Correct $LOG_LEVEL expansion

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/install.sh

@@ -22,20 +22,64 @@
 #	along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
 
-VERSION=xxx # The Build script inserts the actual version
+VERSION=xxx #The Build script inserts the actual version
+
 PRODUCT=shorewall-core
 Product="Shorewall Core"
-
+ 
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
-    echo "where <option> is one of"
-    echo "  -h"
-    echo "  -v"
+    echo "usage: $ME [ <configuration-file> ] "
+    echo "       $ME -v"
+    echo "       $ME -h"
     exit $1
 }
 
+fatal_error()
+{
+    echo "   ERROR: $@" >&2
+    exit 1
+}
+
+split() {
+    local ifs
+    ifs=$IFS
+    IFS=:
+    set -- $1
+    echo $*
+    IFS=$ifs
+}
+
+qt()
+{
+    "$@" >/dev/null 2>&1
+}
+
+mywhich() {
+    local dir
+
+    for dir in $(split $PATH); do
+	if [ -x $dir/$1 ]; then
+	    echo $dir/$1
+	    return 0
+	fi
+    done
+
+    return 2
+}
+
+cant_autostart()
+{
+    echo
+    echo  "WARNING: Unable to configure shorewall to start automatically at boot" >&2
+}
+
+delete_file() # $1 = file to delete
+{
+    rm -f $1
+}
+
 install_file() # $1 = source $2 = target $3 = mode
 {
     if cp -f $1 $2; then
@@ -54,16 +98,16 @@ install_file() # $1 = source $2 = target $3 = mode
     exit 1
 }
 
+require()
+{
+    eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
+}
+
 #
 # Change to the directory containing this script
 #
 cd "$(dirname $0)"
 
-#
-# Source common functions
-#
-. ./lib.installer || { echo "ERROR: Can not load common functions." >&2; exit 1; }
-
 #
 # Parse the run line
 #
@@ -82,7 +126,7 @@ while [ $finished -eq 0 ]; do
 			usage 0
 			;;
 		    v)
-			echo "$Product Firewall Installer Version $VERSION"
+			echo "Shorewall Firewall Installer Version $VERSION"
 			exit 0
 			;;
 		    *)
@@ -104,14 +148,14 @@ done
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
+	. ./shorewallrc
 	file=./shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
     elif [ -f ~/.shorewallrc ]; then
+	. ~/.shorewallrc || exit 1
 	file=~/.shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
+	. /usr/share/shorewall/shorewallrc
 	file=/usr/share/shorewall/shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -125,7 +169,7 @@ elif [ $# -eq 1 ]; then
 	    ;;
     esac
 
-    . $file || fatal_error "Can not load the RC file: $file"
+    . $file
 else
     usage 1
 fi
@@ -241,12 +285,13 @@ case "$HOST" in
     debian|gentoo|redhat|slackware|archlinux|linux|suse|openwrt)
 	;;
     *)
-	fatal_error "Unknown HOST \"$HOST\""
+	echo "ERROR: Unknown HOST \"$HOST\"" >&2
+	exit 1;
 	;;
 esac
 
 if [ -z "$file" ]; then
-    if [ $HOST = linux ]; then
+    if $HOST = linux; then
 	file=shorewallrc.default
     else
 	file=shorewallrc.${HOST}
@@ -259,8 +304,7 @@ if [ -z "$file" ]; then
     echo "" >&2
     echo "Example:" >&2
     echo "" >&2
-    echo "   ./install.sh $file" >&2
-    exit 1
+    echo "   ./install.sh $file" &>2
 fi
 
 if [ -n "$DESTDIR" ]; then
@@ -271,31 +315,45 @@ if [ -n "$DESTDIR" ]; then
     fi
 fi
 
-echo "Installing $Product Version $VERSION"
+echo "Installing Shorewall Core Version $VERSION"
 
 #
 # Create directories
 #
-make_parent_directory ${DESTDIR}${LIBEXECDIR}/shorewall 0755
+mkdir -p ${DESTDIR}${LIBEXECDIR}/shorewall
+chmod 755 ${DESTDIR}${LIBEXECDIR}/shorewall
 
-make_parent_directory ${DESTDIR}${SHAREDIR}/shorewall 0755
+mkdir -p ${DESTDIR}${SHAREDIR}/shorewall
+chmod 755 ${DESTDIR}${SHAREDIR}/shorewall
 
-make_parent_directory ${DESTDIR}${CONFDIR} 0755
+mkdir -p ${DESTDIR}${CONFDIR}
+chmod 755 ${DESTDIR}${CONFDIR}
 
-[ -n "${SYSCONFDIR}" ] && make_parent_directory ${DESTDIR}${SYSCONFDIR} 0755
+if [ -n "${SYSCONFDIR}" ]; then
+    mkdir -p ${DESTDIR}${SYSCONFDIR}
+    chmod 755 ${DESTDIR}${SYSCONFDIR}
+fi
 
 if [ -z "${SERVICEDIR}" ]; then
     SERVICEDIR="$SYSTEMD"
 fi
 
-[ -n "${SERVICEDIR}" ] && make_parent_directory ${DESTDIR}${SERVICEDIR} 0755
+if [ -n "${SERVICEDIR}" ]; then
+    mkdir -p ${DESTDIR}${SERVICEDIR}
+    chmod 755 ${DESTDIR}${SERVICEDIR}
+fi
 
-make_parent_directory ${DESTDIR}${SBINDIR} 0755
+mkdir -p ${DESTDIR}${SBINDIR}
+chmod 755 ${DESTDIR}${SBINDIR}
 
-[ -n "${MANDIR}" ] && make_parent_directory ${DESTDIR}${MANDIR} 0755
+if [ -n "${MANDIR}" ]; then
+    mkdir -p ${DESTDIR}${MANDIR}
+    chmod 755 ${DESTDIR}${MANDIR}
+fi
 
 if [ -n "${INITFILE}" ]; then
-    make_parent_directory ${DESTDIR}${INITDIR} 0755
+    mkdir -p ${DESTDIR}${INITDIR}
+    chmod 755 ${DESTDIR}${INITDIR}
 
     if [ -n "$AUXINITSOURCE" -a -f "$AUXINITSOURCE" ]; then
 	install_file $AUXINITSOURCE ${DESTDIR}${INITDIR}/$AUXINITFILE 0544
@@ -324,14 +382,8 @@ echo "wait4ifup installed in ${DESTDIR}${LIBEXECDIR}/shorewall/wait4ifup"
 # Install the libraries
 #
 for f in lib.* ; do
-    case $f in
-        *installer)
-            ;;
-        *)
-            install_file $f ${DESTDIR}${SHAREDIR}/shorewall/$f 0644
-            echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/shorewall/$f"
-            ;;
-    esac
+    install_file $f ${DESTDIR}${SHAREDIR}/shorewall/$f 0644
+    echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/shorewall/$f"
 done
 
 if [ $SHAREDIR != /usr/share ]; then
@@ -346,11 +398,11 @@ fi
 if [ -n "$MANDIR" ]; then
     cd manpages
 
-    [ -n "$INSTALLD" ] || make_parent_directory ${DESTDIR}${MANDIR}/man8 0755
+    [ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man8/
 
     for f in *.8; do
 	gzip -9c $f > $f.gz
-	install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 0644
+	install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 644
 	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man8/$f.gz"
     done
 
@@ -367,7 +419,7 @@ ln -sf lib.base ${DESTDIR}${SHAREDIR}/shorewall/functions
 # Create the version file
 #
 echo "$VERSION" > ${DESTDIR}${SHAREDIR}/shorewall/coreversion
-chmod 0644 ${DESTDIR}${SHAREDIR}/shorewall/coreversion
+chmod 644 ${DESTDIR}${SHAREDIR}/shorewall/coreversion
 
 if [ -z "${DESTDIR}" ]; then
     if [ $update -ne 0 ]; then
@@ -392,20 +444,14 @@ fi
 
 if [ ${SHAREDIR} != /usr/share ]; then
     for f in lib.*; do
-        case $f in
-            *installer)
-                ;;
-            *)
-                if [ $BUILD != apple ]; then
-                    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/$f
-                else
-                    eval sed -i \'\' -e \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/$f
-                fi
-                ;;
-        esac
+	if [ $BUILD != apple ]; then
+	    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/$f
+	else
+	    eval sed -i \'\' -e \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/$f
+	fi
     done
 fi
 #
-# Report Success
+#  Report Success
 #
-echo "$Product Version $VERSION Installed"
+echo "Shorewall Core Version $VERSION Installed"

Shorewall-core/lib.installer

@@ -1,89 +0,0 @@
-#
-#
-# Shorewall 5.0 -- /usr/share/shorewall/lib.installer.
-#
-#     (c) 2017 - Tom Eastep (teastep@shorewall.net)
-#     (c) 2017 - Matt Darfeuille (matdarf@gmail.com)
-#
-#	Complete documentation is available at http://shorewall.net
-#
-#       This program is part of Shorewall.
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of the GNU General Public License as published by the
-#       Free Software Foundation, either version 2 of the license or, at your
-#       option, any later version.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, see <http://www.gnu.org/licenses/>.
-#
-# The purpose of this library is to hold those functions used by the products installer.
-#
-#########################################################################################
-
-fatal_error()
-{
-    echo "   ERROR: $@" >&2
-    exit 1
-}
-
-split() {
-    local ifs
-    ifs=$IFS
-    IFS=:
-    set -- $1
-    echo $*
-    IFS=$ifs
-}
-
-qt()
-{
-    "$@" >/dev/null 2>&1
-}
-
-mywhich() {
-    local dir
-
-    for dir in $(split $PATH); do
-	if [ -x $dir/$1 ]; then
-	    return 0
-	fi
-    done
-
-    return 2
-}
-
-delete_file() # $1 = file to delete
-{
-    rm -f $1
-}
-
-require()
-{
-    eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
-}
-
-make_directory() # $1 = directory , $2 = mode
-{
-    mkdir $1
-    chmod $2 $1
-    [ -n "$OWNERSHIP" ] && chown $OWNERSHIP $1
-}
-
-make_parent_directory() # $1 = directory , $2 = mode
-{
-    mkdir -p $1
-    chmod $2 $1
-    [ -n "$OWNERSHIP" ] && chown $OWNER:$GROUP $1
-}
-
-cant_autostart()
-{
-    echo
-    echo  "WARNING: Unable to configure $Product to start automatically at boot" >&2
-}

Shorewall-core/lib.uninstaller

@@ -1,106 +0,0 @@
-#
-#
-# Shorewall 5.0 -- /usr/share/shorewall/lib.installer.
-#
-#     (c) 2017 - Tom Eastep (teastep@shorewall.net)
-#     (c) 2017 - Matt Darfeuille (matdarf@gmail.com)
-#
-#	Complete documentation is available at http://shorewall.net
-#
-#       This program is part of Shorewall.
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of the GNU General Public License as published by the
-#       Free Software Foundation, either version 2 of the license or, at your
-#       option, any later version.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, see <http://www.gnu.org/licenses/>.
-#
-# The purpose of this library is to hold those functions used by the products uninstaller.
-#
-#########################################################################################
-
-fatal_error()
-{
-    echo "   ERROR: $@" >&2
-    exit 1
-}
-
-split() {
-    local ifs
-    ifs=$IFS
-    IFS=:
-    set -- $1
-    echo $*
-    IFS=$ifs
-}
-
-qt()
-{
-    "$@" >/dev/null 2>&1
-}
-
-mywhich() {
-    local dir
-
-    for dir in $(split $PATH); do
-	if [ -x $dir/$1 ]; then
-	    return 0
-	fi
-    done
-
-    return 2
-}
-
-remove_file() # $1 = file to remove
-{
-    if [ -n "$1" ] ; then
-        if [ -f $1 -o -L $1 ] ; then
-            rm -f $1
-            echo "$1 Removed"
-        fi
-    fi
-}
-
-remove_directory() # $1 = directory to remove
-{
-    if [ -n "$1" ] ; then
-        if [ -d $1 ] ; then
-            rm -rf $1
-            echo "$1 Removed"
-        fi
-    fi
-}
-
-remove_file_with_wildcard() # $1 = file with wildcard to remove
-{
-    if [ -n "$1" ] ; then
-        for f in $1; do
-            if [ -d $f ] ; then
-                rm -rf $f
-                echo "$f Removed"
-            elif [ -f $f -o -L $f ] ; then
-                rm -f $f
-                echo "$f Removed"
-            fi
-        done
-    fi
-}
-
-restore_file() # $1 = file to restore
-{
-    if [ -f ${1}-shorewall.bkout ]; then
-	if (mv -f ${1}-shorewall.bkout $1); then
-	    echo
-	    echo "$1 restored"
-        else
-	    exit 1
-        fi
-    fi
-}

Shorewall-core/manpages/shorewall.xml

@@ -2016,7 +2016,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">remote-reload
+        <term><emphasis role="bold">remote-reload [-<option>n</option>]
         </emphasis>[-<option>s</option>] [-<option>c</option>]
         [-<option>r</option> <replaceable>root-user-name</replaceable>]
         [-<option>T</option>] [-<option>i</option>] [ [ -D ]
@@ -2056,6 +2056,9 @@
           <replaceable>directory</replaceable>, then the <option>-D</option>
           option must be given.</para>
 
+          <para>The <option>-n</option> option causes Shorewall to avoid
+          updating the routing table(s).</para>
+
           <para>If <emphasis role="bold">-s</emphasis> is specified and the
           <emphasis role="bold">restart</emphasis> command succeeds, then the
           remote Shorewall-lite configuration is saved by executing <emphasis

Shorewall-core/shorewallrc.debian.systemd

@@ -1,5 +1,5 @@
 #
-# Debian Shorewall 5.0 rc file
+# Debian Shorewall 4.5 rc file
 #
 BUILD=					#Default is to detect the build system
 HOST=debian
@@ -14,7 +14,7 @@ INITDIR=				#Directory where SysV init scripts are installed.
 INITFILE=				#Name of the product's installed SysV init script
 INITSOURCE=init.debian.sh		#Name of the distributed file to be installed as the SysV init script
 ANNOTATED=				#If non-zero, annotated configuration files are installed
-SYSCONFFILE=default.debian.systemd		#Name of the distributed file to be installed in $SYSCONFDIR
+SYSCONFFILE=default.debian		#Name of the distributed file to be installed in $SYSCONFDIR
 SERVICEFILE=$PRODUCT.service.debian     #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
 SYSCONFDIR=/etc/default			#Directory where SysV init parameter files are installed
 SERVICEDIR=/lib/systemd/system		#Directory where .service files are installed (systems running systemd only)

Shorewall-core/shorewallrc.debian.sysvinit

@@ -1,5 +1,5 @@
 #
-# Debian Shorewall 5.0 rc file
+# Debian Shorewall 4.5 rc file
 #
 BUILD=                                  #Default is to detect the build system
 HOST=debian
@@ -14,7 +14,7 @@ INITDIR=/etc/init.d                     #Directory where SysV init scripts are i
 INITFILE=$PRODUCT                       #Name of the product's installed SysV init script
 INITSOURCE=init.debian.sh               #Name of the distributed file to be installed as the SysV init script
 ANNOTATED=                              #If non-zero, annotated configuration files are installed
-SYSCONFFILE=default.debian.sysvinit              #Name of the distributed file to be installed in $SYSCONFDIR
+SYSCONFFILE=default.debian              #Name of the distributed file to be installed in $SYSCONFDIR
 SERVICEFILE=				#Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
 SYSCONFDIR=/etc/default                 #Directory where SysV init parameter files are installed
 SERVICEDIR=				#Directory where .service files are installed (systems running systemd only)

Shorewall-core/shorewallrc.default

@@ -1,8 +1,8 @@
 #
 # Default Shorewall 5.0 rc file
 #
-BUILD=                                  #Default is to detect the build system
 HOST=linux                              #Generic Linux
+BUILD=                                  #Default is to detect the build system
 PREFIX=/usr                             #Top-level directory for shared files, libraries, etc.
 SHAREDIR=${PREFIX}/share                #Directory for arch-neutral files.
 LIBEXECDIR=${PREFIX}/share              #Directory for executable scripts.

Shorewall-core/shorewallrc.openwrt

@@ -1,8 +1,8 @@
 #
-# OpenWRT Shorewall 5.0 rc file
+# Created by Shorewall Core version 5.0.2-RC1 configure -  Fri, Nov 06, 2015 10:02:03 AM
+#
+# Input: host=openwrt
 #
-BUILD=                                 #Default is to detect the build system
-HOST=openwrt
 PREFIX=/usr                             #Top-level directory for shared files, libraries, etc.
 SHAREDIR=${PREFIX}/share                #Directory for arch-neutral files.
 LIBEXECDIR=${PREFIX}/share              #Directory for executable scripts.

Shorewall-core/uninstall.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Script to back uninstall Shoreline Firewall Core Modules
+# Script to back uninstall Shoreline Firewall
 #
 #     (c) 2000-2016 - Tom Eastep (teastep@shorewall.net)
 #
@@ -26,75 +26,63 @@
 #       You may only use this script to uninstall the version
 #       shown below. Simply run this script to remove Shorewall Firewall
 
-VERSION=xxx # The Build script inserts the actual version
-PRODUCT=shorewall-core
+VERSION=xxx #The Build script inserts the actual version
+PRODUCT="shorewall-core"
 Product="Shorewall Core"
-
+ 
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
-    echo "where <option> is one of"
-    echo "  -h"
-    echo "  -v"
+    echo "usage: $ME [ <shorewallrc file> ]"
     exit $1
 }
 
+fatal_error()
+{
+    echo "   ERROR: $@" >&2
+    exit 1
+}
+
+qt()
+{
+    "$@" >/dev/null 2>&1
+}
+
+restore_file() # $1 = file to restore
+{
+    if [ -f ${1}-shorewall.bkout ]; then
+	if (mv -f ${1}-shorewall.bkout $1); then
+	    echo
+	    echo "$1 restored"
+        else
+	    exit 1
+        fi
+    fi
+}
+
+remove_file() # $1 = file to restore
+{
+    if [ -f $1 -o -L $1 ] ; then
+	rm -f $1
+	echo "$1 Removed"
+    fi
+}
+
 #
 # Change to the directory containing this script
 #
 cd "$(dirname $0)"
 
-#
-# Source common functions
-#
-. ./lib.uninstaller || { echo "ERROR: Can not load common functions." >&2; exit 1; }
-
-#
-# Parse the run line
-#
-finished=0
-
-while [ $finished -eq 0 ]; do
-    option=$1
-
-    case "$option" in
-	-*)
-	    option=${option#-}
-
-	    while [ -n "$option" ]; do
-		case $option in
-		    h)
-			usage 0
-			;;
-		    v)
-			echo "$Product Firewall Uninstaller Version $VERSION"
-			exit 0
-			;;
-		    *)
-			usage 1
-			;;
-		esac
-	    done
-
-	    shift
-	    ;;
-	*)
-	    finished=1
-	    ;;
-    esac
-done
-
 #
 # Read the RC file
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-        . ./shorewallrc || fatal_error "Can not load the RC file: ./shorewallrc"
+	. ./shorewallrc
     elif [ -f ~/.shorewallrc ]; then
-        . ~/.shorewallrc || fatal_error "Can not load the RC file: ~/.shorewallrc"
+	. ~/.shorewallrc || exit 1
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-        . /usr/share/shorewall/shorewallrc || fatal_error "Can not load the RC file: /usr/share/shorewall/shorewallrc"
+	. /usr/share/shorewall/shorewallrc
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -104,11 +92,11 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file || exit 1
+	    file=./$file
 	    ;;
     esac
 
-    . $file || fatal_error "Can not load the RC file: $file"
+    . $file
 else
     usage 1
 fi
@@ -116,26 +104,20 @@ fi
 if [ -f ${SHAREDIR}/shorewall/coreversion ]; then
     INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall/coreversion)"
     if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
-	echo "WARNING: $Product Version $INSTALLED_VERSION is installed"
+	echo "WARNING: Shorewall Core Version $INSTALLED_VERSION is installed"
 	echo "         and this is the $VERSION uninstaller."
 	VERSION="$INSTALLED_VERSION"
     fi
 else
-    echo "WARNING: $Product Version $VERSION is not installed"
+    echo "WARNING: Shorewall Core Version $VERSION is not installed"
     VERSION=""
 fi
 
-echo "Uninstalling $Product $VERSION"
+echo "Uninstalling Shorewall Core $VERSION"
 
-if [ -n "${MANDIR}" ]; then
-    remove_file_with_wildcard ${MANDIR}/man5/shorewall\*
-    remove_file_with_wildcard ${MANDIR}/man8/shorewall\*
-fi
+rm -rf ${SHAREDIR}/shorewall
+rm -f ~/.shorewallrc
+
+echo "Shorewall Core Uninstalled"
 
-remove_directory ${SHAREDIR}/shorewall
-remove_file ~/.shorewallrc
 
-#
-# Report Success
-#
-echo "$Product $VERSION Uninstalled"

Shorewall-init/default.debian.systemd

@@ -1,21 +0,0 @@
-# List the Shorewall products that Shorewall-init is to
-# initialize (space-separated list).
-#
-# Sample: PRODUCTS="shorewall shorewall6"
-#
-PRODUCTS=""
-
-#
-# Set this to 1 if you want Shorewall-init to react to
-# ifup/ifdown and NetworkManager events
-#
-IFUPDOWN=0
-#
-# Where Up/Down events get logged
-#
-LOGFILE=/var/log/shorewall-ifupdown.log
-
-# Startup options - set verbosity to 0 (minimal reporting)
-OPTIONS="-V0"
-
-# IOF

Shorewall-init/default.debian.sysvinit

@@ -1,27 +0,0 @@
-# List the Shorewall products that Shorewall-init is to
-# initialize (space-separated list).
-#
-# Sample: PRODUCTS="shorewall shorewall6"
-#
-PRODUCTS=""
-
-#
-# Set this to 1 if you want Shorewall-init to react to
-# ifup/ifdown and NetworkManager events
-#
-IFUPDOWN=0
-#
-# Set this to the name of the file that is to hold
-# ipset contents. Shorewall-init will load those ipsets
-# during 'start' and will save them there during 'stop'.
-#
-SAVE_IPSETS=""
-#
-# Where Up/Down events get logged
-#
-LOGFILE=/var/log/shorewall-ifupdown.log
-
-# Startup options - set verbosity to 0 (minimal reporting)
-OPTIONS="-V0"
-
-# IOF

Shorewall-init/install.sh

@@ -27,21 +27,58 @@
 #       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
 
-VERSION=xxx # The Build script inserts the actual version
+VERSION=xxx #The Build script inserts the actual version.
 PRODUCT=shorewall-init
 Product="Shorewall Init"
 
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
-    echo "where <option> is one of"
-    echo "  -h"
-    echo "  -v"
-    echo "  -n"
+    echo "usage: $ME [ <configuration-file> ]"
+    echo "       $ME -v"
+    echo "       $ME -h"
+    echo "       $ME -n"
     exit $1
 }
 
+fatal_error() 
+{
+    echo "   ERROR: $@" >&2
+    exit 1
+}
+
+split() {
+    local ifs
+    ifs=$IFS
+    IFS=:
+    set -- $1
+    echo $*
+    IFS=$ifs
+}
+
+qt()
+{
+    "$@" >/dev/null 2>&1
+}
+
+mywhich() {
+    local dir
+
+    for dir in $(split $PATH); do
+	if [ -x $dir/$1 ]; then
+	    return 0
+	fi
+    done
+
+    return 2
+}
+
+cant_autostart()
+{
+    echo
+    echo  "WARNING: Unable to configure shorewall init to start automatically at boot" >&2
+}
+
 install_file() # $1 = source $2 = target $3 = mode
 {
     if cp -f $1 $2; then
@@ -60,16 +97,23 @@ install_file() # $1 = source $2 = target $3 = mode
     exit 1
 }
 
+make_directory() # $1 = directory , $2 = mode
+{
+    mkdir -p $1
+    chmod 0755 $1
+    [ -n "$OWNERSHIP" ] && chown $OWNERSHIP $1
+}
+
+require() 
+{
+    eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
+}
+
 #
 # Change to the directory containing this script
 #
 cd "$(dirname $0)"
 
-#
-# Source common functions
-#
-. ./lib.installer || { echo "ERROR: Can not load common functions." >&2; exit 1; }
-
 #
 # Parse the run line
 #
@@ -90,7 +134,7 @@ while [ $finished -eq 0 ] ; do
 			usage 0
 			;;
 		    v)
-			echo "$Product Firewall Installer Version $VERSION"
+			echo "Shorewall-init Firewall Installer Version $VERSION"
 			exit 0
 			;;
 		    n*)
@@ -115,17 +159,17 @@ done
 # Read the RC file
 #
 if [ $# -eq 0 ]; then
+    #
+    # Load packager's settings if any
+    #
     if [ -f ./shorewallrc ]; then
+	. ./shorewallrc || exit 1
 	file=./shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
     elif [ -f ~/.shorewallrc ]; then
+	. ~/.shorewallrc || exit 1
 	file=~/.shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
-    elif [ -f /usr/share/shorewall/shorewallrc ]; then
-	file=/usr/share/shorewall/shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
-    else
-	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
+     else
+	fatal_error "No configuration file specified and ~/.shorewallrc not found"
     fi
 elif [ $# -eq 1 ]; then
     file=$1
@@ -133,11 +177,11 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file || exit 1
+	    file=./$file
 	    ;;
     esac
 
-    . $file || fatal_error "Can not load the RC file: $file"
+    . $file
 else
     usage 1
 fi
@@ -254,10 +298,12 @@ case "$HOST" in
 	echo "Installing Openwrt-specific configuration..."
 	;;
     linux)
-	fatal_error "Shorewall-init is not supported on this system"
+	echo "ERROR: Shorewall-init is not supported on this system" >&2
+	exit 1
 	;;
     *)
-	fatal_error "Unsupported HOST distribution: \"$HOST\""
+	echo "ERROR: Unsupported HOST distribution: \"$HOST\"" >&2
+	exit 1;
 	;;
 esac
 
@@ -269,27 +315,30 @@ if [ -n "$DESTDIR" ]; then
 	OWNERSHIP=""
     fi
     
-    make_parent_directory ${DESTDIR}${INITDIR} 0755
+    make_directory ${DESTDIR}${INITDIR} 0755
 fi
 
-echo "Installing $Product Version $VERSION"
+echo "Installing Shorewall Init Version $VERSION"
 
 #
 # Check for /usr/share/shorewall-init/version
 #
-if [ -f ${DESTDIR}${SHAREDIR}/$PRODUCT/version ]; then
+if [ -f ${DESTDIR}${SHAREDIR}/shorewall-init/version ]; then
     first_install=""
 else
     first_install="Yes"
 fi
 
-[ -n "$DESTDIR" ] && make_parent_directory ${DESTDIR}${CONFDIR}/logrotate.d 0755
+if [ -n "$DESTDIR" ]; then
+    mkdir -p ${DESTDIR}${CONFDIR}/logrotate.d
+    chmod 0755 ${DESTDIR}${CONFDIR}/logrotate.d
+fi
 
 #
 # Install the Firewall Script
 #
 if [ -n "$INITFILE" ]; then
-    make_parent_directory ${DESTDIR}${INITDIR} 0755
+    mkdir -p ${DESTDIR}${INITDIR}
     install_file $INITSOURCE ${DESTDIR}${INITDIR}/$INITFILE 0544
     [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${INITDIR}/$INITFILE
     
@@ -308,21 +357,25 @@ if [ -z "${SERVICEDIR}" ]; then
 fi
 
 if [ -n "$SERVICEDIR" ]; then
-    make_parent_directory ${DESTDIR}${SERVICEDIR} 0755
+    mkdir -p ${DESTDIR}${SERVICEDIR}
     [ -z "$SERVICEFILE" ] && SERVICEFILE=$PRODUCT.service
     install_file $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service 0644
     [ ${SBINDIR} != /sbin ] && eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
     echo "Service file $SERVICEFILE installed as ${DESTDIR}${SERVICEDIR}/$PRODUCT.service"
-    [ -n "$DESTDIR" -o $configure -eq 0 ] && make_parent_directory ${DESTDIR}${SBINDIR} 0755
-    install_file $PRODUCT ${DESTDIR}${SBINDIR}/$PRODUCT 0700
-    [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/$PRODUCT
-    echo "CLI installed as ${DESTDIR}${SBINDIR}/$PRODUCT"
+    if [ -n "$DESTDIR" -o $configure -eq 0 ]; then
+	mkdir -p ${DESTDIR}${SBINDIR}
+        chmod 0755 ${DESTDIR}${SBINDIR}
+    fi
+    install_file shorewall-init ${DESTDIR}${SBINDIR}/shorewall-init 0700
+    [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/shorewall-init
+    echo "CLI installed as ${DESTDIR}${SBINDIR}/shorewall-init"
 fi
 
 #
 # Create /usr/share/shorewall-init if needed
 #
-make_parent_directory ${DESTDIR}${SHAREDIR}/$PRODUCT 0755
+mkdir -p ${DESTDIR}${SHAREDIR}/shorewall-init
+chmod 0755 ${DESTDIR}${SHAREDIR}/shorewall-init
 
 #
 # Install logrotate file
@@ -335,53 +388,55 @@ fi
 #
 # Create the version file
 #
-echo "$VERSION" > ${DESTDIR}/${SHAREDIR}/$PRODUCT/version
-chmod 0644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
+echo "$VERSION" > ${DESTDIR}/${SHAREDIR}/shorewall-init/version
+chmod 0644 ${DESTDIR}${SHAREDIR}/shorewall-init/version
 
 #
 # Remove and create the symbolic link to the init script
 #
 if [ -z "$DESTDIR" ]; then
-    rm -f ${SHAREDIR}/$PRODUCT/init
-    ln -s ${INITDIR}/${INITFILE} ${SHAREDIR}/$PRODUCT/init
+    rm -f ${SHAREDIR}/shorewall-init/init
+    ln -s ${INITDIR}/${INITFILE} ${SHAREDIR}/shorewall-init/init
 fi
 
 if [ $HOST = debian ]; then
     if [ -n "${DESTDIR}" ]; then
-	make_parent_directory ${DESTDIR}${ETC}/network/if-up.d 0755
-	make_parent_directory ${DESTDIR}${ETC}/network/if-down.d 0755
-	make_parent_directory ${DESTDIR}${ETC}/network/if-post-down.d 0755
+	mkdir -p ${DESTDIR}${ETC}/network/if-up.d/
+	mkdir -p ${DESTDIR}${ETC}/network/if-down.d/
+	mkdir -p ${DESTDIR}${ETC}/network/if-post-down.d/
     elif [ $configure -eq 0 ]; then
-	make_parent_directory ${DESTDIR}${CONFDIR}/network/if-up.d 0755
-	make_parent_directory ${DESTDIR}${CONFDIR}/network/if-down.d 0755
-	make_parent_directory ${DESTDIR}${CONFDIR}/network/if-post-down.d 0755
+	mkdir -p ${DESTDIR}${CONFDIR}/network/if-up.d/
+	mkdir -p ${DESTDIR}${CONFDIR}/network/if-down.d/
+	mkdir -p ${DESTDIR}${CONFDIR}/network/if-post-down.d/
     fi
 
-    if [ ! -f ${DESTDIR}${CONFDIR}/default/$PRODUCT ]; then
-	[ -n "${DESTDIR}" ] && make_parent_directory ${DESTDIR}${ETC}/default 0755
+    if [ ! -f ${DESTDIR}${CONFDIR}/default/shorewall-init ]; then
+	if [ -n "${DESTDIR}" ]; then
+	    mkdir -p ${DESTDIR}${ETC}/default
+	fi
 
-	[ $configure -eq 1 ] || make_parent_directory ${DESTDIR}${CONFDIR}/default 0755
-	install_file ${SYSCONFFILE} ${DESTDIR}${ETC}/default/$PRODUCT 0644
-	echo "${SYSCONFFILE} file installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}"
+	[ $configure -eq 1 ] || mkdir -p ${DESTDIR}${CONFDIR}/default
+	install_file sysconfig ${DESTDIR}${ETC}/default/shorewall-init 0644
+	echo "sysconfig file installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}"
     fi
 
