Add warning about the sparse population of /etc/shorewall under Debian

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/configure

@@ -143,6 +143,9 @@ if [ -z "$vendor" ]; then
 	    elif [ -f /etc/arch-release ] ; then
 		params[HOST]=archlinux
 		rcfile=shorewallrc.archlinux
+	    elif [ -f /etc/openwrt_release ]; then
+		params[HOST]=openwrt
+		rcfile=shorewallrc.openwrt
 	    else
 		params[HOST]=linux
 		rcfile=shorewallrc.default
@@ -158,6 +161,9 @@ else
     if [ ! -f $rcfile ]; then
 	echo "ERROR: $vendor is not a recognized host type" >&2
 	exit 1
+    elif [ $vendor = default ]; then
+	params[HOST]=linux
+	vendor=linux
     fi
 fi
 

Shorewall-core/configure.pl

@@ -82,7 +82,11 @@ unless ( defined $vendor ) {
 
 if ( defined $vendor ) {
     $rcfilename = $vendor eq 'linux' ? 'shorewallrc.default' : 'shorewallrc.' . $vendor;
-    die qq("ERROR: $vendor" is not a recognized host type) unless -f $rcfilename;
+    unless ( -f $rcfilename ) {
+	die qq("ERROR: $vendor" is not a recognized host type);
+    } elsif ( $vendor eq 'default' ) {
+	$params{HOST} = $vendor = 'linux';
+    }
 } else {
     if ( -f '/etc/debian_version' ) {
 	$vendor = 'debian';

Shorewall-core/install.sh

@@ -66,15 +66,6 @@ mywhich() {
     return 2
 }
 
-run_install()
-{
-    if ! install $*; then
-	echo
-	echo "ERROR: Failed to install $*" >&2
-	exit 1
-    fi
-}
-
 cant_autostart()
 {
     echo
@@ -88,7 +79,20 @@ delete_file() # $1 = file to delete
 
 install_file() # $1 = source $2 = target $3 = mode
 {
-    run_install $T $OWNERSHIP -m $3 $1 ${2}
+    if cp -f $1 $2; then
+	if chmod $3 $2; then
+	    if [ -n "$OWNER" ]; then
+		if chown $OWNER:$GROUP $2; then
+		    return
+		fi
+	    else
+		return 0
+	    fi
+	fi
+    fi
+
+    echo "ERROR: Failed to install $2" >&2
+    exit 1
 }
 
 require()
@@ -181,10 +185,6 @@ done
 
 [ "${INITFILE}" != 'none/' ] && require INITSOURCE && require INITDIR
 
-T="-T"
-
-INSTALLD='-D'
-
 if [ -z "$BUILD" ]; then
     case $(uname) in
 	cygwin*|CYGWIN*)
@@ -226,6 +226,8 @@ if [ -z "$BUILD" ]; then
 		BUILD=suse
 	    elif [ -f /etc/arch-release ] ; then
 		BUILD=archlinux
+	    elif [ -f ${CONFDIR}/openwrt_release ] ; then
+		BUILD=openwrt
 	    else
 		BUILD=linux
 	    fi
@@ -252,17 +254,15 @@ case $BUILD in
 
 	[ -z "$OWNER" ] && OWNER=root
 	[ -z "$GROUP" ] && GROUP=wheel
-	INSTALLD=
-	T=
 	;;
     *)
-	[ -z "$OWNER" ] && OWNER=root
-	[ -z "$GROUP" ] && GROUP=root
+	if [ $(id -u) -eq 0 ]; then
+	    [ -z "$OWNER" ] && OWNER=root
+	    [ -z "$GROUP" ] && GROUP=root
+	fi
 	;;
 esac
 
-OWNERSHIP="-o $OWNER -g $GROUP"
-
 #
 # Determine where to install the firewall script
 #
@@ -276,7 +276,7 @@ case "$HOST" in
     apple)
 	echo "Installing Mac-specific configuration...";
 	;;
-    debian|gentoo|redhat|slackware|archlinux|linux|suse)
+    debian|gentoo|redhat|slackware|archlinux|linux|suse|openwrt)
 	;;
     *)
 	echo "ERROR: Unknown HOST \"$HOST\"" >&2
@@ -305,7 +305,6 @@ if [ -n "$DESTDIR" ]; then
     if [ $BUILD != cygwin ]; then
 	if [ `id -u` != 0 ] ; then
 	    echo "Not setting file owner/group permissions, not running as root."
-	    OWNERSHIP=""
 	fi
     fi
 fi
@@ -407,9 +406,9 @@ fi
 if [ ${SHAREDIR} != /usr/share ]; then
     for f in lib.*; do
 	if [ $BUILD != apple ]; then
-	    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}/${SHAREDIR}/shorewall/$f
+	    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/$f
 	else
-	    eval sed -i \'\' -e \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}/${SHAREDIR}/shorewall/$f
+	    eval sed -i \'\' -e \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/$f
 	fi
     done
 fi

Shorewall-core/lib.cli

@@ -143,29 +143,63 @@ timed_read ()
 }
 
 #
-# Determine if 'syslog -C' is running
+# Determine if 'syslogd -C' or logd -S is running
 #
 syslog_circular_buffer() {
     local pid
     local tty
     local flags
-    local cputime
+    local time
     local path
     local args
     local arg
 
-    ps ax 2> /dev/null | while read pid tty flags cputime path args; do
-	case $path in
-	    syslogd|*/syslogd)
-		for arg in $args; do
-		    if [ x$arg = x-C ]; then
-			echo Yes
-			return
-		    fi
-		done
-		;;
-	esac
-    done
+    ps w 2> /dev/null | (
+	while read pid tty stat time path args; do
+	    case $path in
+		syslogd|*/syslogd)
+		    for arg in $args; do
+			case $arg in
+			    -C*)
+				return 0
+				;;
+			esac
+		    done
+		    ;;
+		logd|*/logd)
+		    for arg in $args; do
+			case $arg in
+			    -S*)
+				return 0
+				;;
+			esac
+		    done
+		    ;;
+	    esac
+	done
+
+	return 1 )
+}
+
+setup_logread() {
+    [ -z "$LOGFILE" ] && LOGFILE=/var/log/messages
+
+    if syslog_circular_buffer; then
+	LOGFILE=logread
+	if qt mywhich tac; then
+	    g_logread="logread | tac"
+	else
+	    g_logread="logread"
+	fi
+    elif [ -r $LOGFILE ]; then
+	if qt mywhich tac; then
+	    g_logread="tac $LOGFILE"
+	else
+	    g_logread="cat $LOGFILE"
+	fi
+    else
+	fatal_error "LOGFILE ($LOGFILE) does not exist or is not readable!"
+    fi
 }
 
 #
@@ -173,31 +207,59 @@ syslog_circular_buffer() {
 #
 packet_log() # $1 = number of messages
 {
-    if [ -n "$g_showmacs" -o $VERBOSITY -gt 2 ]; then
-	if [ $g_family -eq 4 ]; then
-	    $g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' | head -n$1 | tac | sed 's/ kernel://; s/\[.*\] //' | sed s/" $host $LOGFORMAT"/" "/
+    if qt mywhich tac; then
+	if [ -n "$g_showmacs" -o $VERBOSITY -gt 2 ]; then
+	    if [ $g_family -eq 4 ]; then
+		$g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' | head -n$1 | tac | sed 's/ kernel://; s/\[.*\] //' | sed s/" $host $LOGFORMAT"/" "/
+	    else
+		$g_logread | grep 'IN=.* OUT=.*SRC=.*:.*DST=' | head -n$1 | tac | sed -r 's/ kernel://; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
+	    fi
+	elif [ $g_family -eq 4 ]; then
+	    $g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' |  head -n$1 | tac | sed 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] '// | sed s/" $host $LOGFORMAT"/" "/
 	else
-	    $g_logread | grep 'IN=.* OUT=.*SRC=.*:.*DST=' | head -n$1 | tac | sed -r 's/ kernel://; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
+	    $g_logread | grep 'IN=.* OUT=.*SRC=.*:.*DST=' |  head -n$1 | tac | sed -r 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
 	fi
-    elif [ $g_family -eq 4 ]; then
-	$g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' |  head -n$1 | tac | sed 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] '// | sed s/" $host $LOGFORMAT"/" "/
     else
-	$g_logread | grep 'IN=.* OUT=.*SRC=.*:.*DST=' |  head -n$1 | tac | sed -r 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
-    fi
+	if [ -n "$g_showmacs" -o $VERBOSITY -gt 2 ]; then
+	    if [ $g_family -eq 4 ]; then
+		$g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' | tail -n$1 | sed 's/ kernel://; s/\[.*\] //' | sed s/" $host $LOGFORMAT"/" "/
+	    else
+		$g_logread | grep 'IN=.* OUT=.*SRC=.*:.*DST=' | tail -n$1 | sed -r 's/ kernel://; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
+	    fi
+	elif [ $g_family -eq 4 ]; then
+	    $g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' |  tail -n$1 | sed 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] '// | sed s/" $host $LOGFORMAT"/" "/
+	else
+	    $g_logread | grep 'IN=.* OUT=.*SRC=.*:.*DST=' |  tail -n$1 | sed -r 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
+	fi
+    fi	
 }
 
 search_log() # $1 = IP address to search for
 {
-    if [ -n "$g_showmacs" -o $VERBOSITY -gt 2 ]; then
-        if [ $g_family -eq 4 ]; then
-	    $g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' | grep "$1" | tac | sed 's/ kernel://; s/\[.*\] //' | sed s/" $host $LOGFORMAT"/" "/
+    if qt mywhich tac; then
+	if [ -n "$g_showmacs" -o $VERBOSITY -gt 2 ]; then
+            if [ $g_family -eq 4 ]; then
+		$g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' | grep "$1" | tac | sed 's/ kernel://; s/\[.*\] //' | sed s/" $host $LOGFORMAT"/" "/
+	    else
+		$g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' | grep "$1" | tac | sed -r 's/ kernel://; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
+	    fi
+	elif [ $g_family -eq 4 ]; then
+	    $g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' |  grep "$1" | tac | sed 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] '// | sed s/" $host $LOGFORMAT"/" "/
 	else
-	    $g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' | grep "$1" | tac | sed -r 's/ kernel://; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
+	    $g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' |  grep "$1" | tac | sed -r 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
 	fi
-    elif [ $g_family -eq 4 ]; then
-	$g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' |  grep "$1" | tac | sed 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] '// | sed s/" $host $LOGFORMAT"/" "/
     else
-	$g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' |  grep "$1" | tac | sed -r 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
+	if [ -n "$g_showmacs" -o $VERBOSITY -gt 2 ]; then
+            if [ $g_family -eq 4 ]; then
+		$g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' | grep "$1" | sed 's/ kernel://; s/\[.*\] //' | sed s/" $host $LOGFORMAT"/" "/
+	    else
+		$g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' | grep "$1" | sed -r 's/ kernel://; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
+	    fi
+	elif [ $g_family -eq 4 ]; then
+	    $g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' |  grep "$1" | sed 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] '// | sed s/" $host $LOGFORMAT"/" "/
+	else
+	    $g_logread | grep 'IN=.* OUT=.*SRC=.*\..*DST=' |  grep "$1" | sed -r 's/ kernel://; s/MAC=.* SRC=/SRC=/; s/\[.*\] //; s/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | sed s/" $host $LOGFORMAT"/" "/
+	fi
     fi
 }
 
@@ -280,17 +342,7 @@ show_bl() {
 logwatch() # $1 = timeout -- if negative, prompt each time that
 	   #		     an 'interesting' packet count changes
 {
-    if [ -z "$LOGFILE" ]; then
-	LOGFILE=/var/log/messages
-
-	if [ -n "$(syslog_circular_buffer)" ]; then
-	    g_logread="logread | tac"
-	elif [ -r $LOGFILE ]; then
-	    g_logread="tac $LOGFILE"
-	else
-	    fatal_error "LOGFILE ($LOGFILE) does not exist!"
-	fi
-    fi
+    setup_logread
 
     host=$(echo $g_hostname | sed 's/\..*$//')
     oldrejects=$($g_tool -L -v -n | grep 'LOG')
@@ -1038,17 +1090,7 @@ show_command() {
 	log)
 	    [ $# -gt 2 ] && usage 1
 
-	    if [ -z "$LOGFILE" ]; then
-		LOGFILE=/var/log/messages
-
-		if [ -n "$(syslog_circular_buffer)" ]; then
-		    g_logread="logread | tac"
-		elif [ -r $LOGFILE ]; then
-		    g_logread="tac $LOGFILE"
-		else
-		    fatal_error "LOGFILE ($LOGFILE) does not exist!"
-		fi
-	    fi
+	    setup_logread
 
 	    echo "$g_product $SHOREWALL_VERSION Log ($LOGFILE) at $g_hostname - $(date)"
 	    echo
@@ -1427,17 +1469,7 @@ do_dump_command() {
 	esac
     done
 
