowedchains  => ALLCHAINS,
+	    minparams      => 1,
+	    maxparams      => 1,
+	    function       => sub() {
+		ipset_command();
+	    }
+	},
+
 	DIVERT     => {
 	    defaultchain   => REALPREROUTING,
 	    allowedchains  => PREROUTING | REALPREROUTING,
@@ -562,7 +599,7 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
 
 	RESTORE    => {
 	    defaultchain   => 0,
-	    allowedchains  => PREROUTING | FORWARD | OUTPUT | POSTROUTING,
+	    allowedchains  => PREROUTING | INPUT | FORWARD | OUTPUT | POSTROUTING,
 	    minparams      => 0,
 	    maxparams      => 1,
 	    function       => sub () {
@@ -585,13 +622,20 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
 		$target = ( $chain == OUTPUT ? 'sticko' : 'sticky' );
 		$restriction = DESTIFACE_DISALLOW;
 		ensure_mangle_chain( $target );
+		if (supplied $params) {
+		    $ttl = numeric_value( $params );
+		    fatal_error "The SAME timeout must be positive" unless $ttl;
+		} else {
+		    $ttl = 300;
+		}
+
 		$sticky++;
 	    },
 	},
 
 	SAVE       => {
 	    defaultchain   => 0,
-	    allowedchains  => PREROUTING | FORWARD | OUTPUT | POSTROUTING,
+	    allowedchains  => PREROUTING | INPUT | FORWARD | OUTPUT | POSTROUTING,
 	    minparams      => 0,
 	    maxparams      => 1,
 	    function       => sub () {
@@ -599,7 +643,6 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
 		if ( supplied $params ) {
 		    handle_mark_param( '--save-mark --mask ' ,
 				       $config{TC_EXPERT} ? HIGHMARK : SMALLMARK );
-
 		} else {
 		    $target .= '--save-mark --mask ' . in_hex( $globals{TC_MASK} );
 		}
@@ -763,7 +806,7 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
 
 	for ( @state ) {
 	    fatal_error "Invalid STATE ($_)"   unless exists $state{$_};
-	    fatal_error "Duplicate STATE ($_)" if $state{$_};
+	    fatal_error "Duplicate STATE ($_)" if $state{$_}++;
 	}
     } else {
 	$state = 'ALL';
@@ -799,6 +842,7 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
 					 do_dscp( $dscp ) .
 					 state_match( $state ) .
 					 do_time( $time ) .
+					 ( $ttl ? "-t $ttl " : '' ) .
 					 $raw_matches ,
 					 $source ,
 					 $dest ,
@@ -850,13 +894,17 @@ sub process_tc_rule1( $$$$$$$$$$$$$$$$ ) {
     our  %tccmd;
 
     unless ( %tccmd ) {
-	%tccmd = ( SAVE =>     { match     => sub ( $ ) { $_[0] eq 'SAVE' } ,
+	%tccmd = ( ADD =>      { match     => sub ( $ ) { $_[0] =~ /^ADD/ } 
+		               },
+		   DEL =>      { match     => sub ( $ ) { $_[0] =~ /^DEL/ }
+		               },
+	           SAVE =>     { match     => sub ( $ ) { $_[0] eq 'SAVE' } ,
 			       } ,
 		   RESTORE =>  { match     => sub ( $ ) { $_[0] eq 'RESTORE' },
 			       } ,
 		   CONTINUE => { match     => sub ( $ ) { $_[0] eq 'CONTINUE' },
 			       } ,
-		   SAME =>     { match     => sub ( $ ) { $_[0] eq 'SAME' },
+		   SAME =>     { match     => sub ( $ ) { $_[0] =~ /^SAME(?:\(d+\))?$/ },
 			       } ,
 		   IPMARK =>   { match     => sub ( $ ) { $_[0] =~ /^IPMARK/ },
 			       } ,
@@ -1053,7 +1101,7 @@ sub process_mangle_rule( ) {
     my ( $originalmark, $source, $dest, $protos, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $headers, $probability , $dscp , $state, $time );
     if ( $family == F_IPV4 ) {
 	( $originalmark, $source, $dest, $protos, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $probability, $dscp, $state, $time ) =
-	    split_line2( 'tcrules file',
+	    split_line2( 'mangle file',
 			 { mark => 0,
 			   action => 0,
 			   source => 1,
@@ -1078,7 +1126,7 @@ sub process_mangle_rule( ) {
 	$headers = '-';
     } else {
 	( $originalmark, $source, $dest, $protos, $ports, $sports, $user, $testval, $length, $tos , $connbytes, $helper, $headers, $probability, $dscp, $state, $time ) =
-	    split_line2( 'tcrules file',
+	    split_line2( 'mangle file',
 			 { mark => 0,
 			   action => 0,
 			   source => 1,

Shorewall/Perl/Shorewall/Tunnels.pm

@@ -132,6 +132,13 @@ sub setup_tunnels() {
 	add_tunnel_rule $inchainref,  p => 'tcp --dport 1723', @$source
 	}
 
+    sub setup_one_tinc {
+	my ( $inchainref, $outchainref, $kind, $source, $dest ) = @_;
+
+	add_tunnel_rule $inchainref,  p => 'udp --dport 655', @$source;
+	add_tunnel_rule $outchainref, p => 'udp --dport 655', @$dest;
+    }
+
     sub setup_one_openvpn {
 	my ($inchainref, $outchainref, $kind, $source, $dest) = @_;
 
@@ -154,7 +161,7 @@ sub setup_tunnels() {
 	}
 
 	add_tunnel_rule $inchainref,  p => "$protocol --dport $port", @$source;
-	add_tunnel_rule $outchainref, p => "$protocol --dport $port", @$dest;;
+	add_tunnel_rule $outchainref, p => "$protocol --dport $port", @$dest;
     }
 
     sub setup_one_openvpn_client {
@@ -263,6 +270,7 @@ sub setup_tunnels() {
 				'6in4'          => { function => \&setup_one_other,          params   => [ \@source, \@dest , 41 ] } ,
 				'pptpclient'    => { function => \&setup_pptp_client,        params   => [ $kind, \@source, \@dest ] } ,
 				'pptpserver'    => { function => \&setup_pptp_server,        params   => [ $kind, \@source, \@dest ] } ,
+				'tinc'          => { function => \&setup_one_tinc,           params   => [ $kind, \@source, \@dest ] } ,
 				'openvpn'       => { function => \&setup_one_openvpn,        params   => [ $kind, \@source, \@dest ] } ,
 				'openvpnclient' => { function => \&setup_one_openvpn_client, params   => [ $kind, \@source, \@dest ] } ,
 				'openvpnserver' => { function => \&setup_one_openvpn_server, params   => [ $kind, \@source, \@dest ] } ,

Shorewall/Perl/Shorewall/Zones.pm

@@ -55,6 +55,7 @@ our @EXPORT = ( qw( NOTHING
 		    find_zone
 		    firewall_zone
 		    loopback_zones
+		    loopback_interface
 		    local_zones
 		    defined_zone
 		    zone_type
@@ -219,6 +220,7 @@ our $minroot;
 our $zonemark;
 our $zonemarkincr;
 our $zonemarklimit;
+our $loopback_interface;
 
 use constant { FIREWALL => 1,
 	       IP       => 2,
@@ -329,6 +331,7 @@ sub initialize( $$ ) {
     %mapbase1 = ();
     $baseseq = 0;
     $minroot = 0;
+    $loopback_interface = '';
 
     if ( $family == F_IPV4 ) {
 	%validinterfaceoptions = (arp_filter  => BINARY_IF_OPTION,
@@ -341,6 +344,7 @@ sub initialize( $$ ) {
 				  ignore      => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
 				  maclist     => SIMPLE_IF_OPTION + IF_OPTION_HOST,
 				  logmartians => BINARY_IF_OPTION,
+				  loopback    => BINARY_IF_OPTION,
 				  nets        => IPLIST_IF_OPTION + IF_OPTION_ZONEONLY + IF_OPTION_VSERVER,
 				  norfc1918   => OBSOLETE_IF_OPTION,
 				  nosmurfs    => SIMPLE_IF_OPTION + IF_OPTION_HOST,
@@ -386,6 +390,7 @@ sub initialize( $$ ) {
 				    destonly    => SIMPLE_IF_OPTION + IF_OPTION_HOST,
 				    dhcp        => SIMPLE_IF_OPTION,
 				    ignore      => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
+				    loopback    => BINARY_IF_OPTION,
 				    maclist     => SIMPLE_IF_OPTION + IF_OPTION_HOST,
 				    nets        => IPLIST_IF_OPTION + IF_OPTION_ZONEONLY + IF_OPTION_VSERVER,
 				    nosmurfs    => SIMPLE_IF_OPTION + IF_OPTION_HOST,
@@ -1353,8 +1358,15 @@ sub process_interface( $$ ) {
 	$options{ignore} ||= 0;
     }
 
+    $options{loopback} ||= ( $physical eq 'lo' );
+
+    if ( $options{loopback} ) {
+	fatal_error "Only one 'loopback' interface is allowed" if $loopback_interface;
+	$loopback_interface = $physical;
+    }
+
     if ( $options{unmanaged} ) {
-	fatal_error "The 'lo' interface may not be unmanaged when there are vserver zones" if $physical eq 'lo' && vserver_zones;
+	fatal_error "The loopback interface ($loopback_interface) may not be unmanaged when there are vserver zones" if $options{loopback} && vserver_zones;
 
 	while ( my ( $option, $value ) = each( %options ) ) {
 	    fatal_error "The $option option may not be specified with 'unmanaged'" if $prohibitunmanaged{$option};
@@ -1382,9 +1394,9 @@ sub process_interface( $$ ) {
     if ( $zone ) {
 	fatal_error "Unmanaged interfaces may not be associated with a zone" if $options{unmanaged};
 
-	if ( $physical eq 'lo' ) {
-	    fatal_error "Only a loopback zone may be assigned to 'lo'" unless $zoneref->{type} == LOOPBACK;
-	    fatal_error "Invalid definition of 'lo'"                   if $bridge ne $interface;
+	if ( $options{loopback} ) {
+	    fatal_error "Only a loopback zone may be assigned to '$physical'" unless $zoneref->{type} == LOOPBACK;
+	    fatal_error "Invalid definition of '$physical'"                   if $bridge ne $interface;
 	    
 	    for ( qw/arp_filter
 		     arp_ignore
@@ -1406,10 +1418,10 @@ sub process_interface( $$ ) {
 		     upnpclient
 		     mss
 		    / ) {
-		fatal_error "The 'lo' interface may not specify the '$_' option" if supplied $options{$_};
+		fatal_error "The '$config{LOOPBACK}' interface may not specify the '$_' option" if supplied $options{$_};
 	    }
 	} else {
-	    fatal_error "A loopback zone may only be assigned to 'lo'" if $zoneref->{type} == LOOPBACK;
+	    fatal_error "A loopback zone may only be assigned to the loopback interface" if $zoneref->{type} == LOOPBACK;
 	}
 
