Correct typo in Chains.pm

&g_dockeringress -> $g_dockeringress

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/configure

@@ -190,7 +190,7 @@ for p in ${!params[@]}; do
 done
 
 echo '#'                                                                 > shorewallrc
-echo "# Created by Shorewall Core version $VERSION configure - " `date` >> shorewallrc
+echo "# Created by Shorewall Core version $VERSION configure - " `date --utc --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}"` >> shorewallrc
 echo "# rc file: $rcfile"                                               >> shorewallrc
 echo '#'                                                                >> shorewallrc
 

Shorewall-core/configure.pl

@@ -173,7 +173,12 @@ my $outfile;
 
 open $outfile, '>', 'shorewallrc' or die "Can't open 'shorewallrc' for output: $!";
 
-printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s %2d %04d %02d:%02d:%02d\n", VERSION, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];
+if ( $ENV{SOURCE_DATE_EPOCH} ) {
+    printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s\n", VERSION, `date  --utc --date=\"\@$ENV{SOURCE_DATE_EPOCH}\"`;
+} else {
+    printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s %2d %04d %02d:%02d:%02d\n", VERSION, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];
+}
+
 print $outfile "# rc file: $rcfilename\n#\n";
 
 print  $outfile "# Input: @ARGV\n#\n" if @ARGV;

Shorewall-core/lib.cli

@@ -25,7 +25,7 @@
 # loaded after this one and replaces some of the functions declared here.
 #
 
-SHOREWALL_CAPVERSION=50100
+SHOREWALL_CAPVERSION=50106
 
 if [ -z "$g_basedir" ]; then
     #
@@ -2803,6 +2803,8 @@ determine_capabilities() {
     WAIT_OPTION=
     CPU_FANOUT=
     NETMAP_TARGET=
+    NFLOG_SIZE=
+    RESTORE_WAIT_OPTION=
 
     AMANDA_HELPER=
     FTP_HELPER=
@@ -2826,9 +2828,11 @@ determine_capabilities() {
 	qt $arptables -L OUT && ARPTABLESJF=Yes
     fi
 
+    [ -z "$(${g_tool}-restore --wait < /dev/null 2>&1)" ] && RESTORE_WAIT_OPTION=Yes
+
     if qt $g_tool --wait -t filter -L INPUT -n -v; then
 	WAIT_OPTION=Yes
-	tool="$tool --wait"
+	g_tool="$g_tool --wait"
     fi
 
     chain=fooX$$
@@ -3136,10 +3140,13 @@ determine_capabilities() {
     qt $g_tool -A $chain -j LOGMARK && LOGMARK_TARGET=Yes
     qt $g_tool -A $chain -j LOG || LOG_TARGET=
     qt $g_tool -A $chain -j ULOG && ULOG_TARGET=Yes
-    qt $g_tool -A $chain -j NFLOG && NFLOG_TARGET=Yes
     qt $g_tool -A $chain -j MARK --set-mark 5 && MARK_ANYWHERE=Yes
     qt $g_tool -A $chain -m statistic --mode nth --every 2 --packet 1 && STATISTIC_MATCH=Yes
     qt $g_tool -A $chain -m geoip --src-cc US && GEOIP_MATCH=Yes
+    if qt $g_tool -A $chain -j NFLOG; then
+	NFLOG_TARGET=Yes
+	qt $g_tool -A $chain -j NFLOG --nflog-size 64 && NFLOG_SIZE=Yes
+    fi
 
     if [ $g_family -eq 4 ]; then
 	qt $g_tool -A $chain -j ACCOUNT --addr 192.168.1.0/29 --tname $chain && ACCOUNT_TARGET=Yes
@@ -3295,9 +3302,11 @@ report_capabilities_unsorted() {
     if [ $g_family -eq 4 ]; then
 	report_capability "iptables -S (IPTABLES_S)" $IPTABLES_S
 	report_capability "iptables --wait option (WAIT_OPTION)" $WAIT_OPTION
+	report_capability "iptables-restore --wait option (RESTORE_WAIT_OPTION)" $RESTORE_WAIT_OPTION
     else
 	report_capability "ip6tables -S (IPTABLES_S)" $IPTABLES_S
 	report_capability "ip6tables --wait option (WAIT_OPTION)" $WAIT_OPTION
+	report_capability "ip6tables-restore --wait option (RESTORE_WAIT_OPTION)" $RESTORE_WAIT_OPTION
     fi
 
     report_capability "Basic Filter (BASIC_FILTER)" $BASIC_FILTER
@@ -3305,6 +3314,7 @@ report_capabilities_unsorted() {
     report_capability "CT Target (CT_TARGET)" $CT_TARGET
     report_capability "NFQUEUE CPU Fanout (CPU_FANOUT)" $CPU_FANOUT
     report_capability "NETMAP Target (NETMAP_TARGET)" $NETMAP_TARGET
+    report_capability "--nflog-size support (NFLOG_SIZE)" $NFLOG_SIZE
 
     echo "   Kernel Version (KERNELVERSION): $KERNELVERSION"
     echo "   Capabilities Version (CAPVERSION): $CAPVERSION"
@@ -3411,6 +3421,8 @@ report_capabilities_unsorted1() {
     report_capability1 WAIT_OPTION
     report_capability1 CPU_FANOUT
     report_capability1 NETMAP_TARGET
+    report_capability1 NFLOG_SIZE
+    report_capability1 RESTORE_WAIT_OPTION
 
     report_capability1 AMANDA_HELPER
     report_capability1 FTP_HELPER
@@ -3715,7 +3727,7 @@ ipcalc_command() {
 
     valid_address $address || fatal_error "Invalid IP address: $address"
     [ -z "$vlsm" ] && fatal_error "Missing VLSM"
-    [ "x$address" = "x$vlsm" ] && "Invalid VLSM"
+    [ "x$address" = "x$vlsm" ] && fatal_error "Invalid VLSM"
     [ $vlsm -gt 32 ] && fatal_error "Invalid VLSM: /$vlsm"
 
     address=$address/$vlsm

Shorewall-core/lib.common

@@ -269,53 +269,48 @@ loadmodule() # $1 = module name, $2 - * arguments
 {
     local modulename
     modulename=$1
+    shift
+    local moduleoptions
+    moduleoptions=$*
     local modulefile
     local suffix
 
     if [ -d /sys/module/ ]; then
 	if ! list_search $modulename $DONT_LOAD; then
 	    if [ ! -d /sys/module/$modulename ]; then
-		shift
-
-		for suffix in $MODULE_SUFFIX ; do
-		    for directory in $moduledirectories; do
-			modulefile=$directory/${modulename}.${suffix}
-
-			if [ -f $modulefile ]; then
-			    case $moduleloader in
-				insmod)
-				    insmod $modulefile $*
-				    ;;
-				*)
-				    modprobe $modulename $*
-				    ;;
-			    esac
-			    break 2
-			fi
-		    done
-		done
+		case $moduleloader in
+		    insmod)
+			for directory in $moduledirectories; do
+			    for modulefile in $directory/${modulename}.*; do
+				if [ -f $modulefile ]; then
+				    insmod $modulefile $moduleoptions
+				    return
+				fi
+			    done
+			done
+			;;
+		    *)
+			modprobe -q $modulename $moduleoptions
+			;;
+		esac
 	    fi
 	fi
     elif ! list_search $modulename $DONT_LOAD $MODULES; then
-	shift
-
-	for suffix in $MODULE_SUFFIX ; do
-	    for directory in $moduledirectories; do
-		modulefile=$directory/${modulename}.${suffix}
-
-		if [ -f $modulefile ]; then
-		    case $moduleloader in
-			insmod)
-			    insmod $modulefile $*
-			    ;;
-			*)
-			    modprobe $modulename $*
-			    ;;
-		    esac
-		    break 2
-		fi
-	    done
-	done
+	case $moduleloader in
+	    insmod)
+		for directory in $moduledirectories; do
+		    for modulefile in $directory/${modulename}.*; do
+			if [ -f $modulefile ]; then
+			    insmod $modulefile $moduleoptions
+			    return
+			fi
+		    done
+		done
+		;;
+	    *)
+		modprobe -q $modulename $moduleoptions
+		;;
+	esac
     fi
 }
 
@@ -338,8 +333,6 @@ reload_kernel_modules() {
 	moduleloader=insmod
     fi
 
-    [ -n "${MODULE_SUFFIX:=ko ko.gz ko.xz o o.gz o.xz gz xz}" ]
-
     if [ -n "$MODULESDIR" ]; then
 	case "$MODULESDIR" in
 	    +*)
@@ -394,8 +387,6 @@ load_kernel_modules() # $1 = Yes, if we are to save moduleinfo in $VARDIR
 	moduleloader=insmod
     fi
 
-    [ -n "${MODULE_SUFFIX:=o gz xz ko o.gz o.xz ko.gz ko.xz}" ]
-
     if [ -n "$MODULESDIR" ]; then
 	case "$MODULESDIR" in
 	    +*)

Shorewall-init/init.debian.sh

@@ -159,8 +159,9 @@ shorewall_stop () {
 
       mkdir -p $(dirname "$SAVE_IPSETS")
       if ipset -S > "${SAVE_IPSETS}.tmp"; then
-	  grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
+	  grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
       else
+	  rm -f "${SAVE_IPSETS}.tmp"
 	  echo_notdone
       fi
 

Shorewall-init/init.fedora.sh

@@ -66,6 +66,10 @@ start () {
 
     printf "Initializing \"Shorewall-based firewalls\": "
 
+    if [ -n "$SAVE_IPSETS" -a -f "$SAVE_IPSETS" ]; then
+	ipset -R < "$SAVE_IPSETS"
+    fi
+
     for PRODUCT in $PRODUCTS; do
 	setstatedir
 	retval=$?
@@ -120,6 +124,15 @@ stop () {
     done
 
     if [ $retval -eq 0 ]; then
+	if [ -n "$SAVE_IPSETS" ]; then
+	    mkdir -p $(dirname "$SAVE_IPSETS")
+	    if ipset -S > "${SAVE_IPSETS}.tmp"; then
+		grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
+	    else
+		rm -f "${SAVE_IPSETS}.tmp"
+	    fi
+	fi
+
 	rm -f $lockfile
 	success
     else

Shorewall-init/init.openwrt.sh

@@ -126,7 +126,9 @@ stop () {
     if [ -n "$SAVE_IPSETS" ]; then
 	mkdir -p $(dirname "$SAVE_IPSETS")
 	if ipset -S > "${SAVE_IPSETS}.tmp"; then
-	    grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
+	    grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
+	else
+	    rm -f "${SAVE_IPSETS}.tmp"
 	fi
     fi
 }

Shorewall-init/init.sh

@@ -116,7 +116,9 @@ shorewall_stop () {
   if [ -n "$SAVE_IPSETS" ]; then
       mkdir -p $(dirname "$SAVE_IPSETS")
       if ipset -S > "${SAVE_IPSETS}.tmp"; then
-	  grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
+	  grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
+      else
+	  rm -f "${SAVE_IPSETS}.tmp"
       fi
   fi
 

Shorewall-init/init.suse.sh

@@ -126,7 +126,9 @@ shorewall_stop () {
   if [ -n "$SAVE_IPSETS" ]; then
       mkdir -p $(dirname "$SAVE_IPSETS")
       if ipset -S > "${SAVE_IPSETS}.tmp"; then
-	  grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
+	  grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
+      else
+	  rm -f "${SAVE_IPSETS}.tmp"
       fi
   fi
 }

Shorewall-init/shorewall-init

@@ -104,7 +104,9 @@ shorewall_stop () {
     if [ -n "$SAVE_IPSETS" ]; then
 	mkdir -p $(dirname "$SAVE_IPSETS")
 	if ipset -S > "${SAVE_IPSETS}.tmp"; then
-	    grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
+	    grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
+	else
+	    rm -f "${SAVE_IPSETS}.tmp"
 	fi
     fi
 

Shorewall-lite/shorecap

@@ -28,7 +28,7 @@
 #
 #   On the target system (the system where the firewall program is to run):
 #
-#       [ IPTABLES=<iptables binary> ] [ MODULESDIR=<kernel modules directory> ] [ MODULE_SUFFIX="<module suffix list>" ] shorecap > capabilities
+#       [ IPTABLES=<iptables binary> ] [ MODULESDIR=<kernel modules directory> ] shorecap > capabilities
 #
 #    Now move the capabilities file to the compilation system. The file must
 #    be placed in a directory on the CONFIG_PATH to be used when compiling firewalls
@@ -38,7 +38,6 @@
 #
 #        IPTABLES - iptables
 #        MODULESDIR - /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter
-#        MODULE_SUFFIX - "o gz xz ko o.gz o.xz ko.gz ko.xz"
 #
 #    Shorewall need not be installed on the target system to run shorecap. If the '-e' flag is
 #    used during firewall compilation, then the generated firewall program will likewise not

Shorewall/Actions/action.IfEvent

@@ -107,6 +107,11 @@ if ( $command & $REAP_OPT ) {
 
 $duration .= '--rttl ' if $command & $TTL_OPT;
 
+if ( ( $targets{$action} || 0 ) & NATRULE ) {
+    perl_action_helper( "${action}-", "-m recent --rcheck ${duration}--hitcount $hitcount" );
+    $action = 'ACCEPT';
+}
+
 if ( $command & $RESET_CMD ) {
     require_capability 'MARK_ANYWHERE', '"reset"', 's';
 

Shorewall/Actions/action.ResetEvent

@@ -41,6 +41,11 @@ fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src
 set_action_disposition( $disposition) if supplied $disposition;
 set_action_name_to_caller;
 
+if ( ( $targets{$action} || 0 ) & NATRULE ) {
+    perl_action_helper( "${action}-", "" );
+    $action = 'ACCEPT';
+}
+
 if ( $destination eq 'dst' ) {
     perl_action_helper( $action, '', '', "-m recent --name $event --remove --rdest" );
 } else {

Shorewall/Actions/action.SetEvent

@@ -37,6 +37,11 @@ fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src
 set_action_disposition( $disposition) if supplied $disposition;
 set_action_name_to_caller;
 
+if ( ( $targets{$action} || 0 ) & NATRULE ) {
+    perl_action_helper( "${action}-", "" );
+    $action = 'ACCEPT';
+}
+
 if ( $destination eq 'dst' ) {
     perl_action_helper( $action, '', '', "-m recent --name $event --set --rdest" );
 } else {

Shorewall/Actions/action.dropBcasts

@@ -0,0 +1,39 @@
+#
+# Shorewall -- /usr/share/shorewall/action.dropBcasts
+#
+# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
+#
+# (c) 2017 Tom Eastep (teastep@shorewall.net)
+#
+# Complete documentation is available at http://shorewall.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of Version 2 of the GNU General Public License
+# as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# dropBcasts[([audit])]
+#
+###############################################################################
+
+DEFAULTS -
+
+?if passed(@1)
+    ?if @1 eq 'audit'
+	?require AUDIT_TARGET
+	Broadcast(A_DROP)
+    ?else
+	?error "Invalid argument (@1) to dropBcasts"
+    ?endif
+?else
+    Broadcast(DROP)
+?endif
+

Shorewall/Macros/macro.RDP

@@ -6,4 +6,5 @@
 ###############################################################################
 #ACTION	SOURCE	DEST	PROTO	DPORT	SPORT	ORIGDEST	RATE	USER
 
+PARAM	-	-	udp	3389
 PARAM	-	-	tcp	3389

Shorewall/Perl/Shorewall/Accounting.pm

@@ -195,7 +195,7 @@ sub process_accounting_rule1( $$$$$$$$$$$ ) {
     $ports  = ''    if $ports  eq 'any' || $ports  eq 'all';
     $sports = ''    if $sports eq 'any' || $sports eq 'all';
 
-    fatal_error "USER/GROUP may only be specified in the OUTPUT section" unless $user eq '-' || $asection == OUTPUT;
+    fatal_error "USER/GROUP may only be specified in the OUTPUT section" unless $user eq '-' || $asection == OUTPUT_SECTION;
 
     my $rule = do_proto( $proto, $ports, $sports ) . do_user ( $user ) . do_test ( $mark, $globals{TC_MASK} ) . do_headers( $headers );
     my $prerule = '';
@@ -266,7 +266,7 @@ sub process_accounting_rule1( $$$$$$$$$$$ ) {
     if ( $source eq 'any' || $source eq 'all' ) {
         $source = ALLIP;
     } else {
-	fatal_error "MAC addresses only allowed in the INPUT and FORWARD sections" if $source =~ /~/ && ( $asection == OUTPUT || ! $asection );
+	fatal_error "MAC addresses only allowed in the INPUT and FORWARD sections" if $source =~ /~/ && ( $asection == OUTPUT_SECTION || ! $asection );
     }
 
     if ( have_bridges && ! $asection ) {

Shorewall/Perl/Shorewall/Chains.pm

@@ -851,8 +851,15 @@ sub validate_port( $$ ) {
     my $value;
 
     if ( $port =~ /^(\d+)$/ || $port =~ /^0x/ ) {
-	$port = numeric_value $port;
-	return $port if defined $port && $port && $port <= 65535;
+	$value = numeric_value $port;
+
+	if ( defined $value ) {
+	    if ( $value && $value <= 65535 ) {
+		return $value;
+	    } else {
+		$value = undef;
+	    }
+	}
     } elsif ( $port =~ /^%(.*)/ ) {
 	$value = record_runtime_port( $1 );
     } else {
@@ -891,13 +898,13 @@ sub validate_portpair( $$ ) {
 	$what = 'port range';
 
 	unless ($ports[0] =~ /^\$/ || $ports[1] =~ /^\$/ ) {
-	    fatal_error "Invalid port range ($portpair)" unless $ports[0] < $ports[1];
+	    fatal_error "Invalid port range ($_[1])" unless $ports[0] < $ports[1];
 	}
     } else {
 	$what = 'port';
     }
 
-    fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, UDPLITE, SCTP or DCCP" unless
+    fatal_error "Using a $what ( $_[1] ) requires PROTO TCP, UDP, UDPLITE, SCTP or DCCP" unless
 	defined $protonum && ( $protonum == TCP     ||
 			       $protonum == UDP     ||
 			       $protonum == UDPLITE ||
@@ -1338,8 +1345,6 @@ sub format_rule( $$;$ ) {
 	    } else {
 		$rule .= join( '' , ' --', $_, ' ', $value );
 	    }
-
-	    next;
 	} elsif ( $type == EXPENSIVE ) {
 	    #
 	    # Only emit expensive matches now if there are '-m nfacct' or '-m recent' matches in the rule
@@ -1922,7 +1927,7 @@ sub delete_reference( $$ ) {
 
     assert( $toref );
 
-    delete $toref->{references}{$fromref->{name}} unless --$toref->{references}{$fromref->{name}} > 0;
+    delete $toref->{references}{$fromref->{name}} if --$toref->{references}{$fromref->{name}} <= 0;
 }
 