-    if [ -z "$LOGFILE" ]; then
-	LOGFILE=/var/log/messages
-
-	if [ -n "$(syslog_circular_buffer)" ]; then
-	    g_logread="logread | tac"
-	elif [ -r $LOGFILE ]; then
-	    g_logread="tac $LOGFILE"
-	else
-	    fatal_error "LOGFILE ($LOGFILE) does not exist! - See http://www.shorewall.net/shorewall_logging.html"
-	fi
-    fi
+    setup_logread
 
     g_ipt_options="$g_ipt_options $g_ipt_options1"
 
@@ -3495,10 +3527,34 @@ noiptrace_command() {
 	fatal_error "$g_product is not started"
     fi
 }
+
 #
-# Set the configuration variables from shorewall-lite.conf
+# Verify that we have a compiled firewall script
+#
+verify_firewall_script() {
+    if [ ! -f $g_firewall ]; then
+	echo "   ERROR: $g_product is not properly installed" >&2
+	if [ -L $g_firewall ]; then
+	    echo "          $g_firewall is a symbolic link to a" >&2
+	    echo "          non-existant file" >&2
+	else
+	    echo "          The file $g_firewall does not exist" >&2
+	fi
+
+	exit 2
+    fi
+}
+
+################################################################################
+# The remaining functions are used by the Lite cli - they are overloaded by
+# the Standard CLI by loading lib.cli-std
+################################################################################
+#
+# Set the configuration variables from shorewall[6]-lite.conf.
 #
 get_config() {
+    local config
+    local lib
 
     ensure_config_path
 
@@ -3520,15 +3576,7 @@ get_config() {
 
     [ -n "$PATH" ] || PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
-    [ -z "$LOGFILE" ] && LOGFILE=/var/log/messages
-
-    if ( ps ax 2> /dev/null | grep -v grep |  qt grep 'syslogd.*-C' ) ; then
-	g_logread="logread | tac"
-    elif [ -r $LOGFILE ]; then
-	g_logread="tac $LOGFILE"
-    else
-	fatal_error "LOGFILE ($LOGFILE) does not exist!"
-    fi
+    setup_logread
     #
     # See if we have a real version of "tail" -- use separate redirection so
     # that ash (aka /bin/sh on LRP) doesn't crap
@@ -3636,29 +3684,11 @@ get_config() {
 
     g_loopback=$(find_loopback_interfaces)
 
+    lib=$(find_file lib.cli-user)
+
+    [ -f $lib ] && . $lib
+
 }
-
-#
-# Verify that we have a compiled firewall script
-#
-verify_firewall_script() {
-    if [ ! -f $g_firewall ]; then
-	echo "   ERROR: $g_product is not properly installed" >&2
-	if [ -L $g_firewall ]; then
-	    echo "          $g_firewall is a symbolic link to a" >&2
-	    echo "          non-existant file" >&2
-	else
-	    echo "          The file $g_firewall does not exist" >&2
-	fi
-
-	exit 2
-    fi
-}
-
-################################################################################
-# The remaining functions are used by the Lite cli - they are overloaded by
-# the Standard CLI by loading lib.cli-std
-################################################################################
 #
 # Start Command Executor
 #
@@ -3885,6 +3915,13 @@ usage() # $1 = exit status
     ecko "   refresh [ -d ] [ -n ] [ -T ] [ -D <directory> ] [ <chain>... ]"
     echo "   reject <address> ..."
     ecko "   reload [ -s ] [ -c ] [ -r <root user> ] [ -T ] [ -i ] [ <directory> ] <system>"
+
+    if [ -z "$g_lite" ]; then
+	echo "   remote-reload [ -s ] [ -c ] [ -r <root-name> ] [ -T ] [ -i ] [ <directory> ] <system>"
+	echo "   remote-restart [ -s ] [ -c ] [ -r <root-name> ] [ -T ] [ -i ] [ <directory> ] <system>"
+	echo "   remote-start [ -s ] [ -c ] [ -r <root-name> ] [ -T ] [ -i ] [ <directory> ] <system>"
+    fi
+
     echo "   reset [ <chain> ... ]"
 
     if [ -n "$g_lite" ]; then

Shorewall-core/lib.common

@@ -33,7 +33,7 @@ startup_error() # $* = Error Message
     echo "   ERROR: $@: Firewall state not changed" >&2
 
     if [ $LOG_VERBOSITY -ge 0 ]; then
-        timestamp="$(date +'%_b %d %T') "
+        timestamp="$(date +'%b %d %T') "
         echo "${timestamp}  ERROR: $@" >> $STARTUP_LOG
     fi
 
@@ -50,7 +50,7 @@ startup_error() # $* = Error Message
     esac
 
     if [ $LOG_VERBOSITY -ge 0 ]; then
-        timestamp="$(date +'%_b %d %T') "
+        timestamp="$(date +'%b %d %T') "
 
 	case $COMMAND in
 	    start)
@@ -709,12 +709,15 @@ mutex_on()
     local lockf
     lockf=${LOCKFILE:=${VARDIR}/lock}
     local lockpid
+    local lockd
 
     MUTEX_TIMEOUT=${MUTEX_TIMEOUT:-60}
 
     if [ $MUTEX_TIMEOUT -gt 0 ]; then
 
-	[ -d ${VARDIR} ] || mkdir -p ${VARDIR}
+	lockd=$(dirname $LOCKFILE)
+
+	[ -d "$lockd" ] || mkdir -p "$lockd"
 
 	if [ -f $lockf ]; then
 	    lockpid=`cat ${lockf} 2> /dev/null`
@@ -734,6 +737,11 @@ mutex_on()
 	    chmod u+w ${lockf}
 	    echo $$ > ${lockf}
 	    chmod u-w ${lockf}
+	elif qt mywhich lock; then
+            lock -${MUTEX_TIMEOUT} -r1 ${lockf}
+            chmod u+w ${lockf}
+            echo $$ > ${lockf}
+            chmod u-w ${lockf}
 	else
 	    while [ -f ${lockf} -a ${try} -lt ${MUTEX_TIMEOUT} ] ; do
 		sleep 1

Shorewall-core/shorewallrc.openwrt

@@ -0,0 +1,26 @@
+#
+# Created by Shorewall Core version 5.0.2-RC1 configure -  Fri, Nov 06, 2015 10:02:03 AM
+#
+# Input: host=openwrt
+#
+HOST=openwrt
+PREFIX=/usr                             
+SHAREDIR=${PREFIX}/share                
+LIBEXECDIR=${PREFIX}/share              
+PERLLIBDIR=${PREFIX}/share/shorewall    
+CONFDIR=/etc                            
+SBINDIR=/sbin                           
+MANDIR=${PREFIX}/man                    
+INITDIR=/etc/init.d                     
+INITSOURCE=init.openwrt.sh
+INITFILE=$PRODUCT                       
+AUXINITSOURCE=
+AUXINITFILE=
+SERVICEDIR=                             
+SERVICEFILE=                            
+SYSCONFFILE=default.openwrt
+SYSCONFDIR=${CONFDIR}/sysconfig
+SPARSE=                                 
+ANNOTATED=                              
+VARLIB=/lib
+VARDIR=${VARLIB}/$PRODUCT               

Shorewall-init/install.sh

@@ -397,6 +397,7 @@ if [ $HOST = debian ]; then
 
 	[ $configure -eq 1 ] || mkdir -p ${DESTDIR}${CONFDIR}/default
 	install_file sysconfig ${DESTDIR}${ETC}/default/shorewall-init 0644
+	echo "sysconfig file installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}"
     fi
 
     IFUPDOWN=ifupdown.debian.sh
@@ -490,7 +491,12 @@ esac
 if [ -z "$DESTDIR" ]; then
     if [ $configure -eq 1 -a -n "$first_install" ]; then
 	if [ $HOST = debian ]; then
-	    if mywhich insserv; then
+	    if [ -n "$SERVICEDIR" ]; then
+		if systemctl enable ${PRODUCT}.service; then
+                    echo "Shorewall Init will start automatically at 
+boot"
+		fi
+	    elif mywhich insserv; then
 		if insserv ${INITDIR}/shorewall-init; then
 		    echo "Shorewall Init will start automatically at boot"
 		else
@@ -554,7 +560,7 @@ fi
 
 [ -z "${DESTDIR}" ] && [ ! -f ~/.shorewallrc ] && cp ${SHAREDIR}/shorewall/shorewallrc .
 
-if [ -f ${DESTDIR}/etc/ppp ]; then
+if [ -d ${DESTDIR}/etc/ppp ]; then
     case $HOST in
 	debian|suse)
 	    for directory in ip-up.d ip-down.d ipv6-up.d ipv6-down.d; do

Shorewall-init/uninstall.sh

@@ -174,9 +174,13 @@ if [ -f "$INITSCRIPT" ]; then
     remove_file $INITSCRIPT
 fi
 
-if [ -n "$SYSTEMD" ]; then
+if [ -z "${SERVICEDIR}" ]; then
+    SERVICEDIR="$SYSTEMD"
+fi
+
+if [ -n "$SERVICEDIR" ]; then
     [ $configure -eq 1 ] && systemctl disable shorewall-init.service
-    rm -f $SYSTEMD/shorewall-init.service
+    rm -f $SERVICEDIR/shorewall-init.service
 fi
 
 [ "$(readlink -m -q ${SBINDIR}/ifup-local)"   = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifup-local
@@ -202,8 +206,10 @@ if [ -d ${CONFDIR}/ppp ]; then
     done
 
     for file in if-up.local if-down.local; do
-	if grep -qF Shorewall-based ${CONFDIR}/ppp/$FILE; then
-	    remove_file ${CONFDIR}/ppp/$FILE
+	if [ -f ${CONFDIR}/ppp/$file ]; then
+	    if grep -qF Shorewall-based ${CONFDIR}/ppp/$FILE; then
+		remove_file ${CONFDIR}/ppp/$FILE
+	    fi
 	fi
     done
 fi

Shorewall-lite/default.openwrt

@@ -0,0 +1,25 @@
+# sysV init file script configuration(/etc/sysconfdir/shorewall-lite)
+
+# startup option(default "-vvv")
+OPTIONS=
+
+# change default start run level(if none empty; /etc/init.d/shorewall-lite enable)
+START=50
+
+# change default stop run level(if none empty; /etc/init.d/shorewall-lite enable)
+STOP=
+
+# option to pass when shorewall start is executed
+STARTOPTIONS=
+
+# option to pass when shorewall restart is executed
+RESTARTOPTIONS=
+
+# option to pass when shorewall reload is executed
+RELOADOPTIONS=
+
+# option to pass when shorewall stop is executed
+STOPOPTIONS=
+
+# option to pass when shorewall status is executed
+STATUSOPTIONS=

Shorewall-lite/init.openwrt.sh

@@ -0,0 +1,98 @@
+#!/bin/sh /etc/rc.common
+#
+#     The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.5
+#
+#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2012,2014 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2015 - Matt Darfeuille - (matdarf@gmail.com)
+#
+#	On most distributions, this file should be called /etc/init.d/shorewall.
+#
+#	Complete documentation is available at http://shorewall.net
+#
+#       This program is part of Shorewall.
+#
+#	This program is free software; you can redistribute it and/or modify
+#	it under the terms of the GNU General Public License as published by the
+#       Free Software Foundation, either version 2 of the license or, at your
+#       option, any later version.
+#
+#	This program is distributed in the hope that it will be useful,
+#	but WITHOUT ANY WARRANTY; without even the implied warranty of
+#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+#	GNU General Public License for more details.
+#
+#	You should have received a copy of the GNU General Public License
+#	along with this program; if not, see <http://www.gnu.org/licenses/>.
+#
+#	If an error occurs while starting or restarting the firewall, the
+#	firewall is automatically stopped.
+#
+#	Commands are:
+#
+#	   shorewall-lite start			  Starts the firewall
+#	   shorewall-lite restart		  Restarts the firewall
+#	   shorewall-lite reload		  Reload the firewall
+#						  (same as restart)
+#	   shorewall-lite stop			  Stops the firewall
+#	   shorewall-lite status		  Displays firewall status
+#
+
+# description: Packet filtering firewall
+
+# openwrt stuph
+# start and stop runlevel variable
+#START=21
+#STOP=91
+# variable to display what the status command do when /etc/init.d/shorewall-lite is invoke without argument
+EXTRA_COMMANDS="status"
+EXTRA_HELP="Displays shorewall status"
+
+################################################################################
+# Get startup options (override default)
+################################################################################
+OPTIONS="-vvv"
+
+#
+# The installer may alter this
+#
+. /usr/share/shorewall/shorewallrc
+
+if [ -f ${SYSCONFDIR}/shorewall-lite ]; then
+    . ${SYSCONFDIR}/shorewall-lite
+fi
+
+START=${START:-21}
+STOP=${STOP:-91}
+
+SHOREWALL_INIT_SCRIPT=1
+
+################################################################################
+# E X E C U T I O N    B E G I N S   H E R E				       #
+################################################################################
+# arg1 of init script is arg2 when rc.common is sourced; set to action variable
+command="$action"
+
+start() {
+	exec ${SBINDIR}/shorewall-lite $OPTIONS $command ${STARTOPTIONS:-$@}
+}
+
+boot() {
+local command="start"
+start
+}
+
+restart() {
+	exec ${SBINDIR}/shorewall-lite $OPTIONS $command ${RESTARTOPTIONS:-$@}
+}
+
+reload() {
+	exec ${SBINDIR}/shorewall-lite $OPTIONS $command ${RELOADOPTION:-$@}
+}
+
+stop() {
+	exec ${SBINDIR}/shorewall-lite $OPTIONS $command ${STOPOPTIONS:-$@}
+}
+
+status() {
+	exec ${SBINDIR}/shorewall-lite $OPTIONS $command ${STATUSOPTIONS:-$@}
+}