 	$netsref ||= [ allip ];
@@ -1466,6 +1478,22 @@ sub validate_interfaces_file( $ ) {
     #
     fatal_error "No network interfaces defined" unless @interfaces;
 
+    #
+    # Define the loopback interface if it hasn't been already
+    #
+    unless ( $loopback_interface ) {
+	$interfaces{lo} = { name             => 'lo',
+			    bridge           => 'lo',
+			    nets             => 0,
+			    number           => $nextinum++,
+			    root             => 'lo',
+			    broadcasts       => undef,
+			    options          => { loopback => 1 , ignore => 1 },
+			    zone             => '',
+			    physical         => 'lo' };
+	push @interfaces, $loopback_interface = 'lo';
+    }
+
     if ( vserver_zones ) {
 	#
 	# While the user thinks that vservers are associated with a particular interface, they really are not.
@@ -1481,7 +1509,7 @@ sub validate_interfaces_file( $ ) {
 				    broadcasts => undef ,
 				    options    => {} ,
 				    zone       => '',
-				    physical   => 'lo',
+				    physical   => $loopback_interface,
 				  };
 
 	push @interfaces, $interface;
@@ -1543,6 +1571,13 @@ sub known_interface($)
     $physical{$interface} || 0;
 }
 
+# 
+# Return the loopback interface physical name
+#
+sub loopback_interface() {
+    $loopback_interface;
+}
+
 #
 # Return interface number
 #
@@ -1589,7 +1624,7 @@ sub managed_interfaces() {
 # Return a list of unmanaged interfaces (skip 'lo' since it is implicitly unmanaged when there are no loopback zones).
 #
 sub unmanaged_interfaces() {
-    grep ( $interfaces{$_}{options}{unmanaged} && $_ ne 'lo', @interfaces );
+    grep ( $interfaces{$_}{options}{unmanaged} && ! $interfaces{$_}{options}{loopback}, @interfaces );
 }
 
 #
@@ -1989,10 +2024,10 @@ sub process_host( ) {
 	fatal_error "Unknown interface ($interface)" unless ($interfaceref = $interfaces{$interface}) && $interfaceref->{root};
 	fatal_error "Unmanaged interfaces may not be associated with a zone" if $interfaceref->{unmanaged};
 
-	if ( $interfaceref->{name} eq 'lo' ) {
-	    fatal_error "Only a loopback zone may be associated with the loopback interface (lo)" if $type != LOOPBACK;
+	if ( $interfaceref->{physical} eq $loopback_interface ) {
+	    fatal_error "Only a loopback zone may be associated with the loopback interface ($loopback_interface)" if $type != LOOPBACK;
 	} else {
-	    fatal_error "Loopback zones may only be associated with the loopback interface (lo)" if $type == LOOPBACK;
+	    fatal_error "Loopback zones may only be associated with the loopback interface ($loopback_interface)" if $type == LOOPBACK;
 	}
     } else {
 	fatal_error "Invalid HOST(S) column contents: $hosts"

Shorewall/Perl/lib.core

@@ -652,7 +652,7 @@ interface_is_usable() # $1 = interface
     local status;
     status=0
 
-    if [ "$1" != lo ]; then
+    if ! loopback_interface $1; then
 	if interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != 0.0.0.0 ]; then
 	    [ "$COMMAND" = enable ] || run_isusable_exit $1
 	    status=$?
@@ -902,18 +902,21 @@ detect_gateway() # $1 = interface
 # Disable IPV6
 #
 disable_ipv6() {
-    local foo
-    foo="$($IP -f inet6 addr list 2> /dev/null)"
+    local temp
+    temp="$($IP -f inet6 addr list 2> /dev/null)"
 
-    if [ -n "$foo" ]; then
+    if [ -n "$temp" ]; then
 	if [ -x "$IP6TABLES" ]; then
 	    $IP6TABLES -P FORWARD DROP
 	    $IP6TABLES -P INPUT DROP
 	    $IP6TABLES -P OUTPUT DROP
 	    $IP6TABLES -F
 	    $IP6TABLES -X
-	    $IP6TABLES -A OUTPUT -o lo -j ACCEPT
-	    $IP6TABLES -A INPUT -i lo -j ACCEPT
+
+	    for temp in $(find_loopback_interfaces); do
+		$IP6TABLES -A OUTPUT -o $temp -j ACCEPT
+		$IP6TABLES -A INPUT  -i $temp -j ACCEPT
+	    done
 	else
 	    error_message "WARNING: DISABLE_IPV6=Yes in shorewall.conf but this system does not appear to have ip6tables"
 	fi

Shorewall/Perl/prog.footer

@@ -373,20 +373,24 @@ case "$COMMAND" in
 	[ $# -eq 1 ] && exit 0
 	shift
 	[ $# -ne 1 ] && usage 2
+	mutex_on
 	if product_is_started; then
 	    detect_configuration
 	    enable_provider $1
 	fi
+	mutex_off
 	status=0
 	;;
     disable)
 	[ $# -eq 1 ] && exit 0
 	shift
 	[ $# -ne 1 ] && usage 2
+	mutex_on
 	if product_is_started; then
 	    detect_configuration
 	    disable_provider $1
 	fi
+	mutex_off
 	status=0
 	;;
     run)

Shorewall/Samples/Universal/shorewall.conf

@@ -188,7 +188,7 @@ MAPOLDACTIONS=No
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX=ko
+MODULE_SUFFIX="ko ko.xz"
 
 MULTICAST=No
 

Shorewall/Samples/one-interface/shorewall.conf

@@ -199,7 +199,7 @@ MAPOLDACTIONS=No
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX=ko
+MODULE_SUFFIX="ko ko.xz"
 
 MULTICAST=No
 

Shorewall/Samples/three-interfaces/shorewall.conf

@@ -196,7 +196,7 @@ MAPOLDACTIONS=No
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX=ko
+MODULE_SUFFIX="ko ko.xz"
 
 MULTICAST=No
 

Shorewall/Samples/two-interfaces/shorewall.conf

@@ -199,7 +199,7 @@ MAPOLDACTIONS=No
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX=ko
+MODULE_SUFFIX="ko ko.xz"
 
 MULTICAST=No
 

Shorewall/configfiles/shorewall.conf

@@ -166,7 +166,7 @@ HELPERS=
 
 IMPLICIT_CONTINUE=No
 
-INLINE_MATCHES=Yes
+INLINE_MATCHES=No
 
 IPSET_WARNINGS=Yes
 

Shorewall/install.sh

@@ -323,6 +323,7 @@ if [ $PRODUCT = shorewall ]; then
 	    fi
 
 	    eval sed -i \'s/Digest::SHA/Digest::$DIGEST/\' Perl/Shorewall/Chains.pm
+	    eval sed -i \'s/Digest::SHA/Digest::$DIGEST/\' Perl/Shorewall/Config.pm
 	fi
     elif [ "$BUILD" = "$HOST" ]; then
         #

Shorewall/lib.cli-std

@@ -109,25 +109,6 @@ get_config() {
 	    g_tool=$IP6TABLES
 	fi
 
-	if [ -n "$IP" ]; then
-	    case "$IP" in
-		*/*)
-		    if [ ! -x "$IP" ] ; then
-			fatal_error "The program specified in IP ($IP) does not exist or is not executable"
-		    fi
-		    ;;
-		*)
-		    prog="$(mywhich $IP 2> /dev/null)"
-		    if [ -z "$prog" ] ; then
-			fatal_error "Can't find $IP executable"
-		    fi
-		    IP=$prog
-		    ;;
-	    esac
-	else
-	    IP='ip'
-	fi
-
 	if [ -n "$IPSET" ]; then
 	    case "$IPSET" in
 		*/*)
@@ -245,6 +226,25 @@ get_config() {
 	fi
     fi
 
+    if [ -n "$IP" ]; then
+	case "$IP" in
+	    */*)
+		if [ ! -x "$IP" ] ; then
+		    fatal_error "The program specified in IP ($IP) does not exist or is not executable"
+		fi
+		;;
+	    *)
+		prog="$(mywhich $IP 2> /dev/null)"
+		if [ -z "$prog" ] ; then
+		    fatal_error "Can't find $IP executable"
+		fi
+		IP=$prog
+		;;
+	esac
+    else
+	IP='ip'
+    fi
+
     case $VERBOSITY in
 	-1|0|1|2)
 	    ;;
@@ -323,6 +323,8 @@ get_config() {
 	    LEGACY_FASTSTART=Yes
 	    ;;
     esac
+
+    g_loopback=$(find_loopback_interfaces)
 }
 
 #

Shorewall/manpages/shorewall-interfaces.xml

@@ -213,7 +213,7 @@ loc     eth2            -</programlisting>
                 changed; the value assigned to the setting will be the value
                 specified (if any) or 1 if no value is given.</para>
 
-                <para></para>
+                <para/>
 
                 <note>
                   <para>This option does not work with a wild-card
@@ -247,7 +247,7 @@ loc     eth2            -</programlisting>
 
                 <para>8 - do not reply for all local addresses</para>
 
-                <para></para>
+                <para/>
 
                 <note>
                   <para>This option does not work with a wild-card
@@ -255,7 +255,7 @@ loc     eth2            -</programlisting>
                   the INTERFACE column.</para>
                 </note>
 
-                <para></para>
+                <para/>
 
                 <warning>
                   <para>Do not specify <emphasis
@@ -382,6 +382,17 @@ loc     eth2            -</programlisting>
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term>loopback</term>
+
+              <listitem>
+                <para>Added in Shorewall 4.6.6. Designates the interface as
+                the loopback interface. This option is assumed if the
+                interface's physical name is 'lo'. Only one interface man have
+                the <option>loopback</option> option specified.</para>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term><emphasis
               role="bold">logmartians[={0|1}]</emphasis></term>
@@ -414,7 +425,7 @@ loc     eth2            -</programlisting>
         1
         teastep@lists:~$ </programlisting>
 