 #
@@ -2060,7 +2065,7 @@ sub adjust_reference_counts( $$$ ) {
     my ($toref, $name1, $name2) = @_;
 
     if ( $toref ) {
-	delete $toref->{references}{$name1} unless --$toref->{references}{$name1} > 0;
+	delete $toref->{references}{$name1} if --$toref->{references}{$name1} <= 0;
 	$toref->{references}{$name2}++;
     }
 }
@@ -3268,8 +3273,10 @@ sub initialize_chain_table($) {
 	$chainref = new_nat_chain( 'DOCKER' );
 	set_optflags( $chainref, DONT_OPTIMIZE | DONT_DELETE | DONT_MOVE );
 	add_commands( $chainref, '[ -f ${VARDIR}/.nat_DOCKER ] && cat ${VARDIR}/.nat_DOCKER >&3' );
+	$chainref = new_standard_chain( 'DOCKER-INGRESS'   );
 	$chainref = new_standard_chain( 'DOCKER-ISOLATION' );
 	set_optflags( $chainref, DONT_OPTIMIZE | DONT_DELETE | DONT_MOVE );
+	add_commands( $chainref, '[ -f ${VARDIR}/.filter_DOCKER-INGRESS   ] && cat ${VARDIR}/.filter_DOCKER-INGRESS   >&3' );
 	add_commands( $chainref, '[ -f ${VARDIR}/.filter_DOCKER-ISOLATION ] && cat ${VARDIR}/.filter_DOCKER-ISOLATION >&3' );
     }
 
@@ -3893,6 +3900,15 @@ sub optimize_level8( $$$ ) {
 		    }
 
 		    $combined{ $chainref1->{name} } = $chainref->{name};
+		    #
+		    # While rare, it is possible for a policy chain to be combined with a non-policy chain. So we need to preserve
+		    # the policy attributes in the combined chain
+		    #
+		    if ( $chainref->{policychain} ) {
+			@{$chainref1}{qw(policychain policy)} = @{$chainref}{qw(policychain policy)} unless $chainref1->{policychain};
+		    } elsif ( $chainref1->{policychain} ) {
+			@{$chainref}{qw(policychain policy)} = @{$chainref1}{qw(policychain policy)} unless $chainref->{policychain};
+		    }
 		}
 	    }
 	}
@@ -4819,7 +4835,7 @@ sub do_proto( $$$;$ )
 				$multiport = 1;
 			    }  else {
 				fatal_error "Missing DEST PORT" unless supplied $ports;
-				$ports   = validate_portpair $pname , $ports;
+				$ports   = validate_portpair $pname , $ports unless $ports =~ /^\$/;
 				$output .= ( $srcndst ? "-m multiport ${invert}--ports ${ports} " : "${invert}--dport ${ports} " );
 			    }
 			}
@@ -5026,7 +5042,7 @@ sub do_iproto( $$$ )
 				$multiport = 1;
 			    }  else {
 				fatal_error "Missing DEST PORT" unless supplied $ports;
-				$ports   = validate_portpair $pname , $ports;
+				$ports   = validate_portpair $pname , $ports unless $ports =~ /^\$/;
 
 				if ( $srcndst ) {
 				    push @output, multiport => "${invert}--ports ${ports}";
@@ -6311,7 +6327,7 @@ sub match_dest_net( $;$ ) {
 	return '-d ' . record_runtime_address $1, $2;
     }
 
-    $net = validate_net $net, 1;
+    $net = validate_net $net, 1 unless $net =~ /^\$/; # Don't validate if runtime address variable
     $net eq ALLIP ? '' : "-d $net ";
 }
 
@@ -6392,7 +6408,7 @@ sub imatch_dest_net( $;$ ) {
 	return ( d => record_runtime_address( $1, $2, 1 ) );
     }
 
-    $net = validate_net $net, 1;
+    $net = validate_net $net, 1 unless $net =~ /^\$/; # Don't validate if runtime address variable
     $net eq ALLIP ? () : ( d =>  $net );
 }
 
@@ -7051,6 +7067,8 @@ sub interface_gateway( $ ) {
 sub get_interface_gateway ( $;$$ ) {
     my ( $logical, $protect, $provider ) = @_;
 
+    $provider = '' unless defined $provider;
+
     my $interface = get_physical $logical;
     my $variable = interface_gateway( $interface );
     my $gateway  = get_interface_option( $interface, 'gateway' );
@@ -7064,9 +7082,9 @@ sub get_interface_gateway ( $;$$ ) {
     }
 
     if ( interface_is_optional $logical ) {
-	$interfacegateways{$interface} = qq([ -n "\$$variable" ] || $variable=\$(detect_gateway $interface));
+	$interfacegateways{$interface} = qq([ -n "\$$variable" ] || $variable=\$(detect_gateway $interface $provider));
     } else {
-	$interfacegateways{$interface} = qq([ -n "\$$variable" ] || $variable=\$(detect_gateway $interface)
+	$interfacegateways{$interface} = qq([ -n "\$$variable" ] || $variable=\$(detect_gateway $interface $provider)
 [ -n "\$$variable" ] || startup_error "Unable to detect the gateway through interface $interface");
     }
 
@@ -7515,6 +7533,11 @@ sub isolate_dest_interface( $$$$ ) {
 
 	    $rule .= "-d $variable ";
 	}
+    } elsif ( $dest =~ /^\$/ ) {
+	#
+	# Runtime address variable
+	#
+	$dnets  = $dest;
     } elsif ( $family == F_IPV4 ) {
 	if ( $dest =~ /^(.+?):(.+)$/ ) {
 	    $diface = $1;
@@ -8438,6 +8461,7 @@ sub save_docker_rules($) {
 	  qq(    $tool -t nat -S OUTPUT | tail -n +2 | fgrep DOCKER > \${VARDIR}/.nat_OUTPUT),
 	  qq(    $tool -t nat -S POSTROUTING | tail -n +2 | fgrep -v SHOREWALL > \${VARDIR}/.nat_POSTROUTING),
 	  qq(    $tool -t filter -S DOCKER | tail -n +2 > \${VARDIR}/.filter_DOCKER),
+	  qq(    [ -n "\$g_dockeringress" ] && $tool -t filter -S DOCKER-INGRESS   | tail -n +2 > \${VARDIR}/.filter_DOCKER-INGRESS),
 	  qq(    [ -n "\$g_dockernetwork" ] && $tool -t filter -S DOCKER-ISOLATION | tail -n +2 > \${VARDIR}/.filter_DOCKER-ISOLATION)
 	);
 
@@ -8453,6 +8477,7 @@ sub save_docker_rules($) {
 	  q(    rm -f ${VARDIR}/.nat_OUTPUT),
 	  q(    rm -f ${VARDIR}/.nat_POSTROUTING),
 	  q(    rm -f ${VARDIR}/.filter_DOCKER),
+	  q(    rm -f ${VARDIR}/.filter_DOCKER-INGRESS),
 	  q(    rm -f ${VARDIR}/.filter_DOCKER-ISOLATION),
 	  q(    rm -f ${VARDIR}/.filter_FORWARD),
 	  q(fi)
@@ -8895,9 +8920,15 @@ sub create_netfilter_load( $ ) {
     my $UTILITY = $family == F_IPV4 ? 'IPTABLES_RESTORE' : 'IP6TABLES_RESTORE';
 
     emit( '',
-	  'if [ "$COMMAND" = reload -a -n "$g_counters" ] && chain_exists $g_sha1sum1 && chain_exists $g_sha1sum2 ; then',
-	  '    option="--counters"',
-	  '',
+	  'if [ "$COMMAND" = reload -a -n "$g_counters" ] && chain_exists $g_sha1sum1 && chain_exists $g_sha1sum2 ; then' );
+
+    if ( have_capability( 'RESTORE_WAIT_OPTION' ) ) {
+	emit( '    option="--counters --wait "' . $config{MUTEX_TIMEOUT} );
+    } else {
+	emit( '    option="--counters"' );
+    }
+
+    emit( '',
 	  '    progress_message "Reusing existing ruleset..."',
 	  '',
 	  'else'
@@ -8905,7 +8936,11 @@ sub create_netfilter_load( $ ) {
 
     push_indent;
 
-    emit 'option=';
+    if ( have_capability( 'RESTORE_WAIT_OPTION' ) ) {
+	emit 'option="--wait "' . $config{MUTEX_TIMEOUT};
+    } else {
+	emit 'option=';
+    }
 
     save_progress_message "Preparing $utility input...";
 
@@ -8954,6 +8989,10 @@ sub create_netfilter_load( $ ) {
 			enter_cmd_mode;
 			emit( '[ -n "$g_dockernetwork" ] && echo ":DOCKER-ISOLATION - [0:0]" >&3' );
 			enter_cat_mode;
+		    } elsif ( $name eq 'DOCKER-INGRESS' ) {
+			enter_cmd_mode;
+			emit( '[ -n "$g_dockeringress" ] && echo ":DOCKER-INGRESS - [0:0]" >&3' );
+			enter_cat_mode;
 		    } else {		    
 			emit_unindented ":$name - [0:0]";
 		    }
@@ -9058,6 +9097,11 @@ sub preview_netfilter_load() {
 			print( '[ -n "$g_dockernetwork" ] && echo ":DOCKER-ISOLATION - [0:0]" >&3' );
 			print "\n";
 			enter_cat_mode1;
+		    } elsif ( $name eq 'DOCKER-INGRESS' ) {
+			enter_cmd_mode1 unless $mode == CMD_MODE;
+			print( '[ -n "$g_dockeringress" ] && echo ":DOCKER-INGRESS - [0:0]" >&3' );
+			print "\n";
+			enter_cat_mode1;
 		    } else {		    
 			enter_cmd_mode1 unless $mode == CMD_MODE;
 			print( ":$name - [0:0]\n" );
@@ -9295,6 +9339,10 @@ sub create_stop_load( $ ) {
 			enter_cmd_mode;
 			emit( '[ -n "$g_dockernetwork" ] && echo ":DOCKER-ISOLATION - [0:0]" >&3' );
 			enter_cat_mode;
+		    } elsif ( $name eq 'DOCKER-INGRESS' ) {
+			enter_cmd_mode;
+			emit( '[ -n "$g_dockeringress" ] && echo ":DOCKER-INGRESS - [0:0]" >&3' );
+			enter_cat_mode;
 		    } else {		    
 			emit_unindented ":$name - [0:0]";
 		    }
@@ -9320,7 +9368,11 @@ sub create_stop_load( $ ) {
 
     enter_cmd_mode;
 
-    emit( '[ -n "$g_debug_iptables" ] && command=debug_restore_input || command=$' . $UTILITY );
+    if ( have_capability( 'RESTORE_WAIT_OPTION' ) ) {
+	emit( '[ -n "$g_debug_iptables" ] && command=debug_restore_input || command="$' . $UTILITY . ' --wait ' . $config{MUTEX_TIMEOUT} . '"' );
+    } else {
+	emit( '[ -n "$g_debug_iptables" ] && command=debug_restore_input || command=$' . $UTILITY );
+    }
 
     emit( '',
 	  'progress_message2 "Running $command..."',

Shorewall/Perl/Shorewall/Compiler.pm

@@ -109,7 +109,7 @@ sub generate_script_1( $ ) {
 ################################################################################
 EOF
 
-    for my $exit ( qw/init start tcclear started stop stopped clear refresh refreshed restored/ ) {
+    for my $exit ( qw/init start tcclear started stop stopped clear refresh refreshed restored enabled disabled/ ) {
 	emit "\nrun_${exit}_exit() {";
 	push_indent;
 	append_file $exit or emit 'true';
@@ -209,6 +209,8 @@ sub generate_script_2() {
     emit (   '[ -f ${g_confdir}/vardir ] && . ${g_confdir}/vardir' );
     emit ( qq([ -n "\${VARDIR:=$shorewallrc1{VARDIR}}" ]) );
     emit ( qq([ -n "\${VARLIB:=$shorewallrc1{VARLIB}}" ]) );
+    emit ( qq([ -n "\${CONFDIR:=$shorewallrc1{CONFDIR}}" ]) );
+    emit ( qq([ -n "\${SHAREDIR:=$shorewallrc1{SHAREDIR}}" ]) );
 
     emit 'TEMPFILE=';
 
@@ -266,7 +268,8 @@ sub generate_script_2() {
 	emit( '',
 	      'chain_exists DOCKER nat && chain_exists DOCKER && g_docker=Yes',
 	    );
-	emit( 'chain_exists DOCKER-ISOLATION && g_dockernetwork=Yes]' );
+	emit( 'chain_exists DOCKER-INGRESS   && g_dockeringress=Yes' );
+	emit( 'chain_exists DOCKER-ISOLATION && g_dockernetwork=Yes' );
 	emit( '' );
     }
 

Shorewall/Perl/Shorewall/Config.pm

@@ -36,6 +36,7 @@ use strict;
 use warnings;
 use File::Basename;
 use File::Temp qw/ tempfile tempdir /;
+use File::Glob ':globally';
 use Cwd qw(abs_path getcwd);
 use autouse 'Carp' => qw(longmess confess);
 use Scalar::Util 'reftype';
@@ -315,7 +316,7 @@ our %renamed = ( AUTO_COMMENT => 'AUTOCOMMENT', BLACKLIST_LOGLEVEL => 'BLACKLIST
 #
 # Config options and global settings that are to be copied to output script
 #
-our @propagateconfig = qw/ DISABLE_IPV6 MODULESDIR MODULE_SUFFIX LOAD_HELPERS_ONLY LOCKFILE SUBSYSLOCK LOG_VERBOSITY RESTART/;
+our @propagateconfig = qw/ DISABLE_IPV6 MODULESDIR LOAD_HELPERS_ONLY LOCKFILE SUBSYSLOCK LOG_VERBOSITY RESTART/;
 #
 # From parsing the capabilities file or detecting capabilities
 #
@@ -413,7 +414,9 @@ our %capdesc = ( NAT_ENABLED     => 'NAT',
                  WAIT_OPTION     => 'iptables --wait option',
                  CPU_FANOUT      => 'NFQUEUE CPU Fanout',
                  NETMAP_TARGET   => 'NETMAP Target',
-
+                 NFLOG_SIZE      => '--nflog-size support',
+		 RESTORE_WAIT_OPTION
+				 => 'iptables-restore --wait option',
 		 AMANDA_HELPER   => 'Amanda Helper',
 		 FTP_HELPER      => 'FTP Helper',
 		 FTP0_HELPER     => 'FTP-0 Helper',
@@ -646,6 +649,7 @@ our %eliminated = ( LOGRATE          => 1,
 		    HIGH_ROUTE_MARKS => 1,
 		    BLACKLISTNEWONLY => 1,
 		    CHAIN_SCRIPTS    => 1,
+                    MODULE_SUFFIX    => 1,
 		  );
 #
 # Variables involved in ?IF, ?ELSE ?ENDIF processing
@@ -750,8 +754,8 @@ sub initialize( $;$$) {
 		    TC_SCRIPT               => '',
 		    EXPORT                  => 0,
 		    KLUDGEFREE              => '',
-		    VERSION                 => "5.1.4-Beta1",
-		    CAPVERSION              => 50100 ,
+		    VERSION                 => "5.1.5-RC1",
+		    CAPVERSION              => 50106 ,
 		    BLACKLIST_LOG_TAG       => '',
 		    RELATED_LOG_TAG         => '',
 		    MACLIST_LOG_TAG         => '',
@@ -846,7 +850,6 @@ sub initialize( $;$$) {
 	  BLACKLIST => undef,
 	  BLACKLISTNEWONLY => undef,
 	  DELAYBLACKLISTLOAD => undef,
-	  MODULE_SUFFIX => undef,
 	  DISABLE_IPV6 => undef,
 	  DYNAMIC_ZONES => undef,
 	  PKTTYPE=> undef,
@@ -910,6 +913,7 @@ sub initialize( $;$$) {
 	  FIREWALL => undef ,
 	  BALANCE_PROVIDERS => undef ,
 	  PERL_HASH_SEED => undef ,
+	  USE_NFLOG_SIZE => undef ,
 	  #
 	  # Packet Disposition
 	  #
@@ -1043,6 +1047,8 @@ sub initialize( $;$$) {
 	       WAIT_OPTION => undef,
 	       CPU_FANOUT => undef,
 	       NETMAP_TARGET => undef,
+	       NFLOG_SIZE => undef,
+	       RESTORE_WAIT_OPTION => undef,
 
 	       AMANDA_HELPER => undef,
 	       FTP_HELPER => undef,
@@ -2341,7 +2347,7 @@ sub split_line2( $$;$$$ ) {
 
 	    $inline_matches = $pairs;
 
-	    if ( $columns =~ /^(\s*|.*[^&@%]){(.*)}\s*$/ ) {
+	    if ( $columns =~ /^(\s*|.*[^&@%])\{(.*)\}\s*$/ ) {
 		#
 		# Pairs are enclosed in curly brackets.
 		#
@@ -2357,7 +2363,7 @@ sub split_line2( $$;$$$ ) {
 	    if ( $currline =~ /^\s*INLINE(?:\(.*\)(:.*)?|:.*)?\s/ || $currline =~ /^\s*IP6?TABLES(?:\(.*\)|:.*)?\s/ ) {
 		$inline_matches = $pairs;
 
-		if ( $columns =~ /^(\s*|.*[^&@%]){(.*)}\s*$/ ) {
+		if ( $columns =~ /^(\s*|.*[^&@%])\{(.*)\}\s*$/ ) {
 		    #
 		    # Pairs are enclosed in curly brackets.
 		    #
@@ -2371,7 +2377,7 @@ sub split_line2( $$;$$$ ) {
 	} elsif ( $checkinline ) {
 	    warning_message "This entry needs to be changed before INLINE_MATCHES can be set to Yes";
 	}
-    } elsif ( $currline =~ /^(\s*|.*[^&@%]){(.*)}$/ ) {
+    } elsif ( $currline =~ /^(\s*|.*[^&@%])\{(.*)\}$/ ) {
 	#
 	# Pairs are enclosed in curly brackets.
 	#
@@ -4046,7 +4052,7 @@ sub make_mask( $ ) {
     0xffffffff >> ( 32 - $_[0] );
 }
 
-my @suffixes = qw(group range threshold nlgroup cprange qthreshold);
+my @suffixes;
 
 #
 # Validate a log level -- Drop the trailing '!' and translate to numeric value if appropriate"
@@ -4282,7 +4288,7 @@ sub which( $ ) {
 # Load the kernel modules defined in the 'modules' file.
 #
 sub load_kernel_modules( ) {
-    my $moduleloader = which( 'modprobe' ) || ( which 'insmod' );
+    my $moduleloader = which( 'modprobe' ) || which( 'insmod' );
 
     my $modulesdir = $config{MODULESDIR};
 
@@ -4315,25 +4321,20 @@ sub load_kernel_modules( ) {
 
 	close LSMOD;
 