     IFUPDOWN=ifupdown.debian.sh
 else
     if [ -n "$DESTDIR" ]; then
-	make_parent_directory ${DESTDIR}${SYSCONFDIR} 0755
+	mkdir -p ${DESTDIR}${SYSCONFDIR}
 
 	if [ -z "$RPM" ]; then
 	    if [ $HOST = suse ]; then
-		make_parent_directory ${DESTDIR}${ETC}/sysconfig/network/if-up.d 0755
-		make_parent_directory ${DESTDIR}${ETC}/sysconfig/network/if-down.d 0755
+		mkdir -p ${DESTDIR}${ETC}/sysconfig/network/if-up.d
+		mkdir -p ${DESTDIR}${ETC}/sysconfig/network/if-down.d
 	    elif [ $HOST = gentoo ]; then
 		# Gentoo does not support if-{up,down}.d
 		/bin/true
 	    elif [ $HOST = openwrt ]; then
-		# Not implemented on OpenWRT
+		# Not implemented on openwrt
 		/bin/true
 	    else
-		make_parent_directory ${DESTDIR}/${ETC}/NetworkManager/dispatcher.d 0755
+		mkdir -p ${DESTDIR}/${ETC}/NetworkManager/dispatcher.d
 	    fi
 	fi
     fi
@@ -403,13 +458,13 @@ if [ $HOST != openwrt ]; then
 
     [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ifupdown
 
-    make_parent_directory ${DESTDIR}${LIBEXECDIR}/$PRODUCT 0755
+    mkdir -p ${DESTDIR}${LIBEXECDIR}/shorewall-init
 
-    install_file ifupdown ${DESTDIR}${LIBEXECDIR}/$PRODUCT/ifupdown 0544
+    install_file ifupdown ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown 0544
 fi
 
 if [ -d ${DESTDIR}/etc/NetworkManager ]; then
-    [ $configure -eq 1 ] || make_parent_directory ${DESTDIR}${CONFDIR}/NetworkManager/dispatcher.d 0755
+    [ $configure -eq 1 ] || mkdir -p ${DESTDIR}${CONFDIR}/NetworkManager/dispatcher.d/
     install_file ifupdown ${DESTDIR}${ETC}/NetworkManager/dispatcher.d/01-shorewall 0544
 fi
 
@@ -428,8 +483,8 @@ case $HOST in
     suse)
 	if [ -z "$RPM" ]; then
 	    if [ $configure -eq 0 ]; then
-		make_parent_directory ${DESTDIR}${SYSCONFDIR}/network/if-up.d 0755
-		make_parent_directory ${DESTDIR}${SYSCONFDIR}/network/if-down.d 0755
+		mkdir -p ${DESTDIR}${SYSCONFDIR}/network/if-up.d/
+		mkdir -p ${DESTDIR}${SYSCONFDIR}/network/if-down.d/
 	    fi
 
 	    install_file ifupdown ${DESTDIR}${SYSCONFDIR}/network/if-up.d/shorewall 0544
@@ -463,17 +518,17 @@ if [ -z "$DESTDIR" ]; then
 	if [ $HOST = debian ]; then
 	    if [ -n "$SERVICEDIR" ]; then
 		if systemctl enable ${PRODUCT}.service; then
-                    echo "$Product will start automatically at boot"
+                    echo "Shorewall Init will start automatically at boot"
 		fi
 	    elif mywhich insserv; then
-		if insserv ${INITDIR}/$PRODUCT; then
-                    echo "$Product will start automatically at boot"
+		if insserv ${INITDIR}/shorewall-init; then
+		    echo "Shorewall Init will start automatically at boot"
 		else
 		    cant_autostart
 		fi
 	    elif mywhich update-rc.d ; then
 		if update-rc.d $PRODUCT enable; then
-                    echo "$Product will start automatically at boot"
+		    echo "$PRODUCT will start automatically at boot"
 		    echo "Set startup=1 in ${CONFDIR}/default/$PRODUCT to enable"
 		else
 		    cant_autostart
@@ -494,31 +549,31 @@ if [ -z "$DESTDIR" ]; then
 	    /bin/true
 	else
 	    if [ -n "$SERVICEDIR" ]; then
-		if systemctl enable ${PRODUCT}.service; then
-		    echo "$Product will start automatically at boot"
+		if systemctl enable shorewall-init.service; then
+		    echo "Shorewall Init will start automatically at boot"
 		fi
 	    elif [ -x ${SBINDIR}/insserv -o -x /usr${SBINDIR}/insserv ]; then
-		if insserv ${INITDIR}/$PRODUCT ; then
-		    echo "$Product will start automatically at boot"
+		if insserv ${INITDIR}/shorewall-init ; then
+		    echo "Shorewall Init will start automatically at boot"
 		else
 		    cant_autostart
 		fi
 	    elif [ -x ${SBINDIR}/chkconfig -o -x /usr${SBINDIR}/chkconfig ]; then
-		if chkconfig --add $PRODUCT ; then
-		    echo "$Product will start automatically at boot"
-		    chkconfig --list $PRODUCT
+		if chkconfig --add shorewall-init ; then
+		    echo "Shorewall Init will start automatically in run levels as follows:"
+		    chkconfig --list shorewall-init
 		else
 		    cant_autostart
 		fi
 	    elif [ -x ${SBINDIR}/rc-update ]; then
-		if rc-update add $PRODUCT default; then
-		    echo "$Product will start automatically at boot"
+		if rc-update add shorewall-init default; then
+		    echo "Shorewall Init will start automatically at boot"
 		else
 		    cant_autostart
 		fi
 	    elif [ $HOST = openwrt -a -f ${CONFDIR}/rc.common ]; then
 		/etc/init.d/$PRODUCT enable
-		if /etc/init.d/$PRODUCT enabled; then
+		if /etc/init.d/shorewall-init enabled; then
 		    echo "$Product will start automatically at boot"
 		else
 		    cant_autostart
@@ -532,11 +587,11 @@ else
     if [ $configure -eq 1 -a -n "$first_install" ]; then
 	if [ $HOST = debian -a -z "$SERVICEDIR" ]; then
 	    if [ -n "${DESTDIR}" ]; then
-		make_parent_directory ${DESTDIR}/etc/rcS.d 0755
+		mkdir -p ${DESTDIR}/etc/rcS.d
 	    fi
 
-	    ln -sf ../init.d/$PRODUCT ${DESTDIR}${CONFDIR}/rcS.d/S38${PRODUCT}
-	    echo "$Product will start automatically at boot"
+	    ln -sf ../init.d/shorewall-init ${DESTDIR}${CONFDIR}/rcS.d/S38shorewall-init
+	    echo "Shorewall Init will start automatically at boot"
 	fi
     fi
 fi
@@ -547,8 +602,8 @@ if [ -d ${DESTDIR}/etc/ppp ]; then
     case $HOST in
 	debian|suse)
 	    for directory in ip-up.d ip-down.d ipv6-up.d ipv6-down.d; do
-		make_parent_directory ${DESTDIR}/etc/ppp/$directory 0755 #SuSE doesn't create the IPv6 directories
-		cp -fp ${DESTDIR}${LIBEXECDIR}/$PRODUCT/ifupdown ${DESTDIR}${CONFDIR}/ppp/$directory/shorewall
+		mkdir -p ${DESTDIR}/etc/ppp/$directory #SuSE doesn't create the IPv6 directories
+		cp -fp ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown ${DESTDIR}${CONFDIR}/ppp/$directory/shorewall
 	    done
 	    ;;
 	redhat)
@@ -559,19 +614,19 @@ if [ -d ${DESTDIR}/etc/ppp ]; then
 		FILE=${DESTDIR}/etc/ppp/$file
 		if [ -f $FILE ]; then
 		    if grep -qF Shorewall-based $FILE ; then
-			cp -fp ${DESTDIR}${LIBEXECDIR}/$PRODUCT/ifupdown $FILE
+			cp -fp ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown $FILE
 		    else
 			echo "$FILE already exists -- ppp devices will not be handled"
 			break
 		    fi
 		else
-		    cp -fp ${DESTDIR}${LIBEXECDIR}/$PRODUCT/ifupdown $FILE
+		    cp -fp ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown $FILE
 		fi
 	    done
 	    ;;
     esac
 fi
 #
-# Report Success
+#  Report Success
 #
 echo "shorewall Init Version $VERSION Installed"

Shorewall-init/uninstall.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Script to back uninstall Shoreline Firewall Init
+# Script to back uninstall Shoreline Firewall
 #
 #     (c) 2000-2016 - Tom Eastep (teastep@shorewall.net)
 #
@@ -26,34 +26,62 @@
 #       You may only use this script to uninstall the version
 #       shown below. Simply run this script to remove Shorewall Firewall
 
-VERSION=xxx # The Build script inserts the actual version
+VERSION=xxx  #The Build script inserts the actual version
 PRODUCT=shorewall-init
 Product="Shorewall Init"
 
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
-    echo "where <option> is one of"
-    echo "  -h"
-    echo "  -v"
-    echo "  -n"
+    echo "usage: $ME [ <shorewallrc file> ]"
     exit $1
 }
 
+fatal_error()
+{
+    echo "   ERROR: $@" >&2
+    exit 1
+}
+
+qt()
+{
+    "$@" >/dev/null 2>&1
+}
+
+split() {
+    local ifs
+    ifs=$IFS
+    IFS=:
+    set -- $1
+    echo $*
+    IFS=$ifs
+}
+
+mywhich() {
+    local dir
+
+    for dir in $(split $PATH); do
+	if [ -x $dir/$1 ]; then
+	    return 0
+	fi
+    done
+
+    return 2
+}
+
+remove_file() # $1 = file to restore
+{
+    if [ -f $1 -o -L $1 ] ; then
+	rm -f $1
+	echo "$1 Removed"
+    fi
+}
+
 #
 # Change to the directory containing this script
 #
 cd "$(dirname $0)"
 
-#
-# Source common functions
-#
-. ./lib.uninstaller || { echo "ERROR: Can not load common functions." >&2; exit 1; }
-
-#
-# Parse the run line
-#
 finished=0
 configure=1
 
@@ -90,17 +118,16 @@ while [ $finished -eq 0 ]; do
 	    ;;
     esac
 done
-
 #
 # Read the RC file
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-        . ./shorewallrc || fatal_error "Can not load the RC file: ./shorewallrc"
+	. ./shorewallrc
     elif [ -f ~/.shorewallrc ]; then
-        . ~/.shorewallrc || fatal_error "Can not load the RC file: ~/.shorewallrc"
+	. ~/.shorewallrc || exit 1
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-        . /usr/share/shorewall/shorewallrc || fatal_error "Can not load the RC file: /usr/share/shorewall/shorewallrc"
+	. /usr/share/shorewall/shorewallrc
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -110,72 +137,72 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file || exit 1
+	    file=./$file
 	    ;;
     esac
 
-    . $file || fatal_error "Can not load the RC file: $file"
+    . $file || exit 1
 else
     usage 1
 fi
 
-if [ -f ${SHAREDIR}/$PRODUCT/version ]; then
-    INSTALLED_VERSION="$(cat ${SHAREDIR}/$PRODUCT/version)"
+if [ -f ${SHAREDIR}/shorewall-init/version ]; then
+    INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall-init/version)"
     if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
-	echo "WARNING: $Product Version $INSTALLED_VERSION is installed"
+	echo "WARNING: Shorewall Init Version $INSTALLED_VERSION is installed"
 	echo "         and this is the $VERSION uninstaller."
 	VERSION="$INSTALLED_VERSION"
     fi
 else
-    echo "WARNING: $Product Version $VERSION is not installed"
+    echo "WARNING: Shorewall Init Version $VERSION is not installed"
     VERSION=""
 fi
 
-echo "Uninstalling $Product $VERSION"
+[ -n "${LIBEXEC:=${SHAREDIR}}" ]
+
+echo "Uninstalling Shorewall Init $VERSION"
 
 [ -n "$SANDBOX" ] && configure=0
 
-[ -n "${LIBEXEC:=${SHAREDIR}}" ]
+INITSCRIPT=${CONFDIR}/init.d/shorewall-init
 
-remove_file  ${SBINDIR}/$PRODUCT
-
-FIREWALL=${CONFDIR}/init.d/$PRODUCT
-
-if [ -f "$FIREWALL" ]; then
+if [ -f "$INITSCRIPT" ]; then
     if [ $configure -eq 1 ]; then
-	if [ $HOST = openwrt ] ; then
-	    if /etc/init.d/$PRODUCT enabled; then
-		/etc/init.d/$PRODUCT disable
+	if [ $HOST = openwrt ]; then
+	    if /etc/init.d/shorewall-init enabled; then
+		/etc/init.d/shorewall-init disable
 	    fi
+	elif mywhich updaterc.d ; then
+	    updaterc.d shorewall-init remove
 	elif mywhich insserv ; then
-            insserv -r $FIREWALL
-	elif mywhich update-rc.d ; then
-	    update-rc.d ${PRODUCT} remove
+            insserv -r $INITSCRIPT
 	elif mywhich chkconfig ; then
-	    chkconfig --del $(basename $FIREWALL)
+	    chkconfig --del $(basename $INITSCRIPT)
 	fi
     fi
 
-    remove_file $FIREWALL
+    remove_file $INITSCRIPT
 fi
 
-[ -z "${SERVICEDIR}" ] && SERVICEDIR="$SYSTEMD"
+if [ -z "${SERVICEDIR}" ]; then
+    SERVICEDIR="$SYSTEMD"
+fi
 
 if [ -n "$SERVICEDIR" ]; then
-    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}.service
-    remove_file $SERVICEDIR/${PRODUCT}.service
+    [ $configure -eq 1 ] && systemctl disable shorewall-init.service
+    rm -f $SERVICEDIR/shorewall-init.service
 fi
 
 if [ $HOST = openwrt ]; then
-    [ "$(readlink -q ${SBINDIR}/ifup-local)"   = ${SHAREDIR}/$PRODUCT ] && remove_file ${SBINDIR}/ifup-local
-    [ "$(readlink -q ${SBINDIR}/ifdown-local)" = ${SHAREDIR}/$PRODUCT ] && remove_file ${SBINDIR}/ifdown-local
+    [ "$(readlink -q ${SBINDIR}/ifup-local)"   = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifup-local
+    [ "$(readlink -q ${SBINDIR}/ifdown-local)" = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifdown-local
 else
-    [ "$(readlink -m -q ${SBINDIR}/ifup-local)"   = ${SHAREDIR}/$PRODUCT ] && remove_file ${SBINDIR}/ifup-local
-    [ "$(readlink -m -q ${SBINDIR}/ifdown-local)" = ${SHAREDIR}/$PRODUCT ] && remove_file ${SBINDIR}/ifdown-local
+    [ "$(readlink -m -q ${SBINDIR}/ifup-local)"   = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifup-local
+    [ "$(readlink -m -q ${SBINDIR}/ifdown-local)" = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifdown-local
 fi
 
-remove_file ${CONFDIR}/default/$PRODUCT
-remove_file ${CONFDIR}/sysconfig/$PRODUCT
+remove_file ${CONFDIR}/default/shorewall-init
+remove_file ${CONFDIR}/sysconfig/shorewall-init
 
 remove_file ${CONFDIR}/NetworkManager/dispatcher.d/01-shorewall
 
@@ -200,11 +227,10 @@ if [ -d ${CONFDIR}/ppp ]; then
     done
 fi
 
-remove_directory ${SHAREDIR}/$PRODUCT
-remove_directory ${LIBEXECDIR}/$PRODUCT
-remove_file  ${CONFDIR}/logrotate.d/$PRODUCT
+rm -f  ${SBINDIR}/shorewall-init
+rm -rf ${SHAREDIR}/shorewall-init
+rm -rf ${LIBEXECDIR}/shorewall-init
+
+echo "Shorewall Init Uninstalled"
+
 
-#
-# Report Success
-#
-echo "$Product $VERSION Uninstalled"

Shorewall-lite/default.debian

@@ -1,5 +1,5 @@
 # prevent startup with default configuration
-# set the following variable to 1 in order to allow Shorewall-lite to start
+# set the following varible to 1 in order to allow Shorewall-lite to start
 
 startup=0
 
@@ -16,7 +16,7 @@ startup=0
 #    wait_interface=
 
 #
-# Global start/restart/reload/stop options
+# Startup options
 #
 OPTIONS=""
 
@@ -30,16 +30,6 @@ STARTOPTIONS=""
 #
 RESTARTOPTIONS=""
 
-#
-# Reload options
-#
-RELOADOPTIONS=""
-
-#
-# Stop options
-#
-STOPOPTIONS=""
-
 #
 # Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf
 #

Shorewall-lite/default.debian.systemd

@@ -1,26 +0,0 @@
-#
-# Global start/restart/reload/stop options
-#
-OPTIONS=""
-
-#
-# Start options
-#
-STARTOPTIONS=""
-
-#
-# Restart options
-#
-RESTARTOPTIONS=""
-
-#
-# Reload options
-#
-RELOADOPTIONS=""
-
-#
-# Stop options
-#
-STOPOPTIONS=""
-
-# EOF

Shorewall-lite/install.sh

@@ -22,19 +22,62 @@
 #	along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
 
-VERSION=xxx # The Build script inserts the actual version
+VERSION=xxx #The Build script inserts the actual version
 
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
-    echo "where <option> is one of"
-    echo "  -h"
-    echo "  -v"
-    echo "  -n"
+    echo "usage: $ME [ <configuration-file> ]"
+    echo "       $ME -v"
+    echo "       $ME -h"
+    echo "       $ME -n"
     exit $1
 }
 
+fatal_error()
+{
+    echo "   ERROR: $@" >&2
+    exit 1
+}
+
+split() {
+    local ifs
+    ifs=$IFS
+    IFS=:
+    set -- $1
+    echo $*
+    IFS=$ifs
+}
+
+qt()
+{
+    "$@" >/dev/null 2>&1
+}
+
+mywhich() {
+    local dir
+
+    for dir in $(split $PATH); do
+	if [ -x $dir/$1 ]; then
+	    echo $dir/$1
+	    return 0
+	fi
+    done
+
+    return 2
+}
+
+cant_autostart()
+{
+    echo
+    echo  "WARNING: Unable to configure $Product to start automatically at boot" >&2
+}
+
+delete_file() # $1 = file to delete
+{
+    rm -f $1
+}
+
 install_file() # $1 = source $2 = target $3 = mode
 {
     if cp -f $1 $2; then
@@ -53,6 +96,19 @@ install_file() # $1 = source $2 = target $3 = mode
     exit 1
 }
 
+make_directory() # $1 = directory , $2 = mode
+{
+    mkdir -p $1
+    chmod 755 $1
+    [ -n "$OWNERSHIP" ] && chown $OWNERSHIP $1
+
+}
+
+require()
+{
+    eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
+}
+
 #
 # Change to the directory containing this script
 #
@@ -66,11 +122,6 @@ else
     Product="Shorewall6 Lite"
 fi
 
-#
-# Source common functions
-#
-. ./lib.installer || { echo "ERROR: Can not load common functions." >&2; exit 1; }
-
 #
 # Parse the run line
 #
@@ -117,14 +168,12 @@ done
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
+	. ./shorewallrc || exit 1
 	file=./shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
     elif [ -f ~/.shorewallrc ]; then
-	file=~/.shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
+	. ~/.shorewallrc
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-	file=/usr/share/shorewall/shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
+	. /usr/share/shorewall/shorewallrc
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -134,11 +183,11 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file || exit 1
+	    file=./$file
 	    ;;
     esac
 
-    . $file || fatal_error "Can not load the RC file: $file"
+    . $file
 else
     usage 1
 fi
@@ -269,7 +318,8 @@ case "$HOST" in
     linux)
 	;;
     *)
-	fatal_error "ERROR: Unknown HOST \"$HOST\""
+	echo "ERROR: Unknown HOST \"$HOST\"" >&2
+	exit 1;
 	;;
 esac
 
@@ -281,7 +331,7 @@ if [ -n "$DESTDIR" ]; then
 	OWNERSHIP=""
     fi
 
-    make_parent_directory ${DESTDIR}${INITDIR} 0755
+    make_directory ${DESTDIR}${INITDIR} 755
 
 else
     if [ ! -f ${SHAREDIR}/shorewall/coreversion ]; then
@@ -321,20 +371,25 @@ fi
 
 delete_file ${DESTDIR}/usr/share/$PRODUCT/xmodules
 
-[ -n "${INITFILE}" ] && make_parent_directory ${DESTDIR}${INITDIR} 0755
+[ -n "${INITFILE}" ] && make_directory ${DESTDIR}${INITDIR} 755
 
 #
 # Create ${CONFDIR}/$PRODUCT, /usr/share/$PRODUCT and /var/lib/$PRODUCT if needed
 #
-make_parent_directory ${DESTDIR}${CONFDIR}/$PRODUCT 0755
-make_parent_directory ${DESTDIR}${SHAREDIR}/$PRODUCT 0755
-make_parent_directory ${DESTDIR}${LIBEXECDIR}/$PRODUCT 0755
-make_parent_directory ${DESTDIR}${SBINDIR} 0755
-make_parent_directory ${DESTDIR}${VARDIR} 0755
+mkdir -p ${DESTDIR}${CONFDIR}/$PRODUCT
+mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT
+mkdir -p ${DESTDIR}${LIBEXECDIR}/$PRODUCT
+mkdir -p ${DESTDIR}${SBINDIR}
+mkdir -p ${DESTDIR}${VARDIR}
+
+chmod 755 ${DESTDIR}${CONFDIR}/$PRODUCT
+chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT
 
 if [ -n "$DESTDIR" ]; then
-    make_parent_directory ${DESTDIR}${CONFDIR}/logrotate.d 0755
-    make_parent_directory ${DESTDIR}${INITDIR} 0755
+    mkdir -p ${DESTDIR}${CONFDIR}/logrotate.d
+    chmod 755 ${DESTDIR}${CONFDIR}/logrotate.d
+    mkdir -p ${DESTDIR}${INITDIR}
+    chmod 755 ${DESTDIR}${INITDIR}
 fi
 
 if [ -n "$INITFILE" ]; then
@@ -355,9 +410,9 @@ if [ -z "${SERVICEDIR}" ]; then
 fi
 
 if [ -n "$SERVICEDIR" ]; then
-    make_parent_directory ${DESTDIR}${SERVICEDIR} 0755
+    mkdir -p ${DESTDIR}${SERVICEDIR}
     [ -z "$SERVICEFILE" ] && SERVICEFILE=$PRODUCT.service
-    install_file $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service 0644
+    install_file $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service 644
     [ ${SBINDIR} != /sbin ] && eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
     echo "Service file $SERVICEFILE installed as ${DESTDIR}${SERVICEDIR}/$PRODUCT.service"
 fi
@@ -386,14 +441,8 @@ echo "Default config path file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/confi
 #
 for f in lib.* ; do
     if [ -f $f ]; then
-        case $f in
-            *installer)
-                ;;
-            *)
-                install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 0644
-                echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
-                ;;
-        esac
+	install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 0644
+	echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
     fi
 done
 
@@ -421,12 +470,12 @@ if [ -f modules ]; then
 fi
 
 if [ -f helpers ]; then
-    install_file helpers ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers 0600
+    install_file helpers ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers 600
     echo "Helper modules file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers"
 fi
 
 for f in modules.*; do
-    install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 0644
+    install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 644
     echo "Module file $f installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
 done
 
@@ -437,19 +486,19 @@ done
 if [ -d manpages -a -n "$MANDIR" ]; then
     cd manpages
 
-    make_parent_directory ${DESTDIR}${MANDIR}/man5 0755
+    mkdir -p ${DESTDIR}${MANDIR}/man5/
 
     for f in *.5; do
 	gzip -c $f > $f.gz
-	install_file $f.gz ${DESTDIR}${MANDIR}/man5/$f.gz 0644
+	install_file $f.gz ${DESTDIR}${MANDIR}/man5/$f.gz 644
 	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
     done
 
-    make_parent_directory ${DESTDIR}${MANDIR}/man8 0755
+    mkdir -p ${DESTDIR}${MANDIR}/man8/
 
     for f in *.8; do
 	gzip -c $f > $f.gz
-	install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 0644
+	install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 644
 	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man8/$f.gz"
     done
 
@@ -459,7 +508,7 @@ if [ -d manpages -a -n "$MANDIR" ]; then
 fi
 
 if [ -d ${DESTDIR}${CONFDIR}/logrotate.d ]; then
-    install_file logrotate ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT 0644
+    install_file logrotate ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT 644
     echo "Logrotate file installed as ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT"
 fi
 
@@ -467,7 +516,7 @@ fi
 # Create the version file
 #
 echo "$VERSION" > ${DESTDIR}${SHAREDIR}/$PRODUCT/version
-chmod 0644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
+chmod 644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
 #
 # Remove and create the symbolic link to the init script
 #
@@ -490,7 +539,10 @@ ln -sf shorewall ${DESTDIR}${SBINDIR}/${PRODUCT}
 # Note -- not all packages will have the SYSCONFFILE so we need to check for its existance here
 #
 if [ -n "$SYSCONFFILE" -a -f "$SYSCONFFILE" -a ! -f ${DESTDIR}${SYSCONFDIR}/${PRODUCT} ]; then
-    [ ${DESTDIR} ] && make_parent_directory ${DESTDIR}${SYSCONFDIR} 0755
+    if [ ${DESTDIR} ]; then
+	mkdir -p ${DESTDIR}${SYSCONFDIR}
+	chmod 755 ${DESTDIR}${SYSCONFDIR}
+    fi
 
     install_file ${SYSCONFFILE} ${DESTDIR}${SYSCONFDIR}/${PRODUCT} 0640
     echo "$SYSCONFFILE file installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}"
@@ -558,6 +610,6 @@ if [ $configure -eq 1 -a -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${
 fi
 
 #
-# Report Success
+#  Report Success
 #
 echo "$Product Version $VERSION Installed"

Shorewall-lite/uninstall.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Script to back uninstall Shoreline Firewall Lite
+# Script to back uninstall Shoreline Firewall
 #
 #     (c) 2000-2016 - Tom Eastep (teastep@shorewall.net)
 #
@@ -26,7 +26,9 @@
 #       You may only use this script to uninstall the version
 #       shown below. Simply run this script to remove Shorewall Firewall
 
-VERSION=xxx # The Build script inserts the actual version
+VERSION=xxx  #The Build script inserts the actual version
+PRODUCT=shorewall-lite
+Product="Shorewall Lite"
 
 usage() # $1 = exit status
 {
@@ -39,27 +41,46 @@ usage() # $1 = exit status
     exit $1
 }
 
-#
-# Change to the directory containing this script
-#
-cd "$(dirname $0)"
+fatal_error()
+{
+    echo "   ERROR: $@" >&2
+    exit 1
+}
 
-if [ -f shorewall-lite.service ]; then
-    PRODUCT=shorewall-lite
-    Product="Shorewall Lite"
-else
-    PRODUCT=shorewall6-lite
-    Product="Shorewall6 Lite"
-fi
+qt()
+{
+    "$@" >/dev/null 2>&1
+}
 
-#
-# Source common functions
-#
-. ./lib.uninstaller || { echo "ERROR: Can not load common functions." >&2; exit 1; }
+split() {
+    local ifs
+    ifs=$IFS
+    IFS=:
+    set -- $1
+    echo $*
+    IFS=$ifs
+}
+
+mywhich() {
+    local dir
+
+    for dir in $(split $PATH); do
+	if [ -x $dir/$1 ]; then
+	    return 0
+	fi
+    done
+
+    return 2
+}
+
+remove_file() # $1 = file to restore
+{
+    if [ -f $1 -o -L $1 ] ; then
+	rm -f $1
+	echo "$1 Removed"
+    fi
+}
 
-#
-# Parse the run line
-#
 finished=0
 configure=1
 
@@ -76,7 +97,7 @@ while [ $finished -eq 0 ]; do
 			usage 0
 			;;
 		    v)
-			echo "$Product Firewall Uninstaller Version $VERSION"
+			echo "$Product Firewall Installer Version $VERSION"
 			exit 0
 			;;
 		    n*)
@@ -96,17 +117,16 @@ while [ $finished -eq 0 ]; do
 	    ;;
     esac
 done
-
 #
 # Read the RC file
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-        . ./shorewallrc || fatal_error "Can not load the RC file: ./shorewallrc"
+	. ./shorewallrc
     elif [ -f ~/.shorewallrc ]; then
-        . ~/.shorewallrc || fatal_error "Can not load the RC file: ~/.shorewallrc"
+	. ~/.shorewallrc || exit 1
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-        . /usr/share/shorewall/shorewallrc || fatal_error "Can not load the RC file: /usr/share/shorewall/shorewallrc"
+	. /usr/share/shorewall/shorewallrc
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -116,50 +136,46 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file || exit 1
+	    file=./$file
 	    ;;
     esac
 
-    . $file || fatal_error "Can not load the RC file: $file"
+    . $file
 else
     usage 1
 fi
 
-if [ -f ${SHAREDIR}/$PRODUCT/version ]; then
-    INSTALLED_VERSION="$(cat ${SHAREDIR}/$PRODUCT/version)"
+if [ -f ${SHAREDIR}/shorewall-lite/version ]; then
+    INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall-lite/version)"
     if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
-	echo "WARNING: $Product Version $INSTALLED_VERSION is installed"
+	echo "WARNING: Shorewall Lite Version $INSTALLED_VERSION is installed"
 	echo "         and this is the $VERSION uninstaller."
 	VERSION="$INSTALLED_VERSION"
     fi
 else
-    echo "WARNING: $Product Version $VERSION is not installed"
+    echo "WARNING: Shorewall Lite Version $VERSION is not installed"
     VERSION=""
 fi
 
-echo "Uninstalling $Product $VERSION"
+echo "Uninstalling Shorewall Lite $VERSION"
 
 [ -n "$SANDBOX" ] && configure=0
 
 if [ $configure -eq 1 ]; then
     if qt iptables -L shorewall -n && [ ! -f ${SBINDIR}/shorewall ]; then
-	${SBINDIR}/$PRODUCT clear
-    elif qt ip6tables -L shorewall -n && [ ! -f ${SBINDIR}/shorewall6 ]; then
-	${SBINDIR}/$PRODUCT clear
+	shorewall-lite clear
     fi
 fi
 
-remove_file ${SBINDIR}/$PRODUCT
-
-if [ -L ${SHAREDIR}/$PRODUCT/init ]; then
+if [ -L ${SHAREDIR}/shorewall-lite/init ]; then
     if [ $HOST = openwrt ]; then
-	if [ $configure -eq 1 ] && /etc/init.d/$PRODUCT enabled; then
-	    /etc/init.d/$PRODUCT disable
+	if [ $configure -eq 1 ] && /etc/init.d/shorewall-lite enabled; then
+	    /etc/init.d/shorewall-lite disable
 	fi
 	
-	FIREWALL=$(readlink ${SHAREDIR}/$PRODUCT/init)
+	FIREWALL=$(readlink ${SHAREDIR}/shorewall-lite/init)
     else
-	FIREWALL=$(readlink -m -q ${SHAREDIR}/$PRODUCT/init)
+	FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall-lite/init)
     fi
 elif [ -n "$INITFILE" ]; then
     FIREWALL=${INITDIR}/${INITFILE}
@@ -167,10 +183,10 @@ fi
 
 if [ -f "$FIREWALL" ]; then
     if [ $configure -eq 1 ]; then
-	if mywhich insserv ; then
+	if mywhich updaterc.d ; then
+	    updaterc.d shorewall-lite remove
+	elif mywhich insserv ; then
             insserv -r $FIREWALL
-	elif mywhich update-rc.d ; then
-	    update-rc.d ${PRODUCT} remove
 	elif mywhich chkconfig ; then
 	    chkconfig --del $(basename $FIREWALL)
 	fi
@@ -179,29 +195,26 @@ if [ -f "$FIREWALL" ]; then
     remove_file $FIREWALL
 fi
 
-[ -z "${SERVICEDIR}" ] && SERVICEDIR="$SYSTEMD"
+[ -z "$SERVICEDIR" ] && SERVICEDIR="$SYSTEMD"
 
 if [ -n "$SERVICEDIR" ]; then
-    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}.service
-    remove_file $SERVICEDIR/${PRODUCT}.service
+    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}
+    rm -f $SERVICEDIR/shorewall-lite.service
 fi
 
-remove_directory ${CONFDIR}/$PRODUCT
-remove_directory ${VARDIR}
-remove_directory ${SHAREDIR}/$PRODUCT
-remove_directory ${LIBEXECDIR}/$PRODUCT
-remove_file  ${CONFDIR}/logrotate.d/$PRODUCT
+rm -f ${SBINDIR}/shorewall-lite
 
-if [ -n "$SYSCONFDIR" ]; then
-    [ -n "$SYSCONFFILE" ] && remove_file ${SYSCONFDIR}/${PRODUCT}
-fi
+rm -rf ${CONFDIR}/shorewall-lite
+rm -rf ${VARDIR}
+rm -rf ${SHAREDIR}/shorewall-lite
+rm -rf ${LIBEXECDIR}/shorewall-lite
+rm -f  ${CONFDIR}/logrotate.d/shorewall-lite
+rm -f  ${SYSCONFDIR}/shorewall-lite
 
 if [ -n "${MANDIR}" ]; then
-    remove_file_with_wildcard ${MANDIR}/man5/${PRODUCT}\*
-    remove_file_with_wildcard ${MANDIR}/man8/${PRODUCT}\*
+    rm -f ${MANDIR}/man5/shorewall-lite*
+    rm -f ${MANDIR}/man8/shorewall-lite*
 fi
 
-#
-# Report Success
-#
-echo "$Product $VERSION Uninstalled"
+echo "Shorewall Lite Uninstalled"
+

Shorewall/Actions/action.A_AllowICMPs.deprecated

@@ -1,9 +0,0 @@
-#
-# Shorewall6 -- /usr/share/shorewall/action.A_AllowICMPs
-#
-# This action A_ACCEPTs needed ICMP types
-#
-###############################################################################
-#ACTION		SOURCE		DEST	PROTO		DPORT
-
-AllowICMPs(A_ACCEPT)

Shorewall/Actions/action.A_Drop

@@ -13,7 +13,6 @@
 # IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
 #
 ?require AUDIT_TARGET
-?warning "You are using the deprecated A_Drop default action. Please see http://www.shorewall.net/Actions.html
 ###############################################################################
 #ACTION		SOURCE	DEST	PROTO	DPORT	SPORT
 #
@@ -32,10 +31,9 @@ Auth(A_DROP)
 #
 A_AllowICMPs	-	-	icmp
 #
-# Don't log broadcasts and multicasts
+# Don't log broadcasts
 #
 dropBcast(audit)
-dropMcast(audit)
 #
 # Drop packets that are in the INVALID state -- these are usually ICMP packets
 # and just confuse people when they appear in the log.