Shorewall-lite/install.sh

@@ -67,15 +67,6 @@ mywhich() {
     return 2
 }
 
-run_install()
-{
-    if ! install $*; then
-	echo
-	echo "ERROR: Failed to install $*" >&2
-	exit 1
-    fi
-}
-
 cant_autostart()
 {
     echo
@@ -89,7 +80,28 @@ delete_file() # $1 = file to delete
 
 install_file() # $1 = source $2 = target $3 = mode
 {
-    run_install $T $OWNERSHIP -m $3 $1 ${2}
+    if cp -f $1 $2; then
+	if chmod $3 $2; then
+	    if [ -n "$OWNER" ]; then
+		if chown $OWNER:$GROUP $2; then
+		    return
+		fi
+	    else
+		return 0
+	    fi
+	fi
+    fi
+
+    echo "ERROR: Failed to install $2" >&2
+    exit 1
+}
+
+make_directory() # $1 = directory , $2 = mode
+{
+    mkdir -p $1
+    chmod 755 $1
+    [ -n "$OWNERSHIP" ] && chown $OWNERSHIP $1
+
 }
 
 require()
@@ -187,7 +199,7 @@ elif [ -z "${VARDIR}" ]; then
     VARDIR=${VARLIB}/${PRODUCT}
 fi
 
-for var in SHAREDIR LIBEXECDIRDIRDIR CONFDIR SBINDIR VARLIB VARDIR; do
+for var in SHAREDIR LIBEXECDIR CONFDIR SBINDIR VARLIB VARDIR; do
     require $var
 done
 
@@ -201,8 +213,6 @@ PATH=${SBINDIR}:/bin:/usr${SBINDIR}:/usr/bin:/usr/local/bin:/usr/local${SBINDIR}
 # Determine where to install the firewall script
 #
 cygwin=
-INSTALLD='-D'
-T='-T'
 
 if [ -z "$BUILD" ]; then
     case $(uname) in
@@ -245,6 +255,8 @@ if [ -z "$BUILD" ]; then
 		BUILD=slackware
 	    elif [ -f ${CONFDIR}/arch-release ] ; then
 		BUILD=archlinux
+	    elif [ -f ${CONFDIR}/openwrt_release ]; then
+		BUILD=openwrt
 	    else
 		BUILD=linux
 	    fi
@@ -260,16 +272,16 @@ case $BUILD in
     apple)
 	[ -z "$OWNER" ] && OWNER=root
 	[ -z "$GROUP" ] && GROUP=wheel
-	INSTALLD=
-	T=
 	;;
     *)
-	[ -z "$OWNER" ] && OWNER=root
-	[ -z "$GROUP" ] && GROUP=root
+	if [ $(id -u) -eq 0 ]; then
+	    [ -z "$OWNER" ] && OWNER=root
+	    [ -z "$GROUP" ] && GROUP=root
+	fi
 	;;
 esac
 
-OWNERSHIP="-o $OWNER -g $GROUP"
+[ -n "$OWNER" ] && OWNERSHIP="$OWNER:$GROUP"
 
 [ -n "$HOST" ] || HOST=$BUILD
 
@@ -300,6 +312,9 @@ case "$HOST" in
     suse)
 	echo "Installing Suse-specific configuration..."
 	;;
+    openwrt)
+	echo "Installing OpenWRT-specific configuration..."
+	;;
     linux)
 	;;
     *)
@@ -316,8 +331,9 @@ if [ -n "$DESTDIR" ]; then
 	OWNERSHIP=""
     fi
 
-    install -d $OWNERSHIP -m 755 ${DESTDIR}/${SBINDIR}
-    install -d $OWNERSHIP -m 755 ${DESTDIR}${INITDIR}
+    make_directory ${DESTDIR}${SBINDIR} 755
+    make_directory ${DESTDIR}${INITDIR} 755
+
 else
     if [ ! -f ${SHAREDIR}/shorewall/coreversion ]; then
 	echo "$PRODUCT $VERSION requires Shorewall Core which does not appear to be installed" >&2
@@ -357,7 +373,7 @@ fi
 delete_file ${DESTDIR}/usr/share/$PRODUCT/xmodules
 
 install_file $PRODUCT ${DESTDIR}${SBINDIR}/$PRODUCT 0544
-[ -n "${INITFILE}" ] && install -d $OWNERSHIP -m 755 ${DESTDIR}${INITDIR}
+[ -n "${INITFILE}" ] && make_directory ${DESTDIR}${INITDIR} 755
 
 echo "$Product control program installed in ${DESTDIR}${SBINDIR}/$PRODUCT"
 
@@ -399,7 +415,7 @@ fi
 if [ -n "$SERVICEDIR" ]; then
     mkdir -p ${DESTDIR}${SERVICEDIR}
     [ -z "$SERVICEFILE" ] && SERVICEFILE=$PRODUCT.service
-    run_install $OWNERSHIP -m 644 $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
+    install_file $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service 644
     [ ${SBINDIR} != /sbin ] && eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
     echo "Service file $SERVICEFILE installed as ${DESTDIR}${SERVICEDIR}/$PRODUCT.service"
 fi
@@ -421,9 +437,9 @@ fi
 #
 # Install the  Makefile
 #
-run_install $OWNERSHIP -m 0600 Makefile ${DESTDIR}${CONFDIR}/$PRODUCT
-[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}/${CONFDIR}/$PRODUCT/Makefile
-[ $SBINDIR = /sbin ]       || eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\'       ${DESTDIR}/${CONFDIR}/$PRODUCT/Makefile
+install_file Makefile ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile 0600
+[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile
+[ $SBINDIR = /sbin ]       || eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\'       ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile
 echo "Makefile installed as ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile"
 
 #
@@ -438,7 +454,7 @@ echo "Default config path file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/confi
 for f in lib.* ; do
     if [ -f $f ]; then
 	install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 0644
-	echo "Library ${f#*.} file installed as ${DESTDIR}/${SHAREDIR}/$PRODUCT/$f"
+	echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
     fi
 done
 
@@ -451,7 +467,7 @@ echo "Common functions linked through ${DESTDIR}${SHAREDIR}/$PRODUCT/functions"
 #
 
 install_file shorecap ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shorecap 0755
-[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}/${LIBEXECDIR}/$PRODUCT/shorecap
+[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shorecap
 
 echo
 echo "Capability file builder installed in ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shorecap"
@@ -461,17 +477,17 @@ echo "Capability file builder installed in ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shor
 #
 
 if [ -f modules ]; then
-    run_install $OWNERSHIP -m 0600 modules ${DESTDIR}${SHAREDIR}/$PRODUCT
+    install_file modules ${DESTDIR}${SHAREDIR}/$PRODUCT/modules 0600
     echo "Modules file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/modules"
 fi
 
 if [ -f helpers ]; then
-    run_install $OWNERSHIP -m 0600 helpers ${DESTDIR}${SHAREDIR}/$PRODUCT
+    install_file helpers ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers 600
     echo "Helper modules file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers"
 fi
 
 for f in modules.*; do
-    run_install $OWNERSHIP -m 0644 $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f
+    install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 644
     echo "Module file $f installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
 done
 
@@ -482,17 +498,17 @@ done
 if [ -d manpages ]; then
     cd manpages
 
-    [ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man5/ ${DESTDIR}${MANDIR}/man8/
+    mkdir -p ${DESTDIR}${MANDIR}/man5/ ${DESTDIR}${MANDIR}/man8/
 
     for f in *.5; do
 	gzip -c $f > $f.gz
-	run_install $T $INSTALLD $OWNERSHIP -m 0644 $f.gz ${DESTDIR}${MANDIR}/man5/$f.gz
+	install_file $f.gz ${DESTDIR}${MANDIR}/man5/$f.gz 644
 	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
     done
 
     for f in *.8; do
 	gzip -c $f > $f.gz
-	run_install $T $INSTALLD $OWNERSHIP -m 0644 $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz
+	install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 644
 	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man8/$f.gz"
     done
 
@@ -502,7 +518,7 @@ if [ -d manpages ]; then
 fi
 
 if [ -d ${DESTDIR}${CONFDIR}/logrotate.d ]; then
-    run_install $OWNERSHIP -m 0644 logrotate ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT
+    install_file logrotate ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT 644
     echo "Logrotate file installed as ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT"
 fi
 
@@ -533,13 +549,13 @@ if [ -n "$SYSCONFFILE" -a -f "$SYSCONFFILE" -a ! -f ${DESTDIR}${SYSCONFDIR}/${PR
 	chmod 755 ${DESTDIR}${SYSCONFDIR}
     fi
 
-    run_install $OWNERSHIP -m 0644 ${SYSCONFFILE} ${DESTDIR}${SYSCONFDIR}/${PRODUCT}
+    install_file ${SYSCONFFILE} ${DESTDIR}${SYSCONFDIR}/${PRODUCT} 0640
     echo "$SYSCONFFILE installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}"
 fi
 
 if [ ${SHAREDIR} != /usr/share ]; then
-    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}/${SHAREDIR}/${PRODUCT}/lib.base
-    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}/${SBINDIR}/$PRODUCT
+    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.base
+    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/$PRODUCT
 fi
 
 if [ $configure -eq 1 -a -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${mac}" ]; then
@@ -587,6 +603,13 @@ if [ $configure -eq 1 -a -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${
 	else
 	    cant_autostart
 	fi
+    elif [ $HOST = openwrt -a -f ${CONFDIR}/rc.common ]; then
+	/etc/init.d/$PRODUCT enable
+	if /etc/init.d/$PRODUCT enabled; then
+            echo "$PRODUCT will start automatically at boot"
+	else
+            cant_autostart
+	fi
     elif [ "$INITFILE" != rc.${PRODUCT} ]; then #Slackware starts this automatically
 	cant_autostart
     fi

Shorewall-lite/uninstall.sh

@@ -153,7 +153,7 @@ if [ -f ${SHAREDIR}/shorewall-lite/version ]; then
 	VERSION="$INSTALLED_VERSION"
     fi
 else
-    echo "WARNING: Shorewall Lite Version $VERSION is not installed"
+    echo "WARNING: Shorewal Lite Version $VERSION is not installed"
     VERSION=""
 fi
 
@@ -168,7 +168,15 @@ if [ $configure -eq 1 ]; then
 fi
 
 if [ -L ${SHAREDIR}/shorewall-lite/init ]; then
-    FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall-lite/init)
+    if [ $HOST = openwrt ]; then
+	if [ $configure -eq 1 ] && /etc/init.d/shorewall-lite enabled; then
+	    /etc/init.d/shorewall-lite disable
+	fi
+	
+	FIREWALL=$(readlink ${SHAREDIR}/shorewall-lite/init)
+    else
+	FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall-lite/init)
+    fi
 elif [ -n "$INITFILE" ]; then
     FIREWALL=${INITDIR}/${INITFILE}
 fi
@@ -199,6 +207,7 @@ rm -rf ${VARDIR}/shorewall-lite
 rm -rf ${SHAREDIR}/shorewall-lite
 rm -rf ${LIBEXECDIR}/shorewall-lite
 rm -f  ${CONFDIR}/logrotate.d/shorewall-lite
+rm -f  ${SYSCONFDIR}/shorewall-lite
 
 rm -f ${MANDIR}/man5/shorewall-lite*
 rm -f ${MANDIR}/man8/shorewall-lite*

Shorewall/Perl/Shorewall/Config.pm

@@ -5147,6 +5147,7 @@ sub unsupported_yes_no_warning( $ ) {
 #
 sub get_params( $ ) {
     my $export = $_[0];
+    my $cygwin = ( $shorewallrc{HOST} eq 'cygwin' );
 
     my $fn = find_file 'params';
 
