File: ChangeLog

package info (click to toggle)
firehol 1.273-1
  • links: PTS
  • area: main
  • in suites: squeeze, wheezy
  • size: 948 kB
  • ctags: 314
  • sloc: sh: 5,132; makefile: 70
file content (1992 lines) | stat: -rw-r--r-- 79,387 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992

RCS file: /cvsroot/firehol/firehol/firehol.sh,v
Working file: firehol.sh
head: 1.268
branch:
locks: strict
access list:
symbolic names:
	start: 1.1.1.1
	vendor: 1.1.1
keyword substitution: kv
total revisions: 269;	selected revisions: 269
description:
----------------------------
revision 1.268
date: 2007/11/30 19:22:36;  author: ktsaou;  state: Exp;  lines: +7 -7
Updated RESERVED_IPS
----------------------------
revision 1.267
date: 2007/10/25 12:34:06;  author: ktsaou;  state: Exp;  lines: +13 -13
Changed all service definitions which can use client ports bellow 1024 to
allow client connections from any possible port, because when natted, these
services will me remapped to client ports bellow 1024 without any
restriction on the port range.
----------------------------
revision 1.266
date: 2007/10/15 00:43:17;  author: ktsaou;  state: Exp;  lines: +95 -37
'less' is no more required. Now FireHOL can use 'less', 'more' or 'cat'
in that order, for a pager.

FireHOL will now correctly use 'zcat', 'gzcat' or 'gzip' for uncompressing
/proc/config.gz, and it will ignore /proc/config.gz if it cannot
find any of these commands (with a warning).

There was a case, where an attacker could use firehol to execute a custom
script, if it was saved at a location where the kernel config file is
expected by firehol, and /proc/config, /proc/config.gz did not exist.
FireHOL now greps the kernel config file for the information it needs, so
this threat has been eliminated.

Updated the line number management of the configuration file, using the
latest user commands offered by firehol.
----------------------------
revision 1.265
date: 2007/10/14 23:02:39;  author: ktsaou;  state: Exp;  lines: +11 -11
Replace gzcat with zcat.
----------------------------
revision 1.264
date: 2007/10/14 23:00:41;  author: ktsaou;  state: Exp;  lines: +7 -7
Updated RESERVED_IPS to latest IANA reservations.
----------------------------
revision 1.263
date: 2007/08/20 02:03:28;  author: ktsaou;  state: Exp;  lines: +8 -8
Made the helpme wizard correctly recognize services listening on the IPv6
equivalent of 0.0.0.0 (::).
----------------------------
revision 1.262
date: 2007/08/20 00:53:22;  author: ktsaou;  state: Exp;  lines: +8 -8
Changed the protections to activate the 'invalid' match last, after all
other protections.
----------------------------
revision 1.261
date: 2007/07/30 22:52:48;  author: ktsaou;  state: Exp;  lines: +39 -39
Various updates in 'helpme' mode.
There is still one issue unsolved: When there are routes to specific nets
befind a gateway, FireHOL checks if the IP of the host or the gateway are
inside the networks routed through the gateway. This is wrong. In several
cases, the network behind a gateway will not include the IP of the gateway
or the IP of the interface the firehol host routes this traffic via.

However, there seems to be no easy solution to this. For PPP interfaces the
IP of the PPP concentrator is included in the IPs that are reported by
'ip route show dev ppp0' as the networks behind this device.

May be the 'scope' paramater of the routing table should be used to exclude
'scope link' routes. If 'scope link' routes are ommitted, the resulting set
could be used to identify the routes behind a router.
----------------------------
revision 1.260
date: 2007/07/26 21:39:50;  author: ktsaou;  state: Exp;  lines: +7 -7
Updated RESERVED_IPS.
----------------------------
revision 1.259
date: 2007/07/20 21:28:13;  author: ktsaou;  state: Exp;  lines: +11 -8
Service multicast has been changed to match dst 224.0.0.0/4 proto IGMP and
UDP.
----------------------------
revision 1.258
date: 2007/07/20 21:16:59;  author: ktsaou;  state: Exp;  lines: +49 -18
Various minor fixed.

firehol 'save' now saves also the required kernel modules to restore the
firewall at /var/spool/firehol/last_save_modules.sh.
This is executable already and can be called from boot scripts to load
the kernel modules required when restoring the firewall with:

iptables-restore
----------------------------
revision 1.257
date: 2007/07/20 19:58:38;  author: ktsaou;  state: Exp;  lines: +55 -7
Added helper action:

action [chain <name> <action>]
The action helper creates an iptables chain which can be used to control the
action of other firewall rules during runtime.