-                <para></para>
+                <para/>
 
                 <note>
                   <para>This option does not work with a wild-card

Shorewall/manpages/shorewall-mangle.xml

@@ -124,7 +124,29 @@
 
           <variablelist>
             <varlistentry>
-              <term>CHECKSUM</term>
+              <term><emphasis
+              role="bold">ADD(<replaceable>ipset</replaceable>:<replaceable>flags</replaceable>)</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.6.7. Causes addresses and/or port
+                numbers to be added to the named
+                <replaceable>ipset</replaceable>. The
+                <replaceable>flags</replaceable> specify the address or tuple
+                to be added to the set and must match the type of ipset
+                involved. For example, for an iphash ipset, either the SOURCE
+                or DESTINATION address can be added using
+                <replaceable>flags</replaceable> <emphasis
+                role="bold">src</emphasis> or <emphasis
+                role="bold">dst</emphasis> respectively (see the -A command in
+                ipset (8)).</para>
+
+                <para>ADD is non-terminating. Even if a packet matches the
+                rule, it is passed on to the next rule.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">CHECKSUM</emphasis></term>
 
               <listitem>
                 <para>Compute and fill in the checksum in a packet that lacks
@@ -139,7 +161,8 @@
             </varlistentry>
 
             <varlistentry>
-              <term>CLASSIFY(<replaceable>classid</replaceable>)</term>
+              <term><emphasis
+              role="bold">CLASSIFY(<replaceable>classid</replaceable>)</emphasis></term>
 
               <listitem>
                 <para>A classification Id (classid) is of the form
@@ -189,7 +212,8 @@
             </varlistentry>
 
             <varlistentry>
-              <term>CONMARK({mark|range})</term>
+              <term><emphasis
+              role="bold">CONMARK({mark|range})</emphasis></term>
 
               <listitem>
                 <para>Identical to MARK with the exception that the mark is
@@ -212,6 +236,27 @@
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term><emphasis
+              role="bold">DEL(<replaceable>ipset</replaceable>:<replaceable>flags</replaceable>)</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.6.7. Causes an entry to be deleted
+                from the named <replaceable>ipset</replaceable>. The
+                <replaceable>flags</replaceable> specify the address or tuple
+                to be deleted from the set and must match the type of ipset
+                involved. For example, for an iphash ipset, either the SOURCE
+                or DESTINATION address can be deleted using
+                <replaceable>flags</replaceable> <emphasis
+                role="bold">src</emphasis> or <emphasis
+                role="bold">dst</emphasis> respectively (see the -D command in
+                ipset (8)).</para>
+
+                <para>DEL is non-terminating. Even if a packet matches the
+                rule, it is passed on to the next rule.</para>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term><emphasis role="bold">DIVERT</emphasis></term>
 
@@ -322,7 +367,7 @@ INLINE          eth0              -                 ; -p tcp -j MARK --set-mark
             </varlistentry>
 
             <varlistentry>
-              <term>IPMARK</term>
+              <term><emphasis role="bold">IPMARK</emphasis></term>
 
               <listitem>
                 <para>Assigns a mark to each matching packet based on the
@@ -430,8 +475,9 @@ INLINE          eth0              -                 ; -p tcp -j MARK --set-mark
             </varlistentry>
 
             <varlistentry>
-              <term>IPTABLES({<replaceable>target</replaceable>
-              [<replaceable>option</replaceable> ...])</term>
+              <term><emphasis
+              role="bold">IPTABLES({<replaceable>target</replaceable>
+              [<replaceable>option</replaceable> ...])</emphasis></term>
 
               <listitem>
                 <para>This action allows you to specify an iptables target
@@ -452,7 +498,8 @@ INLINE          eth0              -                 ; -p tcp -j MARK --set-mark
             </varlistentry>
 
             <varlistentry>
-              <term>MARK({<replaceable>mark</replaceable>|<replaceable>range</replaceable>})</term>
+              <term><emphasis
+              role="bold">MARK({<replaceable>mark</replaceable>|<replaceable>range</replaceable>})</emphasis></term>
 
               <listitem>
                 <para>where <replaceable>mark</replaceable> is a packet mark
@@ -495,7 +542,7 @@ INLINE          eth0              -                 ; -p tcp -j MARK --set-mark
 
             <varlistentry>
               <term><emphasis
-              role="bold">RESTORE</emphasis>[(/<emphasis>mask</emphasis>)]</term>
+              role="bold">RESTORE</emphasis>[(<emphasis>mask</emphasis>)]</term>
 
               <listitem>
                 <para>Restore the packet's mark from the connection's mark
@@ -505,7 +552,8 @@ INLINE          eth0              -                 ; -p tcp -j MARK --set-mark
             </varlistentry>
 
             <varlistentry>
-              <term><emphasis role="bold">SAME</emphasis></term>
+              <term><emphasis
+              role="bold">SAME[(<replaceable>timeout</replaceable>)]</emphasis></term>
 
               <listitem>
                 <para>Some websites run applications that require multiple
@@ -529,17 +577,22 @@ SAME:P            192.168.1.0/24 0.0.0.0/0    tcp        80,443</programlisting>
                 connections to an individual remote system to all use the same
                 provider. For example:<programlisting>#ACTION           SOURCE         DEST         PROTO      DEST
 #                                                        PORT(S)
-SAME              $FW            0.0.0.0/0    tcp        80,443</programlisting>
-                If the firewall attempts a connection on TCP port 80 or 443
-                and it has sent a packet on either of those ports in the last
-                five minutes to the same remote system then the new connection
-                will use the same provider as the connection over which that
-                last packet was sent.</para>
+SAME              $FW            0.0.0.0/0    tcp        80,443</programlisting>The
+                optional <replaceable>timeout</replaceable> parameter was
+                added in Shorewall 4.6.7 and specifies a number of seconds .
+                When not specified, a value of 300 seconds (5 minutes) is
+                assumed. If the firewall attempts a connection on TCP port 80
+                or 443 and it has sent a packet on either of those ports in
+                the last <replaceable>timeout</replaceable> seconds to the
+                same remote system then the new connection will use the same
+                provider as the connection over which that last packet was
+                sent.</para>
               </listitem>
             </varlistentry>
 
             <varlistentry>
-              <term><emphasis role="bold">SAVE[(/<emphasis>mask)</emphasis>]
+              <term><emphasis
+              role="bold">SAVE[(<emphasis><replaceable>mask</replaceable>)</emphasis>]
               </emphasis></term>
 
               <listitem>

Shorewall/manpages/shorewall-providers.xml

@@ -255,6 +255,19 @@
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term><emphasis role="bold">primary</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.6.6, <emphasis
+                role="bold">primary</emphasis> is equivalent to <emphasis
+                role="bold">balance=1</emphasis> and is preferred when the
+                remaining providers specify <emphasis
+                role="bold">fallback</emphasis> or <emphasis
+                role="bold">tproxy</emphasis>.</para>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term><emphasis
               role="bold">src=</emphasis><replaceable>source-address</replaceable></term>

Shorewall/manpages/shorewall-rules.xml

@@ -652,6 +652,76 @@
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term>TARPIT [(<emphasis role="bold">tarpit</emphasis> |
+              <emphasis role="bold">honeypot</emphasis> | <emphasis
+              role="bold">reset</emphasis>)]</term>
+
+              <listitem>
+                <para>Added in Shorewall 4.6.6.</para>
+
+                <para>TARPIT captures and holds incoming TCP connections using
+                no local per-connection resources.</para>
+
+                <para>TARPIT only works with the PROTO column set to tcp (6),
+                and is totally application agnostic. This module will answer a
+                TCP request and play along like a listening server, but aside
+                from sending an ACK or RST, no data is sent. Incoming packets
+                are ignored and dropped. The attacker will terminate the
+                session eventually. This module allows the initial packets of
+                an attack to be captured by other software for inspection. In
+                most cases this is sufficient to determine the nature of the
+                attack.</para>
+
+                <para>This offers similar functionality to LaBrea
+                &lt;http://www.hackbusters.net/LaBrea/&gt; but does not
+                require dedicated hardware or IPs. Any TCP port that you would
+                normally DROP or REJECT can instead become a tarpit.</para>
+
+                <para>The target accepts a single optional parameter:</para>
+
+                <variablelist>
+                  <varlistentry>
+                    <term>tarpit</term>
+
+                    <listitem>
+                      <para>This mode is the default and completes a
+                      connection with the attacker but limits the window size
+                      to 0, thus keeping the attacker waiting long periods of
+                      time. While he is maintaining state of the connection
+                      and trying to continue every 60-240 seconds, we keep
+                      none, so it is very lightweight. Attempts to close the
+                      connection are ignored, forcing the remote side to time
+                      out the connection in 12-24 minutes.</para>
+                    </listitem>
+                  </varlistentry>
+
+                  <varlistentry>
+                    <term>honeypot</term>
+
+                    <listitem>
+                      <para>This mode completes a connection with the
+                      attacker, but signals a normal window size, so that the
+                      remote side will attempt to send data, often with some
+                      very nasty exploit attempts. We can capture these
+                      packets for decoding and further analysis. The module
+                      does not send any data, so if the remote expects an
+                      application level response, the game is up.</para>
+                    </listitem>
+                  </varlistentry>
+
+                  <varlistentry>
+                    <term>reset</term>
+
+                    <listitem>
+                      <para>This mode is handy because we can send an inline
+                      RST (reset). It has no other function.</para>
+                    </listitem>
+                  </varlistentry>
+                </variablelist>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term><emphasis
               role="bold">ULOG</emphasis>[(<replaceable>ulog-parameters</replaceable>)]</term>
@@ -786,7 +856,10 @@
           When there are nested zones, <emphasis role="bold">any</emphasis>
           only refers to top-level zones (those with no parent zones). Note
           that <emphasis role="bold">any</emphasis> excludes all vserver
-          zones, since those zones are nested within the firewall zone.</para>
+          zones, since those zones are nested within the firewall zone.
+          Beginning with Shorewall 4.4.13, exclusion is supported with
+          <emphasis role="bold">any</emphasis> -- see see <ulink
+          url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
 
           <para>Hosts may also be specified as an IP address range using the
           syntax
@@ -892,18 +965,28 @@
                 (Shorewall 4.4.17 and later).</para>
               </listitem>
             </varlistentry>
+
+            <varlistentry>
+              <term>loc,dmz</term>
+
+              <listitem>
+                <para>Both the <emphasis role="bold">loc</emphasis> and
+                <emphasis role="bold">dmz</emphasis> zones.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>all!dmz</term>
+
+              <listitem>
+                <para>All but the <emphasis role="bold">dmz</emphasis>
+                zone.</para>
+              </listitem>
+            </varlistentry>
           </variablelist>
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term></term>
-
-        <listitem>
-          <para></para>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><emphasis role="bold">DEST</emphasis> -
         {<emphasis>zone</emphasis>|<emphasis>zone-list</emphasis>[+]|{<emphasis
@@ -947,6 +1030,35 @@
           the <emphasis role="bold">SOURCE</emphasis> or <emphasis
           role="bold">DEST</emphasis> column, the rule is ignored.</para>
 
