Don't generate multihop routes unnecessarily

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/install.sh

@@ -22,64 +22,20 @@
 #	along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
 
-VERSION=xxx #The Build script inserts the actual version
-
+VERSION=xxx # The Build script inserts the actual version
 PRODUCT=shorewall-core
 Product="Shorewall Core"
- 
+
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <configuration-file> ] "
-    echo "       $ME -v"
-    echo "       $ME -h"
+    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
+    echo "where <option> is one of"
+    echo "  -h"
+    echo "  -v"
     exit $1
 }
 
-fatal_error()
-{
-    echo "   ERROR: $@" >&2
-    exit 1
-}
-
-split() {
-    local ifs
-    ifs=$IFS
-    IFS=:
-    set -- $1
-    echo $*
-    IFS=$ifs
-}
-
-qt()
-{
-    "$@" >/dev/null 2>&1
-}
-
-mywhich() {
-    local dir
-
-    for dir in $(split $PATH); do
-	if [ -x $dir/$1 ]; then
-	    echo $dir/$1
-	    return 0
-	fi
-    done
-
-    return 2
-}
-
-cant_autostart()
-{
-    echo
-    echo  "WARNING: Unable to configure shorewall to start automatically at boot" >&2
-}
-
-delete_file() # $1 = file to delete
-{
-    rm -f $1
-}
-
 install_file() # $1 = source $2 = target $3 = mode
 {
     if cp -f $1 $2; then
@@ -98,16 +54,16 @@ install_file() # $1 = source $2 = target $3 = mode
     exit 1
 }
 
-require()
-{
-    eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
-}
-
 #
 # Change to the directory containing this script
 #
 cd "$(dirname $0)"
 
+#
+# Source common functions
+#
+. ./lib.installer || { echo "ERROR: Can not load common functions." >&2; exit 1; }
+
 #
 # Parse the run line
 #
@@ -126,7 +82,7 @@ while [ $finished -eq 0 ]; do
 			usage 0
 			;;
 		    v)
-			echo "Shorewall Firewall Installer Version $VERSION"
+			echo "$Product Firewall Installer Version $VERSION"
 			exit 0
 			;;
 		    *)
@@ -148,14 +104,14 @@ done
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-	. ./shorewallrc
 	file=./shorewallrc
+        . $file || fatal_error "Can not load the RC file: $file"
     elif [ -f ~/.shorewallrc ]; then
-	. ~/.shorewallrc || exit 1
 	file=~/.shorewallrc
+        . $file || fatal_error "Can not load the RC file: $file"
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-	. /usr/share/shorewall/shorewallrc
 	file=/usr/share/shorewall/shorewallrc
+        . $file || fatal_error "Can not load the RC file: $file"
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -169,7 +125,7 @@ elif [ $# -eq 1 ]; then
 	    ;;
     esac
 
-    . $file
+    . $file || fatal_error "Can not load the RC file: $file"
 else
     usage 1
 fi
@@ -285,13 +241,12 @@ case "$HOST" in
     debian|gentoo|redhat|slackware|archlinux|linux|suse|openwrt)
 	;;
     *)
-	echo "ERROR: Unknown HOST \"$HOST\"" >&2
-	exit 1;
+	fatal_error "Unknown HOST \"$HOST\""
 	;;
 esac
 
 if [ -z "$file" ]; then
-    if $HOST = linux; then
+    if [ $HOST = linux ]; then
 	file=shorewallrc.default
     else
 	file=shorewallrc.${HOST}
@@ -304,7 +259,8 @@ if [ -z "$file" ]; then
     echo "" >&2
     echo "Example:" >&2
     echo "" >&2
-    echo "   ./install.sh $file" &>2
+    echo "   ./install.sh $file" >&2
+    exit 1
 fi
 
 if [ -n "$DESTDIR" ]; then
@@ -315,45 +271,31 @@ if [ -n "$DESTDIR" ]; then
     fi
 fi
 
-echo "Installing Shorewall Core Version $VERSION"
+echo "Installing $Product Version $VERSION"
 
 #
 # Create directories
 #
-mkdir -p ${DESTDIR}${LIBEXECDIR}/shorewall
-chmod 755 ${DESTDIR}${LIBEXECDIR}/shorewall
+make_parent_directory ${DESTDIR}${LIBEXECDIR}/shorewall 0755
 
-mkdir -p ${DESTDIR}${SHAREDIR}/shorewall
-chmod 755 ${DESTDIR}${SHAREDIR}/shorewall
+make_parent_directory ${DESTDIR}${SHAREDIR}/shorewall 0755
 
-mkdir -p ${DESTDIR}${CONFDIR}
-chmod 755 ${DESTDIR}${CONFDIR}
+make_parent_directory ${DESTDIR}${CONFDIR} 0755
 
-if [ -n "${SYSCONFDIR}" ]; then
-    mkdir -p ${DESTDIR}${SYSCONFDIR}
-    chmod 755 ${DESTDIR}${SYSCONFDIR}
-fi
+[ -n "${SYSCONFDIR}" ] && make_parent_directory ${DESTDIR}${SYSCONFDIR} 0755
 
 if [ -z "${SERVICEDIR}" ]; then
     SERVICEDIR="$SYSTEMD"
 fi
 
-if [ -n "${SERVICEDIR}" ]; then
-    mkdir -p ${DESTDIR}${SERVICEDIR}
-    chmod 755 ${DESTDIR}${SERVICEDIR}
-fi
+[ -n "${SERVICEDIR}" ] && make_parent_directory ${DESTDIR}${SERVICEDIR} 0755
 
-mkdir -p ${DESTDIR}${SBINDIR}
-chmod 755 ${DESTDIR}${SBINDIR}
+make_parent_directory ${DESTDIR}${SBINDIR} 0755
 
-if [ -n "${MANDIR}" ]; then
-    mkdir -p ${DESTDIR}${MANDIR}
-    chmod 755 ${DESTDIR}${MANDIR}
-fi
+[ -n "${MANDIR}" ] && make_parent_directory ${DESTDIR}${MANDIR} 0755
 
 if [ -n "${INITFILE}" ]; then
-    mkdir -p ${DESTDIR}${INITDIR}
-    chmod 755 ${DESTDIR}${INITDIR}
+    make_parent_directory ${DESTDIR}${INITDIR} 0755
 
     if [ -n "$AUXINITSOURCE" -a -f "$AUXINITSOURCE" ]; then
 	install_file $AUXINITSOURCE ${DESTDIR}${INITDIR}/$AUXINITFILE 0544
@@ -382,8 +324,14 @@ echo "wait4ifup installed in ${DESTDIR}${LIBEXECDIR}/shorewall/wait4ifup"
 # Install the libraries
 #
 for f in lib.* ; do
-    install_file $f ${DESTDIR}${SHAREDIR}/shorewall/$f 0644
-    echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/shorewall/$f"
+    case $f in
+        *installer)
+            ;;
+        *)
+            install_file $f ${DESTDIR}${SHAREDIR}/shorewall/$f 0644
+            echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/shorewall/$f"
+            ;;
+    esac
 done
 
 if [ $SHAREDIR != /usr/share ]; then
@@ -398,11 +346,11 @@ fi
 if [ -n "$MANDIR" ]; then
     cd manpages
 
-    [ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man8/
+    [ -n "$INSTALLD" ] || make_parent_directory ${DESTDIR}${MANDIR}/man8 0755
 
     for f in *.8; do
 	gzip -9c $f > $f.gz
-	install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 644
+	install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 0644
 	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man8/$f.gz"
     done
 
@@ -419,7 +367,7 @@ ln -sf lib.base ${DESTDIR}${SHAREDIR}/shorewall/functions
 # Create the version file
 #
 echo "$VERSION" > ${DESTDIR}${SHAREDIR}/shorewall/coreversion
-chmod 644 ${DESTDIR}${SHAREDIR}/shorewall/coreversion
+chmod 0644 ${DESTDIR}${SHAREDIR}/shorewall/coreversion
 
 if [ -z "${DESTDIR}" ]; then
     if [ $update -ne 0 ]; then
@@ -444,14 +392,20 @@ fi
 
 if [ ${SHAREDIR} != /usr/share ]; then
     for f in lib.*; do
-	if [ $BUILD != apple ]; then
-	    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/$f
-	else
-	    eval sed -i \'\' -e \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/$f
-	fi
+        case $f in
+            *installer)
+                ;;
+            *)
+                if [ $BUILD != apple ]; then
+                    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/$f
+                else
+                    eval sed -i \'\' -e \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/$f
+                fi
+                ;;
+        esac
     done
 fi
 #
-#  Report Success
+# Report Success
 #
-echo "Shorewall Core Version $VERSION Installed"
+echo "$Product Version $VERSION Installed"

Shorewall-core/lib.cli

@@ -4264,12 +4264,17 @@ usage() # $1 = exit status
     echo "   reenable <interface>"
     ecko "   refresh [ -d ] [ -n ] [ -T ] [ -D <directory> ] [ <chain>... ]"
     echo "   reject <address> ..."
-    ecko "   reload [ -s ] [ -c ] [ -r <root user> ] [ -T ] [ -i ] [ <directory> ] <system>"
+
+    if [ -n "$g_lite" ]; then
+	echo "   reload [ -n ] [ -p ] [ -f ] [ -C ] [ <directory> ]"
+    else
+	echo "   reload [ -n ] [ -p ] [-d] [ -f ] [ -c ] [ -T ] [ -i ] [ -C ] [ <directory> ]"
+    fi
 
     if [ -z "$g_lite" ]; then
-	echo "   remote-reload [ -s ] [ -c ] [ -r <root-name> ] [ -T ] [ -i ] [ <directory> ] <system>"
-	echo "   remote-restart [ -s ] [ -c ] [ -r <root-name> ] [ -T ] [ -i ] [ <directory> ] <system>"
-	echo "   remote-start [ -s ] [ -c ] [ -r <root-name> ] [ -T ] [ -i ] [ <directory> ] <system>"
+	echo "   remote-reload [ -n ] [ -s ] [ -c ] [ -r <root-name> ] [ -T ] [ -i ] [ <directory> ] <system>"
+	echo "   remote-restart [ -n ] [ -s ] [ -c ] [ -r <root-name> ] [ -T ] [ -i ] [ <directory> ] <system>"
+	echo "   remote-start [ -n ] [ -s ] [ -c ] [ -r <root-name> ] [ -T ] [ -i ] [ <directory> ] <system>"
     fi
 
     echo "   reset [ <chain> ... ]"

Shorewall-core/lib.installer

@@ -0,0 +1,89 @@
+#
+#
+# Shorewall 5.0 -- /usr/share/shorewall/lib.installer.
+#
+#     (c) 2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2017 - Matt Darfeuille (matdarf@gmail.com)
+#
+#	Complete documentation is available at http://shorewall.net
+#
+#       This program is part of Shorewall.
+#
+#	This program is free software; you can redistribute it and/or modify
+#	it under the terms of the GNU General Public License as published by the
+#       Free Software Foundation, either version 2 of the license or, at your
+#       option, any later version.
+#
+#	This program is distributed in the hope that it will be useful,
+#	but WITHOUT ANY WARRANTY; without even the implied warranty of
+#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+#	GNU General Public License for more details.
+#
+#	You should have received a copy of the GNU General Public License
+#	along with this program; if not, see <http://www.gnu.org/licenses/>.
+#
+# The purpose of this library is to hold those functions used by the products installer.
+#
+#########################################################################################
+
+fatal_error()
+{
+    echo "   ERROR: $@" >&2
+    exit 1
+}
+
+split() {
+    local ifs
+    ifs=$IFS
+    IFS=:
+    set -- $1
+    echo $*
+    IFS=$ifs
+}
+
+qt()
+{
+    "$@" >/dev/null 2>&1
+}
+
+mywhich() {
+    local dir
+
+    for dir in $(split $PATH); do
+	if [ -x $dir/$1 ]; then
+	    return 0
+	fi
+    done
+
+    return 2
+}
+
+delete_file() # $1 = file to delete
+{
+    rm -f $1
+}
+
+require()
+{
+    eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
+}
+
+make_directory() # $1 = directory , $2 = mode
+{
+    mkdir $1
+    chmod $2 $1
+    [ -n "$OWNERSHIP" ] && chown $OWNERSHIP $1
+}
+
+make_parent_directory() # $1 = directory , $2 = mode
+{
+    mkdir -p $1
+    chmod $2 $1
+    [ -n "$OWNERSHIP" ] && chown $OWNER:$GROUP $1
+}
+
+cant_autostart()
+{
+    echo
+    echo  "WARNING: Unable to configure $Product to start automatically at boot" >&2
+}

Shorewall-core/lib.uninstaller

@@ -0,0 +1,106 @@
+#
+#
+# Shorewall 5.0 -- /usr/share/shorewall/lib.installer.
+#
+#     (c) 2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2017 - Matt Darfeuille (matdarf@gmail.com)
+#
+#	Complete documentation is available at http://shorewall.net
+#
+#       This program is part of Shorewall.
+#
+#	This program is free software; you can redistribute it and/or modify
+#	it under the terms of the GNU General Public License as published by the
+#       Free Software Foundation, either version 2 of the license or, at your
+#       option, any later version.
+#
+#	This program is distributed in the hope that it will be useful,
+#	but WITHOUT ANY WARRANTY; without even the implied warranty of
+#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+#	GNU General Public License for more details.
+#
+#	You should have received a copy of the GNU General Public License
+#	along with this program; if not, see <http://www.gnu.org/licenses/>.
+#
+# The purpose of this library is to hold those functions used by the products uninstaller.
+#
+#########################################################################################
+
+fatal_error()
+{
+    echo "   ERROR: $@" >&2
+    exit 1
+}
+
+split() {
+    local ifs
+    ifs=$IFS
+    IFS=:
+    set -- $1
+    echo $*
+    IFS=$ifs
+}
+
+qt()
+{
+    "$@" >/dev/null 2>&1
+}
+
+mywhich() {
+    local dir
+
+    for dir in $(split $PATH); do
+	if [ -x $dir/$1 ]; then
+	    return 0
+	fi
+    done
+
+    return 2
+}
+
+remove_file() # $1 = file to remove
+{
+    if [ -n "$1" ] ; then
+        if [ -f $1 -o -L $1 ] ; then
+            rm -f $1
+            echo "$1 Removed"
+        fi
+    fi
+}
+
+remove_directory() # $1 = directory to remove
+{
+    if [ -n "$1" ] ; then
+        if [ -d $1 ] ; then
+            rm -rf $1
+            echo "$1 Removed"
+        fi
+    fi
+}
+
+remove_file_with_wildcard() # $1 = file with wildcard to remove
+{
+    if [ -n "$1" ] ; then
+        for f in $1; do
+            if [ -d $f ] ; then
+                rm -rf $f
+                echo "$f Removed"
+            elif [ -f $f -o -L $f ] ; then
+                rm -f $f
+                echo "$f Removed"
+            fi
+        done
+    fi
+}
+
+restore_file() # $1 = file to restore
+{
+    if [ -f ${1}-shorewall.bkout ]; then
+	if (mv -f ${1}-shorewall.bkout $1); then
+	    echo
+	    echo "$1 restored"
+        else
+	    exit 1
+        fi
+    fi
+}

Shorewall-core/manpages/shorewall.xml

@@ -432,6 +432,33 @@
       <arg choice="plain"><replaceable>address</replaceable></arg>
     </cmdsynopsis>
 
+    <cmdsynopsis>
+      <command>shorewall[6][-lite]</command>
+
+      <arg
+      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
+
+      <arg>options</arg>
+
+      <arg choice="plain"><option>reload</option></arg>
+
+      <arg><option>-n</option></arg>
+
+      <arg><option>-p</option><arg><option>-d</option></arg></arg>
+
+      <arg><option>-f</option></arg>
+
+      <arg><option>-c</option></arg>
+
+      <arg><option>-T</option></arg>
+
+      <arg><option>-i</option></arg>
+
+      <arg><option>-C</option></arg>
+
+      <arg><replaceable>directory</replaceable></arg>
+    </cmdsynopsis>
+
     <cmdsynopsis>
       <command>shorewall[6]</command>
 
@@ -1916,10 +1943,11 @@
 
       <varlistentry>
         <term><emphasis role="bold">remote-start</emphasis>
-        [-<option>s</option>] [-<option>c</option>] [-<option>r</option>
-        <replaceable>root-user-name</replaceable>] [-<option>T</option>]
-        [-<option>i</option>] [ [ -D ] <replaceable>directory</replaceable> ]
-        [ <replaceable>system</replaceable> ]</term>
+        [-<option>n</option>] [-<option>s</option>] [-<option>c</option>]
+        [-<option>r</option> <replaceable>root-user-name</replaceable>]
+        [-<option>T</option>] [-<option>i</option>] [ [ -D ]
+        <replaceable>directory</replaceable> ] [
+        <replaceable>system</replaceable> ]</term>
 
         <listitem>
           <para>This command was renamed from <command>load</command> in
@@ -1955,6 +1983,9 @@
           <replaceable>directory</replaceable>, then the <option>-D</option>
           option must be given.</para>
 
+          <para>The <option>-n</option> option causes Shorewall to avoid
+          updating the routing table(s).</para>
+
           <para>If <emphasis role="bold">-s</emphasis> is specified and the
           <emphasis role="bold">start</emphasis> command succeeds, then the
           remote Shorewall-lite configuration is saved by executing <emphasis

Shorewall-core/shorewallrc.debian.systemd

@@ -1,5 +1,5 @@
 #
-# Debian Shorewall 4.5 rc file
+# Debian Shorewall 5.0 rc file
 #
 BUILD=					#Default is to detect the build system
 HOST=debian
@@ -14,7 +14,7 @@ INITDIR=				#Directory where SysV init scripts are installed.
 INITFILE=				#Name of the product's installed SysV init script
 INITSOURCE=init.debian.sh		#Name of the distributed file to be installed as the SysV init script
 ANNOTATED=				#If non-zero, annotated configuration files are installed
-SYSCONFFILE=default.debian		#Name of the distributed file to be installed in $SYSCONFDIR
+SYSCONFFILE=default.debian.systemd		#Name of the distributed file to be installed in $SYSCONFDIR
 SERVICEFILE=$PRODUCT.service.debian     #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
 SYSCONFDIR=/etc/default			#Directory where SysV init parameter files are installed
 SERVICEDIR=/lib/systemd/system		#Directory where .service files are installed (systems running systemd only)

Shorewall-core/shorewallrc.debian.sysvinit

@@ -1,5 +1,5 @@
 #
-# Debian Shorewall 4.5 rc file
+# Debian Shorewall 5.0 rc file
 #
 BUILD=                                  #Default is to detect the build system
 HOST=debian
@@ -14,7 +14,7 @@ INITDIR=/etc/init.d                     #Directory where SysV init scripts are i
 INITFILE=$PRODUCT                       #Name of the product's installed SysV init script
 INITSOURCE=init.debian.sh               #Name of the distributed file to be installed as the SysV init script
 ANNOTATED=                              #If non-zero, annotated configuration files are installed
-SYSCONFFILE=default.debian              #Name of the distributed file to be installed in $SYSCONFDIR
+SYSCONFFILE=default.debian.sysvinit              #Name of the distributed file to be installed in $SYSCONFDIR
 SERVICEFILE=				#Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
 SYSCONFDIR=/etc/default                 #Directory where SysV init parameter files are installed
 SERVICEDIR=				#Directory where .service files are installed (systems running systemd only)

Shorewall-core/shorewallrc.default

@@ -1,8 +1,8 @@
 #
 # Default Shorewall 5.0 rc file
 #
-HOST=linux                              #Generic Linux
 BUILD=                                  #Default is to detect the build system
+HOST=linux                              #Generic Linux
 PREFIX=/usr                             #Top-level directory for shared files, libraries, etc.
 SHAREDIR=${PREFIX}/share                #Directory for arch-neutral files.
 LIBEXECDIR=${PREFIX}/share              #Directory for executable scripts.

Shorewall-core/shorewallrc.openwrt

@@ -1,8 +1,8 @@
 #
-# Created by Shorewall Core version 5.0.2-RC1 configure -  Fri, Nov 06, 2015 10:02:03 AM
-#
-# Input: host=openwrt
+# OpenWRT Shorewall 5.0 rc file
 #
+BUILD=                                 #Default is to detect the build system
+HOST=openwrt
 PREFIX=/usr                             #Top-level directory for shared files, libraries, etc.
 SHAREDIR=${PREFIX}/share                #Directory for arch-neutral files.
 LIBEXECDIR=${PREFIX}/share              #Directory for executable scripts.

Shorewall-core/uninstall.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Script to back uninstall Shoreline Firewall
+# Script to back uninstall Shoreline Firewall Core Modules
 #
 #     (c) 2000-2016 - Tom Eastep (teastep@shorewall.net)
 #
@@ -26,63 +26,75 @@
 #       You may only use this script to uninstall the version
 #       shown below. Simply run this script to remove Shorewall Firewall
 
-VERSION=xxx #The Build script inserts the actual version
-PRODUCT="shorewall-core"
+VERSION=xxx # The Build script inserts the actual version
+PRODUCT=shorewall-core
 Product="Shorewall Core"
- 
+
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <shorewallrc file> ]"
+    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
+    echo "where <option> is one of"
+    echo "  -h"
+    echo "  -v"
     exit $1
 }
 
-fatal_error()
-{
-    echo "   ERROR: $@" >&2
-    exit 1
-}
-
-qt()
-{
-    "$@" >/dev/null 2>&1
-}
-
-restore_file() # $1 = file to restore
-{
-    if [ -f ${1}-shorewall.bkout ]; then
-	if (mv -f ${1}-shorewall.bkout $1); then
-	    echo
-	    echo "$1 restored"
-        else
-	    exit 1
-        fi
-    fi
-}
-
-remove_file() # $1 = file to restore
-{
-    if [ -f $1 -o -L $1 ] ; then
-	rm -f $1
-	echo "$1 Removed"
-    fi
-}
-
 #
 # Change to the directory containing this script
 #
 cd "$(dirname $0)"
 
+#
+# Source common functions
+#
+. ./lib.uninstaller || { echo "ERROR: Can not load common functions." >&2; exit 1; }
+
+#
+# Parse the run line
+#
+finished=0
+
+while [ $finished -eq 0 ]; do
+    option=$1
+
+    case "$option" in
+	-*)
+	    option=${option#-}
+
+	    while [ -n "$option" ]; do
+		case $option in
+		    h)
+			usage 0
+			;;
+		    v)
+			echo "$Product Firewall Uninstaller Version $VERSION"
+			exit 0
+			;;
+		    *)
+			usage 1
+			;;
+		esac
+	    done
+
+	    shift
+	    ;;
+	*)
+	    finished=1
+	    ;;
+    esac
+done
+
 #
 # Read the RC file
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-	. ./shorewallrc
+        . ./shorewallrc || fatal_error "Can not load the RC file: ./shorewallrc"
     elif [ -f ~/.shorewallrc ]; then
-	. ~/.shorewallrc || exit 1
+        . ~/.shorewallrc || fatal_error "Can not load the RC file: ~/.shorewallrc"
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-	. /usr/share/shorewall/shorewallrc
+        . /usr/share/shorewall/shorewallrc || fatal_error "Can not load the RC file: /usr/share/shorewall/shorewallrc"
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -92,11 +104,11 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file
+	    file=./$file || exit 1
 	    ;;
     esac
 
-    . $file
+    . $file || fatal_error "Can not load the RC file: $file"
 else
     usage 1
 fi
@@ -104,20 +116,26 @@ fi
 if [ -f ${SHAREDIR}/shorewall/coreversion ]; then
     INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall/coreversion)"
     if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
-	echo "WARNING: Shorewall Core Version $INSTALLED_VERSION is installed"
+	echo "WARNING: $Product Version $INSTALLED_VERSION is installed"
 	echo "         and this is the $VERSION uninstaller."
 	VERSION="$INSTALLED_VERSION"
     fi
 else
-    echo "WARNING: Shorewall Core Version $VERSION is not installed"
+    echo "WARNING: $Product Version $VERSION is not installed"
     VERSION=""
 fi
 
-echo "Uninstalling Shorewall Core $VERSION"
+echo "Uninstalling $Product $VERSION"
 
-rm -rf ${SHAREDIR}/shorewall
-rm -f ~/.shorewallrc
-
-echo "Shorewall Core Uninstalled"
+if [ -n "${MANDIR}" ]; then
+    remove_file_with_wildcard ${MANDIR}/man5/shorewall\*
+    remove_file_with_wildcard ${MANDIR}/man8/shorewall\*
+fi
 
+remove_directory ${SHAREDIR}/shorewall
+remove_file ~/.shorewallrc
 
+#
+# Report Success
+#
+echo "$Product $VERSION Uninstalled"

Shorewall-init/default.debian.systemd

@@ -0,0 +1,21 @@
+# List the Shorewall products that Shorewall-init is to
+# initialize (space-separated list).
+#
+# Sample: PRODUCTS="shorewall shorewall6"
+#
+PRODUCTS=""
+
+#
+# Set this to 1 if you want Shorewall-init to react to
+# ifup/ifdown and NetworkManager events
+#
+IFUPDOWN=0
+#
+# Where Up/Down events get logged
+#
+LOGFILE=/var/log/shorewall-ifupdown.log
+
+# Startup options - set verbosity to 0 (minimal reporting)
+OPTIONS="-V0"
+
+# IOF

Shorewall-init/default.debian.sysvinit

@@ -0,0 +1,27 @@
+# List the Shorewall products that Shorewall-init is to
+# initialize (space-separated list).
+#
+# Sample: PRODUCTS="shorewall shorewall6"
+#
+PRODUCTS=""
+
+#
+# Set this to 1 if you want Shorewall-init to react to
+# ifup/ifdown and NetworkManager events
+#
+IFUPDOWN=0
+#
+# Set this to the name of the file that is to hold
+# ipset contents. Shorewall-init will load those ipsets
+# during 'start' and will save them there during 'stop'.
+#
+SAVE_IPSETS=""
+#
+# Where Up/Down events get logged
+#
+LOGFILE=/var/log/shorewall-ifupdown.log
+
+# Startup options - set verbosity to 0 (minimal reporting)
+OPTIONS="-V0"
+
+# IOF

Shorewall-init/install.sh

@@ -27,58 +27,21 @@
 #       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
 
-VERSION=xxx #The Build script inserts the actual version.
+VERSION=xxx # The Build script inserts the actual version
 PRODUCT=shorewall-init
 Product="Shorewall Init"
 
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <configuration-file> ]"
-    echo "       $ME -v"
-    echo "       $ME -h"
-    echo "       $ME -n"
+    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
+    echo "where <option> is one of"
+    echo "  -h"
+    echo "  -v"
+    echo "  -n"
     exit $1
 }
 
-fatal_error() 
-{
-    echo "   ERROR: $@" >&2
-    exit 1
-}
-
-split() {
-    local ifs
-    ifs=$IFS
-    IFS=:
-    set -- $1
-    echo $*
-    IFS=$ifs
-}
-
-qt()
-{
-    "$@" >/dev/null 2>&1
-}
-
-mywhich() {
-    local dir
-
-    for dir in $(split $PATH); do
-	if [ -x $dir/$1 ]; then
-	    return 0
-	fi
-    done
-
-    return 2
-}
-
-cant_autostart()
-{
-    echo
-    echo  "WARNING: Unable to configure shorewall init to start automatically at boot" >&2
-}
-
 install_file() # $1 = source $2 = target $3 = mode
 {
     if cp -f $1 $2; then
@@ -97,23 +60,16 @@ install_file() # $1 = source $2 = target $3 = mode
     exit 1
 }
 
-make_directory() # $1 = directory , $2 = mode
-{
-    mkdir -p $1
-    chmod 0755 $1
-    [ -n "$OWNERSHIP" ] && chown $OWNERSHIP $1
-}
-
-require() 
-{
-    eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
-}
-
 #
 # Change to the directory containing this script
 #
 cd "$(dirname $0)"
 
+#
+# Source common functions
+#
+. ./lib.installer || { echo "ERROR: Can not load common functions." >&2; exit 1; }
+
 #
 # Parse the run line
 #
@@ -134,7 +90,7 @@ while [ $finished -eq 0 ] ; do
 			usage 0
 			;;
 		    v)
-			echo "Shorewall-init Firewall Installer Version $VERSION"
+			echo "$Product Firewall Installer Version $VERSION"
 			exit 0
 			;;
 		    n*)
@@ -159,17 +115,17 @@ done
 # Read the RC file
 #
 if [ $# -eq 0 ]; then
-    #
-    # Load packager's settings if any
-    #
     if [ -f ./shorewallrc ]; then
-	. ./shorewallrc || exit 1
 	file=./shorewallrc
+        . $file || fatal_error "Can not load the RC file: $file"
     elif [ -f ~/.shorewallrc ]; then
-	. ~/.shorewallrc || exit 1
 	file=~/.shorewallrc
-     else
-	fatal_error "No configuration file specified and ~/.shorewallrc not found"
+        . $file || fatal_error "Can not load the RC file: $file"
+    elif [ -f /usr/share/shorewall/shorewallrc ]; then
+	file=/usr/share/shorewall/shorewallrc
+        . $file || fatal_error "Can not load the RC file: $file"
+    else
+	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
 elif [ $# -eq 1 ]; then
     file=$1
@@ -177,11 +133,11 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file
+	    file=./$file || exit 1
 	    ;;
     esac
 
-    . $file
+    . $file || fatal_error "Can not load the RC file: $file"
 else
     usage 1
 fi
@@ -298,12 +254,10 @@ case "$HOST" in
 	echo "Installing Openwrt-specific configuration..."
 	;;
     linux)
-	echo "ERROR: Shorewall-init is not supported on this system" >&2
-	exit 1
+	fatal_error "Shorewall-init is not supported on this system"
 	;;
     *)
-	echo "ERROR: Unsupported HOST distribution: \"$HOST\"" >&2
-	exit 1;
+	fatal_error "Unsupported HOST distribution: \"$HOST\""
 	;;
 esac
 
@@ -315,30 +269,27 @@ if [ -n "$DESTDIR" ]; then
 	OWNERSHIP=""
     fi
     
-    make_directory ${DESTDIR}${INITDIR} 0755
+    make_parent_directory ${DESTDIR}${INITDIR} 0755
 fi
 
-echo "Installing Shorewall Init Version $VERSION"
+echo "Installing $Product Version $VERSION"
 
 #
 # Check for /usr/share/shorewall-init/version
 #
-if [ -f ${DESTDIR}${SHAREDIR}/shorewall-init/version ]; then
+if [ -f ${DESTDIR}${SHAREDIR}/$PRODUCT/version ]; then
     first_install=""
 else
     first_install="Yes"
 fi
 
-if [ -n "$DESTDIR" ]; then
-    mkdir -p ${DESTDIR}${CONFDIR}/logrotate.d
-    chmod 0755 ${DESTDIR}${CONFDIR}/logrotate.d
-fi
+[ -n "$DESTDIR" ] && make_parent_directory ${DESTDIR}${CONFDIR}/logrotate.d 0755
 
 #
 # Install the Firewall Script
 #
 if [ -n "$INITFILE" ]; then
-    mkdir -p ${DESTDIR}${INITDIR}
+    make_parent_directory ${DESTDIR}${INITDIR} 0755
     install_file $INITSOURCE ${DESTDIR}${INITDIR}/$INITFILE 0544
     [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${INITDIR}/$INITFILE
     
@@ -357,25 +308,21 @@ if [ -z "${SERVICEDIR}" ]; then
 fi
 
 if [ -n "$SERVICEDIR" ]; then
-    mkdir -p ${DESTDIR}${SERVICEDIR}
+    make_parent_directory ${DESTDIR}${SERVICEDIR} 0755
     [ -z "$SERVICEFILE" ] && SERVICEFILE=$PRODUCT.service
     install_file $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service 0644
     [ ${SBINDIR} != /sbin ] && eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
     echo "Service file $SERVICEFILE installed as ${DESTDIR}${SERVICEDIR}/$PRODUCT.service"
-    if [ -n "$DESTDIR" -o $configure -eq 0 ]; then
-	mkdir -p ${DESTDIR}${SBINDIR}
-        chmod 0755 ${DESTDIR}${SBINDIR}
-    fi
-    install_file shorewall-init ${DESTDIR}${SBINDIR}/shorewall-init 0700
-    [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/shorewall-init
-    echo "CLI installed as ${DESTDIR}${SBINDIR}/shorewall-init"
+    [ -n "$DESTDIR" -o $configure -eq 0 ] && make_parent_directory ${DESTDIR}${SBINDIR} 0755
+    install_file $PRODUCT ${DESTDIR}${SBINDIR}/$PRODUCT 0700
+    [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/$PRODUCT
+    echo "CLI installed as ${DESTDIR}${SBINDIR}/$PRODUCT"
 fi
 
