Support the DROP command in the mangle file

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/configure

@@ -169,13 +169,16 @@ else
     elif [ $vendor = default ]; then
 	params[HOST]=linux
 	vendor=linux
+    elif [[ $vendor == debian.* ]]; then
+	params[HOST]=debian
+	vendor=debian
     fi
 fi
 
 if [ $vendor = linux ]; then
     echo "INFO: Creating a generic Linux installation - " `date`;
 else
-    echo "INFO: Creating a $params[HOST]-specific installation - " `date`;
+    echo "INFO: Creating a ${params[HOST]}-specific installation - " `date`;
 fi
 
 echo

Shorewall-core/configure.pl

@@ -52,6 +52,9 @@ for ( @ARGV ) {
     $params{$pn} = $pv;
 }
 
+use File::Basename;
+chdir dirname($0);
+
 my $vendor = $params{HOST};
 my $rcfile;
 my $rcfilename;
@@ -83,8 +86,8 @@ unless ( defined $vendor ) {
 if ( defined $vendor ) {
     if ( $vendor eq 'debian' && -f '/etc/debian_version' ) {
 	if ( -l '/sbin/init' ) {
-	    if ( readlink '/sbin/init' =~ /systemd/ ) {
+	    if ( readlink('/sbin/init') =~ /systemd/ ) {
-		$rcfilename = 'debian.systemd';
+		$rcfilename = 'shorewallrc.debian.systemd';
 	    } else {
 		$rcfilename = 'shorewallrc.debian.sysvinit';
 	    }
@@ -99,13 +102,15 @@ if ( defined $vendor ) {
 	die qq("ERROR: $vendor" is not a recognized host type);
     } elsif ( $vendor eq 'default' ) {
 	$params{HOST} = $vendor = 'linux';
+    } elsif ( $vendor =~ /^debian\./ ) {
+	$params{HOST} = $vendor = 'debian';
     }
 } else {
     if ( -f '/etc/debian_version' ) {
 	$vendor = 'debian';
 	if ( -l '/sbin/init' ) {
-	    if ( readlink '/sbin/init' =~ /systemd/ ) {
+	    if ( readlink( '/sbin/init' ) =~ /systemd/ ) {
-		$rcfilename = 'debian.systemd';
+		$rcfilename = 'shorewallrc.debian.systemd';
 	    } else {
 		$rcfilename = 'shorewallrc.debian.sysvinit';
 	    }
@@ -168,7 +173,8 @@ my $outfile;
 
 open $outfile, '>', 'shorewallrc' or die "Can't open 'shorewallrc' for output: $!";
 
-printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s %2d %04d %02d:%02d:%02d\n#\n", VERSION, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];
+printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s %2d %04d %02d:%02d:%02d\n", VERSION, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];
+print $outfile "# rc file: $rcfilename\n#\n";
 
 print  $outfile "# Input: @ARGV\n#\n" if @ARGV;
 

Shorewall-init/install.sh

@@ -397,6 +397,7 @@ if [ $HOST = debian ]; then
 
 	[ $configure -eq 1 ] || mkdir -p ${DESTDIR}${CONFDIR}/default
 	install_file sysconfig ${DESTDIR}${ETC}/default/shorewall-init 0644
+	echo "sysconfig file installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}"
     fi
 
     IFUPDOWN=ifupdown.debian.sh
@@ -492,7 +493,7 @@ if [ -z "$DESTDIR" ]; then
 	if [ $HOST = debian ]; then
 	    if [ -n "$SERVICEDIR" ]; then
 		if systemctl enable ${PRODUCT}.service; then
-		    echo "Shorewall INit will start automatically at boot"
+                    echo "Shorewall Init will start automatically at boot"
 		fi
 	    elif mywhich insserv; then
 		if insserv ${INITDIR}/shorewall-init; then
@@ -558,7 +559,7 @@ fi
 
 [ -z "${DESTDIR}" ] && [ ! -f ~/.shorewallrc ] && cp ${SHAREDIR}/shorewall/shorewallrc .
 