+          <para><emphasis role="bold">all</emphasis> means "All Zones",
+          including the firewall itself. <emphasis role="bold">all-</emphasis>
+          means "All Zones, except the firewall itself". When <emphasis
+          role="bold">all</emphasis>[<emphasis role="bold">-</emphasis>] is
+          used either in the <emphasis role="bold">SOURCE</emphasis> or
+          <emphasis role="bold">DEST</emphasis> column intra-zone traffic is
+          not affected. When <emphasis role="bold">all+</emphasis>[<emphasis
+          role="bold">-</emphasis>] is "used, intra-zone traffic is affected.
+          Beginning with Shorewall 4.4.13, exclusion is supported -- see see
+          <ulink
+          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5).</para>
+
+          <para><emphasis role="bold">any</emphasis> is equivalent to
+          <emphasis role="bold">all</emphasis> when there are no nested zones.
+          When there are nested zones, <emphasis role="bold">any</emphasis>
+          only refers to top-level zones (those with no parent zones). Note
+          that <emphasis role="bold">any</emphasis> excludes all vserver
+          zones, since those zones are nested within the firewall zone.</para>
+
+          <para>Except when <emphasis role="bold">all</emphasis>[<emphasis
+          role="bold">+</emphasis>][<emphasis role="bold">-</emphasis>] or
+          <emphasis role="bold">any</emphasis>[<emphasis
+          role="bold">+</emphasis>][<emphasis role="bold">-</emphasis>] is
+          specified, clients may be further restricted to a list of networks
+          and/or hosts by appending ":" and a comma-separated list of network
+          and/or host addresses. Hosts may be specified by IP or MAC address;
+          mac addresses must begin with "~" and must use "-" as a
+          separator.</para>
+
           <para>When <emphasis role="bold">all</emphasis> is used either in
           the <emphasis role="bold">SOURCE</emphasis> or <emphasis
           role="bold">DEST</emphasis> column intra-zone traffic is not
@@ -955,11 +1067,6 @@
           exclusion is supported -- see see <ulink
           url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
 
-          <para><emphasis role="bold">any</emphasis> is equivalent to
-          <emphasis role="bold">all</emphasis> when there are no nested zones.
-          When there are nested zones, <emphasis role="bold">any</emphasis>
-          only refers to top-level zones (those with no parent zones).</para>
-
           <para>The <replaceable>zone</replaceable> should be omitted in
           DNAT-, REDIRECT- and NONAT rules.</para>
 
@@ -980,7 +1087,8 @@
               </listitem>
             </orderedlist></para>
 
-          <para>Except when <emphasis role="bold">all</emphasis>[<emphasis
+          <para>Except when <emphasis
+          role="bold">{all|any}</emphasis>[<emphasis
           role="bold">+]|[-</emphasis>] is specified, the server may be
           further restricted to a particular network, host or interface by
           appending ":" and the network, host or interface. See <emphasis

Shorewall/manpages/shorewall-tunnels.xml

@@ -70,7 +70,8 @@
         <emphasis role="bold">openvpn</emphasis>       - OpenVPN in point-to-point mode
         <emphasis role="bold">openvpnclient</emphasis> - OpenVPN client runs on the firewall
         <emphasis role="bold">openvpnserver</emphasis> - OpenVPN server runs on the firewall
-        <emphasis role="bold">generic</emphasis>       - Other tunnel type</programlisting>
+        <emphasis role="bold">generic</emphasis>       - Other tunnel type
+        <emphasis role="bold">tinc</emphasis>          - TINC (added in Shorewall 4.6.6)</programlisting>
 
           <para>If the type is <emphasis role="bold">ipsec</emphasis>, it may
           be followed by <emphasis role="bold">:ah</emphasis> to indicate that
@@ -270,6 +271,19 @@
         generic:udp:4444 net     4.3.99.124</programlisting>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term>Example 9:</term>
+
+        <listitem>
+          <para>TINC tunnel where the remote gateways are not specified. If
+          you wish to specify a list of gateways, you can do so in the GATEWAY
+          column.</para>
+
+          <programlisting>        #TYPE            ZONE    GATEWAY          GATEWAY ZONES
+        tinc             net     0.0.0.0/0</programlisting>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 

Shorewall/manpages/shorewall.conf.xml

@@ -1784,8 +1784,8 @@ LOG:info:,bar                        net                    fw</programlisting>
 
         <listitem>
           <para>The value of this option determines the possible file
-          extensions of kernel modules. The default value is "ko ko.gz o o.gz
-          gz".</para>
+          extensions of kernel modules. The default value is "ko ko.gz ko.xz o o.gz
+          o.xz gz xz".</para>
         </listitem>
       </varlistentry>
 

Shorewall/manpages/shorewall.xml

@@ -170,6 +170,8 @@
       <arg><option>-l</option></arg>
 
       <arg><option>-m</option></arg>
+
+      <arg><option>-c</option></arg>
     </cmdsynopsis>
 
     <cmdsynopsis>
@@ -533,7 +535,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-x</option></arg>
 
@@ -547,7 +549,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-b</option></arg>
 
@@ -569,7 +571,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-f</option></arg>
 
@@ -583,7 +585,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg
       choice="req"><option>actions|classifiers|connections|config|events|filters|ip|ipa|macros|zones|policies|marks</option></arg>
@@ -596,7 +598,9 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
+
+      <arg>-c</arg>
 
       <arg choice="plain"><option>event</option><arg
       choice="plain"><replaceable>event</replaceable></arg></arg>
@@ -609,7 +613,21 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
+
+      <arg><option>-c</option></arg>
+
+      <arg choice="plain"><option>routing</option></arg>
+    </cmdsynopsis>
+
+    <cmdsynopsis>
+      <command>shorewall</command>
+
+      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>
+
+      <arg>-<replaceable>options</replaceable></arg>
+
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg choice="plain"><option>macro</option><arg
       choice="plain"><replaceable>macro</replaceable></arg></arg>
@@ -622,11 +640,11 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-x</option></arg>
 
-      <arg choice="req"><option>mangle|nat|routing|raw|rawpost</option></arg>
+      <arg choice="req"><option>mangle|nat|raw|rawpost</option></arg>
     </cmdsynopsis>
 
     <cmdsynopsis>
@@ -636,7 +654,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg choice="plain"><option>tc</option></arg>
     </cmdsynopsis>
@@ -648,7 +666,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-m</option></arg>
 
@@ -881,8 +899,7 @@
           and causes a warning message to be issued if the line current line
           contains alternative input specifications following a semicolon
           (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
-          set to Yes in
-          <ulink
+          set to Yes in <ulink
           url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
         </listitem>
       </varlistentry>
@@ -921,20 +938,21 @@
           compile -- -</command>) to suppress the 'Compiling...' message
           normally generated by <filename>/sbin/shorewall</filename>.</para>
 
-          <para>When <option>-e</option> is specified, the compilation is being
-          performed on a system other than where the compiled script will run.
-          This option disables certain configuration options that require the
-          script to be compiled where it is to be run. The use of <option>-e</option>
-          requires the presence of a configuration file named <filename>capabilities</filename>
-          which may be produced using the command <command>shorewall-lite show -f
-          capabilities &gt; capabilities</command> on a system with Shorewall Lite
+          <para>When <option>-e</option> is specified, the compilation is
+          being performed on a system other than where the compiled script
+          will run. This option disables certain configuration options that
+          require the script to be compiled where it is to be run. The use of
+          <option>-e</option> requires the presence of a configuration file
+          named <filename>capabilities</filename> which may be produced using
+          the command <command>shorewall-lite show -f capabilities &gt;
+          capabilities</command> on a system with Shorewall Lite
           installed</para>
 
           <para>The <option>-c</option> option was added in Shorewall 4.5.17
-          and causes conditional compilation of a script. The
-          script specified by <replaceable>pathname</replaceable> (or implied
-          if <emphasis role="bold">pathname</emphasis> is omitted) is compiled
-          if it doesn't exist or if there is any file in the
+          and causes conditional compilation of a script. The script specified
+          by <replaceable>pathname</replaceable> (or implied if <emphasis
+          role="bold">pathname</emphasis> is omitted) is compiled if it
+          doesn't exist or if there is any file in the
           <replaceable>directory</replaceable> or in a directory on the
           CONFIG_PATH that has a modification time later than the file to be
           compiled. When no compilation is needed, a message is issued and an
@@ -951,11 +969,11 @@
           and causes a Perl stack trace to be included with each
           compiler-generated error and warning message.</para>
 
-          <para>The <option>-i</option> option was added in Shorewall 4.6.0 and
-          causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          <para>The <option>-i</option> option was added in Shorewall 4.6.0
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
         </listitem>
       </varlistentry>
@@ -1028,6 +1046,9 @@
 
           <para>The <emphasis role="bold">-l</emphasis> option causes the rule
           number for each Netfilter rule to be displayed.</para>
+
+          <para>The <option>-c</option> option causes the route cache to be
+          dumped in addition to the other routing information.</para>
         </listitem>
       </varlistentry>
 
@@ -1189,11 +1210,11 @@
           and causes a Perl stack trace to be included with each
           compiler-generated error and warning message.</para>
 
-          <para>The <option>-i</option> option was added in Shorewall 4.6.0 and
-          causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          <para>The <option>-i</option> option was added in Shorewall 4.6.0
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
         </listitem>
       </varlistentry>
@@ -1283,10 +1304,10 @@
           compiler-generated error and warning message.</para>
 
           <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
 
           <para>The <option>-D</option> option was added in Shorewall 4.5.3
@@ -1352,10 +1373,10 @@
           compiler-generated error and warning message.</para>
 
           <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
         </listitem>
       </varlistentry>
@@ -1407,10 +1428,10 @@
           compiler-generated error and warning message.</para>
 
           <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
 
           <para>The <option>-C</option> option was added in Shorewall 4.6.5
@@ -1764,7 +1785,9 @@
               <term><emphasis role="bold">routing</emphasis></term>
 
               <listitem>
-                <para>Displays the system's IPv4 routing configuration.</para>
+                <para>Displays the system's IPv4 routing configuration.
+                The<option> -c</option> option causes the route cache to be
+                displayed along with the other routing information.</para>
               </listitem>
             </varlistentry>
 

Shorewall/shorewall.service

@@ -5,7 +5,7 @@
 #
 [Unit]
 Description=Shorewall IPv4 firewall
-After=network.target
+After=network-online.target
 Conflicts=iptables.service firewalld.service
 
 [Service]