-	$config{MODULE_SUFFIX} = 'o gz xz ko o.gz o.xz ko.gz ko.xz' unless $config{MODULE_SUFFIX};
-
-	my @suffixes = split /\s+/ , $config{MODULE_SUFFIX};
-
+      MODULE:
 	while ( read_a_line( NORMAL_READ ) ) {
 	    fatal_error "Invalid modules file entry" unless ( $currentline =~ /^loadmodule\s+([a-zA-Z]\w*)\s*(.*)$/ );
 	    my ( $module, $arguments ) = ( $1, $2 );
 	    unless ( $loadedmodules{ $module } ) {
-		for my $directory ( @moduledirectories ) {
-		    for my $suffix ( @suffixes ) {
-			my $modulefile = "$directory/$module.$suffix";
-			if ( -f $modulefile ) {
-			    if ( $moduleloader eq 'insmod' ) {
-				system ("insmod $modulefile $arguments" );
-			    } else {
-				system( "modprobe $module $arguments" );
-			    }
-
+		if ( $moduleloader =~ /modprobe$/ ) {
+		    system( "modprobe -q $module $arguments" );
+		    $loadedmodules{ $module } = 1;
+		} else {
+		    for my $directory ( @moduledirectories ) {
+			for my $modulefile ( <$directory/$module.*> ) {
+			    system ("insmod $modulefile $arguments" );
 			    $loadedmodules{ $module } = 1;
+			    next MODULE;
 			}
 		    }
 		}
@@ -4818,6 +4819,10 @@ sub NFLog_Target() {
     qt1( "$iptables $iptablesw -A $sillyname -j NFLOG" );
 }
 
+sub NFLog_Size() {
+    have_capability( 'NFLOG_TARGET' ) && qt1( "$iptables $iptablesw -A $sillyname -j NFLOG --nflog-size 64" );
+}
+
 sub Logmark_Target() {
     qt1( "$iptables $iptablesw -A $sillyname -j LOGMARK" );
 }
@@ -4941,6 +4946,10 @@ sub Cpu_Fanout() {
     have_capability( 'NFQUEUE_TARGET' ) && qt1( "$iptables -A $sillyname -j NFQUEUE --queue-balance 0:3 --queue-cpu-fanout" );
 }
 
+sub Restore_Wait_Option() {
+    length( `${iptables}-restore --wait < /dev/null 2>&1` ) == 0;
+}
+
 our %detect_capability =
     ( ACCOUNT_TARGET =>\&Account_Target,
       AMANDA_HELPER => \&Amanda_Helper,
@@ -4993,6 +5002,7 @@ our %detect_capability =
       LOG_TARGET => \&Log_Target,
       ULOG_TARGET => \&Ulog_Target,
       NFLOG_TARGET => \&NFLog_Target,
+      NFLOG_SIZE => \&NFLog_Size,
       MANGLE_ENABLED => \&Mangle_Enabled,
       MANGLE_FORWARD => \&Mangle_Forward,
       MARK => \&Mark,
@@ -5020,6 +5030,7 @@ our %detect_capability =
       REALM_MATCH => \&Realm_Match,
       REAP_OPTION => \&Reap_Option,
       RECENT_MATCH => \&Recent_Match,
+      RESTORE_WAIT_OPTION => \&Restore_Wait_Option,
       RPFILTER_MATCH => \&RPFilter_Match,
       SANE_HELPER => \&SANE_Helper,
       SANE0_HELPER => \&SANE0_Helper,
@@ -5186,6 +5197,9 @@ sub determine_capabilities() {
 	$capabilities{TCPMSS_TARGET}   = detect_capability( 'TCPMSS_TARGET' );
 	$capabilities{CPU_FANOUT}      = detect_capability( 'CPU_FANOUT' );
 	$capabilities{NETMAP_TARGET}   = detect_capability( 'NETMAP_TARGET' );
+	$capabilities{NFLOG_SIZE}      = detect_capability( 'NFLOG_SIZE' );
+	$capabilities{RESTORE_WAIT_OPTION}
+				       = detect_capability( 'RESTORE_WAIT_OPTION' );
 
 	unless ( have_capability 'CT_TARGET' ) {
 	    $capabilities{HELPER_MATCH} = detect_capability 'HELPER_MATCH';
@@ -5363,11 +5377,11 @@ sub update_config_file( $ ) {
 	update_default( 'BALANCE_PROVIDERS', 'Yes' );
     }
 
-    update_default( 'EXPORTMODULES',     'No' );
-    update_default( 'RESTART',           'reload' );
-    update_default( 'PAGER',             $shorewallrc1{DEFAULT_PAGER} );
-    update_default( 'LOGFORMAT',         'Shorewall:%s:%s:' );
-    update_default( 'LOGLIMIT',          '' );
+    update_default( 'EXPORTMODULES',         'No' );
+    update_default( 'RESTART',               'reload' );
+    update_default( 'PAGER',                 $shorewallrc1{DEFAULT_PAGER} );
+    update_default( 'LOGFORMAT',             'Shorewall:%s:%s:' );
+    update_default( 'LOGLIMIT',              '' );
 
     if ( $family == F_IPV4 ) {
 	update_default( 'BLACKLIST_DEFAULT', 'dropBcasts,dropNotSyn,dropInvalid' );
@@ -6052,7 +6066,6 @@ sub get_configuration( $$$$ ) {
     #
     # get_capabilities requires that the true settings of these options be established
     #
-    default 'MODULE_PREFIX', 'ko ko.gz o o.gz gz';
     default_yes_no 'LOAD_HELPERS_ONLY'          , 'Yes';
 
     if ( ! $export && $> == 0 ) {
@@ -6238,7 +6251,7 @@ sub get_configuration( $$$$ ) {
 	$config{LOG_VERBOSITY} = -1;
     }
 
-    default_yes_no 'ADD_IP_ALIASES'             , 'Yes';
+    default_yes_no 'ADD_IP_ALIASES'             , $family == F_IPV4 ? 'Yes' : '';
     default_yes_no 'ADD_SNAT_ALIASES'           , '';
     default_yes_no 'DETECT_DNAT_IPADDRS'        , '';
     default_yes_no 'DETECT_DNAT_IPADDRS'        , '';
@@ -6393,6 +6406,17 @@ sub get_configuration( $$$$ ) {
     default_yes_no 'AUTOMAKE'                   , '';
     default_yes_no 'TRACK_PROVIDERS'            , '';
     default_yes_no 'BALANCE_PROVIDERS'          , $config{USE_DEFAULT_RT} ? 'Yes' : '';
+    default_yes_no 'USE_NFLOG_SIZE'             , '';
+
+    if ( $config{USE_NFLOG_SIZE} ) {
+	if ( have_capability( 'NFLOG_SIZE' ) ) {
+	    @suffixes = qw(group size threshold nlgroup cprange qthreshold);
+	} else {
+	    fatal_error "USE_NFLOG_SIZE=Yes, but the --nflog-size capabiity is not present";
+	}
+    } else {
+	@suffixes = qw(group range threshold nlgroup cprange qthreshold);
+    }
 
     unless ( ( $config{NULL_ROUTE_RFC1918} || '' ) =~ /^(?:blackhole|unreachable|prohibit)$/ ) {
 	default_yes_no( 'NULL_ROUTE_RFC1918', '' );
@@ -6813,6 +6837,12 @@ sub get_configuration( $$$$ ) {
 	}
     }
 
+    if ( supplied( $val = $config{MUTEX_TIMEOUT} ) ) {
+	fatal_error "Invalid value ($val) for MUTEX_TIMEOUT" unless $val && $val =~ /^\d+$/;
+    } else {
+	$config{MUTEX_TIMEOUT} = 60;
+    }
+
     add_variables %config;
 
     while ( my ($var, $val ) = each %renamed ) {

Shorewall/Perl/Shorewall/Misc.pm

@@ -667,6 +667,7 @@ sub create_docker_rules() {
 
     my $chainref = $filter_table->{FORWARD};
 
+    add_commands( $chainref, '[ -n "$g_dockeringress" ] && echo "-A FORWARD -j DOCKER-INGRESS"   >&3', );
     add_commands( $chainref, '[ -n "$g_dockernetwork" ] && echo "-A FORWARD -j DOCKER-ISOLATION" >&3', );
 
     if ( my $dockerref = known_interface('docker0') ) {

Shorewall/Perl/Shorewall/Nat.pm

@@ -941,7 +941,17 @@ sub handle_nat_rule( $$$$$$$$$$$$$ ) {
 	} else {
 	    $server = $1 if $family == F_IPV6 && $server =~ /^\[(.+)\]$/;
 	    fatal_error "Invalid server IP address ($server)" if $server eq ALLIP || $server eq NILIP;
-	    my @servers = validate_address $server, 1;
+
+	    my @servers;
+
+	    if ( ( $server =~ /^([&%])(.+)/ ) ) {
+		$server = record_runtime_address( $1, $2 );
+		$server =~ s/ $//;
+		@servers = ( $server );
+	    } else {
+		@servers = validate_address $server, 1;
+	    }
+
 	    $server = join ',', @servers;
 	}
 

Shorewall/Perl/Shorewall/Providers.pm

@@ -357,7 +357,7 @@ sub balance_fallback_route( $$$$ ) {
     emit '';
 
     if ( $first_fallback_route ) {
-	if ( $balanced_providers == 1 ) {
+	if ( $fallback_providers == 1 ) {
 	    if ( $gateway ) {
 		emit "FALLBACK_ROUTE=\"via $gateway dev $interface $realm\"";
 	    } else {
@@ -502,7 +502,7 @@ sub process_a_provider( $ ) {
 
     if ( ( $gw = lc $gateway ) eq 'detect' ) {
 	fatal_error "Configuring multiple providers through one interface requires an explicit gateway" if $shared;
-	$gateway = get_interface_gateway( $interface, undef, 1 );
+	$gateway = get_interface_gateway( $interface, undef, $number );
 	$gatewaycase = 'detect';
 	set_interface_option( $interface, 'gateway', 'detect' );
     } elsif ( $gw eq 'none' ) {
@@ -1088,7 +1088,10 @@ CEOF
 	    emit( "setup_${dev}_tc" ) if $tcdevices->{$interface};
 	}
 
-	emit( qq(rm -f \${VARDIR}/${physical}_disabled) );
+	emit( qq(rm -f \${VARDIR}/${physical}_disabled),
+	      $pseudo ? "run_enabled_exit ${physical} ${interface}" : "run_enabled_exit ${physical} ${interface} ${table}"
+	    );
+
 	emit_started_message( '', 2, $pseudo, $table, $number );
 
 	if ( get_interface_option( $interface, 'used_address_variable' ) || get_interface_option( $interface, 'used_gateway_variable' ) ) {
@@ -1233,7 +1236,9 @@ CEOF
 		  "qt \$TC qdisc del dev $physical ingress\n" ) if $tcdevices->{$interface};
 	}
 
-	emit( "echo 1 > \${VARDIR}/${physical}.status" );
+	emit( "echo 1 > \${VARDIR}/${physical}.status",
+	      $pseudo ? "run_disabled_exit ${physical} ${interface}" : "run_disabled_exit ${physical} ${interface} ${table}"
+	    );
 
 	if ( $pseudo ) {
 	    emit( "progress_message2 \"   Optional Interface $table stopped\"" );

Shorewall/Perl/Shorewall/Rules.pm

@@ -216,6 +216,10 @@ our %statetable;
 # Tracks which of the state match actions (action.Invalid, etc.) that is currently being expanded
 #
 our $statematch;
+#
+# Remembers NAT-oriented columns from top-level action invocations
+#
+our %nat_columns;
 
 #
 # Action/Inline options
@@ -384,6 +388,8 @@ sub initialize( $ ) {
 	                  );
     }
 
+    %nat_columns = ( dest => '-', proto => '-', ports => '-' );
+
     ############################################################################
     # Initialize variables moved from the Tc module in Shorewall 5.0.7         #
     ############################################################################
@@ -391,7 +397,7 @@ sub initialize( $ ) {
     %tcdevices = ();
     %tcclasses = ();
     $sticky    = 0;
-    $divertref = 0;    
+    $divertref = 0;
 }
 
 #
@@ -1652,6 +1658,19 @@ sub merge_inline_source_dest( $$ ) {
     $body || '';
 }
 
+#
+# This one is used by perl_action_helper()
+#
+sub merge_action_column( $$ ) {
+    my ( $body, $invocation ) = @_;
+
+    if ( supplied( $body ) && $body ne '-' ) {
+	$body;
+    } else {
+	$invocation;
+    }
+}
+
 sub merge_macro_column( $$ ) {
     my ( $body, $invocation ) = @_;
 
@@ -2510,6 +2529,8 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
     my $exceptionrule = '';
     my $usergenerated;
     my $prerule = '';
+    my %save_nat_columns = %nat_columns;
+    my $generated = 0;
     #
     # Subroutine for handling MARK and CONNMARK.
     #
@@ -2591,32 +2612,30 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 
 	$current_param = $param unless $param eq '' || $param eq 'PARAM';
 
-	my $generated = process_macro( $basictarget,
-				       $chainref,
-				       $rule . $raw_matches,
-				       $matches1,
-				       $target,
-				       $current_param,
-				       $source,
-				       $dest,
-				       $proto,
-				       $ports,
-				       $sports,
-				       $origdest,
-				       $ratelimit,
-				       $user,
-				       $mark,
-				       $connlimit,
-				       $time,
-				       $headers,
-				       $condition,
-				       $helper,
-				       $wildcard );
+	$generated = process_macro( $basictarget,
+				    $chainref,
+				    $rule . $raw_matches,
+				    $matches1,
+				    $target,
+				    $current_param,
+				    $source,
+				    $dest,
+				    $proto,
+				    $ports,
+				    $sports,
+				    $origdest,
+				    $ratelimit,
+				    $user,
+				    $mark,
+				    $connlimit,
+				    $time,
+				    $headers,
+				    $condition,
+				    $helper,
+				    $wildcard );
 
 	$macro_nest_level--;
-
-	return $generated;
-
+	goto EXIT;
     } elsif ( $actiontype & NFQ ) {
 	$action = handle_nfqueue( $param,
 				  1 # Allow 'bypass'
@@ -2688,6 +2707,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 
 	      REDIRECT => sub () {
 		  my $z = $actiontype & NATONLY ? '' : firewall_zone;
+
 		  if ( $dest eq '-' ) {
 		      if ( $family == F_IPV4 ) {
 			  $dest = ( $inchain ) ? '' : join( '', $z, '::' , $ports =~ /[:,]/ ? '' : $ports );
@@ -2816,6 +2836,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 	    }
 	}
     }
+
     #
     # Isolate and validate source and destination zones
     #
@@ -2909,7 +2930,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 	#
 	if ( $destref->{type} & BPORT ) {
 	    unless ( $sourceref->{bridge} eq $destref->{bridge} || single_interface( $sourcezone ) eq $destref->{bridge} ) {
-		return 0 if $wildcard;
+		goto EXIT if $wildcard;
 		fatal_error "Rules with a DESTINATION Bridge Port zone must have a SOURCE zone on the same bridge";
 	    }
 	}
@@ -2924,7 +2945,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 	my $policy = $chainref->{policy};
 
 	if ( $policy eq 'NONE' ) {
-	    return 0 if $wildcard;
+	    goto EXIT if $wildcard;
 	    fatal_error "Rules may not override a NONE policy";
 	}
 	#
@@ -2933,9 +2954,9 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 	if ( $optimize == 1 && $section == NEW_SECTION ) {
 	    my $loglevel = $filter_table->{$chainref->{policychain}}{loglevel};
 	    if ( $loglevel ne '' ) {
-		return 0 if $target eq "${policy}:${loglevel}";
+		goto EXIT if $target eq "${policy}:${loglevel}";
 	    } else {
-		return 0 if $basictarget eq $policy;
+		goto EXIT if $basictarget eq $policy;
 	    }
 	}
 	#
@@ -2980,6 +3001,21 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
     my $actionchain; # Name of the action chain
 
     if ( $actiontype & ACTION ) {
+	#
+	# Save NAT-oriented column contents
+	#
+	@nat_columns{'dest', 'proto', 'ports' } = ( $dest,
+						    $proto eq '-' ? $nat_columns{proto} : $proto,
+						    $ports eq '-' ? $nat_columns{ports} : $ports );
+	#
+	# Push the current column array onto the column stack
+	#
+        my @savecolumns = @columns;
+	#
+	# And store the (modified) columns into the columns array for use by perl_action[_tcp]_helper. We
+	# only need the NAT-oriented columns
+	#
+	@columns = ( undef , undef, $dest, $proto, $ports);
 	#
 	# Handle 'section' option
 	#
@@ -3023,6 +3059,8 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 	}
 
 	$action = $basictarget; # Remove params, if any, from $action.
+
+	@columns = @savecolumns;
     } elsif ( $actiontype & INLINE ) {
 	#
 	# process_inline() will call process_rule() recursively for each rule in the action body
@@ -3039,34 +3077,34 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 
 	$actionresult = 0;
 
-	my $generated = process_inline( $basictarget,
-					$chainref,
-					$prerule . $rule,
-					$matches1 . $raw_matches,
-					$loglevel,
-					$target,
-					$param,
-					$source,
-					$dest,
-					$proto,
-					$ports,
-					$sports,
-					$origdest,
-					$ratelimit,
-					$user,
-					$mark,
-					$connlimit,
-					$time,
-					$headers,
-					$condition,
-					$helper,
-					$wildcard ) || $actionresult;
+	$generated = process_inline( $basictarget,
+				     $chainref,
+				     $prerule . $rule,
+				     $matches1 . $raw_matches,
+				     $loglevel,
+				     $target,
+				     $param,
+				     $source,
+				     $dest,
+				     $proto,
+				     $ports,
+				     $sports,
+				     $origdest,
+				     $ratelimit,
+				     $user,
+				     $mark,
+				     $connlimit,
+				     $time,
+				     $headers,
+				     $condition,
+				     $helper,
+				     $wildcard ) || $actionresult;
 
 	( $actionresult, @columns ) = @$savecolumns;;
 
 	$macro_nest_level--;
 
-	return $generated;
+	goto EXIT;
     }
     #
     # Generate Fixed part of the rule
@@ -3252,7 +3290,14 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 	    unless unreachable_warning( $wildcard || $section == DEFAULTACTION_SECTION, $chainref );
     }
 
-    return 1;
+    $generated = 1;
+
+  EXIT:
+    {
+      %nat_columns = %save_nat_columns;
+    }
+
+    return $generated;
 }
 