 #
 # Create /usr/share/shorewall-init if needed
 #
-mkdir -p ${DESTDIR}${SHAREDIR}/shorewall-init
-chmod 0755 ${DESTDIR}${SHAREDIR}/shorewall-init
+make_parent_directory ${DESTDIR}${SHAREDIR}/$PRODUCT 0755
 
 #
 # Install logrotate file
@@ -388,55 +335,53 @@ fi
 #
 # Create the version file
 #
-echo "$VERSION" > ${DESTDIR}/${SHAREDIR}/shorewall-init/version
-chmod 0644 ${DESTDIR}${SHAREDIR}/shorewall-init/version
+echo "$VERSION" > ${DESTDIR}/${SHAREDIR}/$PRODUCT/version
+chmod 0644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
 
 #
 # Remove and create the symbolic link to the init script
 #
 if [ -z "$DESTDIR" ]; then
-    rm -f ${SHAREDIR}/shorewall-init/init
-    ln -s ${INITDIR}/${INITFILE} ${SHAREDIR}/shorewall-init/init
+    rm -f ${SHAREDIR}/$PRODUCT/init
+    ln -s ${INITDIR}/${INITFILE} ${SHAREDIR}/$PRODUCT/init
 fi
 
 if [ $HOST = debian ]; then
     if [ -n "${DESTDIR}" ]; then
-	mkdir -p ${DESTDIR}${ETC}/network/if-up.d/
-	mkdir -p ${DESTDIR}${ETC}/network/if-down.d/
-	mkdir -p ${DESTDIR}${ETC}/network/if-post-down.d/
+	make_parent_directory ${DESTDIR}${ETC}/network/if-up.d 0755
+	make_parent_directory ${DESTDIR}${ETC}/network/if-down.d 0755
+	make_parent_directory ${DESTDIR}${ETC}/network/if-post-down.d 0755
     elif [ $configure -eq 0 ]; then
-	mkdir -p ${DESTDIR}${CONFDIR}/network/if-up.d/
-	mkdir -p ${DESTDIR}${CONFDIR}/network/if-down.d/
-	mkdir -p ${DESTDIR}${CONFDIR}/network/if-post-down.d/
+	make_parent_directory ${DESTDIR}${CONFDIR}/network/if-up.d 0755
+	make_parent_directory ${DESTDIR}${CONFDIR}/network/if-down.d 0755
+	make_parent_directory ${DESTDIR}${CONFDIR}/network/if-post-down.d 0755
     fi
 
-    if [ ! -f ${DESTDIR}${CONFDIR}/default/shorewall-init ]; then
-	if [ -n "${DESTDIR}" ]; then
-	    mkdir -p ${DESTDIR}${ETC}/default
-	fi
+    if [ ! -f ${DESTDIR}${CONFDIR}/default/$PRODUCT ]; then
+	[ -n "${DESTDIR}" ] && make_parent_directory ${DESTDIR}${ETC}/default 0755
 
-	[ $configure -eq 1 ] || mkdir -p ${DESTDIR}${CONFDIR}/default
-	install_file sysconfig ${DESTDIR}${ETC}/default/shorewall-init 0644
-	echo "sysconfig file installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}"
+	[ $configure -eq 1 ] || make_parent_directory ${DESTDIR}${CONFDIR}/default 0755
+	install_file ${SYSCONFFILE} ${DESTDIR}${ETC}/default/$PRODUCT 0644
+	echo "${SYSCONFFILE} file installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}"
     fi
 
     IFUPDOWN=ifupdown.debian.sh
 else
     if [ -n "$DESTDIR" ]; then
-	mkdir -p ${DESTDIR}${SYSCONFDIR}
+	make_parent_directory ${DESTDIR}${SYSCONFDIR} 0755
 
 	if [ -z "$RPM" ]; then
 	    if [ $HOST = suse ]; then
-		mkdir -p ${DESTDIR}${ETC}/sysconfig/network/if-up.d
-		mkdir -p ${DESTDIR}${ETC}/sysconfig/network/if-down.d
+		make_parent_directory ${DESTDIR}${ETC}/sysconfig/network/if-up.d 0755
+		make_parent_directory ${DESTDIR}${ETC}/sysconfig/network/if-down.d 0755
 	    elif [ $HOST = gentoo ]; then
 		# Gentoo does not support if-{up,down}.d
 		/bin/true
 	    elif [ $HOST = openwrt ]; then
-		# Not implemented on openwrt
+		# Not implemented on OpenWRT
 		/bin/true
 	    else
-		mkdir -p ${DESTDIR}/${ETC}/NetworkManager/dispatcher.d
+		make_parent_directory ${DESTDIR}/${ETC}/NetworkManager/dispatcher.d 0755
 	    fi
 	fi
     fi
@@ -458,13 +403,13 @@ if [ $HOST != openwrt ]; then
 
     [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ifupdown
 
-    mkdir -p ${DESTDIR}${LIBEXECDIR}/shorewall-init
+    make_parent_directory ${DESTDIR}${LIBEXECDIR}/$PRODUCT 0755
 
-    install_file ifupdown ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown 0544
+    install_file ifupdown ${DESTDIR}${LIBEXECDIR}/$PRODUCT/ifupdown 0544
 fi
 
 if [ -d ${DESTDIR}/etc/NetworkManager ]; then
-    [ $configure -eq 1 ] || mkdir -p ${DESTDIR}${CONFDIR}/NetworkManager/dispatcher.d/
+    [ $configure -eq 1 ] || make_parent_directory ${DESTDIR}${CONFDIR}/NetworkManager/dispatcher.d 0755
     install_file ifupdown ${DESTDIR}${ETC}/NetworkManager/dispatcher.d/01-shorewall 0544
 fi
 
@@ -483,8 +428,8 @@ case $HOST in
     suse)
 	if [ -z "$RPM" ]; then
 	    if [ $configure -eq 0 ]; then
-		mkdir -p ${DESTDIR}${SYSCONFDIR}/network/if-up.d/
-		mkdir -p ${DESTDIR}${SYSCONFDIR}/network/if-down.d/
+		make_parent_directory ${DESTDIR}${SYSCONFDIR}/network/if-up.d 0755
+		make_parent_directory ${DESTDIR}${SYSCONFDIR}/network/if-down.d 0755
 	    fi
 
 	    install_file ifupdown ${DESTDIR}${SYSCONFDIR}/network/if-up.d/shorewall 0544
@@ -518,17 +463,17 @@ if [ -z "$DESTDIR" ]; then
 	if [ $HOST = debian ]; then
 	    if [ -n "$SERVICEDIR" ]; then
 		if systemctl enable ${PRODUCT}.service; then
-                    echo "Shorewall Init will start automatically at boot"
+                    echo "$Product will start automatically at boot"
 		fi
 	    elif mywhich insserv; then
-		if insserv ${INITDIR}/shorewall-init; then
-		    echo "Shorewall Init will start automatically at boot"
+		if insserv ${INITDIR}/$PRODUCT; then
+                    echo "$Product will start automatically at boot"
 		else
 		    cant_autostart
 		fi
 	    elif mywhich update-rc.d ; then
 		if update-rc.d $PRODUCT enable; then
-		    echo "$PRODUCT will start automatically at boot"
+                    echo "$Product will start automatically at boot"
 		    echo "Set startup=1 in ${CONFDIR}/default/$PRODUCT to enable"
 		else
 		    cant_autostart
@@ -549,31 +494,31 @@ if [ -z "$DESTDIR" ]; then
 	    /bin/true
 	else
 	    if [ -n "$SERVICEDIR" ]; then
-		if systemctl enable shorewall-init.service; then
-		    echo "Shorewall Init will start automatically at boot"
+		if systemctl enable ${PRODUCT}.service; then
+		    echo "$Product will start automatically at boot"
 		fi
 	    elif [ -x ${SBINDIR}/insserv -o -x /usr${SBINDIR}/insserv ]; then
-		if insserv ${INITDIR}/shorewall-init ; then
-		    echo "Shorewall Init will start automatically at boot"
+		if insserv ${INITDIR}/$PRODUCT ; then
+		    echo "$Product will start automatically at boot"
 		else
 		    cant_autostart
 		fi
 	    elif [ -x ${SBINDIR}/chkconfig -o -x /usr${SBINDIR}/chkconfig ]; then
-		if chkconfig --add shorewall-init ; then
-		    echo "Shorewall Init will start automatically in run levels as follows:"
-		    chkconfig --list shorewall-init
+		if chkconfig --add $PRODUCT ; then
+		    echo "$Product will start automatically at boot"
+		    chkconfig --list $PRODUCT
 		else
 		    cant_autostart
 		fi
 	    elif [ -x ${SBINDIR}/rc-update ]; then
-		if rc-update add shorewall-init default; then
-		    echo "Shorewall Init will start automatically at boot"
+		if rc-update add $PRODUCT default; then
+		    echo "$Product will start automatically at boot"
 		else
 		    cant_autostart
 		fi
 	    elif [ $HOST = openwrt -a -f ${CONFDIR}/rc.common ]; then
 		/etc/init.d/$PRODUCT enable
-		if /etc/init.d/shorewall-init enabled; then
+		if /etc/init.d/$PRODUCT enabled; then
 		    echo "$Product will start automatically at boot"
 		else
 		    cant_autostart
@@ -587,11 +532,11 @@ else
     if [ $configure -eq 1 -a -n "$first_install" ]; then
 	if [ $HOST = debian -a -z "$SERVICEDIR" ]; then
 	    if [ -n "${DESTDIR}" ]; then
-		mkdir -p ${DESTDIR}/etc/rcS.d
+		make_parent_directory ${DESTDIR}/etc/rcS.d 0755
 	    fi
 
-	    ln -sf ../init.d/shorewall-init ${DESTDIR}${CONFDIR}/rcS.d/S38shorewall-init
-	    echo "Shorewall Init will start automatically at boot"
+	    ln -sf ../init.d/$PRODUCT ${DESTDIR}${CONFDIR}/rcS.d/S38${PRODUCT}
+	    echo "$Product will start automatically at boot"
 	fi
     fi
 fi
@@ -602,8 +547,8 @@ if [ -d ${DESTDIR}/etc/ppp ]; then
     case $HOST in
 	debian|suse)
 	    for directory in ip-up.d ip-down.d ipv6-up.d ipv6-down.d; do
-		mkdir -p ${DESTDIR}/etc/ppp/$directory #SuSE doesn't create the IPv6 directories
-		cp -fp ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown ${DESTDIR}${CONFDIR}/ppp/$directory/shorewall
+		make_parent_directory ${DESTDIR}/etc/ppp/$directory 0755 #SuSE doesn't create the IPv6 directories
+		cp -fp ${DESTDIR}${LIBEXECDIR}/$PRODUCT/ifupdown ${DESTDIR}${CONFDIR}/ppp/$directory/shorewall
 	    done
 	    ;;
 	redhat)
@@ -614,19 +559,19 @@ if [ -d ${DESTDIR}/etc/ppp ]; then
 		FILE=${DESTDIR}/etc/ppp/$file
 		if [ -f $FILE ]; then
 		    if grep -qF Shorewall-based $FILE ; then
-			cp -fp ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown $FILE
+			cp -fp ${DESTDIR}${LIBEXECDIR}/$PRODUCT/ifupdown $FILE
 		    else
 			echo "$FILE already exists -- ppp devices will not be handled"
 			break
 		    fi
 		else
-		    cp -fp ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown $FILE
+		    cp -fp ${DESTDIR}${LIBEXECDIR}/$PRODUCT/ifupdown $FILE
 		fi
 	    done
 	    ;;
     esac
 fi
 #
-#  Report Success
+# Report Success
 #
 echo "shorewall Init Version $VERSION Installed"

Shorewall-init/uninstall.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Script to back uninstall Shoreline Firewall
+# Script to back uninstall Shoreline Firewall Init
 #
 #     (c) 2000-2016 - Tom Eastep (teastep@shorewall.net)
 #
@@ -26,62 +26,34 @@
 #       You may only use this script to uninstall the version
 #       shown below. Simply run this script to remove Shorewall Firewall
 
-VERSION=xxx  #The Build script inserts the actual version
+VERSION=xxx # The Build script inserts the actual version
 PRODUCT=shorewall-init
 Product="Shorewall Init"
 
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <shorewallrc file> ]"
+    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
+    echo "where <option> is one of"
+    echo "  -h"
+    echo "  -v"
+    echo "  -n"
     exit $1
 }
 
-fatal_error()
-{
-    echo "   ERROR: $@" >&2
-    exit 1
-}
-
-qt()
-{
-    "$@" >/dev/null 2>&1
-}
-
-split() {
-    local ifs
-    ifs=$IFS
-    IFS=:
-    set -- $1
-    echo $*
-    IFS=$ifs
-}
-
-mywhich() {
-    local dir
-
-    for dir in $(split $PATH); do
-	if [ -x $dir/$1 ]; then
-	    return 0
-	fi
-    done
-
-    return 2
-}
-
-remove_file() # $1 = file to restore
-{
-    if [ -f $1 -o -L $1 ] ; then
-	rm -f $1
-	echo "$1 Removed"
-    fi
-}
-
 #
 # Change to the directory containing this script
 #
 cd "$(dirname $0)"
 
+#
+# Source common functions
+#
+. ./lib.uninstaller || { echo "ERROR: Can not load common functions." >&2; exit 1; }
+
+#
+# Parse the run line
+#
 finished=0
 configure=1
 
@@ -118,16 +90,17 @@ while [ $finished -eq 0 ]; do
 	    ;;
     esac
 done
+
 #
 # Read the RC file
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-	. ./shorewallrc
+        . ./shorewallrc || fatal_error "Can not load the RC file: ./shorewallrc"
     elif [ -f ~/.shorewallrc ]; then
-	. ~/.shorewallrc || exit 1
+        . ~/.shorewallrc || fatal_error "Can not load the RC file: ~/.shorewallrc"
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-	. /usr/share/shorewall/shorewallrc
+        . /usr/share/shorewall/shorewallrc || fatal_error "Can not load the RC file: /usr/share/shorewall/shorewallrc"
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -137,72 +110,72 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file
+	    file=./$file || exit 1
 	    ;;
     esac
 
-    . $file || exit 1
+    . $file || fatal_error "Can not load the RC file: $file"
 else
     usage 1
 fi
 
-if [ -f ${SHAREDIR}/shorewall-init/version ]; then
-    INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall-init/version)"
+if [ -f ${SHAREDIR}/$PRODUCT/version ]; then
+    INSTALLED_VERSION="$(cat ${SHAREDIR}/$PRODUCT/version)"
     if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
-	echo "WARNING: Shorewall Init Version $INSTALLED_VERSION is installed"
+	echo "WARNING: $Product Version $INSTALLED_VERSION is installed"
 	echo "         and this is the $VERSION uninstaller."
 	VERSION="$INSTALLED_VERSION"
     fi
 else
-    echo "WARNING: Shorewall Init Version $VERSION is not installed"
+    echo "WARNING: $Product Version $VERSION is not installed"
     VERSION=""
 fi
 
-[ -n "${LIBEXEC:=${SHAREDIR}}" ]
-
-echo "Uninstalling Shorewall Init $VERSION"
+echo "Uninstalling $Product $VERSION"
 
 [ -n "$SANDBOX" ] && configure=0
 
-INITSCRIPT=${CONFDIR}/init.d/shorewall-init
+[ -n "${LIBEXEC:=${SHAREDIR}}" ]
 
-if [ -f "$INITSCRIPT" ]; then
+remove_file  ${SBINDIR}/$PRODUCT
+
+FIREWALL=${CONFDIR}/init.d/$PRODUCT
+
+if [ -f "$FIREWALL" ]; then
     if [ $configure -eq 1 ]; then
-	if [ $HOST = openwrt ]; then
-	    if /etc/init.d/shorewall-init enabled; then
-		/etc/init.d/shorewall-init disable
+	if [ $HOST = openwrt ] ; then
+	    if /etc/init.d/$PRODUCT enabled; then
+		/etc/init.d/$PRODUCT disable
 	    fi
-	elif mywhich updaterc.d ; then
-	    updaterc.d shorewall-init remove
 	elif mywhich insserv ; then
-            insserv -r $INITSCRIPT
+            insserv -r $FIREWALL
+	elif mywhich update-rc.d ; then
+	    update-rc.d ${PRODUCT} remove
 	elif mywhich chkconfig ; then
-	    chkconfig --del $(basename $INITSCRIPT)
+	    chkconfig --del $(basename $FIREWALL)
 	fi
     fi
 
-    remove_file $INITSCRIPT
+    remove_file $FIREWALL
 fi
 
-if [ -z "${SERVICEDIR}" ]; then
-    SERVICEDIR="$SYSTEMD"
-fi
+[ -z "${SERVICEDIR}" ] && SERVICEDIR="$SYSTEMD"
 
 if [ -n "$SERVICEDIR" ]; then
-    [ $configure -eq 1 ] && systemctl disable shorewall-init.service
-    rm -f $SERVICEDIR/shorewall-init.service
+    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}.service
+    remove_file $SERVICEDIR/${PRODUCT}.service
 fi
 
 if [ $HOST = openwrt ]; then
-    [ "$(readlink -q ${SBINDIR}/ifup-local)"   = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifup-local
-    [ "$(readlink -q ${SBINDIR}/ifdown-local)" = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifdown-local
+    [ "$(readlink -q ${SBINDIR}/ifup-local)"   = ${SHAREDIR}/$PRODUCT ] && remove_file ${SBINDIR}/ifup-local
+    [ "$(readlink -q ${SBINDIR}/ifdown-local)" = ${SHAREDIR}/$PRODUCT ] && remove_file ${SBINDIR}/ifdown-local
 else
-    [ "$(readlink -m -q ${SBINDIR}/ifup-local)"   = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifup-local
-    [ "$(readlink -m -q ${SBINDIR}/ifdown-local)" = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifdown-local
+    [ "$(readlink -m -q ${SBINDIR}/ifup-local)"   = ${SHAREDIR}/$PRODUCT ] && remove_file ${SBINDIR}/ifup-local
+    [ "$(readlink -m -q ${SBINDIR}/ifdown-local)" = ${SHAREDIR}/$PRODUCT ] && remove_file ${SBINDIR}/ifdown-local
 fi
 
-remove_file ${CONFDIR}/default/shorewall-init
-remove_file ${CONFDIR}/sysconfig/shorewall-init
+remove_file ${CONFDIR}/default/$PRODUCT
+remove_file ${CONFDIR}/sysconfig/$PRODUCT
 
 remove_file ${CONFDIR}/NetworkManager/dispatcher.d/01-shorewall
 
@@ -227,10 +200,11 @@ if [ -d ${CONFDIR}/ppp ]; then
     done
 fi
 
-rm -f  ${SBINDIR}/shorewall-init
-rm -rf ${SHAREDIR}/shorewall-init
-rm -rf ${LIBEXECDIR}/shorewall-init
-
-echo "Shorewall Init Uninstalled"
-
+remove_directory ${SHAREDIR}/$PRODUCT
+remove_directory ${LIBEXECDIR}/$PRODUCT
+remove_file  ${CONFDIR}/logrotate.d/$PRODUCT
 
+#
+# Report Success
+#
+echo "$Product $VERSION Uninstalled"

Shorewall-lite/default.debian.systemd

@@ -0,0 +1,26 @@
+#
+# Global start/restart/reload/stop options
+#
+OPTIONS=""
+
+#
+# Start options
+#
+STARTOPTIONS=""
+
+#
+# Restart options
+#
+RESTARTOPTIONS=""
+
+#
+# Reload options
+#
+RELOADOPTIONS=""
+
+#
+# Stop options
+#
+STOPOPTIONS=""
+
+# EOF

Shorewall-lite/default.debian.sysvinit

@@ -1,5 +1,5 @@
 # prevent startup with default configuration
-# set the following varible to 1 in order to allow Shorewall-lite to start
+# set the following variable to 1 in order to allow Shorewall-lite to start
 
 startup=0
 
@@ -16,7 +16,7 @@ startup=0
 #    wait_interface=
 
 #
-# Startup options
+# Global start/restart/reload/stop options
 #
 OPTIONS=""
 
@@ -30,6 +30,16 @@ STARTOPTIONS=""
 #
 RESTARTOPTIONS=""
 
+#
+# Reload options
+#
+RELOADOPTIONS=""
+
+#
+# Stop options
+#
+STOPOPTIONS=""
+
 #
 # Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf
 #

Shorewall-lite/install.sh

@@ -22,62 +22,19 @@
 #	along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
 
-VERSION=xxx #The Build script inserts the actual version
+VERSION=xxx # The Build script inserts the actual version
 
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <configuration-file> ]"
-    echo "       $ME -v"
-    echo "       $ME -h"
-    echo "       $ME -n"
+    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
+    echo "where <option> is one of"
+    echo "  -h"
+    echo "  -v"
+    echo "  -n"
     exit $1
 }
 
-fatal_error()
-{
-    echo "   ERROR: $@" >&2
-    exit 1
-}
-
-split() {
-    local ifs
-    ifs=$IFS
-    IFS=:
-    set -- $1
-    echo $*
-    IFS=$ifs
-}
-
-qt()
-{
-    "$@" >/dev/null 2>&1
-}
-
-mywhich() {
-    local dir
-
-    for dir in $(split $PATH); do
-	if [ -x $dir/$1 ]; then
-	    echo $dir/$1
-	    return 0
-	fi
-    done
-
-    return 2
-}
-
-cant_autostart()
-{
-    echo
-    echo  "WARNING: Unable to configure $Product to start automatically at boot" >&2
-}
-
-delete_file() # $1 = file to delete
-{
-    rm -f $1
-}
-
 install_file() # $1 = source $2 = target $3 = mode
 {
     if cp -f $1 $2; then
@@ -96,19 +53,6 @@ install_file() # $1 = source $2 = target $3 = mode
     exit 1
 }
 
-make_directory() # $1 = directory , $2 = mode
-{
-    mkdir -p $1
-    chmod 755 $1
-    [ -n "$OWNERSHIP" ] && chown $OWNERSHIP $1
-
-}
-
-require()
-{
-    eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
-}
-
 #
 # Change to the directory containing this script
 #
@@ -122,6 +66,11 @@ else
     Product="Shorewall6 Lite"
 fi
 
+#
+# Source common functions
+#
+. ./lib.installer || { echo "ERROR: Can not load common functions." >&2; exit 1; }
+
 #
 # Parse the run line
 #
@@ -168,12 +117,14 @@ done
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-	. ./shorewallrc || exit 1
 	file=./shorewallrc
+        . $file || fatal_error "Can not load the RC file: $file"
     elif [ -f ~/.shorewallrc ]; then
-	. ~/.shorewallrc
+	file=~/.shorewallrc
+        . $file || fatal_error "Can not load the RC file: $file"
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-	. /usr/share/shorewall/shorewallrc
+	file=/usr/share/shorewall/shorewallrc
+        . $file || fatal_error "Can not load the RC file: $file"
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -183,11 +134,11 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file
+	    file=./$file || exit 1
 	    ;;
     esac
 
-    . $file
+    . $file || fatal_error "Can not load the RC file: $file"
 else
     usage 1
 fi
@@ -318,8 +269,7 @@ case "$HOST" in
     linux)
 	;;
     *)
-	echo "ERROR: Unknown HOST \"$HOST\"" >&2
-	exit 1;
+	fatal_error "ERROR: Unknown HOST \"$HOST\""
 	;;
 esac
 
@@ -331,7 +281,7 @@ if [ -n "$DESTDIR" ]; then
 	OWNERSHIP=""
     fi
 
-    make_directory ${DESTDIR}${INITDIR} 755
+    make_parent_directory ${DESTDIR}${INITDIR} 0755
 
 else
     if [ ! -f ${SHAREDIR}/shorewall/coreversion ]; then
@@ -371,25 +321,20 @@ fi
 
 delete_file ${DESTDIR}/usr/share/$PRODUCT/xmodules
 
-[ -n "${INITFILE}" ] && make_directory ${DESTDIR}${INITDIR} 755
+[ -n "${INITFILE}" ] && make_parent_directory ${DESTDIR}${INITDIR} 0755
 
 #
 # Create ${CONFDIR}/$PRODUCT, /usr/share/$PRODUCT and /var/lib/$PRODUCT if needed
 #
-mkdir -p ${DESTDIR}${CONFDIR}/$PRODUCT
-mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT
-mkdir -p ${DESTDIR}${LIBEXECDIR}/$PRODUCT
-mkdir -p ${DESTDIR}${SBINDIR}
-mkdir -p ${DESTDIR}${VARDIR}
-
-chmod 755 ${DESTDIR}${CONFDIR}/$PRODUCT
-chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT
+make_parent_directory ${DESTDIR}${CONFDIR}/$PRODUCT 0755
+make_parent_directory ${DESTDIR}${SHAREDIR}/$PRODUCT 0755
+make_parent_directory ${DESTDIR}${LIBEXECDIR}/$PRODUCT 0755
+make_parent_directory ${DESTDIR}${SBINDIR} 0755
+make_parent_directory ${DESTDIR}${VARDIR} 0755
 
 if [ -n "$DESTDIR" ]; then
-    mkdir -p ${DESTDIR}${CONFDIR}/logrotate.d
-    chmod 755 ${DESTDIR}${CONFDIR}/logrotate.d
-    mkdir -p ${DESTDIR}${INITDIR}
-    chmod 755 ${DESTDIR}${INITDIR}
+    make_parent_directory ${DESTDIR}${CONFDIR}/logrotate.d 0755
+    make_parent_directory ${DESTDIR}${INITDIR} 0755
 fi
 
 if [ -n "$INITFILE" ]; then
@@ -410,9 +355,9 @@ if [ -z "${SERVICEDIR}" ]; then
 fi
 
 if [ -n "$SERVICEDIR" ]; then
-    mkdir -p ${DESTDIR}${SERVICEDIR}
+    make_parent_directory ${DESTDIR}${SERVICEDIR} 0755
     [ -z "$SERVICEFILE" ] && SERVICEFILE=$PRODUCT.service
-    install_file $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service 644
+    install_file $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service 0644
     [ ${SBINDIR} != /sbin ] && eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
     echo "Service file $SERVICEFILE installed as ${DESTDIR}${SERVICEDIR}/$PRODUCT.service"
 fi
@@ -441,8 +386,14 @@ echo "Default config path file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/confi
 #
 for f in lib.* ; do
     if [ -f $f ]; then
-	install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 0644
-	echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
+        case $f in
+            *installer)
+                ;;
+            *)
+                install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 0644
+                echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
+                ;;
+        esac
     fi
 done
 
@@ -470,12 +421,12 @@ if [ -f modules ]; then
 fi
 
 if [ -f helpers ]; then
-    install_file helpers ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers 600
+    install_file helpers ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers 0600
     echo "Helper modules file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers"
 fi
 
 for f in modules.*; do
-    install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 644
+    install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 0644
     echo "Module file $f installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
 done
 
@@ -486,19 +437,19 @@ done
 if [ -d manpages -a -n "$MANDIR" ]; then
     cd manpages
 
-    mkdir -p ${DESTDIR}${MANDIR}/man5/
+    make_parent_directory ${DESTDIR}${MANDIR}/man5 0755
 
     for f in *.5; do
 	gzip -c $f > $f.gz
-	install_file $f.gz ${DESTDIR}${MANDIR}/man5/$f.gz 644
+	install_file $f.gz ${DESTDIR}${MANDIR}/man5/$f.gz 0644
 	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
     done
 
-    mkdir -p ${DESTDIR}${MANDIR}/man8/
+    make_parent_directory ${DESTDIR}${MANDIR}/man8 0755
 
     for f in *.8; do
 	gzip -c $f > $f.gz
-	install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 644
+	install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 0644
 	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man8/$f.gz"
     done
 
@@ -508,7 +459,7 @@ if [ -d manpages -a -n "$MANDIR" ]; then
 fi
 
 if [ -d ${DESTDIR}${CONFDIR}/logrotate.d ]; then
-    install_file logrotate ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT 644
+    install_file logrotate ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT 0644
     echo "Logrotate file installed as ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT"
 fi
 
@@ -516,7 +467,7 @@ fi
 # Create the version file
 #
 echo "$VERSION" > ${DESTDIR}${SHAREDIR}/$PRODUCT/version
-chmod 644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
+chmod 0644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
 #
 # Remove and create the symbolic link to the init script
 #
@@ -539,10 +490,7 @@ ln -sf shorewall ${DESTDIR}${SBINDIR}/${PRODUCT}
 # Note -- not all packages will have the SYSCONFFILE so we need to check for its existance here
 #
 if [ -n "$SYSCONFFILE" -a -f "$SYSCONFFILE" -a ! -f ${DESTDIR}${SYSCONFDIR}/${PRODUCT} ]; then
-    if [ ${DESTDIR} ]; then
-	mkdir -p ${DESTDIR}${SYSCONFDIR}
-	chmod 755 ${DESTDIR}${SYSCONFDIR}
-    fi
+    [ ${DESTDIR} ] && make_parent_directory ${DESTDIR}${SYSCONFDIR} 0755
 
     install_file ${SYSCONFFILE} ${DESTDIR}${SYSCONFDIR}/${PRODUCT} 0640
     echo "$SYSCONFFILE file installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}"
@@ -610,6 +558,6 @@ if [ $configure -eq 1 -a -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${
 fi
 
 #
-#  Report Success
+# Report Success
 #
 echo "$Product Version $VERSION Installed"

Shorewall-lite/uninstall.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Script to back uninstall Shoreline Firewall
+# Script to back uninstall Shoreline Firewall Lite
 #
 #     (c) 2000-2016 - Tom Eastep (teastep@shorewall.net)
 #
@@ -26,9 +26,7 @@
 #       You may only use this script to uninstall the version
 #       shown below. Simply run this script to remove Shorewall Firewall
 
-VERSION=xxx  #The Build script inserts the actual version
-PRODUCT=shorewall-lite
-Product="Shorewall Lite"
+VERSION=xxx # The Build script inserts the actual version
 
 usage() # $1 = exit status
 {
@@ -41,46 +39,27 @@ usage() # $1 = exit status
     exit $1
 }
 
-fatal_error()
-{
-    echo "   ERROR: $@" >&2
-    exit 1
-}
+#
+# Change to the directory containing this script
+#
+cd "$(dirname $0)"
 
-qt()
-{
-    "$@" >/dev/null 2>&1
-}
+if [ -f shorewall-lite.service ]; then
+    PRODUCT=shorewall-lite
+    Product="Shorewall Lite"
+else
+    PRODUCT=shorewall6-lite
+    Product="Shorewall6 Lite"
+fi
 
-split() {
-    local ifs
-    ifs=$IFS
-    IFS=:
-    set -- $1
-    echo $*
-    IFS=$ifs
-}
-
-mywhich() {
-    local dir
-
-    for dir in $(split $PATH); do
-	if [ -x $dir/$1 ]; then
-	    return 0
-	fi
-    done
-
-    return 2
-}
-
-remove_file() # $1 = file to restore
-{
-    if [ -f $1 -o -L $1 ] ; then
-	rm -f $1
-	echo "$1 Removed"
-    fi
-}
+#
+# Source common functions
+#
+. ./lib.uninstaller || { echo "ERROR: Can not load common functions." >&2; exit 1; }
 
+#
+# Parse the run line
+#
 finished=0
 configure=1
 
@@ -97,7 +76,7 @@ while [ $finished -eq 0 ]; do
 			usage 0
 			;;
 		    v)
-			echo "$Product Firewall Installer Version $VERSION"
+			echo "$Product Firewall Uninstaller Version $VERSION"
 			exit 0
 			;;
 		    n*)
@@ -117,16 +96,17 @@ while [ $finished -eq 0 ]; do
 	    ;;
     esac
 done
+
 #
 # Read the RC file
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-	. ./shorewallrc
+        . ./shorewallrc || fatal_error "Can not load the RC file: ./shorewallrc"
     elif [ -f ~/.shorewallrc ]; then
-	. ~/.shorewallrc || exit 1
+        . ~/.shorewallrc || fatal_error "Can not load the RC file: ~/.shorewallrc"
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-	. /usr/share/shorewall/shorewallrc
+        . /usr/share/shorewall/shorewallrc || fatal_error "Can not load the RC file: /usr/share/shorewall/shorewallrc"
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -136,46 +116,50 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file
+	    file=./$file || exit 1
 	    ;;
     esac
 
-    . $file
+    . $file || fatal_error "Can not load the RC file: $file"
 else
     usage 1
 fi
 