Shorewall6-lite/manpages/shorewall6-lite.xml

@@ -116,6 +116,8 @@
       <arg><option>-l</option></arg>
 
       <arg><option>-m</option></arg>
+
+      <arg><option>-c</option></arg>
     </cmdsynopsis>
 
     <cmdsynopsis>
@@ -358,7 +360,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-b</option></arg>
 
@@ -380,7 +382,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-f</option></arg>
 
@@ -394,7 +396,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-x</option></arg>
 
@@ -408,7 +410,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg
       choice="req"><option>classifiers|connections|config|events|filters|ip|ipa|zones|policies|marks</option></arg>
@@ -421,7 +423,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg choice="plain"><option>event</option><arg
       choice="plain"><replaceable>event</replaceable></arg></arg>
@@ -434,11 +436,11 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
-      <arg><option>-x</option></arg>
+      <arg><option>-c</option></arg>
 
-      <arg choice="req"><option>mangle|nat|routing|raw|rawpost</option></arg>
+      <arg choice="plain"><option>routing</option></arg>
     </cmdsynopsis>
 
     <cmdsynopsis>
@@ -448,7 +450,21 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
+
+      <arg><option>-x</option></arg>
+
+      <arg choice="req"><option>mangle|nat|raw|rawpost</option></arg>
+    </cmdsynopsis>
+
+    <cmdsynopsis>
+      <command>shorewall6-lite</command>
+
+      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>
+
+      <arg>-<replaceable>options</replaceable></arg>
+
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg choice="plain"><option>tc</option></arg>
     </cmdsynopsis>
@@ -460,7 +476,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-m</option></arg>
 
@@ -668,6 +684,9 @@
 
           <para>The <option>-l</option> option causes the rule number for each
           Netfilter rule to be displayed.</para>
+
+          <para>The <option>-c</option> option causes the route cache to be
+          dumped in addition to the other routing information.</para>
         </listitem>
       </varlistentry>
 
@@ -1096,7 +1115,9 @@
               <term><emphasis role="bold">routing</emphasis></term>
 
               <listitem>
-                <para>Displays the system's IPv4 routing configuration.</para>
+                <para>Displays the system's IPv4 routing configuration. The -c
+                option causes the route cache to be displayed in addition to
+                the other routing information.</para>
               </listitem>
             </varlistentry>
 

Shorewall6-lite/shorecap

@@ -38,7 +38,7 @@
 #
 #        IPTABLES - iptables
 #        MODULESDIR - /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter
-#        MODULE_SUFFIX - "o gz ko o.gz ko.gz"
+#        MODULE_SUFFIX - "o gz xz ko o.gz o.xz ko.gz ko.xz"
 #
 #    Shorewall need not be installed on the target system to run shorecap. If the '-e' flag is
 #    used during firewall compilation, then the generated firewall program will likewise not

Shorewall6-lite/shorewall6-lite.service

@@ -5,7 +5,7 @@
 #
 [Unit]
 Description=Shorewall IPv6 firewall (lite)
-After=network.target
+After=network-online.target
 Conflicts=ip6tables.service firewalld.service
 
 [Service]

Shorewall6/Samples6/Universal/shorewall6.conf

@@ -175,7 +175,7 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX=ko
+MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
 

Shorewall6/Samples6/one-interface/shorewall6.conf

@@ -175,7 +175,7 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX=ko
+MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
 

Shorewall6/Samples6/three-interfaces/shorewall6.conf

@@ -175,7 +175,7 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX=ko
+MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
 

Shorewall6/Samples6/two-interfaces/shorewall6.conf

@@ -175,7 +175,7 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX=ko
+MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
 

Shorewall6/manpages/shorewall6-interfaces.xml

@@ -323,6 +323,17 @@ loc     eth2            -</programlisting>
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term>loopback</term>
+
+              <listitem>
+                <para>Added in Shorewall 4.6.6. Designates the interface as
+                the loopback interface. This option is assumed if the
+                interface's physical name is 'lo'. Only one interface man have
+                the <option>loopback</option> option specified.</para>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term><emphasis
               role="bold">mss</emphasis>=<emphasis>number</emphasis></term>

Shorewall6/manpages/shorewall6-mangle.xml

@@ -125,7 +125,29 @@
 
           <variablelist>
             <varlistentry>
-              <term>CHECKSUM</term>
+              <term><emphasis
+              role="bold">ADD(<replaceable>ipset</replaceable>:<replaceable>flags</replaceable>)</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.6.7. Causes addresses and/or port
+                numbers to be added to the named
+                <replaceable>ipset</replaceable>. The
+                <replaceable>flags</replaceable> specify the address or tuple
+                to be added to the set and must match the type of ipset
+                involved. For example, for an iphash ipset, either the SOURCE
+                or DESTINATION address can be added using
+                <replaceable>flags</replaceable> <emphasis
+                role="bold">src</emphasis> or <emphasis
+                role="bold">dst</emphasis> respectively (see the -A command in
+                ipset (8)).</para>
+
+                <para>ADD is non-terminating. Even if a packet matches the
+                rule, it is passed on to the next rule.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">CHECKSUM</emphasis></term>
 
               <listitem>
                 <para>Compute and fill in the checksum in a packet that lacks
@@ -140,7 +162,8 @@
             </varlistentry>
 
             <varlistentry>
-              <term>CLASSIFY(<replaceable>classid</replaceable>)</term>
+              <term><emphasis
+              role="bold">CLASSIFY(<replaceable>classid</replaceable>)</emphasis></term>
 
               <listitem>
                 <para>A classification Id (classid) is of the form
@@ -190,7 +213,8 @@
             </varlistentry>
 
             <varlistentry>
-              <term>CONMARK({mark|range})</term>
+              <term><emphasis
+              role="bold">CONMARK({mark|range})</emphasis></term>
 
               <listitem>
                 <para>Identical to MARK with the exception that the mark is
@@ -213,6 +237,27 @@
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term><emphasis
+              role="bold">DEL(<replaceable>ipset</replaceable>:<replaceable>flags</replaceable>)</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.6.7. Causes an entry to be deleted
+                from the named <replaceable>ipset</replaceable>. The
+                <replaceable>flags</replaceable> specify the address or tuple
+                to be deleted from the set and must match the type of ipset
+                involved. For example, for an iphash ipset, either the SOURCE
+                or DESTINATION address can be deleted using
+                <replaceable>flags</replaceable> <emphasis
+                role="bold">src</emphasis> or <emphasis
+                role="bold">dst</emphasis> respectively (see the -D command in
+                ipset (8)).</para>
+
+                <para>DEL is non-terminating. Even if a packet matches the
+                rule, it is passed on to the next rule.</para>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term><emphasis role="bold">DIVERT</emphasis></term>
 
@@ -323,7 +368,7 @@ INLINE          eth0              -                 ; -p tcp -j MARK --set-mark
             </varlistentry>
 
             <varlistentry>
-              <term>IPMARK</term>
+              <term><emphasis role="bold">IPMARK</emphasis></term>
 
               <listitem>
                 <para>Assigns a mark to each matching packet based on the
@@ -431,8 +476,9 @@ INLINE          eth0              -                 ; -p tcp -j MARK --set-mark
             </varlistentry>
 
             <varlistentry>
-              <term>IP6TABLES({<replaceable>target</replaceable>
-              [<replaceable>option</replaceable> ...])</term>
+              <term><emphasis
+              role="bold">IP6TABLES({<replaceable>target</replaceable>
+              [<replaceable>option</replaceable> ...])</emphasis></term>
 
               <listitem>
                 <para>This action allows you to specify an iptables target
@@ -453,7 +499,8 @@ INLINE          eth0              -                 ; -p tcp -j MARK --set-mark
             </varlistentry>
 
             <varlistentry>
-              <term>MARK({<replaceable>mark</replaceable>|<replaceable>range</replaceable>})</term>
+              <term><emphasis
+              role="bold">MARK({<replaceable>mark</replaceable>|<replaceable>range</replaceable>})</emphasis></term>
 
               <listitem>
                 <para>where <replaceable>mark</replaceable> is a packet mark
@@ -496,7 +543,7 @@ INLINE          eth0              -                 ; -p tcp -j MARK --set-mark
 
             <varlistentry>
               <term><emphasis
-              role="bold">RESTORE</emphasis>[(/<emphasis>mask</emphasis>)]</term>
+              role="bold">RESTORE</emphasis>[(<emphasis>mask</emphasis>)]</term>
 
               <listitem>
                 <para>Restore the packet's mark from the connection's mark
@@ -506,7 +553,8 @@ INLINE          eth0              -                 ; -p tcp -j MARK --set-mark
             </varlistentry>
 
             <varlistentry>
-              <term><emphasis role="bold">SAME</emphasis></term>
+              <term><emphasis
+              role="bold">SAME[(<replaceable>timeout</replaceable>)]</emphasis></term>
 
               <listitem>
                 <para>Some websites run applications that require multiple
@@ -530,17 +578,22 @@ SAME:P            192.168.1.0/24 0.0.0.0/0    tcp        80,443</programlisting>
                 connections to an individual remote system to all use the same
                 provider. For example:<programlisting>#ACTION           SOURCE         DEST         PROTO      DEST
 #                                                        PORT(S)
-SAME              $FW            0.0.0.0/0    tcp        80,443</programlisting>
-                If the firewall attempts a connection on TCP port 80 or 443
-                and it has sent a packet on either of those ports in the last
-                five minutes to the same remote system then the new connection
-                will use the same provider as the connection over which that
-                last packet was sent.</para>
+SAME              $FW            0.0.0.0/0    tcp        80,443</programlisting>The
+                optional <replaceable>timeout</replaceable> parameter was
+                added in Shorewall 4.6.7 and specifies a number of seconds .
+                When not specified, a value of 300 seconds (5 minutes) is
+                assumed. If the firewall attempts a connection on TCP port 80
+                or 443 and it has sent a packet on either of those ports in
+                the last <replaceable>timeout</replaceable> seconds to the
+                same remote system then the new connection will use the same
+                provider as the connection over which that last packet was
+                sent.</para>
               </listitem>
             </varlistentry>
 
             <varlistentry>
-              <term><emphasis role="bold">SAVE[(/<emphasis>mask)</emphasis>]
+              <term><emphasis role="bold">SAVE[(<emphasis
+              role="bold"><replaceable>mask</replaceable>)</emphasis>]
               </emphasis></term>
 
               <listitem>

Shorewall6/manpages/shorewall6-providers.xml

@@ -162,8 +162,8 @@
                 this provider's gateway to be added to the <emphasis
                 role="bold">main</emphasis> routing table (USE_DEFAULT_RT=No)
                 or to the <emphasis role="bold">balance</emphasis> routing
-                table (USE_DEFAULT_RT=Yes). At most one provider can specify
-                this option.</para>
+                table (USE_DEFAULT_RT=Yes). Only one provider can specify this
+                option.</para>
               </listitem>
             </varlistentry>
 