For example, you can setup the custom action ACT1, which by default is ACCEPT,
but under certain cases it can be changed to DROP, REJECT or RETURN without
restarting the firewall.

The first argument must always be the word 'chain', for the moment.

        name    can be any chain name accepted by iptables.
                It is suggested to keep it between 5 to 10 letters.

        action  can be any action supported by FireHOL, although ony ACCEPT,
                REJECT, DROP, RETURN may have any meaning under this use.

Example 1:
At the top of firehol.conf, create the action ACT1:

action chain ACT1 accept

later, in interfaces and routers, create rules that use the ACT1 action:

server smtp ACT1
client imap ACT1

Please note that actions created this way are case sensitive.
At some point, and while the firewall is running, the action ACT1 can be
changed to DROP, with this linux command (this is not FireHOL specific):

iptables -t filter -I ACT1 -j DROP

The above command inserts (-I) the new action DROP above the default
action ACCEPT, and therefore all the traffic matching the FireHOL rules that
have the action ACT1 will now be dropped.
To return to the default action (ACCEPT), run the following linux command:

iptables -t filter -D ACT1 -j DROP

This command deletes (-D) the DROP action that was inserted above the
default action. If you delete all actions in the chain ACT1, the default
action will be RETURN, in which case all rules with action ACT1 will be
nutralized (it will be the same as they were not specified at all in
firehol.conf).

Example 2:

action chain "ACT1 ACT2 ACT3" accept chain "ACT4 ACT5 ACT6" drop

will create 6 actions, ACT1, ACT2, ACT3 with ACCEPT, and
ACT4, ACT5, ACT6 with DROP.
----------------------------
revision 1.256
date: 2007/05/22 22:52:53;  author: ktsaou;  state: Exp;  lines: +7 -7
Updated IANA RESERVED_IPS.
----------------------------
revision 1.255
date: 2007/05/06 14:42:43;  author: ktsaou;  state: Exp;  lines: +23 -11
Made firehol correctly identify newer kernel options regarding iptables
modules (applies to kernels 2.6.20+).
----------------------------
revision 1.254
date: 2007/05/05 23:38:31;  author: ktsaou;  state: Exp;  lines: +92 -8
Added support for external definitions of:

RESERVED_IPS
PRIVATE_IPS
MULTICAST_IPS
UNROUTABLE_IPS

in files under the same name in /etc/firehol/.
Only RESERVED_IPS is mandatory (firehol will complain if it is not there,
but it will still work without it), and is also the only file that firehol
checks how old is it. If it is 90+ days old, firehol will complain again.

Changed the supplied get-iana.sh script to generate the RESERVED_IPS file.
FireHOL also instructs the user to use this script if the file is missing
or is too old.
----------------------------
revision 1.253
date: 2007/04/29 18:38:41;  author: ktsaou;  state: Exp;  lines: +7 -7
Updated RESERVED_IPS
----------------------------
revision 1.252
date: 2007/04/29 18:34:55;  author: ktsaou;  state: Exp;  lines: +9 -9
BASH 3.2 support.
The problem is in array variables.
For some reason, an empty array member in BASH 3.1 produces no iptables
arguments, but in BASH 3.2 an empty array member produces an empty iptables
argument which breaks iptables.
----------------------------
revision 1.251
date: 2007/02/04 23:28:41;  author: ktsaou;  state: Exp;  lines: +7 -7
Updated RESERVED_IPS.
----------------------------
revision 1.250
date: 2006/11/21 23:41:23;  author: ktsaou;  state: Exp;  lines: +7 -7
Updated latest IANA RESERVED_IPS.
----------------------------
revision 1.249
date: 2006/06/05 17:47:48;  author: ktsaou;  state: Exp;  lines: +11 -6
Applied patch of bug: 1498292, "nfs" service missing ports for "rpc.statd"
----------------------------
revision 1.248
date: 2006/06/05 17:25:33;  author: ktsaou;  state: Exp;  lines: +53 -15
Added support for TARPIT.
Made 'policy' work for routers too.
----------------------------
revision 1.247
date: 2006/04/22 17:26:18;  author: ktsaou;  state: Exp;  lines: +11 -6
Added protection 'bad-packets'.
----------------------------
revision 1.246
date: 2006/03/23 18:50:16;  author: ktsaou;  state: Exp;  lines: +8 -8
Fixed bug 1455569:
When FireHOL has created the
$FIREHOL_SPOOL_DIR, it then runs chown and chmod on
the $FIREHOL_CONFIG_DIR. This looks like a
cut-n-paste error, since it at that point makes more
sense to chown/chmod $FIREHOL_SPOOL_DIR.
----------------------------
revision 1.245
date: 2006/03/12 12:54:55;  author: ktsaou;  state: Exp;  lines: +7 -7
Updated RESERVED_IPS for latest IANA assignements.
----------------------------
revision 1.244
date: 2006/03/11 12:24:34;  author: ktsaou;  state: Exp;  lines: +15 -7
Added service OSPF.