Shorewall/Actions/action.A_Reject.deprecated

@@ -11,8 +11,6 @@
 #    internet operation are always ACCEPTed.
 #
 # IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
-?require AUDIT_TARGET
-?warning "You are using the deprecated A_REJECT default action. Please see http://www.shorewall.net/Actions.html
 ###############################################################################
 #ACTION		SOURCE	DEST	PROTO
 #
@@ -27,11 +25,10 @@ COUNT
 #
 A_AllowICMPs	-	-	icmp
 #
-# Drop Broadcasts and multicasts so they don't clutter up the log
-# (these must *not* be rejected).
+# Drop Broadcasts so they don't clutter up the log
+# (broadcasts must *not* be rejected).
 #
 dropBcast(audit)
-dropMcast(audit)
 #
 # Drop packets that are in the INVALID state -- these are usually ICMP packets
 # and just confuse people when they appear in the log (these ICMPs cannot be

Shorewall/Actions/action.AllowICMPs

@@ -7,39 +7,5 @@
 #ACTION	SOURCE	DEST	PROTO	DPORT	SPORT	ORIGDEST	RATE	USER
 
 DEFAULTS ACCEPT
-
-?if __IPV4
-    @1	-	-	icmp	fragmentation-needed	{comment="Needed ICMP types"}
-    @1	-	-	icmp	time-exceeded		{comment="Needed ICMP types"}
-?else
-?COMMENT Needed ICMP types (RFC4890)
-
-    @1	-		-	ipv6-icmp	destination-unreachable
-    @1	-		-	ipv6-icmp	packet-too-big
-    @1	-		-	ipv6-icmp	time-exceeded
-    @1	-		-	ipv6-icmp	parameter-problem
-
-# The following should have a ttl of 255 and must be allowed to transit a bridge
-    @1	-		-	ipv6-icmp	router-solicitation
-    @1	-		-	ipv6-icmp	router-advertisement
-    @1	-		-	ipv6-icmp	neighbour-solicitation
-    @1	-		-	ipv6-icmp	neighbour-advertisement
-    @1	-		-	ipv6-icmp	137	# Redirect
-    @1	-		-	ipv6-icmp	141	# Inverse neighbour discovery solicitation
-    @1	-		-	ipv6-icmp	142	# Inverse neighbour discovery advertisement
-
-# The following should have a link local source address and must be allowed to transit a bridge
-    @1	fe80::/10	-	ipv6-icmp	130	# Listener query
-    @1	fe80::/10	-	ipv6-icmp	131	# Listener report
-    @1	fe80::/10	-	ipv6-icmp	132	# Listener done
-    @1	fe80::/10	-	ipv6-icmp	143	# Listener report v2
-
-# The following should be received with a ttl of 255 and must be allowed to transit a bridge
-    @1	-		-	ipv6-icmp	148	# Certificate path solicitation
-    @1	-		-	ipv6-icmp	149	# Certificate path advertisement
-
-# The following should have a link local source address and a ttl of 1 and must be allowed to transit abridge
-    @1	fe80::/10	-	ipv6-icmp	151	# Multicast router advertisement
-    @1	fe80::/10	-	ipv6-icmp	152	# Multicast router solicitation
-    @1	fe80::/10	-	ipv6-icmp	153	# Multicast router termination
-?endif
+@1	-	-	icmp	fragmentation-needed	{comment="Needed ICMP types"}
+@1	-	-	icmp	time-exceeded		{comment="Needed ICMP types"}

Shorewall/Actions/action.Broadcast

@@ -20,7 +20,7 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-# Broadcast[([<action>|[,{audit|-}])]
+# Broadcast[([<action>|-[,{audit|-}])]
 #
 # Default action is DROP
 #
@@ -29,37 +29,27 @@
 DEFAULTS DROP,-
 
 ?if __ADDRTYPE
-    @1	-	-	-	;; -m addrtype --dst-type BROADCAST
-    @1	-	-	-	;; -m addrtype --dst-type ANYCAST
+@1	-	-	-	;; -m addrtype --dst-type BROADCAST
+@1	-	-	-	;; -m addrtype --dst-type ANYCAST
 ?else
-    ?begin perl;
+?begin perl;
 
-    use strict;
-    use Shorewall::IPAddrs;
-    use Shorewall::Config;
-    use Shorewall::Chains;
+use Shorewall::IPAddrs;
+use Shorewall::Config;
+use Shorewall::Chains;
 
-    my ( $action, $audit ) = get_action_params( 2 );
-    my $chainref           = get_action_chain;
-    my ( $level, $tag )    = get_action_logging;
+my ( $action )         = get_action_params( 1 );
+my $chainref           = get_action_chain;
+my ( $level, $tag )    = get_action_logging;
 
-    fatal_error "Invalid parameter to action Broadcast" if supplied $audit && $audit ne 'audit';
+add_commands $chainref, 'for address in $ALL_BCASTS; do';
+incr_cmd_level $chainref;
+log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d $address ' if $level ne '';
+add_jump $chainref, $action, 0, "-d \$address ";
+decr_cmd_level $chainref;
+add_commands $chainref, 'done';
 
-    my $target             = require_audit ( $action , $audit );
+1;
 
-    if ( $family == F_IPV4 ) {
-        add_commands $chainref, 'for address in $ALL_BCASTS; do';
-    } elsif ($family == F_IPV6 ) {
-        add_commands $chainref, 'for address in $ALL_ACASTS; do';
-    }
-
-    incr_cmd_level $chainref;
-    log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d $address ' if $level ne '';
-    add_jump $chainref, $target, 0, "-d \$address ";
-    decr_cmd_level $chainref;
-    add_commands $chainref, 'done';
-
-    1;
-
-    ?end perl;
+?end perl;
 ?endif

Shorewall/Actions/action.GlusterFS

@@ -13,9 +13,9 @@
 DEFAULTS 2,0
 
 ?if @1 !~ /^\d+/ || ! @1 || @1 > 1024
-    ?error Invalid value (@1) for the GlusterFS Bricks argument
+    ?error Invalid value for Bricks (@1)
 ?elsif @2 !~ /^[01]$/
-    ?error Invalid value (@2) for the GlusterFS IB argument
+    ?error Invalid value for IB (@2)
 ?endif
 
 #ACTION		SOURCE		DEST		PROTO	DPORT

Shorewall/Actions/action.Limit

@@ -22,49 +22,6 @@
 #
 # Limit(<recent-set>,<num-connections>,<timeout>)
 #
+# This is a built-in action.
+#
 ###############################################################################
-
-DEFAULTS -,-,-
-
-?begin perl
-
-use strict;
-use Shorewall::Config;
-use Shorewall::Chains;
-
-my $chainref        = get_action_chain;
-my @param           = get_action_params(3);
-my ( $level, $tag ) = get_action_logging;
-
-@param = split( ',', $tag ), $tag = $param[0] unless supplied( join '', @param );
-
-fatal_error 'Limit rules must include <set name>,<max connections>,<interval> as the log tag or as parameters' unless @param == 3;
-
-my $set   = $param[0];
-
-for ( @param[1,2] ) {
-    fatal_error 'Max connections and interval in Limit rules must be numeric (' . join( ':', 'Limit', $level eq '' ? 'none' : $level, $tag ) . ')' unless /^\d+$/
-}
-
-my $count = $param[1] + 1;
-
-require_capability( 'RECENT_MATCH' , 'Limit rules' , '' );
-
-warning_message "The Limit action is deprecated in favor of per-IP rate limiting using the RATE LIMIT column";
-
-add_irule $chainref, recent => "--name $set --set";
-
-if ( $level ne '' ) {
-    my $xchainref = new_chain 'filter' , "$chainref->{name}%";
-    log_irule_limit( $level, $xchainref, '', 'DROP', [], $tag, 'add' , '' );
-    add_ijump $xchainref, j => 'DROP';
-    add_ijump $chainref,  j => $xchainref, recent => "--name $set --update --seconds $param[2] --hitcount $count";
-} else {
-    add_ijump $chainref, j => 'DROP', recent => "--update --name $set --seconds $param[2] --hitcount $count";
-}
-
-add_ijump $chainref, j => 'ACCEPT';
-
-1;
-
-?end perl

Shorewall/Actions/action.Multicast

@@ -29,28 +29,22 @@
 DEFAULTS DROP,-
 
 ?if __ADDRTYPE
-    @1	-	-	-	;; -m addrtype --dst-type MULTICAST
+@1	-	-	-	;; -m addrtype --dst-type MULTICAST
 ?else
-    ?begin perl;
+?begin perl;
 
-    use strict;
-    use Shorewall::IPAddrs;
-    use Shorewall::Config;
-    use Shorewall::Chains;
+use Shorewall::IPAddrs;
+use Shorewall::Config;
+use Shorewall::Chains;
 
-    my ( $action, $audit ) = get_action_params( 2 );
-    my $chainref           = get_action_chain;
-    my ( $level, $tag )    = get_action_logging;
+my ( $action )         = get_action_params( 1 );
+my $chainref           = get_action_chain;
+my ( $level, $tag )    = get_action_logging;
 
-    fatal_error "Invalid parameter to action Multicast" if supplied $audit && $audit ne 'audit';
+log_rule_limit $level, $chainref, 'Multicast' , $action, '', $tag, 'add', ' -d 224.0.0.0/4 ' if $level ne '';
+add_jump $chainref, $action, 0, '-d 224.0.0.0/4 ';
 
-    my $target = require_audit ( $action , $audit );
-    my $dest   = ( $family == F_IPV4 ) ? join( ' ', '-d', IPv4_MULTICAST . ' ' ) : join( ' ', '-d', IPv6_MULTICAST . ' ' );
+1;
 
-    log_rule_limit( $level, $chainref, 'Multicast' , $action, '', $tag, 'add', $dest ) if $level ne '';
-    add_jump $chainref, $target, 0, $dest;
-
-    1;
-
-    ?end perl;
+?end perl;
 ?endif

Shorewall/Actions/action.allowBcast

@@ -22,17 +22,6 @@
 #
 # allowBcast[([audit])]
 #
+# This is a built-in action.
+#
 ###############################################################################
-
-DEFAULTS -
-
-?if passed(@1)
-    ?if @1 eq 'audit'
-	?require AUDIT_TARGET
-	Broadcast(A_ACCEPT)
-    ?else
-	?error "Invalid argument (@1) to allowBcast"
-    ?endif
-?else
-    Broadcast(ACCEPT)
-?endif

Shorewall/Actions/action.allowMcast

@@ -22,17 +22,6 @@
 #
 # allowMcast[([audit])]
 #
+# This is a built-in action.
+#
 ###############################################################################
-
-DEFAULTS -
-
-?if passed(@1)
-    ?if @1 eq 'audit'
-	?require AUDIT_TARGET
-	Multicast(A_ACCEPT)
-    ?else
-	?error "Invalid argument (@1) to allowMcast"
-    ?endif
-?else
-    Multicast(ACCEPT)
-?endif

Shorewall/Actions/action.allowinUPnP

@@ -22,19 +22,6 @@
 #
 # allowinUPnP[([audit])]
 #
+# This is a built-in action.
+#
 ###############################################################################
-
-DEFAULTS -
-
-?if passed(@1)
-    ?if @1 eq 'audit'
-	?require AUDIT_TARGET
-	A_ACCEPT - - 17 1900
-	A_ACCEPT - -  6 49152
-    ?else
-	?error "Invalid argument (@1) to allowinUPnP"
-    ?endif
-?else
-    ACCEPT - - 17 1900
-    ACCEPT - -	6 49152
-?endif

Shorewall/Actions/action.dropBcast

@@ -22,18 +22,6 @@
 #
 # dropBcast[([audit])]
 #
+# This is a built-in action.
+#
 ###############################################################################
-
-DEFAULTS -
-
-?if passed(@1)
-    ?if @1 eq 'audit'
-	?require AUDIT_TARGET
-	Broadcast(A_DROP)
-    ?else
-	?error "Invalid argument (@1) to dropBcast"
-    ?endif
-?else
-    Broadcast(DROP)
-?endif
-

Shorewall/Actions/action.dropMcast

@@ -22,17 +22,6 @@
 #
 # dropMcast[([audit])]
 #
+# This is a built-in action.
+#
 ###############################################################################
-
-DEFAULTS -
-
-?if passed(@1)
-    ?if @1 eq 'audit'
-	?require AUDIT_TARGET
-	Multicast(A_DROP)
-    ?else
-	?error "Invalid argument (@1) to dropMcast"
-    ?endif
-?else
-    Multicast(DROP)
-?endif

Shorewall/Actions/action.dropNotSyn

@@ -22,17 +22,6 @@
 #
 # dropNotSyn[([audit])]
 #
+# This is a built-in action.
+#
 ###############################################################################
-
-DEFAULTS -
-
-?if passed(@1)
-    ?if @1 eq 'audit'
-	?require AUDIT_TARGET
-	A_DROP {proto=6:!syn}
-    ?else
-	?error "Invalid argument (@1) to dropNotSyn"
-    ?endif
-?else
-    DROP {proto=6:!syn}
-?endif

Shorewall/Actions/action.forwardUPnP

@@ -22,22 +22,6 @@
 #
 # forwardUPnP
 #
+# This is a built-in action.
+#
 ###############################################################################
-
-DEFAULTS -
-
-?begin perl
-
-use strict;
-use Shorewall::Config;
-use Shorewall::Chains;
-
-my $chainref = get_action_chain;
-
-set_optflags( $chainref, DONT_OPTIMIZE );
-
-add_commands( $chainref , '[ -f ${VARDIR}/.forwardUPnP ] && cat ${VARDIR}/.forwardUPnP >&3' );
-
-1;
-
-?end perl

Shorewall/Actions/action.rejNotSyn

@@ -22,18 +22,6 @@
 #
 # rejNotSyn[([audit])]
 #
+# This is a built-in action.
+#
 ###############################################################################
-
-DEFAULTS -
-
-?if passed(@1)
-    ?if @1 eq 'audit'
-	?require AUDIT_TARGET
-	A_REJECT {proto=6:!syn}
-    ?else
-	?error "Invalid argument (@1) to rejNotSyn"
-    ?endif
-?else
-    REJECT(tcp-reset) {proto=6:!syn}
-?endif
-

Shorewall/Perl/Shorewall/Accounting.pm

@@ -519,9 +519,9 @@ sub setup_accounting() {
 
 		while ( $chainswithjumps && $progress ) {
 		    $progress = 0;
-		    for my $chain1 ( keys %accountingjumps ) {
+		    for my $chain1 ( sort  keys %accountingjumps ) {
 			if ( keys %{$accountingjumps{$chain1}} ) {
-			    for my $chain2 ( keys %{$accountingjumps{$chain1}} ) {
+			    for my $chain2 ( sort keys %{$accountingjumps{$chain1}} ) {
 				delete $accountingjumps{$chain1}{$chain2}, $progress = 1 unless $accountingjumps{$chain2};
 			    }
 			} else {

Shorewall/Perl/Shorewall/Chains.pm

@@ -405,14 +405,14 @@ our $VERSION = 'MODULEVERSION';
 #   Provider Chains for provider <p>
 #      Load Balance    - ~<p>
 #
-#   Zone-pair chains for rules chain <z1-z2>
+#   Zone-pair chains for rules chain <z12z2>
 #
-#      Syn Flood       - @<z1-z2>
-#      Blacklist       - <z1-z2>~
-#      Established     - ^<z1-z2>
-#      Related         - +<z1-z2>
-#      Invalid         - _<z1-z2>
-#      Untracked       - &<z1-z2>
+#      Syn Flood       - @<z12z2>
+#      Blacklist       - <z12z2>~
+#      Established     - ^<z12z2>
+#      Related         - +<z12z2>
+#      Invalid         - _<z12z2>
+#      Untracked       - &<z12z2>
 #
 our %chain_table;
 our $raw_table;
@@ -434,7 +434,7 @@ use constant { STANDARD     =>      0x1,       #defined by Netfilter
 	       REDIRECT     =>     0x20,       #'REDIRECT'
 	       ACTION       =>     0x40,       #An action (may be built-in)
 	       MACRO        =>     0x80,       #A Macro
-	       LOGRULE      =>    0x100,       #'LOG','ULOG','NFLOG'
+	       LOGRULE      =>    0x100,       #'LOG','NFLOG'
 	       NFQ          =>    0x200,       #'NFQUEUE'
 	       CHAIN        =>    0x400,       #Manual Chain
 	       SET          =>    0x800,       #SET
@@ -1081,11 +1081,11 @@ sub format_option( $$ ) {
 
     assert( ! reftype $value );
 
-    my $rule;
+    my $rule = '';
 
     $value =~ s/\s*$//;
 
-    $rule = join( ' ' , ' -m', $option, $value );
+    $rule .= join( ' ' , ' -m', $option, $value );
 
     $rule;
 }
@@ -1223,7 +1223,7 @@ sub merge_rules( $$$ ) {
 	}
     }
 
-    for my $option ( grep ! $opttype{$_} || $_ eq 'nfacct' || $_ eq 'recent', keys %$fromref ) {
+    for my $option ( grep ! $opttype{$_} || $_ eq 'nfacct' || $_ eq 'recent', sort { $b cmp $a } keys %$fromref ) {
 	set_rule_option( $toref, $option, $fromref->{$option} );
     }
 
@@ -1239,7 +1239,7 @@ sub merge_rules( $$$ ) {
 
     set_rule_option( $toref, 'policy', $fromref->{policy} ) if exists $fromref->{policy};
 
-    for my $option ( grep( get_opttype( $_, 0 ) == EXPENSIVE, keys %$fromref ) ) {
+    for my $option ( grep( get_opttype( $_, 0 ) == EXPENSIVE, sort keys %$fromref ) ) {
 	set_rule_option( $toref, $option, $fromref->{$option} );
     }
 
@@ -3691,7 +3691,7 @@ sub optimize_level8( $$$ ) {
 	}
 
 	if ( $progress ) {
-	    my @rename = keys %rename;
+	    my @rename = sort keys %rename;
 	    #
 	    # First create aliases for each renamed chain and change the {name} member.
 	    #
@@ -4556,8 +4556,7 @@ sub do_proto( $$$;$ )
 
     if ( $proto ne '' ) {
 
-	my $synonly  = ( $proto =~ s/:(!)?syn$//i );
-	my $notsyn   = $1;
+	my $synonly  = ( $proto =~ s/:syn$//i );
 	my $invert   = ( $proto =~ s/^!// ? '! ' : '' );
 	my $protonum = resolve_proto $proto;
 
@@ -4575,7 +4574,7 @@ sub do_proto( $$$;$ )
 		$output  = "${invert}-p ${proto} ";
 	    } else {
 		fatal_error '":syn" is only allowed with tcp' unless $proto == TCP && ! $invert;
-		$output = $notsyn ? "-p $proto ! --syn " : "-p $proto --syn ";
+		$output = "-p $proto --syn ";
 	    }
 
 	    fatal_error "SOURCE/DEST PORT(S) not allowed with PROTO !$pname" if $invert && ($ports ne '' || $sports ne '');
@@ -6981,13 +6980,13 @@ sub set_global_variables( $$ ) {
     if ( $conditional ) {
 	my ( $interface, @interfaces );
 
-	@interfaces = keys %interfaceaddr;
+	@interfaces = sort keys %interfaceaddr;
 
 	for $interface ( @interfaces ) {
 	    emit( qq([ -z "\$interface" -o "\$interface" = "$interface" ] && $interfaceaddr{$interface}) );
 	}
 
-	@interfaces = keys %interfacegateways;
+	@interfaces = sort keys %interfacegateways;
 
 	for $interface ( @interfaces ) {
 	    emit( qq(if [ -z "\$interface" -o "\$interface" = "$interface" ]; then) );
@@ -6997,36 +6996,36 @@ sub set_global_variables( $$ ) {
 	    emit( qq(fi\n) );
 	}
 
-	@interfaces = keys %interfacemacs;
+	@interfaces = sort keys %interfacemacs;
 
 	for $interface ( @interfaces ) {
 	    emit( qq([ -z "\$interface" -o "\$interface" = "$interface" ] && $interfacemacs{$interface}) );
 	}
     } else {
-	emit $_     for values %interfaceaddr;
-	emit "$_\n" for values %interfacegateways;
-	emit $_     for values %interfacemacs;
+	emit $_     for sort values %interfaceaddr;
+	emit "$_\n" for sort values %interfacegateways;
+	emit $_     for sort values %interfacemacs;
     }
 
     if ( $setall ) {
-	emit $_ for values %interfaceaddrs;
-	emit $_ for values %interfacenets;
+	emit $_ for sort values %interfaceaddrs;
+	emit $_ for sort values %interfacenets;
 
 	unless ( have_capability( 'ADDRTYPE' ) ) {
 
 	    if ( $family == F_IPV4 ) {
 		emit 'ALL_BCASTS="$(get_all_bcasts) 255.255.255.255"';
-		emit $_ for values %interfacebcasts;
+		emit $_ for sort values %interfacebcasts;
 	    } else {
 		emit 'ALL_ACASTS="$(get_all_acasts)"';
-		emit $_ for values %interfaceacasts;
+		emit $_ for sort values %interfaceacasts;
 	    }
 	}
     }
 }
 
 sub verify_address_variables() {
-    for my $variable ( keys %address_variables ) {
+    for my $variable ( sort keys %address_variables ) {
 	my $type = $address_variables{$variable};
 	my $address = "\$$variable";
 
@@ -7943,7 +7942,7 @@ sub add_interface_options( $ ) {
 	#
 	# Generate a digest for each chain
 	#
-	for my $chainref ( values %input_chains, values %forward_chains ) {
+	for my $chainref ( sort { $a->{name} cmp $b->{name} } values %input_chains, values %forward_chains ) {
 	    my $digest = '';
 
 	    assert( $chainref );
@@ -7962,7 +7961,7 @@ sub add_interface_options( $ ) {
 	# Insert jumps to the interface chains into the rules chains
 	#
 	for my $zone1 ( off_firewall_zones ) {
-	    my @input_interfaces   = keys %{zone_interfaces( $zone1 )};
+	    my @input_interfaces   = sort keys %{zone_interfaces( $zone1 )};
 	    my @forward_interfaces = @input_interfaces;
 
 	    if ( @input_interfaces > 1 ) {
@@ -8048,7 +8047,7 @@ sub add_interface_options( $ ) {
 	for my $zone1 ( firewall_zone, vserver_zones ) {
 	    for my $zone2 ( off_firewall_zones ) {
 		my $chainref = $filter_table->{rules_chain( $zone1, $zone2 )};
-		my @interfaces = keys %{zone_interfaces( $zone2 )};
+		my @interfaces = sort keys %{zone_interfaces( $zone2 )};
 		my $chain1ref;
 
 		for my $interface ( @interfaces ) {
@@ -8454,7 +8453,7 @@ sub create_save_ipsets() {
 	    #
 	    $ipsets{$_} = 1 for ( @ipsets, @{$globals{SAVED_IPSETS}} );
 
-	    my @sets = keys %ipsets;
+	    my @sets = sort keys %ipsets;
 
 	    emit( '' ,
 		  '    rm -f $file' ,
@@ -8630,7 +8629,7 @@ sub create_load_ipsets() {
 #
 sub create_nfobjects() {
     
-    my @objects = ( keys %nfobjects );
+    my @objects = ( sort keys %nfobjects );
 
     if ( @objects ) {
 	if ( $config{NFACCT} ) {
@@ -8645,7 +8644,7 @@ sub create_nfobjects() {
 	}
     }
 
-    for ( keys %nfobjects ) {
+    for ( sort keys %nfobjects ) {
 	emit( qq(if ! qt \$NFACCT get $_; then),
 	      qq(    \$NFACCT add $_),
 	      qq(fi\n) );
@@ -9121,7 +9120,7 @@ sub initialize_switches() {
     if ( keys %switches ) {
 	emit( 'if [ $COMMAND = start ]; then' );
 	push_indent;
-	for my $switch ( keys %switches ) {
+	for my $switch ( sort keys %switches ) {
 	    my $setting = $switches{$switch};
 	    my $file = "/proc/net/nf_condition/$switch";
 	    emit "[ -f $file ] && echo $setting->{setting} > $file";

Shorewall/Perl/Shorewall/Compiler.pm

@@ -93,10 +93,11 @@ sub generate_script_1( $ ) {
 	    my $date = compiletime;
 
 	    emit "#!$config{SHOREWALL_SHELL}\n#\n# Compiled firewall script generated by Shorewall $globals{VERSION} - $date\n#";
+
+	    copy  $globals{SHAREDIRPL} . '/lib.runtime', 0;
+	    copy2 $globals{SHAREDIRPL} . '/lib.common' , $debug;
 	}
 
-	copy  $globals{SHAREDIRPL} . '/lib.runtime', 0;
-	copy2 $globals{SHAREDIRPL} . '/lib.common' , $debug;
     }
 
     my $lib = find_file 'lib.private';
@@ -944,7 +945,7 @@ sub compiler {
 	#
 	# Copy the footer to the script
 	#
-	copy $globals{SHAREDIRPL} . 'prog.footer';
+	copy $globals{SHAREDIRPL} . 'prog.footer' unless $test;
 
 	disable_script;
 	#

Shorewall/Perl/Shorewall/Config.pm

@@ -86,9 +86,6 @@ our @EXPORT = qw(
 		 kernel_version
 
                  compiletime
-				       
-		 F_IPV4
-		 F_IPV6
                 );
 
 our @EXPORT_OK = qw( $shorewall_dir initialize shorewall);
@@ -199,6 +196,9 @@ our %EXPORT_TAGS = ( internal => [ qw( create_temp_script
 
                                        PARMSMODIFIED
                                        USEDCALLER
+				       
+		                       F_IPV4
+		                       F_IPV6
 
 				       TCP
 				       UDP
@@ -748,7 +748,7 @@ sub initialize( $;$$) {
 		    TC_SCRIPT               => '',
 		    EXPORT                  => 0,
 		    KLUDGEFREE              => '',
-		    VERSION                 => "5.1.4-Beta1",
+		    VERSION                 => "5.1.1-RC1",
 		    CAPVERSION              => 50100 ,
 		    BLACKLIST_LOG_TAG       => '',
 		    RELATED_LOG_TAG         => '',
@@ -907,7 +907,6 @@ sub initialize( $;$$) {
 	  ZERO_MARKS => undef ,
 	  FIREWALL => undef ,
 	  BALANCE_PROVIDERS => undef ,
-	  PERL_HASH_SEED => undef ,
 	  #
 	  # Packet Disposition
 	  #
@@ -1093,7 +1092,7 @@ sub initialize( $;$$) {
 
     %compiler_params = ();
 
-    %actparams = ( 0 => 0, loglevel => '', logtag => '', chain => '', disposition => '', caller => '', callfile => '', callline => ''  );
+    %actparams = ( 0 => 0, loglevel => '', logtag => '', chain => '', disposition => '', caller => ''  );
     $parmsmodified = 0;
     $usedcaller    = 0;
     %ipsets = ();
@@ -1219,7 +1218,7 @@ sub compiletime() {
 sub currentlineinfo() {
     my $linenumber = $currentlinenumber || 1;
 
-    if ( $currentfilename ) {
+    if ( $currentfile ) {
 	my $lineinfo = " $currentfilename ";
 	
 	if ( $linenumber eq 'EOF' ) {
@@ -2178,7 +2177,7 @@ sub split_list3( $$ ) {
 	    $element = join ',', $element , $_;
 	}
     }
-
+    
     unless ( $opencount == 0 ) {
 	fatal_error "Invalid $type ($list)";
     }
@@ -2233,7 +2232,7 @@ sub split_list4( $ ) {
 sub split_columns( $ ) {
     my ($list) = @_;
 
-    return split ' ', $list unless $list =~ /[()]/;
+    return split ' ', $list unless $list =~ /\(/;
 
     my @list1 = split ' ', $list;
     my @list2;
@@ -2274,7 +2273,9 @@ sub split_columns( $ ) {
 	}
     }
 
-    fatal_error "Mismatched parentheses ($list)" unless $opencount == 0;
+    unless ( $opencount == 0 ) {
+	fatal_error "Mismatched parentheses ($list)";
+    }
 
     @list2;
 }
@@ -2287,7 +2288,7 @@ sub clear_comment();
 #    ensure that it has an appropriate number of columns.
 #    supply '-' in omitted trailing columns.
 #    Handles all of the supported forms of column/pair specification
-#    Handles segragating raw iptables input in rules
+#    Handles segragating raw iptables input in INLINE rules
 #
 sub split_line2( $$;$$$ ) {
     my ( $description, $columnsref, $nopad, $maxcolumns, $inline ) = @_;
@@ -2436,12 +2437,12 @@ sub split_line2( $$;$$$ ) {
 		}
 	    } else {
 		fatal_error "Unknown column ($1)" unless exists $columnsref->{$column};
+		$column = $columnsref->{$column};
+		fatal_error "Non-ASCII gunk in file" if $columns =~ /[^\s[:print:]]/;
 		$value = $1 if $value =~ /^"([^"]+)"$/;
 		$value =~ s/\\"/"/g;
-		fatal_error "Non-ASCII gunk in the value of the $column column" if $value =~ /[^\s[:print:]]/;
-		my $colnum = $columnsref->{$column};
-		warning_message qq(Replacing "$line[$colnum]" with "$value" in the ) . uc( $column ) . ' column' if $line[$colnum] ne '-';
-		$line[$colnum] = $value;
+		fatal_error "Non-ASCII gunk in the value of the $column column" if $columns =~ /[^\s[:print:]]/;
+		$line[$column] = $value;
 	    }
 	}
     }
@@ -2781,7 +2782,7 @@ sub evaluate_expression( $$$$ ) {
 	    my ( $first, $var, $rest ) = ( $1, $3, $4);
 	    $var = numeric_value( $var ) if $var =~ /^\d/;
 	    $val = $var ? $actparams{$var} : $chain;
-	    $usedcaller = USEDCALLER if $var =~ /^(?:caller|callfile|callline)$/;
+	    $usedcaller = USEDCALLER if $var eq 'caller';
 	    $expression = join_parts( $first, $val, $rest , $just_expand );
 	    directive_error( "Variable Expansion Loop" , $filename, $linenumber ) if ++$count > 100;
 	}
@@ -2817,6 +2818,7 @@ sub evaluate_expression( $$$$ ) {
 	#
 	# Not a simple one-term expression -- compile it
 	#
+
 	declare_passed unless $evals++;
 