-if [ -f ${SHAREDIR}/shorewall-lite/version ]; then
-    INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall-lite/version)"
+if [ -f ${SHAREDIR}/$PRODUCT/version ]; then
+    INSTALLED_VERSION="$(cat ${SHAREDIR}/$PRODUCT/version)"
     if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
-	echo "WARNING: Shorewall Lite Version $INSTALLED_VERSION is installed"
+	echo "WARNING: $Product Version $INSTALLED_VERSION is installed"
 	echo "         and this is the $VERSION uninstaller."
 	VERSION="$INSTALLED_VERSION"
     fi
 else
-    echo "WARNING: Shorewall Lite Version $VERSION is not installed"
+    echo "WARNING: $Product Version $VERSION is not installed"
     VERSION=""
 fi
 
-echo "Uninstalling Shorewall Lite $VERSION"
+echo "Uninstalling $Product $VERSION"
 
 [ -n "$SANDBOX" ] && configure=0
 
 if [ $configure -eq 1 ]; then
     if qt iptables -L shorewall -n && [ ! -f ${SBINDIR}/shorewall ]; then
-	shorewall-lite clear
+	${SBINDIR}/$PRODUCT clear
+    elif qt ip6tables -L shorewall -n && [ ! -f ${SBINDIR}/shorewall6 ]; then
+	${SBINDIR}/$PRODUCT clear
     fi
 fi
 
-if [ -L ${SHAREDIR}/shorewall-lite/init ]; then
+remove_file ${SBINDIR}/$PRODUCT
+
+if [ -L ${SHAREDIR}/$PRODUCT/init ]; then
     if [ $HOST = openwrt ]; then
-	if [ $configure -eq 1 ] && /etc/init.d/shorewall-lite enabled; then
-	    /etc/init.d/shorewall-lite disable
+	if [ $configure -eq 1 ] && /etc/init.d/$PRODUCT enabled; then
+	    /etc/init.d/$PRODUCT disable
 	fi
 	
-	FIREWALL=$(readlink ${SHAREDIR}/shorewall-lite/init)
+	FIREWALL=$(readlink ${SHAREDIR}/$PRODUCT/init)
     else
-	FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall-lite/init)
+	FIREWALL=$(readlink -m -q ${SHAREDIR}/$PRODUCT/init)
     fi
 elif [ -n "$INITFILE" ]; then
     FIREWALL=${INITDIR}/${INITFILE}
@@ -183,10 +167,10 @@ fi
 
 if [ -f "$FIREWALL" ]; then
     if [ $configure -eq 1 ]; then
-	if mywhich updaterc.d ; then
-	    updaterc.d shorewall-lite remove
-	elif mywhich insserv ; then
+	if mywhich insserv ; then
             insserv -r $FIREWALL
+	elif mywhich update-rc.d ; then
+	    update-rc.d ${PRODUCT} remove
 	elif mywhich chkconfig ; then
 	    chkconfig --del $(basename $FIREWALL)
 	fi
@@ -195,26 +179,29 @@ if [ -f "$FIREWALL" ]; then
     remove_file $FIREWALL
 fi
 
-[ -z "$SERVICEDIR" ] && SERVICEDIR="$SYSTEMD"
+[ -z "${SERVICEDIR}" ] && SERVICEDIR="$SYSTEMD"
 
 if [ -n "$SERVICEDIR" ]; then
-    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}
-    rm -f $SERVICEDIR/shorewall-lite.service
+    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}.service
+    remove_file $SERVICEDIR/${PRODUCT}.service
 fi
 
-rm -f ${SBINDIR}/shorewall-lite
+remove_directory ${CONFDIR}/$PRODUCT
+remove_directory ${VARDIR}
+remove_directory ${SHAREDIR}/$PRODUCT
+remove_directory ${LIBEXECDIR}/$PRODUCT
+remove_file  ${CONFDIR}/logrotate.d/$PRODUCT
 
-rm -rf ${CONFDIR}/shorewall-lite
-rm -rf ${VARDIR}
-rm -rf ${SHAREDIR}/shorewall-lite
-rm -rf ${LIBEXECDIR}/shorewall-lite
-rm -f  ${CONFDIR}/logrotate.d/shorewall-lite
-rm -f  ${SYSCONFDIR}/shorewall-lite
+if [ -n "$SYSCONFDIR" ]; then
+    [ -n "$SYSCONFFILE" ] && remove_file ${SYSCONFDIR}/${PRODUCT}
+fi
 
 if [ -n "${MANDIR}" ]; then
-    rm -f ${MANDIR}/man5/shorewall-lite*
-    rm -f ${MANDIR}/man8/shorewall-lite*
+    remove_file_with_wildcard ${MANDIR}/man5/${PRODUCT}\*
+    remove_file_with_wildcard ${MANDIR}/man8/${PRODUCT}\*
 fi
 
-echo "Shorewall Lite Uninstalled"
-
+#
+# Report Success
+#
+echo "$Product $VERSION Uninstalled"

Shorewall/Actions/action.A_AllowICMPs.deprecated

@@ -0,0 +1,9 @@
+#
+# Shorewall6 -- /usr/share/shorewall/action.A_AllowICMPs
+#
+# This action A_ACCEPTs needed ICMP types
+#
+###############################################################################
+#ACTION		SOURCE		DEST	PROTO		DPORT
+
+AllowICMPs(A_ACCEPT)

Shorewall/Actions/action.A_Drop.deprecated

@@ -13,6 +13,7 @@
 # IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
 #
 ?require AUDIT_TARGET
+?warning "You are using the deprecated A_Drop default action. Please see http://www.shorewall.net/Actions.html
 ###############################################################################
 #ACTION		SOURCE	DEST	PROTO	DPORT	SPORT
 #
@@ -31,9 +32,10 @@ Auth(A_DROP)
 #
 A_AllowICMPs	-	-	icmp
 #
-# Don't log broadcasts
+# Don't log broadcasts and multicasts
 #
 dropBcast(audit)
+dropMcast(audit)
 #
 # Drop packets that are in the INVALID state -- these are usually ICMP packets
 # and just confuse people when they appear in the log.

Shorewall/Actions/action.A_Reject.deprecated

@@ -11,6 +11,8 @@
 #    internet operation are always ACCEPTed.
 #
 # IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
+?require AUDIT_TARGET
+?warning "You are using the deprecated A_REJECT default action. Please see http://www.shorewall.net/Actions.html
 ###############################################################################
 #ACTION		SOURCE	DEST	PROTO
 #
@@ -25,10 +27,11 @@ COUNT
 #
 A_AllowICMPs	-	-	icmp
 #
-# Drop Broadcasts so they don't clutter up the log
-# (broadcasts must *not* be rejected).
+# Drop Broadcasts and multicasts so they don't clutter up the log
+# (these must *not* be rejected).
 #
 dropBcast(audit)
+dropMcast(audit)
 #
 # Drop packets that are in the INVALID state -- these are usually ICMP packets
 # and just confuse people when they appear in the log (these ICMPs cannot be

Shorewall/Actions/action.AllowICMPs

@@ -7,5 +7,39 @@
 #ACTION	SOURCE	DEST	PROTO	DPORT	SPORT	ORIGDEST	RATE	USER
 
 DEFAULTS ACCEPT
-@1	-	-	icmp	fragmentation-needed	{comment="Needed ICMP types"}
-@1	-	-	icmp	time-exceeded		{comment="Needed ICMP types"}
+
+?if __IPV4
+    @1	-	-	icmp	fragmentation-needed	{comment="Needed ICMP types"}
+    @1	-	-	icmp	time-exceeded		{comment="Needed ICMP types"}
+?else
+?COMMENT Needed ICMP types (RFC4890)
+
+    @1	-		-	ipv6-icmp	destination-unreachable
+    @1	-		-	ipv6-icmp	packet-too-big
+    @1	-		-	ipv6-icmp	time-exceeded
+    @1	-		-	ipv6-icmp	parameter-problem
+
+# The following should have a ttl of 255 and must be allowed to transit a bridge
+    @1	-		-	ipv6-icmp	router-solicitation
+    @1	-		-	ipv6-icmp	router-advertisement
+    @1	-		-	ipv6-icmp	neighbour-solicitation
+    @1	-		-	ipv6-icmp	neighbour-advertisement
+    @1	-		-	ipv6-icmp	137	# Redirect
+    @1	-		-	ipv6-icmp	141	# Inverse neighbour discovery solicitation
+    @1	-		-	ipv6-icmp	142	# Inverse neighbour discovery advertisement
+
+# The following should have a link local source address and must be allowed to transit a bridge
+    @1	fe80::/10	-	ipv6-icmp	130	# Listener query
+    @1	fe80::/10	-	ipv6-icmp	131	# Listener report
+    @1	fe80::/10	-	ipv6-icmp	132	# Listener done
+    @1	fe80::/10	-	ipv6-icmp	143	# Listener report v2
+
+# The following should be received with a ttl of 255 and must be allowed to transit a bridge
+    @1	-		-	ipv6-icmp	148	# Certificate path solicitation
+    @1	-		-	ipv6-icmp	149	# Certificate path advertisement
+
+# The following should have a link local source address and a ttl of 1 and must be allowed to transit abridge
+    @1	fe80::/10	-	ipv6-icmp	151	# Multicast router advertisement
+    @1	fe80::/10	-	ipv6-icmp	152	# Multicast router solicitation
+    @1	fe80::/10	-	ipv6-icmp	153	# Multicast router termination
+?endif

Shorewall/Actions/action.Broadcast

@@ -20,7 +20,7 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-# Broadcast[([<action>|-[,{audit|-}])]
+# Broadcast[([<action>|[,{audit|-}])]
 #
 # Default action is DROP
 #
@@ -29,27 +29,37 @@
 DEFAULTS DROP,-
 
 ?if __ADDRTYPE
-@1	-	-	-	;; -m addrtype --dst-type BROADCAST
-@1	-	-	-	;; -m addrtype --dst-type ANYCAST
+    @1	-	-	-	;; -m addrtype --dst-type BROADCAST
+    @1	-	-	-	;; -m addrtype --dst-type ANYCAST
 ?else
-?begin perl;
+    ?begin perl;
 
-use Shorewall::IPAddrs;
-use Shorewall::Config;
-use Shorewall::Chains;
+    use strict;
+    use Shorewall::IPAddrs;
+    use Shorewall::Config;
+    use Shorewall::Chains;
 
-my ( $action )         = get_action_params( 1 );
-my $chainref           = get_action_chain;
-my ( $level, $tag )    = get_action_logging;
+    my ( $action, $audit ) = get_action_params( 2 );
+    my $chainref           = get_action_chain;
+    my ( $level, $tag )    = get_action_logging;
 
-add_commands $chainref, 'for address in $ALL_BCASTS; do';
-incr_cmd_level $chainref;
-log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d $address ' if $level ne '';
-add_jump $chainref, $action, 0, "-d \$address ";
-decr_cmd_level $chainref;
-add_commands $chainref, 'done';
+    fatal_error "Invalid parameter to action Broadcast" if supplied $audit && $audit ne 'audit';
 
-1;
+    my $target             = require_audit ( $action , $audit );
 
-?end perl;
+    if ( $family == F_IPV4 ) {
+        add_commands $chainref, 'for address in $ALL_BCASTS; do';
+    } elsif ($family == F_IPV6 ) {
+        add_commands $chainref, 'for address in $ALL_ACASTS; do';
+    }
+
+    incr_cmd_level $chainref;
+    log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d $address ' if $level ne '';
+    add_jump $chainref, $target, 0, "-d \$address ";
+    decr_cmd_level $chainref;
+    add_commands $chainref, 'done';
+
+    1;
+
+    ?end perl;
 ?endif

Shorewall/Actions/action.GlusterFS

@@ -13,9 +13,9 @@
 DEFAULTS 2,0
 
 ?if @1 !~ /^\d+/ || ! @1 || @1 > 1024
-    ?error Invalid value for Bricks (@1)
+    ?error Invalid value (@1) for the GlusterFS Bricks argument
 ?elsif @2 !~ /^[01]$/
-    ?error Invalid value for IB (@2)
+    ?error Invalid value (@2) for the GlusterFS IB argument
 ?endif
 
 #ACTION		SOURCE		DEST		PROTO	DPORT

Shorewall/Actions/action.Limit

@@ -22,6 +22,49 @@
 #
 # Limit(<recent-set>,<num-connections>,<timeout>)
 #
-# This is a built-in action.
-#
 ###############################################################################
+
+DEFAULTS -,-,-
+
+?begin perl
+
+use strict;
+use Shorewall::Config;
+use Shorewall::Chains;
+
+my $chainref        = get_action_chain;
+my @param           = get_action_params(3);
+my ( $level, $tag ) = get_action_logging;
+
+@param = split( ',', $tag ), $tag = $param[0] unless supplied( join '', @param );
+
+fatal_error 'Limit rules must include <set name>,<max connections>,<interval> as the log tag or as parameters' unless @param == 3;
+
+my $set   = $param[0];
+
+for ( @param[1,2] ) {
+    fatal_error 'Max connections and interval in Limit rules must be numeric (' . join( ':', 'Limit', $level eq '' ? 'none' : $level, $tag ) . ')' unless /^\d+$/
+}
+
+my $count = $param[1] + 1;
+
+require_capability( 'RECENT_MATCH' , 'Limit rules' , '' );
+
+warning_message "The Limit action is deprecated in favor of per-IP rate limiting using the RATE LIMIT column";
+
+add_irule $chainref, recent => "--name $set --set";
+
+if ( $level ne '' ) {
+    my $xchainref = new_chain 'filter' , "$chainref->{name}%";
+    log_irule_limit( $level, $xchainref, '', 'DROP', [], $tag, 'add' , '' );
+    add_ijump $xchainref, j => 'DROP';
+    add_ijump $chainref,  j => $xchainref, recent => "--name $set --update --seconds $param[2] --hitcount $count";
+} else {
+    add_ijump $chainref, j => 'DROP', recent => "--update --name $set --seconds $param[2] --hitcount $count";
+}
+
+add_ijump $chainref, j => 'ACCEPT';
+
+1;
+
+?end perl

Shorewall/Actions/action.Multicast

@@ -29,22 +29,28 @@
 DEFAULTS DROP,-
 
 ?if __ADDRTYPE
-@1	-	-	-	;; -m addrtype --dst-type MULTICAST
+    @1	-	-	-	;; -m addrtype --dst-type MULTICAST
 ?else
-?begin perl;
+    ?begin perl;
 
-use Shorewall::IPAddrs;
-use Shorewall::Config;
-use Shorewall::Chains;
+    use strict;
+    use Shorewall::IPAddrs;
+    use Shorewall::Config;
+    use Shorewall::Chains;
 
-my ( $action )         = get_action_params( 1 );
-my $chainref           = get_action_chain;
-my ( $level, $tag )    = get_action_logging;
+    my ( $action, $audit ) = get_action_params( 2 );
+    my $chainref           = get_action_chain;
+    my ( $level, $tag )    = get_action_logging;
 
-log_rule_limit $level, $chainref, 'Multicast' , $action, '', $tag, 'add', ' -d 224.0.0.0/4 ' if $level ne '';
-add_jump $chainref, $action, 0, '-d 224.0.0.0/4 ';
+    fatal_error "Invalid parameter to action Multicast" if supplied $audit && $audit ne 'audit';
 
-1;
+    my $target = require_audit ( $action , $audit );
+    my $dest   = ( $family == F_IPV4 ) ? join( ' ', '-d', IPv4_MULTICAST . ' ' ) : join( ' ', '-d', IPv6_MULTICAST . ' ' );
 
-?end perl;
+    log_rule_limit( $level, $chainref, 'Multicast' , $action, '', $tag, 'add', $dest ) if $level ne '';
+    add_jump $chainref, $target, 0, $dest;
+
+    1;
+
+    ?end perl;
 ?endif

Shorewall/Actions/action.allowBcast

@@ -22,6 +22,17 @@
 #
 # allowBcast[([audit])]
 #
-# This is a built-in action.
-#
 ###############################################################################
+
+DEFAULTS -
+
+?if passed(@1)
+    ?if @1 eq 'audit'
+	?require AUDIT_TARGET
+	Broadcast(A_ACCEPT)
+    ?else
+	?error "Invalid argument (@1) to allowBcast"
+    ?endif
+?else
+    Broadcast(ACCEPT)
+?endif

Shorewall/Actions/action.allowMcast

@@ -22,6 +22,17 @@
 #
 # allowMcast[([audit])]
 #
-# This is a built-in action.
-#
 ###############################################################################
+
+DEFAULTS -
+
+?if passed(@1)
+    ?if @1 eq 'audit'
+	?require AUDIT_TARGET
+	Multicast(A_ACCEPT)
+    ?else
+	?error "Invalid argument (@1) to allowMcast"
+    ?endif
+?else
+    Multicast(ACCEPT)
+?endif

Shorewall/Actions/action.allowinUPnP

@@ -22,6 +22,19 @@
 #
 # allowinUPnP[([audit])]
 #
-# This is a built-in action.
-#
 ###############################################################################
+
+DEFAULTS -
+
+?if passed(@1)
+    ?if @1 eq 'audit'
+	?require AUDIT_TARGET
+	A_ACCEPT - - 17 1900
+	A_ACCEPT - -  6 49152
+    ?else
+	?error "Invalid argument (@1) to allowinUPnP"
+    ?endif
+?else
+    ACCEPT - - 17 1900
+    ACCEPT - -	6 49152
+?endif

Shorewall/Actions/action.dropBcast

@@ -22,6 +22,18 @@
 #
 # dropBcast[([audit])]
 #
-# This is a built-in action.
-#
 ###############################################################################
+
+DEFAULTS -
+
+?if passed(@1)
+    ?if @1 eq 'audit'
+	?require AUDIT_TARGET
+	Broadcast(A_DROP)
+    ?else
+	?error "Invalid argument (@1) to dropBcast"
+    ?endif
+?else
+    Broadcast(DROP)
+?endif
+

Shorewall/Actions/action.dropMcast

@@ -22,6 +22,17 @@
 #
 # dropMcast[([audit])]
 #
-# This is a built-in action.
-#
 ###############################################################################
+
+DEFAULTS -
+
+?if passed(@1)
+    ?if @1 eq 'audit'
+	?require AUDIT_TARGET
+	Multicast(A_DROP)
+    ?else
+	?error "Invalid argument (@1) to dropMcast"
+    ?endif
+?else
+    Multicast(DROP)
+?endif

Shorewall/Actions/action.dropNotSyn

@@ -22,6 +22,17 @@
 #
 # dropNotSyn[([audit])]
 #
-# This is a built-in action.
-#
 ###############################################################################
+
+DEFAULTS -
+
+?if passed(@1)
+    ?if @1 eq 'audit'
+	?require AUDIT_TARGET
+	A_DROP {proto=6:!syn}
+    ?else
+	?error "Invalid argument (@1) to dropNotSyn"
+    ?endif
+?else
+    DROP {proto=6:!syn}
+?endif

Shorewall/Actions/action.forwardUPnP

@@ -22,6 +22,22 @@
 #
 # forwardUPnP
 #
-# This is a built-in action.
-#
 ###############################################################################
+
+DEFAULTS -
+
+?begin perl
+
+use strict;
+use Shorewall::Config;
+use Shorewall::Chains;
+
+my $chainref = get_action_chain;
+
+set_optflags( $chainref, DONT_OPTIMIZE );
+
+add_commands( $chainref , '[ -f ${VARDIR}/.forwardUPnP ] && cat ${VARDIR}/.forwardUPnP >&3' );
+
+1;
+
+?end perl

Shorewall/Actions/action.rejNotSyn

@@ -22,6 +22,18 @@
 #
 # rejNotSyn[([audit])]
 #
-# This is a built-in action.
-#
 ###############################################################################
+
+DEFAULTS -
+
+?if passed(@1)
+    ?if @1 eq 'audit'
+	?require AUDIT_TARGET
+	A_REJECT {proto=6:!syn}
+    ?else
+	?error "Invalid argument (@1) to rejNotSyn"
+    ?endif
+?else
+    REJECT(tcp-reset) {proto=6:!syn}
+?endif
+

Shorewall/Perl/Shorewall/Accounting.pm

@@ -519,9 +519,9 @@ sub setup_accounting() {
 
 		while ( $chainswithjumps && $progress ) {
 		    $progress = 0;
-		    for my $chain1 ( sort  keys %accountingjumps ) {
+		    for my $chain1 ( keys %accountingjumps ) {
 			if ( keys %{$accountingjumps{$chain1}} ) {
-			    for my $chain2 ( sort keys %{$accountingjumps{$chain1}} ) {
+			    for my $chain2 ( keys %{$accountingjumps{$chain1}} ) {
 				delete $accountingjumps{$chain1}{$chain2}, $progress = 1 unless $accountingjumps{$chain2};
 			    }
 			} else {

Shorewall/Perl/Shorewall/Chains.pm

@@ -405,14 +405,14 @@ our $VERSION = 'MODULEVERSION';
 #   Provider Chains for provider <p>
 #      Load Balance    - ~<p>
 #
-#   Zone-pair chains for rules chain <z12z2>
+#   Zone-pair chains for rules chain <z1-z2>
 #
-#      Syn Flood       - @<z12z2>
-#      Blacklist       - <z12z2>~
-#      Established     - ^<z12z2>
-#      Related         - +<z12z2>
-#      Invalid         - _<z12z2>
-#      Untracked       - &<z12z2>
+#      Syn Flood       - @<z1-z2>
+#      Blacklist       - <z1-z2>~
+#      Established     - ^<z1-z2>
+#      Related         - +<z1-z2>
+#      Invalid         - _<z1-z2>
+#      Untracked       - &<z1-z2>
 #
 our %chain_table;
 our $raw_table;
@@ -434,7 +434,7 @@ use constant { STANDARD     =>      0x1,       #defined by Netfilter
 	       REDIRECT     =>     0x20,       #'REDIRECT'
 	       ACTION       =>     0x40,       #An action (may be built-in)
 	       MACRO        =>     0x80,       #A Macro
-	       LOGRULE      =>    0x100,       #'LOG','NFLOG'
+	       LOGRULE      =>    0x100,       #'LOG','ULOG','NFLOG'
 	       NFQ          =>    0x200,       #'NFQUEUE'
 	       CHAIN        =>    0x400,       #Manual Chain
 	       SET          =>    0x800,       #SET
@@ -1081,11 +1081,11 @@ sub format_option( $$ ) {
 
     assert( ! reftype $value );
 
-    my $rule = '';
+    my $rule;
 
     $value =~ s/\s*$//;
 
-    $rule .= join( ' ' , ' -m', $option, $value );
+    $rule = join( ' ' , ' -m', $option, $value );
 
     $rule;
 }
@@ -1223,7 +1223,7 @@ sub merge_rules( $$$ ) {
 	}
     }
 
-    for my $option ( grep ! $opttype{$_} || $_ eq 'nfacct' || $_ eq 'recent', sort { $b cmp $a } keys %$fromref ) {
+    for my $option ( grep ! $opttype{$_} || $_ eq 'nfacct' || $_ eq 'recent', keys %$fromref ) {
 	set_rule_option( $toref, $option, $fromref->{$option} );
     }
 
@@ -1239,7 +1239,7 @@ sub merge_rules( $$$ ) {
 
     set_rule_option( $toref, 'policy', $fromref->{policy} ) if exists $fromref->{policy};
 
-    for my $option ( grep( get_opttype( $_, 0 ) == EXPENSIVE, sort keys %$fromref ) ) {
+    for my $option ( grep( get_opttype( $_, 0 ) == EXPENSIVE, keys %$fromref ) ) {
 	set_rule_option( $toref, $option, $fromref->{$option} );
     }
 
@@ -3691,7 +3691,7 @@ sub optimize_level8( $$$ ) {
 	}
 
 	if ( $progress ) {
-	    my @rename = sort keys %rename;
+	    my @rename = keys %rename;
 	    #
 	    # First create aliases for each renamed chain and change the {name} member.
 	    #
@@ -4556,7 +4556,8 @@ sub do_proto( $$$;$ )
 
     if ( $proto ne '' ) {
 
-	my $synonly  = ( $proto =~ s/:syn$//i );
+	my $synonly  = ( $proto =~ s/:(!)?syn$//i );
+	my $notsyn   = $1;
 	my $invert   = ( $proto =~ s/^!// ? '! ' : '' );
 	my $protonum = resolve_proto $proto;
 
@@ -4574,7 +4575,7 @@ sub do_proto( $$$;$ )
 		$output  = "${invert}-p ${proto} ";
 	    } else {
 		fatal_error '":syn" is only allowed with tcp' unless $proto == TCP && ! $invert;
-		$output = "-p $proto --syn ";
+		$output = $notsyn ? "-p $proto ! --syn " : "-p $proto --syn ";
 	    }
 
 	    fatal_error "SOURCE/DEST PORT(S) not allowed with PROTO !$pname" if $invert && ($ports ne '' || $sports ne '');
@@ -6980,13 +6981,13 @@ sub set_global_variables( $$ ) {
     if ( $conditional ) {
 	my ( $interface, @interfaces );
 
-	@interfaces = sort keys %interfaceaddr;
+	@interfaces = keys %interfaceaddr;
 
 	for $interface ( @interfaces ) {
 	    emit( qq([ -z "\$interface" -o "\$interface" = "$interface" ] && $interfaceaddr{$interface}) );
 	}
 
-	@interfaces = sort keys %interfacegateways;
+	@interfaces = keys %interfacegateways;
 
 	for $interface ( @interfaces ) {
 	    emit( qq(if [ -z "\$interface" -o "\$interface" = "$interface" ]; then) );
@@ -6996,36 +6997,36 @@ sub set_global_variables( $$ ) {
 	    emit( qq(fi\n) );
 	}
 
-	@interfaces = sort keys %interfacemacs;
+	@interfaces = keys %interfacemacs;
 
 	for $interface ( @interfaces ) {
 	    emit( qq([ -z "\$interface" -o "\$interface" = "$interface" ] && $interfacemacs{$interface}) );
 	}
     } else {
-	emit $_     for sort values %interfaceaddr;
-	emit "$_\n" for sort values %interfacegateways;
-	emit $_     for sort values %interfacemacs;
+	emit $_     for values %interfaceaddr;
+	emit "$_\n" for values %interfacegateways;
+	emit $_     for values %interfacemacs;
     }
 
     if ( $setall ) {
-	emit $_ for sort values %interfaceaddrs;
-	emit $_ for sort values %interfacenets;
+	emit $_ for values %interfaceaddrs;
+	emit $_ for values %interfacenets;
 
 	unless ( have_capability( 'ADDRTYPE' ) ) {
 
 	    if ( $family == F_IPV4 ) {
 		emit 'ALL_BCASTS="$(get_all_bcasts) 255.255.255.255"';
-		emit $_ for sort values %interfacebcasts;
+		emit $_ for values %interfacebcasts;
 	    } else {
 		emit 'ALL_ACASTS="$(get_all_acasts)"';
-		emit $_ for sort values %interfaceacasts;
+		emit $_ for values %interfaceacasts;
 	    }
 	}
     }
 }
 
 sub verify_address_variables() {
-    for my $variable ( sort keys %address_variables ) {
+    for my $variable ( keys %address_variables ) {
 	my $type = $address_variables{$variable};
 	my $address = "\$$variable";
 
@@ -7942,7 +7943,7 @@ sub add_interface_options( $ ) {
 	#
 	# Generate a digest for each chain
 	#
-	for my $chainref ( sort { $a->{name} cmp $b->{name} } values %input_chains, values %forward_chains ) {
+	for my $chainref ( values %input_chains, values %forward_chains ) {
 	    my $digest = '';
 
 	    assert( $chainref );
@@ -7961,7 +7962,7 @@ sub add_interface_options( $ ) {
 	# Insert jumps to the interface chains into the rules chains
 	#
 	for my $zone1 ( off_firewall_zones ) {
-	    my @input_interfaces   = sort keys %{zone_interfaces( $zone1 )};
+	    my @input_interfaces   = keys %{zone_interfaces( $zone1 )};
 	    my @forward_interfaces = @input_interfaces;
 
 	    if ( @input_interfaces > 1 ) {
@@ -8047,7 +8048,7 @@ sub add_interface_options( $ ) {
 	for my $zone1 ( firewall_zone, vserver_zones ) {
 	    for my $zone2 ( off_firewall_zones ) {
 		my $chainref = $filter_table->{rules_chain( $zone1, $zone2 )};
-		my @interfaces = sort keys %{zone_interfaces( $zone2 )};
+		my @interfaces = keys %{zone_interfaces( $zone2 )};
 		my $chain1ref;
 
 		for my $interface ( @interfaces ) {
@@ -8453,7 +8454,7 @@ sub create_save_ipsets() {
 	    #
 	    $ipsets{$_} = 1 for ( @ipsets, @{$globals{SAVED_IPSETS}} );
 
-	    my @sets = sort keys %ipsets;
+	    my @sets = keys %ipsets;
 
 	    emit( '' ,
 		  '    rm -f $file' ,
@@ -8629,7 +8630,7 @@ sub create_load_ipsets() {
 #
 sub create_nfobjects() {
     
-    my @objects = ( sort keys %nfobjects );
+    my @objects = ( keys %nfobjects );
 
     if ( @objects ) {
 	if ( $config{NFACCT} ) {
@@ -8644,7 +8645,7 @@ sub create_nfobjects() {
 	}
     }
 
-    for ( sort keys %nfobjects ) {
+    for ( keys %nfobjects ) {
 	emit( qq(if ! qt \$NFACCT get $_; then),
 	      qq(    \$NFACCT add $_),
 	      qq(fi\n) );
@@ -9120,7 +9121,7 @@ sub initialize_switches() {
     if ( keys %switches ) {
 	emit( 'if [ $COMMAND = start ]; then' );
 	push_indent;
-	for my $switch ( sort keys %switches ) {
+	for my $switch ( keys %switches ) {
 	    my $setting = $switches{$switch};
 	    my $file = "/proc/net/nf_condition/$switch";
 	    emit "[ -f $file ] && echo $setting->{setting} > $file";

Shorewall/Perl/Shorewall/Compiler.pm

@@ -93,11 +93,10 @@ sub generate_script_1( $ ) {
 	    my $date = compiletime;
 
 	    emit "#!$config{SHOREWALL_SHELL}\n#\n# Compiled firewall script generated by Shorewall $globals{VERSION} - $date\n#";
-
-	    copy  $globals{SHAREDIRPL} . '/lib.runtime', 0;
-	    copy2 $globals{SHAREDIRPL} . '/lib.common' , $debug;
 	}
 
+	copy  $globals{SHAREDIRPL} . '/lib.runtime', 0;
+	copy2 $globals{SHAREDIRPL} . '/lib.common' , $debug;
     }
 
     my $lib = find_file 'lib.private';
@@ -945,7 +944,7 @@ sub compiler {
 	#
 	# Copy the footer to the script
 	#
-	copy $globals{SHAREDIRPL} . 'prog.footer' unless $test;
+	copy $globals{SHAREDIRPL} . 'prog.footer';
 
 	disable_script;
 	#

Shorewall/Perl/Shorewall/Config.pm

@@ -86,6 +86,9 @@ our @EXPORT = qw(
 		 kernel_version
 
                  compiletime
+				       
+		 F_IPV4
+		 F_IPV6
                 );
 
 our @EXPORT_OK = qw( $shorewall_dir initialize shorewall);
@@ -196,9 +199,6 @@ our %EXPORT_TAGS = ( internal => [ qw( create_temp_script
 
                                        PARMSMODIFIED
                                        USEDCALLER
-				       
-		                       F_IPV4
-		                       F_IPV6
 
 				       TCP
 				       UDP
@@ -748,7 +748,7 @@ sub initialize( $;$$) {
 		    TC_SCRIPT               => '',
 		    EXPORT                  => 0,
 		    KLUDGEFREE              => '',
-		    VERSION                 => "5.1.1-RC1",
+		    VERSION                 => "5.1.4-Beta1",
 		    CAPVERSION              => 50100 ,
 		    BLACKLIST_LOG_TAG       => '',
 		    RELATED_LOG_TAG         => '',
@@ -907,6 +907,7 @@ sub initialize( $;$$) {
 	  ZERO_MARKS => undef ,
 	  FIREWALL => undef ,
 	  BALANCE_PROVIDERS => undef ,
+	  PERL_HASH_SEED => undef ,
 	  #
 	  # Packet Disposition
 	  #
@@ -1092,7 +1093,7 @@ sub initialize( $;$$) {
 
     %compiler_params = ();
 
-    %actparams = ( 0 => 0, loglevel => '', logtag => '', chain => '', disposition => '', caller => ''  );
+    %actparams = ( 0 => 0, loglevel => '', logtag => '', chain => '', disposition => '', caller => '', callfile => '', callline => ''  );
     $parmsmodified = 0;
     $usedcaller    = 0;
     %ipsets = ();
@@ -1218,7 +1219,7 @@ sub compiletime() {
 sub currentlineinfo() {
     my $linenumber = $currentlinenumber || 1;
 