 
@@ -3406,27 +3451,60 @@ sub perl_action_helper($$;$$) {
 				 '',                              # CurrentParam
 				 @columns );
     } else {
-	$result = process_rule( $chainref,
-				$matches,
-				$matches1,
-				merge_target( $actions{$action}, $target ),
-				'',                               # Current Param
-				'-',                              # Source
-				'-',                              # Dest
-				'-',                              # Proto
-				'-',                              # Port(s)
-				'-',                              # Source Port(s)
-				'-',                              # Original Dest
-				'-',                              # Rate Limit
-				'-',                              # User
-				'-',                              # Mark
-				'-',                              # Connlimit
-				'-',                              # Time
-				'-',                              # Headers,
-				'-',                              # condition,
-				'-',                              # helper,
-				0,                                # Wildcard
-			      );
+	if ( ( $targets{$target} || 0 ) & NATRULE ) {
+	    $result = process_rule( $chainref,
+				    $matches,
+				    $matches1,
+				    merge_target( $actions{$action}, $target ),
+				    '',                               # Current Param
+				    '-',                              # Source
+				    merge_action_column(              # Dest
+					$columns[2],			      
+					$nat_columns{dest}
+				    ),
+				    merge_action_column(              #Proto
+					$columns[3],
+					$nat_columns{proto}
+				    ),
+				    merge_action_column(              #Ports
+					$columns[4],
+					$nat_columns{ports}),
+				    '-',                              # Source Port(s)
+				    '-',                              # Original Dest
+				    '-',                              # Rate Limit
+				    '-',                              # User
+				    '-',                              # Mark
+				    '-',                              # Connlimit
+				    '-',                              # Time
+				    '-',                              # Headers,
+				    '-',                              # condition,
+				    '-',                              # helper,
+				    0,                                # Wildcard
+		);
+	} else {
+	    $result = process_rule( $chainref,
+				    $matches,
+				    $matches1,
+				    merge_target( $actions{$action}, $target ),
+				    '',                               # Current Param
+				    '-',                              # Source
+				    '-',                              # Dest
+				    '-',                              # Proto
+				    '-',                              # Port(s)
+				    '-',                              # Source Port(s)
+				    '-',                              # Original Dest
+				    '-',                              # Rate Limit
+				    '-',                              # User
+				    '-',                              # Mark
+				    '-',                              # Connlimit
+				    '-',                              # Time
+				    '-',                              # Headers,
+				    '-',                              # condition,
+				    '-',                              # helper,
+				    0,                                # Wildcard
+		);
+	}
+
 	allow_optimize( $chainref );
     }
     #
@@ -3492,7 +3570,8 @@ sub perl_action_tcp_helper($$) {
 				    '-',                              # condition,
 				    '-',                              # helper,
 				    0,                                # Wildcard
-				  );
+		                  );
+
 	    allow_optimize( $chainref );
 	}
 	#
@@ -5286,7 +5365,7 @@ sub process_snat1( $$$$$$$$$$$$ ) {
 	    $interfaces = $1;
 	} elsif ( $dest =~ /^([^:]+):([^:]*)$/ ) {
 	    my ( $one, $two ) = ( $1, $2 );
-	    if ( $2 =~ /\./ || $2 =~ /^%/ ) {
+	    if ( $2 =~ /\./ || $2 =~ /^[+%!]/ ) {
 		$interfaces = $one;
 		$destnets = $two;
 	    } else {
@@ -5642,15 +5721,23 @@ sub process_snat( )
 sub setup_snat( $ ) # Convert masq->snat if true
 {
     my $fn;
+    my $have_masq;
 
-    convert_masq() if $_[0];
-
-    if ( $fn = open_file( 'masq', 1, 1 ) ) {
+    if ( $_[0] ) {
+	convert_masq();
+    } elsif ( $fn = open_file( 'masq', 1, 1 ) ) {
 	first_entry( sub { progress_message2 "$doing $fn..."; require_capability 'NAT_ENABLED' , "a non-empty masq file" , 's'; } );
-	process_one_masq(0) while read_a_line( NORMAL_READ );
-    } elsif ( $fn = open_file( 'snat', 1, 1 ) ) {
-	first_entry( sub { progress_message2 "$doing $fn..."; require_capability 'NAT_ENABLED' , "a non-empty snat file" , 's'; } );
-	process_snat while read_a_line( NORMAL_READ );
+	process_one_masq(0), $have_masq = 1 while read_a_line( NORMAL_READ );
+    }
+
+    unless ( $have_masq ) {
+	#
+	# Masq file empty or didn't exist
+	#
+	if ( $fn = open_file( 'snat', 1, 1 ) ) {
+	    first_entry( sub { progress_message2 "$doing $fn..."; require_capability 'NAT_ENABLED' , "a non-empty snat file" , 's'; } );
+	    process_snat while read_a_line( NORMAL_READ );
+	}
     }
 }
 

Shorewall/Perl/Shorewall/Tc.pm

@@ -1434,7 +1434,7 @@ sub process_tc_filter2( $$$$$$$$$ ) {
 
 	    while ( @sportlist ) {
 		my ( $sport, $smask ) = ( shift @sportlist, shift @sportlist );
-		$rule .= "\\\n   cmp\\( u16 at 0 layer 2 mask $smask eq 0x$sport \\)";
+		$rule .= "\\\n   cmp\\( u16 at 0 layer 2 mask 0x$smask eq 0x$sport \\)";
 		$rule .= ' or' if @sportlist;
 	    }
 

Shorewall/Perl/Shorewall/Zones.pm

@@ -92,7 +92,7 @@ our @EXPORT = ( qw( NOTHING
 		    find_interfaces_by_option
 		    find_interfaces_by_option1
 		    get_interface_option
-                    get_interface_origin
+		    get_interface_origin
 		    interface_has_option
 		    set_interface_option
 		    interface_zone
@@ -114,31 +114,31 @@ our $VERSION = 'MODULEVERSION';
 #     @zones contains the ordered list of zones with sub-zones appearing before their parents.
 #
 #     %zones{<zone1> => {name =>       <name>,
-#                        type =>       <zone type>       FIREWALL, IP, IPSEC, BPORT;
-#                        complex =>    0|1
-#                        super   =>    0|1
-#                        options =>    { in_out  => < policy match string >
-#                                        in      => < policy match string >
-#                                        out     => < policy match string >
-#                                      }
-#                        parents =>    [ <parents> ]      Parents, Children and interfaces are listed by name
-#                        children =>   [ <children> ]
-#                        interfaces => { <interfaces1> => 1, ... }
-#                        bridge =>     <bridge>
-#                        hosts { <type> } => [ { <interface1> => { ipsec   => 'ipsec'|'none'
-#                                                                  options => { <option1> => <value1>
-#                                                                               ...
-#                                                                             }
-#                                                                  hosts   => [ <net1> , <net2> , ... ]
-#                                                                  exclusions => [ <net1>, <net2>, ... ]
-#                                                                  origin   => <where defined>
-#                                                                }
-#                                                <interface2> => ...
-#                                              }
-#                                            ]
-#                       }
-#             <zone2> => ...
-#           }
+#			 type =>       <zone type>	 FIREWALL, IP, IPSEC, BPORT;
+#			 complex =>    0|1
+#			 super	 =>    0|1
+#			 options =>    { in_out	 => < policy match string >
+#					 in	 => < policy match string >
+#					 out	 => < policy match string >
+#				       }
+#			 parents =>    [ <parents> ]	  Parents, Children and interfaces are listed by name
+#			 children =>   [ <children> ]
+#			 interfaces => { <interfaces1> => 1, ... }
+#			 bridge =>     <bridge>
+#			 hosts { <type> } => [ { <interface1> => { ipsec   => 'ipsec'|'none'
+#								   options => { <option1> => <value1>
+#										...
+#									      }
+#								   hosts   => [ <net1> , <net2> , ... ]
+#								   exclusions => [ <net1>, <net2>, ... ]
+#								   origin   => <where defined>
+#								 }
+#						 <interface2> => ...
+#					       }
+#					     ]
+#			}
+#	      <zone2> => ...
+#	    }
 #
 #     $firewall_zone names the firewall zone.
 #
@@ -160,27 +160,27 @@ our %reservedName = ( all => 1,
 #
 #     @interfaces lists the interface names in the order that they appear in the interfaces file.
 #
-#     %interfaces { <interface1> => { name        => <name of interface>
-#                                     root        => <name without trailing '+'>
-#                                     options     => { port => undef|1
-#                                                    { <option1> } => <val1> ,          #See %validinterfaceoptions
-#                                                      ...
-#                                                    }
-#                                     zone        => <zone name>
-#                                     multizone   => undef|1   #More than one zone interfaces through this interface
-#                                     nets        => <number of nets in interface/hosts records referring to this interface>
-#                                     bridge      => <bridge name> # Same as ->{name} if not a bridge port.
-#                                     ports       => <number of port on this bridge>
-#                                     ipsec       => undef|1 # Has an ipsec host group
-#                                     broadcasts  => 'none', 'detect' or [ <addr1>, <addr2>, ... ]
-#                                     number      => <ordinal position in the interfaces file>
-#                                     physical    => <physical interface name>
-#                                     base        => <shell variable base representing this interface>
-#                                     wildcard    => undef|1 # Wildcard Name
-#                                     zones       => { zone1 => 1, ... }
-#                                     origin      => <where defined>
-#                                   }
-#                 }
+#     %interfaces { <interface1> => { name	  => <name of interface>
+#				      root	  => <name without trailing '+'>
+#				      options	  => { port => undef|1
+#						     { <option1> } => <val1> ,		#See %validinterfaceoptions
+#						       ...
+#						     }
+#				      zone	  => <zone name>
+#				      multizone	  => undef|1   #More than one zone interfaces through this interface
+#				      nets	  => <number of nets in interface/hosts records referring to this interface>
+#				      bridge	  => <bridge name> # Same as ->{name} if not a bridge port.
+#				      ports	  => <number of port on this bridge>
+#				      ipsec	  => undef|1 # Has an ipsec host group
+#				      broadcasts  => 'none', 'detect' or [ <addr1>, <addr2>, ... ]
+#				      number	  => <ordinal position in the interfaces file>
+#				      physical	  => <physical interface name>
+#				      base	  => <shell variable base representing this interface>
+#				      wildcard	  => undef|1 # Wildcard Name
+#				      zones	  => { zone1 => 1, ... }
+#				      origin	  => <where defined>
+#				    }
+#		  }
 #
 #    The purpose of the 'base' member is to ensure that the base names associated with the physical interfaces are assigned in
 #    the same order as the interfaces are encountered in the configuration files.
@@ -701,6 +701,40 @@ sub haveipseczones() {
     0;
 }
 
+#
+# Returns 1 if the two interfaces passed are related
+#
+sub interface_match( $$ ) {
+    my ( $piface, $ciface ) = @_;
+
+    return 1 if $piface eq $ciface;
+
+    my ( $pifaceref, $cifaceref ) = @interfaces{$piface, $ciface};
+
+    return 1 if $piface eq $cifaceref->{bridge};
+    return 1 if $ciface eq $pifaceref->{bridge};
+
+    if ( $minroot ) {
+	if ( $piface =~ /\+$/ ) {
+	    my $root    = $pifaceref->{root};
+	    my $rlength = length( $root );
+	    while ( length( $ciface ) >= $rlength ) {
+		return 1 if $ciface eq $root;
+		chop $ciface;
+	    }
+	} elsif ( $ciface =~ /\+$/ ) {
+	    my $root    = $cifaceref->{root};
+	    my $rlength = length( $root );
+	    while ( length( $piface ) >= $rlength ) {
+		return 1 if $piface eq $root;
+		chop $piface;
+	    }
+	}
+    }
+
+    0;
+}
+
 #
 # Report about zones.
 #
@@ -738,7 +772,7 @@ sub zone_report()
 			    if ( $family == F_IPV4 ) {
 				progress_message_nocompress "      $iref->{physical}:$grouplist";
 			    } else {
-				progress_message_nocompress "      $iref->{physical}:<$grouplist>";
+				progress_message_nocompress "      $iref->{physical}:[$grouplist]";
 			    }
 			    $printed = 1;
 			}
@@ -747,6 +781,17 @@ sub zone_report()
 	    }
 	}
 
+      PARENT:
+	for my $p ( @{$zoneref->{parents}} ) {
+	    for my $pi ( keys ( %{$zones{$p}{interfaces}} ) ) {
+		for my $ci ( keys( %{$zoneref->{interfaces}} ) ) {
+		    next PARENT if interface_match( $pi, $ci );
+		}
+	    }
+
+	    warning_message "Zone $zone is defined as a sub-zone of $p, yet the two zones have no interface in common";
+	}
+
 	unless ( $printed ) {
 	    fatal_error "No bridge has been associated with zone $zone" if $type & BPORT && ! $zoneref->{bridge};
 	    warning_message "*** $zone is an EMPTY ZONE ***" unless $type == FIREWALL;
@@ -1575,9 +1620,7 @@ sub known_interface($)
 	#
 	# We have wildcard interfaces -- see if this interface matches one of their roots
 	#
-	while ( length $iface > $minroot ) {
-	    chop $iface;
-
+	while ( length $iface >= $minroot ) {
 	    if ( my $i = $roots{$iface} ) {
 		#
 		# Found one
@@ -1599,6 +1642,8 @@ sub known_interface($)
 		                              };
 		return $interfaceref;
 	    }
+
+	    chop $iface;
 	}
     }
 

Shorewall/Perl/lib.runtime

@@ -421,7 +421,7 @@ restore_default_route() # $1 = USE_DEFAULT_RT
 conditionally_flush_conntrack() {
 
     if [ -n "$g_purge" ]; then
-	if [ -n $(mywhich conntrack) ]; then
+	if [ -n "$(mywhich conntrack)" ]; then
             conntrack -F
 	else
             error_message "WARNING: The '-p' option requires the conntrack utility which does not appear to be installed on this system"
@@ -899,7 +899,7 @@ detect_dynamic_gateway() { # $1 = interface
 #
 # Detect the gateway through an interface
 #
-detect_gateway() # $1 = interface
+detect_gateway() # $1 = interface $2 = table number
 {
     local interface
     interface=$1
@@ -912,6 +912,8 @@ detect_gateway() # $1 = interface
     # Maybe there's a default route through this gateway already
     #
     [ -n "$gateway" ] || gateway=$(find_gateway $($IP -4 route list dev $interface | grep ^default))
+
+    [ -z "$gateway" -a -n "$2" ] && gateway=$(find_gateway $($IP -4 route list dev $interface table $2 | grep ^default))
     #
     # Last hope -- is there a load-balancing route through the interface?
     #

Shorewall/Samples/Universal/shorewall.conf

@@ -205,8 +205,6 @@ MINIUPNPD=No
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX="ko ko.xz"
-
 MULTICAST=No
 
 MUTEX_TIMEOUT=60
@@ -249,6 +247,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall/Samples/one-interface/shorewall.conf

@@ -216,8 +216,6 @@ MINIUPNPD=No
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX="ko ko.xz"
-
 MULTICAST=No
 
 MUTEX_TIMEOUT=60
@@ -260,6 +258,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall/Samples/three-interfaces/shorewall.conf

@@ -213,8 +213,6 @@ MINIUPNPD=No
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX="ko ko.xz"
-
 MULTICAST=No
 
 MUTEX_TIMEOUT=60
@@ -257,6 +255,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall/Samples/two-interfaces/shorewall.conf

@@ -216,8 +216,6 @@ MINIUPNPD=No
 
 MARK_IN_FORWARD_CHAIN=No
 
-MODULE_SUFFIX="ko ko.xz"
-
 MULTICAST=No
 
 MUTEX_TIMEOUT=60
@@ -260,6 +258,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall/actions.std

@@ -25,6 +25,7 @@ Broadcast    noinline,audit	# Handles Broadcast/Anycast
 DNSAmp				# Matches one-question recursive DNS queries
 Drop				# Default Action for DROP policy (deprecated)
 dropBcast    inline		# Silently Drop Broadcast
+dropBcasts    inline		# Silently Drop Broadcast
 dropInvalid  inline		# Drops packets in the INVALID conntrack state
 dropMcast    inline		# Silently Drop Multicast
 dropNotSyn   noinline		# Silently Drop Non-syn TCP packets

Shorewall/configfiles/disabled

@@ -0,0 +1,12 @@
+#
+# Shorewall -- /etc/shorewall/disabled
+#
+# Add commands below that you want executed when an optional
+# interface is successfully disabled using the 'disable' command
+#
+# When the commands are invoked:
+#
+#  $1 contains the physical name of the interface
+#  $2 contains the logical name of the interface
+#  $3 contains the name of the provider associated with the interface,
+      if any

Shorewall/configfiles/enabled

@@ -0,0 +1,12 @@
+#
+# Shorewall -- /etc/shorewall/enabled
+#
+# Add commands below that you want executed when an optional
+# interface is successfully enabled using the 'enable' command
+#
+# When the commands are invoked:
+#
+#  $1 contains the physical name of the interface
+#  $2 contains the logical name of the interface
+#  $3 contains the name of the provider associated with the interface,
+      if any

Shorewall/configfiles/shorewall.conf

@@ -205,8 +205,6 @@ MARK_IN_FORWARD_CHAIN=No
 
 MINIUPNPD=No
 
-MODULE_SUFFIX=ko
-
 MULTICAST=No
 
 MUTEX_TIMEOUT=60
@@ -249,6 +247,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall/install.sh

@@ -616,8 +616,14 @@ run_install $OWNERSHIP -m 0644 params.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/c
 if [ -f ${DESTDIR}${CONFDIR}/$PRODUCT/params ]; then
     chmod 0644 ${DESTDIR}${CONFDIR}/$PRODUCT/params
 else
-    run_install $OWNERSHIP -m 0600 params${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/params
-    echo "Parameter file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/params"
+    case "$SPARSE" in
+	[Vv]ery)
+	;;
+	*)
+	    run_install $OWNERSHIP -m 0600 params${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/params
+	    echo "Parameter file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/params"
+	    ;;
+    esac
 fi
 
 if [ $PRODUCT = shorewall ]; then
@@ -693,10 +699,16 @@ fi
 run_install $OWNERSHIP -m 0644 conntrack           ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
 run_install $OWNERSHIP -m 0644 conntrack.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
 
-if [ ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack ]; then
-    run_install $OWNERSHIP -m 0600 conntrack${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack
-    echo "Conntrack file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack"
-fi
+case "$SPARSE" in
+    [Vv]ery)
+    ;;
+    *)
+	if [ ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack ]; then
+	    run_install $OWNERSHIP -m 0600 conntrack${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack
+	    echo "Conntrack file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack"
+	fi
+	;;
+esac
 
 #
 # Install the Mangle file
@@ -1163,31 +1175,25 @@ fi
 if [ $PRODUCT = shorewall6 ]; then
     make_parent_directory ${DESTDIR}${MANDIR}/man5 0755
 
-    for f in \
-	shorewall-accounting.5.gz  shorewall-ipsets.5.gz   shorewall-providers.5.gz     shorewall-tcclasses.5.gz     \
-	shorewall-actions.5.gz     shorewall-maclist.5.gz                               shorewall-tcdevices.5.gz     \
-	                           shorewall-mangle.5.gz   shorewall-proxyndp.5.gz      shorewall-tcfilters.5.gz     \
-	shorewall-blacklist.5.gz   shorewall-masq.5.gz     shorewall-routes.5.gz        shorewall-tcinterfaces.5.gz  \
-	shorewall-blrules.5.gz     shorewall-modules.5.gz  shorewall-routestopped.5.gz  shorewall-tcpri.5.gz         \
-	shorewall-conntrack.5.gz   shorewall-nat.5.gz      shorewall-rtrules.5.gz       shorewall-tcrules.5.gz       \
-                                   shorewall-nesting.5.gz  shorewall-rules.5.gz         shorewall-tos.5.gz           \
-	shorewall-exclusion.5.gz   shorewall-netmap.5.gz   shorewall-secmarks.5.gz      shorewall-tunnels.5.gz       \
-	shorewall-hosts.5.gz       shorewall-params.5.gz   shorewall-snat.5.gz          shorewall-vardir.5.gz        \
-	shorewall-interfaces.5.gz  shorewall-policy.5.gz   shorewall-stoppedrules.5.gz  shorewall-zones.5.gz
-    do
-	base=$(basename $f);
+    rm -f ${DESTDIR}${MANDIR}/man5/shorewall6*
 