 	$val = eval qq(package Shorewall::User;
@@ -2833,7 +2835,6 @@ sub evaluate_expression( $$$$ ) {
     $val;
 }
 
-sub pop_open();
 #
 # Set callback
 #
@@ -2841,40 +2842,6 @@ sub directive_callback( $ ) {
     $directive_callback = shift;
 }
 
-sub directive_message( \&$$$$ ) {
-    my ( $functptr, $verbose, $expression, $filename, $linenumber ) = @_;
-
-    unless ( $omitting ) {
-	if ( $actparams{0} ) {
-	    #
-	    # When issuing a message from an action, report the action invocation
-	    # site rather than the action file and line number.
-	    #
-	    # Avoid double-reporting by temporarily removing the invocation site
-	    # from the open stack.
-	    #
-	    my $saveopens = pop @openstack;
-
-	    $functptr->( $verbose ,
-			 evaluate_expression( $expression ,
-					      $filename ,
-					      $linenumber ,
-					      1 ),
-			 $actparams{callfile} ,
-			 $actparams{callline} );
-	    push @openstack, $saveopens;
-	} else {
-	    $functptr->( $verbose ,
-			 evaluate_expression( $expression ,
-					      $filename ,
-					      $linenumber ,
-					      1 ),
-			 $filename ,
-			 $linenumber );
-	}
-    }
-}
-
 #
 # Each entry in @ifstack consists of a 4-tupple
 #
@@ -2888,8 +2855,7 @@ sub process_compiler_directive( $$$$ ) {
 
     print "CD===> $line\n" if $debug;
 
-    directive_error( "Invalid compiler directive ($line)" , $filename, $linenumber )
-	unless $line =~ /^\s*\?(IF\s+|ELSE|ELSIF\s+|ENDIF|SET\s+|RESET\s+|FORMAT\s+|COMMENT\s*|ERROR\s+|WARNING\s+|INFO\s+|WARNING!\s+|INFO!\s+|REQUIRE\s+)(.*)$/i;
+    directive_error( "Invalid compiler directive ($line)" , $filename, $linenumber ) unless $line =~ /^\s*\?(IF\s+|ELSE|ELSIF\s+|ENDIF|SET\s+|RESET\s+|FORMAT\s+|COMMENT\s*|ERROR\s+|WARNING\s+|INFO\s+|WARNING!\s+|INFO!\s+|REQUIRE\s+)(.*)$/i;
 
     my ($keyword, $expression) = ( uc $1, $2 );
 
@@ -2991,16 +2957,15 @@ sub process_compiler_directive( $$$$ ) {
 		      $var = $2 || 'chain';
 		      directive_error( "Shorewall variables may only be RESET in the body of an action", $filename, $linenumber ) unless $actparams{0};
 		      if ( exists $actparams{$var} ) {
-			  if ( $var =~ /^(?:loglevel|logtag|chain|disposition|caller|callfile|callline)$/ ) {
+			  if ( $var =~ /^loglevel|logtag|chain|disposition|caller$/ ) {
 			      $actparams{$var} = '';
 			  } else {
 			      delete $actparams{$var}
 			  }
-
-			  $parmsmodified = PARMSMODIFIED if @ifstack > $ifstack;
 		      } else {
 			  directive_warning( 'Yes', "Shorewall variable $2 does not exist", $filename, $linenumber );
 		      }
+
 		  } else {
 		      if ( exists $variables{$2} ) {
 			  delete $variables{$2};
@@ -3031,85 +2996,68 @@ sub process_compiler_directive( $$$$ ) {
 
 	  ERROR => sub() {
 	      unless ( $omitting ) {
-		  if ( $actparams{0} ) {
-		      close $currentfile;
-		      #
-		      # Avoid 'missing ?ENDIF' error in pop_open'
-		      #
-		      @ifstack = ();
-		      #
-		      # Avoid double-reporting the action invocation site
-		      #
-		      pop_open;
-
-		      directive_error( evaluate_expression( $expression ,
-							    $filename ,
-							    $linenumber ,
-							    1 ) ,
-				       $actparams{callfile} ,
-				       $actparams{callline} );
-		  } else {
-		      directive_error( evaluate_expression( $expression ,
-							    $filename ,
-							    $linenumber ,
-							    1 ) ,
-				       $filename ,
-				       $linenumber ) unless $omitting;
-		  }
+		  directive_error( evaluate_expression( $expression ,
+							$filename ,
+							$linenumber ,
+							1 ) ,
+				   $filename ,
+				   $linenumber ) unless $omitting;
 	      }
 	  } ,
 
 	  WARNING => sub() {
-	      directive_message( &directive_warning ,
-				 $config{VERBOSE_MESSAGES},
-				 $expression ,
-				 $filename ,
-				 $linenumber );
+	      unless ( $omitting ) {
+		  directive_warning( $config{VERBOSE_MESSAGES} ,
+				     evaluate_expression( $expression ,
+							  $filename ,
+							  $linenumber ,
+							  1 ),
+				     $filename ,
+				     $linenumber ) unless $omitting;
+	      }
 	  } ,
 
 	  INFO => sub() {
-	      directive_message( &directive_info,
-				 $config{VERBOSE_MESSAGES} ,
-				 $expression ,
-				 $filename ,
-				 $linenumber );
+	      unless ( $omitting ) {
+		  directive_info( $config{VERBOSE_MESSAGES} ,
+				  evaluate_expression( $expression ,
+						       $filename ,
+						       $linenumber ,
+						       1 ),
+				  $filename ,
+				  $linenumber ) unless $omitting;
+	      }
 	  } ,
 
 	  'WARNING!' => sub() {
-	      directive_message( &directive_warning ,
-				 ! $config{VERBOSE_MESSAGES} ,
-				 $expression ,
-				 $filename ,
-				 $linenumber );
+	      unless ( $omitting ) {
+		  directive_warning( ! $config{VERBOSE_MESSAGES} ,
+				     evaluate_expression( $expression ,
+							  $filename ,
+							  $linenumber ,
+							  1 ),
+				     $filename ,
+				     $linenumber ) unless $omitting;
+	      }
 	  } ,
 
 	  'INFO!' => sub() {
-	      directive_message( &directive_info ,
-				 ! $config{VERBOSE_MESSAGES} ,
-				 $expression ,
-				 $filename ,
-				 $linenumber );
+	      unless ( $omitting ) {
+		  directive_info( ! $config{VERBOSE_MESSAGES} ,
+				  evaluate_expression( $expression ,
+						       $filename ,
+						       $linenumber ,
+						       1 ),
+				  $filename ,
+				  $linenumber ) unless $omitting;
+	      }
 	  } ,
 
 	  REQUIRE => sub() {
 	      unless ( $omitting ) {
 		  fatal_error "?REQUIRE may only be used within action files" unless $actparams{0};
-		  fatal_error "Unknown capability ($expression)" unless ( my $capdesc = $capdesc{$expression} );
-		  unless ( have_capability( $expression ) ) {
-		      close $currentfile;
-		      #
-		      # Avoid 'missing ?ENDIF' error in pop_open'
-		      #
-		      @ifstack = ();
-		      #
-		      # Avoid double-reporting the action call site
-		      #
-		      pop_open;
-
-		      directive_error( "The $actparams{action} action requires the $capdesc capability",
-				       $actparams{callfile} ,
-				       $actparams{callline} );
-		  }
+		  fatal_error "Unknown capability ($expression)" unless exists $capabilities{$expression};
+		  require_capability( $expression, "The $actparams{action} action", 's' );
 	      }
 	  } ,
 
@@ -3611,8 +3559,6 @@ sub push_action_params( $$$$$$ ) {
     $actparams{loglevel}    = $loglevel;
     $actparams{logtag}      = $logtag;
     $actparams{caller}      = $caller;
-    $actparams{callfile}    = $currentfilename;
-    $actparams{callline}    = $currentlinenumber;
     $actparams{disposition} = '' if $chainref->{action};
     #
     # The Shorewall variable '@chain' has non-word characters other than hyphen removed
@@ -3743,7 +3689,6 @@ sub expand_variables( \$ ) {
 	    $usedcaller = USEDCALLER if $var eq 'caller';
 	} else {
 	    fatal_error "Undefined shell variable (\$$var)" unless $config{IGNOREUNKNOWNVARIABLES} || exists $config{$var};
-	    $val = $config{$var};
 	}
 
 	$val = '' unless defined $val;
@@ -5423,12 +5368,8 @@ sub update_config_file( $ ) {
 		    }
 
 		}
-		if ( supplied $val ) {
-		    #
-		    # Log LEVEL and DEFAULT settings often contain parens
-		    #
-		    $val = ($var =~ /(?:LEVEL|DEFAULT)$/) ? qq("$val") : conditional_quote $val;
-		}
+
+		$val = conditional_quote $val;
 
 		$_ = "$var=$val\n";
 	    }
@@ -5491,7 +5432,6 @@ EOF
 sub process_shorewall_conf( $$ ) {
     my ( $update, $annotate ) = @_;
     my $file   = find_file "$product.conf";
-    my @vars;
 
     if ( -f $file ) {
 	$globals{CONFIGDIR} =  $configfile = $file;
@@ -5505,7 +5445,7 @@ sub process_shorewall_conf( $$ ) {
 	    # Don't expand shell variables or allow embedded scripting
 	    #
 	    while ( read_a_line( STRIP_COMMENTS | SUPPRESS_WHITESPACE  | CHECK_GUNK ) ) {
-		if ( $currentline =~ /^\s*([a-zA-Z]\w*)=(.*)$/ ) {
+		if ( $currentline =~ /^\s*([a-zA-Z]\w*)=(.*?)\s*$/ ) {
 		    my ($var, $val) = ($1, $2);
 
 		    if ( exists $config{$var} ) {
@@ -5524,12 +5464,6 @@ sub process_shorewall_conf( $$ ) {
 			next;
 		    }
 
-		    if ( $update ) {
-			push @vars, $var;
-		    } else {
-			expand_variables( $val ) unless $val =~ /^'.*'$/;
-		    }
-
 		    $config{$var} = ( $val =~ /\"([^\"]*)\"$/ ? $1 : $val );
 
 		    warning_message "Option $var=$val is deprecated"
@@ -5550,19 +5484,22 @@ sub process_shorewall_conf( $$ ) {
     #
     # Now update the config file if asked
     #
-    if ( $update ) {
-	update_config_file( $annotate ); 
-	#
-	# Config file update requires that the option values not have
-	# Shell variables expanded. We do that now.
-	#
-	# To handle options like LOG_LEVEL, we process the options
-	# in the order in which they appear in the .conf file.
-	#
-	for ( @vars ) {
-	    if ( supplied( my $val = $config{$_} ) ) {
-		expand_variables( $config{$_} ) unless $val =~ /^'.*'$/;
-	    }
+    update_config_file( $annotate ) if $update;
+    #
+    # Config file update requires that the option values not have
+    # Shell variables expanded. We do that now.
+    #
+    # We must first make LOG_LEVEL a variable because the order in which
+    # the values are processed below is not the order in which they appear
+    # in the config file.
+    #
+    my %log_level = ( LOG_LEVEL => $config{LOG_LEVEL} );
+
+    add_variables( %log_level );
+
+    for ( values  %config ) {
+	if ( supplied $_ ) {
+	    expand_variables( $_ ) unless /^'(.+)'$/;
 	}
     }
 }

Shorewall/Perl/Shorewall/IPAddrs.pm

@@ -389,8 +389,6 @@ sub resolve_proto( $ ) {
     my $proto = $_[0];
     my $number;
 
-    $proto =~ s/:.*//;
-
     if ( $proto =~ /^\d+$/ || $proto =~ /^0x/ ) {
 	$number = numeric_value ( $proto );
 	defined $number && $number <= 255 ? $number : undef;

Shorewall/Perl/Shorewall/Misc.pm

@@ -127,7 +127,7 @@ sub setup_ecn()
 	}
 
 	if ( @hosts ) {
-	    my @interfaces = ( keys %interfaces );
+	    my @interfaces = ( sort { interface_number($a) <=> interface_number($b) } keys %interfaces );
 
 	    progress_message "$doing ECN control on @interfaces...";
 
@@ -1213,53 +1213,55 @@ sub add_common_rules ( $ ) {
 	}
     }
 
-    my $announced = 0;
+    if ( $family == F_IPV4 ) {
+	my $announced = 0;
 
-    $list = find_interfaces_by_option 'upnp';
+	$list = find_interfaces_by_option 'upnp';
 
-    if ( @$list ) {
-	progress_message2 "$doing UPnP";
+	if ( @$list ) {
+	    progress_message2 "$doing UPnP";
 
-	$chainref = set_optflags( new_nat_chain( 'UPnP' ), DONT_OPTIMIZE );
+	    $chainref = set_optflags( new_nat_chain( 'UPnP' ), DONT_OPTIMIZE );
 
-	add_commands( $chainref, '[ -s /${VARDIR}/.UPnP ] && cat ${VARDIR}/.UPnP >&3' );
+	    add_commands( $chainref, '[ -s /${VARDIR}/.UPnP ] && cat ${VARDIR}/.UPnP >&3' );
 
-	my $chainref1;
+	    my $chainref1;
 
-	if ( $config{MINIUPNPD} ) {
-	    $chainref1 = set_optflags( new_nat_chain( 'MINIUPNPD-POSTROUTING' ), DONT_OPTIMIZE ); 
-	    add_commands( $chainref, '[ -s /${VARDIR}/.MINIUPNPD-POSTROUTING ] && cat ${VARDIR}/.MINIUPNPD-POSTROUTING >&3' );
+	    if ( $config{MINIUPNPD} ) {
+		$chainref1 = set_optflags( new_nat_chain( 'MINIUPNPD-POSTROUTING' ), DONT_OPTIMIZE ); 
+		add_commands( $chainref, '[ -s /${VARDIR}/.MINIUPNPD-POSTROUTING ] && cat ${VARDIR}/.MINIUPNPD-POSTROUTING >&3' );
+	    }
+
+	    $announced = 1;
+
+	    for $interface ( @$list ) {
+		add_ijump_extended $nat_table->{PREROUTING} ,            j => 'UPnP',                   get_interface_origin($interface), imatch_source_dev ( $interface );
+		add_ijump_extended $nat_table->{$globals{POSTROUTING}} , j => 'MINIUPNPD-POSTROUTING' , $origin{MINIUPNPD}              , imatch_dest_dev   ( $interface ) if $chainref1;
+	    }
 	}
 
-	$announced = 1;
+	$list = find_interfaces_by_option 'upnpclient';
 
-	for $interface ( @$list ) {
-	    add_ijump_extended $nat_table->{PREROUTING} ,            j => 'UPnP',                   get_interface_origin($interface), imatch_source_dev ( $interface );
-	    add_ijump_extended $nat_table->{$globals{POSTROUTING}} , j => 'MINIUPNPD-POSTROUTING' , $origin{MINIUPNPD}              , imatch_dest_dev   ( $interface ) if $chainref1;
-	}
-    }
+	if ( @$list ) {
+	    progress_message2 "$doing UPnP" unless $announced;
 
-    $list = find_interfaces_by_option 'upnpclient';
+	    for $interface ( @$list ) {
+		my $chainref = $filter_table->{input_option_chain $interface};
+		my $base     = uc var_base get_physical $interface;
+		my $optional = interface_is_optional( $interface );
+		my $variable = get_interface_gateway( $interface, ! $optional );
+		my $origin   = get_interface_origin( $interface );
 
-    if ( @$list ) {
-	progress_message2 "$doing UPnP" unless $announced;
-
-	for $interface ( @$list ) {
-	    my $chainref = $filter_table->{input_option_chain $interface};
-	    my $base     = uc var_base get_physical $interface;
-	    my $optional = interface_is_optional( $interface );
-	    my $variable = get_interface_gateway( $interface, ! $optional );
-	    my $origin   = get_interface_origin( $interface );
-
-	    if ( $optional ) {
-		add_commands( $chainref,
-			      qq(if [ -n "SW_\$${base}_IS_USABLE" -a -n "$variable" ]; then) );
-		incr_cmd_level( $chainref );
-		add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
-		decr_cmd_level( $chainref );
-		add_commands( $chainref, 'fi' );
-	    } else {
-		add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
+		if ( $optional ) {
+		    add_commands( $chainref,
+				  qq(if [ -n "SW_\$${base}_IS_USABLE" -a -n "$variable" ]; then) );
+		    incr_cmd_level( $chainref );
+		    add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
+		    decr_cmd_level( $chainref );
+		    add_commands( $chainref, 'fi' );
+		} else {
+		    add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
+		}
 	    }
 	}
     }
@@ -1295,7 +1297,7 @@ sub setup_mac_lists( $ ) {
 	$maclist_interfaces{ $hostref->[0] } = 1;
     }
 
-    my @maclist_interfaces = ( keys %maclist_interfaces );
+    my @maclist_interfaces = ( sort keys %maclist_interfaces );
 
     if ( $phase == 1 ) {
 
@@ -1616,7 +1618,7 @@ sub handle_loopback_traffic() {
 	    # Handle conntrack rules
 	    #
 	    if ( $notrackref->{referenced} ) {
-		for my $hostref ( @{defined_zone( $z1 )->{hosts}{ip}{'%vserver%'}} ) {
+		for my $hostref ( sort { $a->{type} cmp $b->{type} } @{defined_zone( $z1 )->{hosts}{ip}{'%vserver%'}} ) {
 		    my $exclusion   = source_exclusion( $hostref->{exclusions}, $notrackref);
 		    my @ipsec_match = match_ipsec_in $z1 , $hostref;
 
@@ -1637,8 +1639,8 @@ sub handle_loopback_traffic() {
 	    #
 	    my $source_hosts_ref = defined_zone( $z1 )->{hosts};
 
-	    for my $typeref ( values %{$source_hosts_ref} ) {
-		for my $hostref ( @{$typeref->{'%vserver%'}} ) {
+	    for my $typeref ( sort { $a->{type} cmp $b->{type} } values %{$source_hosts_ref} ) {
+		for my $hostref ( sort { $a->{type} cmp $b->{type} } @{$typeref->{'%vserver%'}} ) {
 		    my $exclusion   = source_exclusion( $hostref->{exclusions}, $natref);
 
 		    for my $net ( @{$hostref->{hosts}} ) {
@@ -1660,7 +1662,7 @@ sub add_interface_jumps {
     our %input_jump_added;
     our %output_jump_added;
     our %forward_jump_added;
-    my @interfaces = grep $_ ne '%vserver%', @_;
+    my @interfaces = sort grep $_ ne '%vserver%', @_;
     my $dummy;
     my $lo_jump_added = interface_zone( loopback_interface ) && ! get_interface_option( loopback_interface, 'destonly' );
     #
@@ -1774,7 +1776,7 @@ sub handle_complex_zone( $$ ) {
 	my $type       = $zoneref->{type};
 	my $source_ref = ( $zoneref->{hosts}{ipsec} ) || {};
 
-	for my $interface ( keys %$source_ref ) {
+	for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$source_ref ) {
 	    my $sourcechainref = $filter_table->{forward_chain $interface};
 	    my @interfacematch;
 	    my $interfaceref = find_interface $interface;
@@ -2286,9 +2288,9 @@ sub generate_matrix() {
 	#
 	# Take care of PREROUTING, INPUT and OUTPUT jumps
 	#
-	for my $type ( keys %$source_hosts_ref ) {
+	for my $type ( sort keys %$source_hosts_ref ) {
 	    my $typeref = $source_hosts_ref->{$type};
-	    for my $interface ( keys %$typeref ) {
+	    for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$typeref ) {
 		if ( get_physical( $interface ) eq '+' ) {
 		    #
 		    # Insert the interface-specific jumps before this one which is not interface-specific
@@ -2373,9 +2375,9 @@ sub generate_matrix() {
 
 		my $chainref = $filter_table->{$chain}; #Will be null if $chain is a Netfilter Built-in target like ACCEPT
 
-		for my $type ( keys %{$zone1ref->{hosts}} ) {
+		for my $type ( sort keys %{$zone1ref->{hosts}} ) {
 		    my $typeref = $zone1ref->{hosts}{$type};
-		    for my $interface ( keys %$typeref ) {
+		    for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$typeref ) {
 			for my $hostref ( @{$typeref->{$interface}} ) {
 			    next if $hostref->{options}{sourceonly};
 			    if ( $zone ne $zone1 || $num_ifaces > 1 || $hostref->{options}{routeback} ) {

Shorewall/Perl/Shorewall/Providers.pm

@@ -1799,7 +1799,7 @@ sub map_provider_to_interface() {
 
     my $haveoptional;
 
-    for my $providerref ( values %providers ) {
+    for my $providerref ( sort { $a->{number} cmp $b->{number} } values %providers ) {
 	if ( $providerref->{optional} ) {
 	    unless ( $haveoptional++ ) {
 		emit( 'if [ -n "$interface" ]; then',
@@ -1963,7 +1963,7 @@ sub compile_updown() {
     }
 
     my @nonshared = ( grep $providers{$_}->{optional},
-		      values %provider_interfaces );
+		      sort( { $providers{$a}->{number} <=> $providers{$b}->{number} } values %provider_interfaces ) );
 
     if ( @nonshared ) {
 	my $interfaces = join( '|', map $providers{$_}->{physical}, @nonshared );
@@ -2158,7 +2158,7 @@ sub handle_optional_interfaces( $ ) {
     # names but they might derive from wildcard interface entries. Optional interfaces which do not have
     # wildcard physical names are also included in the providers table.
     #
-    for my $providerref ( grep $_->{optional} , values %providers ) {
+    for my $providerref ( grep $_->{optional} , sort { $a->{number} <=> $b->{number} } values %providers ) {
 	push @interfaces, $providerref->{interface};
 	$wildcards ||= $providerref->{wildcard};
     }

Shorewall/Perl/Shorewall/Proxyarp.pm

@@ -154,7 +154,7 @@ sub setup_proxy_arp() {
 
 	emit '';
 
-	for my $interface ( keys %reset ) {
+	for my $interface ( sort keys %reset ) {
 	    unless ( $set{interface} ) {
 		my $physical = get_physical $interface;
 		emit  ( "if [ -f /proc/sys/net/ipv$family/conf/$physical/$proc_file ]; then" ,
@@ -163,7 +163,7 @@ sub setup_proxy_arp() {
 	    }
 	}
 
-	for my $interface ( keys %set ) {
+	for my $interface ( sort keys %set ) {
 	    my $physical = get_physical $interface;
 	    emit  ( "if [ -f /proc/sys/net/ipv$family/conf/$physical/$proc_file ]; then" ,
 		    "    echo 1 > /proc/sys/net/ipv$family/conf/$physical/$proc_file" );

Shorewall/Perl/Shorewall/Rules.pm

@@ -144,6 +144,8 @@ our %macros;
 
 our $family;
 
+our @builtins;
+
 #
 # Commands that can be embedded in a basic rule and how many total tokens on the line (0 => unlimited).
 #
@@ -350,7 +352,7 @@ sub initialize( $ ) {
     #
     $macro_nest_level  = 0;
     #
-    # All actions mentioned in /etc/shorewall[6]/actions and /usr/share/shorewall[6]/actions.std
+    # All builtin actions plus those mentioned in /etc/shorewall[6]/actions and /usr/share/shorewall[6]/actions.std
     #
     %actions           = ();
     #
@@ -361,6 +363,7 @@ sub initialize( $ ) {
     @columns           = ( ( '-' ) x LAST_COLUMN, 0 );
 
     if ( $family == F_IPV4 ) {
+	@builtins = qw/dropBcast dropMcast allowBcast allowMcast dropNotSyn rejNotSyn allowinUPnP forwardUPnP Limit/;
 	%reject_options = ( 'icmp-net-unreachable'   => 1,
 			    'icmp-host-unreachable'  => 1,
 			    'icmp-port-unreachable'  => 1,
@@ -373,6 +376,7 @@ sub initialize( $ ) {
 	                  );
 			    
     } else {
+	@builtins = qw/dropBcast dropMcast allowBcast allowMcast dropNotSyn rejNotSyn/;
 	%reject_options = ( 'icmp6-no-route'         => 1,
 			    'no-route'               => 1,
 			    'icmp6-adm-prohibited'   => 1,
@@ -617,7 +621,7 @@ sub handle_nfqueue( $$ ) {
 	    fatal_error "Invalid NFQUEUE queue number ($queue1)" unless defined( $queuenum1) && $queuenum1 >= 0 && $queuenum1 <= 65535;
 
 	    if ( supplied $queue2 ) {
-		$fanout    = $queue2 =~ s/c$// ? ' --queue-cpu-fanout' : '';
+		$fanout    = ' --queue-cpu-fanout' if $queue2 =~ s/c$//;
 		$queuenum2 = numeric_value( $queue2 );
 
 		fatal_error "Invalid NFQUEUE queue number ($queue2)" unless defined( $queuenum2) && $queuenum2 >= 0 && $queuenum2 <= 65535 && $queuenum1 < $queuenum2;
@@ -747,21 +751,22 @@ sub process_a_policy1($$$$$$$) {
 	if ( $serverwild ) {
 	    for my $zone ( @zonelist ) {
 		for my $zone1 ( @zonelist ) {
-		    set_policy_chain rules_chain( ${zone}, ${zone1} ), $zone, $zone1, $chainref, $policy, $intrazone;
+		    set_policy_chain rules_chain( ${zone}, ${zone1} ), $client, $server, $chainref, $policy, $intrazone;
 		    print_policy $zone, $zone1, $originalpolicy, $chain;
 		}
 	    }
 	} else {
 	    for my $zone ( all_zones ) {
-		set_policy_chain rules_chain( ${zone}, ${server} ), $zone, $server, $chainref, $policy, $intrazone;
+		set_policy_chain rules_chain( ${zone}, ${server} ), $client, $server, $chainref, $policy, $intrazone;
 		print_policy $zone, $server, $originalpolicy, $chain;
 	    }
 	}
     } elsif ( $serverwild ) {
 	for my $zone ( @zonelist ) {
-	    set_policy_chain rules_chain( ${client}, ${zone} ), $client, $zone, $chainref, $policy, $intrazone;
+	    set_policy_chain rules_chain( ${client}, ${zone} ), $client, $server, $chainref, $policy, $intrazone;
 	    print_policy $client, $zone, $originalpolicy, $chain;
 	}
+
     } else {
 	print_policy $client, $server, $originalpolicy, $chain;
     }
@@ -1705,6 +1710,191 @@ sub map_old_actions( $ ) {
     }
 }
 
+#
+# The following small functions generate rules for the builtin actions of the same name
+#
+sub dropBcast( $$$$ ) {
+    my ($chainref, $level, $tag, $audit) = @_;
+
+    my $target = require_audit ( 'DROP', $audit );
+
+    if ( have_capability( 'ADDRTYPE' ) ) {
+	if ( $level ne '' ) {
+	    log_irule_limit( $level, $chainref, 'dropBcast' , 'DROP', [], $tag, 'add', '', addrtype => '--dst-type BROADCAST' );
+	    if ( $family == F_IPV4 ) {
+		log_irule_limit( $level, $chainref, 'dropBcast' , 'DROP', [], $tag, 'add', '', d => '224.0.0.0/4' );
+	    } else {
+		log_irule_limit( $level, $chainref, 'dropBcast' , 'DROP', [], $tag, 'add', '', d => IPv6_MULTICAST );
+	    }
+	}
+
+	add_ijump $chainref, j => $target, addrtype => '--dst-type BROADCAST';
+    } else {
+	if ( $family == F_IPV4 ) {
+	    add_commands $chainref, 'for address in $ALL_BCASTS; do';
+	} else {
+	    add_commands $chainref, 'for address in $ALL_ACASTS; do';
+	}
+
+	incr_cmd_level $chainref;
+	log_irule_limit( $level, $chainref, 'dropBcast' , 'DROP', [], $tag, 'add', '', d => '$address' ) if $level ne '';
+	add_ijump $chainref, j => $target, d => '$address';
+	decr_cmd_level $chainref;
+	add_commands $chainref, 'done';
+    }
+}
+
+sub dropMcast( $$$$ ) {
+    my ($chainref, $level, $tag, $audit) = @_;
+
+    my $target = require_audit ( 'DROP', $audit );
+
+    if ( $family == F_IPV4 ) {
+	log_irule_limit $level, $chainref, 'dropMcast' , 'DROP', [], $tag, 'add', '', d => '224.0.0.0/4' if $level ne '';
+	add_ijump $chainref, j => $target, d => '224.0.0.0/4';
+    } else {
+	log_irule_limit( $level, $chainref, 'dropMcast' , 'DROP', [], $tag, 'add', '', d => IPv6_MULTICAST ) if $level ne '';
+	add_ijump $chainref, j => $target, d => IPv6_MULTICAST;
+    }
+}
+    
+sub allowBcast( $$$$ ) {
+    my ($chainref, $level, $tag, $audit) = @_;
+
+    my $target = require_audit( 'ACCEPT', $audit );
+
+    if ( $family == F_IPV4 && have_capability( 'ADDRTYPE' ) ) {
+	if ( $level ne '' ) {
+	    log_irule_limit( $level, $chainref, 'allowBcast' , 'ACCEPT', [], $tag, 'add', '', addrtype => '--dst-type BROADCAST' );
+	    log_irule_limit( $level, $chainref, 'allowBcast' , 'ACCEPT', [], $tag, 'add', '', d => '224.0.0.0/4' );
+	}
+
+	add_ijump $chainref, j => $target, addrtype => '--dst-type BROADCAST';
+    } else {
+	if ( $family == F_IPV4 ) {
+	    add_commands $chainref, 'for address in $ALL_BCASTS; do';
+	} else {
+	    add_commands $chainref, 'for address in $ALL_MACASTS; do';
+	}
+
+	incr_cmd_level $chainref;
+	log_irule_limit( $level, $chainref, 'allowBcast' , 'ACCEPT', [], $tag, 'add', '', d => '$address' ) if $level ne '';
+	add_ijump $chainref, j => $target, d => '$address';
+	decr_cmd_level $chainref;
+	add_commands $chainref, 'done';
+    }
+}
+
+sub allowMcast( $$$$ ) {
+    my ($chainref, $level, $tag, $audit) = @_;
+
+    my $target = require_audit( 'ACCEPT', $audit );
+
+    if ( $family == F_IPV4 ) {
+	log_irule_limit( $level, $chainref, 'allowMcast' , 'ACCEPT', [], $tag, 'add', '', d => '224.0.0.0/4' ) if $level ne '';
+	add_ijump $chainref, j => $target, d => '224.0.0.0/4';
+    } else {
+	log_irule_limit( $level, $chainref, 'allowMcast' , 'ACCEPT', '', $tag, 'add',  '', d => IPv6_MULTICAST ) if $level ne '';
+	add_ijump $chainref, j => $target, d => IPv6_MULTICAST;
+    }
+}
+
+sub dropNotSyn ( $$$$ ) {
+    my ($chainref, $level, $tag, $audit) = @_;
+
+    my $target = require_audit( 'DROP', $audit );
+
+    log_irule_limit( $level, $chainref, 'dropNotSyn' , 'DROP', [], $tag, 'add', '', p => '6 ! --syn' ) if $level ne '';
+    add_ijump $chainref , j => $target, p => '6 ! --syn';
+}
+
+sub rejNotSyn ( $$$$ ) {
+    my ($chainref, $level, $tag, $audit) = @_;
+
+    warning_message "rejNotSyn is deprecated in favor of NotSyn(REJECT)";
+
+    my $target = 'REJECT --reject-with tcp-reset';
+
+    if ( supplied $audit ) {
+	$target = require_audit( 'REJECT' , $audit );
+    }
+
+    log_irule_limit( $level, $chainref, 'rejNotSyn' , 'REJECT', [], $tag, 'add', '', p => '6 ! --syn' ) if $level ne '';
+    add_ijump $chainref , j => $target, p => '6 ! --syn';
+}
+
+sub forwardUPnP ( $$$$ ) {
+    my $chainref = set_optflags( 'forwardUPnP', DONT_OPTIMIZE );
+
+    add_commands( $chainref , '[ -f ${VARDIR}/.forwardUPnP ] && cat ${VARDIR}/.forwardUPnP >&3' );
+}
+
+sub allowinUPnP ( $$$$ ) {
+    my ($chainref, $level, $tag, $audit) = @_;
+
+    my $target = require_audit( 'ACCEPT', $audit );
+
+    if ( $level ne '' ) {
+	log_irule_limit( $level, $chainref, 'allowinUPnP' , 'ACCEPT', [], $tag, 'add', '', p => '17 --dport 1900' );
+	log_irule_limit( $level, $chainref, 'allowinUPnP' , 'ACCEPT', [], $tag, 'add', '', p => '6 --dport 49152' );
+    }
+
+    add_ijump $chainref, j => $target, p => '17 --dport 1900';
+    add_ijump $chainref, j => $target, p => '6 --dport 49152';
+}
+
+sub Limit( $$$$ ) {
+    my ($chainref, $level, $tag, $param ) = @_;
+
+    my @param;
+
+    if ( $param ) {
+	@param = split /,/, $param;
+    } else {
+	@param = split /,/, $tag;
+	$tag = '';
+    }
+
+    fatal_error 'Limit rules must include <set name>,<max connections>,<interval> as the log tag or as parameters' unless @param == 3;
+
+    my $set   = $param[0];
+
+    for ( @param[1,2] ) {
+	fatal_error 'Max connections and interval in Limit rules must be numeric (' . join( ':', 'Limit', $level eq '' ? 'none' : $level, $tag ) . ')' unless /^\d+$/
+    }
+
+    my $count = $param[1] + 1;
+
+    require_capability( 'RECENT_MATCH' , 'Limit rules' , '' );
+
+    warning_message "The Limit action is deprecated in favor of per-IP rate limiting using the RATE LIMIT column";
+
+    add_irule $chainref, recent => "--name $set --set";
+
+    if ( $level ne '' ) {
+	my $xchainref = new_chain 'filter' , "$chainref->{name}%";
+	log_irule_limit( $level, $xchainref, $param[0], 'DROP', [], $tag, 'add' , '' );
+	add_ijump $xchainref, j => 'DROP';
+	add_ijump $chainref,  j => $xchainref, recent => "--name $set --update --seconds $param[2] --hitcount $count";
+    } else {
+	add_ijump $chainref, j => 'DROP', recent => "--update --name $set --seconds $param[2] --hitcount $count";
+    }
+
+    add_ijump $chainref, j => 'ACCEPT';
+}
+
+my %builtinops = ( 'dropBcast'      => \&dropBcast,
+		   'dropMcast'      => \&dropMcast,
+		   'allowBcast'     => \&allowBcast,
+		   'allowMcast'     => \&allowMcast,
+		   'dropNotSyn'     => \&dropNotSyn,
+		   'rejNotSyn'      => \&rejNotSyn,
+		   'allowinUPnP'    => \&allowinUPnP,
+		   'forwardUPnP'    => \&forwardUPnP,
+		   'Limit'          => \&Limit,
+		 );
+
+
 sub process_rule ( $$$$$$$$$$$$$$$$$$$$ );
 sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$$ );
 sub process_snat1( $$$$$$$$$$$$ );
@@ -1726,6 +1916,12 @@ sub process_action(\$\$$) {
     my $actionref = $actions{$action};
     my $matches   = fetch_inline_matches;
 