-    if ( $currentfile ) {
+    if ( $currentfilename ) {
 	my $lineinfo = " $currentfilename ";
 	
 	if ( $linenumber eq 'EOF' ) {
@@ -2177,7 +2178,7 @@ sub split_list3( $$ ) {
 	    $element = join ',', $element , $_;
 	}
     }
-    
+
     unless ( $opencount == 0 ) {
 	fatal_error "Invalid $type ($list)";
     }
@@ -2232,7 +2233,7 @@ sub split_list4( $ ) {
 sub split_columns( $ ) {
     my ($list) = @_;
 
-    return split ' ', $list unless $list =~ /\(/;
+    return split ' ', $list unless $list =~ /[()]/;
 
     my @list1 = split ' ', $list;
     my @list2;
@@ -2273,9 +2274,7 @@ sub split_columns( $ ) {
 	}
     }
 
-    unless ( $opencount == 0 ) {
-	fatal_error "Mismatched parentheses ($list)";
-    }
+    fatal_error "Mismatched parentheses ($list)" unless $opencount == 0;
 
     @list2;
 }
@@ -2288,7 +2287,7 @@ sub clear_comment();
 #    ensure that it has an appropriate number of columns.
 #    supply '-' in omitted trailing columns.
 #    Handles all of the supported forms of column/pair specification
-#    Handles segragating raw iptables input in INLINE rules
+#    Handles segragating raw iptables input in rules
 #
 sub split_line2( $$;$$$ ) {
     my ( $description, $columnsref, $nopad, $maxcolumns, $inline ) = @_;
@@ -2437,12 +2436,12 @@ sub split_line2( $$;$$$ ) {
 		}
 	    } else {
 		fatal_error "Unknown column ($1)" unless exists $columnsref->{$column};
-		$column = $columnsref->{$column};
-		fatal_error "Non-ASCII gunk in file" if $columns =~ /[^\s[:print:]]/;
 		$value = $1 if $value =~ /^"([^"]+)"$/;
 		$value =~ s/\\"/"/g;
-		fatal_error "Non-ASCII gunk in the value of the $column column" if $columns =~ /[^\s[:print:]]/;
-		$line[$column] = $value;
+		fatal_error "Non-ASCII gunk in the value of the $column column" if $value =~ /[^\s[:print:]]/;
+		my $colnum = $columnsref->{$column};
+		warning_message qq(Replacing "$line[$colnum]" with "$value" in the ) . uc( $column ) . ' column' if $line[$colnum] ne '-';
+		$line[$colnum] = $value;
 	    }
 	}
     }
@@ -2782,7 +2781,7 @@ sub evaluate_expression( $$$$ ) {
 	    my ( $first, $var, $rest ) = ( $1, $3, $4);
 	    $var = numeric_value( $var ) if $var =~ /^\d/;
 	    $val = $var ? $actparams{$var} : $chain;
-	    $usedcaller = USEDCALLER if $var eq 'caller';
+	    $usedcaller = USEDCALLER if $var =~ /^(?:caller|callfile|callline)$/;
 	    $expression = join_parts( $first, $val, $rest , $just_expand );
 	    directive_error( "Variable Expansion Loop" , $filename, $linenumber ) if ++$count > 100;
 	}
@@ -2818,7 +2817,6 @@ sub evaluate_expression( $$$$ ) {
 	#
 	# Not a simple one-term expression -- compile it
 	#
-
 	declare_passed unless $evals++;
 
 	$val = eval qq(package Shorewall::User;
@@ -2835,6 +2833,7 @@ sub evaluate_expression( $$$$ ) {
     $val;
 }
 
+sub pop_open();
 #
 # Set callback
 #
@@ -2842,6 +2841,40 @@ sub directive_callback( $ ) {
     $directive_callback = shift;
 }
 
+sub directive_message( \&$$$$ ) {
+    my ( $functptr, $verbose, $expression, $filename, $linenumber ) = @_;
+
+    unless ( $omitting ) {
+	if ( $actparams{0} ) {
+	    #
+	    # When issuing a message from an action, report the action invocation
+	    # site rather than the action file and line number.
+	    #
+	    # Avoid double-reporting by temporarily removing the invocation site
+	    # from the open stack.
+	    #
+	    my $saveopens = pop @openstack;
+
+	    $functptr->( $verbose ,
+			 evaluate_expression( $expression ,
+					      $filename ,
+					      $linenumber ,
+					      1 ),
+			 $actparams{callfile} ,
+			 $actparams{callline} );
+	    push @openstack, $saveopens;
+	} else {
+	    $functptr->( $verbose ,
+			 evaluate_expression( $expression ,
+					      $filename ,
+					      $linenumber ,
+					      1 ),
+			 $filename ,
+			 $linenumber );
+	}
+    }
+}
+
 #
 # Each entry in @ifstack consists of a 4-tupple
 #
@@ -2855,7 +2888,8 @@ sub process_compiler_directive( $$$$ ) {
 
     print "CD===> $line\n" if $debug;
 
-    directive_error( "Invalid compiler directive ($line)" , $filename, $linenumber ) unless $line =~ /^\s*\?(IF\s+|ELSE|ELSIF\s+|ENDIF|SET\s+|RESET\s+|FORMAT\s+|COMMENT\s*|ERROR\s+|WARNING\s+|INFO\s+|WARNING!\s+|INFO!\s+|REQUIRE\s+)(.*)$/i;
+    directive_error( "Invalid compiler directive ($line)" , $filename, $linenumber )
+	unless $line =~ /^\s*\?(IF\s+|ELSE|ELSIF\s+|ENDIF|SET\s+|RESET\s+|FORMAT\s+|COMMENT\s*|ERROR\s+|WARNING\s+|INFO\s+|WARNING!\s+|INFO!\s+|REQUIRE\s+)(.*)$/i;
 
     my ($keyword, $expression) = ( uc $1, $2 );
 
@@ -2957,15 +2991,16 @@ sub process_compiler_directive( $$$$ ) {
 		      $var = $2 || 'chain';
 		      directive_error( "Shorewall variables may only be RESET in the body of an action", $filename, $linenumber ) unless $actparams{0};
 		      if ( exists $actparams{$var} ) {
-			  if ( $var =~ /^loglevel|logtag|chain|disposition|caller$/ ) {
+			  if ( $var =~ /^(?:loglevel|logtag|chain|disposition|caller|callfile|callline)$/ ) {
 			      $actparams{$var} = '';
 			  } else {
 			      delete $actparams{$var}
 			  }
+
+			  $parmsmodified = PARMSMODIFIED if @ifstack > $ifstack;
 		      } else {
 			  directive_warning( 'Yes', "Shorewall variable $2 does not exist", $filename, $linenumber );
 		      }
-
 		  } else {
 		      if ( exists $variables{$2} ) {
 			  delete $variables{$2};
@@ -2996,68 +3031,85 @@ sub process_compiler_directive( $$$$ ) {
 
 	  ERROR => sub() {
 	      unless ( $omitting ) {
-		  directive_error( evaluate_expression( $expression ,
-							$filename ,
-							$linenumber ,
-							1 ) ,
-				   $filename ,
-				   $linenumber ) unless $omitting;
+		  if ( $actparams{0} ) {
+		      close $currentfile;
+		      #
+		      # Avoid 'missing ?ENDIF' error in pop_open'
+		      #
+		      @ifstack = ();
+		      #
+		      # Avoid double-reporting the action invocation site
+		      #
+		      pop_open;
+
+		      directive_error( evaluate_expression( $expression ,
+							    $filename ,
+							    $linenumber ,
+							    1 ) ,
+				       $actparams{callfile} ,
+				       $actparams{callline} );
+		  } else {
+		      directive_error( evaluate_expression( $expression ,
+							    $filename ,
+							    $linenumber ,
+							    1 ) ,
+				       $filename ,
+				       $linenumber ) unless $omitting;
+		  }
 	      }
 	  } ,
 
 	  WARNING => sub() {
-	      unless ( $omitting ) {
-		  directive_warning( $config{VERBOSE_MESSAGES} ,
-				     evaluate_expression( $expression ,
-							  $filename ,
-							  $linenumber ,
-							  1 ),
-				     $filename ,
-				     $linenumber ) unless $omitting;
-	      }
+	      directive_message( &directive_warning ,
+				 $config{VERBOSE_MESSAGES},
+				 $expression ,
+				 $filename ,
+				 $linenumber );
 	  } ,
 
 	  INFO => sub() {
-	      unless ( $omitting ) {
-		  directive_info( $config{VERBOSE_MESSAGES} ,
-				  evaluate_expression( $expression ,
-						       $filename ,
-						       $linenumber ,
-						       1 ),
-				  $filename ,
-				  $linenumber ) unless $omitting;
-	      }
+	      directive_message( &directive_info,
+				 $config{VERBOSE_MESSAGES} ,
+				 $expression ,
+				 $filename ,
+				 $linenumber );
 	  } ,
 
 	  'WARNING!' => sub() {
-	      unless ( $omitting ) {
-		  directive_warning( ! $config{VERBOSE_MESSAGES} ,
-				     evaluate_expression( $expression ,
-							  $filename ,
-							  $linenumber ,
-							  1 ),
-				     $filename ,
-				     $linenumber ) unless $omitting;
-	      }
+	      directive_message( &directive_warning ,
+				 ! $config{VERBOSE_MESSAGES} ,
+				 $expression ,
+				 $filename ,
+				 $linenumber );
 	  } ,
 
 	  'INFO!' => sub() {
-	      unless ( $omitting ) {
-		  directive_info( ! $config{VERBOSE_MESSAGES} ,
-				  evaluate_expression( $expression ,
-						       $filename ,
-						       $linenumber ,
-						       1 ),
-				  $filename ,
-				  $linenumber ) unless $omitting;
-	      }
+	      directive_message( &directive_info ,
+				 ! $config{VERBOSE_MESSAGES} ,
+				 $expression ,
+				 $filename ,
+				 $linenumber );
 	  } ,
 
 	  REQUIRE => sub() {
 	      unless ( $omitting ) {
 		  fatal_error "?REQUIRE may only be used within action files" unless $actparams{0};
-		  fatal_error "Unknown capability ($expression)" unless exists $capabilities{$expression};
-		  require_capability( $expression, "The $actparams{action} action", 's' );
+		  fatal_error "Unknown capability ($expression)" unless ( my $capdesc = $capdesc{$expression} );
+		  unless ( have_capability( $expression ) ) {
+		      close $currentfile;
+		      #
+		      # Avoid 'missing ?ENDIF' error in pop_open'
+		      #
+		      @ifstack = ();
+		      #
+		      # Avoid double-reporting the action call site
+		      #
+		      pop_open;
+
+		      directive_error( "The $actparams{action} action requires the $capdesc capability",
+				       $actparams{callfile} ,
+				       $actparams{callline} );
+		  }
 	      }
 	  } ,
 
@@ -3559,6 +3611,8 @@ sub push_action_params( $$$$$$ ) {
     $actparams{loglevel}    = $loglevel;
     $actparams{logtag}      = $logtag;
     $actparams{caller}      = $caller;
+    $actparams{callfile}    = $currentfilename;
+    $actparams{callline}    = $currentlinenumber;
     $actparams{disposition} = '' if $chainref->{action};
     #
     # The Shorewall variable '@chain' has non-word characters other than hyphen removed
@@ -3689,6 +3743,7 @@ sub expand_variables( \$ ) {
 	    $usedcaller = USEDCALLER if $var eq 'caller';
 	} else {
 	    fatal_error "Undefined shell variable (\$$var)" unless $config{IGNOREUNKNOWNVARIABLES} || exists $config{$var};
+	    $val = $config{$var};
 	}
 
 	$val = '' unless defined $val;
@@ -5368,8 +5423,12 @@ sub update_config_file( $ ) {
 		    }
 
 		}
-
-		$val = conditional_quote $val;
+		if ( supplied $val ) {
+		    #
+		    # Log LEVEL and DEFAULT settings often contain parens
+		    #
+		    $val = ($var =~ /(?:LEVEL|DEFAULT)$/) ? qq("$val") : conditional_quote $val;
+		}
 
 		$_ = "$var=$val\n";
 	    }
@@ -5432,6 +5491,7 @@ EOF
 sub process_shorewall_conf( $$ ) {
     my ( $update, $annotate ) = @_;
     my $file   = find_file "$product.conf";
+    my @vars;
 
     if ( -f $file ) {
 	$globals{CONFIGDIR} =  $configfile = $file;
@@ -5445,7 +5505,7 @@ sub process_shorewall_conf( $$ ) {
 	    # Don't expand shell variables or allow embedded scripting
 	    #
 	    while ( read_a_line( STRIP_COMMENTS | SUPPRESS_WHITESPACE  | CHECK_GUNK ) ) {
-		if ( $currentline =~ /^\s*([a-zA-Z]\w*)=(.*?)\s*$/ ) {
+		if ( $currentline =~ /^\s*([a-zA-Z]\w*)=(.*)$/ ) {
 		    my ($var, $val) = ($1, $2);
 
 		    if ( exists $config{$var} ) {
@@ -5464,6 +5524,12 @@ sub process_shorewall_conf( $$ ) {
 			next;
 		    }
 
+		    if ( $update ) {
+			push @vars, $var;
+		    } else {
+			expand_variables( $val ) unless $val =~ /^'.*'$/;
+		    }
+
 		    $config{$var} = ( $val =~ /\"([^\"]*)\"$/ ? $1 : $val );
 
 		    warning_message "Option $var=$val is deprecated"
@@ -5484,14 +5550,19 @@ sub process_shorewall_conf( $$ ) {
     #
     # Now update the config file if asked
     #
-    update_config_file( $annotate ) if $update;
-    #
-    # Config file update requires that the option values not have
-    # Shell variables expanded. We do that now.
-    #
-    for ( values  %config ) {
-	if ( supplied $_ ) {
-	    expand_variables( $_ ) unless /^'(.+)'$/;
+    if ( $update ) {
+	update_config_file( $annotate ); 
+	#
+	# Config file update requires that the option values not have
+	# Shell variables expanded. We do that now.
+	#
+	# To handle options like LOG_LEVEL, we process the options
+	# in the order in which they appear in the .conf file.
+	#
+	for ( @vars ) {
+	    if ( supplied( my $val = $config{$_} ) ) {
+		expand_variables( $config{$_} ) unless $val =~ /^'.*'$/;
+	    }
 	}
     }
 }

Shorewall/Perl/Shorewall/IPAddrs.pm

@@ -389,6 +389,8 @@ sub resolve_proto( $ ) {
     my $proto = $_[0];
     my $number;
 
+    $proto =~ s/:.*//;
+
     if ( $proto =~ /^\d+$/ || $proto =~ /^0x/ ) {
 	$number = numeric_value ( $proto );
 	defined $number && $number <= 255 ? $number : undef;

Shorewall/Perl/Shorewall/Misc.pm

@@ -127,7 +127,7 @@ sub setup_ecn()
 	}
 
 	if ( @hosts ) {
-	    my @interfaces = ( sort { interface_number($a) <=> interface_number($b) } keys %interfaces );
+	    my @interfaces = ( keys %interfaces );
 
 	    progress_message "$doing ECN control on @interfaces...";
 
@@ -1213,55 +1213,53 @@ sub add_common_rules ( $ ) {
 	}
     }
 
-    if ( $family == F_IPV4 ) {
-	my $announced = 0;
+    my $announced = 0;
 
-	$list = find_interfaces_by_option 'upnp';
+    $list = find_interfaces_by_option 'upnp';
 
-	if ( @$list ) {
-	    progress_message2 "$doing UPnP";
+    if ( @$list ) {
+	progress_message2 "$doing UPnP";
 
-	    $chainref = set_optflags( new_nat_chain( 'UPnP' ), DONT_OPTIMIZE );
+	$chainref = set_optflags( new_nat_chain( 'UPnP' ), DONT_OPTIMIZE );
 
-	    add_commands( $chainref, '[ -s /${VARDIR}/.UPnP ] && cat ${VARDIR}/.UPnP >&3' );
+	add_commands( $chainref, '[ -s /${VARDIR}/.UPnP ] && cat ${VARDIR}/.UPnP >&3' );
 
-	    my $chainref1;
+	my $chainref1;
 
-	    if ( $config{MINIUPNPD} ) {
-		$chainref1 = set_optflags( new_nat_chain( 'MINIUPNPD-POSTROUTING' ), DONT_OPTIMIZE ); 
-		add_commands( $chainref, '[ -s /${VARDIR}/.MINIUPNPD-POSTROUTING ] && cat ${VARDIR}/.MINIUPNPD-POSTROUTING >&3' );
-	    }
-
-	    $announced = 1;
-
-	    for $interface ( @$list ) {
-		add_ijump_extended $nat_table->{PREROUTING} ,            j => 'UPnP',                   get_interface_origin($interface), imatch_source_dev ( $interface );
-		add_ijump_extended $nat_table->{$globals{POSTROUTING}} , j => 'MINIUPNPD-POSTROUTING' , $origin{MINIUPNPD}              , imatch_dest_dev   ( $interface ) if $chainref1;
-	    }
+	if ( $config{MINIUPNPD} ) {
+	    $chainref1 = set_optflags( new_nat_chain( 'MINIUPNPD-POSTROUTING' ), DONT_OPTIMIZE ); 
+	    add_commands( $chainref, '[ -s /${VARDIR}/.MINIUPNPD-POSTROUTING ] && cat ${VARDIR}/.MINIUPNPD-POSTROUTING >&3' );
 	}
 
-	$list = find_interfaces_by_option 'upnpclient';
+	$announced = 1;
 
-	if ( @$list ) {
-	    progress_message2 "$doing UPnP" unless $announced;
+	for $interface ( @$list ) {
+	    add_ijump_extended $nat_table->{PREROUTING} ,            j => 'UPnP',                   get_interface_origin($interface), imatch_source_dev ( $interface );
+	    add_ijump_extended $nat_table->{$globals{POSTROUTING}} , j => 'MINIUPNPD-POSTROUTING' , $origin{MINIUPNPD}              , imatch_dest_dev   ( $interface ) if $chainref1;
+	}
+    }
 
-	    for $interface ( @$list ) {
-		my $chainref = $filter_table->{input_option_chain $interface};
-		my $base     = uc var_base get_physical $interface;
-		my $optional = interface_is_optional( $interface );
-		my $variable = get_interface_gateway( $interface, ! $optional );
-		my $origin   = get_interface_origin( $interface );
+    $list = find_interfaces_by_option 'upnpclient';
 
-		if ( $optional ) {
-		    add_commands( $chainref,
-				  qq(if [ -n "SW_\$${base}_IS_USABLE" -a -n "$variable" ]; then) );
-		    incr_cmd_level( $chainref );
-		    add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
-		    decr_cmd_level( $chainref );
-		    add_commands( $chainref, 'fi' );
-		} else {
-		    add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
-		}
+    if ( @$list ) {
+	progress_message2 "$doing UPnP" unless $announced;
+
+	for $interface ( @$list ) {
+	    my $chainref = $filter_table->{input_option_chain $interface};
+	    my $base     = uc var_base get_physical $interface;
+	    my $optional = interface_is_optional( $interface );
+	    my $variable = get_interface_gateway( $interface, ! $optional );
+	    my $origin   = get_interface_origin( $interface );
+
+	    if ( $optional ) {
+		add_commands( $chainref,
+			      qq(if [ -n "SW_\$${base}_IS_USABLE" -a -n "$variable" ]; then) );
+		incr_cmd_level( $chainref );
+		add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
+		decr_cmd_level( $chainref );
+		add_commands( $chainref, 'fi' );
+	    } else {
+		add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
 	    }
 	}
     }
@@ -1297,7 +1295,7 @@ sub setup_mac_lists( $ ) {
 	$maclist_interfaces{ $hostref->[0] } = 1;
     }
 
-    my @maclist_interfaces = ( sort keys %maclist_interfaces );
+    my @maclist_interfaces = ( keys %maclist_interfaces );
 
     if ( $phase == 1 ) {
 
@@ -1618,7 +1616,7 @@ sub handle_loopback_traffic() {
 	    # Handle conntrack rules
 	    #
 	    if ( $notrackref->{referenced} ) {
-		for my $hostref ( sort { $a->{type} cmp $b->{type} } @{defined_zone( $z1 )->{hosts}{ip}{'%vserver%'}} ) {
+		for my $hostref ( @{defined_zone( $z1 )->{hosts}{ip}{'%vserver%'}} ) {
 		    my $exclusion   = source_exclusion( $hostref->{exclusions}, $notrackref);
 		    my @ipsec_match = match_ipsec_in $z1 , $hostref;
 
@@ -1639,8 +1637,8 @@ sub handle_loopback_traffic() {
 	    #
 	    my $source_hosts_ref = defined_zone( $z1 )->{hosts};
 
-	    for my $typeref ( sort { $a->{type} cmp $b->{type} } values %{$source_hosts_ref} ) {
-		for my $hostref ( sort { $a->{type} cmp $b->{type} } @{$typeref->{'%vserver%'}} ) {
+	    for my $typeref ( values %{$source_hosts_ref} ) {
+		for my $hostref ( @{$typeref->{'%vserver%'}} ) {
 		    my $exclusion   = source_exclusion( $hostref->{exclusions}, $natref);
 
 		    for my $net ( @{$hostref->{hosts}} ) {
@@ -1662,7 +1660,7 @@ sub add_interface_jumps {
     our %input_jump_added;
     our %output_jump_added;
     our %forward_jump_added;
-    my @interfaces = sort grep $_ ne '%vserver%', @_;
+    my @interfaces = grep $_ ne '%vserver%', @_;
     my $dummy;
     my $lo_jump_added = interface_zone( loopback_interface ) && ! get_interface_option( loopback_interface, 'destonly' );
     #
@@ -1776,7 +1774,7 @@ sub handle_complex_zone( $$ ) {
 	my $type       = $zoneref->{type};
 	my $source_ref = ( $zoneref->{hosts}{ipsec} ) || {};
 
-	for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$source_ref ) {
+	for my $interface ( keys %$source_ref ) {
 	    my $sourcechainref = $filter_table->{forward_chain $interface};
 	    my @interfacematch;
 	    my $interfaceref = find_interface $interface;
@@ -2288,9 +2286,9 @@ sub generate_matrix() {
 	#
 	# Take care of PREROUTING, INPUT and OUTPUT jumps
 	#
-	for my $type ( sort keys %$source_hosts_ref ) {
+	for my $type ( keys %$source_hosts_ref ) {
 	    my $typeref = $source_hosts_ref->{$type};
-	    for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$typeref ) {
+	    for my $interface ( keys %$typeref ) {
 		if ( get_physical( $interface ) eq '+' ) {
 		    #
 		    # Insert the interface-specific jumps before this one which is not interface-specific
@@ -2375,9 +2373,9 @@ sub generate_matrix() {
 
 		my $chainref = $filter_table->{$chain}; #Will be null if $chain is a Netfilter Built-in target like ACCEPT
 
-		for my $type ( sort keys %{$zone1ref->{hosts}} ) {
+		for my $type ( keys %{$zone1ref->{hosts}} ) {
 		    my $typeref = $zone1ref->{hosts}{$type};
-		    for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$typeref ) {
+		    for my $interface ( keys %$typeref ) {
 			for my $hostref ( @{$typeref->{$interface}} ) {
 			    next if $hostref->{options}{sourceonly};
 			    if ( $zone ne $zone1 || $num_ifaces > 1 || $hostref->{options}{routeback} ) {

Shorewall/Perl/Shorewall/Providers.pm

@@ -64,6 +64,8 @@ our @load_interfaces;
 
 our $balancing;
 our $fallback;
+our $balanced_providers;
+our $fallback_providers;
 our $metrics;
 our $first_default_route;
 our $first_fallback_route;
@@ -99,6 +101,8 @@ sub initialize( $ ) {
     %provider_interfaces    = ();
     @load_interfaces        = ();
     $balancing              = 0;
+    $balanced_providers     = 0;
+    $fallback_providers     = 0;
     $fallback               = 0;
     $metrics                = 0;
     $first_default_route    = 1;
@@ -323,7 +327,13 @@ sub balance_default_route( $$$$ ) {
     emit '';
 
     if ( $first_default_route ) {
-	if ( $gateway ) {
+	if ( $balanced_providers == 1 ) {
+	    if ( $gateway ) {
+		emit "DEFAULT_ROUTE=\"via $gateway dev $interface $realm\"";
+	    } else {
+		emit "DEFAULT_ROUTE=\"dev $interface $realm\"";
+	    }
+	} elsif ( $gateway ) {
 	    emit "DEFAULT_ROUTE=\"nexthop via $gateway dev $interface weight $weight $realm\"";
 	} else {
 	    emit "DEFAULT_ROUTE=\"nexthop dev $interface weight $weight $realm\"";
@@ -347,7 +357,13 @@ sub balance_fallback_route( $$$$ ) {
     emit '';
 
     if ( $first_fallback_route ) {
-	if ( $gateway ) {
+	if ( $balanced_providers == 1 ) {
+	    if ( $gateway ) {
+		emit "FALLBACK_ROUTE=\"via $gateway dev $interface $realm\"";
+	    } else {
+		emit "FALLBACK_ROUTE=\"dev $interface $realm\"";
+	    }
+	} elsif ( $gateway ) {
 	    emit "FALLBACK_ROUTE=\"nexthop via $gateway dev $interface weight $weight $realm\"";
 	} else {
 	    emit "FALLBACK_ROUTE=\"nexthop dev $interface weight $weight $realm\"";
@@ -593,7 +609,12 @@ sub process_a_provider( $ ) {
 	}
     }
 
-    fatal_error q(The 'balance' and 'fallback' options are mutually exclusive) if $balance && $default;
+    if ( $balance ) {
+	fatal_error q(The 'balance' and 'fallback' options are mutually exclusive) if $default;
+	$balanced_providers++;
+    } elsif ( $default ) {
+	$fallback_providers++;
+    }
 
     if ( $load ) {
 	fatal_error q(The 'balance=<weight>' and 'load=<load-factor>' options are mutually exclusive) if $balance > 1;
@@ -1534,9 +1555,9 @@ sub finish_providers() {
 	} else {
 	    emit  ( "    if echo \$DEFAULT_ROUTE | grep -q 'nexthop.+nexthop'; then",
 		    "        qt \$IP -6 route delete default scope global table $table \$DEFAULT_ROUTE",
-		    "        run_ip -6 route add default scope global table $table \$DEFAULT_ROUTE",
+		    "        run_ip route add default scope global table $table \$DEFAULT_ROUTE",
 		    '    else',
-		    "        run_ip -6 route replace default scope global table $table \$DEFAULT_ROUTE",
+		    "        run_ip route replace default scope global table $table \$DEFAULT_ROUTE",
 		    '    fi',
 		    '' );
 	}
@@ -1799,7 +1820,7 @@ sub map_provider_to_interface() {
 
     my $haveoptional;
 
-    for my $providerref ( sort { $a->{number} cmp $b->{number} } values %providers ) {
+    for my $providerref ( values %providers ) {
 	if ( $providerref->{optional} ) {
 	    unless ( $haveoptional++ ) {
 		emit( 'if [ -n "$interface" ]; then',
@@ -1963,7 +1984,7 @@ sub compile_updown() {
     }
 
     my @nonshared = ( grep $providers{$_}->{optional},
-		      sort( { $providers{$a}->{number} <=> $providers{$b}->{number} } values %provider_interfaces ) );
+		      values %provider_interfaces );
 
     if ( @nonshared ) {
 	my $interfaces = join( '|', map $providers{$_}->{physical}, @nonshared );
@@ -2158,7 +2179,7 @@ sub handle_optional_interfaces( $ ) {
     # names but they might derive from wildcard interface entries. Optional interfaces which do not have
     # wildcard physical names are also included in the providers table.
     #
-    for my $providerref ( grep $_->{optional} , sort { $a->{number} <=> $b->{number} } values %providers ) {
+    for my $providerref ( grep $_->{optional} , values %providers ) {
 	push @interfaces, $providerref->{interface};
 	$wildcards ||= $providerref->{wildcard};
     }

Shorewall/Perl/Shorewall/Proxyarp.pm

@@ -154,7 +154,7 @@ sub setup_proxy_arp() {
 
 	emit '';
 
-	for my $interface ( sort keys %reset ) {
+	for my $interface ( keys %reset ) {
 	    unless ( $set{interface} ) {
 		my $physical = get_physical $interface;
 		emit  ( "if [ -f /proc/sys/net/ipv$family/conf/$physical/$proc_file ]; then" ,
@@ -163,7 +163,7 @@ sub setup_proxy_arp() {
 	    }
 	}
 
-	for my $interface ( sort keys %set ) {
+	for my $interface ( keys %set ) {
 	    my $physical = get_physical $interface;
 	    emit  ( "if [ -f /proc/sys/net/ipv$family/conf/$physical/$proc_file ]; then" ,
 		    "    echo 1 > /proc/sys/net/ipv$family/conf/$physical/$proc_file" );

Shorewall/Perl/Shorewall/Rules.pm

@@ -144,8 +144,6 @@ our %macros;
 
 our $family;
 
-our @builtins;
-
 #
 # Commands that can be embedded in a basic rule and how many total tokens on the line (0 => unlimited).
 #
@@ -352,7 +350,7 @@ sub initialize( $ ) {
     #
     $macro_nest_level  = 0;
     #
-    # All builtin actions plus those mentioned in /etc/shorewall[6]/actions and /usr/share/shorewall[6]/actions.std
+    # All actions mentioned in /etc/shorewall[6]/actions and /usr/share/shorewall[6]/actions.std
     #
     %actions           = ();
     #
@@ -363,7 +361,6 @@ sub initialize( $ ) {
     @columns           = ( ( '-' ) x LAST_COLUMN, 0 );
 
     if ( $family == F_IPV4 ) {
-	@builtins = qw/dropBcast dropMcast allowBcast allowMcast dropNotSyn rejNotSyn allowinUPnP forwardUPnP Limit/;
 	%reject_options = ( 'icmp-net-unreachable'   => 1,
 			    'icmp-host-unreachable'  => 1,
 			    'icmp-port-unreachable'  => 1,
@@ -376,7 +373,6 @@ sub initialize( $ ) {
 	                  );
 			    
     } else {
-	@builtins = qw/dropBcast dropMcast allowBcast allowMcast dropNotSyn rejNotSyn/;
 	%reject_options = ( 'icmp6-no-route'         => 1,
 			    'no-route'               => 1,
 			    'icmp6-adm-prohibited'   => 1,
@@ -621,7 +617,7 @@ sub handle_nfqueue( $$ ) {
 	    fatal_error "Invalid NFQUEUE queue number ($queue1)" unless defined( $queuenum1) && $queuenum1 >= 0 && $queuenum1 <= 65535;
 
 	    if ( supplied $queue2 ) {
-		$fanout    = ' --queue-cpu-fanout' if $queue2 =~ s/c$//;
+		$fanout    = $queue2 =~ s/c$// ? ' --queue-cpu-fanout' : '';
 		$queuenum2 = numeric_value( $queue2 );
 
 		fatal_error "Invalid NFQUEUE queue number ($queue2)" unless defined( $queuenum2) && $queuenum2 >= 0 && $queuenum2 <= 65535 && $queuenum1 < $queuenum2;
@@ -751,22 +747,21 @@ sub process_a_policy1($$$$$$$) {
 	if ( $serverwild ) {
 	    for my $zone ( @zonelist ) {
 		for my $zone1 ( @zonelist ) {
-		    set_policy_chain rules_chain( ${zone}, ${zone1} ), $client, $server, $chainref, $policy, $intrazone;
+		    set_policy_chain rules_chain( ${zone}, ${zone1} ), $zone, $zone1, $chainref, $policy, $intrazone;
 		    print_policy $zone, $zone1, $originalpolicy, $chain;
 		}
 	    }
 	} else {
 	    for my $zone ( all_zones ) {
-		set_policy_chain rules_chain( ${zone}, ${server} ), $client, $server, $chainref, $policy, $intrazone;
+		set_policy_chain rules_chain( ${zone}, ${server} ), $zone, $server, $chainref, $policy, $intrazone;
 		print_policy $zone, $server, $originalpolicy, $chain;
 	    }
 	}
     } elsif ( $serverwild ) {
 	for my $zone ( @zonelist ) {
-	    set_policy_chain rules_chain( ${client}, ${zone} ), $client, $server, $chainref, $policy, $intrazone;
+	    set_policy_chain rules_chain( ${client}, ${zone} ), $client, $zone, $chainref, $policy, $intrazone;
 	    print_policy $client, $zone, $originalpolicy, $chain;
 	}
-
     } else {
 	print_policy $client, $server, $originalpolicy, $chain;
     }
@@ -1710,191 +1705,6 @@ sub map_old_actions( $ ) {
     }
 }
 