@@ -248,6 +248,19 @@
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term><emphasis role="bold">primary</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.6.6, <emphasis
+                role="bold">primary</emphasis> is a synonym for <emphasis
+                role="bold">balance</emphasis> (see above) and is preferred
+                when the remaining providers specify <emphasis
+                role="bold">fallback</emphasis> or <emphasis
+                role="bold">tproxy</emphasis>.</para>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term>src=<replaceable>source-address</replaceable></term>
 

Shorewall6/manpages/shorewall6-rules.xml

@@ -628,6 +628,76 @@
                 url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
               </listitem>
             </varlistentry>
+
+            <varlistentry>
+              <term>TARPIT [(<emphasis role="bold">tarpit</emphasis> |
+              <emphasis role="bold">honeypot</emphasis> | <emphasis
+              role="bold">reset</emphasis>)]</term>
+
+              <listitem>
+                <para>Added in Shorewall 4.6.6.</para>
+
+                <para>TARPIT captures and holds incoming TCP connections using
+                no local per-connection resources.</para>
+
+                <para>TARPIT only works with the PROTO column set to tcp (6),
+                and is totally application agnostic. This module will answer a
+                TCP request and play along like a listening server, but aside
+                from sending an ACK or RST, no data is sent. Incoming packets
+                are ignored and dropped. The attacker will terminate the
+                session eventually. This module allows the initial packets of
+                an attack to be captured by other software for inspection. In
+                most cases this is sufficient to determine the nature of the
+                attack.</para>
+
+                <para>This offers similar functionality to LaBrea
+                &lt;http://www.hackbusters.net/LaBrea/&gt; but does not
+                require dedicated hardware or IPs. Any TCP port that you would
+                normally DROP or REJECT can instead become a tarpit.</para>
+
+                <para>The target accepts a single optional parameter:</para>
+
+                <variablelist>
+                  <varlistentry>
+                    <term>tarpit</term>
+
+                    <listitem>
+                      <para>This mode is the default and completes a
+                      connection with the attacker but limits the window size
+                      to 0, thus keeping the attacker waiting long periods of
+                      time. While he is maintaining state of the connection
+                      and trying to continue every 60-240 seconds, we keep
+                      none, so it is very lightweight. Attempts to close the
+                      connection are ignored, forcing the remote side to time
+                      out the connection in 12-24 minutes.</para>
+                    </listitem>
+                  </varlistentry>
+
+                  <varlistentry>
+                    <term>honeypot</term>
+
+                    <listitem>
+                      <para>This mode completes a connection with the
+                      attacker, but signals a normal window size, so that the
+                      remote side will attempt to send data, often with some
+                      very nasty exploit attempts. We can capture these
+                      packets for decoding and further analysis. The module
+                      does not send any data, so if the remote expects an
+                      application level response, the game is up.</para>
+                    </listitem>
+                  </varlistentry>
+
+                  <varlistentry>
+                    <term>reset</term>
+
+                    <listitem>
+                      <para>This mode is handy because we can send an inline
+                      RST (reset). It has no other function.</para>
+                    </listitem>
+                  </varlistentry>
+                </variablelist>
+              </listitem>
+            </varlistentry>
           </variablelist>
 
           <para>The <replaceable>target</replaceable> may optionally be
@@ -721,6 +791,13 @@
           <ulink
           url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5).</para>
 
+          <para><emphasis role="bold">any</emphasis> is equivalent to
+          <emphasis role="bold">all</emphasis> when there are no nested zones.
+          When there are nested zones, <emphasis role="bold">any</emphasis>
+          only refers to top-level zones (those with no parent zones). Note
+          that <emphasis role="bold">any</emphasis> excludes all vserver
+          zones, since those zones are nested within the firewall zone.</para>
+
           <para>Except when <emphasis role="bold">all</emphasis>[<emphasis
           role="bold">+</emphasis>][<emphasis role="bold">-</emphasis>] or
           <emphasis role="bold">any</emphasis>[<emphasis
@@ -731,13 +808,6 @@
           mac addresses must begin with "~" and must use "-" as a
           separator.</para>
 
-          <para><emphasis role="bold">any</emphasis> is equivalent to
-          <emphasis role="bold">all</emphasis> when there are no nested zones.
-          When there are nested zones, <emphasis role="bold">any</emphasis>
-          only refers to top-level zones (those with no parent zones). Note
-          that <emphasis role="bold">any</emphasis> excludes all vserver
-          zones, since those zones are nested within the firewall zone.</para>
-
           <para>Hosts may also be specified as an IP address range using the
           syntax
           <emphasis>lowaddress</emphasis>-<emphasis>highaddress</emphasis>.

Shorewall6/manpages/shorewall6-tunnels.xml

@@ -65,7 +65,8 @@
         <emphasis role="bold">openvpn</emphasis>       - OpenVPN in point-to-point mode
         <emphasis role="bold">openvpnclient</emphasis> - OpenVPN client runs on the firewall
         <emphasis role="bold">openvpnserver</emphasis> - OpenVPN server runs on the firewall
-        <emphasis role="bold">generic</emphasis>       - Other tunnel type</programlisting>
+        <emphasis role="bold">generic</emphasis>       - Other tunnel type
+        <emphasis role="bold">tinc</emphasis>          - TINC (added in Shorewall 4.6.6)</programlisting>
 
           <para>If the type is <emphasis role="bold">ipsec</emphasis>, it may
           be followed by <emphasis role="bold">:ah</emphasis> to indicate that
@@ -229,6 +230,19 @@
         generic:udp:4444 net     2001:cec792b4:1::44</programlisting>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term>Example 9:</term>
+
+        <listitem>
+          <para>TINC tunnel where the remote gateways are not specified. If
+          you wish to specify a list of gateways, you can do so in the GATEWAY
+          column.</para>
+
+          <programlisting>        #TYPE            ZONE    GATEWAY          GATEWAY ZONES
+        tinc             net     ::/0</programlisting>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 

Shorewall6/manpages/shorewall6.conf.xml

@@ -1588,8 +1588,8 @@ LOG:info:,bar                        net                    fw</programlisting>
 
         <listitem>
           <para>The value of this option determines the possible file
-          extensions of kernel modules. The default value is "ko ko.gz o o.gz
-          gz".</para>
+          extensions of kernel modules. The default value is "ko ko.gz ko.xz o o.gz
+          o.xz gz xz".</para>
         </listitem>
       </varlistentry>
 

Shorewall6/manpages/shorewall6.xml

@@ -163,6 +163,8 @@
       <arg><option>-l</option></arg>
 
       <arg><option>-m</option></arg>
+
+      <arg><option>-c</option></arg>
     </cmdsynopsis>
 
     <cmdsynopsis>
@@ -488,7 +490,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-x</option></arg>
 
@@ -502,7 +504,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-b</option></arg>
 
@@ -524,7 +526,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-f</option></arg>
 
@@ -538,7 +540,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg
       choice="req"><option>actions|classifiers|connections|config|events|filters|ip|macros|zones|policies|tc|marks</option></arg>
@@ -551,7 +553,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg choice="plain"><option>event</option><arg
       choice="plain"><replaceable>event</replaceable></arg></arg>
@@ -564,7 +566,35 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
+
+      <arg><option>-c</option></arg>
+
+      <arg choice="plain"><option>routing</option></arg>
+    </cmdsynopsis>
+
+    <cmdsynopsis>
+      <command>shorewall6</command>
+
+      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>
+
+      <arg>-<replaceable>options</replaceable></arg>
+
+      <arg choice="req"><option>show | list | ls </option></arg>
+
+      <arg><option>-x</option></arg>
+
+      <arg choice="req"><option>mangle|nat|raw|rawpost</option></arg>
+    </cmdsynopsis>
+
+    <cmdsynopsis>
+      <command>shorewall6</command>
+
+      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>
+
+      <arg>-<replaceable>options</replaceable></arg>
+
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg choice="plain"><option>tc</option></arg>
     </cmdsynopsis>
@@ -576,7 +606,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="opt"><option>show | list | ls </option></arg>
+      <arg choice="req"><option>show | list | ls </option></arg>
 
       <arg><option>-m</option></arg>
 
@@ -782,11 +812,11 @@
           <filename class="directory">/etc/shorewall6</filename> is
           assumed.</para>
 
-          <para>The <option>-e</option> option causes the
-          compiler to look for a file named capabilities. This file is
-          produced using the command <command>shorewall6-lite
-          show -f capabilities &gt; capabilities</command> on a system with
-          Shorewall6 Lite installed.</para>
+          <para>The <option>-e</option> option causes the compiler to look for
+          a file named capabilities. This file is produced using the command
+          <command>shorewall6-lite show -f capabilities &gt;
+          capabilities</command> on a system with Shorewall6 Lite
+          installed.</para>
 
           <para>The <option>-d</option> option causes the compiler to be run
           under control of the Perl debugger.</para>
@@ -804,10 +834,10 @@
           compiler-generated error and warning message.</para>
 
           <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf(5)</ulink>.</para>
         </listitem>
       </varlistentry>
@@ -840,20 +870,20 @@
           normally generated by <filename>/sbin/shorewall6</filename>.</para>
 
           <para>When <option>-e</option> is specified, the compilation is
-          being performed on a system other than where the compiled script will
-          run. This option disables certain configuration options that require
-          the script to be compiled where it is to be run. The use of
-          <option>-e</option> requires the presence of a configuration file named
-          <filename>capabilities</filename> which may be produced using the
-          command <command>shorewall6-lite show -f capabilities &gt;
+          being performed on a system other than where the compiled script
+          will run. This option disables certain configuration options that
+          require the script to be compiled where it is to be run. The use of
+          <option>-e</option> requires the presence of a configuration file
+          named <filename>capabilities</filename> which may be produced using
+          the command <command>shorewall6-lite show -f capabilities &gt;
           capabilities</command> on a system with Shorewall6 Lite
           installed.</para>
 
-          <para>The <option>-c</option> option was added in
-          Shorewall 4.5.17 and causes conditional compilation of a script. The
-          script specified by <replaceable>pathname</replaceable> (or implied
-          if <emphasis role="bold">pathname</emphasis> is omitted) is compiled
-          if it doesn't exist or if there is any file in the
+          <para>The <option>-c</option> option was added in Shorewall 4.5.17
+          and causes conditional compilation of a script. The script specified
+          by <replaceable>pathname</replaceable> (or implied if <emphasis
+          role="bold">pathname</emphasis> is omitted) is compiled if it
+          doesn't exist or if there is any file in the
           <replaceable>directory</replaceable> or in a directory on the
           CONFIG_PATH that has a modification time later than the file to be
           compiled. When no compilation is needed, a message is issued and an
@@ -871,10 +901,10 @@
           compiler-generated error and warning message.</para>
 