+    if ( $type & BUILTIN ) {
+	$level = '' if $level =~ /none!?/;
+	$builtinops{$action}->( $chainref, $level, $tag, $param );
+	return 0;
+    }
+
     if ( $type & MANGLE_TABLE ) {
 	fatal_error "Action $action may only be used in the mangle file" unless $chainref->{table} eq 'mangle';
     } else {
@@ -1998,6 +2194,7 @@ sub process_action(\$\$$) {
 #
 # This function is called prior to processing of the policy file. It:
 #
+# - Adds the builtin actions to the target table
 # - Reads actions.std and actions (in that order) and for each entry:
 #   o Adds the action to the target table
 #   o Verifies that the corresponding action file exists
@@ -2006,6 +2203,10 @@ sub process_action(\$\$$) {
 sub process_actions() {
 
     progress_message2 "Locating Action Files...";
+    #
+    # Add built-in actions to the target table and create those actions
+    #
+    $targets{$_} = new_action( $_ , ACTION + BUILTIN, NOINLINE_OPT, '' , '' ) for @builtins;
 
     for my $file ( qw/actions.std actions/ ) {
 	open_file( $file, 2 );

Shorewall/Perl/Shorewall/Tc.pm

@@ -1924,7 +1924,7 @@ sub process_traffic_shaping() {
 
 			my ( $options, $redopts ) = ( '', $tcref->{redopts} );
 
-			for my $option ( keys %validredoptions ) {
+			for my $option ( sort keys %validredoptions ) {
 			    my $type = $validredoptions{$option};
 
 			    if ( my $value = $redopts->{$option} ) {
@@ -1943,7 +1943,7 @@ sub process_traffic_shaping() {
 
 			my ( $options, $codelopts ) = ( '', $tcref->{codelopts} );
 
-			for my $option ( keys %validcodeloptions ) {
+			for my $option ( sort keys %validcodeloptions ) {
 			    my $type = $validcodeloptions{$option};
 
 			    if ( my $value = $codelopts->{$option} ) {

Shorewall/Perl/Shorewall/Zones.pm

@@ -108,6 +108,24 @@ our @EXPORT = ( qw( NOTHING
 
 our @EXPORT_OK = qw( initialize );
 our $VERSION = 'MODULEVERSION';
+
+#
+# IPSEC Option types
+#
+use constant { NOTHING    => 'NOTHING',
+	       NUMERIC    => '0x[\da-fA-F]+|\d+',
+	       NETWORK    => '\d+.\d+.\d+.\d+(\/\d+)?',
+	       IPSECPROTO => 'ah|esp|ipcomp',
+	       IPSECMODE  => 'tunnel|transport'
+	       };
+
+#
+# Option columns
+#
+use constant { IN_OUT     => 1,
+	       IN         => 2,
+	       OUT        => 3 };
+
 #
 # Zone Table.
 #
@@ -203,26 +221,6 @@ our $zonemarkincr;
 our $zonemarklimit;
 our $loopback_interface;
 
-#
-# IPSEC Option types
-#
-use constant { NOTHING    => 'NOTHING',
-	       NUMERIC    => '0x[\da-fA-F]+|\d+',
-	       IPSECPROTO => 'ah|esp|ipcomp',
-	       IPSECMODE  => 'tunnel|transport'
-	     };
-
-sub NETWORK() {
-    $family == F_IPV4 ? '\d+.\d+.\d+.\d+(\/\d+)?' : '(?:[0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}(?:\/d+)?';
-}
-
-#
-# Option columns
-#
-use constant { IN_OUT     => 1,
-	       IN         => 2,
-	       OUT        => 3 };
-
 use constant { FIREWALL => 1,
 	       IP       => 2,
 	       BPORT    => 4,
@@ -278,7 +276,19 @@ our %maxoptionvalue = ( routefilter => 2, mss => 100000 , wait => 120 , ignore =
 
 our %validhostoptions;
 
-our %validzoneoptions;
+our %validzoneoptions = ( mss            => NUMERIC,
+			  nomark         => NOTHING,
+			  blacklist      => NOTHING,
+			  dynamic_shared => NOTHING,
+			  strict         => NOTHING,
+			  next           => NOTHING,
+			  reqid          => NUMERIC,
+			  spi            => NUMERIC,
+			  proto          => IPSECPROTO,
+			  mode           => IPSECMODE,
+			 "tunnel-src"   => NETWORK,
+			 "tunnel-dst"   => NETWORK,
+		       );
 
 use constant { UNRESTRICTED => 1, NOFW => 2 , COMPLEX => 8, IN_OUT_ONLY => 16 };
 #
@@ -320,20 +330,6 @@ sub initialize( $$ ) {
     $minroot = 0;
     $loopback_interface = '';
 
-    %validzoneoptions = ( mss            => NUMERIC,
-			  nomark         => NOTHING,
-			  blacklist      => NOTHING,
-			  dynamic_shared => NOTHING,
-			  strict         => NOTHING,
-			  next           => NOTHING,
-			  reqid          => NUMERIC,
-			  spi            => NUMERIC,
-			  proto          => IPSECPROTO,
-			  mode           => IPSECMODE,
-			 "tunnel-src"   => NETWORK,
-			 "tunnel-dst"   => NETWORK,
-		       );
-
     if ( $family == F_IPV4 ) {
 	%validinterfaceoptions = (arp_filter  => BINARY_IF_OPTION,
 				  arp_ignore  => ENUM_IF_OPTION,
@@ -411,8 +407,6 @@ sub initialize( $$ ) {
 				    forward     => BINARY_IF_OPTION,
 				    physical    => STRING_IF_OPTION + IF_OPTION_HOST,
 				    unmanaged   => SIMPLE_IF_OPTION,
-				    upnp        => SIMPLE_IF_OPTION,
-				    upnpclient  => SIMPLE_IF_OPTION,
 				    wait        => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
 				 );
 	%validhostoptions = (
@@ -719,10 +713,10 @@ sub zone_report()
 	my $printed = 0;
 
 	if ( $hostref ) {
-	    for my $type ( keys %$hostref ) {
+	    for my $type ( sort keys %$hostref ) {
 		my $interfaceref = $hostref->{$type};
 
-		for my $interface ( keys %$interfaceref ) {
+		for my $interface ( sort keys %$interfaceref ) {
 		    my $iref     = $interfaces{$interface};
 		    my $arrayref = $interfaceref->{$interface};
 
@@ -772,10 +766,10 @@ sub dump_zone_contents() {
 	$entry .= ( " mark=" . in_hex( $zoneref->{mark} ) ) if exists $zoneref->{mark};
 
 	if ( $hostref ) {
-	    for my $type ( keys %$hostref ) {
+	    for my $type ( sort keys %$hostref ) {
 		my $interfaceref = $hostref->{$type};
 
-		for my $interface ( keys %$interfaceref ) {
+		for my $interface ( sort keys %$interfaceref ) {
 		    my $iref     = $interfaces{$interface};
 		    my $arrayref = $interfaceref->{$interface};
 
@@ -1319,7 +1313,7 @@ sub process_interface( $$ ) {
 		    assert(0);
 		}
 	    } elsif ( $type == STRING_IF_OPTION ) {
-		fatal_error "The '$option' option requires a value" unless supplied $value;
+		fatal_error "The '$option' option requires a value" unless defined $value;
 
 		if ( $option eq 'physical' ) {
 		    fatal_error "Invalid interface name ($interface)" if $interface =~ /[()\[\]\*\?%]/;
@@ -2225,9 +2219,9 @@ sub find_hosts_by_option( $ ) {
     }
 
     for my $zone ( grep ! ( $zones{$_}{type} & FIREWALL ) , @zones ) {
-	for my $type (keys %{$zones{$zone}{hosts}} ) {
+	for my $type (sort keys %{$zones{$zone}{hosts}} ) {
 	    my $interfaceref = $zones{$zone}{hosts}->{$type};
-	    for my $interface ( keys %$interfaceref ) {
+	    for my $interface ( sort keys %$interfaceref ) {
 		my $arrayref = $interfaceref->{$interface};
 		for my $host ( @{$arrayref} ) {
 		    my $ipsec  = $host->{ipsec};
@@ -2255,9 +2249,9 @@ sub find_zone_hosts_by_option( $$ ) {
     my @hosts;
 
     unless ( $zones{$zone}{type} & FIREWALL ) {
-	for my $type (keys %{$zones{$zone}{hosts}} ) {
+	for my $type (sort keys %{$zones{$zone}{hosts}} ) {
 	    my $interfaceref = $zones{$zone}{hosts}->{$type};
-	    for my $interface ( keys %$interfaceref ) {
+	    for my $interface ( sort keys %$interfaceref ) {
 		my $arrayref = $interfaceref->{$interface};
 		for my $host ( @{$arrayref} ) {
 		    if ( my $value = $host->{options}{$option} ) {

Shorewall/Perl/compiler.pl

@@ -43,8 +43,6 @@
 #         --inline                    # Update alternative column specifications
 #         --update                    # Update configuration to current release
 #
-#    If the <filename> is omitted, then a 'check' operation is performed.
-#
 use strict;
 use FindBin;
 use lib "$FindBin::Bin";

Shorewall/Perl/lib.runtime

@@ -32,7 +32,7 @@
 #	    down			Stop an optional interface
 #	    enable			Enable an optional interface
 #	    help			Show command syntax
-#	    reenable			Disable then enable an optional
+#	    reenable			Disable then nable an optional
 #					interface
 #	    refresh			Refresh the firewall
 #	    reload			Reload the firewall

Shorewall/Samples/Universal/shorewall.conf

@@ -109,12 +109,12 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT="none"
+ACCEPT_DEFAULT=none
 BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
-REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
+REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
@@ -217,8 +217,6 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
-PERL_HASH_SEED=0
-
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=Yes

Shorewall/Samples/one-interface/shorewall.conf

@@ -120,12 +120,12 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT="none"
+ACCEPT_DEFAULT=none
 BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
-REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
+REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
@@ -228,8 +228,6 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
-PERL_HASH_SEED=0
-
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No

Shorewall/Samples/three-interfaces/shorewall.conf

@@ -117,12 +117,12 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT="none"
+ACCEPT_DEFAULT=none
 BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
-REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
+REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
@@ -225,8 +225,6 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
-PERL_HASH_SEED=0
-
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No

Shorewall/Samples/two-interfaces/shorewall.conf

@@ -120,12 +120,12 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT="none"
+ACCEPT_DEFAULT=none
 BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
-REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
+REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
@@ -228,8 +228,6 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
-PERL_HASH_SEED=0
-
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No

Shorewall/Samples/two-interfaces/snat

@@ -20,4 +20,4 @@
 MASQUERADE		10.0.0.0/8,\
 			169.254.0.0/16,\
 			172.16.0.0/12,\
-			192.168.0.0/16		eth0
+			92.168.0.0/16		eth0

Shorewall/actions.std

@@ -6,42 +6,45 @@
 #	Please see http://shorewall.net/Actions.html for additional
 #	information.
 #
+# Builtin Actions are:
+#
+?if 0
+allowBcast			# Silently Allow Broadcast
+allowMcast			# Silently Allow Multicast
+dropBcast			# Silently Drop Broadcast
+dropMcast			# Silently Drop Multicast
+dropNotSyn			# Silently Drop Non-syn TCP packets
+rejNotSyn			# Silently Reject Non-syn TCP packets
+allowinUPnP			# Allow UPnP inbound (to firewall) traffic
+forwardUPnP			# Allow traffic that upnpd has redirected from 'upnp' interfaces.
+Limit				# Limit the rate of connections from each individual IP address
+?endif
 ###############################################################################
 #ACTION
-A_AllowICMPs inline		# Audited version of AllowICMPs
 A_Drop				# Audited Default Action for DROP policy
 A_REJECT     noinline,logjump	# Audits then rejects a connection request
 A_REJECT!    inline		# Audits then rejects a connection request
 A_Reject			# Audited Default action for REJECT policy
-AllowICMPs   inline		# Allow Required ICMP packets
-allowBcast   inline		# Silently Allow Broadcast
-allowinUPnP  inline		# Allow UPnP inbound (to firewall) traffic
+AllowICMPs   inline             # Allow Required ICMP packets
 allowInvalid inline		# Accepts packets in the INVALID conntrack state
-allowMcast   inline		# Silently Allow Multicast
 AutoBL	     noinline		# Auto-blacklist IPs that exceed thesholds
 AutoBLL	     noinline		# Helper for AutoBL
 BLACKLIST    logjump,section	# Add sender to the dynamic blacklist
 Broadcast    noinline,audit	# Handles Broadcast/Anycast
 DNSAmp				# Matches one-question recursive DNS queries
 Drop				# Default Action for DROP policy (deprecated)
-dropBcast    inline		# Silently Drop Broadcast
 dropInvalid  inline		# Drops packets in the INVALID conntrack state
-dropMcast    inline		# Silently Drop Multicast
-dropNotSyn   noinline		# Silently Drop Non-syn TCP packets
 DropDNSrep   inline		# Drops DNS replies
 DropSmurfs   noinline		# Drop smurf packets
 Established  inline,\		# Handles packets in the ESTABLISHED state
 	     state=ESTABLISHED	#
-forwardUPnP  noinline		# Allow traffic that upnpd has redirected from 'upnp' interfaces.
 GlusterFS    inline		# Handles GlusterFS
 IfEvent	     noinline		# Perform an action based on an event
 Invalid	     inline,audit,\	# Handles packets in the INVALID conntrack state
 	     state=INVALID	#
-Limit	     noinline		# Limit the rate of connections from each individual IP address
 Multicast    noinline,audit	# Handles Multicast
 New	     inline,state=NEW	# Handles packets in the NEW conntrack state
 NotSyn	     inline,audit	# Handles TCP packets which do not have SYN=1 and ACK=0
-rejNotSyn    noinline		# Silently Reject Non-syn TCP packets
 Reject				# Default Action for REJECT policy (deprecated)
 Related	     inline,\		# Handles packets in the RELATED conntrack state
 	     state=RELATED	#

Shorewall/configfiles/shorewall.conf

@@ -63,7 +63,7 @@ RPFILTER_LOG_LEVEL="$LOG_LEVEL"
 
 SFILTER_LOG_LEVEL="$LOG_LEVEL"
 
-SMURF_LOG_LEVEL="$LOG_LEVEL"
+SMURF_LOG_LEVEL=$LOG_LEVEL
 
 STARTUP_LOG=/var/log/shorewall-init.log
 
@@ -109,12 +109,12 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT="none"
+ACCEPT_DEFAULT=none
 BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
-REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
+REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP),AllowICMPs"
 
 ###############################################################################
 #			 R S H / R C P	C O M M A N D S
@@ -217,8 +217,6 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
-PERL_HASH_SEED=0
-
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No

Shorewall/default.debian

@@ -1,5 +1,5 @@
 # prevent startup with default configuration
-# set the following variable to 1 in order to allow Shorewall to start
+# set the following varible to 1 in order to allow Shorewall to start
 
 startup=0
 
@@ -16,7 +16,7 @@ startup=0
 #    wait_interface=
 
 #
-# Global start/restart/reload/stop options
+# Global start/restart options
 #
 OPTIONS=""
 
@@ -28,17 +28,12 @@ STARTOPTIONS=""
 #
 # Restart options
 #
-RESTARTOPTIONS=""
-
-#
-# Reload options
-#
 RELOADOPTIONS=""
 
 #
-# Stop options
+# Restart options
 #
-STOPOPTIONS=""
+RESTARTOPTIONS=""
 
 #
 # Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf

Shorewall/default.debian.systemd

@@ -1,26 +0,0 @@
-#
-# Global start/restart/reload/stop options
-#
-OPTIONS=""
-
-#
-# Start options
-#
-STARTOPTIONS=""
-
-#
-# Restart options
-#
-RESTARTOPTIONS=""
-
-#
-# Reload options
-#
-RELOADOPTIONS=""
-
-#
-# Stop options
-#
-STOPOPTIONS=""
-
-# EOF

Shorewall/install.sh

@@ -22,22 +22,55 @@
 #	along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
 
-VERSION=xxx # The Build script inserts the actual version
+VERSION=4.5.5       #The Build script inserts the actual version
 
+#
+# Change to the directory containing this script
+#
 usage() # $1 = exit status
 {
     ME=$(basename $0)
-    echo "usage: $ME [ <option> ] [ <shorewallrc file> ]"
-    echo "where <option> is one of"
-    echo "  -h"
-    echo "  -v"
-    echo "  -s"
-    echo "  -a"
-    echo "  -p"
-    echo "  -n"
+    echo "usage: $ME [ <configuration-file> ]"
+    echo "       $ME -v"
+    echo "       $ME -h"
+    echo "       $ME -s"
+    echo "       $ME -a"
+    echo "       $ME -n"
     exit $1
 }
 
+fatal_error()
+{
+    echo "   ERROR: $@" >&2
+    exit 1
+}
+
+split() {
+    local ifs
+    ifs=$IFS
+    IFS=:
+    set -- $1
+    echo $*
+    IFS=$ifs
+}
+
+qt()
+{
+    "$@" >/dev/null 2>&1
+}
+
+mywhich() {
+    local dir
+
+    for dir in $(split $PATH); do
+	if [ -x $dir/$1 ]; then
+	    return 0
+	fi
+    done
+
+    return 2
+}
+
 run_install()
 {
     if ! install $*; then
@@ -47,14 +80,27 @@ run_install()
     fi
 }
 
+cant_autostart()
+{
+    echo
+    echo  "WARNING: Unable to configure $PRODUCT to start automatically at boot" >&2
+}
+
+delete_file() # $1 = file to delete
+{
+    rm -f $1
+}
+
 install_file() # $1 = source $2 = target $3 = mode
 {
     run_install $T $OWNERSHIP -m $3 $1 ${2}
 }
 
-#
-# Change to the directory containing this script
-#
+require()
+{
+    eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
+}
+
 cd "$(dirname $0)"
 
 if [ -f shorewall.service ]; then
@@ -65,11 +111,6 @@ else
     Product=Shorewall6
 fi
 
-#
-# Source common functions
-#
-. ./lib.installer || { echo "ERROR: Can not load common functions." >&2; exit 1; }
-
 #
 # Parse the run line
 #
@@ -131,14 +172,11 @@ done
 #
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-	file=./shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
+	. ./shorewallrc
     elif [ -f ~/.shorewallrc ]; then
-	file=~/.shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
+	. ~/.shorewallrc || exit 1
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-	file=/usr/share/shorewall/shorewallrc
-        . $file || fatal_error "Can not load the RC file: $file"
+	. /usr/share/shorewall/shorewallrc
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -148,11 +186,11 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file || exit 1
+	    file=./$file
 	    ;;
     esac
 
-    . $file || fatal_error "Can not load the RC file: $file"
+    . $file
 else
     usage 1
 fi
@@ -267,7 +305,8 @@ case "$HOST" in
     linux)
 	;;
     *)
-	fatal_error "Unknown HOST \"$HOST\""
+	echo "ERROR: Unknown HOST \"$HOST\"" >&2
+	exit 1;
 	;;
 esac
 
@@ -278,7 +317,8 @@ if [ $PRODUCT = shorewall ]; then
 	#
 	if [ "$DIGEST" != SHA ]; then
 	    if [ "$BUILD" = "$HOST" ] && ! eval perl -e \'use Digest::$DIGEST\;\' 2> /dev/null ; then
-		fatal_error "Perl compilation with Digest::$DIGEST failed"
+		echo "ERROR: Perl compilation with Digest::$DIGEST failed" >&2
+		exit 1;
 	    fi
 
 	    cp -af Perl/Shorewall/Chains.pm Perl/Shorewall/Chains.pm.bak
@@ -301,7 +341,8 @@ if [ $PRODUCT = shorewall ]; then
 		sed -i 's/Digest::SHA/Digest::SHA1/' Perl/Shorewall/Config.pm
 		DIGEST=SHA1
 	    else
-		fatal_error "Shorewall $VERSION requires either Digest::SHA or Digest::SHA1"
+		echo "ERROR: Shorewall $VERSION requires either Digest::SHA or Digest::SHA1" >&2
+		exit 1
 	    fi
 	fi
     fi
@@ -329,10 +370,11 @@ if [ $BUILD != cygwin ]; then
     fi
 fi
 
-run_install -d $OWNERSHIP -m 0755 ${DESTDIR}${SBINDIR}
-[ -n "${INITFILE}" ] && run_install -d $OWNERSHIP -m 0755 ${DESTDIR}${INITDIR}
+install -d $OWNERSHIP -m 755 ${DESTDIR}${SBINDIR}
+[ -n "${INITFILE}" ] && install -d $OWNERSHIP -m 755 ${DESTDIR}${INITDIR}
 if [ -z "$DESTDIR" -a $PRODUCT != shorewall ]; then
-    [ -x ${LIBEXECDIR}/shorewall/compiler.pl ] || fatal_error "Shorewall >= 4.5.0 is not installed"
+    [ -x ${LIBEXECDIR}/shorewall/compiler.pl ] || \
+	{ echo "   ERROR: Shorewall >= 4.5.0 is not installed" >&2; exit 1; }
 fi
 
 echo "Installing $Product Version $VERSION"
@@ -346,7 +388,7 @@ else
     first_install="Yes"
 fi
 
-if [ -z "${DESTDIR}" -a $PRODUCT = shorewall -a ! -f ${SHAREDIR}/shorewall/coreversion ]; then
+if [ -z "${DESTDIR}" -a $PRODUCT = shorewall -a ! -f ${SHAREDIR}/$PRODUCT/coreversion ]; then
     echo "Shorewall $VERSION requires Shorewall Core which does not appear to be installed"
     exit 1
 fi
@@ -368,16 +410,22 @@ fi
 #
 # Create /etc/$PRODUCT and other directories
 #
-make_parent_directory ${DESTDIR}${CONFDIR}/$PRODUCT 0755
-make_parent_directory ${DESTDIR}${LIBEXECDIR}/$PRODUCT 0755
-make_parent_directory ${DESTDIR}${PERLLIBDIR}/Shorewall 0755
-make_parent_directory ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles 0755
-make_parent_directory ${DESTDIR}${SHAREDIR}/$PRODUCT/deprecated 0755
-make_parent_directory ${DESTDIR}${VARDIR} 0755
+mkdir -p ${DESTDIR}${CONFDIR}/$PRODUCT
+mkdir -p ${DESTDIR}${LIBEXECDIR}/$PRODUCT
+mkdir -p ${DESTDIR}${PERLLIBDIR}/Shorewall
+mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
+mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT/deprecated
+mkdir -p ${DESTDIR}${VARDIR}
 
-chmod 0755 ${DESTDIR}${SHAREDIR}/$PRODUCT
+chmod 755 ${DESTDIR}${CONFDIR}/$PRODUCT
+chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT
+chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
+chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT/deprecated
 
-[ -n "$DESTDIR" ] && make_parent_directory ${DESTDIR}${CONFDIR}/logrotate.d 0755
+if [ -n "$DESTDIR" ]; then
+    mkdir -p ${DESTDIR}${CONFDIR}/logrotate.d
+    chmod 755 ${DESTDIR}${CONFDIR}/logrotate.d
+fi
 
 #
 # Install the .service file
@@ -387,9 +435,9 @@ if [ -z "${SERVICEDIR}" ]; then
 fi
 
 if [ -n "$SERVICEDIR" ]; then
-    make_parent_directory ${DESTDIR}${SERVICEDIR} 0755
+    mkdir -p ${DESTDIR}${SERVICEDIR}
     [ -z "$SERVICEFILE" ] && SERVICEFILE=$PRODUCT.service
-    run_install $OWNERSHIP -m 0644 $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
+    run_install $OWNERSHIP -m 644 $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
     [ ${SBINDIR} != /sbin ] && eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
     echo "Service file $SERVICEFILE installed as ${DESTDIR}${SERVICEDIR}/$PRODUCT.service"
 fi
@@ -442,14 +490,6 @@ if [ -z "$first_install" ]; then
 	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.A_REJECT
 	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.Drop
 	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.Reject
-	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.A_Drop
-	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.A_Reject
-	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.A_AllowICMPs
-    else
-	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.A_AllowICMPs
-	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.AllowICMPs
-	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.Broadcast
-	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.Multicast
     fi
 fi
 
@@ -1054,14 +1094,8 @@ cd ..
 #
 for f in lib.* Perl/lib.*; do
     if [ -f $f ]; then
-        case $f in
-            *installer)
-                ;;
-            *)
-                install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$(basename $f) 0644
-                echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
-                ;;
-        esac
+	install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$(basename $f) 0644
+	echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
     fi
 done
 
@@ -1071,7 +1105,7 @@ if [ $PRODUCT = shorewall6 ]; then
     #
     ln -sf lib.base ${DESTDIR}${SHAREDIR}/$PRODUCT/functions
     #
-    # And create a symbolic link for the CLI
+    # And create a sybolic link for the CLI
     #
     ln -sf shorewall ${DESTDIR}${SBINDIR}/shorewall6
 fi
@@ -1080,7 +1114,8 @@ if [ -d Perl ]; then
     #
     # ${SHAREDIR}/$PRODUCT/$Product if needed
     #
-    make_parent_directory ${DESTDIR}${SHAREDIR}/$PRODUCT/$Product 0755
+    mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT/$Product
+    chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT/$Product
     #
     # Install the Compiler
     #
@@ -1129,7 +1164,7 @@ fi
 # Create the version file
 #
 echo "$VERSION" > ${DESTDIR}${SHAREDIR}/$PRODUCT/version
-chmod 0644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
+chmod 644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
 #
 # Remove and create the symbolic link to the init script
 #
@@ -1147,7 +1182,7 @@ if [ -n "$MANDIR" ]; then
 
 cd manpages
 
-[ -n "$INSTALLD" ] || make_parent_directory ${DESTDIR}${MANDIR}/man5 0755
+[ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man5/
 
 for f in *.5; do
     gzip -9c $f > $f.gz
@@ -1155,7 +1190,7 @@ for f in *.5; do
     echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
 done
 
-[ -n "$INSTALLD" ] || make_parent_directory ${DESTDIR}${MANDIR}/man8 0755
+[ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man8/
 
 for f in *.8; do
     gzip -9c $f > $f.gz
@@ -1178,7 +1213,8 @@ fi
 #
 if [ -n "$SYSCONFFILE" -a -f "$SYSCONFFILE" -a ! -f ${DESTDIR}${SYSCONFDIR}/${PRODUCT} ]; then
     if [ ${DESTDIR} ]; then
-	make_parent_directory ${DESTDIR}${SYSCONFDIR} 0755
+	mkdir -p ${DESTDIR}${SYSCONFDIR}
+	chmod 755 ${DESTDIR}${SYSCONFDIR}
     fi
 
     run_install $OWNERSHIP -m 0644 ${SYSCONFFILE} ${DESTDIR}${SYSCONFDIR}/$PRODUCT
@@ -1236,6 +1272,6 @@ if [ $configure -eq 1 -a -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${
 fi
 
 #
-# Report Success
+#  Report Success
 #
 echo "$Product Version $VERSION Installed"

Shorewall/lib.cli-std

@@ -341,18 +341,6 @@ get_config() {
 	setup_dbl
     fi
 
-    if [ -z "$PERL_HASH_SEED" ]; then
-	PERL_HASH_SEED=0
-    else
-	case $PERL_HASH_SEED in
-	    [0-9]|[1-9][0-9]|[1-9][0-9][0-9]|[1-9][0-9][0-9][0-9]|[1-9][0-9][0-9][0-9][0-9]|random)
-	        ;;
-	    *)
-		fatal_error "Invalid setting ($PERL_HASH_SEED) for PERL_HASH_SEED"
-		;;
-	esac
-    fi
-
     lib=$(find_file lib.cli-user)
 
     [ -f $lib ] && . $lib
@@ -496,18 +484,6 @@ compiler() {
     #
     [ "$g_debugging" != trace -a -z "$g_preview" ] || [ -n "$g_debug" ] && g_pager=
 
-    case $PERL_HASH_SEED in
-	random)
-	    unset PERL_HASH_SEED
-	    unset PERL_PERTURB_KEYS
-	    ;;
-	*)
-	    export PERL_HASH_SEED
-	    PERL_PERTURB_KEYS=0
-	    export PERL_PERTURB_KEYS
-	    ;;
-    esac
-
     if [ ${PERLLIBDIR} = ${LIBEXECDIR}/shorewall ]; then
 	eval $PERL $debugflags $pc $options $@ $g_pager
     else
@@ -534,6 +510,28 @@ start_command() {
     local rc
     rc=0
 
+    do_it() {
+	if [ -n "$AUTOMAKE" ]; then
+	    [ -n "$nolock" ] || mutex_on
+	    run_it ${VARDIR}/firewall $g_debugging start
+	    rc=$?
+	    [ -n "$nolock" ] || mutex_off
+	else
+	    g_file="${VARDIR}/.start"
+	    if compiler $g_debugging $nolock compile "$g_file"; then
+		[ -n "$nolock" ] || mutex_on
+		run_it ${VARDIR}/.start $g_debugging start
+		rc=$?
+		[ -n "$nolock" ] || mutex_off
+	    else
+		rc=$?
+		mylogger kern.err "ERROR:$g_product start failed"
+	    fi
+	fi
+
+	exit $rc
+    }
+
     if product_is_started; then
 	error_message "Shorewall is already running"
 	exit 0
@@ -625,25 +623,7 @@ start_command() {
 	fi
     fi
 
-    if [ -n "$AUTOMAKE" ]; then
-	[ -n "$nolock" ] || mutex_on
-	run_it ${VARDIR}/firewall $g_debugging start
-	rc=$?
-	[ -n "$nolock" ] || mutex_off
-    else
-	g_file="${VARDIR}/.start"
-	if compiler $g_debugging $nolock compile "$g_file"; then
-	    [ -n "$nolock" ] || mutex_on
-	    run_it ${VARDIR}/.start $g_debugging start
-	    rc=$?
-	    [ -n "$nolock" ] || mutex_off
-	else
-	    rc=$?
-	    mylogger kern.err "ERROR:$g_product start failed"
-	fi
-    fi
-
-    exit $rc
+    do_it
 }
 
 #

Shorewall/manpages/shorewall-actions.xml

@@ -148,9 +148,9 @@
               <listitem>
                 <para>Added in Shorewall 5.0.7. Specifies that this action is
                 to be used in <ulink
-                url="/manpages/shorewall-mangle.html">shorewall-mangle(5)</ulink> rather
+                url="shorewall-mangle.html">shorewall-mangle(5)</ulink> rather
                 than <ulink
-                url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink>.</para>
+                url="shorewall-rules.html">shorewall-rules(5)</ulink>.</para>
               </listitem>
             </varlistentry>
 
@@ -160,9 +160,9 @@
               <listitem>
                 <para>Added in Shorewall 5.0.13. Specifies that this action is
                 to be used in <ulink
-                url="/manpages/shorewall-snat.html">shorewall-snat(5)</ulink> rather
+                url="shorewall-snat.html">shorewall-snat(5)</ulink> rather
                 than <ulink
-                url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink>. The
+                url="shorewall-rules.html">shorewall-rules(5)</ulink>. The
                 <option>mangle</option> and <option>nat</option> options are
                 mutually exclusive.</para>
               </listitem>

Shorewall/manpages/shorewall-blrules.xml

@@ -170,7 +170,7 @@
               <listitem>
                 <para>queues matching packets to a back end logging daemon via
                 a netlink socket then continues to the next rule. See <ulink
-                url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
+                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
               </listitem>
             </varlistentry>
 

Shorewall/manpages/shorewall-interfaces.xml

@@ -257,7 +257,7 @@ loc     eth2            -</programlisting>
                 <warning>
                   <para>Do not specify <emphasis
                   role="bold">arp_ignore</emphasis> for any interface involved
-                  in <ulink url="/ProxyARP.htm">Proxy ARP</ulink>.</para>
+                  in <ulink url="../ProxyARP.htm">Proxy ARP</ulink>.</para>
                 </warning>
               </listitem>
             </varlistentry>
@@ -323,7 +323,7 @@ loc     eth2            -</programlisting>
                 and/or destination address is to be compared against the
                 ipset-based dynamic blacklist (DYNAMIC_BLACKLIST=ipset... in
                 <ulink
-                url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>).
+                url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink>).
                 The default is determine by the setting of
                 DYNAMIC_BLACKLIST:</para>
 
@@ -411,13 +411,13 @@ loc     eth2            -</programlisting>
 
                   <listitem>
                     <para>the interface is a <ulink
-                    url="/SimpleBridge.html">simple bridge</ulink> with a
+                    url="../SimpleBridge.html">simple bridge</ulink> with a
                     DHCP server on one port and DHCP clients on another
                     port.</para>
 
                     <note>
                       <para>If you use <ulink
-                      url="/bridge-Shorewall-perl.html">Shorewall-perl for
+                      url="../bridge-Shorewall-perl.html">Shorewall-perl for
                       firewall/bridging</ulink>, then you need to include
                       DHCP-specific rules in <ulink
                       url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(5).