-	case $base in
-	    shorewall-arprules.*|shorewall-ecn.*|shorewall-proxyarp.*)
-	        ;;
-	    *)
-		base6=shorewall6-${base#*-}
-		ln -sf ${MANDIR}/man5/$(basename $f) ${DESTDIR}${MANDIR}/man5/$base6
-		;;
-	esac
+    for f in \
+	shorewall-accounting.5  shorewall-ipsets.5   shorewall-providers.5     shorewall-tcclasses.5     \
+	shorewall-actions.5     shorewall-maclist.5                            shorewall-tcdevices.5     \
+	                        shorewall-mangle.5   shorewall-proxyndp.5      shorewall-tcfilters.5     \
+	shorewall-blacklist.5   shorewall-masq.5     shorewall-routes.5        shorewall-tcinterfaces.5  \
+	shorewall-blrules.5     shorewall-modules.5  shorewall-routestopped.5  shorewall-tcpri.5         \
+	shorewall-conntrack.5   shorewall-nat.5      shorewall-rtrules.5       shorewall-tcrules.5       \
+                                shorewall-nesting.5  shorewall-rules.5         shorewall-tos.5           \
+	shorewall-exclusion.5   shorewall-netmap.5   shorewall-secmarks.5      shorewall-tunnels.5       \
+	shorewall-hosts.5       shorewall-params.5   shorewall-snat.5          shorewall-vardir.5        \
+	shorewall-interfaces.5  shorewall-policy.5   shorewall-stoppedrules.5  shorewall-zones.5
+    do
+	f6=shorewall6-${f#*-}
+	echo ".so man5/$f" > ${DESTDIR}${MANDIR}/man5/$f6
     done
 
-    ln -sf ${MANDIR}/man5/shorewall.conf.5.gz ${DESTDIR}${MANDIR}/man5/shorewall6.conf.5.gz
+    echo ".so man5/shorewall.conf.5" > ${DESTDIR}${MANDIR}/man5/shorewall6.conf.5
 fi
 
 [ -n "$INSTALLD" ] || make_parent_directory ${DESTDIR}${MANDIR}/man8 0755

Shorewall/lib.cli-std

@@ -1556,10 +1556,10 @@ remote_reload_command() # $* = original arguments less the command.
 
 	progress_message "Getting Capabilities on system $system..."
 	if [ $g_family -eq 4 ]; then
-	    if ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IPTABLES=$IPTABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall-lite/shorecap" > $g_shorewalldir/capabilities; then
+	    if ! rsh_command "MODULESDIR=$MODULESDIR IPTABLES=$IPTABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall-lite/shorecap" > $g_shorewalldir/capabilities; then
 	        fatal_error "Capturing capabilities on system $system failed"
 	    fi
-	elif ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IP6TABLES=$IP6TABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall6-lite/shorecap" > $g_shorewalldir/capabilities; then
+	elif ! rsh_command "MODULESDIR=$MODULESDIR IP6TABLES=$IP6TABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall6-lite/shorecap" > $g_shorewalldir/capabilities; then
 	    fatal_error "Capturing capabilities on system $system failed"
 	fi
     fi

Shorewall/manpages/shorewall-interfaces.xml

@@ -104,9 +104,7 @@ loc     eth2            -</programlisting>
           <para>You may use wildcards here by specifying a prefix followed by
           the plus sign ("+"). For example, if you want to make an entry that
           applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
-          ppp1, ppp2, … Please note that the '+' means '<emphasis
-          role="bold">one</emphasis> or more additional characters' so 'ppp'
-          does not match 'ppp+'.</para>
+          ppp1, ppp2, …</para>
 
           <para>When using Shorewall versions before 4.1.4, care must be
           exercised when using wildcards where there is another zone that uses

Shorewall/manpages/shorewall-modules.xml

@@ -51,7 +51,7 @@
 
     <para>The <replaceable>modulename</replaceable> names a kernel module
     (without suffix). Shorewall will search for modules based on your
-    MODULESDIR and MODULE_SUFFIX settings in <ulink
+    MODULESDIR setting in <ulink
     url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(8). The
     <replaceable>moduleoption</replaceable>s are passed to modprobe (if
     installed) or to insmod.</para>

Shorewall/manpages/shorewall-providers.xml

@@ -214,7 +214,14 @@
                 BALANCE_PROVIDERS=Yes, <option>balance=1</option> is assumed
                 unless the <option>fallback</option>, <option>loose</option>,
                 <option>load</option> or <option>tproxy</option> option is
-                specified.</para>
+                specified.I</para>
+
+                <caution>
+                  <para>In IPV6, the <option>balance</option> option does not
+                  cause balanced default routes to be created; it rather
+                  causes a sequence of default routes with different metrics
+                  to be created. </para>
+                </caution>
               </listitem>
             </varlistentry>
 
@@ -337,6 +344,14 @@
                 <para>Prior to Shorewall 4.4.24, the option is ignored with a
                 warning message if USE_DEFAULT_RT=Yes in
                 <filename>shorewall.conf</filename>.</para>
+
+                <caution>
+                  <para>In IPV6, specifying the <option>fallback</option>
+                  option on multiple providers does not cause balanced
+                  fallback routes to be created; it rather causes a sequence
+                  of fallback routes with different metrics to be
+                  created.</para>
+                </caution>
               </listitem>
             </varlistentry>
 

Shorewall/manpages/shorewall-snat.xml

@@ -673,7 +673,7 @@
           address changed to 206.124.146.177.</para>
 
           <programlisting>        #ACTION                 SOURCE          DEST
-        SNAT(206.124.146.177)   -               eth0+myset[dst]</programlisting>
+        SNAT(206.124.146.177)   -               eth0:+myset[dst]</programlisting>
         </listitem>
       </varlistentry>
 

Shorewall/manpages/shorewall.conf.xml

@@ -406,8 +406,9 @@
         <listitem>
           <para>Formerly named AUTO_COMMENT. If set, if there is not a current
           comment when a macro is invoked, the behavior is as if the first
-          line of the macro file was "COMMENT &lt;macro name&gt;". The
-          AUTO_COMMENT option has a default value of 'Yes'.</para>
+          line of the macro file was "COMMENT &lt;macro name&gt;". If not
+          specified, the AUTO_COMMENT option has a default value of
+          'Yes'.</para>
         </listitem>
       </varlistentry>
 
@@ -473,7 +474,7 @@
           command, then the compilation step is skipped and the compiled
           script that executed the last <command>start</command>, <emphasis
           role="bold">reload</emphasis> or <command>restart</command> command
-          is used. The default is AUTOMAKE=No.</para>
+          is used. If not specified, the default is AUTOMAKE=No.</para>
 
           <para>The setting of the AUTOMAKE option is ignored if the
           <command>start</command>, <emphasis role="bold">reload</emphasis> or
@@ -1891,18 +1892,6 @@ LOG:info:,bar                        net                    fw</programlisting>
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term><emphasis role="bold">MODULE_SUFFIX=</emphasis>[<emphasis
-        role="bold">"</emphasis><emphasis>extension</emphasis> ...<emphasis
-        role="bold">"</emphasis>]</term>
-
-        <listitem>
-          <para>The value of this option determines the possible file
-          extensions of kernel modules. The default value is "ko ko.gz ko.xz o
-          o.gz o.xz gz xz".</para>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><emphasis
         role="bold">MODULESDIR=</emphasis>[[+]<emphasis>pathname</emphasis>[<emphasis
@@ -2212,8 +2201,9 @@ LOG:info:,bar                        net                    fw</programlisting>
             </listitem>
           </itemizedlist>
 
-          <para>The default value is zero which disables all
-          optimizations.</para>
+          <para>In versions prior to 5.1.0, the default value is zero which
+          disables all optimizations. Beginning with Shorewall 5.1.0, the
+          default value is All which enables all optimizations.</para>
         </listitem>
       </varlistentry>
 
@@ -3083,6 +3073,40 @@ INLINE          -       -       -       ;; -j REJECT
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><emphasis role="bold">USE_NFLOG_SIZE=</emphasis>[<emphasis
+        role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
+
+        <listitem>
+          <para>Added in Shorewall 5.1.5. The second parameter to the NFLOG
+          target specifies how many bytes of the packet to copy to the log; if
+          omitted or if supplied as zero, the entire packet is copied. This
+          feature has traditionally been implemented using the --nflog-range
+          option to the NFLOG iptables target. Unfortuntely, the --nflog-range
+          option never worked (the entire packet was always copied). To deal
+          with this issue, the Netfilter team:</para>
+
+          <itemizedlist>
+            <listitem>
+              <para>Added a warning message when --nflog-range is used</para>
+            </listitem>
+
+            <listitem>
+              <para>Added --nflog-size which works like --nflog-range was
+              intended to work.</para>
+            </listitem>
+          </itemizedlist>
+
+          <para>When USE_NFLOG_SIZE=Yes, Shorewall will attempt to use the new
+          --nflog-size feature. If that feature is not available in the
+          running kernel and ip[6]tables, an error is raised.</para>
+
+          <para>When USE_NFLOG_SIZE is not supplied, USE_NFLOG_SIZE=No is
+          assumed. When USE_NFLOG_SIZE is added by shorewall update, it is
+          added with setting No.</para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><emphasis role="bold">USE_PHYSICAL_NAMES=</emphasis>[<emphasis
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>

Shorewall6-lite/shorecap

@@ -28,7 +28,7 @@
 #
 #   On the target system (the system where the firewall program is to run):
 #
-#       [ IPTABLES=<iptables binary> ] [ MODULESDIR=<kernel modules directory> ] [ MODULE_SUFFIX="<module suffix list>" ] shorecap > capabilities
+#       [ IPTABLES=<iptables binary> ] [ MODULESDIR=<kernel modules directory> ] shorecap > capabilities
 #
 #    Now move the capabilities file to the compilation system. The file must
 #    be placed in a directory on the CONFIG_PATH to be used when compiling firewalls
@@ -38,7 +38,6 @@
 #
 #        IPTABLES - iptables
 #        MODULESDIR - /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter
-#        MODULE_SUFFIX - "o gz xz ko o.gz o.xz ko.gz ko.xz"
 #
 #    Shorewall need not be installed on the target system to run shorecap. If the '-e' flag is
 #    used during firewall compilation, then the generated firewall program will likewise not

Shorewall6-lite/shorewall6-lite.service

@@ -8,6 +8,7 @@
 Description=Shorewall IPv6 firewall (lite)
 Wants=network-online.target
 After=network-online.target
+After=shorewall-lite.service
 Conflicts=ip6tables.service firewalld.service
 
 [Service]

Shorewall6-lite/shorewall6-lite.service.debian

@@ -7,6 +7,7 @@
 Description=Shorewall IPv6 firewall (lite)
 Wants=network-online.target
 After=network-online.target
+After=shorewall-lite.service
 Conflicts=ip6tables.service firewalld.service
 
 [Service]

Shorewall6/Samples6/Universal/shorewall6.conf

@@ -190,8 +190,6 @@ MARK_IN_FORWARD_CHAIN=No
 
 MINIUPNPD=No
 
-MODULE_SUFFIX="ko ko.xz"
-
 MUTEX_TIMEOUT=60
 
 OPTIMIZE=All
@@ -206,6 +204,8 @@ REQUIRE_INTERFACE=Yes
 
 RESTART=restart
 
+RESTORE_DEFAULT_ROUTE=Yes
+
 RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
@@ -222,6 +222,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall6/Samples6/one-interface/shorewall6.conf

@@ -191,8 +191,6 @@ MARK_IN_FORWARD_CHAIN=No
 
 MINIUPNPD=No
 
-MODULE_SUFFIX="ko ko.xz"
-
 MUTEX_TIMEOUT=60
 
 OPTIMIZE=All
@@ -207,6 +205,8 @@ REQUIRE_INTERFACE=No
 
 RESTART=restart
 
+RESTORE_DEFAULT_ROUTE=Yes
+
 RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
@@ -223,6 +223,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall6/Samples6/three-interfaces/shorewall6.conf

@@ -190,8 +190,6 @@ MARK_IN_FORWARD_CHAIN=No
 
 MINIUPNPD=No
 
-MODULE_SUFFIX="ko ko.xz"
-
 MUTEX_TIMEOUT=60
 
 OPTIMIZE=All
@@ -206,6 +204,8 @@ REQUIRE_INTERFACE=No
 
 RESTART=restart
 
+RESTORE_DEFAULT_ROUTE=Yes
+
 RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
@@ -222,6 +222,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall6/Samples6/two-interfaces/shorewall6.conf

@@ -190,8 +190,6 @@ MARK_IN_FORWARD_CHAIN=No
 
 MINIUPNPD=No
 
-MODULE_SUFFIX="ko ko.xz"
-
 MUTEX_TIMEOUT=60
 
 OPTIMIZE=All
@@ -206,6 +204,8 @@ REQUIRE_INTERFACE=No
 
 RESTART=restart
 
+RESTORE_DEFAULT_ROUTE=Yes
+
 RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
@@ -222,6 +222,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall6/actions.std

@@ -21,6 +21,7 @@ BLACKLIST    logjump,section	# Add sender to the dynamic blacklist
 Broadcast    noinline      	# Handles Broadcast/Anycast
 Drop		        	# Default Action for DROP policy (deprecated)
 dropBcast    inline		# Silently Drop Broadcast
+dropBcasts   inline		# Silently Drop Broadcast
 dropInvalid  inline		# Drops packets in the INVALID conntrack state
 dropMcast    inline		# Silently Drop Multicast
 dropNotSyn   noinline		# Silently Drop Non-syn TCP packets

Shorewall6/configfiles/disabled

@@ -0,0 +1,12 @@
+#
+# Shorewall6 -- /etc/shorewall6/disabled
+#
+# Add commands below that you want executed when an optional
+# interface is successfully disabled using the 'disable' command
+#
+# When the commands are invoked:
+#
+#  $1 contains the physical name of the interface
+#  $2 contains the logical name of the interface
+#  $3 contains the name of the provider associated with the interface,
+      if any

Shorewall6/configfiles/enabled

@@ -0,0 +1,12 @@
+#
+# Shorewall6 -- /etc/shorewall6/enabled
+#
+# Add commands below that you want executed when an optional
+# interface is successfully enabled using the 'enable' command
+#
+# When the commands are invoked:
+#
+#  $1 contains the physical name of the interface
+#  $2 contains the logical name of the interface
+#  $3 contains the name of the provider associated with the interface,
+      if any

Shorewall6/configfiles/shorewall6.conf

@@ -190,8 +190,6 @@ MARK_IN_FORWARD_CHAIN=No
 
 MINIUPNPD=No
 
-MODULE_SUFFIX=ko
-
 MUTEX_TIMEOUT=60
 
 OPTIMIZE=All
@@ -206,6 +204,8 @@ REQUIRE_INTERFACE=No
 
 RESTART=restart
 
+RESTORE_DEFAULT_ROUTE=Yes
+
 RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
@@ -222,6 +222,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall6/shorewall6.service

@@ -7,6 +7,7 @@
 Description=Shorewall IPv6 firewall
 Wants=network-online.target
 After=network-online.target
+After=shorewall.service
 Conflicts=ip6tables.service firewalld.service
 
 [Service]

Shorewall6/shorewall6.service.debian

@@ -8,6 +8,7 @@
 Description=Shorewall IPv6 firewall
 Wants=network-online.target
 After=network-online.target
+After=shorewall.service
 Conflicts=ip6tables.service firewalld.service
 
 [Service]

docs/Documentation_Index.xml

@@ -417,7 +417,8 @@
           <row>
             <entry><ulink url="IPv6Support.html">IPv6 Support</ulink></entry>
 
-            <entry><ulink url="Events.html">Shorewall Events</ulink></entry>
+            <entry><ulink url="SharedConfig.html">Shared Shorewall/Shorewall6
+            Configuration</ulink></entry>
 
             <entry/>
           </row>
@@ -426,8 +427,7 @@
             <entry><ulink url="ISO-3661.html">ISO 3661 Country
             Codes</ulink></entry>
 
-            <entry><ulink url="Shorewall-init.html">Shorewall
-            Init</ulink></entry>
+            <entry><ulink url="Events.html">Shorewall Events</ulink></entry>
 
             <entry/>
           </row>
@@ -436,8 +436,8 @@
             <entry><ulink url="Shorewall_and_Kazaa.html">Kazaa
             Filtering</ulink></entry>
 
-            <entry><ulink url="Shorewall-Lite.html">Shorewall
-            Lite</ulink></entry>
+            <entry><ulink url="Shorewall-init.html">Shorewall
+            Init</ulink></entry>
 
             <entry/>
           </row>
@@ -446,7 +446,8 @@
             <entry><ulink url="kernel.htm">Kernel
             Configuration</ulink></entry>
 
-            <entry/>
+            <entry><ulink url="Shorewall-Lite.html">Shorewall
+            Lite</ulink></entry>
 
             <entry/>
           </row>

docs/Events.xml

@@ -475,10 +475,8 @@ root@gateway:~# </programlisting>
     <section>
       <title>Automatic Blacklisting</title>
 
-      <para>This example is taken from <ulink
-      url="http://www.briandowney.net/blog/2009/08/20/firewalling-brute-force-attempts-with-iptables/">this
-      article</ulink> which explains the nice benefits of this approach. This
-      example is for ssh, but it can be adapted for any application.</para>
+      <para>This example is for ssh, but it can be adapted for any
+      application.</para>
 
       <para>The name SSH has been changed to SSHLIMIT so as not to override
       the Shorewall macro of the same name.</para>

docs/FAQ.xml

@@ -175,8 +175,8 @@
     </section>
 
     <section id="faq76">
-      <title>(FAQ 76) I just upgraded my Debian (Ubuntu, Kubuntu, ...) system
-      and now masquerading doesn't work? What happened?</title>
+      <title>(FAQ 76) I just upgraded my system and now masquerading doesn't
+      work? What happened?</title>
 
       <para><emphasis role="bold">Answer:</emphasis> This happens to people
       who ignore <ulink url="Install.htm#Upgrade_Deb">our advice</ulink> and
@@ -185,7 +185,7 @@
       default settings. Failure to forward traffic (such as during masqueraded
       net access from a local network) usually means that <filename><ulink
       url="manpages/shorewall.conf.html">/etc/shorewall/shorewall.conf</ulink></filename>
-      contains the Debian default setting IP_FORWARDING=Keep; it should be
+      contains the default setting IP_FORWARDING=Keep; it should be
       IP_FORWARDING=On.</para>
 
       <para><emphasis role="bold">Update</emphasis>: Beginning with Shorewall
@@ -776,12 +776,7 @@ SNAT(<emphasis role="bold">130.151.100.69</emphasis>)    192.168.1.0/24  eth1:19
 
           <para>That rule (and the second one in the previous bullet) only
           works of course if you have a static external IP address. If you
-          have a dynamic IP address then include this in
-          <filename>/etc/shorewall/params</filename>.</para>
-
-          <programlisting><command>ETH0_IP=$(find_first_interface_address eth0)</command>        </programlisting>
-
-          <para>and make your DNAT rule:</para>
+          have a dynamic IP address then make your DNAT rule:</para>
 
           <programlisting>#ACTION         SOURCE          DEST            PROTO   DPORT   SPORT   ORIGDEST
 
@@ -793,34 +788,17 @@ SNAT(<emphasis role="bold">130.151.100.69</emphasis>)    192.168.1.0/24  eth1:19
 ?SECTION NEW
 
 DNAT            loc             loc:192.168.1.5 tcp     www     -       <emphasis
-              role="bold">$ETH0_IP</emphasis></programlisting>
+              role="bold">&amp;eth0</emphasis></programlisting>
 