-#
-# The following small functions generate rules for the builtin actions of the same name
-#
-sub dropBcast( $$$$ ) {
-    my ($chainref, $level, $tag, $audit) = @_;
-
-    my $target = require_audit ( 'DROP', $audit );
-
-    if ( have_capability( 'ADDRTYPE' ) ) {
-	if ( $level ne '' ) {
-	    log_irule_limit( $level, $chainref, 'dropBcast' , 'DROP', [], $tag, 'add', '', addrtype => '--dst-type BROADCAST' );
-	    if ( $family == F_IPV4 ) {
-		log_irule_limit( $level, $chainref, 'dropBcast' , 'DROP', [], $tag, 'add', '', d => '224.0.0.0/4' );
-	    } else {
-		log_irule_limit( $level, $chainref, 'dropBcast' , 'DROP', [], $tag, 'add', '', d => IPv6_MULTICAST );
-	    }
-	}
-
-	add_ijump $chainref, j => $target, addrtype => '--dst-type BROADCAST';
-    } else {
-	if ( $family == F_IPV4 ) {
-	    add_commands $chainref, 'for address in $ALL_BCASTS; do';
-	} else {
-	    add_commands $chainref, 'for address in $ALL_ACASTS; do';
-	}
-
-	incr_cmd_level $chainref;
-	log_irule_limit( $level, $chainref, 'dropBcast' , 'DROP', [], $tag, 'add', '', d => '$address' ) if $level ne '';
-	add_ijump $chainref, j => $target, d => '$address';
-	decr_cmd_level $chainref;
-	add_commands $chainref, 'done';
-    }
-}
-
-sub dropMcast( $$$$ ) {
-    my ($chainref, $level, $tag, $audit) = @_;
-
-    my $target = require_audit ( 'DROP', $audit );
-
-    if ( $family == F_IPV4 ) {
-	log_irule_limit $level, $chainref, 'dropMcast' , 'DROP', [], $tag, 'add', '', d => '224.0.0.0/4' if $level ne '';
-	add_ijump $chainref, j => $target, d => '224.0.0.0/4';
-    } else {
-	log_irule_limit( $level, $chainref, 'dropMcast' , 'DROP', [], $tag, 'add', '', d => IPv6_MULTICAST ) if $level ne '';
-	add_ijump $chainref, j => $target, d => IPv6_MULTICAST;
-    }
-}
-    
-sub allowBcast( $$$$ ) {
-    my ($chainref, $level, $tag, $audit) = @_;
-
-    my $target = require_audit( 'ACCEPT', $audit );
-
-    if ( $family == F_IPV4 && have_capability( 'ADDRTYPE' ) ) {
-	if ( $level ne '' ) {
-	    log_irule_limit( $level, $chainref, 'allowBcast' , 'ACCEPT', [], $tag, 'add', '', addrtype => '--dst-type BROADCAST' );
-	    log_irule_limit( $level, $chainref, 'allowBcast' , 'ACCEPT', [], $tag, 'add', '', d => '224.0.0.0/4' );
-	}
-
-	add_ijump $chainref, j => $target, addrtype => '--dst-type BROADCAST';
-    } else {
-	if ( $family == F_IPV4 ) {
-	    add_commands $chainref, 'for address in $ALL_BCASTS; do';
-	} else {
-	    add_commands $chainref, 'for address in $ALL_MACASTS; do';
-	}
-
-	incr_cmd_level $chainref;
-	log_irule_limit( $level, $chainref, 'allowBcast' , 'ACCEPT', [], $tag, 'add', '', d => '$address' ) if $level ne '';
-	add_ijump $chainref, j => $target, d => '$address';
-	decr_cmd_level $chainref;
-	add_commands $chainref, 'done';
-    }
-}
-
-sub allowMcast( $$$$ ) {
-    my ($chainref, $level, $tag, $audit) = @_;
-
-    my $target = require_audit( 'ACCEPT', $audit );
-
-    if ( $family == F_IPV4 ) {
-	log_irule_limit( $level, $chainref, 'allowMcast' , 'ACCEPT', [], $tag, 'add', '', d => '224.0.0.0/4' ) if $level ne '';
-	add_ijump $chainref, j => $target, d => '224.0.0.0/4';
-    } else {
-	log_irule_limit( $level, $chainref, 'allowMcast' , 'ACCEPT', '', $tag, 'add',  '', d => IPv6_MULTICAST ) if $level ne '';
-	add_ijump $chainref, j => $target, d => IPv6_MULTICAST;
-    }
-}
-
-sub dropNotSyn ( $$$$ ) {
-    my ($chainref, $level, $tag, $audit) = @_;
-
-    my $target = require_audit( 'DROP', $audit );
-
-    log_irule_limit( $level, $chainref, 'dropNotSyn' , 'DROP', [], $tag, 'add', '', p => '6 ! --syn' ) if $level ne '';
-    add_ijump $chainref , j => $target, p => '6 ! --syn';
-}
-
-sub rejNotSyn ( $$$$ ) {
-    my ($chainref, $level, $tag, $audit) = @_;
-
-    warning_message "rejNotSyn is deprecated in favor of NotSyn(REJECT)";
-
-    my $target = 'REJECT --reject-with tcp-reset';
-
-    if ( supplied $audit ) {
-	$target = require_audit( 'REJECT' , $audit );
-    }
-
-    log_irule_limit( $level, $chainref, 'rejNotSyn' , 'REJECT', [], $tag, 'add', '', p => '6 ! --syn' ) if $level ne '';
-    add_ijump $chainref , j => $target, p => '6 ! --syn';
-}
-
-sub forwardUPnP ( $$$$ ) {
-    my $chainref = set_optflags( 'forwardUPnP', DONT_OPTIMIZE );
-
-    add_commands( $chainref , '[ -f ${VARDIR}/.forwardUPnP ] && cat ${VARDIR}/.forwardUPnP >&3' );
-}
-
-sub allowinUPnP ( $$$$ ) {
-    my ($chainref, $level, $tag, $audit) = @_;
-
-    my $target = require_audit( 'ACCEPT', $audit );
-
-    if ( $level ne '' ) {
-	log_irule_limit( $level, $chainref, 'allowinUPnP' , 'ACCEPT', [], $tag, 'add', '', p => '17 --dport 1900' );
-	log_irule_limit( $level, $chainref, 'allowinUPnP' , 'ACCEPT', [], $tag, 'add', '', p => '6 --dport 49152' );
-    }
-
-    add_ijump $chainref, j => $target, p => '17 --dport 1900';
-    add_ijump $chainref, j => $target, p => '6 --dport 49152';
-}
-
-sub Limit( $$$$ ) {
-    my ($chainref, $level, $tag, $param ) = @_;
-
-    my @param;
-
-    if ( $param ) {
-	@param = split /,/, $param;
-    } else {
-	@param = split /,/, $tag;
-	$tag = '';
-    }
-
-    fatal_error 'Limit rules must include <set name>,<max connections>,<interval> as the log tag or as parameters' unless @param == 3;
-
-    my $set   = $param[0];
-
-    for ( @param[1,2] ) {
-	fatal_error 'Max connections and interval in Limit rules must be numeric (' . join( ':', 'Limit', $level eq '' ? 'none' : $level, $tag ) . ')' unless /^\d+$/
-    }
-
-    my $count = $param[1] + 1;
-
-    require_capability( 'RECENT_MATCH' , 'Limit rules' , '' );
-
-    warning_message "The Limit action is deprecated in favor of per-IP rate limiting using the RATE LIMIT column";
-
-    add_irule $chainref, recent => "--name $set --set";
-
-    if ( $level ne '' ) {
-	my $xchainref = new_chain 'filter' , "$chainref->{name}%";
-	log_irule_limit( $level, $xchainref, $param[0], 'DROP', [], $tag, 'add' , '' );
-	add_ijump $xchainref, j => 'DROP';
-	add_ijump $chainref,  j => $xchainref, recent => "--name $set --update --seconds $param[2] --hitcount $count";
-    } else {
-	add_ijump $chainref, j => 'DROP', recent => "--update --name $set --seconds $param[2] --hitcount $count";
-    }
-
-    add_ijump $chainref, j => 'ACCEPT';
-}
-
-my %builtinops = ( 'dropBcast'      => \&dropBcast,
-		   'dropMcast'      => \&dropMcast,
-		   'allowBcast'     => \&allowBcast,
-		   'allowMcast'     => \&allowMcast,
-		   'dropNotSyn'     => \&dropNotSyn,
-		   'rejNotSyn'      => \&rejNotSyn,
-		   'allowinUPnP'    => \&allowinUPnP,
-		   'forwardUPnP'    => \&forwardUPnP,
-		   'Limit'          => \&Limit,
-		 );
-
-
 sub process_rule ( $$$$$$$$$$$$$$$$$$$$ );
 sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$$ );
 sub process_snat1( $$$$$$$$$$$$ );
@@ -1916,12 +1726,6 @@ sub process_action(\$\$$) {
     my $actionref = $actions{$action};
     my $matches   = fetch_inline_matches;
 
-    if ( $type & BUILTIN ) {
-	$level = '' if $level =~ /none!?/;
-	$builtinops{$action}->( $chainref, $level, $tag, $param );
-	return 0;
-    }
-
     if ( $type & MANGLE_TABLE ) {
 	fatal_error "Action $action may only be used in the mangle file" unless $chainref->{table} eq 'mangle';
     } else {
@@ -2194,7 +1998,6 @@ sub process_action(\$\$$) {
 #
 # This function is called prior to processing of the policy file. It:
 #
-# - Adds the builtin actions to the target table
 # - Reads actions.std and actions (in that order) and for each entry:
 #   o Adds the action to the target table
 #   o Verifies that the corresponding action file exists
@@ -2203,10 +2006,6 @@ sub process_action(\$\$$) {
 sub process_actions() {
 
     progress_message2 "Locating Action Files...";
-    #
-    # Add built-in actions to the target table and create those actions
-    #
-    $targets{$_} = new_action( $_ , ACTION + BUILTIN, NOINLINE_OPT, '' , '' ) for @builtins;
 
     for my $file ( qw/actions.std actions/ ) {
 	open_file( $file, 2 );

Shorewall/Perl/Shorewall/Tc.pm

@@ -1924,7 +1924,7 @@ sub process_traffic_shaping() {
 
 			my ( $options, $redopts ) = ( '', $tcref->{redopts} );
 
-			for my $option ( sort keys %validredoptions ) {
+			for my $option ( keys %validredoptions ) {
 			    my $type = $validredoptions{$option};
 
 			    if ( my $value = $redopts->{$option} ) {
@@ -1943,7 +1943,7 @@ sub process_traffic_shaping() {
 
 			my ( $options, $codelopts ) = ( '', $tcref->{codelopts} );
 
-			for my $option ( sort keys %validcodeloptions ) {
+			for my $option ( keys %validcodeloptions ) {
 			    my $type = $validcodeloptions{$option};
 
 			    if ( my $value = $codelopts->{$option} ) {

Shorewall/Perl/Shorewall/Zones.pm

@@ -108,24 +108,6 @@ our @EXPORT = ( qw( NOTHING
 
 our @EXPORT_OK = qw( initialize );
 our $VERSION = 'MODULEVERSION';
-
-#
-# IPSEC Option types
-#
-use constant { NOTHING    => 'NOTHING',
-	       NUMERIC    => '0x[\da-fA-F]+|\d+',
-	       NETWORK    => '\d+.\d+.\d+.\d+(\/\d+)?',
-	       IPSECPROTO => 'ah|esp|ipcomp',
-	       IPSECMODE  => 'tunnel|transport'
-	       };
-
-#
-# Option columns
-#
-use constant { IN_OUT     => 1,
-	       IN         => 2,
-	       OUT        => 3 };
-
 #
 # Zone Table.
 #
@@ -221,6 +203,26 @@ our $zonemarkincr;
 our $zonemarklimit;
 our $loopback_interface;
 
+#
+# IPSEC Option types
+#
+use constant { NOTHING    => 'NOTHING',
+	       NUMERIC    => '0x[\da-fA-F]+|\d+',
+	       IPSECPROTO => 'ah|esp|ipcomp',
+	       IPSECMODE  => 'tunnel|transport'
+	     };
+
+sub NETWORK() {
+    $family == F_IPV4 ? '\d+.\d+.\d+.\d+(\/\d+)?' : '(?:[0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}(?:\/d+)?';
+}
+
+#
+# Option columns
+#
+use constant { IN_OUT     => 1,
+	       IN         => 2,
+	       OUT        => 3 };
+
 use constant { FIREWALL => 1,
 	       IP       => 2,
 	       BPORT    => 4,
@@ -276,19 +278,7 @@ our %maxoptionvalue = ( routefilter => 2, mss => 100000 , wait => 120 , ignore =
 
 our %validhostoptions;
 
-our %validzoneoptions = ( mss            => NUMERIC,
-			  nomark         => NOTHING,
-			  blacklist      => NOTHING,
-			  dynamic_shared => NOTHING,
-			  strict         => NOTHING,
-			  next           => NOTHING,
-			  reqid          => NUMERIC,
-			  spi            => NUMERIC,
-			  proto          => IPSECPROTO,
-			  mode           => IPSECMODE,
-			 "tunnel-src"   => NETWORK,
-			 "tunnel-dst"   => NETWORK,
-		       );
+our %validzoneoptions;
 
 use constant { UNRESTRICTED => 1, NOFW => 2 , COMPLEX => 8, IN_OUT_ONLY => 16 };
 #
@@ -330,6 +320,20 @@ sub initialize( $$ ) {
     $minroot = 0;
     $loopback_interface = '';
 
+    %validzoneoptions = ( mss            => NUMERIC,
+			  nomark         => NOTHING,
+			  blacklist      => NOTHING,
+			  dynamic_shared => NOTHING,
+			  strict         => NOTHING,
+			  next           => NOTHING,
+			  reqid          => NUMERIC,
+			  spi            => NUMERIC,
+			  proto          => IPSECPROTO,
+			  mode           => IPSECMODE,
+			 "tunnel-src"   => NETWORK,
+			 "tunnel-dst"   => NETWORK,
+		       );
+
     if ( $family == F_IPV4 ) {
 	%validinterfaceoptions = (arp_filter  => BINARY_IF_OPTION,
 				  arp_ignore  => ENUM_IF_OPTION,
@@ -407,6 +411,8 @@ sub initialize( $$ ) {
 				    forward     => BINARY_IF_OPTION,
 				    physical    => STRING_IF_OPTION + IF_OPTION_HOST,
 				    unmanaged   => SIMPLE_IF_OPTION,
+				    upnp        => SIMPLE_IF_OPTION,
+				    upnpclient  => SIMPLE_IF_OPTION,
 				    wait        => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
 				 );
 	%validhostoptions = (
@@ -713,10 +719,10 @@ sub zone_report()
 	my $printed = 0;
 
 	if ( $hostref ) {
-	    for my $type ( sort keys %$hostref ) {
+	    for my $type ( keys %$hostref ) {
 		my $interfaceref = $hostref->{$type};
 
-		for my $interface ( sort keys %$interfaceref ) {
+		for my $interface ( keys %$interfaceref ) {
 		    my $iref     = $interfaces{$interface};
 		    my $arrayref = $interfaceref->{$interface};
 
@@ -766,10 +772,10 @@ sub dump_zone_contents() {
 	$entry .= ( " mark=" . in_hex( $zoneref->{mark} ) ) if exists $zoneref->{mark};
 
 	if ( $hostref ) {
-	    for my $type ( sort keys %$hostref ) {
+	    for my $type ( keys %$hostref ) {
 		my $interfaceref = $hostref->{$type};
 
-		for my $interface ( sort keys %$interfaceref ) {
+		for my $interface ( keys %$interfaceref ) {
 		    my $iref     = $interfaces{$interface};
 		    my $arrayref = $interfaceref->{$interface};
 
@@ -1313,7 +1319,7 @@ sub process_interface( $$ ) {
 		    assert(0);
 		}
 	    } elsif ( $type == STRING_IF_OPTION ) {
-		fatal_error "The '$option' option requires a value" unless defined $value;
+		fatal_error "The '$option' option requires a value" unless supplied $value;
 
 		if ( $option eq 'physical' ) {
 		    fatal_error "Invalid interface name ($interface)" if $interface =~ /[()\[\]\*\?%]/;
@@ -2219,9 +2225,9 @@ sub find_hosts_by_option( $ ) {
     }
 
     for my $zone ( grep ! ( $zones{$_}{type} & FIREWALL ) , @zones ) {
-	for my $type (sort keys %{$zones{$zone}{hosts}} ) {
+	for my $type (keys %{$zones{$zone}{hosts}} ) {
 	    my $interfaceref = $zones{$zone}{hosts}->{$type};
-	    for my $interface ( sort keys %$interfaceref ) {
+	    for my $interface ( keys %$interfaceref ) {
 		my $arrayref = $interfaceref->{$interface};
 		for my $host ( @{$arrayref} ) {
 		    my $ipsec  = $host->{ipsec};
@@ -2249,9 +2255,9 @@ sub find_zone_hosts_by_option( $$ ) {
     my @hosts;
 
     unless ( $zones{$zone}{type} & FIREWALL ) {
-	for my $type (sort keys %{$zones{$zone}{hosts}} ) {
+	for my $type (keys %{$zones{$zone}{hosts}} ) {
 	    my $interfaceref = $zones{$zone}{hosts}->{$type};
-	    for my $interface ( sort keys %$interfaceref ) {
+	    for my $interface ( keys %$interfaceref ) {
 		my $arrayref = $interfaceref->{$interface};
 		for my $host ( @{$arrayref} ) {
 		    if ( my $value = $host->{options}{$option} ) {

Shorewall/Perl/compiler.pl

@@ -43,6 +43,8 @@
 #         --inline                    # Update alternative column specifications
 #         --update                    # Update configuration to current release
 #
+#    If the <filename> is omitted, then a 'check' operation is performed.
+#
 use strict;
 use FindBin;
 use lib "$FindBin::Bin";

Shorewall/Perl/lib.runtime

@@ -32,7 +32,7 @@
 #	    down			Stop an optional interface
 #	    enable			Enable an optional interface
 #	    help			Show command syntax
-#	    reenable			Disable then nable an optional
+#	    reenable			Disable then enable an optional
 #					interface
 #	    refresh			Refresh the firewall
 #	    reload			Reload the firewall

Shorewall/Samples/Universal/shorewall.conf

@@ -33,7 +33,7 @@ FIREWALL=
 #		                L O G G I N G
 ###############################################################################
 
-LOG_LEVEL=info
+LOG_LEVEL="info"
 
 BLACKLIST_LOG_LEVEL=
 
@@ -55,19 +55,19 @@ LOGTAGONLY=No
 
 LOGLIMIT="s:1/sec:10"
 
-MACLIST_LOG_LEVEL=$LOG_LEVEL
+MACLIST_LOG_LEVEL="$LOG_LEVEL"
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=$LOG_LEVEL
+RPFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SFILTER_LOG_LEVEL=$LOG_LEVEL
+SFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SMURF_LOG_LEVEL=$LOG_LEVEL
+SMURF_LOG_LEVEL="$LOG_LEVEL"
 
 STARTUP_LOG=/var/log/shorewall-init.log
 
-TCP_FLAGS_LOG_LEVEL=$LOG_LEVEL
+TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
 
 UNTRACKED_LOG_LEVEL=
 
@@ -109,11 +109,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT=none
-BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs,dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
-DROP_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs"
-NFQUEUE_DEFAULT=none
-QUEUE_DEFAULT=none
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
 REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -217,6 +217,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=Yes

Shorewall/Samples/one-interface/shorewall.conf

@@ -120,11 +120,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT=none
-BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs,dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
-DROP_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs"
-NFQUEUE_DEFAULT=none
-QUEUE_DEFAULT=none
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
 REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -228,6 +228,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No

Shorewall/Samples/three-interfaces/shorewall.conf

@@ -41,7 +41,7 @@ FIREWALL=
 #		                L O G G I N G
 ###############################################################################
 
-LOG_LEVEL=info
+LOG_LEVEL="info"
 
 BLACKLIST_LOG_LEVEL=
 
@@ -63,19 +63,19 @@ LOGTAGONLY=No
 
 LOGLIMIT="s:1/sec:10"
 
-MACLIST_LOG_LEVEL=$LOG_LEVEL
+MACLIST_LOG_LEVEL="$LOG_LEVEL"
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=$LOG_LEVEL
+RPFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SFILTER_LOG_LEVEL=$LOG_LEVEL
+SFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SMURF_LOG_LEVEL=$LOG_LEVEL
+SMURF_LOG_LEVEL="$LOG_LEVEL"
 
 STARTUP_LOG=/var/log/shorewall-init.log
 
-TCP_FLAGS_LOG_LEVEL=$LOG_LEVEL
+TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
 
 UNTRACKED_LOG_LEVEL=
 
@@ -117,11 +117,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT=none
-BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs,dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
-DROP_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs"
-NFQUEUE_DEFAULT=none
-QUEUE_DEFAULT=none
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
 REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -225,6 +225,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No

Shorewall/Samples/two-interfaces/shorewall.conf

@@ -44,7 +44,7 @@ FIREWALL=
 #		                L O G G I N G
 ###############################################################################
 
-LOG_LEVEL=info
+LOG_LEVEL="info"
 
 BLACKLIST_LOG_LEVEL=
 
@@ -66,19 +66,19 @@ LOGTAGONLY=No
 
 LOGLIMIT="s:1/sec:10"
 
-MACLIST_LOG_LEVEL=$LOG_LEVEL
+MACLIST_LOG_LEVEL="$LOG_LEVEL"
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=$LOG_LEVEL
+RPFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SFILTER_LOG_LEVEL=$LOG_LEVEL
+SFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SMURF_LOG_LEVEL=$LOG_LEVEL
+SMURF_LOG_LEVEL="$LOG_LEVEL"
 
 STARTUP_LOG=/var/log/shorewall-init.log
 
-TCP_FLAGS_LOG_LEVEL=$LOG_LEVEL
+TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
 
 UNTRACKED_LOG_LEVEL=
 
@@ -120,11 +120,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT=none
-BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs,dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
-DROP_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs"
-NFQUEUE_DEFAULT=none
-QUEUE_DEFAULT=none
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
 REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -228,6 +228,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No

Shorewall/Samples/two-interfaces/snat

@@ -20,4 +20,4 @@
 MASQUERADE		10.0.0.0/8,\
 			169.254.0.0/16,\
 			172.16.0.0/12,\
-			92.168.0.0/16		eth0
+			192.168.0.0/16		eth0

Shorewall/actions.std

@@ -6,45 +6,42 @@
 #	Please see http://shorewall.net/Actions.html for additional
 #	information.
 #
-# Builtin Actions are:
-#
-?if 0
-allowBcast			# Silently Allow Broadcast
-allowMcast			# Silently Allow Multicast
-dropBcast			# Silently Drop Broadcast
-dropMcast			# Silently Drop Multicast
-dropNotSyn			# Silently Drop Non-syn TCP packets
-rejNotSyn			# Silently Reject Non-syn TCP packets
-allowinUPnP			# Allow UPnP inbound (to firewall) traffic
-forwardUPnP			# Allow traffic that upnpd has redirected from 'upnp' interfaces.
-Limit				# Limit the rate of connections from each individual IP address
-?endif
 ###############################################################################
 #ACTION
+A_AllowICMPs inline		# Audited version of AllowICMPs
 A_Drop				# Audited Default Action for DROP policy
 A_REJECT     noinline,logjump	# Audits then rejects a connection request
 A_REJECT!    inline		# Audits then rejects a connection request
 A_Reject			# Audited Default action for REJECT policy
-AllowICMPs   inline             # Allow Required ICMP packets
+AllowICMPs   inline		# Allow Required ICMP packets
+allowBcast   inline		# Silently Allow Broadcast
+allowinUPnP  inline		# Allow UPnP inbound (to firewall) traffic
 allowInvalid inline		# Accepts packets in the INVALID conntrack state
+allowMcast   inline		# Silently Allow Multicast
 AutoBL	     noinline		# Auto-blacklist IPs that exceed thesholds
 AutoBLL	     noinline		# Helper for AutoBL
 BLACKLIST    logjump,section	# Add sender to the dynamic blacklist
 Broadcast    noinline,audit	# Handles Broadcast/Anycast
 DNSAmp				# Matches one-question recursive DNS queries
 Drop				# Default Action for DROP policy (deprecated)
+dropBcast    inline		# Silently Drop Broadcast
 dropInvalid  inline		# Drops packets in the INVALID conntrack state
+dropMcast    inline		# Silently Drop Multicast
+dropNotSyn   noinline		# Silently Drop Non-syn TCP packets
 DropDNSrep   inline		# Drops DNS replies
 DropSmurfs   noinline		# Drop smurf packets
 Established  inline,\		# Handles packets in the ESTABLISHED state
 	     state=ESTABLISHED	#
+forwardUPnP  noinline		# Allow traffic that upnpd has redirected from 'upnp' interfaces.
 GlusterFS    inline		# Handles GlusterFS
 IfEvent	     noinline		# Perform an action based on an event
 Invalid	     inline,audit,\	# Handles packets in the INVALID conntrack state
 	     state=INVALID	#
+Limit	     noinline		# Limit the rate of connections from each individual IP address
 Multicast    noinline,audit	# Handles Multicast
 New	     inline,state=NEW	# Handles packets in the NEW conntrack state
 NotSyn	     inline,audit	# Handles TCP packets which do not have SYN=1 and ACK=0
+rejNotSyn    noinline		# Silently Reject Non-syn TCP packets
 Reject				# Default Action for REJECT policy (deprecated)
 Related	     inline,\		# Handles packets in the RELATED conntrack state
 	     state=RELATED	#

Shorewall/configfiles/shorewall.conf

@@ -33,7 +33,7 @@ FIREWALL=
 #			       L O G G I N G
 ###############################################################################
 
-LOG_LEVEL=info
+LOG_LEVEL="info"
 
 BLACKLIST_LOG_LEVEL=
 
@@ -55,19 +55,19 @@ LOGTAGONLY=No
 
 LOGLIMIT="s:1/sec:10"
 
-MACLIST_LOG_LEVEL=$LOG_LEVEL
+MACLIST_LOG_LEVEL="$LOG_LEVEL"
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=$LOG_LEVEL
+RPFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SFILTER_LOG_LEVEL=$LOG_LEVEL
+SFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SMURF_LOG_LEVEL=$LOG_LEVEL
+SMURF_LOG_LEVEL="$LOG_LEVEL"
 
 STARTUP_LOG=/var/log/shorewall-init.log
 
-TCP_FLAGS_LOG_LEVEL=$LOG_LEVEL
+TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
 
 UNTRACKED_LOG_LEVEL=
 
@@ -109,11 +109,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT=none
-BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs,dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
-DROP_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs"
-NFQUEUE_DEFAULT=none
-QUEUE_DEFAULT=none
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
 REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -217,6 +217,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No

Shorewall/default.debian.systemd

@@ -0,0 +1,26 @@
+#
+# Global start/restart/reload/stop options
+#
+OPTIONS=""
+
+#
+# Start options
+#
+STARTOPTIONS=""
+
+#
+# Restart options
+#
+RESTARTOPTIONS=""
+
+#
+# Reload options
+#
+RELOADOPTIONS=""
+
+#
+# Stop options
+#
+STOPOPTIONS=""
+
+# EOF

Shorewall/default.debian.sysvinit

@@ -1,5 +1,5 @@
 # prevent startup with default configuration
-# set the following varible to 1 in order to allow Shorewall to start
+# set the following variable to 1 in order to allow Shorewall to start
 
 startup=0
 
@@ -16,7 +16,7 @@ startup=0
 #    wait_interface=
 
 #
-# Global start/restart options
+# Global start/restart/reload/stop options
 #
 OPTIONS=""
 
@@ -28,12 +28,17 @@ STARTOPTIONS=""
 #
 # Restart options
 #
+RESTARTOPTIONS=""
+
+#
+# Reload options
+#
 RELOADOPTIONS=""
 
 #
-# Restart options
+# Stop options
 #
-RESTARTOPTIONS=""
+STOPOPTIONS=""
 
 #
 # Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf

Shorewall/install.sh

@@ -22,55 +22,22 @@
 #	along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
 
-VERSION=4.5.5       #The Build script inserts the actual version
+VERSION=xxx # The Build script inserts the actual version
 
-#
-# Change to the directory containing this script
-#
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <configuration-file> ]"
-    echo "       $ME -v"
-    echo "       $ME -h"
-    echo "       $ME -s"
-    echo "       $ME -a"
-    echo "       $ME -n"
+    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
+    echo "where <option> is one of"
+    echo "  -h"
+    echo "  -v"
+    echo "  -s"
+    echo "  -a"
+    echo "  -p"
+    echo "  -n"
     exit $1
 }
 
-fatal_error()
-{
-    echo "   ERROR: $@" >&2
-    exit 1
-}
-
-split() {
-    local ifs
-    ifs=$IFS
-    IFS=:
-    set -- $1
-    echo $*
-    IFS=$ifs
-}
-
-qt()
-{
-    "$@" >/dev/null 2>&1
-}
-
-mywhich() {
-    local dir
-
-    for dir in $(split $PATH); do
-	if [ -x $dir/$1 ]; then
-	    return 0
-	fi
-    done
-
-    return 2
-}
-
 run_install()
 {
     if ! install $*; then
@@ -80,27 +47,14 @@ run_install()
     fi
 }
 
-cant_autostart()
-{
-    echo
-    echo  "WARNING: Unable to configure $PRODUCT to start automatically at boot" >&2
-}
-
-delete_file() # $1 = file to delete
-{
-    rm -f $1
-}
-
 install_file() # $1 = source $2 = target $3 = mode
 {
     run_install $T $OWNERSHIP -m $3 $1 ${2}
 }
 
-require()
-{
-    eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
-}
-
+#
+# Change to the directory containing this script
+#
 cd "$(dirname $0)"
 
 if [ -f shorewall.service ]; then
@@ -111,6 +65,11 @@ else
     Product=Shorewall6
 fi
 
+#
+# Source common functions
+#
+. ./lib.installer || { echo "ERROR: Can not load common functions." >&2; exit 1; }
+
 #
 # Parse the run line
 #
@@ -172,11 +131,14 @@ done
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-	. ./shorewallrc
+	file=./shorewallrc
+        . $file || fatal_error "Can not load the RC file: $file"
     elif [ -f ~/.shorewallrc ]; then
-	. ~/.shorewallrc || exit 1
+	file=~/.shorewallrc
+        . $file || fatal_error "Can not load the RC file: $file"
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-	. /usr/share/shorewall/shorewallrc
+	file=/usr/share/shorewall/shorewallrc
+        . $file || fatal_error "Can not load the RC file: $file"
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -186,11 +148,11 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file
+	    file=./$file || exit 1
 	    ;;
     esac
 
-    . $file
+    . $file || fatal_error "Can not load the RC file: $file"
 else
     usage 1
 fi
@@ -305,8 +267,7 @@ case "$HOST" in
     linux)
 	;;
     *)
-	echo "ERROR: Unknown HOST \"$HOST\"" >&2
-	exit 1;
+	fatal_error "Unknown HOST \"$HOST\""
 	;;
 esac
 
@@ -317,8 +278,7 @@ if [ $PRODUCT = shorewall ]; then
 	#
 	if [ "$DIGEST" != SHA ]; then
 	    if [ "$BUILD" = "$HOST" ] && ! eval perl -e \'use Digest::$DIGEST\;\' 2> /dev/null ; then
-		echo "ERROR: Perl compilation with Digest::$DIGEST failed" >&2
-		exit 1;
+		fatal_error "Perl compilation with Digest::$DIGEST failed"
 	    fi
 
 	    cp -af Perl/Shorewall/Chains.pm Perl/Shorewall/Chains.pm.bak
@@ -341,8 +301,7 @@ if [ $PRODUCT = shorewall ]; then
 		sed -i 's/Digest::SHA/Digest::SHA1/' Perl/Shorewall/Config.pm
 		DIGEST=SHA1
 	    else
-		echo "ERROR: Shorewall $VERSION requires either Digest::SHA or Digest::SHA1" >&2
-		exit 1
+		fatal_error "Shorewall $VERSION requires either Digest::SHA or Digest::SHA1"
 	    fi
 	fi
     fi
@@ -370,11 +329,10 @@ if [ $BUILD != cygwin ]; then
     fi
 fi
 