Shorewall/manpages/shorewall-ipsets.xml

@@ -103,7 +103,7 @@
 
     <important>
       <para>These additional match options are not available in <ulink
-      url="/manpages/shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink>.</para>
+      url="shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink>.</para>
     </important>
 
     <para>Available options are:</para>

Shorewall/manpages/shorewall-mangle.xml

@@ -119,7 +119,7 @@
           Additionally, a <replaceable>chain-designator</replaceable> may not
           be specified in an action body unless the action is declared as
           <option>inline</option> in <ulink
-          url="/manpages6/shorewall6-actions.html">shorewall-actions</ulink>(5).</para>
+          url="shorewall6-actions.html">shorewall-actions</ulink>(5).</para>
 
           <para>Where a command takes parameters, those parameters are
           enclosed in parentheses ("(....)") and separated by commas.</para>
@@ -299,7 +299,7 @@
                 configuration described at <ulink
                 url="http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x">http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x</ulink>,
                 place this entry in <ulink
-                url="/manpages/shorewall-providers.html">shorewall-providers(5)</ulink>:</para>
+                url="manpages/shorewall-providers.html">shorewall-providers(5)</ulink>:</para>
 
                 <programlisting>#NAME    NUMBER   MARK    DUPLICATE  INTERFACE GATEWAY         OPTIONS               COPY
 TProxy   1        -       -          lo        -               tproxy</programlisting>
@@ -365,7 +365,7 @@ DIVERTHA        -               -               tcp</programlisting>
 
               <listitem>
                 <para>Added in Shorewall 5.0.6 as an alternative to entries in
-                <ulink url="/manpages/shorewall-ecn.html">shorewall-ecn(5)</ulink>. If a
+                <ulink url="shorewall-ecn.html">shorewall-ecn(5)</ulink>. If a
                 PROTO is specified, it must be 'tcp' (6). If no PROTO is
                 supplied, TCP is assumed. This action causes all ECN bits in
                 the TCP header to be cleared.</para>
@@ -788,7 +788,7 @@ Normal-Service       =&gt; 0x00</programlisting>
               <listitem>
                 <para>where <replaceable>interface</replaceable> is the
                 logical name of an interface defined in <ulink
-                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
+                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
                 Matches packets entering the firewall from the named
                 interface. May not be used in CLASSIFY rules or in rules using
                 the :T chain qualifier.</para>
@@ -864,7 +864,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 on the firewall and whose source IP address matches one of the
                 listed addresses and does not match any address listed in the
                 <replaceable>exclusion</replaceable>. May not be used with a
-                chain qualifier (:P, :F, etc.) in the ACTION column.</para>
+                chain qualifier (:P, :F, etc.) in the ACTION column. </para>
               </listitem>
             </varlistentry>
 
@@ -911,11 +911,11 @@ Normal-Service       =&gt; 0x00</programlisting>
               <listitem>
                 <para>where <replaceable>interface</replaceable> is the
                 logical name of an interface defined in <ulink
-                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
+                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
                 Matches packets leaving the firewall through the named
                 interface. May not be used in the PREROUTING chain (:P in the
                 mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No
-                in <ulink url="/manpages/shorewall.conf">shorewall.conf</ulink>
+                in <ulink url="manpages/shorewall.conf">shorewall.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -952,7 +952,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 when both the outgoing interface and destination IP address
                 match. May not be used in the PREROUTING chain (:P in the mark
                 column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in
-                <ulink url="/manpages/shorewall.conf">shorewall.conf</ulink>
+                <ulink url="manpages/shorewall.conf">shorewall.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -967,7 +967,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 <replaceable>exclusion</replaceable>. May not be used in the
                 PREROUTING chain (:P in the mark column or no chain qualifier
                 and MARK_IN_FORWARD_CHAIN=No in <ulink
-                url="/manpages/shorewall.conf">shorewall.conf</ulink>
+                url="manpages/shorewall.conf">shorewall.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -1028,16 +1028,15 @@ Normal-Service       =&gt; 0x00</programlisting>
       <varlistentry>
         <term><emphasis role="bold">PROTO</emphasis> - {<emphasis
         role="bold">-</emphasis>|<emphasis
-        role="bold">{tcp:[!]syn</emphasis>|<emphasis
+        role="bold">{tcp:syn</emphasis>|<emphasis
         role="bold">ipp2p</emphasis>|<emphasis
         role="bold">ipp2p:udp</emphasis>|<emphasis
         role="bold">ipp2p:all</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis
         role="bold">all}[,...]}</emphasis></term>
 
         <listitem>
-          <para>See <ulink
-          url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink> for
-          details.</para>
+          <para>Protocol - <emphasis role="bold">ipp2p</emphasis> requires
+          ipp2p match support in your kernel and iptables.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall/manpages/shorewall-nat.xml

@@ -199,7 +199,7 @@ all		all		REJECT		info
 
       <listitem>
         <para>Set IMPLICIT_CONTINUE=Yes in <ulink
-        url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>.</para>
+        url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink>.</para>
       </listitem>
     </orderedlist>
   </refsect1>

Shorewall/manpages/shorewall-rules.xml

@@ -66,7 +66,7 @@
           this section.</para>
 
           <para>The only ACTIONs allowed in this section are ACCEPT, DROP,
-          REJECT, LOG, NFQUEUE and QUEUE</para>
+          REJECT, LOG and QUEUE</para>
 
           <para>There is an implicit ACCEPT rule inserted at the end of this
           section.</para>
@@ -81,7 +81,7 @@
           section.</para>
 
           <para>The only ACTIONs allowed in this section are ACCEPT, DROP,
-          REJECT, LOG, NFQUEUE and QUEUE</para>
+          REJECT, LOG and QUEUE</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the RELATED_DISPOSITION (<ulink
@@ -97,7 +97,7 @@
           processed by rules in this section.</para>
 
           <para>The only Actions allowed in this section are ACCEPT, DROP,
-          REJECT, LOG, NFQUEUE and QUEUE.</para>
+          REJECT, LOG and QUEUE.</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the INVALID_DISPOSITION (<ulink
@@ -113,7 +113,7 @@
           processed by rules in this section.</para>
 
           <para>The only Actions allowed in this section are ACCEPT, DROP,
-          REJECT, LOG, NFQUEUE and QUEUE.</para>
+          REJECT, LOG and QUEUE.</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the UNTRACKED_DISPOSITION (<ulink
@@ -136,8 +136,11 @@
     <note>
       <para>If you are not familiar with Netfilter to the point where you are
       comfortable with the differences between the various connection tracking
-      states, then it is suggested that you place all of your rules in the NEW
-      section (That's after the line that reads ?SECTION NEW').</para>
+      states, then it is suggested that you omit the <emphasis
+      role="bold">ESTABLISHED</emphasis> and <emphasis
+      role="bold">RELATED</emphasis> sections and place all of your
+      non-blacklisting rules in the NEW section (That's after the line that
+      reads ?SECTION NEW').</para>
     </note>
 
     <warning>
@@ -146,8 +149,8 @@
       <emphasis role="bold">ALL, ESTABLISHED</emphasis> and <emphasis
       role="bold">RELATED</emphasis> sections must be empty.</para>
 
-      <para>An exception is made if you are running Shorewall 4.4.27 or later
-      and you have specified a non-default value for RELATED_DISPOSITION or
+      <para>An except is made if you are running Shorewall 4.4.27 or later and
+      you have specified a non-default value for RELATED_DISPOSITION or
       RELATED_LOG_LEVEL. In that case, you may have rules in the RELATED
       section of this file.</para>
     </warning>
@@ -592,7 +595,7 @@
                 <para>Added in Shorewall 4.5.9.3. Queues matching packets to a
                 back end logging daemon via a netlink socket then continues to
                 the next rule. See <ulink
-                url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
+                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
 
                 <para>The <replaceable>nflog-parameters</replaceable> are a
                 comma-separated list of up to 3 numbers:</para>
@@ -727,9 +730,7 @@
                   <member><option>icmp-admin-prohibited</option></member>
 
                   <member><option>icmp-tcp-reset</option> (the PROTO column
-                  must specify TCP). Beginning with Shorewall 5.1.3, this
-                  option may also be specified as
-                  <option>tcp-reset</option>.</member>
+                  must specify TCP)</member>
                 </simplelist>
               </listitem>
             </varlistentry>
@@ -845,7 +846,7 @@
                 <para>Added in Shorewall 4.5.10. Queues matching packets to a
                 back end logging daemon via a netlink socket then continues to
                 the next rule. See <ulink
-                url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
+                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
 
                 <para>Similar to<emphasis role="bold">
                 LOG:ULOG</emphasis>[(<replaceable>ulog-parameters</replaceable>)],
@@ -922,7 +923,7 @@
 
               <listitem>
                 <para>The name of a zone defined in <ulink
-                url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5). When
+                url="shorewall-zones.html">shorewall-zones</ulink>(5). When
                 only the zone name is specified, the packet source may be any
                 host in that zone.</para>
 
@@ -989,9 +990,9 @@
                 <replaceable>interface</replaceable> must be the name of an
                 interface associated with the named
                 <replaceable>zone</replaceable> in either <ulink
-                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
+                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
                 or <ulink
-                url="/manpages/shorewall.hosts.html">shorewall-hosts</ulink>(5). Only
+                url="shorewall.hosts.html">shorewall-hosts</ulink>(5). Only
                 packets from hosts in the <replaceable>zone</replaceable> that
                 arrive through the named interface will match the rule.</para>
               </listitem>
@@ -1007,7 +1008,7 @@
                   <listitem>
                     <para>A host or network IP address. A network address may
                     be followed by exclusion (see <ulink
-                    url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                    url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
                   </listitem>
 
                   <listitem>
@@ -1067,7 +1068,7 @@
               <listitem>
                 <para>This form matches if the host IP address does not match
                 any of the entries in the exclusion (see <ulink
-                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -1229,7 +1230,7 @@
 
               <listitem>
                 <para>The name of a zone defined in <ulink
-                url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5). When
+                url="shorewall-zones.html">shorewall-zones</ulink>(5). When
                 only the zone name is specified, the packet destination may be
                 any host in that zone.</para>
 
@@ -1296,9 +1297,9 @@
                 <replaceable>interface</replaceable> must be the name of an
                 interface associated with the named
                 <replaceable>zone</replaceable> in either <ulink
-                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
+                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
                 or <ulink
-                url="/manpages/shorewall-hosts.html">shorewall-hosts</ulink>(5). Only
+                url="shorewall.hosts.html">shorewall-hosts</ulink>(5). Only
                 packets to hosts in the <replaceable>zone</replaceable> that
                 are sent through the named interface will match the
                 rule.</para>
@@ -1315,7 +1316,7 @@
                   <listitem>
                     <para>A host or network IP address. A network address may
                     be followed by exclusion (see <ulink
-                    url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                    url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
                   </listitem>
 
                   <listitem>
@@ -1370,7 +1371,7 @@
               <listitem>
                 <para>This form matches if the host IP address does not match
                 any of the entries in the exclusion (see <ulink
-                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -1592,7 +1593,7 @@
       <varlistentry>
         <term><emphasis role="bold">PROTO</emphasis>- {<emphasis
         role="bold">-</emphasis>|<emphasis
-        role="bold">tcp:[!]syn</emphasis>|<emphasis
+        role="bold">tcp:syn</emphasis>|<emphasis
         role="bold">ipp2p</emphasis>|<emphasis
         role="bold">ipp2p:udp</emphasis>|<emphasis
         role="bold">ipp2p:all</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis
@@ -1603,10 +1604,7 @@
           requires ipp2p match support in your kernel and iptables. <emphasis
           role="bold">tcp:syn</emphasis> implies <emphasis
           role="bold">tcp</emphasis> plus the SYN flag must be set and the
-          RST, ACK and FIN flags must be reset. Beginning with Shorewall
-          5.1.3, you may also specify <emphasis
-          role="bold">tcp:!syn</emphasis>, which matches if SYN is not set or
-          if RST, ACK or FIN is set.</para>
+          RST,ACK and FIN flags must be reset.</para>
 
           <para>Beginning with Shorewall 4.4.19, this column can contain a
           comma-separated list of protocol-numbers and/or protocol

Shorewall/manpages/shorewall-secmarks.xml

@@ -229,9 +229,8 @@
         role="bold">all}[,...]</emphasis></term>
 
         <listitem>
-          <para> See <ulink
-          url="shorewall-rules.html">shorewall-rules(5)</ulink> for
-          details.</para>
+          <para>Protocol - <emphasis role="bold">ipp2p</emphasis> requires
+          ipp2p match support in your kernel and iptables.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall/manpages/shorewall-snat.xml

@@ -27,7 +27,7 @@
 
     <para>This file is used to define dynamic NAT (Masquerading) and to define
     Source NAT (SNAT). It superseded <ulink
-    url="/manpages/shorewall-masq.html">shorewall-masq</ulink>(5) in Shorewall
+    url="shorewall-masq.html">shorewall-masq</ulink>(5) in Shorewall
     5.0.14.</para>
 
     <warning>
@@ -150,7 +150,7 @@
               <listitem>
                 <para>where <replaceable>action</replaceable> is an action
                 declared in <ulink
-                url="/manpages/shorewall-actions.html">shorewall-actions(5)</ulink> with
+                url="shorewall-actions.html">shorewall-actions(5)</ulink> with
                 the <option>nat</option> option. See <ulink
                 url="/Actions.html">www.shorewall.net/Actions.html</ulink> for
                 further information.</para>
@@ -256,9 +256,8 @@
 
         <listitem>
           <para>If you wish to restrict this entry to a particular protocol
-          then enter the protocol name (from protocols(5)) or number here. See
-          <ulink url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink> for
-          details.</para>
+          then enter the protocol name (from protocols(5)) or number
+          here.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall/manpages/shorewall-tcfilters.xml

@@ -89,11 +89,11 @@
           Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
           may be used if your kernel and ip6tables have the <firstterm>Basic
           Ematch</firstterm> capability and you set BASIC_FILTERS=Yes in
-          <ulink url="/manpages/shorewall.conf.html">shorewall.conf (5)</ulink>. The
+          <ulink url="shorewall.conf.html">shorewall.conf (5)</ulink>. The
           ipset name may optionally be followed by a number or a comma
           separated list of src and/or dst enclosed in square brackets
           ([...]). See <ulink
-          url="/manpages/shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
+          url="shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
           details.</para>
         </listitem>
       </varlistentry>
@@ -108,11 +108,11 @@
           Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
           may be used if your kernel and ip6tables have the <firstterm>Basic
           Ematch</firstterm> capability and you set BASIC_FILTERS=Yes in
-          <ulink url="/manpages/shorewall.conf.html">shorewall.conf (5)</ulink>. The
+          <ulink url="shorewall.conf.html">shorewall.conf (5)</ulink>. The
           ipset name may optionally be followed by a number or a comma
           separated list of src and/or dst enclosed in square brackets
           ([...]). See <ulink
-          url="/manpages/shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
+          url="shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
           details.</para>
 
           <para>You may exclude certain hosts from the set already defined

Shorewall/manpages/shorewall-zones.xml

@@ -55,14 +55,14 @@
             <para>The maximum length of an iptables log prefix is 29 bytes. As
             explained in <ulink
             url="/manpages/shorewall.conf.html">shorewall.conf</ulink> (5),
-            the legacy default LOGPREFIX formatting string is
-            “Shorewall:%s:%s:” where the first %s is replaced by the chain
-            name and the second is replaced by the disposition.</para>
+            the default LOGPREFIX formatting string is “Shorewall:%s:%s:”
+            where the first %s is replaced by the chain name and the second is
+            replaced by the disposition.</para>
 
             <itemizedlist>
               <listitem>
-                <para>The "Shorewall:%s:%s:" formatting string has 12 fixed
-                characters ("Shorewall" and three colons).</para>
+                <para>The default formatting string has 12 fixed characters
+                ("Shorewall" and three colons).</para>
               </listitem>
 
               <listitem>
@@ -90,29 +90,6 @@
                 </simplelist>
               </listitem>
             </itemizedlist>
-
-            <para>In Shorewall 5.1.0, the LOGFORMAT in the default and sample
-            shorewall.conf files was changed to "%s:%s ".</para>
-
-            <itemizedlist>
-              <listitem>
-                <para>That formatting string has 2 fixed characters (":" and a
-                space).</para>
-              </listitem>
-
-              <listitem>
-                <para>So the maximum zone name length M is calculated
-                as:</para>
-
-                <simplelist>
-                  <member>2 + 6 + 2*M + 1 = 29</member>
-
-                  <member>2M = 29 - 2 + 6 + 1 = 20</member>
-
-                  <member>M = 10</member>
-                </simplelist>
-              </listitem>
-            </itemizedlist>
           </blockquote>
 
           <para>The order in which Shorewall matches addresses from packets to

Shorewall/manpages/shorewall.conf.xml

@@ -321,9 +321,9 @@
         <listitem>
           <para>The value of this variable affects Shorewall's stopped state.
           The behavior differs depending on whether <ulink
-          url="/manpages/shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
+          url="shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
           or <ulink
-          url="/manpages/shorewall-stoppedrules.html">shorewall-stoppedrules</ulink>(5)
+          url="shorewall-stoppedrules.html">shorewall-stoppedrules</ulink>(5)
           is used:</para>
 
           <variablelist>
@@ -483,7 +483,7 @@
           <para>Added in Shorewall 5.1.1. When USE_DEFAULT_RT=Yes, this option
           determines whether the <option>balance</option> provider option (see
           <ulink
-          url="/manpages/shorewall-providers.html">shorewall-providers(5)</ulink>) is
+          url="shorewall-providers.html">shorewall-providers(5)</ulink>) is
           the default. When BALANCE_PROVIDERS=Yes, then the
           <option>balance</option> option is assumed unless the
           <option>fallback</option>, <option>loose</option>,
@@ -500,7 +500,7 @@
         <listitem>
           <para>Added in Shorewall-4.6.0. When set to <emphasis
           role="bold">Yes</emphasis>, causes entries in <ulink
-          url="/manpages/shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink> to
+          url="shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink> to
           generate a basic filter rather than a u32 filter. This setting
           requires the <firstterm>Basic Ematch</firstterm> capability in your
           kernel and iptables.</para>
@@ -1114,8 +1114,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           specificaitons</ulink> on the right.. When INLINE_MATCHES=Yes is
           specified, the specifications on the right are interpreted as if
           INLINE had been specified in the ACTION column. This also applies to
-          <ulink url="/manpages/shorewall-masq.html">shorewall-masq(5)</ulink> and
-          <ulink url="/manpages/shorewall-mangle.html">shorewall-mangle(5</ulink>) which
+          <ulink url="shorewall-masq.html">shorewall-masq(5)</ulink> and
+          <ulink url="shorewall-mangle.html">shorewall-mangle(5</ulink>) which
           also support INLINE. If not specified or if specified as the empty
           value, the value 'No' is assumed for backward compatibility.</para>
 
@@ -1365,7 +1365,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           sample configurations use this as the default log level and changing
           it will change all packet logging done by the configuration. In any
           configuration file (except <ulink
-          url="/manpages/shorewall-params.html">shorewall-params(5)</ulink>), $LOG_LEVEL
+          url="shorewall-params.html">shorewall-params(5)</ulink>), $LOG_LEVEL
           will expand to this value.</para>
         </listitem>
       </varlistentry>
@@ -1443,20 +1443,15 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
             </listitem>
           </itemizedlist>
 
+          <para/>
+
           <blockquote>
             <para>For example, using the default LOGFORMAT, the log prefix for
-            logging from the nat table's PREROUTING chain is as follows in
-            versions prior to 5.1.0:</para>
+            logging from the nat table's PREROUTING chain is:</para>
 
             <programlisting>    Shorewall:nat:PREROUTING
  </programlisting>
 
-            <para>In Shorewall 5.1.0 and later releases, the log prefix
-            is:</para>
-
-            <programlisting>    nat:PREROUTING
- </programlisting>
-
             <important>
               <para>To help insure that all packets in the NEW state are
               logged, rate limiting (LOGLIMIT) should be disabled when using
@@ -1487,7 +1482,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           log</emphasis>, and <emphasis role="bold">hits</emphasis> commands.
           If not assigned or if assigned an empty value, /var/log/messages is
           assumed. For further information, see <ulink
-          url="/manpages/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.
+          url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.
           Beginning with Shorewall 5.0.10.1, you may specify
           <option>systemd</option> to use <command>journelctl -r</command> to
           read the log.</para>
@@ -1520,24 +1515,6 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
             url="/manpages/shorewall-zones.html">shorewall-zones</ulink>
             (5).</para>
           </note>
-
-          <caution>
-            <para>Beginning with Shorewall 5.1.0, the default and sample
-            shorewall.conf files set LOGFORMAT="%s %s ". Shorewall log
-            messages that use this LOGFORMAT can be uniquely identified using
-            the following regular expression:</para>
-
-            <simplelist>
-              <member>'IN=.* OUT=.* SRC=.*\..* DST='</member>
-            </simplelist>
-
-            <para>To match all Netfilter log messages (Both IPv4 and IPv6),
-            use:</para>
-
-            <simplelist>
-              <member>'IN=.* OUT=.* SRC=.* DST='</member>
-            </simplelist>
-          </caution>
         </listitem>
       </varlistentry>
 
@@ -1574,8 +1551,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
 
         <listitem>
-          <para>Using LOGFORMAT=“Shorewall:%s:%s:”, chain names may not exceed
-          5 characters or truncation of the log prefix may occur. Longer chain
+          <para>Using the default LOGFORMAT, chain names may not exceed 11
+          characters or truncation of the log prefix may occur. Longer chain
           names may be used with log tags if you set LOGTAGONLY=Yes. With
           LOGTAGONLY=Yes, if a log tag is specified then the tag is included
           in the log prefix in place of the chain name.</para>
@@ -1587,10 +1564,10 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           separated by a comma. So this rule:</para>
 
           <programlisting>#ACTION                                SOURCE         DEST
-LOG:info:foo,bar                       net            fw</programlisting>
+LOG:info:foo,bar                 net                   fw</programlisting>
 
-          <para>would generate the following log prefix when using
-          LOGFORMAT=“Shorewall:%s:%s:”:</para>
+          <para>would generate the following log prefix when using the default
+          LOGFORMAT setting:</para>
 
           <simplelist>
             <member>Shorewall:foo:bar:</member>
@@ -1935,9 +1912,10 @@ LOG:info:,bar                        net                    fw</programlisting>
           <itemizedlist>
             <listitem>
               <para>Optimization category 1 - Traditionally, Shorewall has
-              created rules for the complete matrix of
+              created rules for <ulink
+              url="/ScalabilityAndPerformance.html">the complete matrix of
               host groups defined by the zones, interfaces and hosts
-              files. Any traffic that didn't correspond to an element
+              files</ulink>. Any traffic that didn't correspond to an element
               of that matrix was rejected in one of the built-in chains. When
               the matrix is sparse, this results in lots of largely useless
               rules.</para>
@@ -2175,21 +2153,6 @@ LOG:info:,bar                        net                    fw</programlisting>
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term><emphasis role="bold">PERL_HASH_SEED=</emphasis><emphasis
-        role="bold"><replaceable>seed</replaceable><emphasis
-        role="bold">|random</emphasis></emphasis></term>
-
-        <listitem>
-          <para>Added in Shorewall 5.1.4. Sets the Perl hash
-          <replaceable>seed</replaceable> (an integer in the range 0-99999)
-          when running the Shorewall rules compiler. If not specified, the
-          value 0 is assumed. If <option>random</option> is specified, a
-          random seed will be chosed by Perl. See perlsec(1) for additional
-          information.</para>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><emphasis
         role="bold">PROVIDER_BITS</emphasis>=[<replaceable>number</replaceable>]</term>
@@ -2572,7 +2535,7 @@ INLINE          -       -       -       ;; -j REJECT
           the <option>routeback</option> option.<footnote>
               <para>Hairpin packets are packets that are routed out of the
               same interface that they arrived on.</para>
-            </footnote></para>
+            </footnote> interfaces without the routeback option.</para>
         </listitem>
       </varlistentry>
 
@@ -2588,9 +2551,9 @@ INLINE          -       -       -       ;; -j REJECT
           the <option>routeback</option> option.<footnote>
               <para>Hairpin packets are packets that are routed out of the
               same interface that they arrived on.</para>
-            </footnote> The default is <option>info</option>. If you don't
-          wish for these packets to be logged, use
-          SFILTER_LOG_LEVEL=none.</para>
+            </footnote> interfaces without the routeback option. The default
+          is <option>info</option>. If you don't wish for these packets to be
+          logged, use SFILTER_LOG_LEVEL=none.</para>
         </listitem>
       </varlistentry>
 
@@ -2943,7 +2906,7 @@ INLINE          -       -       -       ;; -j REJECT
             <listitem>
               <para>Packets are sent through the main routing table by a rule
               with priority 999. In <ulink
-              url="/manpages/shorewall-rtrules.html">shorewall-rtrules</ulink>(5),
+              url="/manpages/shorewall-routing_rules.html">routing_rules</ulink>(5),
               the range 1-998 may be used for inserting rules that bypass the
               main table.</para>
             </listitem>

Shorewall/uninstall.sh

@@ -26,7 +26,9 @@
 #       You may only use this script to uninstall the version
 #       shown below. Simply run this script to remove Shorewall Firewall
 
-VERSION=xxx # The Build script inserts the actual version
+VERSION=xxx #The Build script inserts the actual version
+PRODUCT=shorewall
+Product=Shorewall
 
 usage() # $1 = exit status
 {
@@ -39,27 +41,51 @@ usage() # $1 = exit status
     exit $1
 }
 
+fatal_error()
+{
+    echo "   ERROR: $@" >&2
+    exit 1
+}
+
+qt()
+{
+    "$@" >/dev/null 2>&1
+}
+
+split() {
+    local ifs
+    ifs=$IFS
+    IFS=:
+    set -- $1
+    echo $*
+    IFS=$ifs
+}
+
+mywhich() {
+    local dir
+
+    for dir in $(split $PATH); do
+	if [ -x $dir/$1 ]; then
+	    return 0
+	fi
+    done
+
+    return 2
+}
+
+remove_file() # $1 = file to restore
+{
+    if [ -f $1 -o -L $1 ] ; then
+	rm -f $1
+	echo "$1 Removed"
+    fi
+}
+
 #
 # Change to the directory containing this script
 #
 cd "$(dirname $0)"
 
-if [ -f shorewall.service ]; then
-    PRODUCT=shorewall
-    Product=Shorewall
-else
-    PRODUCT=shorewall6
-    Product=Shorewall6
-fi
-
-#
-# Source common functions
-#
-. ./lib.uninstaller || { echo "ERROR: Can not load common functions." >&2; exit 1; }
-
-#
-# Parse the run line
-#
 finished=0
 configure=1
 
@@ -76,7 +102,7 @@ while [ $finished -eq 0 ]; do
 			usage 0
 			;;
 		    v)
-			echo "$Product Firewall Uninstaller Version $VERSION"
+			echo "$Product Firewall Installer Version $VERSION"
 			exit 0
 			;;
 		    n*)
@@ -97,16 +123,13 @@ while [ $finished -eq 0 ]; do
     esac
 done
 
-#
-# Read the RC file
-#
 if [ $# -eq 0 ]; then
     if [ -f ./shorewallrc ]; then
-        . ./shorewallrc || fatal_error "Can not load the RC file: ./shorewallrc"
+	. ./shorewallrc
     elif [ -f ~/.shorewallrc ]; then
-        . ~/.shorewallrc || fatal_error "Can not load the RC file: ~/.shorewallrc"
+	. ~/.shorewallrc || exit 1
     elif [ -f /usr/share/shorewall/shorewallrc ]; then
-        . /usr/share/shorewall/shorewallrc || fatal_error "Can not load the RC file: /usr/share/shorewall/shorewallrc"
+	. /usr/share/shorewall/shorewallrc
     else
 	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
     fi
@@ -116,53 +139,52 @@ elif [ $# -eq 1 ]; then
 	/*|.*)
 	    ;;
 	*)
-	    file=./$file || exit 1
+	    file=./$file
 	    ;;
     esac
 
-    . $file || fatal_error "Can not load the RC file: $file"
+    . $file
 else
     usage 1
 fi
 
-if [ -f ${SHAREDIR}/$PRODUCT/version ]; then
-    INSTALLED_VERSION="$(cat ${SHAREDIR}/$PRODUCT/version)"
+if [ -f ${SHAREDIR}/shorewall/version ]; then
+    INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall/version)"
     if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
-	echo "WARNING: $Product Version $INSTALLED_VERSION is installed"
+	echo "WARNING: Shorewall Version $INSTALLED_VERSION is installed"
 	echo "         and this is the $VERSION uninstaller."
 	VERSION="$INSTALLED_VERSION"
     fi
 else
-    echo "WARNING: $Product Version $VERSION is not installed"
+    echo "WARNING: Shorewall Version $VERSION is not installed"
     VERSION=""
 fi
 