           <para>Using this technique, you will want to configure your
-          DHCP/PPPoE/PPTP/… client to automatically restart Shorewall each
-          time that you get a new IP address.</para>
+          DHCP/PPPoE/PPTP/… client to automatically reload Shorewall each time
+          that you get a new IP address.</para>
 
           <note>
             <para>If your local interface is a bridge, see <link
             linkend="faq2e">FAQ 2e</link> for additional configuration
             steps.</para>
           </note>
-
-          <note>
-            <para>For optional interfaces, use the function <emphasis
-            role="bold">find_first_interface_address_if_any()</emphasis>
-            rather than <emphasis
-            role="bold">find_first_interface_address()</emphasis>. The former
-            will return 0.0.0.0 if the interface has no configured IP address;
-            the latter terminates the calling program.</para>
-          </note>
-
-          <note id="Call">
-            <para>If you run Shorewall-lite on your firewall, you must use the
-            following in the firewall's configuration directory
-            <filename>params</filename> file:</para>
-
-            <programlisting><command>ETH0_IP=$(ssh root@firewall "/sbin/shorewall-lite call find_first_interface_address eth0")</command></programlisting>
-          </note>
         </listitem>
       </itemizedlist>
 
@@ -928,14 +906,8 @@ MASQUERADE     192.168.1.0/24  eth2:192.168.1.2    tcp     www</programlisting>
 
 <emphasis role="bold">DNAT            loc             dmz:192.168.2.4 tcp     80      -       206.124.146.176</emphasis></programlisting>
 
-        <para>If your external IP address is dynamic, then you must do the
-        following:</para>
-
-        <para>In <filename>/etc/shorewall/params</filename>:</para>
-
-        <programlisting><command>ETH0_IP=`find_first_interface_address eth0`</command> </programlisting>
-
-        <para>and make your DNAT rule:</para>
+        <para>If your external IP address is dynamic, then you must make your
+        DNAT rule:</para>
 
         <programlisting>#ACTION         SOURCE          DEST            PROTO   DPORT   SPORT   ORIGDEST
 
@@ -947,7 +919,7 @@ MASQUERADE     192.168.1.0/24  eth2:192.168.1.2    tcp     www</programlisting>
 ?SECTION NEW
 
 DNAT            loc             dmz:192.168.2.4 tcp     80      -       <emphasis
-            role="bold">$ETH0_IP</emphasis></programlisting>
+            role="bold">&amp;eth0</emphasis></programlisting>
 
         <warning>
           <para>With dynamic IP addresses, you probably don't want to use
@@ -956,21 +928,6 @@ DNAT            loc             dmz:192.168.2.4 tcp     80      -       <emphasi
           save</command> and <command>shorewall[-lite]
           restore</command></ulink>.</para>
         </warning>
-
-        <note>
-          <para>For optional interfaces, use the function <emphasis
-          role="bold">find_first_interface_address_if_any()</emphasis> rather
-          than <emphasis
-          role="bold">find_first_interface_address()</emphasis>. The former
-          will return 0.0.0.0 if the interface has no configured IP address;
-          the latter terminates the calling program.</para>
-        </note>
-
-        <note>
-          <para>If you use Shorewall-lite, then you need to configure the
-          params file in the firewall's configuration directory as described
-          <link linkend="Call">above</link>.</para>
-        </note>
       </section>
 
       <section id="faq2c">

docs/IPv6Support.xml

@@ -24,6 +24,8 @@
 
       <year>2016</year>
 
+      <year>2017</year>
+
       <holder>Thomas M. Eastep</holder>
     </copyright>
 
@@ -537,6 +539,15 @@ ACCEPT          net:wlan0:&lt;2002:ce7c:92b4::3&gt;   $FW             tcp     22
     remote firewalls to allow for central IPv6 firewall administration.</para>
   </section>
 
+  <section>
+    <title>Shared Shorewall/Shorewall6 Configuration Files</title>
+
+    <para>Normally, the configuration files for Shorewall are kept in
+    /etc/shorewall/ and those for Shorewall6 are kept in /etc/shorewall6/. It
+    is possible, however, to share almost all of those files as shown in
+    <ulink url="/SharedConfig.html">this article</ulink>.</para>
+  </section>
+
   <section>
     <title>More information about IPv6</title>
 

docs/Install.xml

@@ -387,7 +387,7 @@
 
             <listitem>
               <para>Directory where the Shorewall Perl modules are installed.
-              Then will be installed in this directory under the sub-directory
+              They will be installed in this directory under the sub-directory
               Shorewall. Default is distribution-specific.</para>
             </listitem>
           </varlistentry>
@@ -597,7 +597,7 @@
           ...</member>
         </simplelist>
 
-        <para>The possible values for option are the same as those shone above
+        <para>The possible values for option are the same as those shown above
         in the shorewallrc file. They may be specified in either upper or
         lower case and may optionally be prefixed by '--'. To facilitate use
         with the rpm %configure script, the following options are
@@ -634,7 +634,7 @@
           </varlistentry>
         </variablelist>
 
-        <para>Note that %configure may dsgenerate option/value pairs that are
+        <para>Note that %configure may generate option/value pairs that are
         incompatible with the <command>configure</command> script. The current
         %configure macro is:</para>
 

docs/MultiISP.xml

@@ -2246,14 +2246,6 @@ net      eth1         detect          <emphasis role="bold">optional</emphasis><
             contains the link configurations. That file is included by
             <filename>/etc/foolsm/foolsm.conf</filename>.</para>
           </listitem>
-
-          <listitem>
-            <para>The script run by FOOLSM during state change
-            (<filename>/etc/foolsm/script) </filename>writes a<filename>
-            ${VARDIR}/xxx.status</filename> file when the status of an
-            interface changes. Those files are read by the
-            <filename>isusable</filename> extension script (see below).</para>
-          </listitem>
         </itemizedlist>
 
         <para>Below are my relevant configuration files.</para>
@@ -2278,6 +2270,11 @@ COM_IF=eth1</programlisting>
 
 return $status</programlisting>
 
+        <para>Note that the above script overrides the normal behavior of
+        <emphasis>persistent</emphasis> providers, in that it prevents the
+        attempt to enable the provider during <command>start</command>,
+        <command>restart</command> and <command>reload</command>.</para>
+
         <para><filename>/etc/shorewall/lib.private</filename>:</para>
 
         <programlisting>###############################################################################