Make the wizard to ommit /32 from IPs since iptables now seems to complain
about it. Check bug: 1435098
----------------------------
revision 1.243
date: 2006/01/18 21:24:22;  author: ktsaou;  state: Exp;  lines: +7 -7
Updated RESERVED_IPS.
----------------------------
revision 1.242
date: 2006/01/18 21:20:28;  author: ktsaou;  state: Exp;  lines: +7 -7
Fixed the SIP service to allow port 5060 for the client (had only 'default').
----------------------------
revision 1.241
date: 2005/11/19 09:38:25;  author: ktsaou;  state: Exp;  lines: +7 -7
Added tcp/8333 to vmwareweb
----------------------------
revision 1.240
date: 2005/11/11 21:49:03;  author: ktsaou;  state: Exp;  lines: +70 -9
Added option 'recent' to action 'ACCEPT':

Example:

server smtp accept with recent NAME SECONDS HITS

where

NAME is a name for this RECENT match
SECONDS is a number, or empty ("")
HITS is a number, or empty ("")

Check:

iptables -m recent --help

for more information.
----------------------------
revision 1.239
date: 2005/10/27 23:46:01;  author: ktsaou;  state: Exp;  lines: +9 -6
created a copy of "microsoft_ds" service as "ms_ds" to overcome the issue
of long chain names.
----------------------------
revision 1.238
date: 2005/10/16 08:55:53;  author: ktsaou;  state: Exp;  lines: +24 -6
Added variable FIREHOL_DROP_ORPHAN_TCP_ACK_FIN which once set to 1 in the
config file, it makes FireHOL drop all packets that appear as NEW
connections to the connection tracker but they are TCP and have ACK and FIN
set.

This should eliminate the logs that appear in a few busy environments where
the iptables connection tracker removes entries from its table when it
sees the FIN and therefore the ACK,FIN is considered a NEW connection.

See also https://sourceforge.net/tracker/?func=detail&atid=487693&aid=1326811&group_id=58425
----------------------------
revision 1.237
date: 2005/09/21 21:32:58;  author: ktsaou;  state: Exp;  lines: +16 -13
Made it dynamically detect /var/lock/subsys and switch back to /var/lock
if the first does not exist.
----------------------------
revision 1.236
date: 2005/06/02 16:20:35;  author: ktsaou;  state: Exp;  lines: +7 -7
fixed a bug in negative 'mac' expressions where a faulty rule was generated
for matching mac-source 'any'.
----------------------------
revision 1.235
date: 2005/06/02 15:48:52;  author: ktsaou;  state: Exp;  lines: +7 -7
Allowed 127.0.0.1 to be in RESERVED_IPS
----------------------------
revision 1.234
date: 2005/05/08 23:27:22;  author: ktsaou;  state: Exp;  lines: +7 -7
Updated RESERVED_IPS to current IANA reservations.
----------------------------
revision 1.233
date: 2005/04/18 22:38:23;  author: ktsaou;  state: Exp;  lines: +83 -8
Added 'addrtype' matches, in the form of 'srctype' and 'dsttype' optional
rule parameters.
----------------------------
revision 1.232
date: 2005/04/18 21:00:22;  author: ktsaou;  state: Exp;  lines: +11 -10
Added FIREHOL_LOG_PREFIX.
----------------------------
revision 1.231
date: 2005/04/03 21:48:04;  author: ktsaou;  state: Exp;  lines: +16 -6
Added experimental protection all-floods.
----------------------------
revision 1.230
date: 2005/03/01 19:52:56;  author: ktsaou;  state: Exp;  lines: +7 -6
Made FireHOL trap SIGHUP and cleanup properly on it.
----------------------------
revision 1.229
date: 2005/02/17 23:45:02;  author: ktsaou;  state: Exp;  lines: +64 -19
Made a set of external commands optional in wizard mode, so that FireHOL
will work if these are absent, but will refuse to enter wizard mode.
----------------------------
revision 1.228
date: 2005/02/09 22:36:24;  author: ktsaou;  state: Exp;  lines: +17 -8
Added support for /proc/config.gz for kernel configuration.
This is silently ignored if the command 'gzcat' cannot be found in the
system path.
----------------------------
revision 1.227
date: 2005/02/07 20:56:09;  author: ktsaou;  state: Exp;  lines: +31 -7
Made wget and curl optional. Now they are required only when they are
really needed.