-if [ -f ${DESTDIR}/etc/ppp ]; then
+if [ -d ${DESTDIR}/etc/ppp ]; then
     case $HOST in
 	debian|suse)
 	    for directory in ip-up.d ip-down.d ipv6-up.d ipv6-down.d; do

Shorewall-init/uninstall.sh

@@ -174,9 +174,13 @@ if [ -f "$INITSCRIPT" ]; then
     remove_file $INITSCRIPT
 fi
 
-if [ -n "$SYSTEMD" ]; then
+if [ -z "${SERVICEDIR}" ]; then
+    SERVICEDIR="$SYSTEMD"
+fi
+
+if [ -n "$SERVICEDIR" ]; then
     [ $configure -eq 1 ] && systemctl disable shorewall-init.service
-    rm -f $SYSTEMD/shorewall-init.service
+    rm -f $SERVICEDIR/shorewall-init.service
 fi
 
 [ "$(readlink -m -q ${SBINDIR}/ifup-local)"   = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifup-local
@@ -202,8 +206,10 @@ if [ -d ${CONFDIR}/ppp ]; then
     done
 
     for file in if-up.local if-down.local; do
-	if grep -qF Shorewall-based ${CONFDIR}/ppp/$FILE; then
+	if [ -f ${CONFDIR}/ppp/$file ]; then
-	    remove_file ${CONFDIR}/ppp/$FILE
+	    if grep -qF Shorewall-based ${CONFDIR}/ppp/$FILE; then
+		remove_file ${CONFDIR}/ppp/$FILE
+	    fi
 	fi
     done
 fi

Shorewall-lite/uninstall.sh

@@ -153,7 +153,7 @@ if [ -f ${SHAREDIR}/shorewall-lite/version ]; then
 	VERSION="$INSTALLED_VERSION"
     fi
 else
-    echo "WARNING: Shorewal Lite Version $VERSION is not installed"
+    echo "WARNING: Shorewall Lite Version $VERSION is not installed"
     VERSION=""
 fi
 

Shorewall/Perl/Shorewall/Chains.pm

@@ -6242,7 +6242,7 @@ sub log_rule_limit( $$$$$$$$ ) {
 		if ( $tag =~ /^,/ ) {
 		    ( $disposition = $tag ) =~ s/,//;
 		} elsif ( $tag =~ /,/ ) {
-		    ( $chain, $disposition ) = split ',', $tag;
+		    ( $chain, $disposition ) = split ',', $tag, 2;
 		} else { 
 		    $chain = $tag;
 		}
@@ -6336,7 +6336,7 @@ sub log_irule_limit( $$$$$$$@ ) {
 		if ( $tag =~ /^,/ ) {
 		    ( $disposition = $tag ) =~ s/,//;
 		} elsif ( $tag =~ /,/ ) {
-		    ( $chain, $disposition ) = split ',', $tag;
+		    ( $chain, $disposition ) = split ',', $tag, 2;
 		} else { 
 		    $chain = $tag;
 		}
@@ -7031,7 +7031,7 @@ sub isolate_source_interface( $ ) {
 	    $inets  = $2;
 	} elsif ( $source =~ /^(.+?):\[(.+)\]\s*$/ ||
 		  $source =~ /^(.+?):(!?\+.+)$/    ||
-		  $source =~ /^(.+?):(!?[&%].+)$/  ||
+		  $source =~ /^(.+?):(!?[&%~].+)$/ ||
 		  $source =~ /^(.+?):(\[.+\]\/(?:\d+))\s*$/
 		) {
 	    $iiface = $1;