-echo "Uninstalling $Product $VERSION"
+
+echo "Uninstalling shorewall $VERSION"
 
 [ -n "$SANDBOX" ] && configure=0
 
 if [ $configure -eq 1 ]; then
     if qt iptables -L shorewall -n && [ ! -f ${SBINDIR}/shorewall-lite ]; then
-	${SBINDIR}/$PRODUCT clear
-    elif qt ip6tables -L shorewall6 -n && [ ! -f ${SBINDIR}/shorewall6-lite ]; then
-	${SBINDIR}/$PRODUCT clear
+	shorewall clear
     fi
 fi
 
-remove_file ${SBINDIR}/$PRODUCT
+rm -f ${SBINDIR}/shorewall
 
-if [ -L ${SHAREDIR}/$PRODUCT/init ]; then
-    FIREWALL=$(readlink -m -q ${SHAREDIR}/$PRODUCT/init)
+if [ -L ${SHAREDIR}/shorewall/init ]; then
+    FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall/init)
 elif [ -n "$INITFILE" ]; then
     FIREWALL=${INITDIR}/${INITFILE}
 fi
 
 if [ -f "$FIREWALL" ]; then
     if [ $configure -eq 1 ]; then
-	if mywhich insserv ; then
+	if mywhich updaterc.d ; then
+	    updaterc.d ${PRODUCT} remove
+	elif mywhich insserv ; then
             insserv -r $FIREWALL
-	elif mywhich update-rc.d ; then
-	    update-rc.d ${PRODUCT} remove
 	elif mywhich chkconfig ; then
 	    chkconfig --del $(basename $FIREWALL)
 	fi
@@ -171,56 +193,51 @@ if [ -f "$FIREWALL" ]; then
     remove_file $FIREWALL
 fi
 
-[ -z "${SERVICEDIR}" ] && SERVICEDIR="$SYSTEMD"
-
+if [ -z "${SERVICEDIR}" ]; then
+    SERVICEDIR="$SYSTEMD"
+fi
 if [ -n "$SERVICEDIR" ]; then
-    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}.service
-    remove_file $SERVICEDIR/${PRODUCT}.service
+    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}
+    rm -f $SERVICEDIR/shorewall.service
 fi
 
-remove_file ${SHAREDIR}/$PRODUCT/version
-remove_directory ${CONFDIR}/$PRODUCT
+rm -rf ${SHAREDIR}/shorewall/version
+rm -rf ${CONFDIR}/shorewall
 
 if [ -n "$SYSCONFDIR" ]; then
-    [ -n "$SYSCONFFILE" ] && remove_file ${SYSCONFDIR}/${PRODUCT}
+    [ -n "$SYSCONFFILE" ] && rm -f ${SYSCONFDIR}/${PRODUCT}
 fi
 
-remove_directory ${VARDIR}
-[ ${LIBEXECDIR} = ${SHAREDIR} ] || remove_directory ${LIBEXECDIR}/$PRODUCT
-remove_directory ${SHAREDIR}/$PRODUCT/configfiles
-remove_file_with_wildcard  ${SHAREDIR}/$PRODUCT/module\*
-remove_file  ${SHAREDIR}/$PRODUCT/helpers
-remove_file_with_wildcard  ${SHAREDIR}/$PRODUCT/action\*
-remove_file_with_wildcard  ${SHAREDIR}/$PRODUCT/macro.\*
+rm -rf ${VARDIR}/shorewall
+rm -rf ${PERLLIBDIR}/Shorewall/*
+[ ${LIBEXECDIR} = ${SHAREDIR} ] || rm -rf ${LIBEXECDIR}/shorewall
+rm -rf ${SHAREDIR}/shorewall/configfiles/
+rm -rf ${SHAREDIR}/shorewall/Samples/
+rm -rf ${SHAREDIR}/shorewall/Shorewall/
+rm -f  ${SHAREDIR}/shorewall/lib.cli-std
+rm -f  ${SHAREDIR}/shorewall/lib.runtime
+rm -f  ${SHAREDIR}/shorewall/compiler.pl
+rm -f  ${SHAREDIR}/shorewall/prog.*
+rm -f  ${SHAREDIR}/shorewall/module*
+rm -f  ${SHAREDIR}/shorewall/helpers
+rm -f  ${SHAREDIR}/shorewall/action*
+rm -f  ${SHAREDIR}/shorewall/macro.*
+rm -f  ${SHAREDIR}/shorewall/init
 
-if [ $PRODUCT = shorewall ]; then
-    remove_file_with_wildcard ${PERLLIBDIR}/$Product/\*
-    remove_directory ${SHAREDIR}/$PRODUCT/Samples
-    remove_directory ${SHAREDIR}/$PRODUCT/$Product
-    remove_file  ${SHAREDIR}/$PRODUCT/lib.cli-std
-    remove_file  ${SHAREDIR}/$PRODUCT/lib.runtime
-    remove_file  ${SHAREDIR}/$PRODUCT/compiler.pl
-    remove_file_with_wildcard  ${SHAREDIR}/$PRODUCT/prog.\*
-    remove_file  ${SHAREDIR}/$PRODUCT/init
-else
-    remove_directory ${SHAREDIR}/$PRODUCT
-fi
-
-for f in ${MANDIR}/man5/${PRODUCT}* ${MANDIR}/man8/${PRODUCT}*; do
+for f in ${MANDIR}/man5/shorewall* ${MANDIR}/man8/shorewall*; do
     case $f in
-	shorewall[6]-lite*)
+	shorewall6*|shorewall-lite*)
 	    ;;
 	*)
-	    remove_file $f
+	    rm -f $f
 	    ;;
     esac
 done
 
-remove_file  ${CONFDIR}/logrotate.d/$PRODUCT
+rm -f  ${CONFDIR}/logrotate.d/shorewall
+
+[ -n "$SYSTEMD" ] && rm -f  ${SYSTEMD}/shorewall.service
+
+echo "Shorewall Uninstalled"
 
-[ -n "$SYSTEMD" ] && remove_file ${SYSTEMD}/${PRODUCT}.service
 
-#
-# Report Success
-#
-echo "$Product $VERSION Uninstalled"

Shorewall6-lite/default.debian

@@ -1,5 +1,5 @@
 # prevent startup with default configuration
-# set the following variable to 1 in order to allow Shorewall6-lite to start
+# set the following varible to 1 in order to allow Shorewall6-lite to start
 
 startup=0
 
@@ -16,7 +16,7 @@ startup=0
 #    wait_interface=
 
 #
-# Global start/restart/reload/stop options
+# Startup options
 #
 OPTIONS=""
 
@@ -30,16 +30,6 @@ STARTOPTIONS=""
 #
 RESTARTOPTIONS=""
 
-#
-# Reload options
-#
-RELOADOPTIONS=""
-
-#
-# Stop options
-#
-STOPOPTIONS=""
-
 #
 # Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf
 #

Shorewall6-lite/default.debian.systemd

@@ -1,26 +0,0 @@
-#
-# Global start/restart/reload/stop options
-#
-OPTIONS=""
-
-#
-# Start options
-#
-STARTOPTIONS=""
-
-#
-# Restart options
-#
-RESTARTOPTIONS=""
-
-#
-# Reload options
-#
-RELOADOPTIONS=""
-
-#
-# Stop options
-#
-STOPOPTIONS=""
-
-# EOF

Shorewall6-lite/uninstall.sh

@@ -0,0 +1,221 @@
+#!/bin/sh
+#
+# Script to back uninstall Shoreline Firewall 6 Lite
+#
+#     (c) 2000-2016 - Tom Eastep (teastep@shorewall.net)
+#
+#       Shorewall documentation is available at http://shorewall.sourceforge.net
+#
+#       This program is part of Shorewall.
+#
+#	This program is free software; you can redistribute it and/or modify
+#	it under the terms of the GNU General Public License as published by the
+#       Free Software Foundation, either version 2 of the license or, at your
+#       option, any later version.
+#
+#	This program is distributed in the hope that it will be useful,
+#	but WITHOUT ANY WARRANTY; without even the implied warranty of
+#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+#	GNU General Public License for more details.
+#
+#	You should have received a copy of the GNU General Public License
+#	along with this program; if not, see <http://www.gnu.org/licenses/>.
+#
+#    Usage:
+#
+#       You may only use this script to uninstall the version
+#       shown below. Simply run this script to remove Shorewall Firewall
+
+VERSION=xxx  #The Build script inserts the actual version
+PRODUCT=shorewall6-lite
+Product="Shorewall6 Lite"
+
+usage() # $1 = exit status
+{
+    ME=$(basename $0)
+    echo "usage: $ME [ <shorewallrc file> ]"
+    exit $1
+}
+
+fatal_error()
+{
+    echo "   ERROR: $@" >&2
+    exit 1
+}
+
+qt()
+{
+    "$@" >/dev/null 2>&1
+}
+
+split() {
+    local ifs
+    ifs=$IFS
+    IFS=:
+    set -- $1
+    echo $*
+    IFS=$ifs
+}
+
+mywhich() {
+    local dir
+
+    for dir in $(split $PATH); do
+	if [ -x $dir/$1 ]; then
+	    return 0
+	fi
+    done
+
+    return 2
+}
+
+remove_file() # $1 = file to restore
+{
+    if [ -f $1 -o -L $1 ] ; then
+	rm -f $1
+	echo "$1 Removed"
+    fi
+}
+
+#
+# Change to the directory containing this script
+#
+cd "$(dirname $0)"
+
+finished=0
+configure=1
+
+while [ $finished -eq 0 ]; do
+    option=$1
+
+    case "$option" in
+	-*)
+	    option=${option#-}
+
+	    while [ -n "$option" ]; do
+		case $option in
+		    h)
+			usage 0
+			;;
+		    v)
+			echo "$Product Firewall Installer Version $VERSION"
+			exit 0
+			;;
+		    n*)
+			configure=0
+			option=${option#n}
+			;;
+		    *)
+			usage 1
+			;;
+		esac
+	    done
+
+	    shift
+	    ;;
+	*)
+	    finished=1
+	    ;;
+    esac
+done
+#
+# Read the RC file
+#
+if [ $# -eq 0 ]; then
+    if [ -f ./shorewallrc ]; then
+	. ./shorewallrc
+    elif [ -f ~/.shorewallrc ]; then
+	. ~/.shorewallrc || exit 1
+    elif [ -f /usr/share/shorewall/shorewallrc ]; then
+	. /usr/share/shorewall/shorewallrc
+    else
+	fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
+    fi
+elif [ $# -eq 1 ]; then
+    file=$1
+    case $file in
+	/*|.*)
+	    ;;
+	*)
+	    file=./$file
+	    ;;
+    esac
+
+    . $file
+else
+    usage 1
+fi
+
+if [ -f ${SHAREDIR}/shorewall6-lite/version ]; then
+    INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall6-lite/version)"
+    if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
+	echo "WARNING: Shorewall6 Lite Version $INSTALLED_VERSION is installed"
+	echo "         and this is the $VERSION uninstaller."
+	VERSION="$INSTALLED_VERSION"
+    fi
+else
+    echo "WARNING: Shorewall6 Lite Version $VERSION is not installed"
+    VERSION=""
+fi
+
+echo "Uninstalling Shorewall6 Lite $VERSION"
+
+[ -n "$SANDBOX" ] && configure=0
+
+if [ $configure -eq 1 ]; then
+    if qt ip6tables -L shorewall -n && [ ! -f ${SBINDIR}/shorewall6 ]; then
+	${SBINDIR}/shorewall6-lite clear
+    fi
+fi
+
+if [ -f ${SHAREDIR}/shorewall6-lite/init ]; then
+    if [ $HOST = openwrt ]; then
+	if [ $configure -eq 1 ] && /etc/init.d/shorewall6-lite enabled; then
+	    /etc/init.d/shorewall6-lite disable
+	fi
+	
+	FIREWALL=$(readlink ${SHAREDIR}/shorewall6-lite/init)
+    else
+	FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall6-lite/init)
+    fi
+elif [ -n "$INITFILE" ]; then
+    FIREWALL=${INITDIR}/${INITFILE}
+fi
+
+if [ -f "$FIREWALL" ]; then
+    if [ $configure -eq 1 ]; then
+	if mywhich updaterc.d ; then
+	    updaterc.d shorewall6-lite remove
+	elif mywhich insserv ; then
+            insserv -r $FIREWALL
+	elif mywhich chkconfig ; then
+	    chkconfig --del $(basename $FIREWALL)
+	elif mywhich systemctl ; then
+	    systemctl disable shorewall6-lite
+	fi
+    fi
+
+    remove_file $FIREWALL
+fi
+
+[ -z "$SERVICEDIR" ] && SERVICEDIR="$SYSTEMD"
+
+if [ -n "$SERVICEDIR" ]; then
+    [ $configure -eq 1 ] && systemctl disable ${PRODUCT}
+    rm -f $SERVICEDIR/shorewall6-lite.service
+fi
+
+rm -f ${SBINDIR}/shorewall6-lite
+rm -rf ${CONFDIR}/shorewall6-lite
+rm -rf ${VARDIR}
+rm -rf ${SHAREDIR}/shorewall6-lite
+rm -rf ${LIBEXECDIR}/shorewall6-lite
+rm -f  ${CONFDIR}/logrotate.d/shorewall6-lite
+rm -f  ${SYSCONFDIR}/shorewall6-lite
+
+if [ -n "${MANDIR}" ]; then
+    rm -f ${MANDIR}/man5/shorewall6-lite*
+    rm -f ${MANDIR}/man8/shorewall6-lite*
+fi
+
+echo "Shorewall6 Lite Uninstalled"

Shorewall6/Actions/action.A_AllowICMPs

@@ -0,0 +1,38 @@
+#
+# Shorewall6 -- /usr/share/shorewall6/action.A_AllowICMPs
+#
+# This action A_ACCEPTs needed ICMP types
+#
+###############################################################################
+#ACTION		SOURCE		DEST	PROTO		DPORT
+
+?comment Needed ICMP types (RFC4890)
+
+A_ACCEPT	-		-	ipv6-icmp	destination-unreachable
+A_ACCEPT	-		-	ipv6-icmp	packet-too-big
+A_ACCEPT	-		-	ipv6-icmp	time-exceeded
+A_ACCEPT	-		-	ipv6-icmp	parameter-problem
+
+# The following should have a ttl of 255 and must be allowed to transit a bridge
+A_ACCEPT	-		-	ipv6-icmp	router-solicitation
+A_ACCEPT	-		-	ipv6-icmp	router-advertisement
+A_ACCEPT	-		-	ipv6-icmp	neighbour-solicitation
+A_ACCEPT	-		-	ipv6-icmp	neighbour-advertisement
+A_ACCEPT	-		-	ipv6-icmp	137	# Redirect
+A_ACCEPT	-		-	ipv6-icmp	141	# Inverse neighbour discovery solicitation
+A_ACCEPT	-		-	ipv6-icmp	142	# Inverse neighbour discovery advertisement
+
+# The following should have a link local source address and must be allowed to transit a bridge
+A_ACCEPT	fe80::/10	-	ipv6-icmp	130	# Listener query
+A_ACCEPT	fe80::/10	-	ipv6-icmp	131	# Listener report
+A_ACCEPT	fe80::/10	-	ipv6-icmp	132	# Listener done
+A_ACCEPT	fe80::/10	-	ipv6-icmp	143	# Listener report v2
+
+# The following should be received with a ttl of 255 and must be allowed to transit a bridge
+A_ACCEPT	-		-	ipv6-icmp	148	# Certificate path solicitation
+A_ACCEPT	-		-	ipv6-icmp	149	# Certificate path advertisement
+
+# The following should have a link local source address and a ttl of 1 and must be allowed to transit abridge
+A_ACCEPT	fe80::/10	-	ipv6-icmp	151	# Multicast router advertisement
+A_ACCEPT	fe80::/10	-	ipv6-icmp	152	# Multicast router solicitation
+A_ACCEPT	fe80::/10	-	ipv6-icmp	153	# Multicast router termination

Shorewall6/Actions/action.AllowICMPs

@@ -0,0 +1,40 @@
+#
+# Shorewall6 -- /usr/share/shorewall6/action.AllowICMPs
+#
+# This action ACCEPTs needed ICMP types
+#
+###############################################################################
+#ACTION	SOURCE		DEST	PROTO		DPORT
+
+DEFAULTS ACCEPT
+
+?COMMENT Needed ICMP types (RFC4890)
+
+$1	-		-	ipv6-icmp	destination-unreachable
+$1	-		-	ipv6-icmp	packet-too-big
+$1	-		-	ipv6-icmp	time-exceeded
+$1	-		-	ipv6-icmp	parameter-problem
+
+# The following should have a ttl of 255 and must be allowed to transit a bridge
+$1	-		-	ipv6-icmp	router-solicitation
+$1	-		-	ipv6-icmp	router-advertisement
+$1	-		-	ipv6-icmp	neighbour-solicitation
+$1	-		-	ipv6-icmp	neighbour-advertisement
+$1	-		-	ipv6-icmp	137	# Redirect
+$1	-		-	ipv6-icmp	141	# Inverse neighbour discovery solicitation
+$1	-		-	ipv6-icmp	142	# Inverse neighbour discovery advertisement
+
+# The following should have a link local source address and must be allowed to transit a bridge
+$1	fe80::/10	-	ipv6-icmp	130	# Listener query
+$1	fe80::/10	-	ipv6-icmp	131	# Listener report
+$1	fe80::/10	-	ipv6-icmp	132	# Listener done
+$1	fe80::/10	-	ipv6-icmp	143	# Listener report v2
+
+# The following should be received with a ttl of 255 and must be allowed to transit a bridge
+$1	-		-	ipv6-icmp	148	# Certificate path solicitation
+$1	-		-	ipv6-icmp	149	# Certificate path advertisement
+
+# The following should have a link local source address and a ttl of 1 and must be allowed to transit abridge
+$1	fe80::/10	-	ipv6-icmp	151	# Multicast router advertisement
+$1	fe80::/10	-	ipv6-icmp	152	# Multicast router solicitation
+$1	fe80::/10	-	ipv6-icmp	153	# Multicast router termination

Shorewall6/Actions/action.Broadcast

@@ -0,0 +1,65 @@
+#
+# Shorewall6 -- /usr/share/shorewall6/action.Broadcast
+#
+# Multicast/Anycast IPv6 Action
+#
+# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
+#
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
+#
+# Complete documentation is available at http://shorewall.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of Version 2 of the GNU General Public License
+# as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Broadcast[([<action>|-[,{audit|-}])]
+#
+# Default action is DROP
+#
+###############################################################################
+
+DEFAULTS DROP,-
+
+?begin perl;
+
+use Shorewall::IPAddrs;
+use Shorewall::Config;
+use Shorewall::Chains;
+
+my $chainref           = get_action_chain;
+my ( $action, $audit ) = get_action_params( 2 );
+my ( $level, $tag )    = get_action_logging;
+my $target             = require_audit ( $action , $audit );
+
+fatal_error "Invalid parameter to action Broadcast"   if supplied $audit && $audit ne 'audit';
+
+if ( have_capability( 'ADDRTYPE' ) ) {
+    if ( $level ne '' ) {
+	log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type BROADCAST ';
+	log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type ANYCAST ';
+    }
+
+    add_jump $chainref, $target, 0, '-m addrtype --dst-type BROADCAST ';
+    add_jump $chainref, $target, 0, '-m addrtype --dst-type ANYCAST ';
+} else {
+    add_commands $chainref, 'for address in $ALL_ACASTS; do';
+    incr_cmd_level $chainref;
+    log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d $address ' if $level ne '';
+    add_jump $chainref, $target, 0, "-d \$address ";
+    decr_cmd_level $chainref;
+    add_commands $chainref, 'done';
+}
+
+1;
+
+?end perl;

Shorewall6/Actions/action.Multicast

@@ -0,0 +1,59 @@
+#
+# Shorewall6 -- /usr/share/shorewall6/action.Multicast
+#
+# Multicast/Anycast IPv6 Action
+#
+# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
+#
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
+#
+# Complete documentation is available at http://shorewall.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of Version 2 of the GNU General Public License
+# as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Multicast[([<action>|-[,{audit|-}])]
+#
+# Default action is DROP
+#
+###############################################################################
+
+DEFAULTS DROP,-
+
+?begin perl;
+
+use Shorewall::IPAddrs;
+use Shorewall::Config;
+use Shorewall::Chains;
+
+my $chainref           = get_action_chain;
+my ( $action, $audit ) = get_action_params( 2 );
+my ( $level, $tag )    = get_action_logging;
+my $target             = require_audit ( $action , $audit );
+
+fatal_error "Invalid parameter to action Broadcast"   if supplied $audit && $audit ne 'audit';
+
+if ( have_capability( 'ADDRTYPE' ) ) {
+    if ( $level ne '' ) {
+	log_rule_limit $level, $chainref, 'Multicast' , $action, '', $tag, 'add', ' -m addrtype --dst-type MULTICAST ';
+    }
+
+    add_jump $chainref, $target, 0, '-m addrtype --dst-type MULTICAST ';
+} else {
+    log_rule_limit( $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', join( ' ', '-d', IPv6_MULTICAST . ' ' ) )  if $level ne '';
+    add_jump $chainref, $target, 0, join( ' ', '-d', IPv6_MULTICAST . ' ' );
+}
+
+1;
+
+?end perl;

Shorewall6/Samples6/Universal/shorewall6.conf

@@ -74,7 +74,7 @@ UNTRACKED_LOG_LEVEL=
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
-CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
+CONFIG_PATH=${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
 
 GEOIPDIR=/usr/share/xt_geoip/LE
 
@@ -106,11 +106,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT="none"
-BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+ACCEPT_DEFAULT=none
+BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
 REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -188,8 +188,6 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
-MINIUPNPD=No
-
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -198,8 +196,6 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
-PERL_HASH_SEED=0
-
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=Yes
@@ -210,7 +206,7 @@ RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
 
-TC_ENABLED=Shared
+TC_ENABLED=No
 
 TC_EXPERT=No
 

Shorewall6/Samples6/one-interface/shorewall6.conf

@@ -107,11 +107,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT="none"
-BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+ACCEPT_DEFAULT=none
+BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
 REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -189,8 +189,6 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
-MINIUPNPD=No
-
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -199,8 +197,6 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
-PERL_HASH_SEED=0
-
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -211,7 +207,7 @@ RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
 
-TC_ENABLED=Shared
+TC_ENABLED=No
 
 TC_EXPERT=No
 

Shorewall6/Samples6/three-interfaces/shorewall6.conf

@@ -106,11 +106,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT="none"
-BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+ACCEPT_DEFAULT=none
+BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
 REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -188,8 +188,6 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
-MINIUPNPD=No
-
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -198,8 +196,6 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
-PERL_HASH_SEED=0
-
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -210,7 +206,7 @@ RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
 
-TC_ENABLED=Shared
+TC_ENABLED=No
 
 TC_EXPERT=No
 

Shorewall6/Samples6/two-interfaces/shorewall6.conf

@@ -106,11 +106,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT="none"
-BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+ACCEPT_DEFAULT=none
+BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
 REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -188,8 +188,6 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
-MINIUPNPD=No
-
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -198,8 +196,6 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
-PERL_HASH_SEED=0
-
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -210,7 +206,7 @@ RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
 
-TC_ENABLED=Shared
+TC_ENABLED=No
 
 TC_EXPERT=No
 

Shorewall6/actions.std

@@ -6,29 +6,32 @@
 #	Please see http://shorewall.net/Actions.html for additional
 #	information.
 #
+# Builtin Actions are:
+#
+?if 0
+allowBcasts                     # Accept anycast packets
+allowMcasts                     # Accept multicast packets
+dropBcasts                      # Silently Drop anycast packets
+dropMcasts                      # Silently Drop multicast packets
+dropNotSyn		        # Silently Drop Non-syn TCP packets
+rejNotSyn		        # Silently Reject Non-syn TCP packets
+?endif
 ###############################################################################
 #ACTION
 A_Drop	                        # Audited Default Action for DROP policy
 A_Reject	                # Audited Default Action for REJECT policy
 A_AllowICMPs	                # Audited Accept needed ICMP6 types
 AllowICMPs   	                # Accept needed ICMP6 types
-allowBcast   inline		# Silently Allow Broadcast
 allowInvalid inline		# Accepts packets in the INVALID conntrack state
-allowMcast   inline		# Silently Allow Multicast
 AutoBL       noinline           # Auto-blacklist IPs that exceed thesholds
 AutoBLL      noinline           # Helper for AutoBL
-BLACKLIST    logjump,section	# Add sender to the dynamic blacklist
 Broadcast    noinline      	# Handles Broadcast/Anycast
 Drop		        	# Default Action for DROP policy (deprecated)
-dropBcast    inline		# Silently Drop Broadcast
 dropInvalid  inline		# Drops packets in the INVALID conntrack state
-dropMcast    inline		# Silently Drop Multicast
-dropNotSyn   noinline		# Silently Drop Non-syn TCP packets
 DropDNSrep   inline		# Drops DNS replies
 DropSmurfs   noinline     	# Handles packets with a broadcast source address
 Established  inline,\		# Handles packets in the ESTABLISHED state
 	     state=ESTABLISHED
-forwardUPnP  noinline		# Allow traffic that upnpd has redirected from 'upnp' interfaces.
 IfEvent      noinline           # Perform an action based on an event
 Invalid      inline,audit,\     # Handles packets in the INVALID conntrack state
              state=INVALID
@@ -36,7 +39,6 @@ Multicast    noinline      	# Handles Multicast
 New	     inline,state=NEW	# Handles packets in the NEW conntrack state
 NotSyn	     inline 		# Handles TCP packets that do not have SYN=1 and ACK=0
 Reject		        	# Default Action for REJECT policy (deprecated)
-rejNotSyn    noinline		# Silently Reject Non-syn TCP packets
 Related      inline,\		# Handles packets in the RELATED conntrack state
              state=RELATED
 ResetEvent   inline		# Reset an Event

Shorewall6/configfiles/shorewall6.conf

@@ -66,7 +66,7 @@ SMURF_LOG_LEVEL="$LOG_LEVEL"
 
 STARTUP_LOG=/var/log/shorewall6-init.log
 
-TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
+TCP_FLAGS_LOG_LEVEL=:$LOG_LEVEL"
 
 UNTRACKED_LOG_LEVEL=
 
@@ -106,11 +106,11 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-ACCEPT_DEFAULT="none"
-BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+ACCEPT_DEFAULT=none
+BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
+NFQUEUE_DEFAULT=none
+QUEUE_DEFAULT=none
 REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
 
 ###############################################################################
@@ -188,8 +188,6 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
-MINIUPNPD=No
-
 MODULE_SUFFIX=ko
 
 MUTEX_TIMEOUT=60
@@ -198,8 +196,6 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
-PERL_HASH_SEED=0
-
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -210,7 +206,7 @@ RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
 
-TC_ENABLED=Shared
+TC_ENABLED=No
 
 TC_EXPERT=No
 

Shorewall6/default.debian

@@ -1,5 +1,5 @@
 # prevent startup with default configuration
-# set the following variable to 1 in order to allow Shorewall6 to start
+# set the following varible to 1 in order to allow Shorewall6 to start
 
 startup=0
 
@@ -16,7 +16,7 @@ startup=0
 #    wait_interface=
 
 #
-# Global start/restart/reload/stop options
+# Startup options
 #
 OPTIONS=""
 
@@ -30,16 +30,6 @@ STARTOPTIONS=""
 #
 RESTARTOPTIONS=""
 
-#
-# Reload options
-#
-RELOADOPTIONS=""
-
-#
-# Stop options
-#
-STOPOPTIONS=""
-
 #
 # Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf
 #

Shorewall6/default.debian.systemd

@@ -1,26 +0,0 @@
-#
-# Global start/restart/reload/stop options
-#
-OPTIONS=""
-
-#
-# Start options
-#
-STARTOPTIONS=""
-
-#
-# Restart options
-#
-RESTARTOPTIONS=""
-
-#
-# Reload options
-#
-RELOADOPTIONS=""
-
-#
-# Stop options
-#
-STOPOPTIONS=""
-
-# EOF

Shorewall6/manpages/shorewall6-actions.xml

@@ -149,9 +149,9 @@
               <listitem>
                 <para>Added in Shorewall 5.0.7. Specifies that this action is
                 to be used in <ulink
-                url="/manpages6/shorewall6-mangle.html">shorewall6-mangle(5)</ulink>
+                url="shorewall6-mangle.html">shorewall6-mangle(5)</ulink>
                 rather than <ulink
-                url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink>.</para>
+                url="shorewall6-rules.html">shorewall6-rules(5)</ulink>.</para>
               </listitem>
             </varlistentry>
 
@@ -161,9 +161,9 @@
               <listitem>
                 <para>Added in Shorewall 5.0.13. Specifies that this action is
                 to be used in <ulink
-                url="/manpages6/shorewall6-snat.html">shorewall6-snat(5)</ulink> rather
+                url="shorewall6-snat.html">shorewall6-snat(5)</ulink> rather
                 than <ulink
-                url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink>. The
+                url="shorewall6-rules.html">shorewall6-rules(5)</ulink>. The
                 <option>mangle</option> and <option>nat</option> options are
                 mutually exclusive.</para>
               </listitem>

Shorewall6/manpages/shorewall6-blrules.xml

@@ -171,7 +171,7 @@
               <listitem>
                 <para>queues matching packets to a back end logging daemon via
                 a netlink socket then continues to the next rule. See <ulink
-                url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
+                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
               </listitem>
             </varlistentry>
 

Shorewall6/manpages/shorewall6-conntrack.xml

@@ -403,7 +403,7 @@
               <listitem>
                 <para>Where interface is the logical name of an interface
                 defined in <ulink
-                url="/manpages6/shorewall6-interfaces.html">shorewall6-interface</ulink>(5).</para>
+                url="shorewall-interfaces.html">shorewall-interface</ulink>(5).</para>
               </listitem>
             </varlistentry>
 
@@ -426,13 +426,13 @@
                   <listitem>
                     <para>The name of an ipset preceded by a plus sign ("+").
                     See <ulink
-                    url="/manpages6/shorewall6-ipsets.html">shorewall6-ipsets</ulink>(5).</para>
+                    url="shorewall-ipsets.html">shorewall-ipsets</ulink>(5).</para>
                   </listitem>
                 </itemizedlist>
 
                 <para><replaceable>exclusion</replaceable> is described in
                 <ulink
-                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5).</para>
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
               </listitem>
             </varlistentry>
 
@@ -450,7 +450,7 @@
 
               <listitem>
                 <para>See <ulink
-                url="/manpages6/shorewall6-exclusion.html">shorewall-exclusion</ulink>
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>
                 (5)</para>
               </listitem>
             </varlistentry>
@@ -499,7 +499,7 @@
               <listitem>
                 <para>Where interface is the logical name of an interface
                 defined in <ulink
-                url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).</para>
+                url="shorewall-interfaces.html">shorewall-interface</ulink>(5).</para>
               </listitem>
             </varlistentry>
 
@@ -522,13 +522,13 @@
                   <listitem>
                     <para>The name of an ipset preceded by a plus sign ("+").
                     See <ulink
-                    url="/manpages6/shorewall6-ipsets.html">shorewall6-ipsets</ulink>(5).</para>
+                    url="shorewall-ipsets.html">shorewall-ipsets</ulink>(5).</para>
                   </listitem>
                 </itemizedlist>
 
                 <para><replaceable>exclusion</replaceable> is described in
                 <ulink
-                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5).</para>
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
               </listitem>
             </varlistentry>
 
@@ -547,7 +547,7 @@
 
               <listitem>
                 <para>See <ulink
-                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>
                 (5)</para>
               </listitem>
             </varlistentry>

Shorewall6/manpages/shorewall6-interfaces.xml

@@ -345,7 +345,7 @@ loc     eth2            -</programlisting>
                       url="/bridge-Shorewall-perl.html">Shorewall-perl for
                       firewall/bridging</ulink>, then you need to include
                       DHCP-specific rules in <ulink
-                      url="/manpages6/shorewall6-rules.html">shorewall6-rules</ulink>(8).
+                      url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(8).
                       DHCP uses UDP ports 546 and 547.</para>
                     </note>
                   </listitem>

Shorewall6/manpages/shorewall6-ipsets.xml

@@ -102,7 +102,7 @@
 
     <important>
       <para>These additional match options are not available in <ulink
-      url="/manpages6/shorewall6-tcfilters.html">shorewall6-tcfilters(5)</ulink>.</para>
+      url="shorewall6-tcfilters.html">shorewall6-tcfilters(5)</ulink>.</para>
     </important>
 