-install -d $OWNERSHIP -m 755 ${DESTDIR}${SBINDIR}
-[ -n "${INITFILE}" ] && install -d $OWNERSHIP -m 755 ${DESTDIR}${INITDIR}
+run_install -d $OWNERSHIP -m 0755 ${DESTDIR}${SBINDIR}
+[ -n "${INITFILE}" ] && run_install -d $OWNERSHIP -m 0755 ${DESTDIR}${INITDIR}
 if [ -z "$DESTDIR" -a $PRODUCT != shorewall ]; then
-    [ -x ${LIBEXECDIR}/shorewall/compiler.pl ] || \
-	{ echo "   ERROR: Shorewall >= 4.5.0 is not installed" >&2; exit 1; }
+    [ -x ${LIBEXECDIR}/shorewall/compiler.pl ] || fatal_error "Shorewall >= 4.5.0 is not installed"
 fi
 
 echo "Installing $Product Version $VERSION"
@@ -388,7 +346,7 @@ else
     first_install="Yes"
 fi
 
-if [ -z "${DESTDIR}" -a $PRODUCT = shorewall -a ! -f ${SHAREDIR}/$PRODUCT/coreversion ]; then
+if [ -z "${DESTDIR}" -a $PRODUCT = shorewall -a ! -f ${SHAREDIR}/shorewall/coreversion ]; then
     echo "Shorewall $VERSION requires Shorewall Core which does not appear to be installed"
     exit 1
 fi
@@ -410,22 +368,16 @@ fi
 #
 # Create /etc/$PRODUCT and other directories
 #
-mkdir -p ${DESTDIR}${CONFDIR}/$PRODUCT
-mkdir -p ${DESTDIR}${LIBEXECDIR}/$PRODUCT
-mkdir -p ${DESTDIR}${PERLLIBDIR}/Shorewall
-mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
-mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT/deprecated
-mkdir -p ${DESTDIR}${VARDIR}
+make_parent_directory ${DESTDIR}${CONFDIR}/$PRODUCT 0755
+make_parent_directory ${DESTDIR}${LIBEXECDIR}/$PRODUCT 0755
+make_parent_directory ${DESTDIR}${PERLLIBDIR}/Shorewall 0755
+make_parent_directory ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles 0755
+make_parent_directory ${DESTDIR}${SHAREDIR}/$PRODUCT/deprecated 0755
+make_parent_directory ${DESTDIR}${VARDIR} 0755
 
-chmod 755 ${DESTDIR}${CONFDIR}/$PRODUCT
-chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT
-chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
-chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT/deprecated
+chmod 0755 ${DESTDIR}${SHAREDIR}/$PRODUCT
 
-if [ -n "$DESTDIR" ]; then
-    mkdir -p ${DESTDIR}${CONFDIR}/logrotate.d
-    chmod 755 ${DESTDIR}${CONFDIR}/logrotate.d
-fi
+[ -n "$DESTDIR" ] && make_parent_directory ${DESTDIR}${CONFDIR}/logrotate.d 0755
 
 #
 # Install the .service file
@@ -435,9 +387,9 @@ if [ -z "${SERVICEDIR}" ]; then
 fi
 
 if [ -n "$SERVICEDIR" ]; then
-    mkdir -p ${DESTDIR}${SERVICEDIR}
+    make_parent_directory ${DESTDIR}${SERVICEDIR} 0755
     [ -z "$SERVICEFILE" ] && SERVICEFILE=$PRODUCT.service
-    run_install $OWNERSHIP -m 644 $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
+    run_install $OWNERSHIP -m 0644 $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
     [ ${SBINDIR} != /sbin ] && eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
     echo "Service file $SERVICEFILE installed as ${DESTDIR}${SERVICEDIR}/$PRODUCT.service"
 fi
@@ -490,6 +442,14 @@ if [ -z "$first_install" ]; then
 	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.A_REJECT
 	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.Drop
 	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.Reject
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.A_Drop
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.A_Reject
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.A_AllowICMPs
+    else
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.A_AllowICMPs
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.AllowICMPs
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.Broadcast
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.Multicast
     fi
 fi
 
@@ -1094,8 +1054,14 @@ cd ..
 #
 for f in lib.* Perl/lib.*; do
     if [ -f $f ]; then
-	install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$(basename $f) 0644
-	echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
+        case $f in
+            *installer)
+                ;;
+            *)
+                install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$(basename $f) 0644
+                echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
+                ;;
+        esac
     fi
 done
 
@@ -1105,7 +1071,7 @@ if [ $PRODUCT = shorewall6 ]; then
     #
     ln -sf lib.base ${DESTDIR}${SHAREDIR}/$PRODUCT/functions
     #
-    # And create a sybolic link for the CLI
+    # And create a symbolic link for the CLI
     #
     ln -sf shorewall ${DESTDIR}${SBINDIR}/shorewall6
 fi
@@ -1114,8 +1080,7 @@ if [ -d Perl ]; then
     #
     # ${SHAREDIR}/$PRODUCT/$Product if needed
     #
-    mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT/$Product
-    chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT/$Product
+    make_parent_directory ${DESTDIR}${SHAREDIR}/$PRODUCT/$Product 0755
     #
     # Install the Compiler
     #
@@ -1164,7 +1129,7 @@ fi
 # Create the version file
 #
 echo "$VERSION" > ${DESTDIR}${SHAREDIR}/$PRODUCT/version
-chmod 644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
+chmod 0644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
 #
 # Remove and create the symbolic link to the init script
 #
@@ -1182,7 +1147,7 @@ if [ -n "$MANDIR" ]; then
 
 cd manpages
 
-[ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man5/
+[ -n "$INSTALLD" ] || make_parent_directory ${DESTDIR}${MANDIR}/man5 0755
 
 for f in *.5; do
     gzip -9c $f > $f.gz
@@ -1190,7 +1155,7 @@ for f in *.5; do
     echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
 done
 
-[ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man8/
+[ -n "$INSTALLD" ] || make_parent_directory ${DESTDIR}${MANDIR}/man8 0755
 
 for f in *.8; do
     gzip -9c $f > $f.gz
@@ -1213,8 +1178,7 @@ fi
 #
 if [ -n "$SYSCONFFILE" -a -f "$SYSCONFFILE" -a ! -f ${DESTDIR}${SYSCONFDIR}/${PRODUCT} ]; then
     if [ ${DESTDIR} ]; then
-	mkdir -p ${DESTDIR}${SYSCONFDIR}
-	chmod 755 ${DESTDIR}${SYSCONFDIR}
+	make_parent_directory ${DESTDIR}${SYSCONFDIR} 0755
     fi
 
     run_install $OWNERSHIP -m 0644 ${SYSCONFFILE} ${DESTDIR}${SYSCONFDIR}/$PRODUCT
@@ -1272,6 +1236,6 @@ if [ $configure -eq 1 -a -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${
 fi
 
 #
-#  Report Success
+# Report Success
 #
 echo "$Product Version $VERSION Installed"

Shorewall/lib.cli-std

@@ -341,6 +341,18 @@ get_config() {
 	setup_dbl
     fi
 
+    if [ -z "$PERL_HASH_SEED" ]; then
+	PERL_HASH_SEED=0
+    else
+	case $PERL_HASH_SEED in
+	    [0-9]|[1-9][0-9]|[1-9][0-9][0-9]|[1-9][0-9][0-9][0-9]|[1-9][0-9][0-9][0-9][0-9]|random)
+	        ;;
+	    *)
+		fatal_error "Invalid setting ($PERL_HASH_SEED) for PERL_HASH_SEED"
+		;;
+	esac
+    fi
+
     lib=$(find_file lib.cli-user)
 
     [ -f $lib ] && . $lib
@@ -484,6 +496,18 @@ compiler() {
     #
     [ "$g_debugging" != trace -a -z "$g_preview" ] || [ -n "$g_debug" ] && g_pager=
 
+    case $PERL_HASH_SEED in
+	random)
+	    unset PERL_HASH_SEED
+	    unset PERL_PERTURB_KEYS
+	    ;;
+	*)
+	    export PERL_HASH_SEED
+	    PERL_PERTURB_KEYS=0
+	    export PERL_PERTURB_KEYS
+	    ;;
+    esac
+
     if [ ${PERLLIBDIR} = ${LIBEXECDIR}/shorewall ]; then
 	eval $PERL $debugflags $pc $options $@ $g_pager
     else
@@ -510,28 +534,6 @@ start_command() {
     local rc
     rc=0
 
-    do_it() {
-	if [ -n "$AUTOMAKE" ]; then
-	    [ -n "$nolock" ] || mutex_on
-	    run_it ${VARDIR}/firewall $g_debugging start
-	    rc=$?
-	    [ -n "$nolock" ] || mutex_off
-	else
-	    g_file="${VARDIR}/.start"
-	    if compiler $g_debugging $nolock compile "$g_file"; then
-		[ -n "$nolock" ] || mutex_on
-		run_it ${VARDIR}/.start $g_debugging start
-		rc=$?
-		[ -n "$nolock" ] || mutex_off
-	    else
-		rc=$?
-		mylogger kern.err "ERROR:$g_product start failed"
-	    fi
-	fi
-
-	exit $rc
-    }
-
     if product_is_started; then
 	error_message "Shorewall is already running"
 	exit 0
@@ -623,7 +625,25 @@ start_command() {
 	fi
     fi
 
-    do_it
+    if [ -n "$AUTOMAKE" ]; then
+	[ -n "$nolock" ] || mutex_on
+	run_it ${VARDIR}/firewall $g_debugging start
+	rc=$?
+	[ -n "$nolock" ] || mutex_off
+    else
+	g_file="${VARDIR}/.start"
+	if compiler $g_debugging $nolock compile "$g_file"; then
+	    [ -n "$nolock" ] || mutex_on
+	    run_it ${VARDIR}/.start $g_debugging start
+	    rc=$?
+	    [ -n "$nolock" ] || mutex_off
+	else
+	    rc=$?
+	    mylogger kern.err "ERROR:$g_product start failed"
+	fi
+    fi
+
+    exit $rc
 }
 
 #

Shorewall/manpages/shorewall-actions.xml

@@ -148,9 +148,9 @@
               <listitem>
                 <para>Added in Shorewall 5.0.7. Specifies that this action is
                 to be used in <ulink
-                url="shorewall-mangle.html">shorewall-mangle(5)</ulink> rather
+                url="/manpages/shorewall-mangle.html">shorewall-mangle(5)</ulink> rather
                 than <ulink
-                url="shorewall-rules.html">shorewall-rules(5)</ulink>.</para>
+                url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink>.</para>
               </listitem>
             </varlistentry>
 
@@ -160,9 +160,9 @@
               <listitem>
                 <para>Added in Shorewall 5.0.13. Specifies that this action is
                 to be used in <ulink
-                url="shorewall-snat.html">shorewall-snat(5)</ulink> rather
+                url="/manpages/shorewall-snat.html">shorewall-snat(5)</ulink> rather
                 than <ulink
-                url="shorewall-rules.html">shorewall-rules(5)</ulink>. The
+                url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink>. The
                 <option>mangle</option> and <option>nat</option> options are
                 mutually exclusive.</para>
               </listitem>

Shorewall/manpages/shorewall-blrules.xml

@@ -170,7 +170,7 @@
               <listitem>
                 <para>queues matching packets to a back end logging daemon via
                 a netlink socket then continues to the next rule. See <ulink
-                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
+                url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
               </listitem>
             </varlistentry>
 

Shorewall/manpages/shorewall-interfaces.xml

@@ -257,7 +257,7 @@ loc     eth2            -</programlisting>
                 <warning>
                   <para>Do not specify <emphasis
                   role="bold">arp_ignore</emphasis> for any interface involved
-                  in <ulink url="../ProxyARP.htm">Proxy ARP</ulink>.</para>
+                  in <ulink url="/ProxyARP.htm">Proxy ARP</ulink>.</para>
                 </warning>
               </listitem>
             </varlistentry>
@@ -323,7 +323,7 @@ loc     eth2            -</programlisting>
                 and/or destination address is to be compared against the
                 ipset-based dynamic blacklist (DYNAMIC_BLACKLIST=ipset... in
                 <ulink
-                url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink>).
+                url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>).
                 The default is determine by the setting of
                 DYNAMIC_BLACKLIST:</para>
 
@@ -411,13 +411,13 @@ loc     eth2            -</programlisting>
 
                   <listitem>
                     <para>the interface is a <ulink
-                    url="../SimpleBridge.html">simple bridge</ulink> with a
+                    url="/SimpleBridge.html">simple bridge</ulink> with a
                     DHCP server on one port and DHCP clients on another
                     port.</para>
 
                     <note>
                       <para>If you use <ulink
-                      url="../bridge-Shorewall-perl.html">Shorewall-perl for
+                      url="/bridge-Shorewall-perl.html">Shorewall-perl for
                       firewall/bridging</ulink>, then you need to include
                       DHCP-specific rules in <ulink
                       url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(5).

Shorewall/manpages/shorewall-ipsets.xml

@@ -103,7 +103,7 @@
 
     <important>
       <para>These additional match options are not available in <ulink
-      url="shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink>.</para>
+      url="/manpages/shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink>.</para>
     </important>
 
     <para>Available options are:</para>

Shorewall/manpages/shorewall-mangle.xml

@@ -119,7 +119,7 @@
           Additionally, a <replaceable>chain-designator</replaceable> may not
           be specified in an action body unless the action is declared as
           <option>inline</option> in <ulink
-          url="shorewall6-actions.html">shorewall-actions</ulink>(5).</para>
+          url="/manpages6/shorewall6-actions.html">shorewall-actions</ulink>(5).</para>
 
           <para>Where a command takes parameters, those parameters are
           enclosed in parentheses ("(....)") and separated by commas.</para>
@@ -299,7 +299,7 @@
                 configuration described at <ulink
                 url="http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x">http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x</ulink>,
                 place this entry in <ulink
-                url="manpages/shorewall-providers.html">shorewall-providers(5)</ulink>:</para>
+                url="/manpages/shorewall-providers.html">shorewall-providers(5)</ulink>:</para>
 
                 <programlisting>#NAME    NUMBER   MARK    DUPLICATE  INTERFACE GATEWAY         OPTIONS               COPY
 TProxy   1        -       -          lo        -               tproxy</programlisting>
@@ -365,7 +365,7 @@ DIVERTHA        -               -               tcp</programlisting>
 
               <listitem>
                 <para>Added in Shorewall 5.0.6 as an alternative to entries in
-                <ulink url="shorewall-ecn.html">shorewall-ecn(5)</ulink>. If a
+                <ulink url="/manpages/shorewall-ecn.html">shorewall-ecn(5)</ulink>. If a
                 PROTO is specified, it must be 'tcp' (6). If no PROTO is
                 supplied, TCP is assumed. This action causes all ECN bits in
                 the TCP header to be cleared.</para>
@@ -788,7 +788,7 @@ Normal-Service       =&gt; 0x00</programlisting>
               <listitem>
                 <para>where <replaceable>interface</replaceable> is the
                 logical name of an interface defined in <ulink
-                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
+                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
                 Matches packets entering the firewall from the named
                 interface. May not be used in CLASSIFY rules or in rules using
                 the :T chain qualifier.</para>
@@ -864,7 +864,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 on the firewall and whose source IP address matches one of the
                 listed addresses and does not match any address listed in the
                 <replaceable>exclusion</replaceable>. May not be used with a
-                chain qualifier (:P, :F, etc.) in the ACTION column. </para>
+                chain qualifier (:P, :F, etc.) in the ACTION column.</para>
               </listitem>
             </varlistentry>
 
@@ -911,11 +911,11 @@ Normal-Service       =&gt; 0x00</programlisting>
               <listitem>
                 <para>where <replaceable>interface</replaceable> is the
                 logical name of an interface defined in <ulink
-                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
+                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
                 Matches packets leaving the firewall through the named
                 interface. May not be used in the PREROUTING chain (:P in the
                 mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No
-                in <ulink url="manpages/shorewall.conf">shorewall.conf</ulink>
+                in <ulink url="/manpages/shorewall.conf">shorewall.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -952,7 +952,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 when both the outgoing interface and destination IP address
                 match. May not be used in the PREROUTING chain (:P in the mark
                 column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in
-                <ulink url="manpages/shorewall.conf">shorewall.conf</ulink>
+                <ulink url="/manpages/shorewall.conf">shorewall.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -967,7 +967,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 <replaceable>exclusion</replaceable>. May not be used in the
                 PREROUTING chain (:P in the mark column or no chain qualifier
                 and MARK_IN_FORWARD_CHAIN=No in <ulink
-                url="manpages/shorewall.conf">shorewall.conf</ulink>
+                url="/manpages/shorewall.conf">shorewall.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -1028,15 +1028,16 @@ Normal-Service       =&gt; 0x00</programlisting>
       <varlistentry>
         <term><emphasis role="bold">PROTO</emphasis> - {<emphasis
         role="bold">-</emphasis>|<emphasis
-        role="bold">{tcp:syn</emphasis>|<emphasis
+        role="bold">{tcp:[!]syn</emphasis>|<emphasis
         role="bold">ipp2p</emphasis>|<emphasis
         role="bold">ipp2p:udp</emphasis>|<emphasis
         role="bold">ipp2p:all</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis
         role="bold">all}[,...]}</emphasis></term>
 
         <listitem>
-          <para>Protocol - <emphasis role="bold">ipp2p</emphasis> requires
-          ipp2p match support in your kernel and iptables.</para>
+          <para>See <ulink
+          url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink> for
+          details.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall/manpages/shorewall-nat.xml

@@ -199,7 +199,7 @@ all		all		REJECT		info
 
       <listitem>
         <para>Set IMPLICIT_CONTINUE=Yes in <ulink
-        url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink>.</para>
+        url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>.</para>
       </listitem>
     </orderedlist>
   </refsect1>

Shorewall/manpages/shorewall-rules.xml

@@ -66,7 +66,7 @@
           this section.</para>
 
           <para>The only ACTIONs allowed in this section are ACCEPT, DROP,
-          REJECT, LOG and QUEUE</para>
+          REJECT, LOG, NFQUEUE and QUEUE</para>
 
           <para>There is an implicit ACCEPT rule inserted at the end of this
           section.</para>
@@ -81,7 +81,7 @@
           section.</para>
 
           <para>The only ACTIONs allowed in this section are ACCEPT, DROP,
-          REJECT, LOG and QUEUE</para>
+          REJECT, LOG, NFQUEUE and QUEUE</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the RELATED_DISPOSITION (<ulink
@@ -97,7 +97,7 @@
           processed by rules in this section.</para>
 
           <para>The only Actions allowed in this section are ACCEPT, DROP,
-          REJECT, LOG and QUEUE.</para>
+          REJECT, LOG, NFQUEUE and QUEUE.</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the INVALID_DISPOSITION (<ulink
@@ -113,7 +113,7 @@
           processed by rules in this section.</para>
 
           <para>The only Actions allowed in this section are ACCEPT, DROP,
-          REJECT, LOG and QUEUE.</para>
+          REJECT, LOG, NFQUEUE and QUEUE.</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the UNTRACKED_DISPOSITION (<ulink
@@ -136,11 +136,8 @@
     <note>
       <para>If you are not familiar with Netfilter to the point where you are
       comfortable with the differences between the various connection tracking
-      states, then it is suggested that you omit the <emphasis
-      role="bold">ESTABLISHED</emphasis> and <emphasis
-      role="bold">RELATED</emphasis> sections and place all of your
-      non-blacklisting rules in the NEW section (That's after the line that
-      reads ?SECTION NEW').</para>
+      states, then it is suggested that you place all of your rules in the NEW
+      section (That's after the line that reads ?SECTION NEW').</para>
     </note>
 
     <warning>
@@ -149,8 +146,8 @@
       <emphasis role="bold">ALL, ESTABLISHED</emphasis> and <emphasis
       role="bold">RELATED</emphasis> sections must be empty.</para>
 
-      <para>An except is made if you are running Shorewall 4.4.27 or later and
-      you have specified a non-default value for RELATED_DISPOSITION or
+      <para>An exception is made if you are running Shorewall 4.4.27 or later
+      and you have specified a non-default value for RELATED_DISPOSITION or
       RELATED_LOG_LEVEL. In that case, you may have rules in the RELATED
       section of this file.</para>
     </warning>
@@ -595,7 +592,7 @@
                 <para>Added in Shorewall 4.5.9.3. Queues matching packets to a
                 back end logging daemon via a netlink socket then continues to
                 the next rule. See <ulink
-                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
+                url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
 
                 <para>The <replaceable>nflog-parameters</replaceable> are a
                 comma-separated list of up to 3 numbers:</para>
@@ -730,7 +727,9 @@
                   <member><option>icmp-admin-prohibited</option></member>
 
                   <member><option>icmp-tcp-reset</option> (the PROTO column
-                  must specify TCP)</member>
+                  must specify TCP). Beginning with Shorewall 5.1.3, this
+                  option may also be specified as
+                  <option>tcp-reset</option>.</member>
                 </simplelist>
               </listitem>
             </varlistentry>
@@ -846,7 +845,7 @@
                 <para>Added in Shorewall 4.5.10. Queues matching packets to a
                 back end logging daemon via a netlink socket then continues to
                 the next rule. See <ulink
-                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
+                url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
 
                 <para>Similar to<emphasis role="bold">
                 LOG:ULOG</emphasis>[(<replaceable>ulog-parameters</replaceable>)],
@@ -923,7 +922,7 @@
 
               <listitem>
                 <para>The name of a zone defined in <ulink
-                url="shorewall-zones.html">shorewall-zones</ulink>(5). When
+                url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5). When
                 only the zone name is specified, the packet source may be any
                 host in that zone.</para>
 
@@ -990,9 +989,9 @@
                 <replaceable>interface</replaceable> must be the name of an
                 interface associated with the named
                 <replaceable>zone</replaceable> in either <ulink
-                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
+                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
                 or <ulink
-                url="shorewall.hosts.html">shorewall-hosts</ulink>(5). Only
+                url="/manpages/shorewall.hosts.html">shorewall-hosts</ulink>(5). Only
                 packets from hosts in the <replaceable>zone</replaceable> that
                 arrive through the named interface will match the rule.</para>
               </listitem>
@@ -1008,7 +1007,7 @@
                   <listitem>
                     <para>A host or network IP address. A network address may
                     be followed by exclusion (see <ulink
-                    url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                    url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
                   </listitem>
 
                   <listitem>
@@ -1068,7 +1067,7 @@
               <listitem>
                 <para>This form matches if the host IP address does not match
                 any of the entries in the exclusion (see <ulink
-                url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -1230,7 +1229,7 @@
 
               <listitem>
                 <para>The name of a zone defined in <ulink
-                url="shorewall-zones.html">shorewall-zones</ulink>(5). When
+                url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5). When
                 only the zone name is specified, the packet destination may be
                 any host in that zone.</para>
 
@@ -1297,9 +1296,9 @@
                 <replaceable>interface</replaceable> must be the name of an
                 interface associated with the named
                 <replaceable>zone</replaceable> in either <ulink
-                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
+                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
                 or <ulink
-                url="shorewall.hosts.html">shorewall-hosts</ulink>(5). Only
+                url="/manpages/shorewall-hosts.html">shorewall-hosts</ulink>(5). Only
                 packets to hosts in the <replaceable>zone</replaceable> that
                 are sent through the named interface will match the
                 rule.</para>
@@ -1316,7 +1315,7 @@
                   <listitem>
                     <para>A host or network IP address. A network address may
                     be followed by exclusion (see <ulink
-                    url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                    url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
                   </listitem>
 
                   <listitem>
@@ -1371,7 +1370,7 @@
               <listitem>
                 <para>This form matches if the host IP address does not match
                 any of the entries in the exclusion (see <ulink
-                url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -1593,7 +1592,7 @@
       <varlistentry>
         <term><emphasis role="bold">PROTO</emphasis>- {<emphasis
         role="bold">-</emphasis>|<emphasis
-        role="bold">tcp:syn</emphasis>|<emphasis
+        role="bold">tcp:[!]syn</emphasis>|<emphasis
         role="bold">ipp2p</emphasis>|<emphasis
         role="bold">ipp2p:udp</emphasis>|<emphasis
         role="bold">ipp2p:all</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis
@@ -1604,7 +1603,10 @@
           requires ipp2p match support in your kernel and iptables. <emphasis
           role="bold">tcp:syn</emphasis> implies <emphasis
           role="bold">tcp</emphasis> plus the SYN flag must be set and the
-          RST,ACK and FIN flags must be reset.</para>
+          RST, ACK and FIN flags must be reset. Beginning with Shorewall
+          5.1.3, you may also specify <emphasis
+          role="bold">tcp:!syn</emphasis>, which matches if SYN is not set or
+          if RST, ACK or FIN is set.</para>
 
           <para>Beginning with Shorewall 4.4.19, this column can contain a
           comma-separated list of protocol-numbers and/or protocol

Shorewall/manpages/shorewall-secmarks.xml

@@ -229,8 +229,9 @@
         role="bold">all}[,...]</emphasis></term>
 
         <listitem>
-          <para>Protocol - <emphasis role="bold">ipp2p</emphasis> requires
-          ipp2p match support in your kernel and iptables.</para>
+          <para> See <ulink
+          url="shorewall-rules.html">shorewall-rules(5)</ulink> for
+          details.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall/manpages/shorewall-snat.xml

@@ -27,7 +27,7 @@
 
     <para>This file is used to define dynamic NAT (Masquerading) and to define
     Source NAT (SNAT). It superseded <ulink
-    url="shorewall-masq.html">shorewall-masq</ulink>(5) in Shorewall
+    url="/manpages/shorewall-masq.html">shorewall-masq</ulink>(5) in Shorewall
     5.0.14.</para>
 
     <warning>
@@ -150,7 +150,7 @@
               <listitem>
                 <para>where <replaceable>action</replaceable> is an action
                 declared in <ulink
-                url="shorewall-actions.html">shorewall-actions(5)</ulink> with
+                url="/manpages/shorewall-actions.html">shorewall-actions(5)</ulink> with
                 the <option>nat</option> option. See <ulink
                 url="/Actions.html">www.shorewall.net/Actions.html</ulink> for
                 further information.</para>
@@ -256,8 +256,9 @@
 
         <listitem>
           <para>If you wish to restrict this entry to a particular protocol
-          then enter the protocol name (from protocols(5)) or number
-          here.</para>
+          then enter the protocol name (from protocols(5)) or number here. See
+          <ulink url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink> for
+          details.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall/manpages/shorewall-tcfilters.xml

@@ -89,11 +89,11 @@
           Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
           may be used if your kernel and ip6tables have the <firstterm>Basic
           Ematch</firstterm> capability and you set BASIC_FILTERS=Yes in
-          <ulink url="shorewall.conf.html">shorewall.conf (5)</ulink>. The
+          <ulink url="/manpages/shorewall.conf.html">shorewall.conf (5)</ulink>. The
           ipset name may optionally be followed by a number or a comma
           separated list of src and/or dst enclosed in square brackets
           ([...]). See <ulink
-          url="shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
+          url="/manpages/shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
           details.</para>
         </listitem>
       </varlistentry>
@@ -108,11 +108,11 @@
           Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
           may be used if your kernel and ip6tables have the <firstterm>Basic
           Ematch</firstterm> capability and you set BASIC_FILTERS=Yes in
-          <ulink url="shorewall.conf.html">shorewall.conf (5)</ulink>. The
+          <ulink url="/manpages/shorewall.conf.html">shorewall.conf (5)</ulink>. The
           ipset name may optionally be followed by a number or a comma
           separated list of src and/or dst enclosed in square brackets
           ([...]). See <ulink
-          url="shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
+          url="/manpages/shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
           details.</para>
 
           <para>You may exclude certain hosts from the set already defined

Shorewall/manpages/shorewall-zones.xml

@@ -55,14 +55,14 @@
             <para>The maximum length of an iptables log prefix is 29 bytes. As
             explained in <ulink
             url="/manpages/shorewall.conf.html">shorewall.conf</ulink> (5),
-            the default LOGPREFIX formatting string is “Shorewall:%s:%s:”
-            where the first %s is replaced by the chain name and the second is
-            replaced by the disposition.</para>
+            the legacy default LOGPREFIX formatting string is
+            “Shorewall:%s:%s:” where the first %s is replaced by the chain
+            name and the second is replaced by the disposition.</para>
 
             <itemizedlist>
               <listitem>
-                <para>The default formatting string has 12 fixed characters
-                ("Shorewall" and three colons).</para>
+                <para>The "Shorewall:%s:%s:" formatting string has 12 fixed
+                characters ("Shorewall" and three colons).</para>
               </listitem>
 
               <listitem>
@@ -90,6 +90,29 @@
                 </simplelist>
               </listitem>
             </itemizedlist>
+
+            <para>In Shorewall 5.1.0, the LOGFORMAT in the default and sample
+            shorewall.conf files was changed to "%s:%s ".</para>
+
+            <itemizedlist>
+              <listitem>
+                <para>That formatting string has 2 fixed characters (":" and a
+                space).</para>
+              </listitem>
+
+              <listitem>
+                <para>So the maximum zone name length M is calculated
+                as:</para>
+
+                <simplelist>
+                  <member>2 + 6 + 2*M + 1 = 29</member>
+
+                  <member>2M = 29 - 2 + 6 + 1 = 20</member>
+
+                  <member>M = 10</member>
+                </simplelist>
+              </listitem>
+            </itemizedlist>
           </blockquote>
 
           <para>The order in which Shorewall matches addresses from packets to

Shorewall/manpages/shorewall.conf.xml

@@ -321,9 +321,9 @@
         <listitem>
           <para>The value of this variable affects Shorewall's stopped state.
           The behavior differs depending on whether <ulink
-          url="shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
+          url="/manpages/shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
           or <ulink
-          url="shorewall-stoppedrules.html">shorewall-stoppedrules</ulink>(5)
+          url="/manpages/shorewall-stoppedrules.html">shorewall-stoppedrules</ulink>(5)
           is used:</para>
 
           <variablelist>
@@ -483,7 +483,7 @@
           <para>Added in Shorewall 5.1.1. When USE_DEFAULT_RT=Yes, this option
           determines whether the <option>balance</option> provider option (see
           <ulink
-          url="shorewall-providers.html">shorewall-providers(5)</ulink>) is
+          url="/manpages/shorewall-providers.html">shorewall-providers(5)</ulink>) is
           the default. When BALANCE_PROVIDERS=Yes, then the
           <option>balance</option> option is assumed unless the
           <option>fallback</option>, <option>loose</option>,
@@ -500,7 +500,7 @@
         <listitem>
           <para>Added in Shorewall-4.6.0. When set to <emphasis
           role="bold">Yes</emphasis>, causes entries in <ulink
-          url="shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink> to
+          url="/manpages/shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink> to
           generate a basic filter rather than a u32 filter. This setting
           requires the <firstterm>Basic Ematch</firstterm> capability in your
           kernel and iptables.</para>
@@ -1114,8 +1114,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           specificaitons</ulink> on the right.. When INLINE_MATCHES=Yes is
           specified, the specifications on the right are interpreted as if
           INLINE had been specified in the ACTION column. This also applies to
-          <ulink url="shorewall-masq.html">shorewall-masq(5)</ulink> and
-          <ulink url="shorewall-mangle.html">shorewall-mangle(5</ulink>) which
+          <ulink url="/manpages/shorewall-masq.html">shorewall-masq(5)</ulink> and
+          <ulink url="/manpages/shorewall-mangle.html">shorewall-mangle(5</ulink>) which
           also support INLINE. If not specified or if specified as the empty
           value, the value 'No' is assumed for backward compatibility.</para>
 
@@ -1365,7 +1365,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           sample configurations use this as the default log level and changing
           it will change all packet logging done by the configuration. In any
           configuration file (except <ulink
-          url="shorewall-params.html">shorewall-params(5)</ulink>), $LOG_LEVEL
+          url="/manpages/shorewall-params.html">shorewall-params(5)</ulink>), $LOG_LEVEL
           will expand to this value.</para>
         </listitem>
       </varlistentry>
@@ -1443,15 +1443,20 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
             </listitem>
           </itemizedlist>
 
-          <para/>
-
           <blockquote>
             <para>For example, using the default LOGFORMAT, the log prefix for
-            logging from the nat table's PREROUTING chain is:</para>
+            logging from the nat table's PREROUTING chain is as follows in
+            versions prior to 5.1.0:</para>
 