@@ -5188,14 +5189,16 @@ sub get_params( $ ) {
 	    $shell = BASH;
 
 	    for ( @params ) {
-		if ( /^declare -x (.*?)="(.*[^\\])"$/ ) {
+		chomp;
+		if ( $cygwin && /^declare -x (.*?)="(.*)"$/ ) {
+		    $params{$1} = $2 unless $1 eq '_';
+		} elsif ( /^declare -x (.*?)="(.*[^\\])"$/ ) {
 		    $params{$1} = $2 unless $1 eq '_';
 		} elsif ( /^declare -x (.*?)="(.*)$/ ) {
 		    $params{$variable=$1} = $2 eq '"' ? '' : "${2}\n";
 		} elsif ( /^declare -x (.*)\s+$/ || /^declare -x (.*)=""$/ ) {
 		    $params{$1} = '';
 		} else {
-		    chomp;
 		    if ($variable) {
 			s/"$//;
 			$params{$variable} .= $_;
@@ -5216,14 +5219,16 @@ sub get_params( $ ) {
 	    $shell = OLDBASH;
 
 	    for ( @params ) {
-		if ( /^export (.*?)="(.*[^\\])"$/ ) {
+		chomp;
+		if ( $cygwin && /^export (.*?)="(.*)"$/ ) {
+		    $params{$1} = $2 unless $1 eq '_';
+		} elsif ( /^export (.*?)="(.*[^\\])"$/ ) {
 		    $params{$1} = $2 unless $1 eq '_';
 		} elsif ( /^export (.*?)="(.*)$/ ) {
 		    $params{$variable=$1} = $2 eq '"' ? '' : "${2}\n";
 		} elsif ( /^export ([^\s=]+)\s*$/ || /^export (.*)=""$/ ) {
 		    $params{$1} = '';
 		} else {
-		    chomp;
 		    if ($variable) {
 			s/"$//;
 			$params{$variable} .= $_;
@@ -5243,6 +5248,7 @@ sub get_params( $ ) {
 	    $shell = ASH;
 
 	    for ( @params ) {
+		chomp;
 		if ( /^export (.*?)='(.*'"'"')$/ ) {
 		    $params{$variable=$1}="${2}\n";
 		} elsif ( /^export (.*?)='(.*)'$/ ) {
@@ -5250,7 +5256,6 @@ sub get_params( $ ) {
 		} elsif ( /^export (.*?)='(.*)$/ ) {
 		    $params{$variable=$1}="${2}\n";
 		} else {
-		    chomp;
 		    if ($variable) {
 			s/'$//;
 			$params{$variable} .= $_;
@@ -5262,9 +5267,23 @@ sub get_params( $ ) {
 	}
 
 	for ( keys %params ) {
-	    unless ( $_ eq 'SHOREWALL_INIT_SCRIPT' ) {
-		fatal_error "The variable name $_ is reserved and may not be set in the params file"
-		    if /^SW_/ || /^SHOREWALL_/ || ( exists $config{$_} && ! exists $ENV{$_} ) || exists $reserved{$_};
+	    if ( /[^\w]/ ) {
+		#
+		# Useless variable with special characters in its name
+		#
+		delete $params{$_};
+	    } elsif ( /^(?:SHLVL|OLDPWD)$/ ) {
+		#
+		# The shell running getparams generates those
+		#
+		delete $params{$_};
+	    } else {
+		unless ( $_ eq 'SHOREWALL_INIT_SCRIPT' ) {
+		    fatal_error "The variable name $_ is reserved and may not be set in the params file"
+			if /^SW_/ || /^SHOREWALL_/ || ( exists $config{$_} && ! exists $ENV{$_} ) || exists $reserved{$_};
+		}
+
+		$params{$_} = '' unless defined $params{$_};
 	    }
 	}
 
@@ -5314,6 +5333,8 @@ sub export_params() {
 	next if exists $compiler_params{$param};
 
 	my $value = $params{$param};
+
+	chomp $value;
 	#
 	# Values in %params are generated from the output of 'export -p'.
 	# The different shells have different conventions for delimiting
@@ -5324,19 +5345,27 @@ sub export_params() {
 	    $value =~ s/\\"/"/g;
 	} elsif ( $shell == OLDBASH ) {
 	    $value =~ s/\\'/'/g;
+	    $value =~ s/\\"/"/g;
+	    $value =~ s/\\\\/\\/g;
 	} else {
 	    $value =~ s/'"'"'/'/g;
 	}
 	#
 	# Don't export pairs from %ENV
 	#
-	next if defined $ENV{$param} && $value eq $ENV{$param};
+	if ( defined $ENV{$param} ) {
+	    next if $value eq $ENV{$param};
+	} elsif ( exists $ENV{$param} ) {
+	    next unless supplied $value;
+	}
 
 	emit "#\n# From the params file\n#" unless $count++;
 	#
 	# We will use double quotes and escape embedded quotes with \.
 	#
-	if ( $value =~ /[\s()['"]/ ) {
+	if ( $value =~ /^"[^"]*"$/ ) {
+	    emit "$param=$value";
+	} elsif ( $value =~ /[\s()['"]/ ) {
 	    $value =~ s/"/\\"/g;
 	    emit "$param='$value'";
 	} else {

Shorewall/Perl/Shorewall/Providers.pm

@@ -661,6 +661,10 @@ sub process_a_provider( $ ) {
 	fatal_error 'A non-empty COPY column requires that a routing table be specified in the DUPLICATE column' unless $copy eq 'none';
     }
 
+    if ( $persistent ) {
+	warning_message( "Provider $table is not optional -- the 'persistent' option is ignored" ), $persistent = 0 unless $optional;
+    }
+
     $providers{$table} = { provider          => $table,
 			   number            => $number ,
 			   id                => $config{USE_RT_NAMES} ? $table : $number,
@@ -702,7 +706,7 @@ sub process_a_provider( $ ) {
     if ( $track ) {
 	if ( $routemarked_interfaces{$interface} ) {
 	    fatal_error "Interface $interface is tracked through an earlier provider" if $routemarked_interfaces{$interface} == ROUTEMARKED_UNSHARED;
-	    fatal_error "Multiple providers through the same interface must their IP address specified in the INTERFACES" unless $shared;
+	    fatal_error "Multiple providers through the same interface must have their IP address specified in the INTERFACES column" unless $shared;
 	} else {
 	    $routemarked_interfaces{$interface} = $shared ? ROUTEMARKED_SHARED : ROUTEMARKED_UNSHARED;
 	    push @routemarked_interfaces, $interface;
@@ -1346,7 +1350,7 @@ sub add_a_route( ) {
 
     my $persistent;
 
-    if ( $options != '-' ) {
+    if ( $options ne '-' ) {
 	for ( split_list1( 'option', $options ) ) {
 	    my ( $option, $value ) = split /=/, $options;
 
@@ -1764,6 +1768,7 @@ sub map_provider_to_interface() {
 
 sub setup_providers() {
     our $providers;
+    our $pseudoproviders;
 
     if ( $providers ) {
 	if ( $maxload ) {
@@ -1798,6 +1803,11 @@ sub setup_providers() {
 
 	push_indent;
 
+	if ( $pseudoproviders ) {
+	    emit '';
+	    emit "start_$providers{$_}->{what}_$_" for @providers;
+	}
+
 	emit "\nundo_routing";
 	emit "restore_default_route $config{USE_DEFAULT_RT}";
 

Shorewall/configfiles/accounting

@@ -1,5 +1,5 @@
 #
-# Shorewall - Accounting File
+# Shorewall -- /etc/shorewall/accounting
 #
 # For information about entries in this file, type "man shorewall-accounting"
 #

Shorewall/configfiles/actions

@@ -1,7 +1,5 @@
 #
-# Shorewall - Actions File
-#
-# /etc/shorewall/actions
+# Shorewall -- /etc/shorewall/actions
 #
 # For information about entries in this file, type "man shorewall-actions"
 #

Shorewall/configfiles/arprules

@@ -1,5 +1,5 @@
 #
-# Shorewall - arprules File
+# Shorewall -- /etc/shorewall/arprules
 #
 # For information about entries in this file, type "man shorewall-arprules"
 #

Shorewall/configfiles/blrules

@@ -1,5 +1,5 @@
 #
-# Shorewall - Blacklist Rules File
+# Shorewall -- /etc/shorewall/blrules
 #
 # For information about entries in this file, type "man shorewall-blrules"
 #
@@ -9,4 +9,3 @@
 ################################################################################################################################################################################################
 #ACTION		SOURCE			DEST			PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME	HEADERS		SWITCH
 #									PORT	PORT(S)		DEST		LIMIT		GROUP
-

Shorewall/configfiles/clear

@@ -1,7 +1,5 @@
 #
-# Shorewall - clear File
-#
-# /etc/shorewall/clear
+# Shorewall -- /etc/shorewall/clear
 #
 # Add commands below that you want to be executed after Shorewall has
 # processed the 'clear' command.

Shorewall/configfiles/conntrack

@@ -1,10 +1,11 @@
 #
-# Shorewall - conntrack File
+# Shorewall -- /etc/shorewall/conntrack
 #
 # For information about entries in this file, type "man shorewall-conntrack"
 #
 ##############################################################################################################
 ?FORMAT 3
+##############################################################################################################
 #ACTION			SOURCE		DESTINATION	PROTO	DEST		SOURCE	USER/		SWITCH
 #								PORT(S)		PORT(S)	GROUP
 ?if $AUTOHELPERS && __CT_TARGET

Shorewall/configfiles/ecn

@@ -1,5 +1,5 @@
 #
-# Shorewall - Ecn File
+# Shorewall -- /etc/shorewall/ecn
 #
 # For information about entries in this file, type "man shorewall-ecn"
 #

Shorewall/configfiles/findgw

@@ -1,7 +1,5 @@
 #
-# Shorewall - Findgw File
-#
-# /etc/shorewall/findgw
+# Shorewall -- /etc/shorewall/findgw
 #
 # The code in this file is executed when Shorewall is trying to detect the
 # gateway through an interface in /etc/shorewall/providers that has GATEWAY

Shorewall/configfiles/hosts

@@ -1,5 +1,5 @@
 #
-# Shorewall - Hosts file
+# Shorewall -- /etc/shorewall/hosts
 #
 # For information about entries in this file, type "man shorewall-hosts"
 #

Shorewall/configfiles/init

@@ -1,10 +1,8 @@
 #
-# Shorewall - Init File
+# Shorewall -- /etc/shorewall/init
 #
-# /etc/shorewall/init
-#
-#	Add commands below that you want to be executed at the beginning of
-#	a "shorewall start", "shorewall-reload" or "shorewall restart" command.
+# Add commands below that you want to be executed at the beginning of
+# a "shorewall start", "shorewall-reload" or "shorewall restart" command.
 #
 # For additional information, see
 # http://shorewall.net/shorewall_extension_scripts.htm

Shorewall/configfiles/initdone

@@ -1,12 +1,10 @@
 #
-# Shorewall - Initdone File
+# Shorewall -- /etc/shorewall/initdone
 #
-# /etc/shorewall/initdone
-#
-#	Add commands below that you want to be executed during
-#	"shorewall start", "shorewall reload" or "shorewall restart" commands
-#	at the point where Shorewall has not yet added any permanent rules to
-#       the builtin chains.
+# Add commands below that you want to be executed during
+# "shorewall start", "shorewall reload" or "shorewall restart" commands
+# at the point where Shorewall has not yet added any permanent rules to
+# the builtin chains.
 #
 # For additional information, see
 # http://shorewall.net/shorewall_extension_scripts.htm

Shorewall/configfiles/interfaces

@@ -1,5 +1,5 @@
 #
-# Shorewall - Interfaces File
+# Shorewall -- /etc/shorewall/interfaces
 #
 # For information about entries in this file, type "man shorewall-interfaces"
 #

Shorewall/configfiles/isusable

@@ -1,15 +1,13 @@
 #
-# Shorewall - isusable File
+# Shorewall -- /etc/shorewall/isusable
 #
-# /etc/shorewall/isusable
+# This script is called when Shorewall is attempting to determine
+# if an interface named in /etc/shorewall/providers is usable.
 #
-#	This script is called when Shorewall is attempting to determine
-#	if an interface named in /etc/shorewall/providers is usable.
-#
-#	The script is invoked inside a function that accepts an interface
-#	name as a single argument. The file below is designed to work with
-#	both swping and lsm as described at
-#	http://www.shorewall.net/MultiISP.html
+# The script is invoked inside a function that accepts an interface
+# name as a single argument. The file below is designed to work with
+# both swping and lsm as described at
+# http://www.shorewall.net/MultiISP.html
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.