           <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf(5)</ulink>.</para>
         </listitem>
       </varlistentry>
@@ -939,15 +969,18 @@
           <para>Produces a verbose report about the firewall configuration for
           the purpose of problem analysis.</para>
 
-          <para>The <option>-x</option> option causes actual
-          packet and byte counts to be displayed. Without that option, these
-          counts are abbreviated.</para>
+          <para>The <option>-x</option> option causes actual packet and byte
+          counts to be displayed. Without that option, these counts are
+          abbreviated.</para>
 
           <para>The <option>-m</option> option causes any MAC addresses
           included in Shorewall6 log messages to be displayed.</para>
 
-          <para>The <option>-l</option> option causes the rule
-          number for each Netfilter rule to be displayed.</para>
+          <para>The <option>-l</option> option causes the rule number for each
+          Netfilter rule to be displayed.</para>
+
+          <para>The <option>-c</option> option causes the route cache to be
+          dumped in addition to the other routing information.</para>
         </listitem>
       </varlistentry>
 
@@ -1002,8 +1035,8 @@
         <listitem>
           <para>Deletes <filename>/var/lib/shorewall6/<replaceable>filename
           </replaceable></filename> and <filename>/var/lib/shorewall6/save
-          </filename>. If no <emphasis>filename</emphasis> is
-          given then the file specified by RESTOREFILE in <ulink
+          </filename>. If no <emphasis>filename</emphasis> is given then the
+          file specified by RESTOREFILE in <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5) is
           assumed.</para>
         </listitem>
@@ -1062,15 +1095,15 @@
           Shorewall6 Lite on <replaceable>system</replaceable> is started via
           ssh.</para>
 
-          <para>If <option>-s</option> is specified and the
-          <emphasis role="bold">start</emphasis> command succeeds, then the
-          remote Shorewall6-lite configuration is saved by executing
+          <para>If <option>-s</option> is specified and the <emphasis
+          role="bold">start</emphasis> command succeeds, then the remote
+          Shorewall6-lite configuration is saved by executing
           <command>shorewall6-lite save</command> via ssh.</para>
 
-          <para>if <option>-c</option> is included, the
-          command <command>shorewall6-lite show capabilities -f
-          &gt; /var/lib/shorewall6-lite/capabilities</command> is executed
-          via ssh then the generated file is copied to
+          <para>if <option>-c</option> is included, the command
+          <command>shorewall6-lite show capabilities -f &gt;
+          /var/lib/shorewall6-lite/capabilities</command> is executed via ssh
+          then the generated file is copied to
           <replaceable>directory</replaceable> using scp. This step is
           performed before the configuration is compiled.</para>
 
@@ -1083,10 +1116,10 @@
           compiler-generated error and warning message.</para>
 
           <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
         </listitem>
       </varlistentry>
@@ -1111,14 +1144,13 @@
           <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5) and
           produces an audible alarm when new Shorewall6 messages are logged.
-          The <option>-m</option> option causes the MAC
-          address of each packet source to be displayed if that information is
-          available. The <replaceable>refresh-interval</replaceable> specifies
-          the time in seconds between screen refreshes. You can enter a
-          negative number by preceding the number with "--" (e.g.,
-          <command>shorewall6 logwatch -- -30</command>). In this case, when a
-          packet count changes, you will be prompted to hit any key to resume
-          screen refreshes.</para>
+          The <option>-m</option> option causes the MAC address of each packet
+          source to be displayed if that information is available. The
+          <replaceable>refresh-interval</replaceable> specifies the time in
+          seconds between screen refreshes. You can enter a negative number by
+          preceding the number with "--" (e.g., <command>shorewall6 logwatch
+          -- -30</command>). In this case, when a packet count changes, you
+          will be prompted to hit any key to resume screen refreshes.</para>
         </listitem>
       </varlistentry>
 
@@ -1156,10 +1188,10 @@
           <command>refresh</command> only recreates the chains specified in
           the command while <command>restart</command> recreates the entire
           Netfilter ruleset.When no chain name is given to the
-          <command>refresh</command> command, the mangle table is
-          refreshed along with the blacklist chain (if any). This allows you
-          to modify <filename>/etc/shorewall6/tcrules</filename>and install
-          the changes using <command>refresh</command>.</para>
+          <command>refresh</command> command, the mangle table is refreshed
+          along with the blacklist chain (if any). This allows you to modify
+          <filename>/etc/shorewall6/tcrules</filename>and install the changes
+          using <command>refresh</command>.</para>
 
           <para>The listed chains are assumed to be in the filter table. You
           can refresh chains in other tables by prefixing the chain name with
@@ -1179,10 +1211,10 @@
           compiler-generated error and warning message.</para>
 
           <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
 
           <para>The -<option>D</option> option was added in Shorewall 4.5.3
@@ -1192,6 +1224,7 @@
           <example>
             <title>Refresh the 'net-fw' chain in the filter table and the
             'net_dnat' chain in the nat table</title>
+
             <programlisting><command>shorewall6 refresh net-fw nat:net_dnat
             </command></programlisting>
           </example>
@@ -1225,16 +1258,16 @@
           ssh.</para>
 
           <para>If <option>-s</option> is specified and the
-          <command>restart</command> command succeeds, then the
-          remote Shorewall6-lite configuration is saved by executing
+          <command>restart</command> command succeeds, then the remote
+          Shorewall6-lite configuration is saved by executing
           <command>shorewall6-lite save</command> via ssh.</para>
 
-          <para>if <option>-c</option> is included, the
-          command <command>shorewall6-lite show capabilities -f
-          &gt; /var/lib/shorewall6-lite/capabilities</command> is executed
-          via ssh then the generated file is copied to
-          <emphasis>directory</emphasis> using scp. This step is performed
-          before the configuration is compiled.</para>
+          <para>if <option>-c</option> is included, the command
+          <command>shorewall6-lite show capabilities -f &gt;
+          /var/lib/shorewall6-lite/capabilities</command> is executed via ssh
+          then the generated file is copied to <emphasis>directory</emphasis>
+          using scp. This step is performed before the configuration is
+          compiled.</para>
 
           <para>If <option>-r</option> is included, it specifies that the root
           user on <replaceable>system</replaceable> is named
@@ -1245,10 +1278,10 @@
           compiler-generated error and warning message.</para>
 
           <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
         </listitem>
       </varlistentry>
@@ -1269,9 +1302,9 @@
         <term><emphasis role="bold">restart</emphasis></term>
 
         <listitem>
-          <para>Restart is similar to <command>shorewall6
-          start</command> except that it assumes that the firewall is already
-          started. Existing connections are maintained. If a
+          <para>Restart is similar to <command>shorewall6 start</command>
+          except that it assumes that the firewall is already started.
+          Existing connections are maintained. If a
           <emphasis>directory</emphasis> is included in the command,
           Shorewall6 will look in that <emphasis>directory</emphasis> first
           for configuration files.</para>
@@ -1289,8 +1322,8 @@
           <para>The <option>-f</option> option suppresses the compilation step
           and simply reused the compiled script which last started/restarted
           Shorewall, provided that <filename class="directory">/etc/shorewall6
-          </filename> and its contents have not
-          been modified since the last start/restart.</para>
+          </filename> and its contents have not been modified since the last
+          start/restart.</para>
 
           <para>The <option>-c</option> option was added in Shorewall 4.4.20
           and performs the compilation step unconditionally, overriding the
@@ -1304,10 +1337,10 @@
           compiler-generated error and warning message.</para>
 
           <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
 
           <para>The <option>-C</option> option was added in Shorewall 4.6.5
@@ -1325,11 +1358,11 @@
 
         <listitem>
           <para>Restore Shorewall6 to a state saved using the
-          <command>shorewall6 save</command> command. Existing connections
-          are maintained. The <emphasis>filename</emphasis> names a restore
-          file in <filename class="directory">/var/lib/shorewall6</filename>
-          created using <command>shorewall6 save</command>;
-          if no <emphasis>filename</emphasis> is given then Shorewall6 will be
+          <command>shorewall6 save</command> command. Existing connections are
+          maintained. The <emphasis>filename</emphasis> names a restore file
+          in <filename class="directory">/var/lib/shorewall6</filename>
+          created using <command>shorewall6 save</command>; if no
+          <emphasis>filename</emphasis> is given then Shorewall6 will be
           restored from the file specified by the RESTOREFILE option in <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
 
@@ -1343,8 +1376,8 @@
 
           <para>The <option>-C</option> option was added in Shorewall 4.6.5.
           If the <option>-C</option> option was specified during
-          <command>shorewall6 save</command>, then the counters saved by
-          that operation will be restored.</para>
+          <command>shorewall6 save</command>, then the counters saved by that
+          operation will be restored.</para>
         </listitem>
       </varlistentry>
 
@@ -1365,8 +1398,7 @@
 
           <para>If there are files in the CONFIG_PATH that were modified after
           the current firewall script was generated, the following warning
-          message is issued before the script's run command is
-          executed:
+          message is issued before the script's run command is executed:
           <screen>WARNING: /var/lib/shorewall6/firewall is not up to
           date</screen></para>
         </listitem>
@@ -1378,15 +1410,15 @@
         <listitem>
           <para>Only allowed if Shorewall6 is running. The current
           configuration is saved in <filename>/var/lib/shorewall6/safe-restart
-          </filename> (see the <emphasis role="bold">save</emphasis>
-          command below) then a <command>shorewall6 restart</command> is
-          done. You will then be prompted asking if you
-          want to accept the new configuration or not. If you answer "n" or if
-          you fail to answer within 60 seconds (such as when your new
-          configuration has disabled communication with your terminal), the
-          configuration is restored from the saved configuration. If a
-          directory is given, then Shorewall6 will look in that directory
-          first when opening configuration files.</para>
+          </filename> (see the <emphasis role="bold">save</emphasis> command
+          below) then a <command>shorewall6 restart</command> is done. You
+          will then be prompted asking if you want to accept the new
+          configuration or not. If you answer "n" or if you fail to answer
+          within 60 seconds (such as when your new configuration has disabled
+          communication with your terminal), the configuration is restored
+          from the saved configuration. If a directory is given, then
+          Shorewall6 will look in that directory first when opening
+          configuration files.</para>
 
           <para>Beginning with Shorewall 4.5.0, you may specify a different
           <replaceable>timeout</replaceable> value using the
@@ -1425,8 +1457,8 @@
 