             <programlisting>    Shorewall:nat:PREROUTING
  </programlisting>
 
+            <para>In Shorewall 5.1.0 and later releases, the log prefix
+            is:</para>
+
+            <programlisting>    nat:PREROUTING
+ </programlisting>
+
             <important>
               <para>To help insure that all packets in the NEW state are
               logged, rate limiting (LOGLIMIT) should be disabled when using
@@ -1482,7 +1487,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           log</emphasis>, and <emphasis role="bold">hits</emphasis> commands.
           If not assigned or if assigned an empty value, /var/log/messages is
           assumed. For further information, see <ulink
-          url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.
+          url="/manpages/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.
           Beginning with Shorewall 5.0.10.1, you may specify
           <option>systemd</option> to use <command>journelctl -r</command> to
           read the log.</para>
@@ -1515,6 +1520,24 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
             url="/manpages/shorewall-zones.html">shorewall-zones</ulink>
             (5).</para>
           </note>
+
+          <caution>
+            <para>Beginning with Shorewall 5.1.0, the default and sample
+            shorewall.conf files set LOGFORMAT="%s %s ". Shorewall log
+            messages that use this LOGFORMAT can be uniquely identified using
+            the following regular expression:</para>
+
+            <simplelist>
+              <member>'IN=.* OUT=.* SRC=.*\..* DST='</member>
+            </simplelist>
+
+            <para>To match all Netfilter log messages (Both IPv4 and IPv6),
+            use:</para>
+
+            <simplelist>
+              <member>'IN=.* OUT=.* SRC=.* DST='</member>
+            </simplelist>
+          </caution>
         </listitem>
       </varlistentry>
 
@@ -1551,8 +1574,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
 
         <listitem>
-          <para>Using the default LOGFORMAT, chain names may not exceed 11
-          characters or truncation of the log prefix may occur. Longer chain
+          <para>Using LOGFORMAT=“Shorewall:%s:%s:”, chain names may not exceed
+          5 characters or truncation of the log prefix may occur. Longer chain
           names may be used with log tags if you set LOGTAGONLY=Yes. With
           LOGTAGONLY=Yes, if a log tag is specified then the tag is included
           in the log prefix in place of the chain name.</para>
@@ -1564,10 +1587,10 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           separated by a comma. So this rule:</para>
 
           <programlisting>#ACTION                                SOURCE         DEST
-LOG:info:foo,bar                 net                   fw</programlisting>
+LOG:info:foo,bar                       net            fw</programlisting>
 
-          <para>would generate the following log prefix when using the default
-          LOGFORMAT setting:</para>
+          <para>would generate the following log prefix when using
+          LOGFORMAT=“Shorewall:%s:%s:”:</para>
 
           <simplelist>
             <member>Shorewall:foo:bar:</member>
@@ -1912,10 +1935,9 @@ LOG:info:,bar                        net                    fw</programlisting>
           <itemizedlist>
             <listitem>
               <para>Optimization category 1 - Traditionally, Shorewall has
-              created rules for <ulink
-              url="/ScalabilityAndPerformance.html">the complete matrix of
+              created rules for the complete matrix of
               host groups defined by the zones, interfaces and hosts
-              files</ulink>. Any traffic that didn't correspond to an element
+              files. Any traffic that didn't correspond to an element
               of that matrix was rejected in one of the built-in chains. When
               the matrix is sparse, this results in lots of largely useless
               rules.</para>
@@ -2153,6 +2175,21 @@ LOG:info:,bar                        net                    fw</programlisting>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><emphasis role="bold">PERL_HASH_SEED=</emphasis><emphasis
+        role="bold"><replaceable>seed</replaceable><emphasis
+        role="bold">|random</emphasis></emphasis></term>
+
+        <listitem>
+          <para>Added in Shorewall 5.1.4. Sets the Perl hash
+          <replaceable>seed</replaceable> (an integer in the range 0-99999)
+          when running the Shorewall rules compiler. If not specified, the
+          value 0 is assumed. If <option>random</option> is specified, a
+          random seed will be chosed by Perl. See perlsec(1) for additional
+          information.</para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><emphasis
         role="bold">PROVIDER_BITS</emphasis>=[<replaceable>number</replaceable>]</term>
@@ -2535,7 +2572,7 @@ INLINE          -       -       -       ;; -j REJECT
           the <option>routeback</option> option.<footnote>
               <para>Hairpin packets are packets that are routed out of the
               same interface that they arrived on.</para>
-            </footnote> interfaces without the routeback option.</para>
+            </footnote></para>
         </listitem>
       </varlistentry>
 
@@ -2551,9 +2588,9 @@ INLINE          -       -       -       ;; -j REJECT
           the <option>routeback</option> option.<footnote>
               <para>Hairpin packets are packets that are routed out of the
               same interface that they arrived on.</para>
-            </footnote> interfaces without the routeback option. The default
-          is <option>info</option>. If you don't wish for these packets to be
-          logged, use SFILTER_LOG_LEVEL=none.</para>
+            </footnote> The default is <option>info</option>. If you don't
+          wish for these packets to be logged, use
+          SFILTER_LOG_LEVEL=none.</para>
         </listitem>
       </varlistentry>
 
@@ -2906,7 +2943,7 @@ INLINE          -       -       -       ;; -j REJECT
             <listitem>
               <para>Packets are sent through the main routing table by a rule
               with priority 999. In <ulink
-              url="/manpages/shorewall-routing_rules.html">routing_rules</ulink>(5),
+              url="/manpages/shorewall-rtrules.html">shorewall-rtrules</ulink>(5),
               the range 1-998 may be used for inserting rules that bypass the
               main table.</para>
             </listitem>

Shorewall/uninstall.sh

@@ -26,9 +26,7 @@
 #       You may only use this script to uninstall the version
 #       shown below. Simply run this script to remove Shorewall Firewall
 
-VERSION=xxx #The Build script inserts the actual version
-PRODUCT=shorewall
-Product=Shorewall
+VERSION=xxx # The Build script inserts the actual version
 
 usage() # $1 = exit status
 {
@@ -41,51 +39,27 @@ usage() # $1 = exit status
     exit $1
 }
 
-fatal_error()
-{
-    echo "   ERROR: $@" >&2
-    exit 1
-}
-
-qt()
-{
-    "$@" >/dev/null 2>&1
-}
-
-split() {
-    local ifs
-    ifs=$IFS
-    IFS=:
-    set -- $1
-    echo $*
-    IFS=$ifs
-}
-
-mywhich() {
-    local dir
-
-    for dir in $(split $PATH); do
-	if [ -x $dir/$1 ]; then
-	    return 0
-	fi
-    done
-
-    return 2
-}
-
-remove_file() # $1 = file to restore
-{
-    if [ -f $1 -o -L $1 ] ; then
-	rm -f $1
-	echo "$1 Removed"
-    fi
-}
-
 #
 # Change to the directory containing this script
 #
 cd "$(dirname $0)"
 
+if [ -f shorewall.service ]; then
+    PRODUCT=shorewall
+    Product=Shorewall
+else
+    PRODUCT=shorewall6
+    Product=Shorewall6
+fi
+
+#
+# Source common functions
+#
+. ./lib.uninstaller || { echo "ERROR: Can not load common functions." >&2; exit 1; }
+
+#
+# Parse the run line
+#
 finished=0
 configure=1
 
@@ -102,7 +76,7 @@ while [ $finished -eq 0 ]; do
 			usage 0
 			;;
 		    v)
-			echo "$Product Firewall Installer Version $VERSION"
+			echo "$Product Firewall Uninstaller Version $VERSION"
 			exit 0
 			;;
 		    n*)
@@ -123,13 +97,16 @@ while [ $finished -eq 0 ]; do
     esac
 done
 
+#
+# Read the RC file
+#
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-	. ./shorewallrc
+        . ./shorewallrc || fatal_error "Can not load the RC file: ./shorewallrc"
     elif [ -f ~/.shorewallrc ]; then
-	. ~/.shorewallrc || exit 1
+        . ~/.shorewallrc || fatal_error "Can not load the RC file: ~/.shorewallrc"
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-	. /usr/share/shorewall/shorewallrc
+        . /usr/share/shorewall/shorewallrc || fatal_error "Can not load the RC file: /usr/share/shorewall/shorewallrc"
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -139,52 +116,53 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file
+	    file=./$file || exit 1
 	    ;;
     esac
 
-    . $file
+    . $file || fatal_error "Can not load the RC file: $file"
 else
     usage 1
 fi
 
-if [ -f ${SHAREDIR}/shorewall/version ]; then
-    INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall/version)"
+if [ -f ${SHAREDIR}/$PRODUCT/version ]; then
+    INSTALLED_VERSION="$(cat ${SHAREDIR}/$PRODUCT/version)"
     if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
-	echo "WARNING: Shorewall Version $INSTALLED_VERSION is installed"
+	echo "WARNING: $Product Version $INSTALLED_VERSION is installed"
 	echo "         and this is the $VERSION uninstaller."
 	VERSION="$INSTALLED_VERSION"
     fi
 else
-    echo "WARNING: Shorewall Version $VERSION is not installed"
+    echo "WARNING: $Product Version $VERSION is not installed"
     VERSION=""
 fi
 
-
-echo "Uninstalling shorewall $VERSION"
+echo "Uninstalling $Product $VERSION"
 
 [ -n "$SANDBOX" ] && configure=0
 
 if [ $configure -eq 1 ]; then
     if qt iptables -L shorewall -n && [ ! -f ${SBINDIR}/shorewall-lite ]; then
-	shorewall clear
+	${SBINDIR}/$PRODUCT clear
+    elif qt ip6tables -L shorewall6 -n && [ ! -f ${SBINDIR}/shorewall6-lite ]; then
+	${SBINDIR}/$PRODUCT clear
     fi
 fi
 
-rm -f ${SBINDIR}/shorewall
+remove_file ${SBINDIR}/$PRODUCT
 
-if [ -L ${SHAREDIR}/shorewall/init ]; then
-    FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall/init)
+if [ -L ${SHAREDIR}/$PRODUCT/init ]; then
+    FIREWALL=$(readlink -m -q ${SHAREDIR}/$PRODUCT/init)
 elif [ -n "$INITFILE" ]; then
     FIREWALL=${INITDIR}/${INITFILE}
 fi
 
 if [ -f "$FIREWALL" ]; then
     if [ $configure -eq 1 ]; then
-	if mywhich updaterc.d ; then
-	    updaterc.d ${PRODUCT} remove
-	elif mywhich insserv ; then
+	if mywhich insserv ; then
             insserv -r $FIREWALL
+	elif mywhich update-rc.d ; then
+	    update-rc.d ${PRODUCT} remove
 	elif mywhich chkconfig ; then
 	    chkconfig --del $(basename $FIREWALL)
 	fi
@@ -193,51 +171,56 @@ if [ -f "$FIREWALL" ]; then
     remove_file $FIREWALL
 fi
 
-if [ -z "${SERVICEDIR}" ]; then
-    SERVICEDIR="$SYSTEMD"
-fi
+[ -z "${SERVICEDIR}" ] && SERVICEDIR="$SYSTEMD"
+
 if [ -n "$SERVICEDIR" ]; then
-    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}
-    rm -f $SERVICEDIR/shorewall.service
+    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}.service
+    remove_file $SERVICEDIR/${PRODUCT}.service
 fi
 
-rm -rf ${SHAREDIR}/shorewall/version
-rm -rf ${CONFDIR}/shorewall
+remove_file ${SHAREDIR}/$PRODUCT/version
+remove_directory ${CONFDIR}/$PRODUCT
 
 if [ -n "$SYSCONFDIR" ]; then
-    [ -n "$SYSCONFFILE" ] && rm -f ${SYSCONFDIR}/${PRODUCT}
+    [ -n "$SYSCONFFILE" ] && remove_file ${SYSCONFDIR}/${PRODUCT}
 fi
 
-rm -rf ${VARDIR}/shorewall
-rm -rf ${PERLLIBDIR}/Shorewall/*
-[ ${LIBEXECDIR} = ${SHAREDIR} ] || rm -rf ${LIBEXECDIR}/shorewall
-rm -rf ${SHAREDIR}/shorewall/configfiles/
-rm -rf ${SHAREDIR}/shorewall/Samples/
-rm -rf ${SHAREDIR}/shorewall/Shorewall/
-rm -f  ${SHAREDIR}/shorewall/lib.cli-std
-rm -f  ${SHAREDIR}/shorewall/lib.runtime
-rm -f  ${SHAREDIR}/shorewall/compiler.pl
-rm -f  ${SHAREDIR}/shorewall/prog.*
-rm -f  ${SHAREDIR}/shorewall/module*
-rm -f  ${SHAREDIR}/shorewall/helpers
-rm -f  ${SHAREDIR}/shorewall/action*
-rm -f  ${SHAREDIR}/shorewall/macro.*
-rm -f  ${SHAREDIR}/shorewall/init
+remove_directory ${VARDIR}
+[ ${LIBEXECDIR} = ${SHAREDIR} ] || remove_directory ${LIBEXECDIR}/$PRODUCT
+remove_directory ${SHAREDIR}/$PRODUCT/configfiles
+remove_file_with_wildcard  ${SHAREDIR}/$PRODUCT/module\*
+remove_file  ${SHAREDIR}/$PRODUCT/helpers
+remove_file_with_wildcard  ${SHAREDIR}/$PRODUCT/action\*
+remove_file_with_wildcard  ${SHAREDIR}/$PRODUCT/macro.\*
 
-for f in ${MANDIR}/man5/shorewall* ${MANDIR}/man8/shorewall*; do
+if [ $PRODUCT = shorewall ]; then
+    remove_file_with_wildcard ${PERLLIBDIR}/$Product/\*
+    remove_directory ${SHAREDIR}/$PRODUCT/Samples
+    remove_directory ${SHAREDIR}/$PRODUCT/$Product
+    remove_file  ${SHAREDIR}/$PRODUCT/lib.cli-std
+    remove_file  ${SHAREDIR}/$PRODUCT/lib.runtime
+    remove_file  ${SHAREDIR}/$PRODUCT/compiler.pl
+    remove_file_with_wildcard  ${SHAREDIR}/$PRODUCT/prog.\*
+    remove_file  ${SHAREDIR}/$PRODUCT/init
+else
+    remove_directory ${SHAREDIR}/$PRODUCT
+fi
+
+for f in ${MANDIR}/man5/${PRODUCT}* ${MANDIR}/man8/${PRODUCT}*; do
     case $f in
-	shorewall6*|shorewall-lite*)
+	shorewall[6]-lite*)
 	    ;;
 	*)
-	    rm -f $f
+	    remove_file $f
 	    ;;
     esac
 done
 
-rm -f  ${CONFDIR}/logrotate.d/shorewall
-
-[ -n "$SYSTEMD" ] && rm -f  ${SYSTEMD}/shorewall.service
-
-echo "Shorewall Uninstalled"
+remove_file  ${CONFDIR}/logrotate.d/$PRODUCT
 
+[ -n "$SYSTEMD" ] && remove_file ${SYSTEMD}/${PRODUCT}.service
 
+#
+# Report Success
+#
+echo "$Product $VERSION Uninstalled"

Shorewall6-lite/default.debian.systemd

@@ -0,0 +1,26 @@
+#
+# Global start/restart/reload/stop options
+#
+OPTIONS=""
+
+#
+# Start options
+#
+STARTOPTIONS=""
+
+#
+# Restart options
+#
+RESTARTOPTIONS=""
+
+#
+# Reload options
+#
+RELOADOPTIONS=""
+
+#
+# Stop options
+#
+STOPOPTIONS=""
+
+# EOF

Shorewall6-lite/default.debian.sysvinit

@@ -1,5 +1,5 @@
 # prevent startup with default configuration
-# set the following varible to 1 in order to allow Shorewall6-lite to start
+# set the following variable to 1 in order to allow Shorewall6-lite to start
 
 startup=0
 
@@ -16,7 +16,7 @@ startup=0
 #    wait_interface=
 
 #
-# Startup options
+# Global start/restart/reload/stop options
 #
 OPTIONS=""
 
@@ -30,6 +30,16 @@ STARTOPTIONS=""
 #
 RESTARTOPTIONS=""
 
+#
+# Reload options
+#
+RELOADOPTIONS=""
+
+#
+# Stop options
+#
+STOPOPTIONS=""
+
 #
 # Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf
 #

Shorewall6-lite/uninstall.sh

@@ -1,221 +0,0 @@
-#!/bin/sh
-#
-# Script to back uninstall Shoreline Firewall 6 Lite
-#
-#     (c) 2000-2016 - Tom Eastep (teastep@shorewall.net)
-#
-#       Shorewall documentation is available at http://shorewall.sourceforge.net
-#
-#       This program is part of Shorewall.
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of the GNU General Public License as published by the
-#       Free Software Foundation, either version 2 of the license or, at your
-#       option, any later version.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, see <http://www.gnu.org/licenses/>.
-#
-#    Usage:
-#
-#       You may only use this script to uninstall the version
-#       shown below. Simply run this script to remove Shorewall Firewall
-
-VERSION=xxx  #The Build script inserts the actual version
-PRODUCT=shorewall6-lite
-Product="Shorewall6 Lite"
-
-usage() # $1 = exit status
-{
-    ME=$(basename $0)
-    echo "usage: $ME [ <shorewallrc file> ]"
-    exit $1
-}
-
-fatal_error()
-{
-    echo "   ERROR: $@" >&2
-    exit 1
-}
-
-qt()
-{
-    "$@" >/dev/null 2>&1
-}
-
-split() {
-    local ifs
-    ifs=$IFS
-    IFS=:
-    set -- $1
-    echo $*
-    IFS=$ifs
-}
-
-mywhich() {
-    local dir
-
-    for dir in $(split $PATH); do
-	if [ -x $dir/$1 ]; then
-	    return 0
-	fi
-    done
-
-    return 2
-}
-
-remove_file() # $1 = file to restore
-{
-    if [ -f $1 -o -L $1 ] ; then
-	rm -f $1
-	echo "$1 Removed"
-    fi
-}
-
-#
-# Change to the directory containing this script
-#
-cd "$(dirname $0)"
-
-finished=0
-configure=1
-
-while [ $finished -eq 0 ]; do
-    option=$1
-
-    case "$option" in
-	-*)
-	    option=${option#-}
-
-	    while [ -n "$option" ]; do
-		case $option in
-		    h)
-			usage 0
-			;;
-		    v)
-			echo "$Product Firewall Installer Version $VERSION"
-			exit 0
-			;;
-		    n*)
-			configure=0
-			option=${option#n}
-			;;
-		    *)
-			usage 1
-			;;
-		esac
-	    done
-
-	    shift
-	    ;;
-	*)
-	    finished=1
-	    ;;
-    esac
-done
-#
-# Read the RC file
-#
-if [ $# -eq 0 ]; then
-    if [ -f ./shorewallrc ]; then
-	. ./shorewallrc
-    elif [ -f ~/.shorewallrc ]; then
-	. ~/.shorewallrc || exit 1
-    elif [ -f /usr/share/shorewall/shorewallrc ]; then
-	. /usr/share/shorewall/shorewallrc
-    else
-	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
-    fi
-elif [ $# -eq 1 ]; then
-    file=$1
-    case $file in
-	/*|.*)
-	    ;;
-	*)
-	    file=./$file
-	    ;;
-    esac
-
-    . $file
-else
-    usage 1
-fi
-
-if [ -f ${SHAREDIR}/shorewall6-lite/version ]; then
-    INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall6-lite/version)"
-    if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
-	echo "WARNING: Shorewall6 Lite Version $INSTALLED_VERSION is installed"
-	echo "         and this is the $VERSION uninstaller."
-	VERSION="$INSTALLED_VERSION"
-    fi
-else
-    echo "WARNING: Shorewall6 Lite Version $VERSION is not installed"
-    VERSION=""
-fi
-
-echo "Uninstalling Shorewall6 Lite $VERSION"
-
-[ -n "$SANDBOX" ] && configure=0
-
-if [ $configure -eq 1 ]; then
-    if qt ip6tables -L shorewall -n && [ ! -f ${SBINDIR}/shorewall6 ]; then
-	${SBINDIR}/shorewall6-lite clear
-    fi
-fi
-
-if [ -f ${SHAREDIR}/shorewall6-lite/init ]; then
-    if [ $HOST = openwrt ]; then
-	if [ $configure -eq 1 ] && /etc/init.d/shorewall6-lite enabled; then
-	    /etc/init.d/shorewall6-lite disable
-	fi
-	
-	FIREWALL=$(readlink ${SHAREDIR}/shorewall6-lite/init)
-    else
-	FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall6-lite/init)
-    fi
-elif [ -n "$INITFILE" ]; then
-    FIREWALL=${INITDIR}/${INITFILE}
-fi
-
-if [ -f "$FIREWALL" ]; then
-    if [ $configure -eq 1 ]; then
-	if mywhich updaterc.d ; then
-	    updaterc.d shorewall6-lite remove
-	elif mywhich insserv ; then
-            insserv -r $FIREWALL
-	elif mywhich chkconfig ; then
-	    chkconfig --del $(basename $FIREWALL)
-	elif mywhich systemctl ; then
-	    systemctl disable shorewall6-lite
-	fi
-    fi
-
-    remove_file $FIREWALL
-fi
-
-[ -z "$SERVICEDIR" ] && SERVICEDIR="$SYSTEMD"
-
-if [ -n "$SERVICEDIR" ]; then
-    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}
-    rm -f $SERVICEDIR/shorewall6-lite.service
-fi
-
-rm -f ${SBINDIR}/shorewall6-lite
-rm -rf ${CONFDIR}/shorewall6-lite
-rm -rf ${VARDIR}
-rm -rf ${SHAREDIR}/shorewall6-lite
-rm -rf ${LIBEXECDIR}/shorewall6-lite
-rm -f  ${CONFDIR}/logrotate.d/shorewall6-lite
-rm -f  ${SYSCONFDIR}/shorewall6-lite
-
-if [ -n "${MANDIR}" ]; then
-    rm -f ${MANDIR}/man5/shorewall6-lite*
-    rm -f ${MANDIR}/man8/shorewall6-lite*
-fi
-
-echo "Shorewall6 Lite Uninstalled"

Shorewall6/Actions/action.A_AllowICMPs

@@ -1,38 +0,0 @@
-#
-# Shorewall6 -- /usr/share/shorewall6/action.A_AllowICMPs
-#
-# This action A_ACCEPTs needed ICMP types
-#
-###############################################################################
-#ACTION		SOURCE		DEST	PROTO		DPORT
-
-?comment Needed ICMP types (RFC4890)
-
-A_ACCEPT	-		-	ipv6-icmp	destination-unreachable
-A_ACCEPT	-		-	ipv6-icmp	packet-too-big
-A_ACCEPT	-		-	ipv6-icmp	time-exceeded
-A_ACCEPT	-		-	ipv6-icmp	parameter-problem
-
-# The following should have a ttl of 255 and must be allowed to transit a bridge
-A_ACCEPT	-		-	ipv6-icmp	router-solicitation
-A_ACCEPT	-		-	ipv6-icmp	router-advertisement
-A_ACCEPT	-		-	ipv6-icmp	neighbour-solicitation
-A_ACCEPT	-		-	ipv6-icmp	neighbour-advertisement
-A_ACCEPT	-		-	ipv6-icmp	137	# Redirect
-A_ACCEPT	-		-	ipv6-icmp	141	# Inverse neighbour discovery solicitation
-A_ACCEPT	-		-	ipv6-icmp	142	# Inverse neighbour discovery advertisement
-
-# The following should have a link local source address and must be allowed to transit a bridge
-A_ACCEPT	fe80::/10	-	ipv6-icmp	130	# Listener query
-A_ACCEPT	fe80::/10	-	ipv6-icmp	131	# Listener report
-A_ACCEPT	fe80::/10	-	ipv6-icmp	132	# Listener done
-A_ACCEPT	fe80::/10	-	ipv6-icmp	143	# Listener report v2
-
-# The following should be received with a ttl of 255 and must be allowed to transit a bridge
-A_ACCEPT	-		-	ipv6-icmp	148	# Certificate path solicitation
-A_ACCEPT	-		-	ipv6-icmp	149	# Certificate path advertisement
-
-# The following should have a link local source address and a ttl of 1 and must be allowed to transit abridge
-A_ACCEPT	fe80::/10	-	ipv6-icmp	151	# Multicast router advertisement
-A_ACCEPT	fe80::/10	-	ipv6-icmp	152	# Multicast router solicitation
-A_ACCEPT	fe80::/10	-	ipv6-icmp	153	# Multicast router termination

Shorewall6/Actions/action.AllowICMPs

@@ -1,40 +0,0 @@
-#
-# Shorewall6 -- /usr/share/shorewall6/action.AllowICMPs
-#
-# This action ACCEPTs needed ICMP types
-#
-###############################################################################
-#ACTION	SOURCE		DEST	PROTO		DPORT
-
-DEFAULTS ACCEPT
-
-?COMMENT Needed ICMP types (RFC4890)
-
-$1	-		-	ipv6-icmp	destination-unreachable
-$1	-		-	ipv6-icmp	packet-too-big
-$1	-		-	ipv6-icmp	time-exceeded
-$1	-		-	ipv6-icmp	parameter-problem
-
-# The following should have a ttl of 255 and must be allowed to transit a bridge
-$1	-		-	ipv6-icmp	router-solicitation
-$1	-		-	ipv6-icmp	router-advertisement
-$1	-		-	ipv6-icmp	neighbour-solicitation
-$1	-		-	ipv6-icmp	neighbour-advertisement
-$1	-		-	ipv6-icmp	137	# Redirect
-$1	-		-	ipv6-icmp	141	# Inverse neighbour discovery solicitation
-$1	-		-	ipv6-icmp	142	# Inverse neighbour discovery advertisement
-
-# The following should have a link local source address and must be allowed to transit a bridge
-$1	fe80::/10	-	ipv6-icmp	130	# Listener query
-$1	fe80::/10	-	ipv6-icmp	131	# Listener report
-$1	fe80::/10	-	ipv6-icmp	132	# Listener done
-$1	fe80::/10	-	ipv6-icmp	143	# Listener report v2
-
-# The following should be received with a ttl of 255 and must be allowed to transit a bridge
-$1	-		-	ipv6-icmp	148	# Certificate path solicitation
-$1	-		-	ipv6-icmp	149	# Certificate path advertisement
-
-# The following should have a link local source address and a ttl of 1 and must be allowed to transit abridge
-$1	fe80::/10	-	ipv6-icmp	151	# Multicast router advertisement
-$1	fe80::/10	-	ipv6-icmp	152	# Multicast router solicitation
-$1	fe80::/10	-	ipv6-icmp	153	# Multicast router termination

Shorewall6/Actions/action.Broadcast

@@ -1,65 +0,0 @@
-#
-# Shorewall6 -- /usr/share/shorewall6/action.Broadcast
-#
-# Multicast/Anycast IPv6 Action
-#
-# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
-#
-# Complete documentation is available at http://shorewall.net
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of Version 2 of the GNU General Public License
-# as published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Broadcast[([<action>|-[,{audit|-}])]
-#
-# Default action is DROP
-#
-###############################################################################
-
-DEFAULTS DROP,-
-
-?begin perl;
-
-use Shorewall::IPAddrs;
-use Shorewall::Config;
-use Shorewall::Chains;
-
-my $chainref           = get_action_chain;
-my ( $action, $audit ) = get_action_params( 2 );
-my ( $level, $tag )    = get_action_logging;
-my $target             = require_audit ( $action , $audit );
-
-fatal_error "Invalid parameter to action Broadcast"   if supplied $audit && $audit ne 'audit';
-
-if ( have_capability( 'ADDRTYPE' ) ) {
-    if ( $level ne '' ) {
-	log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type BROADCAST ';
-	log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type ANYCAST ';
-    }
-
-    add_jump $chainref, $target, 0, '-m addrtype --dst-type BROADCAST ';
-    add_jump $chainref, $target, 0, '-m addrtype --dst-type ANYCAST ';
-} else {
-    add_commands $chainref, 'for address in $ALL_ACASTS; do';
-    incr_cmd_level $chainref;
-    log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d $address ' if $level ne '';
-    add_jump $chainref, $target, 0, "-d \$address ";
-    decr_cmd_level $chainref;
-    add_commands $chainref, 'done';
-}
-
-1;
-
-?end perl;

Shorewall6/Actions/action.Multicast

@@ -1,59 +0,0 @@
-#
-# Shorewall6 -- /usr/share/shorewall6/action.Multicast
-#
-# Multicast/Anycast IPv6 Action
-#
-# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
-#
-# Complete documentation is available at http://shorewall.net
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of Version 2 of the GNU General Public License
-# as published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Multicast[([<action>|-[,{audit|-}])]
-#
-# Default action is DROP
-#
-###############################################################################
-
-DEFAULTS DROP,-
-
-?begin perl;
-
-use Shorewall::IPAddrs;
-use Shorewall::Config;
-use Shorewall::Chains;
-
-my $chainref           = get_action_chain;
-my ( $action, $audit ) = get_action_params( 2 );
-my ( $level, $tag )    = get_action_logging;
-my $target             = require_audit ( $action , $audit );
-
-fatal_error "Invalid parameter to action Broadcast"   if supplied $audit && $audit ne 'audit';
-
-if ( have_capability( 'ADDRTYPE' ) ) {
-    if ( $level ne '' ) {
-	log_rule_limit $level, $chainref, 'Multicast' , $action, '', $tag, 'add', ' -m addrtype --dst-type MULTICAST ';
-    }
-
-    add_jump $chainref, $target, 0, '-m addrtype --dst-type MULTICAST ';
-} else {
-    log_rule_limit( $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', join( ' ', '-d', IPv6_MULTICAST . ' ' ) )  if $level ne '';
-    add_jump $chainref, $target, 0, join( ' ', '-d', IPv6_MULTICAST . ' ' );
-}
-
-1;
-
-?end perl;

Shorewall6/Samples6/Universal/shorewall6.conf

@@ -34,7 +34,7 @@ FIREWALL=
 #			       L O G G I N G
 ###############################################################################
 
-LOG_LEVEL=info
+LOG_LEVEL="info"
 
 BLACKLIST_LOG_LEVEL=
 
@@ -54,19 +54,19 @@ LOGLIMIT="s:1/sec:10"
 
 LOGTAGONLY=No
 
-MACLIST_LOG_LEVEL=info
+MACLIST_LOG_LEVEL="$LOG_LEVEL"
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
+RPFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SFILTER_LOG_LEVEL=info
+SFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SMURF_LOG_LEVEL=info
+SMURF_LOG_LEVEL="$LOG_LEVEL"
 
 STARTUP_LOG=/var/log/shorewall6-init.log
 
-TCP_FLAGS_LOG_LEVEL=info
+TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
 
 UNTRACKED_LOG_LEVEL=
 
@@ -74,7 +74,7 @@ UNTRACKED_LOG_LEVEL=
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
-CONFIG_PATH=${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
+CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
 
 GEOIPDIR=/usr/share/xt_geoip/LE
 
@@ -106,11 +106,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT=none
-BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT=none
-QUEUE_DEFAULT=none
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
 REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
+MINIUPNPD=No
+
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -196,6 +198,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=Yes
@@ -206,7 +210,7 @@ RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
 
-TC_ENABLED=No
+TC_ENABLED=Shared
 
 TC_EXPERT=No
 

Shorewall6/Samples6/one-interface/shorewall6.conf

@@ -35,7 +35,7 @@ FIREWALL=
 #			       L O G G I N G
 ###############################################################################
 
-LOG_LEVEL=info
+LOG_LEVEL="info"
 
 BLACKLIST_LOG_LEVEL=
 
@@ -55,19 +55,19 @@ LOGLIMIT="s:1/sec:10"
 
 LOGTAGONLY=No
 
-MACLIST_LOG_LEVEL=info
+MACLIST_LOG_LEVEL="$LOG_LEVEL"
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
+RPFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SFILTER_LOG_LEVEL=info
+SFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SMURF_LOG_LEVEL=info
+SMURF_LOG_LEVEL="$LOG_LEVEL"
 
 STARTUP_LOG=/var/log/shorewall6-init.log
 
-TCP_FLAGS_LOG_LEVEL=info
+TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
 
 UNTRACKED_LOG_LEVEL=
 
@@ -107,11 +107,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT=none
-BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT=none
-QUEUE_DEFAULT=none
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
 REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -189,6 +189,8 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
+MINIUPNPD=No
+
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -197,6 +199,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -207,7 +211,7 @@ RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
 
-TC_ENABLED=No
+TC_ENABLED=Shared
 
 TC_EXPERT=No
 

Shorewall6/Samples6/three-interfaces/shorewall6.conf

@@ -34,7 +34,7 @@ FIREWALL=
 #			       L O G G I N G
 ###############################################################################
 
-LOG_LEVEL=info
+LOG_LEVEL="info"
 