Shorewall/configfiles/lib.private

@@ -1,7 +1,5 @@
 #
-# Shorewall - lib.private File
-#
-# /etc/shorewall/lib.private
+# Shorewall -- /etc/shorewall/lib.private
 #
 # Use this file to declare shell functions to be called in the other
 # run-time extension scripts. The file will be copied into the generated

Shorewall/configfiles/maclist

@@ -1,5 +1,5 @@
 #
-# Shorewall - Maclist file
+# Shorewall -- /etc/shorewall/maclist
 #
 # For information about entries in this file, type "man shorewall-maclist"
 #

Shorewall/configfiles/mangle

@@ -1,5 +1,5 @@
 #
-# Shorewall - Mangle File
+# Shorewall -- /etc/shorewall/mangle
 #
 # For information about entries in this file, type "man shorewall-mangle"
 #
@@ -9,6 +9,7 @@
 #
 # See http://shorewall.net/PacketMarking.html for a detailed description of
 # the Netfilter/Shorewall packet marking mechanism.
+#
 ####################################################################################################################################################
 #ACTION		SOURCE		DEST		PROTO	DEST	SOURCE	USER	TEST	LENGTH	TOS	CONNBYTES	HELPER	PROBABILITY	DSCP
 #							PORT(S)	PORT(S)

Shorewall/configfiles/masq

@@ -1,5 +1,5 @@
 #
-# Shorewall - Masq file
+# Shorewall -- /etc/shorewall/masq
 #
 # For information about entries in this file, type "man shorewall-masq"
 #

Shorewall/configfiles/nat

@@ -1,5 +1,5 @@
 #
-# Shorewall - Nat File
+# Shorewall -- /etc/shorewall/nat
 #
 # For information about entries in this file, type "man shorewall-nat"
 #

Shorewall/configfiles/netmap

@@ -1,5 +1,5 @@
 #
-# Shorewall	 - Netmap File
+# Shorewall -- /etc/shorewall/netmap
 #
 # For information about entries in this file, type "man shorewall-netmap"
 #

Shorewall/configfiles/params

@@ -1,27 +1,25 @@
 #
-# Shorewall - Params File
+# Shorewall -- /etc/shorewall/params
 #
-# /etc/shorewall/params
+# Assign any variables that you need here.
 #
-#	Assign any variables that you need here.
+# It is suggested that variable names begin with an upper case letter
+# to distinguish them from variables used internally within the
+# Shorewall programs
 #
-#	It is suggested that variable names begin with an upper case letter
-#	to distinguish them from variables used internally within the
-#	Shorewall programs
+# Example:
 #
-#	Example:
+#	NET_IF=eth0
+#	NET_BCAST=130.252.100.255
+#	NET_OPTIONS=routefilter,norfc1918
 #
-#		NET_IF=eth0
-#		NET_BCAST=130.252.100.255
-#		NET_OPTIONS=routefilter,norfc1918
+# Example (/etc/shorewall/interfaces record):
 #
-#	Example (/etc/shorewall/interfaces record):
+#	net	$NET_IF		$NET_BCAST	$NET_OPTIONS
 #
-#		net	$NET_IF		$NET_BCAST	$NET_OPTIONS
+# The result will be the same as if the record had been written
 #
-#	The result will be the same as if the record had been written
-#
-#		net	eth0		130.252.100.255	routefilter,norfc1918
+#	net	eth0		130.252.100.255	routefilter,norfc1918
 #
 ###############################################################################
 

Shorewall/configfiles/policy

@@ -1,5 +1,5 @@
 #
-# Shorewall - Policy File
+# Shorewall -- /etc/shorewall/policy
 #
 # For information about entries in this file, type "man shorewall-policy"
 #

Shorewall/configfiles/providers

@@ -1,5 +1,5 @@
 #
-# Shorewall - Providers File
+# Shorewall -- /etc/shorewall/providers
 #
 # For information about entries in this file, type "man shorewall-providers"
 #

Shorewall/configfiles/proxyarp

@@ -1,5 +1,5 @@
 #
-# Shorewall - Proxyarp File
+# Shorewall -- /etc/shorewall/proxyarp
 #
 # For information about entries in this file, type "man shorewall-proxyarp"
 #

Shorewall/configfiles/refresh

@@ -1,7 +1,5 @@
 #
-# Shorewall - refresh File
-#
-# /etc/shorewall/refresh
+# Shorewall -- /etc/shorewall/refresh
 #
 # Add commands below that you want to be executed before Shorewall
 # has processed the 'refresh' command.

Shorewall/configfiles/refreshed

@@ -1,7 +1,5 @@
 #
-# Shorewall - refreshed File
-#
-# /etc/shorewall/refreshed
+# Shorewall -- /etc/shorewall/refreshed
 #
 # Add commands below that you want to be executed after Shorewall has
 # processed the 'refresh' command.

Shorewall/configfiles/restored

@@ -1,10 +1,8 @@
 #
-# Shorewall - Restored File
+# Shorewall -- /etc/shorewall/restored
 #
-# /etc/shorewall/restored
-#
-#	Add commands below that you want to be executed after shorewall has
-#	completed a 'restore' command.
+# Add commands below that you want to be executed after shorewall has
+# completed a 'restore' command.
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.

Shorewall/configfiles/routes

@@ -1,9 +1,9 @@
 #
-# Shorewall - routes File
+# Shorewall -- /etc/shorewall/routes
 #
 # For information about entries in this file, type "man shorewall-routes"
 #
 # For additional information, see http://www.shorewall.net/MultiISP.html
+#
 ###############################################################################
 #PROVIDER		DEST			GATEWAY		DEVICE	OPTIONS
-

Shorewall/configfiles/routestopped

@@ -1,16 +0,0 @@
-#
-# Shorewall - Routestopped File
-#
-# This file is deprecated in favor of the stoppedrules file
-#
-# For information about entries in this file, type "man shorewall-routestopped"
-#
-# The manpage is also online at
-# http://www.shorewall.net/manpages/shorewall-routestopped.html
-#
-# See http://shorewall.net/starting_and_stopping_shorewall.htm for additional
-# information.
-#
-###############################################################################
-#INTERFACE	HOST(S)			OPTIONS		PROTO	DEST	SOURCE
-#								PORT(S)	PORT(S)

Shorewall/configfiles/rtrules

@@ -1,8 +1,9 @@
 #
-# Shorewall - route rules File
+# Shorewall -- /etc/shorewall/rtrules
 #
 # For information about entries in this file, type "man shorewall-rtrules"
 #
 # For additional information, see http://www.shorewall.net/MultiISP.html
+#
 ####################################################################################
 #SOURCE			DEST			PROVIDER	PRIORITY	MASK

Shorewall/configfiles/rules

@@ -1,5 +1,5 @@
 #
-# Shorewall - Rules File
+# Shorewall -- /etc/shorewall/rules
 #
 # For information on the settings in this file, type "man shorewall-rules"
 #

Shorewall/configfiles/scfilter

@@ -1,7 +1,5 @@
 #
-# Shorewall - Show Connections Filter
-#
-# /etc/shorewall/scfilter
+# Shorewall -- /etc/shorewall/scfilter
 #
 # Replace the 'cat' command below to filter the output of
 # 'show connections'.

Shorewall/configfiles/secmarks

@@ -1,13 +1,8 @@
 #
-# Shorewall - Secmarks File
+# Shorewall -- /etc/shorewall/secmarks
 #
 # For information about entries in this file, type "man shorewall-secmarks"
 #
 ############################################################################################################
 #SECMARK			CHAIN:	SOURCE		DEST		PROTO	DEST	SOURCE	USER/	MARK
 #				STATE						PORT(S)	PORT(S) GROUP
-
-
-
-
-

Shorewall/configfiles/start

@@ -1,10 +1,8 @@
 #
-# Shorewall - Start File
+# Shorewall -- /etc/shorewall/start
 #
-# /etc/shorewall/start
-#
-#	Add commands below that you want to be executed after shorewall has
-#	been started, reloaded or restarted.
+# Add commands below that you want to be executed after shorewall has
+# been started, reloaded or restarted.
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.

Shorewall/configfiles/started

@@ -1,17 +1,15 @@
 #
-# Shorewall - Started File
+# Shorewall -- /etc/shorewall/started
 #
-# /etc/shorewall/started
+# Add commands below that you want to be executed after shorewall has
+# been completely started, reloaded or restarted. The difference between
+# this extension script and /etc/shorewall/start is that this one is
+# invoked after the 'shorewall' chain has been created (thus
+# signaling that the firewall is completely up).
 #
-#	Add commands below that you want to be executed after shorewall has
-#	been completely started, reloaded or restarted. The difference between
-#       this extension script and /etc/shorewall/start is that this one is
-#	invoked	after the 'shorewall' chain has been created (thus
-#	signaling that the firewall is completely up).
-#
-#	This script should not change the firewall configuration directly but
-#	may do so indirectly by running /sbin/shorewall with the 'nolock'
-#	option.
+# This script should not change the firewall configuration directly but
+# may do so indirectly by running /sbin/shorewall with the 'nolock'
+# option.
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.

Shorewall/configfiles/stop

@@ -1,10 +1,8 @@
 #
-# Shorewall - Stop File
+# Shorewall -- /etc/shorewall/stop
 #
-# /etc/shorewall/stop
-#
-#	Add commands below that you want to be executed at the beginning of a
-#	"shorewall stop" command.
+# Add commands below that you want to be executed at the beginning of a
+# "shorewall stop" command.
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.

Shorewall/configfiles/stopped

@@ -1,10 +1,8 @@
 #
-# Shorewall - Stopped File
+# Shorewall -- /etc/shorewall/stopped
 #
-# /etc/shorewall/stopped
-#
-#	Add commands below that you want to be executed at the completion of a
-#	"shorewall stop" command.
+# Add commands below that you want to be executed at the completion of a
+# "shorewall stop" command.
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.

Shorewall/configfiles/stoppedrules

@@ -1,5 +1,5 @@
 #
-# Shorewall - Stopped Rules File
+# Shorewall -- /etc/shorewall/stoppedrules
 #
 # For information about entries in this file, type "man shorewall-stoppedrules"
 #

Shorewall/configfiles/tcclasses

@@ -1,5 +1,5 @@
 #
-# Shorewall - Tcclasses File
+# Shorewall -- /etc/shorewall/tcclasses
 #
 # For information about entries in this file, type "man shorewall-tcclasses"
 #

Shorewall/configfiles/tcclear

@@ -1,7 +1,5 @@
 #
-# Shorewall - tcclear File
-#
-# /etc/shorewall/tcclear
+# Shorewall -- /etc/shorewall/tcclear
 #
 # Add commands below that you want to be executed before Shorewall clears
 # the traffic shaping configuration.