     <para>Available options are:</para>

Shorewall6/manpages/shorewall6-mangle.xml

@@ -120,7 +120,7 @@
           Additionally, a <replaceable>chain-designator</replaceable> may not
           be specified in an action body unless the action is declared as
           <option>inline</option> in <ulink
-          url="/manpages6/shorewall6-actions.html">shorewall6-actions</ulink>(5).</para>
+          url="shorewall6-actions.html">shorewall6-actions</ulink>(5).</para>
 
           <para>Where a command takes parameters, those parameters are
           enclosed in parentheses ("(....)") and separated by commas.</para>
@@ -137,7 +137,7 @@
                 <para>Added in Shorewall 5.0.7.
                 <replaceable>action</replaceable> must be an action declared
                 with the <option>mangle</option> option in <ulink
-                url="/manpages6/shorewall6-actions.html">shorewall6-actions(5)</ulink>.
+                url="manpages6/shorewall6-actions.html">shorewall6-actions(5)</ulink>.
                 If the action accepts parameters, they are specified as a
                 comma-separated list within parentheses following the
                 <replaceable>action</replaceable> name.</para>
@@ -300,7 +300,7 @@
                 configuration described at <ulink
                 url="http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x">http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x</ulink>,
                 place this entry in <ulink
-                url="/manpages6/shorewall6-providers.html">shorewall6-providers(5)</ulink>:</para>
+                url="manpages6/shorewall6-providers.html">shorewall6-providers(5)</ulink>:</para>
 
                 <programlisting>#NAME    NUMBER   MARK    DUPLICATE  INTERFACE GATEWAY         OPTIONS               COPY
 TProxy   1        -       -          lo        -               tproxy</programlisting>
@@ -410,7 +410,7 @@ DIVERTHA        -               -               tcp</programlisting>
                 specified at the end of the rule. If the target is not one
                 known to Shorewall, then it must be defined as a builtin
                 action in <ulink
-                url="/manpages6/shorewall6-actions.html">shorewall6-actions</ulink>
+                url="/manpages/shorewall-actions.html">shorewall-actions</ulink>
                 (5).</para>
 
                 <para>The following rules are equivalent:</para>
@@ -423,7 +423,7 @@ INLINE                eth0              -                 ; -p tcp -j MARK --set
 </programlisting>
 
                 <para>If INLINE_MATCHES=Yes in <ulink
-                url="/manpages6/shorewall6.conf.html">shorewall6.conf(5)</ulink>
+                url="/manpages/shorewall.conf.html">shorewall6.conf(5)</ulink>
                 then the third rule above can be specified as follows:</para>
 
                 <programlisting>MARK(2):P             eth0              -                 ; -p tcp</programlisting>
@@ -780,7 +780,7 @@ Normal-Service       =&gt; 0x00</programlisting>
               <listitem>
                 <para>where <replaceable>interface</replaceable> is the
                 logical name of an interface defined in <ulink
-                url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
+                url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
                 Matches packets entering the firewall from the named
                 interface. May not be used in CLASSIFY rules or in rules using
                 the :T chain qualifier.</para>
@@ -807,7 +807,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 <para>Matches traffic whose source IP address matches one of
                 the listed addresses and that does not match an address listed
                 in the <replaceable>exclusion</replaceable> (see <ulink
-                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
 
                 <para><emphasis role="bold">This form will not match traffic
                 that originates on the firewall itself unless either
@@ -903,11 +903,11 @@ Normal-Service       =&gt; 0x00</programlisting>
               <listitem>
                 <para>where <replaceable>interface</replaceable> is the
                 logical name of an interface defined in <ulink
-                url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
+                url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
                 Matches packets leaving the firewall through the named
                 interface. May not be used in the PREROUTING chain (:P in the
                 mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No
-                in <ulink url="/manpages6/shorewall6.conf">shorewall6.conf</ulink>
+                in <ulink url="shorewall6.conf">shorewall6.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -932,7 +932,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 <para>Matches traffic whose destination IP address matches one
                 of the listed addresses and that does not match an address
                 listed in the <replaceable>exclusion</replaceable> (see <ulink
-                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -944,7 +944,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 when both the outgoing interface and destination IP address
                 match. May not be used in the PREROUTING chain (:P in the mark
                 column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in
-                <ulink url="/manpages6/shorewall6.conf">shorewall6.conf</ulink>
+                <ulink url="shorewall6.conf">shorewall6.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -959,7 +959,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 <replaceable>exclusion</replaceable>. May not be used in the
                 PREROUTING chain (:P in the mark column or no chain qualifier
                 and MARK_IN_FORWARD_CHAIN=No in <ulink
-                url="/manpages6/shorewall6.conf">shorewall6.conf</ulink> (5)).</para>
+                url="shorewall6.conf">shorewall6.conf</ulink> (5)).</para>
               </listitem>
             </varlistentry>
 
@@ -1026,9 +1026,8 @@ Normal-Service       =&gt; 0x00</programlisting>
         role="bold">all}[,...]}</emphasis></term>
 
         <listitem>
-          <para>See <ulink
-          url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink> for
-          details.</para>
+          <para>Protocol - <emphasis role="bold">ipp2p</emphasis> requires
+          ipp2p match support in your kernel and iptables.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall6/manpages/shorewall6-masq.xml

@@ -67,7 +67,7 @@
           entry that defines <filename
           class="devicefile">ppp+</filename>.</para>
 
-          <para>Where <ulink url="MultiISP.html#Shared">more that one
+          <para>Where <ulink url="/4.4/MultiISP.html#Shared">more that one
           internet provider share a single interface</ulink>, the provider is
           specified by including the provider name or number in
           parentheses:</para>

Shorewall6/manpages/shorewall6-nat.xml

@@ -67,7 +67,7 @@
           <para>Interfaces that have the <emphasis
           role="bold">EXTERNAL</emphasis> address. If ADD_IP_ALIASES=Yes in
           <ulink
-          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5),
+          url="/manpages/shorewall.conf.html">shorewall6.conf</ulink>(5),
           Shorewall will automatically add the EXTERNAL address to this
           interface. Also if ADD_IP_ALIASES=Yes, you may follow the interface
           name with ":" and a <emphasis>digit</emphasis> to indicate that you
@@ -78,12 +78,12 @@
           </emphasis></para>
 
           <para>Each interface must match an entry in <ulink
-          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
+          url="/manpages/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
           Shorewall allows loose matches to wildcard entries in <ulink
-          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
+          url="/manpages/shorewall-interfaces.html">shorewall6-interfaces</ulink>(5).
           For example, <filename class="devicefile">ppp0</filename> in this
           file will match a <ulink
-          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
+          url="/manpages/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
           entry that defines <filename
           class="devicefile">ppp+</filename>.</para>
 

Shorewall6/manpages/shorewall6-policy.xml

@@ -156,7 +156,7 @@
           policy-action list can be prefixed with a plus sign ("+") indicating
           that the listed actions are in addition to those listed in the
           related _DEFAULT setting in <ulink
-          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
+          url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
 
           <para>Possible policies are:</para>
 
@@ -192,7 +192,7 @@
               <listitem>
                 <para>Added in Shorewall 5.1.1 and requires that the
                 DYNAMIC_BLACKLIST setting in <ulink
-                url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)
+                url="/manpages/shorewall.conf.html">shorewall6.conf</ulink>(5)
                 specifies ipset-based dynamic blacklisting. The SOURCE IP
                 address is added to the blacklist ipset and the connection
                 request is ignored.</para>

Shorewall6/manpages/shorewall6-rules.xml

@@ -59,7 +59,7 @@
           this section.</para>
 
           <para>The only ACTIONs allowed in this section are ACCEPT, DROP,
-          REJECT, LOG, NFQUEUE and QUEUE</para>
+          REJECT, LOG and QUEUE</para>
 
           <para>There is an implicit ACCEPT rule inserted at the end of this
           section.</para>
@@ -74,7 +74,7 @@
           section.</para>
 
           <para>The only ACTIONs allowed in this section are ACCEPT, DROP,
-          REJECT, LOG, NFQUEUE and QUEUE</para>
+          REJECT, LOG and QUEUE</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the RELATED_DISPOSITION (<ulink
@@ -90,7 +90,7 @@
           processed by rules in this section.</para>
 
           <para>The only Actions allowed in this section are ACCEPT, DROP,
-          REJECT, LOG, NFQUEUE and QUEUE.</para>
+          REJECT, LOG and QUEUE.</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the INVALID_DISPOSITION (<ulink
@@ -106,7 +106,7 @@
           processed by rules in this section.</para>
 
           <para>The only Actions allowed in this section are ACCEPT, DROP,
-          REJECT, LOG, NFQUEUE and QUEUE.</para>
+          REJECT, LOG and QUEUE.</para>
 
           <para>There is an implicit rule added at the end of this section
           that invokes the UNTRACKED_DISPOSITION (<ulink
@@ -487,7 +487,7 @@
                 the<replaceable>
                 ip6tables-</replaceable><replaceable>target</replaceable> as a
                 builtin action in <ulink
-                url="/manpages6/shorewall6-actions.html">shorewall6-actions</ulink>(5).</para>
+                url="shorewall6-actions.html">shorewall6-actions</ulink>(5).</para>
 
                 <important>
                   <para>If you specify REJECT as the
@@ -642,7 +642,7 @@
               <listitem>
                 <para>like NFQUEUE but exempts the rule from being suppressed
                 by OPTIMIZE=1 in <ulink
-                url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
+                url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
               </listitem>
             </varlistentry>
 
@@ -829,7 +829,7 @@
 
           <para>If the <emphasis role="bold">ACTION</emphasis> names an
           <emphasis>action</emphasis> declared in <ulink
-          url="/manpages6/shorewall6-actions.html">shorewall6-actions</ulink>(5) or in
+          url="shorewall6-actions.html">shorewall6-actions</ulink>(5) or in
           /usr/share/shorewall/actions.std then:</para>
 
           <itemizedlist>
@@ -884,7 +884,7 @@
 
               <listitem>
                 <para>The name of a zone defined in <ulink
-                url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5). When
+                url="shorewall6-zones.html">shorewall6-zones</ulink>(5). When
                 only the zone name is specified, the packet source may be any
                 host in that zone.</para>
 
@@ -951,9 +951,9 @@
                 <replaceable>interface</replaceable> must be the name of an
                 interface associated with the named
                 <replaceable>zone</replaceable> in either <ulink
-                url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
+                url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
                 or <ulink
-                url="/manpages6/shorewall6.hosts.html">shorewall6-hosts</ulink>(5). Only
+                url="shorewall6.hosts.html">shorewall6-hosts</ulink>(5). Only
                 packets from hosts in the <replaceable>zone</replaceable> that
                 arrive through the named interface will match the rule.</para>
               </listitem>
@@ -971,7 +971,7 @@
                     follow the standard convention and be enclosed in square
                     brackets (e.g., [2001:470:b:227::0]/64). A network address
                     may be followed by exclusion (see <ulink
-                    url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                    url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
                   </listitem>
 
                   <listitem>
@@ -1009,7 +1009,7 @@
                     be specified by an ampersand ('&amp;') followed by the
                     logical name of the interface as found in the INTERFACE
                     column of <ulink
-                    url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>
+                    url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>
                     (5).</para>
                   </listitem>
                 </itemizedlist>
@@ -1031,7 +1031,7 @@
               <listitem>
                 <para>This form matches if the host IP address does not match
                 any of the entries in the exclusion (see <ulink
-                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -1139,7 +1139,7 @@
 
               <listitem>
                 <para>The name of a zone defined in <ulink
-                url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5). When
+                url="shorewall6-zones.html">shorewall6-zones</ulink>(5). When
                 only the zone name is specified, the packet destination may be
                 any host in that zone.</para>
 
@@ -1206,9 +1206,9 @@
                 <replaceable>interface</replaceable> must be the name of an
                 interface associated with the named
                 <replaceable>zone</replaceable> in either <ulink
-                url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
+                url="shorewall-interfaces.html">shorewall6-interfaces</ulink>(5)
                 or <ulink
-                url="/manpages6/shorewall6.hosts.html">shorewall6-hosts</ulink>(5). Only
+                url="shorewall.hosts.html">shorewall6-hosts</ulink>(5). Only
                 packets to hosts in the <replaceable>zone</replaceable> that
                 are sent through the named interface will match the
                 rule.</para>
@@ -1225,7 +1225,7 @@
                   <listitem>
                     <para>A host or network IP address. A network address may
                     be followed by exclusion (see <ulink
-                    url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                    url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
                   </listitem>
 
                   <listitem>
@@ -1257,7 +1257,7 @@
                     be specified by an ampersand ('&amp;') followed by the
                     logical name of the interface as found in the INTERFACE
                     column of <ulink
-                    url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>
+                    url="/manpages/shorewall6-interfaces.html">shorewall6-interfaces</ulink>
                     (5).</para>
                   </listitem>
                 </itemizedlist>
@@ -1280,7 +1280,7 @@
               <listitem>
                 <para>This form matches if the host IP address does not match
                 any of the entries in the exclusion (see <ulink
-                url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -1392,7 +1392,7 @@
       <varlistentry>
         <term><emphasis role="bold">PROTO</emphasis> - {<emphasis
         role="bold">-</emphasis>|<emphasis
-        role="bold">tcp:[!]syn</emphasis>|<emphasis
+        role="bold">tcp:syn</emphasis>|<emphasis
         role="bold">ipp2p</emphasis>|<emphasis
         role="bold">ipp2p:udp</emphasis>|<emphasis
         role="bold">ipp2p:all</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis
@@ -1403,9 +1403,7 @@
           requires ipp2p match support in your kernel and ip6tables. <emphasis
           role="bold">tcp:syn</emphasis> implies <emphasis
           role="bold">tcp</emphasis> plus the SYN flag must be set and the
-          RST,ACK and FIN flags must be reset. Beginning with Shorewall 5.1.3,
-          you may also specify <emphasis role="bold">tcp:!syn</emphasis>,
-          which matches if SYN is not set or if RST, ACK or FIN is set.</para>
+          RST,ACK and FIN flags must be reset.</para>
 
           <para>Beginning with Shorewall6 4.4.19, this column can contain a
           comma-separated list of protocol-numbers and/or protocol names

Shorewall6/manpages/shorewall6-secmarks.xml

@@ -222,9 +222,8 @@
         role="bold">all}</emphasis></term>
 
         <listitem>
-          <para>See <ulink
-          url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink> for
-          details.</para>
+          <para>Protocol - <emphasis role="bold">ipp2p</emphasis> requires
+          ipp2p match support in your kernel and iptables.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall6/manpages/shorewall6-snat.xml

@@ -27,7 +27,7 @@
 
     <para>This file is used to define dynamic NAT (Masquerading) and to define
     Source NAT (SNAT). While still supported, its use is deprecated in favor
-    of <ulink url="/manpages6/shorewall6-snat.html">shorewall6-snat</ulink>(5) which was
+    of <ulink url="shorewall6-snat.html">shorewall6-snat</ulink>(5) which was
     introduced in Shorewall 5.0.14.</para>
 
     <warning>
@@ -84,7 +84,7 @@
                 <para>If you specify an address here, matching packets will
                 have their source address set to that address. If
                 ADD_SNAT_ALIASES is set to Yes or yes in <ulink
-                url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5) then
+                url="shorewall6.conf.html">shorewall6.conf</ulink>(5) then
                 Shorewall will automatically add this address to the INTERFACE
                 named in the first column.</para>
 
@@ -149,7 +149,7 @@
               <listitem>
                 <para>where <replaceable>action</replaceable> is an action
                 declared in <ulink
-                url="/manpages6/shorewall6-actions.html">shorewall6-actions(5)</ulink>
+                url="shorewall6-actions.html">shorewall6-actions(5)</ulink>
                 with the <option>nat</option> option. See <ulink
                 url="/Actions.html">www.shorewall.net/Actions.html</ulink> for
                 further information.</para>
@@ -200,7 +200,7 @@
           entry that defines <filename
           class="devicefile">ppp+</filename>.</para>
 
-          <para>Where <ulink url="MultiISP.html#Shared">more that one
+          <para>Where <ulink url="/4.4/MultiISP.html#Shared">more that one
           internet provider share a single interface</ulink>, the provider is
           specified by including the provider name or number in
           parentheses:</para>
@@ -234,9 +234,8 @@
 
         <listitem>
           <para>If you wish to restrict this entry to a particular protocol
-          then enter the protocol name (from protocols(5)) or number here. See
-          <ulink url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink> for
-          details.</para>
+          then enter the protocol name (from protocols(5)) or number
+          here.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
           comma-separated list of protocols.</para>

Shorewall6/manpages/shorewall6-tcfilters.xml

@@ -89,11 +89,11 @@
           Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
           may be used if your kernel and ip6tables have the <firstterm>Basic
           Ematch </firstterm>capability and you set BASIC_FILTERS=Yes in
-          <ulink url="/manpages6/shorewall6.conf.html">shorewall6.conf (5)</ulink>. The
+          <ulink url="shorewall6.conf.html">shorewall6.conf (5)</ulink>. The
           ipset name may optionally be followed by a number or a comma
           separated list of src and/or dst enclosed in square brackets
           ([...]). See <ulink
-          url="/manpages6/shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for
+          url="shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for
           details.</para>
         </listitem>
       </varlistentry>
@@ -108,11 +108,11 @@
           Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
           may be used if your kernel and ip6tables have the <firstterm>Basic
           Ematch</firstterm> capability and you set BASIC_FILTERS=Yes in
-          <ulink url="/manpages6/shorewall6.conf.html">shorewall6.conf (5)</ulink>. The
+          <ulink url="shorewall6.conf.html">shorewall6.conf (5)</ulink>. The
           ipset name may optionally be followed by a number or a comma
           separated list of src and/or dst enclosed in square brackets
           ([...]). See <ulink
-          url="/manpages6/shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for
+          url="shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for
           details.</para>
         </listitem>
       </varlistentry>

Shorewall6/manpages/shorewall6-zones.xml

@@ -42,27 +42,26 @@
         role="bold">,</emphasis><emphasis>parent-zone</emphasis>]...]</term>
 
         <listitem>
-          <para>Name of the <emphasis>zone</emphasis>. Must start with a
-          letter and consist of letters, digits or '_'. The names "all",
-          "none", "any", "SOURCE" and "DEST" are reserved and may not be used
-          as zone names. The maximum length of a zone name is determined by
-          the setting of the LOGFORMAT option in <ulink
-          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5). With
-          the default LOGFORMAT, zone names can be at most 5 characters
+          <para>Name of the <emphasis>zone</emphasis>. The names "all",
+          "none", "SOURCE" and "DEST" are reserved and may not be used as zone
+          names. The maximum length of a zone name is determined by the
+          setting of the LOGFORMAT option in <ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).
+          With the default LOGFORMAT, zone names can be at most 5 characters
           long.</para>
 
           <blockquote>
             <para>The maximum length of an iptables log prefix is 29 bytes. As
             explained in <ulink
-            url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink> (5), the legacy
-            default LOGPREFIX formatting string is “Shorewall:%s:%s:” where
-            the first %s is replaced by the chain name and the second is
+            url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink> (5),
+            the default LOGPREFIX formatting string is “Shorewall:%s:%s:”
+            where the first %s is replaced by the chain name and the second is
             replaced by the disposition.</para>
 
             <itemizedlist>
               <listitem>
-                <para>The "Shorewall:%s:%s:" formatting string has 12 fixed
-                characters ("Shorewall" and three colons).</para>
+                <para>The default formatting string has 12 fixed characters
+                ("Shorewall" and three colons).</para>
               </listitem>
 
               <listitem>
@@ -73,8 +72,7 @@
               <listitem>
                 <para>The canonical name for the chain containing the rules
                 for traffic going from zone 1 to zone 2 is "&lt;zone
-                1&gt;2&lt;zone 2&gt;" or "&lt;zone 1&gt;-&lt;zone
-                2&gt;".</para>
+                1&gt;2&lt;zone 2&gt;".</para>
               </listitem>
 
               <listitem>
@@ -90,29 +88,6 @@
                 </simplelist>
               </listitem>
             </itemizedlist>
-
-            <para>In Shorewall 5.1.0, the LOGFORMAT in the default and sample
-            shorewall.conf files was changed to "%s:%s ".</para>
-
-            <itemizedlist>
-              <listitem>
-                <para>That formatting string has 2 fixed characters (":" and a
-                space).</para>
-              </listitem>
-
-              <listitem>
-                <para>So the maximum zone name length M is calculated
-                as:</para>
-
-                <simplelist>
-                  <member>2 + 6 + 2*M + 1 = 29</member>
-
-                  <member>2M = 29 - 2 + 6 + 1 = 20</member>
-
-                  <member>M = 10</member>
-                </simplelist>
-              </listitem>
-            </itemizedlist>
           </blockquote>
 
           <para>The order in which Shorewall6 matches addresses from packets

Shorewall6/manpages/shorewall6.conf.xml

@@ -243,9 +243,9 @@
         <listitem>
           <para>The value of this variable affects Shorewall's stopped state.
           The behavior differs depending on whether <ulink
-          url="/manpages6/shorewall6-routestopped.html">shorewall6-routestopped</ulink>(5)
+          url="shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
           or <ulink
-          url="/manpages6/shorewall6-stoppedrules.html">shorewall6-stoppedrules</ulink>(5)
+          url="shorewall-stoppedrules.html">shorewall-stoppedrules</ulink>(5)
           is used:</para>
 
           <variablelist>
@@ -404,7 +404,7 @@
           <para>Added in Shorewall 5.1.1. When USE_DEFAULT_RT=Yes, this option
           determines whether the <option>balance</option> provider option (see
           <ulink
-          url="/manpages6/shorewall6-providers.html">shorewall6-providers(5)</ulink>) is
+          url="shorewall6-providers.html">shorewall6-providers(5)</ulink>) is
           the default. When BALANCE_PROVIDERS=Yes, then the
           <option>balance</option> option is assumed unless the
           <option>fallback</option>, <option>loose</option>,
@@ -421,7 +421,7 @@
         <listitem>
           <para>Added in Shorewall-4.6.0. When set to <emphasis
           role="bold">Yes</emphasis>, causes entries in <ulink
-          url="/manpages6/shorewall6-tcfilters.html">shorewall6-tcfilters(5)</ulink> to
+          url="shorewall6-tcfilters.html">shorewall6-tcfilters(5)</ulink> to
           generate a basic filter rather than a u32 filter. This setting
           requires the <firstterm>Basic Ematch</firstterm> capability in your
           kernel and iptables.</para>
@@ -950,8 +950,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           specificaitons</ulink> on the right.. When INLINE_MATCHES=Yes is
           specified, the specifications on the right are interpreted as if
           INLINE had been specified in the ACTION column. This also applies to
-          <ulink url="/manpages6/shorewall6-masq.html">shorewall6-masq(5)</ulink> and
-          <ulink url="/manpages6/shorewall6-mangle.html">shorewall6-mangle(5</ulink>)
+          <ulink url="shorewall-masq.html">shorewall6-masq(5)</ulink> and
+          <ulink url="shorewall6-mangle.html">shorewall6-mangle(5</ulink>)
           which also support INLINE. If not specified or if specified as the
           empty value, the value 'No' is assumed for backward
           compatibility.</para>
@@ -1194,7 +1194,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           sample configurations use this as the default log level and changing
           it will change all packet logging done by the configuration. In any
           configuration file (except <ulink
-          url="/manpages6/shorewall6-params.html">shorewall6-params(5)</ulink>),
+          url="shorewall6-params.html">shorewall6-params(5)</ulink>),
           $LOG_LEVEL will expand to this value.</para>
         </listitem>
       </varlistentry>
@@ -1229,7 +1229,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
 
         <listitem>
           <para>This option is intended for use as a debugging aid. When set
-          to a log level, this option causes Shorewall to generate a logging
+          to a log level, this option causes Shorewall6 to generate a logging
           rule as the first rule in each builtin chain.</para>
 
           <itemizedlist>
@@ -1244,19 +1244,14 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
             </listitem>
           </itemizedlist>
 
+          <para/>
+
           <blockquote>
             <para>For example, using the default LOGFORMAT, the log prefix for
-            logging from the nat table's PREROUTING chain is as follows in
-            versions prior to 5.1.0:</para>
+            logging from the nat table's PREROUTING chain is:</para>
 
             <programlisting>    Shorewall:nat:PREROUTING
- </programlisting>
-
-            <para>In Shorewall 5.1.0 and later releases, the log prefix
-            is:</para>
-
-            <programlisting>    nat:PREROUTING
- </programlisting>
+</programlisting>
 
             <important>
               <para>To help insure that all packets in the NEW state are
@@ -1300,7 +1295,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
 
         <listitem>
           <para>The value of this variable generate the --log-prefix setting
-          for Shorewall logging rules. It contains a “printf” formatting
+          for Shorewall6 logging rules. It contains a “printf” formatting
           template which accepts three arguments (the chain name, logging rule
           number (optional) and the disposition). To use LOGFORMAT with
           fireparse, set it as:</para>
@@ -1311,7 +1306,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           logging rule number is calculated and formatted in that position; if
           that substring is not included then the rule number is not included.
           If not supplied or supplied as empty (LOGFORMAT="") then
-          “Shorewall:%s:%s:” is assumed.</para>
+          “Shorewall6:%s:%s:” is assumed.</para>
 
           <note>
             <para>The setting of LOGFORMAT has an effect of the permitted
@@ -1319,23 +1314,6 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
             url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>
             (5).</para>
           </note>
-
-          <caution>
-            <para>Beginning with Shorewall 5.1.0, the default and sample
-            shorewall.conf files set LOGFORMAT="%s %s ". Shorewall6 log
-            messages that use this LOGFORMAT can be uniquely identified using
-            the following regular expression:</para>
-
-            <simplelist>
-              <member>'IN=.* OUT=.* SRC=.*:.* DST='</member>
-            </simplelist>
-
-            <para>To match all Netfilter log messages, use:</para>
-
-            <simplelist>
-              <member>'IN=.* OUT=.* SRC=.* DST='</member>
-            </simplelist>
-          </caution>
         </listitem>
       </varlistentry>
 
@@ -1372,8 +1350,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
 
         <listitem>
-          <para>Using LOGFORMAT=“Shorewall:%s:%s:”, chain names may not exceed
-          5 characters or truncation of the log prefix may occur. Longer chain
+          <para>Using the default LOGFORMAT, chain names may not exceed 11
+          characters or truncation of the log prefix may occur. Longer chain
           names may be used with log tags if you set LOGTAGONLY=Yes. With
           LOGTAGONLY=Yes, if a log tag is specified then the tag is included
           in the log prefix in place of the chain name.</para>
@@ -1385,10 +1363,10 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           separated by a comma. So this rule:</para>
 
           <programlisting>#ACTION                                SOURCE         DEST
-LOG:info:foo,bar                       net            fw</programlisting>
+LOG:info:foo,bar                 net                   fw</programlisting>
 
-          <para>would generate the following log prefix when using
-          LOGFORMAT=“Shorewall:%s:%s:”:</para>
+          <para>would generate the following log prefix when using the default
+          LOGFORMAT setting:</para>
 
           <simplelist>
             <member>Shorewall:foo:bar:</member>
@@ -1397,7 +1375,7 @@ LOG:info:foo,bar                       net            fw</programlisting>
           <para>Similarly,</para>
 
           <programlisting>#ACTION                               SOURCE            DEST
-LOG:info:,bar                         net               fw</programlisting>
+LOG:info:,bar                        net                    fw</programlisting>
 
           <para>would generate</para>
 
@@ -1577,28 +1555,6 @@ LOG:info:,bar                         net               fw</programlisting>
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term><emphasis role="bold">MINIUPNPD=</emphasis>[<emphasis
-        role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
-
-        <listitem>
-          <para>Added in Shorewall 5.1.4. If set to Yes, Shorewall will create
-          a chain in the nat table named MINIUPNPD-POSTROUTING and will add
-          jumps from POSTROUTING to that chain for each interface with the
-          <option>upnpd</option> option specified. Default is No.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis
-        role="bold">MARK_IN_FORWARD_CHAIN=</emphasis>[<emphasis
-        role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
-
-        <listitem>
-          <para/>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><emphasis role="bold">MODULE_SUFFIX=</emphasis>[<emphasis
         role="bold">"</emphasis><emphasis>extension</emphasis> ...<emphasis
@@ -1679,9 +1635,10 @@ LOG:info:,bar                         net               fw</programlisting>
           <itemizedlist>
             <listitem>
               <para>Optimization category 1 - Traditionally, Shorewall has
-              created rules for the complete matrix of
+              created rules for <ulink
+              url="/ScalabilityAndPerformance.html">the complete matrix of
               host groups defined by the zones, interfaces and hosts
-              files. Any traffic that didn't correspond to an element
+              files</ulink>. Any traffic that didn't correspond to an element
               of that matrix was rejected in one of the built-in chains. When
               the matrix is sparse, this results in lots of largely useless
               rules.</para>
@@ -1911,21 +1868,6 @@ LOG:info:,bar                         net               fw</programlisting>
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term><emphasis role="bold">PERL_HASH_SEED=</emphasis><emphasis
-        role="bold"><replaceable>seed</replaceable><emphasis
-        role="bold">|random</emphasis></emphasis></term>
-
-        <listitem>
-          <para>Added in Shorewall 5.1.4. Sets the Perl hash
-          <replaceable>seed</replaceable> (an integer in the range 0-99999)
-          when running the Shorewall rules compiler. If not specified, the
-          value 0 is assumed. If <option>random</option> is specified, a
-          random seed will be chosed by Perl. See perlsec(1) for additional
-          information.</para>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><emphasis
         role="bold">PROVIDER_BITS</emphasis>=[<replaceable>number</replaceable>]</term>
@@ -2103,7 +2045,7 @@ INLINE          -       -       -       ;; -j REJECT
           <para>Added in Shorewall 4.4.10. The default is No. If set to Yes,
           at least one optional interface must be up in order for the firewall
           to be in the started state. Intended to be used with the <ulink
-          url="/shorewall-init.html">Shorewall Init
+          url="/manpages/shorewall-init.html">Shorewall Init
           Package</ulink>.</para>
         </listitem>
       </varlistentry>
@@ -2257,7 +2199,7 @@ INLINE          -       -       -       ;; -j REJECT
           the <option>routeback</option> option.<footnote>
               <para>Hairpin packets are packets that are routed out of the
               same interface that they arrived on.</para>
-            </footnote></para>
+            </footnote> interfaces without the routeback option.</para>
         </listitem>
       </varlistentry>
 
@@ -2273,8 +2215,9 @@ INLINE          -       -       -       ;; -j REJECT
           the <option>routeback</option> option.<footnote>
               <para>Hairpin packets are packets that are routed out of the
               same interface that they arrived on.</para>
-            </footnote>The default is <option>info</option>. If you don't wish
-          for these packets to be logged, use SFILTER_LOG_LEVEL=none.</para>
+            </footnote> interfaces without the routeback option. The default
+          is <option>info</option>. If you don't wish for these packets to be
+          logged, use SFILTER_LOG_LEVEL=none.</para>
         </listitem>
       </varlistentry>
 
@@ -2380,9 +2323,9 @@ INLINE          -       -       -       ;; -j REJECT
 
           <para>If you set TC_ENABLED=Simple (Shorewall 4.4.6 and later),
           simple traffic shaping using <ulink
-          url="/manpages6/shorewall6-tcinterfaces.html">shorewall6-tcinterfaces</ulink>(5)
+          url="/manpages/shorewall-tcinterfaces.html">shorewall-tcinterfaces</ulink>(5)
           and <ulink
-          url="/manpages6/shorewall6-tcpri.html">shorewall6-tcpri</ulink>(5) is
+          url="/manpages/shorewall-tcpri.html">shorewall-tcpri</ulink>(5) is
           enabled.</para>
 
           <para>Beginning with Shorewall 4.4.15, if you set TC_ENABLED=Shared
@@ -2597,7 +2540,7 @@ INLINE          -       -       -       ;; -j REJECT
             <listitem>
               <para>Packets are sent through the main routing table by a rule
               with priority 999. In <ulink
-              url="/manpages6/shorewall6-rtrules.html">shorewall6-routing_rules</ulink>(5),
+              url="/manpages6/shorewall6-routing_rules.html">shorewall6-routing_rules</ulink>(5),
               the range 1-998 may be used for inserting rules that bypass the
               main table.</para>
             </listitem>