Shorewall/Perl/Shorewall/Config.pm

@@ -2245,7 +2245,7 @@ sub split_line2( $$;$$$ ) {
 
 	for ( @pairs ) {
 	    fatal_error "Invalid column/value pair ($_)" unless /^(\w+)(?:=>?|:)(.+)$/;
-	    my ( $column, $value ) = ( lc $1, $2 );
+	    my ( $column, $value ) = ( lc( $1 ), $2 );
 	    fatal_error "Unknown column ($1)" unless exists $columnsref->{$column};
 	    $column = $columnsref->{$column};
 	    fatal_error "Non-ASCII gunk in file" if $columns =~ /[^\s[:print:]]/;

Shorewall/Perl/Shorewall/Rules.pm

@@ -2477,13 +2477,21 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 	    $actiontype |= HELPER;
 	} elsif ( $actiontype & SET ) {
 	    my %xlate = ( ADD => 'add-set' , DEL => 'del-set' );
+	    my ( $setname, $flags, $timeout, $rest ) = split ':', $param, 4;
 
-	    my ( $setname, $flags, $rest ) = split ':', $param, 3;
 	    fatal_error "Invalid ADD/DEL parameter ($param)" if $rest;
 	    $setname =~ s/^\+//;
 	    fatal_error "Expected ipset name ($setname)" unless $setname =~ /^(6_)?[a-zA-Z][-\w]*$/;
-	    fatal_error "Invalid flags ($flags)" unless defined $flags && $flags =~ /^(dst|src)(,(dst|src)){0,5}$/;
+	    fatal_error "Invalid flags ($flags)"         unless defined $flags && $flags =~ /^(dst|src)(,(dst|src)){0,5}$/;
+
 	    $action = join( ' ', 'SET --' . $xlate{$basictarget} , $setname , $flags );
+
+	    if ( supplied $timeout ) {
+		fatal_error "A timeout may only be supplied in an ADD rule" unless $basictarget eq 'ADD';
+		fatal_error "Invalid Timeout ($timeout)"                    unless $timeout && $timeout =~ /^\d+$/;
+
+		$action .= " --timeout $timeout";
+	    }
 	}
     }
     #

Shorewall/Perl/Shorewall/Tc.pm

@@ -452,6 +452,16 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$ ) {
 	    },
 	},
 
+	DROP       => {
+	    defaultchain   => 0,
+	    allowedchains  => PREROUTING | FORWARD | OUTPUT | POSTROUTING,
+	    minparams      => 0,
+	    maxparams      => 0,
+	    function       => sub() {
+		$target = 'DROP';
+	    }
+	},
+
 	DSCP       => {
 	    defaultchain   => 0,
 	    allowedchains  => PREROUTING | FORWARD | OUTPUT | POSTROUTING,

Shorewall/configfiles/masq

@@ -6,5 +6,5 @@
 # The manpage is also online at
 # http://www.shorewall.net/manpages/shorewall-masq.html
 #
-######################################################################################################
+###################################################################################################################################
-#INTERFACE		SOURCE		ADDRESS		PROTO	PORT	IPSEC	MARK	USER	SWITCH
+#INTERFACE		SOURCE		ADDRESS		PROTO	PORT	IPSEC	MARK	USER	SWITCH	ORIGDEST	PROBABILITY

Shorewall/manpages/shorewall-rules.xml

@@ -241,7 +241,7 @@
 
             <varlistentry>
               <term><emphasis
-              role="bold">ADD(<replaceable>ipset</replaceable>:<replaceable>flags</replaceable>)</emphasis></term>
+              role="bold">ADD(<replaceable>ipset</replaceable>:<replaceable>flags</replaceable>[:<replaceable>timeout</replaceable>])</emphasis></term>
 
               <listitem>
                 <para>Added in Shorewall 4.4.12. Causes addresses and/or port
@@ -256,6 +256,12 @@
                 role="bold">dst</emphasis> respectively (see the -A command in
                 ipset (8)).</para>
 