Shorewall/configfiles/tcdevices

@@ -1,5 +1,5 @@
 #
-# Shorewall - Tcdevices File
+# Shorewall -- /etc/shorewall/tcdevices
 #
 # For information about entries in this file, type "man shorewall-tcdevices"
 #

Shorewall/configfiles/tcfilters

@@ -1,5 +1,5 @@
 #
-# Shorewall - Tcfilters File
+# Shorewall -- /etc/shorewall/tcfilters
 #
 # For information about entries in this file, type "man shorewall-tcfilters"
 #

Shorewall/configfiles/tcinterfaces

@@ -1,5 +1,5 @@
 #
-# Shorewall - Tcinterfaces File
+# Shorewall -- /etc/shorewall/tcinterfaces
 #
 # For information about entries in this file, type "man shorewall-tcinterfaces"
 #

Shorewall/configfiles/tcpri

@@ -1,5 +1,5 @@
 #
-# Shorewall - Tcpri File
+# Shorewall -- /etc/shorewall/tcpri
 #
 # For information about entries in this file, type "man shorewall-tcpri"
 #
@@ -8,6 +8,3 @@
 #
 ###############################################################################
 #BAND	PROTO	PORT(S)		ADDRESS		IN-INTERFACE	HELPER
-
-
-

Shorewall/configfiles/tunnels

@@ -1,5 +1,5 @@
 #
-# Shorewall - Tunnels File
+# Shorewall -- /etc/shorewall/tunnels
 #
 # For information about entries in this file, type "man shorewall-tunnels"
 #

Shorewall/configfiles/zones

@@ -1,5 +1,5 @@
 #
-# Shorewall - Zones File
+# Shorewall -- /etc/shorewall/zones
 #
 # For information about this file, type "man shorewall-zones"
 #

Shorewall/install.sh

@@ -389,7 +389,7 @@ if [ -z "${DESTDIR}" -a $PRODUCT = shorewall -a ! -f ${SHAREDIR}/$PRODUCT/coreve
 fi
 
 install_file $PRODUCT ${DESTDIR}${SBINDIR}/$PRODUCT 0755
-[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}/${SBINDIR}/${PRODUCT}
+[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/${PRODUCT}
 echo "$PRODUCT control program installed in ${DESTDIR}${SBINDIR}/$PRODUCT"
 
 #
@@ -468,16 +468,16 @@ if [ -z "$first_install" ]; then
     #
     # Delete obsolete config files and manpages
     #
-    delete_file ${DESTDIR}/${SHAREDIR}/$PRODUCT/configfiles/tos
-    delete_file ${DESTDIR}/${SHAREDIR}/$PRODUCT/configfiles/tcrules
-    delete_file ${DESTDIR}/${SHAREDIR}/$PRODUCT/configfiles/stoppedrules
-    delete_file ${DESTDIR}/${SHAREDIR}/$PRODUCT/configfiles/notrack
-    delete_file ${DESTDIR}/${SHAREDIR}/$PRODUCT/configfiles/blacklist
-    delete_file ${DESTDIR}/${MANDIR}/man5/$PRODUCT/${PRODUCT}-tos
-    delete_file ${DESTDIR}/${MANDIR}/man5/$PRODUCT/${PRODUCT}-tcrules
-    delete_file ${DESTDIR}/${MANDIR}/man5/$PRODUCT/${PRODUCT}-stoppedrules
-    delete_file ${DESTDIR}/${MANDIR}/man5/$PRODUCT/${PRODUCT}-notrack
-    delete_file ${DESTDIR}/${MANDIR}/man5/$PRODUCT/${PRODUCT}-blacklist
+    delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles/tos
+    delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles/tcrules
+    delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles/stoppedrules
+    delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles/notrack
+    delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles/blacklist
+    delete_file ${DESTDIR}${MANDIR}/man5/$PRODUCT/${PRODUCT}-tos
+    delete_file ${DESTDIR}${MANDIR}/man5/$PRODUCT/${PRODUCT}-tcrules
+    delete_file ${DESTDIR}${MANDIR}/man5/$PRODUCT/${PRODUCT}-stoppedrules
+    delete_file ${DESTDIR}${MANDIR}/man5/$PRODUCT/${PRODUCT}-notrack
+    delete_file ${DESTDIR}${MANDIR}/man5/$PRODUCT/${PRODUCT}-blacklist
 fi
 
 #
@@ -1082,7 +1082,7 @@ if [ $PRODUCT = shorewall6 ]; then
     # Symbolically link 'functions' to lib.base
     #
     ln -sf lib.base ${DESTDIR}${SHAREDIR}/$PRODUCT/functions
-    [ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}/${SHAREDIR}/${PRODUCT}/lib.base
+    [ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.base
 fi
 
 if [ -d Perl ]; then

Shorewall/lib.cli-std

@@ -31,6 +31,7 @@
 #
 get_config() {
     local prog
+    local lib
 
     ensure_config_path
 
@@ -70,15 +71,7 @@ get_config() {
 	# This block is avoided for compile for export and when the user isn't root
 	#
 	if [ "$3" = Yes ]; then
-	    if [ -n "$LOGFILE" ]; then
-		if [ -n "$(syslog_circular_buffer)" ]; then
-		    g_logread="logread | tac"
-		elif [ -r $LOGFILE ]; then
-		    g_logread="tac $LOGFILE"
-		else
-		    fatal_error "LOGFILE ($LOGFILE) does not exist!"
-		fi
-	    fi
+	    setup_logread
 	fi
 
 	if [ $g_family -eq 4 ]; then
@@ -322,6 +315,10 @@ get_config() {
     fi
 
     g_loopback=$(find_loopback_interfaces)
+
+    lib=$(find_file lib.cli-user)
+
+    [ -f $lib ] && . $lib
 }
 
 #
@@ -1394,6 +1391,7 @@ remote_reload_command() # $* = original arguments less the command.
     local sharedir
     sharedir=${SHAREDIR}
     local litedir
+    local exitstatus
 
     while [ $finished -eq 0 -a $# -gt 0 ]; do
 	option=$1
@@ -1510,32 +1508,60 @@ remote_reload_command() # $* = original arguments less the command.
 
     g_file="$g_shorewalldir/firewall"
 
-    if compiler $g_debugging compiler "$g_file" && \
-	progress_message3 "Copying $file and ${file}.conf to ${system}:${litedir}..." && \
-	rcp_command "$g_shorewalldir/firewall $g_shorewalldir/firewall.conf" ${litedir}
-    then
-	save=$(find_file save);
+    exitstatus=0
 
-	[ -f $save ] && progress_message3 "Copying $save to ${system}:${confdir}/${g_program}-lite/" && rcp_command $save ${confdir}/shorewall-lite/
+    if compiler $g_debugging compiler "$g_file"; then
+	progress_message3 "Copying $file and ${file}.conf to ${system}:${litedir}..."
+	if rcp_command "$g_shorewalldir/firewall $g_shorewalldir/firewall.conf" ${litedir};  then
+	    save=$(find_file save);
 
-	progress_message3 "Copy complete"
+	    if [ -f $save ]; then
+		progress_message3 "Copying $save to ${system}:${confdir}/${g_program}-lite/"
+		rcp_command $save ${confdir}/shorewall-lite/
+		exitstatus=$?
+	    fi
 
-	if [ $COMMAND = remote-reload ]; then
-	    rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp reload" && \
-	    progress_message3 "System $system reloaded" || saveit=
-	elif [ $COMMAND = remote-restart ]; then
-	    rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp restart" && \
-	    progress_message3 "System $system restarted" || saveit=
+	    if [ $exitstatus -eq 0 ]; then
+
+		progress_message3 "Copy complete"
+
+		if [ $COMMAND = remote-reload ]; then
+		    if rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp reload"; then
+			progress_message3 "System $system reloaded"
+		    else
+			exitstatus=$?
+			savit=
+		    fi
+		elif [ $COMMAND = remote-restart ]; then
+		    if rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp restart"; then
+			progress_message3 "System $system restarted"
+		    else
+			exitstatus=$?
+			saveit=
+		    fi
+		elif rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp start"; then
+		    progress_message3 "System $system started"
+		else
+		    exitstatus=$?
+		    saveit=
+		fi
+
+		if [ -n "$saveit" ]; then
+		    if rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp save"; then
+			progress_message3 "Configuration on system $system saved"
+		    else
+			exitstatus=$?
+		    fi
+		fi
+	    fi
 	else
-	    rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp start" && \
-	    progress_message3 "System $system started" || saveit=
-	fi
-
-	if [ -n "$saveit" ]; then
-	    rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp save" && \
-	    progress_message3 "Configuration on system $system saved"
+	    exitstatus=$?
 	fi
+    else
+	exitstatus=$?
     fi
+
+    return $exitstatus
 }
 
 #
@@ -1645,7 +1671,7 @@ compiler_command() {
 	    shift
 	    update_command $@
 	    ;;
-	remote-start|remote-reload-reload|remote-restart)
+	remote-start|remote-reload|remote-restart)
 	    shift
 	    remote_reload_command $@
 	    ;;

Shorewall/manpages/shorewall-routestopped.xml

@@ -1,237 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall-routestopped</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>routestopped</refname>
-
-    <refpurpose>The Shorewall file that governs what traffic flows through the
-    firewall while it is in the 'stopped' state.</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>/etc/shorewall/routestopped</command>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>This file is deprecated in favor of the <ulink
-    url="/manpages/shorewall-stoppedrules.html">shorewall-stoppedrules</ulink>(5)
-    file.</para>
-
-    <para>This file is used to define the hosts that are accessible when the
-    firewall is stopped or is being stopped.</para>
-
-    <warning>
-      <para>Changes to this file do not take effect until after the next
-      <command>shorewall start</command> or <command>shorewall
-      restart</command> command.</para>
-    </warning>
-
-    <para>The columns in the file are as follows (where the column name is
-    followed by a different name in parentheses, the different name is used in
-    the alternate specification syntax).</para>
-
-    <variablelist>
-      <varlistentry>
-        <term><emphasis role="bold">INTERFACE</emphasis> -
-        <emphasis>interface</emphasis></term>
-
-        <listitem>
-          <para>Interface through which host(s) communicate with the
-          firewall</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">HOST(S)</emphasis> (hosts) - [<emphasis
-        role="bold">-</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...]</term>
-
-        <listitem>
-          <para>Optional. Comma-separated list of IP/subnet addresses. If your
-          kernel and iptables include iprange match support, IP address ranges
-          are also allowed.</para>
-
-          <para>If left empty or supplied as "-", 0.0.0.0/0 is assumed.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">OPTIONS</emphasis> - [<emphasis
-        role="bold">-</emphasis>|<emphasis>option</emphasis>[<emphasis
-        role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
-
-        <listitem>
-          <para>Optional. A comma-separated list of options. The order of the
-          options is not important but the list can contain no embedded
-          white-space. The currently-supported options are:</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><emphasis role="bold">routeback</emphasis></term>
-
-              <listitem>
-                <para>Set up a rule to ACCEPT traffic from these hosts back to
-                themselves. Beginning with Shorewall 4.4.9, this option is
-                automatically set if <emphasis
-                role="bold">routeback</emphasis> is specified in <ulink
-                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>
-                (5) or if the rules compiler detects that the interface is a
-                bridge.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">source</emphasis></term>
-
-              <listitem>
-                <para>Allow traffic from these hosts to ANY destination.
-                Without this option or the <emphasis
-                role="bold">dest</emphasis> option, only traffic from this
-                host to other listed hosts (and the firewall) is allowed. If
-                <emphasis role="bold">source</emphasis> is specified then
-                <emphasis role="bold">routeback</emphasis> is
-                redundant.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">dest</emphasis></term>
-
-              <listitem>
-                <para>Allow traffic to these hosts from ANY source. Without
-                this option or the <emphasis role="bold">source</emphasis>
-                option, only traffic from this host to other listed hosts (and
-                the firewall) is allowed. If <emphasis
-                role="bold">dest</emphasis> is specified then <emphasis
-                role="bold">routeback</emphasis> is redundant.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">notrack</emphasis></term>
-
-              <listitem>
-                <para>The traffic will be exempted from connection
-                tracking.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-
-          <note>
-            <para>The <emphasis role="bold">source</emphasis> and <emphasis
-            role="bold">dest</emphasis> options work best when used in
-            conjunction with ADMINISABSENTMINDED=Yes in <ulink
-            url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
-          </note>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>PROTO (Optional) ‒
-        <replaceable>protocol-name-or-number</replaceable></term>
-
-        <listitem>
-          <para>Protocol.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>DEST PORT(S) (dport) ‒
-        <replaceable>service-name/port-number-list</replaceable></term>
-
-        <listitem>
-          <para>Optional. A comma-separated list of port numbers and/or
-          service names from <filename>/etc/services</filename>. May also
-          include port ranges of the form
-          <replaceable>low-port</replaceable>:<replaceable>high-port</replaceable>
-          if your kernel and iptables include port range support.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>SOURCE PORT(S) (sport) ‒
-        <replaceable>service-name/port-number-list</replaceable></term>
-
-        <listitem>
-          <para>Optional. A comma-separated list of port numbers and/or
-          service names from <filename>/etc/services</filename>. May also
-          include port ranges of the form
-          <replaceable>low-port</replaceable>:<replaceable>high-port</replaceable>
-          if your kernel and iptables include port range support.</para>
-
-          <para>Beginning with Shorewall 4.5.15, you may place '=' in this
-          column, provided that the DEST PORT(S) column is non-empty. This
-          causes the rule to match when either the source port or the
-          destination port in a packet matches one of the ports specified in
-          DEST PORTS(S). Use of '=' requires multi-port match in your iptables
-          and kernel.</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-
-    <note>
-      <para>The <emphasis role="bold">source</emphasis> and <emphasis
-      role="bold">dest</emphasis> options work best when used in conjunction
-      with ADMINISABSENTMINDED=Yes in <ulink
-      url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
-    </note>
-  </refsect1>
-
-  <refsect1>
-    <title>Example</title>
-
-    <variablelist>
-      <varlistentry>
-        <term>Example 1:</term>
-
-        <listitem>
-          <programlisting>        #INTERFACE      HOST(S)                 OPTIONS         PROTO          DEST       SOURCE
-        #                                                                      PORT(S)    PORT(S)
-        eth2            192.168.1.0/24
-        eth0            192.0.2.44
-        br0             -                       routeback
-        eth3            -                       source
-        eth4            -                       notrack        41</programlisting>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/etc/shorewall/routestopped</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See ALSO</title>
-
-    <para><ulink
-    url="/starting_and_stopping_shorewall.htm">http://www.shorewall.net/starting_and_stopping_shorewall.htm</ulink></para>
-
-    <para><ulink
-    url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
-
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
-  </refsect1>
-</refentry>