         <listitem>
           <para>The dynamic blacklist is stored in <filename>
-          /var/lib/shorewall6/save</filename>.
-          The state of the firewall is stored in <filename>
+          /var/lib/shorewall6/save</filename>. The state of the firewall is
+          stored in <filename>
           /var/lib/shorewall6/<replaceable>filename</replaceable></filename>
           for use by the <command>shorewall6 restore</command> and <command>
           shorewall6 -f start</command> commands. If <emphasis>filename
@@ -1463,10 +1495,10 @@
               <listitem>
                 <para>Added in Shorewall 4.6.2. Displays the dynamic chain
                 along with any chains produced by entries in
-                shorewall-blrules(5).The <option>-x</option>
-                option is passed directly through to ip6tables and causes
-                actual packet and byte counts to be displayed. Without this
-                option, those counts are abbreviated.</para>
+                shorewall-blrules(5).The <option>-x</option> option is passed
+                directly through to ip6tables and causes actual packet and
+                byte counts to be displayed. Without this option, those counts
+                are abbreviated.</para>
               </listitem>
             </varlistentry>
 
@@ -1475,9 +1507,9 @@
 
               <listitem>
                 <para>Displays your kernel/ip6tables capabilities. The
-                <option>-f</option> option causes the display
-                to be formatted as a capabilities file for use with
-                <command>shorewall6 compile -e</command>.</para>
+                <option>-f</option> option causes the display to be formatted
+                as a capabilities file for use with <command>shorewall6
+                compile -e</command>.</para>
               </listitem>
             </varlistentry>
 
@@ -1487,32 +1519,29 @@
 
               <listitem>
                 <para>The rules in each <emphasis>chain</emphasis> are
-                displayed using the <command>ip6tables
-                -L</command> <emphasis>chain</emphasis> <emphasis
-                role="bold">-n -v</emphasis> command. If no
-                <emphasis>chain</emphasis> is given, all of the chains in the
-                filter table are displayed. The <option>-x</option> option is
-                passed directly through to ip6tables and causes actual packet
-                and byte counts to be displayed. Without this option, those
-                counts are abbreviated.
-                The <option>-t</option> option specifies the
-                Netfilter table to display. The default is <emphasis
+                displayed using the <command>ip6tables -L</command>
+                <emphasis>chain</emphasis> <emphasis role="bold">-n
+                -v</emphasis> command. If no <emphasis>chain</emphasis> is
+                given, all of the chains in the filter table are displayed.
+                The <option>-x</option> option is passed directly through to
+                ip6tables and causes actual packet and byte counts to be
+                displayed. Without this option, those counts are abbreviated.
+                The <option>-t</option> option specifies the Netfilter table
+                to display. The default is <emphasis
                 role="bold">filter</emphasis>.</para>
 
-                <para>The <option>-b</option> ('brief') option
-                causes rules which have not been used (i.e. which have zero
-                packet and byte counts) to be omitted from the output. Chains
-                with no rules displayed are also omitted from the
-                output.</para>
+                <para>The <option>-b</option> ('brief') option causes rules
+                which have not been used (i.e. which have zero packet and byte
+                counts) to be omitted from the output. Chains with no rules
+                displayed are also omitted from the output.</para>
 
-                <para>The <option>-l</option> option causes
-                the rule number for each Netfilter rule to be
-                displayed.</para>
+                <para>The <option>-l</option> option causes the rule number
+                for each Netfilter rule to be displayed.</para>
 
-                <para>If the <option>-t</option> option and
-                the <option>chain</option> keyword are both omitted and any of
-                the listed <replaceable>chain</replaceable>s do not exist, a
-                usage message is displayed.</para>
+                <para>If the <option>-t</option> option and the
+                <option>chain</option> keyword are both omitted and any of the
+                listed <replaceable>chain</replaceable>s do not exist, a usage
+                message is displayed.</para>
               </listitem>
             </varlistentry>
 
@@ -1577,9 +1606,9 @@
                 <para>Displays the last 20 Shorewall6 messages from the log
                 file specified by the LOGFILE option in <ulink
                 url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).
-                The <option>-m</option> option causes the MAC
-                address of each packet source to be displayed if that
-                information is available.</para>
+                The <option>-m</option> option causes the MAC address of each
+                packet source to be displayed if that information is
+                available.</para>
               </listitem>
             </varlistentry>
 
@@ -1597,11 +1626,11 @@
 
               <listitem>
                 <para>Displays the Netfilter mangle table using the command
-                <command>ip6tables -t mangle -L -n
-                -v</command>.The <option>-x</option> option
-                is passed directly through to ip6tables and causes actual
-                packet and byte counts to be displayed. Without this option,
-                those counts are abbreviated.</para>
+                <command>ip6tables -t mangle -L -n -v</command>.The
+                <option>-x</option> option is passed directly through to
+                ip6tables and causes actual packet and byte counts to be
+                displayed. Without this option, those counts are
+                abbreviated.</para>
               </listitem>
             </varlistentry>
 
@@ -1628,10 +1657,12 @@
             </varlistentry>
 
             <varlistentry>
-              <term><emphasis role="bold">Routing</emphasis></term>
+              <term><emphasis role="bold">routing</emphasis></term>
 
               <listitem>
-                <para>Displays the system's IPv6 routing configuration.</para>
+                <para>Displays the system's IPv6 routing configuration. The -c
+                option causes the route cache to be displayed in addition to
+                the other routing information.</para>
               </listitem>
             </varlistentry>
 
@@ -1665,24 +1696,22 @@
           only if they are allowed by the firewall rules or policies. If a
           <replaceable>directory</replaceable> is included in the command,
           Shorewall6 will look in that <emphasis>directory</emphasis> first
-          for configuration files. If <option>-f</option> is
-          specified, the saved configuration specified by the RESTOREFILE
-          option in <ulink
+          for configuration files. If <option>-f</option> is specified, the
+          saved configuration specified by the RESTOREFILE option in <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)
           will be restored if that saved configuration exists and has been
           modified more recently than the files in <filename
           class="directory">/etc/shorewall6</filename>. When <option>-f
-          </option> is given, a <replaceable>directory</replaceable> may
-          not be specified.</para>
+          </option> is given, a <replaceable>directory</replaceable> may not
+          be specified.</para>
 
           <para>Update: In Shorewall6 4.4.20, a new LEGACY_FASTSTART option
           was added to <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).
           When LEGACY_FASTSTART=No, the modification times of files in
-          <filename class="directory">/etc/shorewall6</filename> are
-          compared with that of <filename>/var/lib/shorewall6/firewall
-          </filename> (the compiled script that last started/restarted the
-          firewall).</para>
+          <filename class="directory">/etc/shorewall6</filename> are compared
+          with that of <filename>/var/lib/shorewall6/firewall </filename> (the
+          compiled script that last started/restarted the firewall).</para>
 
           <para>The <option>-n</option> option causes Shorewall6 to avoid
           updating the routing table(s).</para>
@@ -1699,18 +1728,18 @@
           compiler-generated error and warning message.</para>
 
           <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
 
           <para>The <option>-C</option> option was added in Shorewall 4.6.5
           and is only meaningful when the <option>-f</option> option is also
           specified. If the previously-saved configuration is restored, and if
           the <option>-C</option> option was also specified in the
-          <command>save</command> command, then the packet and byte
-          counters will be restored along with the chains and rules.</para>
+          <command>save</command> command, then the packet and byte counters
+          will be restored along with the chains and rules.</para>
         </listitem>
       </varlistentry>
 
@@ -1761,9 +1790,9 @@
           state. If an error occurs during the <emphasis role="bold">restart
           </emphasis> phase, then a <command>shorewall6 restore</command> is
           performed using the saved configuration. If an error occurs during
-          the <emphasis role="bold">start</emphasis> phase, then Shorewall6
-          is cleared. If the <emphasis role="bold">start</emphasis>/
-          <emphasis role="bold">restart</emphasis> succeeds and a
+          the <emphasis role="bold">start</emphasis> phase, then Shorewall6 is
+          cleared. If the <emphasis role="bold">start</emphasis>/ <emphasis
+          role="bold">restart</emphasis> succeeds and a
           <replaceable>timeout</replaceable> is specified then a <emphasis
           role="bold">clear</emphasis> or <emphasis role="bold">restore
           </emphasis> is performed after <replaceable>timeout</replaceable>
@@ -1815,10 +1844,10 @@
           directory.</para>
 
           <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the line current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
+          and causes a warning message to be issued if the line current line
+          contains alternative input specifications following a semicolon
+          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
+          set to Yes in <ulink
           url="/manpages6/shorewall6.conf.html">shorewall6.conf(5)</ulink>.</para>
 
           <para>The <option>-t</option> option was added in Shorewall 4.6.0.

Shorewall6/shorewall6.service

@@ -5,7 +5,7 @@
 #
 [Unit]
 Description=Shorewall IPv6 firewall
-After=network.target
+After=network-online.target
 Conflicts=ip6tables.service firewalld.service
 
 [Service]

docs/FAQ.xml

@@ -2208,7 +2208,7 @@ shorewall status > /dev/null 2>&1 || shorewall start # Start Shorewall
 
           <listitem>
             <para>Beginning with Shorewall 4.4.10, there is a new <ulink
-            url="Manpages/shorewall-init.html">Shorewall Init Package</ulink>
+            url="manpages/shorewall-init.html">Shorewall Init Package</ulink>
             that is designed to handle this case.</para>
           </listitem>
         </varlistentry>
@@ -2319,7 +2319,7 @@ gateway:~# </programlisting>
       <title>(FAQ 104) I see <emphasis>kernel</emphasis> messages in my log
       when I start or restart Shorewall or Shorewall6</title>
 
-      <para>Example: </para>
+      <para>Example:</para>
 
       <programlisting>&gt; Oct 1 13:04:39 deb kernel: [ 9570.619744] xt_addrtype: ipv6 does not support BROADCAST matching
 </programlisting>

docs/MultiISP.xml

@@ -503,6 +503,19 @@
                 </listitem>
               </varlistentry>
 
+              <varlistentry>
+                <term>primary</term>
+
+                <listitem>
+                  <para>Added in Shorewall 4.6.6, <emphasis
+                  role="bold">primary</emphasis> is a synonym for <emphasis
+                  role="bold">balance=1</emphasis> and is preferred when the
+                  remaining providers specify <emphasis
+                  role="bold">fallback</emphasis> or <emphasis
+                  role="bold">tproxy</emphasis>.</para>
+                </listitem>
+              </varlistentry>
+
               <varlistentry>
                 <term>src=<replaceable>source-address</replaceable></term>