 BLACKLIST_LOG_LEVEL=
 
@@ -54,19 +54,19 @@ LOGLIMIT="s:1/sec:10"
 
 LOGTAGONLY=No
 
-MACLIST_LOG_LEVEL=info
+MACLIST_LOG_LEVEL="$LOG_LEVEL"
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
+RPFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SFILTER_LOG_LEVEL=info
+SFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SMURF_LOG_LEVEL=info
+SMURF_LOG_LEVEL="$LOG_LEVEL"
 
 STARTUP_LOG=/var/log/shorewall6-init.log
 
-TCP_FLAGS_LOG_LEVEL=info
+TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
 
 UNTRACKED_LOG_LEVEL=
 
@@ -106,11 +106,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT=none
-BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT=none
-QUEUE_DEFAULT=none
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
 REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
+MINIUPNPD=No
+
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -196,6 +198,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -206,7 +210,7 @@ RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
 
-TC_ENABLED=No
+TC_ENABLED=Shared
 
 TC_EXPERT=No
 

Shorewall6/Samples6/two-interfaces/shorewall6.conf

@@ -34,7 +34,7 @@ FIREWALL=
 #			       L O G G I N G
 ###############################################################################
 
-LOG_LEVEL=info
+LOG_LEVEL="info"
 
 BLACKLIST_LOG_LEVEL=
 
@@ -54,19 +54,19 @@ LOGLIMIT="s:1/sec:10"
 
 LOGTAGONLY=No
 
-MACLIST_LOG_LEVEL=info
+MACLIST_LOG_LEVEL="$LOG_LEVEL"
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=info
+RPFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SFILTER_LOG_LEVEL=info
+SFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SMURF_LOG_LEVEL=info
+SMURF_LOG_LEVEL="$LOG_LEVEL"
 
 STARTUP_LOG=/var/log/shorewall6-init.log
 
-TCP_FLAGS_LOG_LEVEL=info
+TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
 
 UNTRACKED_LOG_LEVEL=
 
@@ -106,11 +106,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT=none
-BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT=none
-QUEUE_DEFAULT=none
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
 REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
+MINIUPNPD=No
+
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -196,6 +198,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -206,7 +210,7 @@ RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
 
-TC_ENABLED=No
+TC_ENABLED=Shared
 
 TC_EXPERT=No
 

Shorewall6/actions.std

@@ -6,32 +6,29 @@
 #	Please see http://shorewall.net/Actions.html for additional
 #	information.
 #
-# Builtin Actions are:
-#
-?if 0
-allowBcasts                     # Accept anycast packets
-allowMcasts                     # Accept multicast packets
-dropBcasts                      # Silently Drop anycast packets
-dropMcasts                      # Silently Drop multicast packets
-dropNotSyn		        # Silently Drop Non-syn TCP packets
-rejNotSyn		        # Silently Reject Non-syn TCP packets
-?endif
 ###############################################################################
 #ACTION
 A_Drop	                        # Audited Default Action for DROP policy
 A_Reject	                # Audited Default Action for REJECT policy
 A_AllowICMPs	                # Audited Accept needed ICMP6 types
 AllowICMPs   	                # Accept needed ICMP6 types
+allowBcast   inline		# Silently Allow Broadcast
 allowInvalid inline		# Accepts packets in the INVALID conntrack state
+allowMcast   inline		# Silently Allow Multicast
 AutoBL       noinline           # Auto-blacklist IPs that exceed thesholds
 AutoBLL      noinline           # Helper for AutoBL
+BLACKLIST    logjump,section	# Add sender to the dynamic blacklist
 Broadcast    noinline      	# Handles Broadcast/Anycast
 Drop		        	# Default Action for DROP policy (deprecated)
+dropBcast    inline		# Silently Drop Broadcast
 dropInvalid  inline		# Drops packets in the INVALID conntrack state
+dropMcast    inline		# Silently Drop Multicast
+dropNotSyn   noinline		# Silently Drop Non-syn TCP packets
 DropDNSrep   inline		# Drops DNS replies
 DropSmurfs   noinline     	# Handles packets with a broadcast source address
 Established  inline,\		# Handles packets in the ESTABLISHED state
 	     state=ESTABLISHED
+forwardUPnP  noinline		# Allow traffic that upnpd has redirected from 'upnp' interfaces.
 IfEvent      noinline           # Perform an action based on an event
 Invalid      inline,audit,\     # Handles packets in the INVALID conntrack state
              state=INVALID
@@ -39,6 +36,7 @@ Multicast    noinline      	# Handles Multicast
 New	     inline,state=NEW	# Handles packets in the NEW conntrack state
 NotSyn	     inline 		# Handles TCP packets that do not have SYN=1 and ACK=0
 Reject		        	# Default Action for REJECT policy (deprecated)
+rejNotSyn    noinline		# Silently Reject Non-syn TCP packets
 Related      inline,\		# Handles packets in the RELATED conntrack state
              state=RELATED
 ResetEvent   inline		# Reset an Event

Shorewall6/configfiles/shorewall6.conf

@@ -34,7 +34,7 @@ FIREWALL=
 #			       L O G G I N G
 ###############################################################################
 
-LOG_LEVEL=info
+LOG_LEVEL="info"
 
 BLACKLIST_LOG_LEVEL=
 
@@ -54,19 +54,19 @@ LOGLIMIT="s:1/sec:10"
 
 LOGTAGONLY=No
 
-MACLIST_LOG_LEVEL=$LOG_LEVEL
+MACLIST_LOG_LEVEL="$LOG_LEVEL"
 
 RELATED_LOG_LEVEL=
 
-RPFILTER_LOG_LEVEL=$LOG_LEVEL
+RPFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SFILTER_LOG_LEVEL=$LOG_LEVEL
+SFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SMURF_LOG_LEVEL=$LOG_LEVEL
+SMURF_LOG_LEVEL="$LOG_LEVEL"
 
 STARTUP_LOG=/var/log/shorewall6-init.log
 
-TCP_FLAGS_LOG_LEVEL=$LOG_LEVEL
+TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
 
 UNTRACKED_LOG_LEVEL=
 
@@ -106,11 +106,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT=none
-BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT=none
-QUEUE_DEFAULT=none
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
 REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
+MINIUPNPD=No
+
 MODULE_SUFFIX=ko
 
 MUTEX_TIMEOUT=60
@@ -196,6 +198,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -206,7 +210,7 @@ RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
 
-TC_ENABLED=No
+TC_ENABLED=Shared
 
 TC_EXPERT=No
 

Shorewall6/default.debian.systemd

@@ -0,0 +1,26 @@
+#
+# Global start/restart/reload/stop options
+#
+OPTIONS=""
+
+#
+# Start options
+#
+STARTOPTIONS=""
+
+#
+# Restart options
+#
+RESTARTOPTIONS=""
+
+#
+# Reload options
+#
+RELOADOPTIONS=""
+
+#
+# Stop options
+#
+STOPOPTIONS=""
+
+# EOF

Shorewall6/default.debian.sysvinit

@@ -1,5 +1,5 @@
 # prevent startup with default configuration
-# set the following varible to 1 in order to allow Shorewall6 to start
+# set the following variable to 1 in order to allow Shorewall6 to start
 
 startup=0
 
@@ -16,7 +16,7 @@ startup=0
 #    wait_interface=
 
 #
-# Startup options
+# Global start/restart/reload/stop options
 #
 OPTIONS=""
 
@@ -30,6 +30,16 @@ STARTOPTIONS=""
 #
 RESTARTOPTIONS=""
 
+#
+# Reload options
+#
+RELOADOPTIONS=""
+
+#
+# Stop options
+#
+STOPOPTIONS=""
+
 #
 # Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf
 #

Shorewall6/manpages/shorewall6-actions.xml

@@ -149,9 +149,9 @@
               <listitem>
                 <para>Added in Shorewall 5.0.7. Specifies that this action is
                 to be used in <ulink
-                url="shorewall6-mangle.html">shorewall6-mangle(5)</ulink>
+                url="/manpages6/shorewall6-mangle.html">shorewall6-mangle(5)</ulink>
                 rather than <ulink
-                url="shorewall6-rules.html">shorewall6-rules(5)</ulink>.</para>
+                url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink>.</para>
               </listitem>
             </varlistentry>
 
@@ -161,9 +161,9 @@
               <listitem>
                 <para>Added in Shorewall 5.0.13. Specifies that this action is
                 to be used in <ulink
-                url="shorewall6-snat.html">shorewall6-snat(5)</ulink> rather
+                url="/manpages6/shorewall6-snat.html">shorewall6-snat(5)</ulink> rather
                 than <ulink
-                url="shorewall6-rules.html">shorewall6-rules(5)</ulink>. The
+                url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink>. The
                 <option>mangle</option> and <option>nat</option> options are
                 mutually exclusive.</para>
               </listitem>

Shorewall6/manpages/shorewall6-blrules.xml

@@ -171,7 +171,7 @@
               <listitem>
                 <para>queues matching packets to a back end logging daemon via
                 a netlink socket then continues to the next rule. See <ulink
-                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
+                url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
               </listitem>
             </varlistentry>
 

Shorewall6/manpages/shorewall6-conntrack.xml

@@ -403,7 +403,7 @@
               <listitem>
                 <para>Where interface is the logical name of an interface
                 defined in <ulink
-                url="shorewall-interfaces.html">shorewall-interface</ulink>(5).</para>
+                url="/manpages6/shorewall6-interfaces.html">shorewall6-interface</ulink>(5).</para>
               </listitem>
             </varlistentry>
 
@@ -426,13 +426,13 @@
                   <listitem>
                     <para>The name of an ipset preceded by a plus sign ("+").
                     See <ulink
-                    url="shorewall-ipsets.html">shorewall-ipsets</ulink>(5).</para>
+                    url="/manpages6/shorewall6-ipsets.html">shorewall6-ipsets</ulink>(5).</para>
                   </listitem>
                 </itemizedlist>
 
                 <para><replaceable>exclusion</replaceable> is described in
                 <ulink
-                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
+                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5).</para>
               </listitem>
             </varlistentry>
 
@@ -450,7 +450,7 @@
 
               <listitem>
                 <para>See <ulink
-                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>
+                url="/manpages6/shorewall6-exclusion.html">shorewall-exclusion</ulink>
                 (5)</para>
               </listitem>
             </varlistentry>
@@ -499,7 +499,7 @@
               <listitem>
                 <para>Where interface is the logical name of an interface
                 defined in <ulink
-                url="shorewall-interfaces.html">shorewall-interface</ulink>(5).</para>
+                url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).</para>
               </listitem>
             </varlistentry>
 
@@ -522,13 +522,13 @@
                   <listitem>
                     <para>The name of an ipset preceded by a plus sign ("+").
                     See <ulink
-                    url="shorewall-ipsets.html">shorewall-ipsets</ulink>(5).</para>
+                    url="/manpages6/shorewall6-ipsets.html">shorewall6-ipsets</ulink>(5).</para>
                   </listitem>
                 </itemizedlist>
 
                 <para><replaceable>exclusion</replaceable> is described in
                 <ulink
-                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
+                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5).</para>
               </listitem>
             </varlistentry>
 
@@ -547,7 +547,7 @@
 
               <listitem>
                 <para>See <ulink
-                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>
+                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>
                 (5)</para>
               </listitem>
             </varlistentry>

Shorewall6/manpages/shorewall6-interfaces.xml

@@ -345,7 +345,7 @@ loc     eth2            -</programlisting>
                       url="/bridge-Shorewall-perl.html">Shorewall-perl for
                       firewall/bridging</ulink>, then you need to include
                       DHCP-specific rules in <ulink
-                      url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(8).
+                      url="/manpages6/shorewall6-rules.html">shorewall6-rules</ulink>(8).
                       DHCP uses UDP ports 546 and 547.</para>
                     </note>
                   </listitem>

Shorewall6/manpages/shorewall6-ipsets.xml

@@ -102,7 +102,7 @@
 
     <important>
       <para>These additional match options are not available in <ulink
-      url="shorewall6-tcfilters.html">shorewall6-tcfilters(5)</ulink>.</para>
+      url="/manpages6/shorewall6-tcfilters.html">shorewall6-tcfilters(5)</ulink>.</para>
     </important>
 
     <para>Available options are:</para>

Shorewall6/manpages/shorewall6-mangle.xml

@@ -120,7 +120,7 @@
           Additionally, a <replaceable>chain-designator</replaceable> may not
           be specified in an action body unless the action is declared as
           <option>inline</option> in <ulink
-          url="shorewall6-actions.html">shorewall6-actions</ulink>(5).</para>
+          url="/manpages6/shorewall6-actions.html">shorewall6-actions</ulink>(5).</para>
 
           <para>Where a command takes parameters, those parameters are
           enclosed in parentheses ("(....)") and separated by commas.</para>
@@ -137,7 +137,7 @@
                 <para>Added in Shorewall 5.0.7.
                 <replaceable>action</replaceable> must be an action declared
                 with the <option>mangle</option> option in <ulink
-                url="manpages6/shorewall6-actions.html">shorewall6-actions(5)</ulink>.
+                url="/manpages6/shorewall6-actions.html">shorewall6-actions(5)</ulink>.
                 If the action accepts parameters, they are specified as a
                 comma-separated list within parentheses following the
                 <replaceable>action</replaceable> name.</para>
@@ -300,7 +300,7 @@
                 configuration described at <ulink
                 url="http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x">http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x</ulink>,
                 place this entry in <ulink
-                url="manpages6/shorewall6-providers.html">shorewall6-providers(5)</ulink>:</para>
+                url="/manpages6/shorewall6-providers.html">shorewall6-providers(5)</ulink>:</para>
 
                 <programlisting>#NAME    NUMBER   MARK    DUPLICATE  INTERFACE GATEWAY         OPTIONS               COPY
 TProxy   1        -       -          lo        -               tproxy</programlisting>
@@ -410,7 +410,7 @@ DIVERTHA        -               -               tcp</programlisting>
                 specified at the end of the rule. If the target is not one
                 known to Shorewall, then it must be defined as a builtin
                 action in <ulink
-                url="/manpages/shorewall-actions.html">shorewall-actions</ulink>
+                url="/manpages6/shorewall6-actions.html">shorewall6-actions</ulink>
                 (5).</para>
 
                 <para>The following rules are equivalent:</para>
@@ -423,7 +423,7 @@ INLINE                eth0              -                 ; -p tcp -j MARK --set
 </programlisting>
 
                 <para>If INLINE_MATCHES=Yes in <ulink
-                url="/manpages/shorewall.conf.html">shorewall6.conf(5)</ulink>
+                url="/manpages6/shorewall6.conf.html">shorewall6.conf(5)</ulink>
                 then the third rule above can be specified as follows:</para>
 
                 <programlisting>MARK(2):P             eth0              -                 ; -p tcp</programlisting>
@@ -780,7 +780,7 @@ Normal-Service       =&gt; 0x00</programlisting>
               <listitem>
                 <para>where <replaceable>interface</replaceable> is the
                 logical name of an interface defined in <ulink
-                url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
+                url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
                 Matches packets entering the firewall from the named
                 interface. May not be used in CLASSIFY rules or in rules using
                 the :T chain qualifier.</para>
@@ -807,7 +807,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 <para>Matches traffic whose source IP address matches one of
                 the listed addresses and that does not match an address listed
                 in the <replaceable>exclusion</replaceable> (see <ulink
-                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
 
                 <para><emphasis role="bold">This form will not match traffic
                 that originates on the firewall itself unless either
@@ -903,11 +903,11 @@ Normal-Service       =&gt; 0x00</programlisting>
               <listitem>
                 <para>where <replaceable>interface</replaceable> is the
                 logical name of an interface defined in <ulink
-                url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
+                url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
                 Matches packets leaving the firewall through the named
                 interface. May not be used in the PREROUTING chain (:P in the
                 mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No
-                in <ulink url="shorewall6.conf">shorewall6.conf</ulink>
+                in <ulink url="/manpages6/shorewall6.conf">shorewall6.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -932,7 +932,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 <para>Matches traffic whose destination IP address matches one
                 of the listed addresses and that does not match an address
                 listed in the <replaceable>exclusion</replaceable> (see <ulink
-                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -944,7 +944,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 when both the outgoing interface and destination IP address
                 match. May not be used in the PREROUTING chain (:P in the mark
                 column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in
-                <ulink url="shorewall6.conf">shorewall6.conf</ulink>
+                <ulink url="/manpages6/shorewall6.conf">shorewall6.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -959,7 +959,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 <replaceable>exclusion</replaceable>. May not be used in the
                 PREROUTING chain (:P in the mark column or no chain qualifier
                 and MARK_IN_FORWARD_CHAIN=No in <ulink
-                url="shorewall6.conf">shorewall6.conf</ulink> (5)).</para>
+                url="/manpages6/shorewall6.conf">shorewall6.conf</ulink> (5)).</para>
               </listitem>
             </varlistentry>
 
@@ -1026,8 +1026,9 @@ Normal-Service       =&gt; 0x00</programlisting>
         role="bold">all}[,...]}</emphasis></term>
 
         <listitem>
-          <para>Protocol - <emphasis role="bold">ipp2p</emphasis> requires
-          ipp2p match support in your kernel and iptables.</para>
+          <para>See <ulink
+          url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink> for
+          details.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall6/manpages/shorewall6-masq.xml

@@ -67,7 +67,7 @@
           entry that defines <filename
           class="devicefile">ppp+</filename>.</para>
 
-          <para>Where <ulink url="/4.4/MultiISP.html#Shared">more that one
+          <para>Where <ulink url="MultiISP.html#Shared">more that one
           internet provider share a single interface</ulink>, the provider is
           specified by including the provider name or number in
           parentheses:</para>

Shorewall6/manpages/shorewall6-nat.xml

@@ -67,7 +67,7 @@
           <para>Interfaces that have the <emphasis
           role="bold">EXTERNAL</emphasis> address. If ADD_IP_ALIASES=Yes in
           <ulink
-          url="/manpages/shorewall.conf.html">shorewall6.conf</ulink>(5),
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5),
           Shorewall will automatically add the EXTERNAL address to this
           interface. Also if ADD_IP_ALIASES=Yes, you may follow the interface
           name with ":" and a <emphasis>digit</emphasis> to indicate that you
@@ -78,12 +78,12 @@
           </emphasis></para>
 
           <para>Each interface must match an entry in <ulink
-          url="/manpages/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
+          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
           Shorewall allows loose matches to wildcard entries in <ulink
-          url="/manpages/shorewall-interfaces.html">shorewall6-interfaces</ulink>(5).
+          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
           For example, <filename class="devicefile">ppp0</filename> in this
           file will match a <ulink
-          url="/manpages/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
+          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
           entry that defines <filename
           class="devicefile">ppp+</filename>.</para>
 

Shorewall6/manpages/shorewall6-policy.xml

@@ -156,7 +156,7 @@
           policy-action list can be prefixed with a plus sign ("+") indicating
           that the listed actions are in addition to those listed in the
           related _DEFAULT setting in <ulink
-          url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
 
           <para>Possible policies are:</para>
 
@@ -192,7 +192,7 @@
               <listitem>
                 <para>Added in Shorewall 5.1.1 and requires that the
                 DYNAMIC_BLACKLIST setting in <ulink
-                url="/manpages/shorewall.conf.html">shorewall6.conf</ulink>(5)
+                url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)
                 specifies ipset-based dynamic blacklisting. The SOURCE IP
                 address is added to the blacklist ipset and the connection
                 request is ignored.</para>

Shorewall6/manpages/shorewall6-rules.xml

@@ -59,7 +59,7 @@
           this section.</para>
 
           <para>The only ACTIONs allowed in this section are ACCEPT, DROP,
-          REJECT, LOG and QUEUE</para>
+          REJECT, LOG, NFQUEUE and QUEUE</para>
 
           <para>There is an implicit ACCEPT rule inserted at the end of this
           section.</para>
@@ -74,7 +74,7 @@
           section.</para>
 
           <para>The only ACTIONs allowed in this section are ACCEPT, DROP,
-          REJECT, LOG and QUEUE</para>
+          REJECT, LOG, NFQUEUE and QUEUE</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the RELATED_DISPOSITION (<ulink
@@ -90,7 +90,7 @@
           processed by rules in this section.</para>
 
           <para>The only Actions allowed in this section are ACCEPT, DROP,
-          REJECT, LOG and QUEUE.</para>
+          REJECT, LOG, NFQUEUE and QUEUE.</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the INVALID_DISPOSITION (<ulink
@@ -106,7 +106,7 @@
           processed by rules in this section.</para>
 
           <para>The only Actions allowed in this section are ACCEPT, DROP,
-          REJECT, LOG and QUEUE.</para>
+          REJECT, LOG, NFQUEUE and QUEUE.</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the UNTRACKED_DISPOSITION (<ulink
@@ -487,7 +487,7 @@
                 the<replaceable>
                 ip6tables-</replaceable><replaceable>target</replaceable> as a
                 builtin action in <ulink
-                url="shorewall6-actions.html">shorewall6-actions</ulink>(5).</para>
+                url="/manpages6/shorewall6-actions.html">shorewall6-actions</ulink>(5).</para>
 
                 <important>
                   <para>If you specify REJECT as the
@@ -642,7 +642,7 @@
               <listitem>
                 <para>like NFQUEUE but exempts the rule from being suppressed
                 by OPTIMIZE=1 in <ulink
-                url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
+                url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
               </listitem>
             </varlistentry>
 
@@ -829,7 +829,7 @@
 
           <para>If the <emphasis role="bold">ACTION</emphasis> names an
           <emphasis>action</emphasis> declared in <ulink
-          url="shorewall6-actions.html">shorewall6-actions</ulink>(5) or in
+          url="/manpages6/shorewall6-actions.html">shorewall6-actions</ulink>(5) or in
           /usr/share/shorewall/actions.std then:</para>
 
           <itemizedlist>
@@ -884,7 +884,7 @@
 
               <listitem>
                 <para>The name of a zone defined in <ulink
-                url="shorewall6-zones.html">shorewall6-zones</ulink>(5). When
+                url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5). When
                 only the zone name is specified, the packet source may be any
                 host in that zone.</para>
 
@@ -951,9 +951,9 @@
                 <replaceable>interface</replaceable> must be the name of an
                 interface associated with the named
                 <replaceable>zone</replaceable> in either <ulink
-                url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
+                url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
                 or <ulink
-                url="shorewall6.hosts.html">shorewall6-hosts</ulink>(5). Only
+                url="/manpages6/shorewall6.hosts.html">shorewall6-hosts</ulink>(5). Only
                 packets from hosts in the <replaceable>zone</replaceable> that
                 arrive through the named interface will match the rule.</para>
               </listitem>
@@ -971,7 +971,7 @@
                     follow the standard convention and be enclosed in square
                     brackets (e.g., [2001:470:b:227::0]/64). A network address
                     may be followed by exclusion (see <ulink
-                    url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                    url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
                   </listitem>
 
                   <listitem>
@@ -1009,7 +1009,7 @@
                     be specified by an ampersand ('&amp;') followed by the
                     logical name of the interface as found in the INTERFACE
                     column of <ulink
-                    url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>
+                    url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>
                     (5).</para>
                   </listitem>
                 </itemizedlist>
@@ -1031,7 +1031,7 @@
               <listitem>
                 <para>This form matches if the host IP address does not match
                 any of the entries in the exclusion (see <ulink
-                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -1139,7 +1139,7 @@
 
               <listitem>
                 <para>The name of a zone defined in <ulink
-                url="shorewall6-zones.html">shorewall6-zones</ulink>(5). When
+                url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5). When
                 only the zone name is specified, the packet destination may be
                 any host in that zone.</para>
 
@@ -1206,9 +1206,9 @@
                 <replaceable>interface</replaceable> must be the name of an
                 interface associated with the named
                 <replaceable>zone</replaceable> in either <ulink
-                url="shorewall-interfaces.html">shorewall6-interfaces</ulink>(5)
+                url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
                 or <ulink
-                url="shorewall.hosts.html">shorewall6-hosts</ulink>(5). Only
+                url="/manpages6/shorewall6.hosts.html">shorewall6-hosts</ulink>(5). Only
                 packets to hosts in the <replaceable>zone</replaceable> that
                 are sent through the named interface will match the
                 rule.</para>
@@ -1225,7 +1225,7 @@
                   <listitem>
                     <para>A host or network IP address. A network address may
                     be followed by exclusion (see <ulink
-                    url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                    url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
                   </listitem>
 
                   <listitem>
@@ -1257,7 +1257,7 @@
                     be specified by an ampersand ('&amp;') followed by the
                     logical name of the interface as found in the INTERFACE
                     column of <ulink
-                    url="/manpages/shorewall6-interfaces.html">shorewall6-interfaces</ulink>
+                    url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>
                     (5).</para>
                   </listitem>
                 </itemizedlist>
@@ -1280,7 +1280,7 @@
               <listitem>
                 <para>This form matches if the host IP address does not match
                 any of the entries in the exclusion (see <ulink
-                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -1392,7 +1392,7 @@
       <varlistentry>
         <term><emphasis role="bold">PROTO</emphasis> - {<emphasis
         role="bold">-</emphasis>|<emphasis
-        role="bold">tcp:syn</emphasis>|<emphasis
+        role="bold">tcp:[!]syn</emphasis>|<emphasis
         role="bold">ipp2p</emphasis>|<emphasis
         role="bold">ipp2p:udp</emphasis>|<emphasis
         role="bold">ipp2p:all</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis
@@ -1403,7 +1403,9 @@
           requires ipp2p match support in your kernel and ip6tables. <emphasis
           role="bold">tcp:syn</emphasis> implies <emphasis
           role="bold">tcp</emphasis> plus the SYN flag must be set and the
-          RST,ACK and FIN flags must be reset.</para>
+          RST,ACK and FIN flags must be reset. Beginning with Shorewall 5.1.3,
+          you may also specify <emphasis role="bold">tcp:!syn</emphasis>,
+          which matches if SYN is not set or if RST, ACK or FIN is set.</para>
 
           <para>Beginning with Shorewall6 4.4.19, this column can contain a
           comma-separated list of protocol-numbers and/or protocol names

Shorewall6/manpages/shorewall6-secmarks.xml

@@ -222,8 +222,9 @@
         role="bold">all}</emphasis></term>
 
         <listitem>
-          <para>Protocol - <emphasis role="bold">ipp2p</emphasis> requires
-          ipp2p match support in your kernel and iptables.</para>
+          <para>See <ulink
+          url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink> for
+          details.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall6/manpages/shorewall6-snat.xml

@@ -27,7 +27,7 @@
 
     <para>This file is used to define dynamic NAT (Masquerading) and to define
     Source NAT (SNAT). While still supported, its use is deprecated in favor
-    of <ulink url="shorewall6-snat.html">shorewall6-snat</ulink>(5) which was
+    of <ulink url="/manpages6/shorewall6-snat.html">shorewall6-snat</ulink>(5) which was
     introduced in Shorewall 5.0.14.</para>
 
     <warning>
@@ -84,7 +84,7 @@
                 <para>If you specify an address here, matching packets will
                 have their source address set to that address. If
                 ADD_SNAT_ALIASES is set to Yes or yes in <ulink
-                url="shorewall6.conf.html">shorewall6.conf</ulink>(5) then
+                url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5) then
                 Shorewall will automatically add this address to the INTERFACE
                 named in the first column.</para>
 
@@ -149,7 +149,7 @@
               <listitem>
                 <para>where <replaceable>action</replaceable> is an action
                 declared in <ulink
-                url="shorewall6-actions.html">shorewall6-actions(5)</ulink>
+                url="/manpages6/shorewall6-actions.html">shorewall6-actions(5)</ulink>
                 with the <option>nat</option> option. See <ulink
                 url="/Actions.html">www.shorewall.net/Actions.html</ulink> for
                 further information.</para>
@@ -200,7 +200,7 @@
           entry that defines <filename
           class="devicefile">ppp+</filename>.</para>
 
-          <para>Where <ulink url="/4.4/MultiISP.html#Shared">more that one
+          <para>Where <ulink url="MultiISP.html#Shared">more that one
           internet provider share a single interface</ulink>, the provider is
           specified by including the provider name or number in
           parentheses:</para>
@@ -234,8 +234,9 @@
 
         <listitem>
           <para>If you wish to restrict this entry to a particular protocol
-          then enter the protocol name (from protocols(5)) or number
-          here.</para>
+          then enter the protocol name (from protocols(5)) or number here. See
+          <ulink url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink> for
+          details.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall6/manpages/shorewall6-tcfilters.xml

@@ -89,11 +89,11 @@
           Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
           may be used if your kernel and ip6tables have the <firstterm>Basic
           Ematch </firstterm>capability and you set BASIC_FILTERS=Yes in
-          <ulink url="shorewall6.conf.html">shorewall6.conf (5)</ulink>. The
+          <ulink url="/manpages6/shorewall6.conf.html">shorewall6.conf (5)</ulink>. The
           ipset name may optionally be followed by a number or a comma
           separated list of src and/or dst enclosed in square brackets
           ([...]). See <ulink
-          url="shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for
+          url="/manpages6/shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for
           details.</para>
         </listitem>
       </varlistentry>
@@ -108,11 +108,11 @@
           Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
           may be used if your kernel and ip6tables have the <firstterm>Basic
           Ematch</firstterm> capability and you set BASIC_FILTERS=Yes in
-          <ulink url="shorewall6.conf.html">shorewall6.conf (5)</ulink>. The
+          <ulink url="/manpages6/shorewall6.conf.html">shorewall6.conf (5)</ulink>. The
           ipset name may optionally be followed by a number or a comma
           separated list of src and/or dst enclosed in square brackets
           ([...]). See <ulink
-          url="shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for
+          url="/manpages6/shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for
           details.</para>
         </listitem>
       </varlistentry>

Shorewall6/manpages/shorewall6-zones.xml

@@ -42,26 +42,27 @@
         role="bold">,</emphasis><emphasis>parent-zone</emphasis>]...]</term>
 
         <listitem>
-          <para>Name of the <emphasis>zone</emphasis>. The names "all",
-          "none", "SOURCE" and "DEST" are reserved and may not be used as zone
-          names. The maximum length of a zone name is determined by the
-          setting of the LOGFORMAT option in <ulink
-          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).
-          With the default LOGFORMAT, zone names can be at most 5 characters
+          <para>Name of the <emphasis>zone</emphasis>. Must start with a
+          letter and consist of letters, digits or '_'. The names "all",
+          "none", "any", "SOURCE" and "DEST" are reserved and may not be used
+          as zone names. The maximum length of a zone name is determined by
+          the setting of the LOGFORMAT option in <ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5). With
+          the default LOGFORMAT, zone names can be at most 5 characters
           long.</para>
 
           <blockquote>
             <para>The maximum length of an iptables log prefix is 29 bytes. As
             explained in <ulink
-            url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink> (5),
-            the default LOGPREFIX formatting string is “Shorewall:%s:%s:”
-            where the first %s is replaced by the chain name and the second is
+            url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink> (5), the legacy
+            default LOGPREFIX formatting string is “Shorewall:%s:%s:” where
+            the first %s is replaced by the chain name and the second is
             replaced by the disposition.</para>
 
             <itemizedlist>
               <listitem>
-                <para>The default formatting string has 12 fixed characters
-                ("Shorewall" and three colons).</para>
+                <para>The "Shorewall:%s:%s:" formatting string has 12 fixed
+                characters ("Shorewall" and three colons).</para>
               </listitem>
 
               <listitem>
@@ -72,7 +73,8 @@
               <listitem>
                 <para>The canonical name for the chain containing the rules
                 for traffic going from zone 1 to zone 2 is "&lt;zone
-                1&gt;2&lt;zone 2&gt;".</para>
+                1&gt;2&lt;zone 2&gt;" or "&lt;zone 1&gt;-&lt;zone
+                2&gt;".</para>
               </listitem>
 
               <listitem>
@@ -88,6 +90,29 @@
                 </simplelist>
               </listitem>
             </itemizedlist>
+
+            <para>In Shorewall 5.1.0, the LOGFORMAT in the default and sample
+            shorewall.conf files was changed to "%s:%s ".</para>
+
+            <itemizedlist>
+              <listitem>
+                <para>That formatting string has 2 fixed characters (":" and a
+                space).</para>
+              </listitem>
+
+              <listitem>
+                <para>So the maximum zone name length M is calculated
+                as:</para>
+
+                <simplelist>
+                  <member>2 + 6 + 2*M + 1 = 29</member>
+
+                  <member>2M = 29 - 2 + 6 + 1 = 20</member>
+
+                  <member>M = 10</member>
+                </simplelist>
+              </listitem>
+            </itemizedlist>
           </blockquote>
 
           <para>The order in which Shorewall6 matches addresses from packets