Shorewall/manpages/shorewall.xml

@@ -424,7 +424,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="plain"><option>remote_start</option></arg>
+      <arg choice="plain"><option>remote-start</option></arg>
 
       <arg><option>-s</option></arg>
 
@@ -448,7 +448,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="plain"><option>remote_reload</option></arg>
+      <arg choice="plain"><option>remote-reload</option></arg>
 
       <arg><option>-s</option></arg>
 
@@ -472,7 +472,7 @@
 
       <arg>-<replaceable>options</replaceable></arg>
 
-      <arg choice="plain"><option>remote_restart</option></arg>
+      <arg choice="plain"><option>remote-restart</option></arg>
 
       <arg><option>-s</option></arg>
 
@@ -1522,7 +1522,7 @@
         <listitem>
           <para>This command was re-implemented in Shorewall 5.0.0. The
           pre-5.0.0 <command>reload</command> command is now called
-          <command>remote_restart</command> (see below).</para>
+          <command>remote-restart</command> (see below).</para>
 
           <para>Reload is similar to <emphasis role="bold">shorewall
           start</emphasis> except that it assumes that the firewall is already
@@ -1575,7 +1575,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">remote_start</emphasis>
+        <term><emphasis role="bold">remote-start</emphasis>
         [-<option>s</option>] [-<option>c</option>] [-<option>r</option>
         <replaceable>root-user-name</replaceable>] [-<option>T</option>]
         [-<option>i</option>] [ <replaceable>directory</replaceable> ]
@@ -1637,7 +1637,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">remote_reload
+        <term><emphasis role="bold">remote-reload
         </emphasis>[-<option>s</option>] [-<option>c</option>]
         [-<option>r</option> <replaceable>root-user-name</replaceable>]
         [-<option>T</option>] [-<option>i</option>] [
@@ -1699,7 +1699,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">remote_restart
+        <term><emphasis role="bold">remote-restart
         </emphasis>[-<option>s</option>] [-<option>c</option>]
         [-<option>r</option> <replaceable>root-user-name</replaceable>]
         [-<option>T</option>] [-<option>i</option>] [

Shorewall/uninstall.sh

@@ -168,8 +168,8 @@ fi
 
 rm -f ${SBINDIR}/shorewall
 
-if [ -L ${SHAREDIR}/shorewall6/init ]; then
-    FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall6/init)
+if [ -L ${SHAREDIR}/shorewall/init ]; then
+    FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall/init)
 elif [ -n "$INITFILE" ]; then
     FIREWALL=${INITDIR}/${INITFILE}
 fi
@@ -188,17 +188,19 @@ if [ -f "$FIREWALL" ]; then
     remove_file $FIREWALL
 fi
 
-if [ -n "$SYSTEMD" ]; then
+if [ -z "${SERVICEDIR}" ]; then
+    SERVICEDIR="$SYSTEMD"
+fi
+if [ -n "$SERVICEDIR" ]; then
     [ $configure -eq 1 ] && systemctl disable ${PRODUCT}
-    rm -f $SYSTEMD/shorewall.service
+    rm -f $SERVICEDIR/shorewall.service
 fi
 
 rm -rf ${SHAREDIR}/shorewall/version
 rm -rf ${CONFDIR}/shorewall
 
 if [ -n "$SYSCONFDIR" ]; then
-    [ -n "$SYSCONFFILE" ] || SYSCONFFILE=${PRODUCT};
-    rm -f ${SYSCONFDIR}/${SYSCONFFILE}
+    [ -n "$SYSCONFFILE" ] && rm -f ${SYSCONFDIR}/${PRODUCT}
 fi
 
 rm -rf ${VARDIR}/shorewall

Shorewall6-lite/default.openwrt

@@ -0,0 +1,25 @@
+# sysV init file script configuration(/etc/sysconfdir/shorewall-lite)
+
+# startup option(default "-vvv")
+OPTIONS=
+
+# change default start run level(if none empty; /etc/init.d/shorewall-lite enable)
+START=50
+
+# change default stop run level(if none empty; /etc/init.d/shorewall-lite enable)
+STOP=
+
+# option to pass when shorewall start is executed
+STARTOPTIONS=
+
+# option to pass when shorewall restart is executed
+RESTARTOPTIONS=
+
+# option to pass when shorewall reload is executed
+RELOADOPTIONS=
+
+# option to pass when shorewall stop is executed
+STOPOPTIONS=
+
+# option to pass when shorewall status is executed
+STATUSOPTIONS=

Shorewall6-lite/init.openwrt.sh

@@ -0,0 +1,98 @@
+#!/bin/sh /etc/rc.common
+#
+#     The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.5
+#
+#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2012,2014 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2015 - Matt Darfeuille - (matdarf@gmail.com)
+#
+#	On most distributions, this file should be called /etc/init.d/shorewall.
+#
+#	Complete documentation is available at http://shorewall.net
+#
+#       This program is part of Shorewall.
+#
+#	This program is free software; you can redistribute it and/or modify
+#	it under the terms of the GNU General Public License as published by the
+#       Free Software Foundation, either version 2 of the license or, at your
+#       option, any later version.
+#
+#	This program is distributed in the hope that it will be useful,
+#	but WITHOUT ANY WARRANTY; without even the implied warranty of
+#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+#	GNU General Public License for more details.
+#
+#	You should have received a copy of the GNU General Public License
+#	along with this program; if not, see <http://www.gnu.org/licenses/>.
+#
+#	If an error occurs while starting or restarting the firewall, the
+#	firewall is automatically stopped.
+#
+#	Commands are:
+#
+#	   shorewall6-lite start			  Starts the firewall
+#	   shorewall6-lite restart		  Restarts the firewall
+#	   shorewall6-lite reload		  Reload the firewall
+#						  (same as restart)
+#	   shorewall6-lite stop			  Stops the firewall
+#	   shorewall6-lite status		  Displays firewall status
+#
+
+# description: Packet filtering firewall
+
+# openwrt stuph
+# start and stop runlevel variable
+#START=21
+#STOP=91
+# variable to display what the status command do when /etc/init.d/shorewall6-lite is invoke without argument
+EXTRA_COMMANDS="status"
+EXTRA_HELP="Displays shorewall status"
+
+################################################################################
+# Get startup options (override default)
+################################################################################
+OPTIONS="-vvv"
+
+#
+# The installer may alter this
+#
+. /usr/share/shorewall/shorewallrc
+
+if [ -f ${SYSCONFDIR}/shorewall6-lite ]; then
+    . ${SYSCONFDIR}/shorewall6-lite
+fi
+
+START=${START:-21}
+STOP=${STOP:-91}
+
+SHOREWALL_INIT_SCRIPT=1
+
+################################################################################
+# E X E C U T I O N    B E G I N S   H E R E				       #
+################################################################################
+# arg1 of init script is arg2 when rc.common is sourced; set to action variable
+command="$action"
+
+start() {
+	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command ${STARTOPTIONS:-$@}
+}
+
+boot() {
+local command="start"
+start
+}
+
+restart() {
+	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command ${RESTARTOPTIONS:-$@}
+}
+
+reload() {
+	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command ${RELOADOPTION:-$@}
+}
+
+stop() {
+	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command ${STOPOPTIONS:-$@}
+}
+
+status() {
+	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command ${STATUSOPTIONS:-$@}
+}

Shorewall6-lite/uninstall.sh

@@ -144,16 +144,16 @@ fi
 if [ -f ${SHAREDIR}/shorewall6-lite/version ]; then
     INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall6-lite/version)"
     if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
-	echo "WARNING: Shorewall Lite Version $INSTALLED_VERSION is installed"
+	echo "WARNING: Shorewall6 Lite Version $INSTALLED_VERSION is installed"
 	echo "         and this is the $VERSION uninstaller."
 	VERSION="$INSTALLED_VERSION"
     fi
 else
-    echo "WARNING: Shorewall Lite Version $VERSION is not installed"
+    echo "WARNING: Shorewall6 Lite Version $VERSION is not installed"
     VERSION=""
 fi
 
-echo "Uninstalling Shorewall Lite $VERSION"
+echo "Uninstalling Shorewall6 Lite $VERSION"
 
 [ -n "$SANDBOX" ] && configure=0
 
@@ -164,7 +164,15 @@ if [ $configure -eq 1 ]; then
 fi
 
 if [ -f ${SHAREDIR}/shorewall6-lite/init ]; then
-    FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall6-lite/init)
+    if [ $HOST = openwrt ]; then
+	if [ $configure -eq 1 ] && /etc/init.d/shorewall6-lite enabled; then
+	    /etc/init.d/shorewall6-lite disable
+	fi
+	
+	FIREWALL=$(readlink ${SHAREDIR}/shorewall6-lite/init)
+    else
+	FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall6-lite/init)
+    fi
 elif [ -n "$INITFILE" ]; then
     FIREWALL=${INITDIR}/${INITFILE}
 fi
@@ -196,6 +204,7 @@ rm -rf ${VARDIR}/shorewall6-lite
 rm -rf ${SHAREDIR}/shorewall6-lite
 rm -rf ${LIBEXECDIR}/shorewall6-lite
 rm -f  ${CONFDIR}/logrotate.d/shorewall6-lite
+rm -f  ${SYSCONFDIR}/shorewall6-lite
 [ -n "$SYSTEMD" ] && rm -f  ${SYSTEMD}/shorewall6-lite.service
 
 rm -f ${MANDIR}/man5/shorewall6-lite*

Shorewall6/configfiles/accounting

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - Accounting File
+# Shorewall6 -- /etc/shorewall6/accounting
 #
 # For information about entries in this file, type "man shorewall6-accounting"
 #

Shorewall6/configfiles/actions

@@ -1,7 +1,5 @@
 #
-# Shorewall6 - Actions File
-#
-# /etc/shorewall6/actions
+# Shorewall6 -- /etc/shorewall6/actions
 #
 # For information about entries in this file, type "man shorewall6-actions"
 #

Shorewall6/configfiles/blrules

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - Blacklist File
+# Shorewall6 -- /etc/shorewall6/blrules
 #
 # For information about entries in this file, type "man shorewall6-blrules"
 #

Shorewall6/configfiles/clear

@@ -1,7 +1,5 @@
 #
-# Shorewall6 - clear File
-#
-# /etc/shorewall6/clear
+# Shorewall6 -- /etc/shorewall6/clear
 #
 # Add commands below that you want to be executed after Shorewall6 has
 # processed the 'clear' command.