docs/SharedConfig.xml

@@ -0,0 +1,979 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<article>
+  <!--$Id$-->
+
+  <articleinfo>
+    <title>Shared Shorewall and Shorewall6 Configuration</title>
+
+    <authorgroup>
+      <author>
+        <firstname>Tom</firstname>
+
+        <surname>Eastep</surname>
+      </author>
+    </authorgroup>
+
+    <pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
+
+    <copyright>
+      <year>2017</year>
+
+      <holder>Thomas M. Eastep</holder>
+    </copyright>
+
+    <legalnotice>
+      <para>Permission is granted to copy, distribute and/or modify this
+      document under the terms of the GNU Free Documentation License, Version
+      1.2 or any later version published by the Free Software Foundation; with
+      no Invariant Sections, with no Front-Cover, and with no Back-Cover
+      Texts. A copy of the license is included in the section entitled
+      <quote><ulink url="GnuCopyright.htm">GNU Free Documentation
+      License</ulink></quote>.</para>
+    </legalnotice>
+  </articleinfo>
+
+  <section>
+    <title>Introduction</title>
+
+    <para>Netfilter separates management of IPv4 and IPv6 configurations. Each
+    address family has its own utility (iptables and ip6tables), and changes
+    made to the configuration of one address family do not affect the other.
+    While Shorewall also separates the address families in this way, it is
+    possible for Shorewall and Shorewall6 to share almost all of the
+    configuration files. This article gives an example.</para>
+
+    <caution>
+      <para>What is shown here currently works best with Debian and
+      derivatives, or when the tarball installer is used and the SPARSE option
+      is enabled when running configure[.pl].</para>
+    </caution>
+  </section>
+
+  <section>
+    <title>Environment</title>
+
+    <para>In this example, each address family has two Internet interfaces.
+    Both address families share a fast uplink (eth0) that has a single public
+    IPv4 address, but can delegate IPv6 subnets to the Shorewall-based router.
+    Both address families also have a production uplink. For IPv4, Ethernet is
+    used (eth1) and supports the public IPv4 subnet 70.90.191.120/29. For
+    IPv6, a Hurricane Electric 6in4 tunnel is used (sit1), which provides the
+    public IPv6 subnet 2001:470:b:227::/64. The router also has two bridges. A
+    DMZ bridge (br0) provides access to containers running a web server, a
+    mail exchanger, and an IMAPS mail access server. The second bridge (br1)
+    provides access to a container running irssi under screen, allowing
+    constant access to and monitoring of IRC channels.</para>
+  </section>
+
+  <section>
+    <title>Configuration</title>
+
+    <para>Here are the contents of /etc/shorewall/ and /etc/shorewal6/:</para>
+
+    <programlisting>root@gateway:/etc# ls -l shorewall shorewall6
+shorewall:
+total 88
+-rw-r--r-- 1 root root  201 Mar 19 08:43 action.Mirrors
+-rw-r--r-- 1 root root  109 Jun 29 15:13 actions
+-rw-r--r-- 1 root root  655 Jun 29 15:13 conntrack
+-rw-r--r-- 1 root root  107 Jul  1 10:40 hosts
+-rw-r--r-- 1 root root  867 Jul  1 10:50 interfaces
+-rw-r--r-- 1 root root  107 Jun 29 15:14 isusable
+-rw-r--r-- 1 root root  497 Jul  1 10:42 mangle
+-rw-r--r-- 1 root root    7 Jul  6 09:24 masq
+-rw-r--r-- 1 root root 1290 Jun 29 15:16 mirrors
+-rw-r--r-- 1 root root 2650 Jul  2 08:05 params
+-rw-r--r-- 1 root root  645 Jun 28 10:04 policy
+-rw-r--r-- 1 root root 1828 Jul  1 15:43 providers
+-rw-r--r-- 1 root root  398 Mar 18 20:18 proxyarp
+-rw-r--r-- 1 root root  702 Jul  1 10:42 rtrules
+-rw-r--r-- 1 root root 6214 Jul  2 08:45 rules
+lrwxrwxrwx 1 root root   29 Jul  6 12:42 shorewall6.conf -&gt; ../shorewall6/shorewall6.conf
+-rw-r--r-- 1 root root 5571 Jun 25 18:09 shorewall.conf
+-rw-r--r-- 1 root root 1084 Jul  1 10:42 snat
+-rw-r--r-- 1 root root  181 Jun 29 15:12 started
+-rw-r--r-- 1 root root  437 Jun 28 10:45 tunnels
+-rw-r--r-- 1 root root  928 Jun 29 08:25 zones
+
+shorewall6:
+total 12
+-rw------- 1 root root  954 Jul  6 12:48 conntrack
+lrwxrwxrwx 1 root root   20 Jul  6 16:35 mirrors -&gt; ../shorewall/mirrors
+lrwxrwxrwx 1 root root   19 Jul  6 12:48 params -&gt; ../shorewall/params
+-rw-r--r-- 1 root root 5328 Jul  6 12:45 shorewall6.conf
+root@gateway:/etc# </programlisting>
+
+    <para>The various configuration files are described in the sections that
+    follow. Note that in all cases, these files use the <ulink
+    url="/configuration_file_basics.htm#Pairs">alternate format for column
+    specification</ulink>.</para>
+
+    <section>
+      <title>shorewall.conf and shorewall6.conf</title>
+
+      <para>These are the only files that are not shared between the two
+      address families. The key setting is CONFIG_PATH in
+      shorewall6.conf:</para>
+
+      <programlisting>CONFIG_PATH="<emphasis role="bold">${CONFDIR}/shorewall:</emphasis>/usr/share/shorewall6:${SHAREDIR}/shorewall"</programlisting>
+
+      <para><filename>/etc/shorewall6/</filename> is only used for processing
+      the <filename>params</filename> and <filename>shorewall6.conf</filename>
+      files. <filename>/etc/shorewall6/conntrack</filename> is installed when
+      SPARSE=Yes, but is not used.</para>
+
+      <para>The /etc/shorewall/shorewall6.conf symbolic link is required once
+      the above CONFIG_PATH setting is in effect.</para>
+
+      <section>
+        <title>shorewall.conf</title>
+
+        <para>The contents of /etc/shorewall/shorewall.conf are as
+        follows:</para>
+
+        <programlisting>###############################################################################
+#		       S T A R T U P   E N A B L E D
+###############################################################################
+STARTUP_ENABLED=Yes
+###############################################################################
+#			     V E R B O S I T Y
+###############################################################################
+VERBOSITY=1
+###############################################################################
+#			        P A G E R
+###############################################################################
+PAGER=pager
+###############################################################################
+#			     F I R E W A L L
+###############################################################################
+FIREWALL=
+###############################################################################
+#			       L O G G I N G
+###############################################################################
+LOG_LEVEL="NFLOG(0,64,1)"
+BLACKLIST_LOG_LEVEL="none"
+INVALID_LOG_LEVEL=
+LOG_BACKEND=netlink
+LOG_MARTIANS=Yes
+LOG_VERBOSITY=1
+LOGALLNEW=
+LOGFILE=/var/log/ulogd/ulogd.syslogemu.log
+LOGFORMAT=": %s %s"
+LOGTAGONLY=Yes
+LOGLIMIT="s:5/min"
+MACLIST_LOG_LEVEL="$LOG_LEVEL"
+RELATED_LOG_LEVEL="$LOG_LEVEL:,related"
+RPFILTER_LOG_LEVEL="$LOG_LEVEL:,rpfilter"
+SFILTER_LOG_LEVEL="$LOG_LEVEL"
+SMURF_LOG_LEVEL="$LOG_LEVEL"
+STARTUP_LOG=/var/log/shorewall-init.log
+TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
+UNTRACKED_LOG_LEVEL=
+###############################################################################
+#	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
+###############################################################################
+ARPTABLES=
+CONFIG_PATH="/etc/shorewall:/usr/share/shorewall:/usr/share/shorewall/Shorewall"
+GEOIPDIR=/usr/share/xt_geoip/LE
+IPTABLES=/sbin/iptables
+IP=/sbin/ip
+IPSET=
+LOCKFILE=/var/lib/shorewall/lock
+MODULESDIR="+extra/RTPENGINE"
+NFACCT=
+PATH="/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin"
+PERL=/usr/bin/perl
+RESTOREFILE=
+SHOREWALL_SHELL=/bin/sh
+SUBSYSLOCK=
+TC=
+###############################################################################
+#		D E F A U L T   A C T I O N S / M A C R O S
+###############################################################################
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="NotSyn(DROP):$LOG_LEVEL"
+DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
+###############################################################################
+#			 R S H / R C P	C O M M A N D S
+###############################################################################
+RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
+###############################################################################
+#			F I R E W A L L	  O P T I O N S
+###############################################################################
+ACCOUNTING=Yes
+ACCOUNTING_TABLE=mangle
+ADD_IP_ALIASES=No
+ADD_SNAT_ALIASES=No
+ADMINISABSENTMINDED=Yes
+AUTOCOMMENT=Yes
+AUTOHELPERS=No
+AUTOMAKE=Yes
+BALANCE_PROVIDERS=No
+BASIC_FILTERS=No
+BLACKLIST="NEW,INVALID,UNTRACKED"
+CLAMPMSS=Yes
+CLEAR_TC=Yes
+COMPLETE=No
+DEFER_DNS_RESOLUTION=No
+DELETE_THEN_ADD=No
+DETECT_DNAT_IPADDRS=No
+DISABLE_IPV6=No
+DOCKER=No
+DONT_LOAD="nf_nat_sip,nf_conntrack_sip,nf_conntrack_h323,nf_nat_h323"
+DYNAMIC_BLACKLIST="ipset-only,disconnect,timeout=7200"
+EXPAND_POLICIES=Yes
+EXPORTMODULES=Yes
+FASTACCEPT=Yes
+FORWARD_CLEAR_MARK=Yes
+HELPERS="ftp,irc"
+IGNOREUNKNOWNVARIABLES=No
+IMPLICIT_CONTINUE=No
+INLINE_MATCHES=Yes
+IPSET_WARNINGS=Yes
+IP_FORWARDING=Yes
+KEEP_RT_TABLES=Yes
+LOAD_HELPERS_ONLY=Yes
+MACLIST_TABLE=filter
+MACLIST_TTL=60
+MANGLE_ENABLED=Yes
+MAPOLDACTIONS=No
+MARK_IN_FORWARD_CHAIN=No
+MINIUPNPD=Yes
+MODULE_SUFFIX="ko ko.xz"
+MULTICAST=No
+MUTEX_TIMEOUT=60
+NULL_ROUTE_RFC1918=unreachable
+OPTIMIZE=All
+OPTIMIZE_ACCOUNTING=No
+PERL_HASH_SEED=12345
+REJECT_ACTION=
+REQUIRE_INTERFACE=No
+RESTART=restart
+RESTORE_DEFAULT_ROUTE=No
+RESTORE_ROUTEMARKS=Yes
+RETAIN_ALIASES=No
+ROUTE_FILTER=No
+SAVE_ARPTABLES=No
+SAVE_IPSETS=ipv4
+TC_ENABLED=No
+TC_EXPERT=No
+TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
+TRACK_PROVIDERS=Yes
+TRACK_RULES=No
+USE_DEFAULT_RT=Yes
+USE_NFLOG_SIZE=No
+USE_PHYSICAL_NAMES=Yes
+USE_RT_NAMES=Yes
+VERBOSE_MESSAGES=No
+WARNOLDCAPVERSION=Yes
+WORKAROUNDS=No
+ZERO_MARKS=Yes
+ZONE2ZONE=-
+###############################################################################
+#			P A C K E T   D I S P O S I T I O N
+###############################################################################
+BLACKLIST_DISPOSITION=DROP
+INVALID_DISPOSITION=CONTINUE
+MACLIST_DISPOSITION=ACCEPT
+RELATED_DISPOSITION=REJECT
+RPFILTER_DISPOSITION=DROP
+SMURF_DISPOSITION=DROP
+SFILTER_DISPOSITION=DROP
+TCP_FLAGS_DISPOSITION=DROP
+UNTRACKED_DISPOSITION=DROP
+################################################################################
+#			P A C K E T  M A R K  L A Y O U T
+################################################################################
+TC_BITS=8
+PROVIDER_BITS=2
+PROVIDER_OFFSET=16
+MASK_BITS=8
+ZONE_BITS=0
+</programlisting>
+      </section>
+
+      <section>
+        <title>shorewall6.conf</title>
+
+        <para>The contents of /etc/shorewall6/shorewall6.conf are:</para>
+
+        <programlisting>###############################################################################
+#		       S T A R T U P   E N A B L E D
+###############################################################################
+STARTUP_ENABLED=Yes
+###############################################################################
+#			     V E R B O S I T Y
+###############################################################################
+VERBOSITY=1
+###############################################################################
+#			        P A G E R
+###############################################################################
+PAGER=pager
+###############################################################################
+#			     F I R E W A L L
+###############################################################################
+FIREWALL=
+###############################################################################
+#			       L O G G I N G
+###############################################################################
+LOG_LEVEL="NFLOG(0,64,1)"
+BLACKLIST_LOG_LEVEL="none"
+INVALID_LOG_LEVEL=
+LOG_BACKEND=netlink
+LOG_VERBOSITY=2
+LOGALLNEW=
+LOGFILE=/var/log/ulogd/ulogd.syslogemu.log
+LOGFORMAT="%s %s "
+LOGLIMIT="s:5/min"
+LOGTAGONLY=Yes
+MACLIST_LOG_LEVEL="$LOG_LEVEL"
+RELATED_LOG_LEVEL=
+RPFILTER_LOG_LEVEL="$LOG_LEVEL"
+SFILTER_LOG_LEVEL="$LOG_LEVEL"
+SMURF_LOG_LEVEL="$LOG_LEVEL"
+STARTUP_LOG=/var/log/shorewall6-init.log
+TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL"
+UNTRACKED_LOG_LEVEL=
+###############################################################################
+#	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
+###############################################################################
+CONFIG_PATH="${CONFDIR}/shorewall:/usr/share/shorewall6:${SHAREDIR}/shorewall"
+GEOIPDIR=/usr/share/xt_geoip/LE
+IP6TABLES=
+IP=
+IPSET=
+LOCKFILE=
+MODULESDIR="+extra/RTPENGINE"
+NFACCT=
+PERL=/usr/bin/perl
+PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
+RESTOREFILE=restore
+SHOREWALL_SHELL=/bin/sh
+SUBSYSLOCK=/var/lock/subsys/shorewall6
+TC=
+###############################################################################
+#		D E F A U L T   A C T I O N S / M A C R O S
+###############################################################################
+ACCEPT_DEFAULT="none"
+BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
+DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
+###############################################################################
+#			 R S H / R C P	C O M M A N D S
+###############################################################################
+RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
+###############################################################################
+#			F I R E W A L L	  O P T I O N S
+###############################################################################
+ACCOUNTING=Yes
+ACCOUNTING_TABLE=mangle
+ADMINISABSENTMINDED=Yes
+AUTOCOMMENT=Yes
+AUTOHELPERS=Yes
+AUTOMAKE=Yes
+BALANCE_PROVIDERS=No
+BASIC_FILTERS=No
+BLACKLIST="NEW,INVALID,UNTRACKED"
+CLAMPMSS=Yes
+CLEAR_TC=No
+COMPLETE=No
+DEFER_DNS_RESOLUTION=Yes
+DELETE_THEN_ADD=No
+DONT_LOAD=
+DYNAMIC_BLACKLIST="ipset-only,disconnect,timeout=7200"
+EXPAND_POLICIES=Yes
+EXPORTMODULES=Yes
+FASTACCEPT=Yes
+FORWARD_CLEAR_MARK=Yes
+HELPERS=
+IGNOREUNKNOWNVARIABLES=No
+IMPLICIT_CONTINUE=No
+INLINE_MATCHES=No
+IPSET_WARNINGS=Yes
+IP_FORWARDING=Keep
+KEEP_RT_TABLES=Yes
+LOAD_HELPERS_ONLY=Yes
+MACLIST_TABLE=filter
+MACLIST_TTL=
+MANGLE_ENABLED=Yes
+MARK_IN_FORWARD_CHAIN=No
+MINIUPNPD=Yes
+MODULE_SUFFIX=ko
+MUTEX_TIMEOUT=60
+OPTIMIZE=All
+OPTIMIZE_ACCOUNTING=No
+PERL_HASH_SEED=0
+REJECT_ACTION=
+REQUIRE_INTERFACE=No
+RESTART=restart
+RESTORE_DEFAULT_ROUTE=Yes
+RESTORE_ROUTEMARKS=Yes
+SAVE_IPSETS=No
+TC_ENABLED=Shared
+TC_EXPERT=No
+TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
+TRACK_PROVIDERS=Yes
+TRACK_RULES=No
+USE_DEFAULT_RT=Yes
+USE_NFLOG_SIZE=No
+USE_PHYSICAL_NAMES=No
+USE_RT_NAMES=No
+VERBOSE_MESSAGES=Yes
+WARNOLDCAPVERSION=Yes
+WORKAROUNDS=No
+ZERO_MARKS=No
+ZONE2ZONE=-
+###############################################################################
+#			P A C K E T   D I S P O S I T I O N
+###############################################################################
+BLACKLIST_DISPOSITION=DROP
+INVALID_DISPOSITION=CONTINUE
+MACLIST_DISPOSITION=REJECT
+RELATED_DISPOSITION=REJECT
+SFILTER_DISPOSITION=DROP
+RPFILTER_DISPOSITION=DROP
+SMURF_DISPOSITION=DROP
+TCP_FLAGS_DISPOSITION=DROP
+UNTRACKED_DISPOSITION=DROP
+################################################################################
+#			P A C K E T  M A R K  L A Y O U T
+################################################################################
+TC_BITS=8
+PROVIDER_BITS=2
+PROVIDER_OFFSET=8
+MASK_BITS=8
+ZONE_BITS=0
+</programlisting>
+      </section>
+    </section>
+
+    <section>
+      <title>params</title>
+
+      <para>Because addresses and interfaces are different between the two
+      address families, they cannot be hard-coded in the configuration files.
+      <filename>/etc/shorewall/params</filename> is used to set shell
+      variables whose contents will vary between Shorewall and Shorewall6. In
+      the <filename>params</filename> file and in run-time extension files,
+      the shell variable <emphasis role="bold">g_family</emphasis> can be used
+      to determine which address family to use; if IPv4, then $g_family will
+      expand to 4 and if IPv6, $g_family will expand to 6.</para>
+
+      <para>The contents of /etc/shorewall/params is as follows:</para>
+
+      <programlisting>INCLUDE mirrors #Sets the MIRRORS variable for the Mirrors action
+
+#
+# Set compile-time variables depending on the address family
+#
+if [ $g_family = 4 ]; then
+    #
+    # IPv4 compilation
+    #
+    FALLBACK=Yes	   # Make FAST_IF the primary and PROD_IF the fallback interface
+			   # See /etc/shorewall/providers
+    STATISTICAL=No	   # Don't use statistical load balancing
+    LISTS=70.90.191.124	   # IP address of lists.shorewall.net (MX)
+    MAIL=70.90.191.122	   # IP address of mail.shorewall.net  (IMAPS)
+    SERVER=70.90.191.125   # IP address of www.shorewall.org
+    PROXY=Yes		   # Use TPROXY for local web access
+    ALL=0.0.0.0/0	   # Entire address space
+    LOC_ADDR=172.20.1.253  # IP address of the local LAN interface
+    FAST_GATEWAY=10.2.10.1 # Default gateway through the IF_FAST interface
+    FAST_MARK=0x20000	   # Multi-ISP mark setting for IF_FAST
+    #
+    # Interface Options
+    #
+    LOC_OPTIONS=dhcp,ignore=1,wait=5,routefilter,routeback,tcpflags=0,nodbl,physical=eth2
+    FAST_OPTIONS=optional,dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0,arp_ignore=1,proxyarp=0,upnp,nosmurfs,physical=eth0
+    PROD_OPTIONS=optional,dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0,arp_ignore=1,proxyarp=0,upnp,nosmurfs,physical=eth1
+    DMZ_OPTIONS=routeback,proxyarp=1,required,wait=30,nets=70.90.191.120/29,dhcp,nodbl,physical=br0
+    IRC_OPTIONS=routeback,proxyarp=1,required,wait=30,nets=172.20.2.0/24,dhcp,nodbl,physical=br1
+else
+    #
+    # IPv6 compilation
+    #
+    FALLBACK=Yes			      # Make FAST_IF the primary and PROD_IF the fallback interface
+					      # See /etc/shorewall/providers
+    STATISTICAL=No			      # Don't use statistical load balancing
+    LISTS=[2001:470:b:227::42]		      # IP address of lists.shorewall.net (MX and HTTPS)
+    MAIL=[2001:470:b:227::45]		      # IP address of mail.shorewall.net  (IMAPS and HTTPS)
+    SERVER=[2001:470:b:227::43]		      # IP address of www.shorewall.org   (HTTP, FTP and RSYNC)
+    PROXY=
+    ALL=[::]/0				      # Entire address space
+    LOC_ADDR=[2601:601:8b00:bf0::1]	      # IP address of the local LAN interface
+    FAST_GATEWAY=fe80::22e5:2aff:feb7:f2cf    # Default gateway through the IF_FAST interface
+    FAST_MARK=0x100			      # Multi-ISP mark setting for IF_FAST
+    #
+    # Interface Options
+    #
+    PROD_OPTIONS=forward=1,optional,physical=sit1
+    FAST_OPTIONS=forward=1,optional,dhcp,upnp,physical=eth0
+    LOC_OPTIONS=forward=1,nodbl,routeback,physical=eth2
+    DMZ_OPTIONS=routeback,forward=1,required,wait=30,nodbl,physical=br0
+    IRC_OPTIONS=routeback,forward=1,required,wait=30,nodbl,physical=br1
+fi
+</programlisting>
+    </section>
+
+    <section>
+      <title>zones</title>
+
+      <para>Here is the /etc/shorewall/zones file:</para>
+
+      <programlisting>#ZONE	TYPE	OPTIONS			IN			OUT
+#					OPTIONS			OPTIONS
+#
+# By using the 'ip' type, both Shorewall and Shorewall6 can share this file
+#
+fw	{ TYPE=firewall }
+net	{ TYPE=ip }
+loc	{ TYPE=ip }
+dmz	{ TYPE=ip }
+apps	{ TYPE=ip }
+vpn1	{ TYPE=ipsec, OPTIONS=mode=tunnel,proto=esp }
+</programlisting>
+    </section>
+
+    <section>
+      <title>interfaces</title>
+
+      <para>/etc/shorewall/interfaces makes heavy use of variables set in
+      /etc/shorewall/params:</para>
+
+      <programlisting>#
+# LOC_IF is the local LAN for both families
+# FAST_IF is a Comcast IPv6 beta uplink which is used for internet access from the local lan for both families
+# PROD_IF is the interface used by shorewall.org servers
+#     For IPv4, it is eth1
+#     For IPv6, it is sit1 (Hurricane Electric 6in4 link)
+# DMZ_IF is a bridge to the production containers
+# IRC_IF is a bridge to a container that currently runs irssi under screen
+
+loc  { INTERFACE=LOC_IF,  OPTIONS=$LOC_OPTIONS }
+net  { INTERFACE=FAST_IF, OPTIONS=$FAST_OPTIONS }
+net  { INTERFACE=PROD_IF, OPTIONS=$PROD_OPTIONS }
+dmz  { INTERFACE=DMZ_IF,  OPTIONS=$DMZ_OPTIONS }
+apps { INTERFACE=IRC_IF,  OPTIONS=$IRC_OPTIONS }</programlisting>
+    </section>
+
+    <section>
+      <title>hosts</title>
+
+      <para>/etc/shorewall/hosts is used to define the vpn zone:</para>
+
+      <programlisting>#ZONE		HOSTS				OPTIONS
+vpn1 { HOSTS=PROD_IF:$ALL }
+vpn1 { HOSTS=FAST_IF:$ALL }
+vpn1 { HOSTS=LOC_IF:$ALL }
+</programlisting>
+    </section>
+
+    <section>
+      <title>policy</title>
+
+      <para>The same set of policies apply to both address families:</para>
+
+      <programlisting>#SOURCE         DEST            POLICY					LOGLEVEL		RATE
+$FW { DEST=dmz,net, POLICY=REJECT, LOGLEVEL=$LOG_LEVEL }
+$FW { DEST=all, POLICY=ACCEPT }
+loc { DEST=net, POLICY=ACCEPT }
+loc,vpn1,apps { DEST=loc,vpn1,apps POLICY=ACCEPT }
+loc { DEST=fw, POLICY=REJECT, LOGLEVEL=$LOG_LEVEL }
+net { DEST=net, POLICY=NONE }
+net { DEST=fw, POLICY=BLACKLIST:+Broadcast(DROP),Multicast(DROP),DropDNSrep:$LOG_LEVEL, LOGLEVEL=$LOG_LEVEL, RATE=8/sec:30 }
+net { DEST=all, POLICY=BLACKLIST:+DropDNSrep:$LOG_LEVEL, LOGLEVEL=$LOG_LEVEL, RATE=8/sec:30 }
+dmz { DEST=fw, POLICY=REJECT, LOGLEVEL=$LOG_LEVEL }
+all { DEST=all, POLICY=REJECT, LOGLEVEL=$LOG_LEVEL }
+</programlisting>
+    </section>
+
+    <section>
+      <title>providers</title>
+
+      <para>The providers file is set up to allow for three different
+      configurations:</para>
+
+      <orderedlist>
+        <listitem>
+          <para>FALLBACK -- FAST_IF is the primary interface and PROD_IF is
+          the fallback</para>
+        </listitem>
+
+        <listitem>
+          <para>STATISTICAL -- Statistical load balancing between FAST_IF and
+          PROD_IF</para>
+        </listitem>
+
+        <listitem>
+          <para>IPv4 only -- balance between FAST_IF and PROD_IF</para>
+        </listitem>
+      </orderedlist>
+
+      <programlisting>#
+# This could be cleaned up a bit, but I'm leaving it as is for now
+#
+#   - The two address families use different fw mark geometry
+#   - The two address families use different fallback interfaces
+#   - The 'balance' option doesn't work as expected in IPv6 so I have no balance configuration for Shorewall6
+#   - IPv4 uses the 'loose' option on PROD_IF
+#
+?if $FALLBACK
+    # FAST_IF is primary, PROD_IF is fallback
+    #
+    ?info Compiling with FALLBACK
+    IPv6Fast	    { NUMBER=1, MARK=$FAST_MARK, INTERFACE=FAST_IF, GATEWAY=$FAST_GATEWAY, OPTIONS=loose,primary,persistent }
+    ?if __IPV4
+	ComcastB    { NUMBER=4, MARK=0x10000,	 INTERFACE=PROD_IF, GATEWAY=10.1.10.1, OPTIONS=loose,fallback,persistent }
+    ?else    
+	HE	    { NUMBER=2, MARK=0x200,	 INTERFACE=PROD_IF, OPTIONS=fallback,persistent }
+    ?endif
+?elsif $STATISTICAL
+    # Statistically balance traffic between FAST_IF and PROD_IF
+    ?info Compiling with STATISTICAL
+    ?if __IPV4
+    	IPv6Fast    { NUMBER=1, MARK=0x20000, INTERFACE=FAST_IF, GATEWAY=$FAST_GATEWAY, OPTIONS=loose,load=0.66666667,primary }
+    ?else
+	HE	    { NUMBER=2, MARK=0x200,   INTERFACE=PROD_IF,                        OPTIONS=track,load=0.33333333,persistent }
+    ?endif
+?else
+    ?INFO Compiling with BALANCE
+    IPv6Fast	 { NUMBER=1, MARK=0x100,   INTERFACE=eth0,    GATEWAY=$FAST_GATEWAY, OPTIONS=track,balance=2,loose,persistent }
+    ?if __IPV4
+	ComcastB { NUMBER=4, MARK=0x10000, INTERFACE=IPV4_IF, GATEWAY=10.1.10.1,     OPTIONS=nohostroute,loose,balance,persistent }
+    ?else
+        ?warning No BALANCE IPv6 configuration - using FALLBACK  
+	HE	 { NUMBER=2, MARK=0x200,   INTERFACE=PROD_IF,			     OPTIONS=fallback,persistent }
+    ?endif
+?endif
+
+Tproxy   { NUMBER=3, INTERFACE=lo, OPTIONS=tproxy }
+</programlisting>
+    </section>
+
+    <section>
+      <title>rtrules</title>
+
+      <para>The routing rules are quite dependent on the address
+      family:</para>
+
+      <programlisting>#SOURCE             DEST             PROVIDER  PRIORITY
+
+#
+# This file ensures that the DMZ is routed out of the IF_PROD interface
+# and that the IPv6 subnets delegated by the Fast router are routed out
+# of the IF_FAST interface.
+#
+?if __IPV4
+    { SOURCE=70.90.191.121,70.90.191.123, PROVIDER=ComcastB, PRIORITY=1000! }
+    { SOURCE=&amp;FAST_IF,	              	  PROVIDER=IPv6Fast, PRIORITY=1000! }
+    { SOURCE=br0,	     		  PROVIDER=ComcastB, PRIORITY=11000 }
+?else
+    { SOURCE=2001:470:A:227::/64,         PROVIDER=HE,	     PRIORITY=1000! }
+    { SOURCE=2001:470:B:227::/64,         PROVIDER=HE,	     PRIORITY=11000 }
+    { SOURCE=2601:601:8b00:bf0::/60	  PROVIDER=IPv6Fast, PRIORITY=11000 }
+?endif
+</programlisting>
+    </section>
+
+    <section>
+      <title>actions</title>
+
+      <para>/etc/shorewall/actions defines one action:</para>
+
+      <programlisting>#ACTION                         COMMENT
+Mirrors	   	                # Accept traffic from Shorewall Mirrors
+</programlisting>
+
+      <para>/etc/shorewall/action.Mirrors:</para>
+
+      <programlisting>#TARGET SOURCE		DEST      	PROTO	DEST    SOURCE	   ORIGINAL	RATE
+#                       	        	PORT    PORT(S)    DEST		LIMIT
+?COMMENT Accept traffic from Mirrors
+?FORMAT  2
+DEFAULTS -
+$1	$MIRRORS
+</programlisting>
+    </section>
+
+    <section>
+      <title>conntrack</title>
+
+      <para>In addition to invoking the FTP helper on TCP port 21, this file
+      notracks some IPv4 traffic:</para>
+
+      <programlisting>#ACTION			SOURCE		DEST		PROTO	DPORT		SPORT	USER	SWITCH
+
+CT:helper:ftp:P { PROTO=tcp, DPORT=21 }
+CT:helper:ftp:O { PROTO=tcp, DPORT=21 }
+
+?if __IPV4
+    #
+    # Don't track IPv4 broadcasts
+    #
+    NOTRACK:P       { SOURCE=LOC_IF, DEST=172.20.1.255,   PROTO=udp }
+    NOTRACK:P       { DEST=255.255.255.255, 	          PROTO=udp }
+    NOTRACK:O       { DEST=255.255.255.255, 	          PROTO=udp }
+    NOTRACK:O       { DEST=172.20.1.255,    	          PROTO=udp }
+    NOTRACK:O       { DEST=70.90.191.127,                 PROTO=udp }
+?endif
+</programlisting>
+    </section>
+
+    <section>
+      <title>rules</title>
+
+      <para>/etc/shorewall/rules has only a couple of rules that are
+      conditional based on address family:</para>
+
+      <programlisting>#ACTION		SOURCE		DEST		PROTO	DPORT	SPORT	ORIGDEST	RATE	USER	MARK	CONNLIMIT	TIME	HEADERS	SWITCH	HELPER
+
+?SECTION ALL
+
+Ping(ACCEPT)	{ SOURCE=net, DEST=all, RATE=d:ping:2/sec:10 }
+Trcrt(ACCEPT)	{ SOURCE=net, DEST=all, RATE=d:ping:2/sec:10 }
+
+?SECTION ESTABLISHED
+
+?SECTION RELATED
+
+ACCEPT		{ SOURCE=all, DEST=dmz:$SERVER, PROTO=tcp,  DPORT=61001:62000,  helper=ftp }
+ACCEPT		{ SOURCE=dmz, DEST=all,		PROTO=tcp,  helper=ftp }
+ACCEPT		{ SOURCE=all, DEST=net,		PROTO=tcp,  helper=ftp }
+ACCEPT		{ SOURCE=all, DEST=all,		PROTO=icmp }
+RST(ACCEPT)	{ SOURCE=all, DEST=all }
+ACCEPT		{ SOURCE=dmz, DEST=dmz }
+
+?SECTION INVALID
+
+RST(ACCEPT)	{ SOURCE=all, DEST=all }
+DROP		{ SOURCE=net, DEST=all }
+FIN		{ SOURCE=all, DEST=all }
+
+?SECTION UNTRACKED
+
+?if __IPV4
+Broadcast(ACCEPT) { SOURCE=all, DEST=$FW }
+ACCEPT		  { SOURCE=all, DEST=$FW, PROTO=udp }
+CONTINUE	  { SOURCE=loc, DEST=$FW }
+CONTINUE	  { SOURCE=$FW, DEST=all }
+?endif
+
+?SECTION NEW
+
+######################################################################################################
+# Stop certain outgoing traffic to the net
+#
+REJECT:$LOG_LEVEL { SOURCE=loc,vpn1,apps DEST=net, PROTO=tcp, DPORT=25 }		#Stop direct loc-&gt;net SMTP (Comcast uses submission).
+REJECT:$LOG_LEVEL { SOURCE=loc,vpn1,apps DEST=net, PROTO=udp, DPORT=1025:1031 }	#MS Messaging
+
+REJECT		{ SOURCE=all, DEST=net, PROTO=tcp, DPORT=137,445, comment="Stop NETBIOS Crap" }
+REJECT		{ SOURCE=all, DEST=net, PROTO=udp, DPORT=137:139, comment="Stop NETBIOS Crap" }
+
+REJECT		{ SOURCE=all, DEST=net, PROTO=tcp, DPORT=3333, comment="Disallow port 3333" }
+
+REJECT		{ SOURCE=all, DEST=net, PROTO=udp, DPORT=3544, comment="Stop Teredo" }
+
+?COMMENT
+
+######################################################################################################
+# 6in4
+#
+?if __IPV4
+    ACCEPT		    { SOURCE=net:216.218.226.238, DEST=$FW, PROTO=41 }
+    ACCEPT		    { SOURCE=$FW, DEST=net:216.218.226.238, PROTO=41 }
+?endif
+######################################################################################################
+# Ping
+#
+Ping(ACCEPT)	  { SOURCE=$FW,loc,dmz,vpn1, DEST=$FW,loc,dmz,vpn1 }
+Ping(ACCEPT)	  { SOURCE=all,              DEST=net }
+######################################################################################################
+# SSH
+#
+AutoBL(SSH,60,-,-,-,-,$LOG_LEVEL)\
+		  { SOURCE=net,              DEST=all,         PROTO=tcp, DPORT=22 }
+SSH(ACCEPT)	  { SOURCE=all, DEST=all }
+?if __IPV4
+SSH(DNAT-)	  { SOURCE=net,              DEST=172.20.2.44, PROTO=tcp, DPORT=ssh, ORIGDEST=70.90.191.123 }
+?endif
+######################################################################################################
+# DNS
+#
+DNS(ACCEPT)	  { SOURCE=loc,dmz,vpn1,apps, DEST=$FW }
+DNS(ACCEPT)	  { SOURCE=$FW, DEST=net }
+######################################################################################################
+# Traceroute
+#
+Trcrt(ACCEPT)	  { SOURCE=all, DEST=net }
+Trcrt(ACCEPT)	  { SOURCE=net, DEST=$FW,dmz }
+######################################################################################################
+# Email
+#
+SMTP(ACCEPT)	   { SOURCE=net,$FW, DEST=dmz:$LISTS }
+SMTP(ACCEPT)	   { SOURCE=dmz:$LISTS, DEST=net:PROD_IF }
+SMTP(REJECT)	   { SOURCE=dmz:$LISTS, DEST=net }
+IMAPS(ACCEPT)  	   { SOURCE=all, DEST=dmz:$MAIL }
+Submission(ACCEPT) { SOURCE=all, DEST=dmz:$LISTS }
+SMTPS(ACCEPT) 	   { SOURCE=all, DEST=dmz:$LISTS }
+IMAP(ACCEPT)	   { SOURCE=loc,vpn1, DEST=net }
+######################################################################################################
+# NTP
+#
+NTP(ACCEPT)	   { SOURCE=all, DEST=net }
+NTP(ACCEPT)	   { SOURCE=loc,vpn1,dmz,apps DEST=$FW }
+######################################################################################################
+# HTTP/HTTPS
+#
+Web(ACCEPT)	   { SOURCE=loc,vpn1 DEST=$FW }
+Web(ACCEPT)	   { SOURCE=$FW, DEST=net, USER=proxy }
+Web(DROP)	   { SOURCE=net, DEST=fw, PROTO=tcp, comment="Do not blacklist web crawlers" }
+HTTP(ACCEPT)	   { SOURCE=net,loc,vpn1,apps,$FW DEST=dmz:$SERVER,$LISTS }
+HTTPS(ACCEPT)	   { SOURCE=net,loc,vpn1,apps,$FW DEST=dmz:$LISTS,$MAIL }
+Web(ACCEPT)	   { SOURCE=dmz,apps DEST=net,$FW }
+Web(ACCEPT)	   { SOURCE=$FW, DEST=net, USER=root }
+Web(ACCEPT)	   { SOURCE=$FW, DEST=net, USER=teastep }
+######################################################################################################
+# FTP
+#
+FTP(ACCEPT)	   { SOURCE=loc,vpn1,apps DEST=net }
+FTP(ACCEPT)	   { SOURCE=dmz,          DEST=net }
+FTP(ACCEPT)	   { SOURCE=$FW,          DEST=net, USER=root }
+FTP(ACCEPT)	   { SOURCE=all,          DEST=dmz:$SERVER }
+#
+# Some FTP clients seem prone to sending the PORT command split over two packets.
+# This prevents the FTP connection tracking code from processing the command  and setting
+# up the proper expectation.
+#
+# The following rule allows active FTP to work in these cases
+# but logs the connection so I can keep an eye on this potential security hole.
+#
+ACCEPT:$LOG_LEVEL  { SOURCE=dmz, DEST=net, PROTO=tcp, DPORT=1024:, SPORT=20 }
+######################################################################################################
+# whois
+#
+Whois(ACCEPT)	   { SOURCE=all, DEST=net }
+######################################################################################################
+# SMB
+#
+SMBBI(ACCEPT)	    { SOURCE=loc, DEST=$FW }
+SMBBI(ACCEPT)	    { SOURCE=vpn1, DEST=$FW }
+######################################################################################################
+# IRC
+#
+IRC(ACCEPT)	    { SOURCE=loc,vpn1,apps:IRC_IF, DEST=net }
+######################################################################################################
+# Rsync
+#
+Mirrors(ACCEPT:none) { SOURCE=net, DEST=dmz:$SERVER, PROTO=tcp, DPORT=873 }
+</programlisting>
+    </section>
+
+    <section>
+      <title>mangle</title>
+
+      <para>Note that TPROXY can be enabled/disabled via a shell variable
+      setting in /etc/shorewall/params:</para>
+
+      <programlisting>#ACTION		SOURCE		DEST		PROTO	DPORT	SPORT	USER	TEST	LENGTH	TOS	CONNBYTES	HELPER	PROBABILITY	DSCP
+
+?if __IPV4
+    #
+    # I've had a checksum issue with certain IPv4 UDP packets
+    #
+    CHECKSUM:T { DEST=FAST_IF, PROTO=udp }
+    CHECKSUM:T { DEST=DMZ_IF,  PROTO=udp }
+?endif
+
+?if $PROXY
+    #
+    # Use TPROXY for web access from the local LAN
+    #
+    DIVERT:R { PROTO=tcp, SPORT=80 }
+    DIVERT:R { PROTO=tcp, DPORT=80 }
+    TPROXY(3129,$LOC_ADDR) { SOURCE=LOC_IF, PROTO=tcp, DPORT=80 }
+?endif
+</programlisting>
+    </section>
+
+    <section>
+      <title>snat</title>
+
+      <para>NAT entries are quite dependent on the address family:</para>
+
+      <programlisting>#ACTION         SOURCE			DEST            PROTO   PORT   IPSEC  MARK   USER    SWITCH  ORIGDEST   PROBABILITY
+
+?if __IPV4
+    MASQUERADE		{ SOURCE=172.20.1.0/24,172.20.2.0/24, DEST=FAST_IF }
+    MASQUERADE 		{ SOURCE=70.90.191.120/29, 	      DEST=FAST_IF }
+    SNAT(70.90.191.121) { SOURCE=!70.90.191.120/29,	      DEST=PROD_IF,  PROBABILITY=0.50, COMMENT="Masquerade Local Network" }
+    SNAT(70.90.191.123) { SOURCE=!70.90.191.120/29,	      DEST=PROD_IF,                    COMMENT="Masquerade Local Network" }
+    SNAT(172.20.1.253)  { SOURCE=172.20.3.0/24,	 	      DEST=LOC_IF:172.20.1.100 }
+?else
+    SNAT(&amp;PROD_IF)	{ SOURCE=2601:601:8b00:bf0::/60,                DEST=PROD_IF }
+    SNAT(&amp;FAST_IF)	{ SOURCE=2001:470:b:227::/64,2001:470:a:227::2,	DEST=FAST_IF }
+?endif
+</programlisting>
+    </section>
+
+    <section>
+      <title>tunnels</title>
+
+      <para>Both address families define IPSEC tunnels:</para>
+
+      <programlisting>#TYPE			ZONE		GATEWAY			GATEWAY_ZONE
+ipsecnat {ZONE=net,  GATEWAY=$ALL, GATEWAY_ZONE=vpn1 }
+ipsecnat {ZONE=loc,  GATEWAY=$ALL, GATEWAY_ZONE=vpn1 }
+</programlisting>
+    </section>
+
+    <section>
+      <title>proxyarp</title>
+
+      <para>This file is only used in the IPv4 configuration:</para>
+
+      <programlisting>#ADDRESS	INTERFACE	EXTERNAL	HAVEROUTE	PERSISTENT
+
+70.90.191.122 { INTERFACE=br0, EXTERNAL=eth1, HAVEROUTE=yes, PERSISTENT=no }
+</programlisting>
+    </section>
+
+    <section>
+      <title>isuable</title>
+
+      <para>This is just the standard Shorewall isusable extension
+      script:</para>
+
+      <programlisting>local status
+status=0
+
+[ -f ${VARDIR}/${1}.status ] &amp;&amp; status=$(cat ${VARDIR}/${1}.status)
+
+return $status
+</programlisting>
+    </section>
+
+    <section>
+      <title>started</title>
+
+      <para>/etc/shorewall/started only does something in the IPv4
+      configuration, although it gets compiled into both scripts:</para>
+
+      <programlisting>if [ $g_family = 4 ]; then
+    qt $IP -4 route replace 70.90.191.122 dev br0
+    qt $IP -4 route replace 70.90.191.124 dev br0
+    qt $IP -4 route replace 70.90.191.125 dev br0
+fi
+</programlisting>
+    </section>
+  </section>
+</article>