+                <para>Beginning with Shorewall 5.0.3, an optional
+                <replaceable>timeout</replaceable> can be specified. This is
+                the number of seconds that the new entry in the ipset is to
+                remain valid and overrides any timeout specified when the
+                ipset was created.</para>
+
                 <para>ADD is non-terminating. Even if a packet matches the
                 rule, it is passed on to the next rule.</para>
               </listitem>

Shorewall/uninstall.sh

@@ -168,8 +168,8 @@ fi
 
 rm -f ${SBINDIR}/shorewall
 
-if [ -L ${SHAREDIR}/shorewall6/init ]; then
+if [ -L ${SHAREDIR}/shorewall/init ]; then
-    FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall6/init)
+    FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall/init)
 elif [ -n "$INITFILE" ]; then
     FIREWALL=${INITDIR}/${INITFILE}
 fi
@@ -188,17 +188,19 @@ if [ -f "$FIREWALL" ]; then
     remove_file $FIREWALL
 fi
 
-if [ -n "$SYSTEMD" ]; then
+if [ -z "${SERVICEDIR}" ]; then
+    SERVICEDIR="$SYSTEMD"
+fi
+if [ -n "$SERVICEDIR" ]; then
     [ $configure -eq 1 ] && systemctl disable ${PRODUCT}
-    rm -f $SYSTEMD/shorewall.service
+    rm -f $SERVICEDIR/shorewall.service
 fi
 
 rm -rf ${SHAREDIR}/shorewall/version
 rm -rf ${CONFDIR}/shorewall
 
 if [ -n "$SYSCONFDIR" ]; then
-    [ -n "$SYSCONFFILE" ] || SYSCONFFILE=${PRODUCT};
+    [ -n "$SYSCONFFILE" ] && rm -f ${SYSCONFDIR}/${PRODUCT}
-    rm -f ${SYSCONFDIR}/${SYSCONFFILE}
 fi
 
 rm -rf ${VARDIR}/shorewall

Shorewall6/manpages/shorewall6-rules.xml

@@ -229,6 +229,12 @@
                 role="bold">dst</emphasis> respectively (see the -A command in
                 ipset (8)).</para>
 
+                <para>Beginning with Shorewall 5.0.3, an optional
+                <replaceable>timeout</replaceable> can be specified. This is
+                the number of seconds that the new entry in the ipset is to
+                remain valid and overrides any timeout specified when the
+                ipset was created.</para>
+
                 <para>ADD is non-terminating. Even if a packet matches the
                 rule, it is passed on to the next rule.</para>
               </listitem>

Shorewall6/uninstall.sh

@@ -184,9 +184,18 @@ if [ -f "$FIREWALL" ]; then
     remove_file $FIREWALL
 fi
 
-if [ -n "$SYSTEMD" ]; then
+[ -n "$SERVICEDIR" ] || SERVICEDIR=${SYSTEMD}
+
+if [ -n "$SERVICEDIR" ]; then
     [ $configure -eq 1 ] && systemctl disable ${PRODUCT}
-    rm -f $SYSTEMD/shorewall6.service
+    rm -f $SERVICEDIR/shorewall6.service
+fi
+
+rm -rf ${SHAREDIR}/shorewall6/version
+rm -rf ${CONFDIR}/shorewall6
+
+if [ -n "$SYSCONFDIR" ]; then
+    [ -n "$SYSCONFFILE" ] && rm -f ${SYSCONFDIR}/${PRODUCT}
 fi
 
 rm -f ${SBINDIR}/shorewall6

docs/configuration_file_basics.xml

@@ -553,8 +553,10 @@ ACCEPT      net:\
       </listitem>
     </itemizedlist>
 
-    <para>The following table shows the column names for each of the
+    <para>In Shorewall 5.0.3, the sample configuration files and the man pages
-    table-oriented configuration files.</para>
+    were updated to use the same column names in both the column headings and
+    in the alternate specification format. The following table shows the
+    column names for each of the table-oriented configuration files.</para>
 
     <note>
       <para>Column names are <emphasis