Shorewall6/configfiles/conntrack

@@ -1,53 +1,54 @@
 #
-# Shorewall - conntrack File
+# Shorewall6 -- /etc/shorewall6/conntrack
 #
-# For information about entries in this file, type "man shorewal6-conntrack"
+# For information about entries in this file, type "man shorewall6-conntrack"
 #
 ##############################################################################################################
-?FORMAT 2
+?FORMAT 3
+##############################################################################################################
 #ACTION			SOURCE		DESTINATION	PROTO	DEST		SOURCE	USER/		SWITCH
 #								PORT(S)		PORT(S)	GROUP
-?if __CT_TARGET
+?if $AUTOHELPERS && __CT_TARGET
 
 ?if __AMANDA_HELPER
-CT:helper:amanda	all		-		udp	10080
+CT:helper:amanda:PO	-		-		udp	10080
 ?endif
 
 ?if __FTP_HELPER
-CT:helper:ftp		all		-		tcp	21
+CT:helper:ftp:PO	-		-		tcp	21
 ?endif
 
 ?if __H323_HELPER
-CT:helper:RAS		all		-		udp	1719
-CT:helper:Q.931		all		-		tcp	1720
+CT:helper:RAS:PO	-		-		udp	1719
+CT:helper:Q.931:PO	-		-		tcp	1720
 ?endif
 
 ?if __IRC_HELPER
-CT:helper:irc		all		-		tcp	6667
+CT:helper:irc:PO	-		-		tcp	6667
 ?endif
 
 ?if __NETBIOS_NS_HELPER
-CT:helper:netbios-ns	all		-		udp	137
+CT:helper:netbios-ns:PO	-		-		udp	137
 ?endif
 
 ?if __PPTP_HELPER
-CT:helper:pptp		all		-		tcp	1723
+CT:helper:pptp:PO	-		-		tcp	1723
 ?endif
 
 ?if __SANE_HELPER
-CT:helper:sane		all		-		tcp	6566
+CT:helper:sane:PO	-		-		tcp	6566
 ?endif
 
 ?if __SIP_HELPER
-CT:helper:sip		all		-		udp	5060
+CT:helper:sip:PO	-		-		udp	5060
 ?endif
 
 ?if __SNMP_HELPER
-CT:helper:snmp		all		-		udp	161
+CT:helper:snmp:PO	-		-		udp	161
 ?endif
 
 ?if __TFTP_HELPER
-CT:helper:tftp		all		-		udp	69
+CT:helper:tftp:PO	-		-		udp	69
 ?endif
 
 ?endif

Shorewall6/configfiles/findgw

@@ -1,7 +1,5 @@
 #
-# Shorewall - Findgw File
-#
-# /etc/shorewall6/findgw
+# Shorewall6 -- /etc/shorewall6/findgw
 #
 # The code in this file is executed when Shorewall is trying to detect the
 # gateway through an interface in /etc/shorewall6/providers that has GATEWAY

Shorewall6/configfiles/hosts

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - Hosts file
+# Shorewall6 -- /etc/shorewall6/hosts
 #
 # For information about entries in this file, type "man shorewall6-hosts"
 #

Shorewall6/configfiles/init

@@ -1,10 +1,8 @@
 #
-# Shorewall6 - Init File
+# Shorewall6 -- /etc/shorewall6/init
 #
-# /etc/shorewall6/init
-#
-#	Add commands below that you want to be executed at the beginning of
-#	a "shorewall6 start" or "shorewall6 restart" command.
+# Add commands below that you want to be executed at the beginning of
+# a "shorewall6 start" or "shorewall6 restart" command.
 #
 # For additional information, see
 # http://shorewall.net/shorewall_extension_scripts.htm

Shorewall6/configfiles/interfaces

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - Interfaces File
+# Shorewall6 -- /etc/shorewall6/interfaces
 #
 # For information about entries in this file, type "man shorewall6-interfaces"
 #

Shorewall6/configfiles/isusable

@@ -1,15 +1,13 @@
 #
-# Shorewall6 - isusable File
+# Shorewall6 -- /etc/shorewall6/isusable
 #
-# /etc/shorewall6/isusable
+# This script is called when Shorewall6 is attempting to determine
+# if an interface named in /etc/shorewall6/providers is usable.
 #
-#	This script is called when Shorewall6 is attempting to determine
-#	if an interface named in /etc/shorewall6/providers is usable.
-#
-#	The script is invoked inside a function that accepts an interface
-#	name as a single argument. The file below is designed to work with
-#	both swping and lsm as described at
-#	http://www.shorewall.net/MultiISP.html
+# The script is invoked inside a function that accepts an interface
+# name as a single argument. The file below is designed to work with
+# both swping and lsm as described at
+# http://www.shorewall.net/MultiISP.html
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.

Shorewall6/configfiles/lib.private

@@ -1,7 +1,5 @@
 #
-# Shorewall6 - lib.private File
-#
-# /etc/shorewall6/lib.private
+# Shorewall6 -- /etc/shorewall6/lib.private
 #
 # Use this file to declare shell functions to be called in the other
 # run-time extension scripts. The file will be copied into the generated

Shorewall6/configfiles/maclist

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - Maclist file
+# Shorewall6 -- /etc/shorewall6/maclist
 #
 # For information about entries in this file, type "man shorewall6-maclist"
 #

Shorewall6/configfiles/mangle

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - Mangle File
+# Shorewall6 -- /etc/shorewall6/mangle
 #
 # For information about entries in this file, type "man shorewall6-mangle"
 #
@@ -9,6 +9,7 @@
 #
 # See http://shorewall.net/PacketMarking.html for a detailed description of
 # the Netfilter/Shorewall packet marking mechanism.
+#
 ############################################################################################################################################################
 #ACTION		SOURCE		DEST		PROTO	DEST	SOURCE	USER	TEST	LENGTH	TOS	CONNBYTES	HELPER	HEADERS	PROBABILITY	DSCP
 #							PORT(S)	PORT(S)

Shorewall6/configfiles/masq

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - MASQUERADE/SNAT file
+# Shorewall6 -- /etc/shorewall6/masq
 #
 # For information about entries in this file, type "man shorewall6-masq"
 #

Shorewall6/configfiles/nat

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - Nat File
+# Shorewall6 -- /etc/shorewall6/nat
 #
 # For information about entries in this file, type "man shorewall6-nat"
 #

Shorewall6/configfiles/netmap

@@ -1,5 +1,5 @@
 #
-# Shorewall6	 - Netmap File
+# Shorewall6 -- /etc/shorewall6/netmap
 #
 # For information about entries in this file, type "man shorewall-netmap"
 #

Shorewall6/configfiles/params

@@ -1,26 +1,24 @@
 #
-# Shorewall6 - Params File
+# Shorewall6 -- /etc/shorewall6/params
 #
-# /etc/shorewall6/params
+# Assign any variables that you need here.
 #
-#	Assign any variables that you need here.
+# It is suggested that variable names begin with an upper case letter
+# to distinguish them from variables used internally within the
+# Shorewall6 programs
 #
-#	It is suggested that variable names begin with an upper case letter
-#	to distinguish them from variables used internally within the
-#	Shorewall6 programs
+# Example:
 #
-#	Example:
+#	NET_IF=eth0
+#	NET_OPTIONS=dhcp,nosmurfs
 #
-#		NET_IF=eth0
-#		NET_OPTIONS=dhcp,nosmurfs
+# Example (/etc/shorewall6/interfaces record):
 #
-#	Example (/etc/shorewall6/interfaces record):
+#	net	$NET_IF		-	$NET_OPTIONS
 #
-#		net	$NET_IF		-	$NET_OPTIONS
+# The result will be the same as if the record had been written
 #
-#	The result will be the same as if the record had been written
-#
-#		net	eth0		-	dhcp,nosmurfs
+#	net	eth0		-	dhcp,nosmurfs
 #
 ###############################################################################
 

Shorewall6/configfiles/policy

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - Policy File
+# Shorewall6 -- /etc/shorewall6/policy
 #
 # For information about entries in this file, type "man shorewall6-policy"
 #

Shorewall6/configfiles/providers

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - Providers File
+# Shorewall6 -- /etc/shorewall6/providers
 #
 # For information about entries in this file, type "man shorewall6-providers"
 #

Shorewall6/configfiles/proxyndp

@@ -1,5 +1,5 @@
 #
-# Shorewall - Proxyndp File
+# Shorewall6 -- /etc/shorewall6/proxyndp
 #
 # For information about entries in this file, type "man shorewall6-proxyndp"
 #

Shorewall6/configfiles/refresh

@@ -1,7 +1,5 @@
 #
-# Shorewall6 - refresh File
-#
-# /etc/shorewall6/refresh
+# Shorewall6 -- /etc/shorewall6/refresh
 #
 # Add commands below that you want to be executed before Shorewall6 has
 # processed the 'refresh' command.

Shorewall6/configfiles/refreshed

@@ -1,7 +1,5 @@
 #
-# Shorewall6 - refreshed File
-#
-# /etc/shorewall6/refreshed
+# Shorewall6 -- /etc/shorewall6/refreshed
 #
 # Add commands below that you want to be executed after Shorewall6 has
 # processed the 'refresh' command.

Shorewall6/configfiles/restored

@@ -1,10 +1,8 @@
 #
-# Shorewall6 - Restored File
+# Shorewall6 -- /etc/shorewall6/restored
 #
-# /etc/shorewall6/restored
-#
-#	Add commands below that you want to be executed after shorewall6 has
-#	completed a 'restore' command.
+# Add commands below that you want to be executed after shorewall6 has
+# completed a 'restore' command.
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.

Shorewall6/configfiles/routes

@@ -1,9 +1,9 @@
 #
-# Shorewall6 - routes File
+# Shorewall6 -- /etc/shorewall6/routes
 #
 # For information about entries in this file, type "man shorewall6-routes"
 #
 # For additional information, see http://www.shorewall.net/MultiISP.html
+#
 ###############################################################################
 #PROVIDER		DEST			GATEWAY		DEVICE	OPTIONS
-

Shorewall6/configfiles/routestopped

@@ -1,15 +0,0 @@
-#
-# Shorewall6 - Routestopped File
-#
-# This file is deprecated in favor of the stoppedrules file.
-#
-# For information about entries in this file, type "man shorewall6-routestopped"
-#
-# The manpage is also online at
-# http://www.shorewall.net/manpages/shorewall6-routestopped.html
-#
-# See http://shorewall.net/starting_and_stopping_shorewall.htm for additional
-# information.
-#
-###############################################################################
-#INTERFACE	HOST(S)			OPTIONS

Shorewall6/configfiles/rtrules

@@ -1,8 +1,9 @@
 #
-# Shorewall6 - route rules File
+# Shorewall6 -- /etc/shorewall6/rtrules
 #
 # For information about entries in this file, type "man shorewall6-rtrules"
 #
 # For additional information, see http://www.shorewall.net/MultiISP.html
+#
 ####################################################################################
 #SOURCE			DEST			PROVIDER	PRIORITY	MASK

Shorewall6/configfiles/rules

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - Rules File
+# Shorewall6 -- /etc/shorewall6/rules
 #
 # For information on the settings in this file, type "man shorewall6-rules"
 #

Shorewall6/configfiles/scfilter

@@ -1,7 +1,5 @@
 #
-# Shorewall - Show Connections Filter
-#
-# /etc/shorewall/scfilter
+# Shorewall6 -- /etc/shorewall6/scfilter
 #
 # Replace the 'cat' command below to filter the output of
 # 'show connections'.

Shorewall6/configfiles/secmarks

@@ -1,5 +1,5 @@
 #
-# Shorewall6 - Secmarks File
+# Shorewall6 -- /etc/shorewall6/secmarks
 #
 # For information about entries in this file, type "man shorewall-secmarks"
 #

Shorewall6/configfiles/start

@@ -1,10 +1,8 @@
 #
-# Shorewall6 - Start File
+# Shorewall6 -- /etc/shorewall6/start
 #
-# /etc/shorewall6/start
-#
-#	Add commands below that you want to be executed after shorewall6 has
-#	been started or restarted.
+# Add commands below that you want to be executed after shorewall6 has
+# been started or restarted.
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.

Shorewall6/configfiles/started

@@ -1,17 +1,15 @@
 #
-# Shorewall6 - Started File
+# Shorewall6 -- /etc/shorewall6/started
 #
-# /etc/shorewall6/started
+# Add commands below that you want to be executed after shorewall6 has
+# been completely started or restarted. The difference between this
+# extension script and /etc/shorewall6/start is that this one is invoked
+# after the 'shorewall' chain has been created (thus signaling that the
+# firewall is completely up).
 #
-#	Add commands below that you want to be executed after shorewall6 has
-#	been completely started or restarted. The difference between this
-#	extension script and /etc/shorewall6/start is that this one is invoked
-#	after the 'shorewall' chain has been created (thus signaling that the
-#	firewall is completely up).
-#
-#	This script should not change the firewall configuration directly but
-#	may do so indirectly by running /sbin/shorewall6 with the 'nolock'
-#	option.
+# This script should not change the firewall configuration directly but
+# may do so indirectly by running /sbin/shorewall6 with the 'nolock'
+# option.
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.

Shorewall6/configfiles/stop

@@ -1,10 +1,8 @@
 #
-# Shorewall6 - Stop File
+# Shorewall6 -- /etc/shorewall6/stop
 #
-# /etc/shorewall6/stop
-#
-#	Add commands below that you want to be executed at the beginning of a
-#	"shorewall6 stop" command.
+# Add commands below that you want to be executed at the beginning of a
+# "shorewall6 stop" command.
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.

Shorewall6/configfiles/stopped

@@ -1,10 +1,8 @@
 #
-# Shorewall6 - Stopped File
+# Shorewall6 -- /etc/shorewall6/stopped
 #
-# /etc/shorewall6/stopped
-#
-#	Add commands below that you want to be executed at the completion of a
-#	"shorewal6l stop" command.
+# Add commands below that you want to be executed at the completion of a
+# "shorewall6 stop" command.
 #
 # See http://shorewall.net/shorewall_extension_scripts.htm for additional
 # information.