docs/Shorewall-init.xml

@@ -147,7 +147,7 @@
 
     <para>To integrate with NetworkManager and ifup/ifdown, additional steps
     are required. You probably don't want to enable this feature if you run a
-    link status monitor like swping or LSM.</para>
+    link status monitor like FOOLSM.</para>
 
     <orderedlist numeration="loweralpha">
       <listitem>

docs/Shorewall_Squid_Usage.xml

@@ -20,6 +20,8 @@
     <copyright>
       <year>2003-2008</year>
 
+      <year>2017</year>
+
       <holder>Thomas M. Eastep</holder>
     </copyright>
 
@@ -45,6 +47,13 @@
     release.</emphasis></para>
   </caution>
 
+  <caution>
+    <para>If your firewall is dual-stack, there are risks to using either
+    Transparent Proxy or TPROXY. Both break PMTU discovery for local clients
+    and can cause slow page loading and/or inability to connect to some
+    sites.</para>
+  </caution>
+
   <section id="Transparent">
     <title>Squid as a Transparent (Interception) Proxy</title>
 
@@ -417,7 +426,8 @@ Tproxy    1        -        -           lo        -            tproxy</programli
 DIVERT          eth0        0.0.0.0/0   tcp        -           80
 TPROXY(3129)    eth1        0.0.0.0/0   tcp        80</programlisting>
 
-    <para>Corresponding <filename>/etc/shorewall/mangle</filename> are:</para>
+    <para>Corresponding <filename>/etc/shorewall/tcrules</filename>
+    are:</para>
 
     <programlisting>#MARK           SOURCE      DEST        PROTO      DPORT       SPORT
 DIVERT          eth0        0.0.0.0/0   tcp        -           80

docs/Shorewall_and_Aliased_Interfaces.xml

@@ -253,7 +253,7 @@ eth0:0                   192.168.1.0/24 206.124.146.178-206.124.146.180</program
       <filename>/etc/shorewall/snat</filename> is:</para>
 
       <programlisting>#ACTION                              SOURCE          DEST                PROTO   PORT
-SNAT(206.124.146.178-206.24.146.80)  192.168.1.0/24  eth0</programlisting>
+SNAT(206.124.146.178-206.24.146.180)  192.168.1.0/24  eth0</programlisting>
 
       <para>The above would create three IP addresses:</para>
 

docs/configuration_file_basics.xml

@@ -18,7 +18,7 @@
     <pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
 
     <copyright>
-      <year>2001-2016</year>
+      <year>2001-2017</year>
 
       <holder>Thomas M. Eastep</holder>
     </copyright>
@@ -583,9 +583,9 @@ ACCEPT      net:\
           </row>
 
           <row>
-            <entry>conntrack (formerly notrack)</entry>
+            <entry>conntrack</entry>
 
-            <entry>source,dest,proto,dport,sport,user,switch</entry>
+            <entry>action,source,dest,proto,dport,sport,user,switch</entry>
           </row>
 
           <row>
@@ -859,6 +859,15 @@ INLINE               net              $FW ; -m recent --rcheck 10 --hitcount 5 -
 
           <programlisting>COMB_IF                         !70.90.191.120/29       70.90.191.121 ;; -m statistic --mode random --probability 0.50
 COMB_IF                         !70.90.191.120/29       70.90.191.123</programlisting>
+
+          <para>If the first character of the inline matches is a plus sign
+          ("+"), then the matches are processed before the column-oriented
+          input in the rule. That is required when specifying additional TCP
+          protocol parameters.</para>
+
+          <para>Example from action.TCPFlags:</para>
+
+          <programlisting>DROP     -      -      ;;+ -p 6 --tcp-flags ALL FIN,URG,PSH</programlisting>
         </listitem>
       </varlistentry>
     </variablelist>

docs/shorewall_extension_scripts.xml

@@ -234,6 +234,18 @@ cat -</programlisting>
         can be used to augment or replace functions in the standard CLI
         libraries.</para>
       </listitem>
+
+      <listitem>
+        <para><filename>enabled</filename> -- Added in Shorewall 5.1.6.
+        Invoked when an optional interface or provider is successfully enabled
+        using the <command>enable</command> command.</para>
+      </listitem>
+
+      <listitem>
+        <para><filename>disabled</filename> -- Added in Shorewall 5.1.6.
+        Invoked when an optional interface or provider is successfully
+        disabled using the <command>disable</command> command.</para>
+      </listitem>
     </itemizedlist>
 
     <para><emphasis role="bold">If your version of Shorewall doesn't have the
@@ -274,6 +286,18 @@ cat -</programlisting>
             <entry/>
           </row>
 
+          <row>
+            <entry>disable</entry>
+
+            <entry>disable</entry>
+          </row>
+
+          <row>
+            <entry>enable</entry>
+
+            <entry>enable</entry>
+          </row>
+
           <row>
             <entry>init</entry>
 
@@ -446,20 +470,14 @@ cat -</programlisting>
         <itemizedlist>
           <listitem>
             <para>CONFDIR - The configuration directory. Will be <filename
-            class="directory">/etc/shorewall</filename>, <filename
-            class="directory">/etc/shorewall6/</filename>, <filename
-            class="directory">/etc/shorewall-lite</filename>, or <filename
-            class="directory">/etc/shorewall6-lite</filename> depending on
-            which product is running.</para>
+            class="directory">/etc/</filename>.
+	    The running product is defined in the g_product variable.</para>
           </listitem>
 
-          <listitem>
-            <para>SHAREDIR - The product shared directory. Will be <filename
-            class="directory">/usr/share/shorewall</filename>, <filename
-            class="directory">/usr/share/shorewall6/</filename>, <filename
-            class="directory">/usr/share/shorewall-lite</filename>, or
-            <filename class="directory">/usr/share/shorewall6-lite</filename>
-            depending on which product is running.</para>
+	  <listitem>
+	    <para>SHAREDIR - The product shared directory. Will be <filename
+	    class="directory">/usr/share</filename>.
+	    The running product is defined in the g_product variable.</para>
           </listitem>
 
           <listitem>
@@ -508,25 +526,37 @@ cat -</programlisting>
               <row>
                 <entry>initdone</entry>
 
-                <entry>init</entry>
+                <entry>disable</entry>
               </row>
 
               <row>
                 <entry>maclog</entry>
 
-                <entry>isusable</entry>
+                <entry>enable</entry>
               </row>
 
               <row>
                 <entry>Per-chain (including those associated with
                 actions)</entry>
 
-                <entry>start</entry>
+                <entry>init</entry>
               </row>
 
               <row>
                 <entry>postcompile</entry>
 
+                <entry>isusable</entry>
+              </row>
+
+              <row>
+                <entry/>
+
+                <entry>start</entry>
+              </row>
+
+              <row>
+                <entry/>
+
                 <entry>started</entry>
               </row>
 
@@ -575,6 +605,44 @@ cat -</programlisting>
           </tgroup>
         </informaltable></para>
 
+      <para>The contents of each run-time script is placed in a shell
+      function, so you can declare local variables and can use the
+      <command>return</command> command. The functions generated from the
+      <filename>enable</filename> and <filename>disable</filename> scripts are
+      passed three arguments:</para>
+
+      <variablelist>
+        <varlistentry>
+          <term>$1</term>
+
+          <listitem>
+            <para>Physical name of the interface that was enabled or
+            disabled.</para>
+          </listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term>$2</term>
+
+          <listitem>
+            <para>Logical name of the interface.</para>
+          </listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term>$3</term>
+
+          <listitem>
+            <para>Name of the Provider, if any, associated with the
+            interface.</para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+
+      <para>As described above, the function generated from the
+      <filename>isusable</filename> script is passed a single argument that
+      names a network interface.</para>
+
       <para>With the exception of postcompile, compile-time extension scripts
       are executed using the Perl 'eval `cat
       &lt;<emphasis>file</emphasis>&gt;`' mechanism. Be sure that each script

docs/template.xml

@@ -18,7 +18,7 @@
     <pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
 
     <copyright>
-      <year>2012</year>
+      <year>2017</year>
 
       <holder>Thomas M. Eastep</holder>
     </copyright>