Also, small fixes in ecn_shame helper.
----------------------------
revision 1.226
date: 2005/01/25 21:28:19;  author: ktsaou;  state: Exp;  lines: +10 -10
Remove -p from mkdir commands, in order for them to fail if the directory
to be created already exists.
----------------------------
revision 1.225
date: 2005/01/25 21:07:01;  author: ktsaou;  state: Exp;  lines: +12 -12
Made sure that no files are created anywhere except the firehol temp dir.
Made the firehol temp dir use the $RANDOM variable to randomize its name.
----------------------------
revision 1.224
date: 2005/01/24 22:24:48;  author: ktsaou;  state: Exp;  lines: +8 -8
Fixed service pptp to control GRE traffic in a stateless way.
----------------------------
revision 1.223
date: 2005/01/24 21:23:38;  author: ktsaou;  state: Exp;  lines: +145 -103
Added security checks to directory creation mechanism.
----------------------------
revision 1.222
date: 2005/01/21 19:58:09;  author: ktsaou;  state: Exp;  lines: +9 -6
Added service DICT (kdict, gnome-dictionary).
----------------------------
revision 1.221
date: 2004/12/29 22:34:45;  author: ktsaou;  state: Exp;  lines: +21 -14
Minor fixes for calculating minor firehol version number, added transparent
proxy to line number calculation and fix a typo in the docs.
----------------------------
revision 1.220
date: 2004/12/23 18:43:03;  author: ktsaou;  state: Exp;  lines: +8 -6
The knock was not allowing established connections, and knockd was
inserting a rule with a -s which matched requests but did not match the
replies.

Now, the default is to allow established connections for knock and only
control NEW connections via knockd.
----------------------------
revision 1.219
date: 2004/12/22 23:05:57;  author: ktsaou;  state: Exp;  lines: +38 -8
Small internal changes.

Added support for integration with knockd (http://www.zeroflux.org/knock/)
This integration comes as part of the ACCEPT action:

accept [with knock <name>]
The optional parameter 'with knock' allows easy integration with knockd,
a server that allows you to control access to services, by sending certain
packets to "knock" the door, before the door is open for service.

This parameter accepts just a name. This name is used to build a special
chain knock_<name> which will contain no rules, so that the traffic entering
this chain will just return back and continue to match against the other
rules until the end of the firewall.

As an example, lets say that you want to allow https traffic based on a knock.
In FireHOL you write:

   server https accept with knock hidden

and you configure knockd so that it runs:

   iptables -A knock_hidden -s %IP% -j ACCEPT

to enable the https service (notice that there is no need to match anything
else than the IP. FireHOL already matches everything needed for its rules
to work), and:

   iptables -D knock_hidden -s %IP% -j ACCEPT

to disable this service for the given IP.
----------------------------
revision 1.218
date: 2004/12/21 21:49:11;  author: ktsaou;  state: Exp;  lines: +24 -18
Added helper 'transparent_proxy' and modified 'transparent_squid' to call
the new helper for setting up transparent web proxies.
----------------------------
revision 1.217
date: 2004/12/03 21:29:41;  author: ktsaou;  state: Exp;  lines: +36 -5
Added service TIMESTAMP.
----------------------------
revision 1.216
date: 2004/11/04 19:47:05;  author: ktsaou;  state: Exp;  lines: +7 -7
Fixed a bug in FIREHOL_OUTPUT_ACTIVATION_POLICY which was incorrectly
setting the INPUT policy.
----------------------------
revision 1.215
date: 2004/11/02 00:37:15;  author: ktsaou;  state: Exp;  lines: +38 -5
Added service ANYSTATELESS
----------------------------
revision 1.214
date: 2004/11/01 00:13:00;  author: ktsaou;  state: Exp;  lines: +30 -10
Implemented minor version check on services in /etc/firehol/services
----------------------------
revision 1.213
date: 2004/10/31 03:17:00;  author: ktsaou;  state: Exp;  lines: +9 -6
Fixed a type in DSCP optional rule parameter.
Added line numbering to newly added helpers.
----------------------------
revision 1.212
date: 2004/10/31 02:21:02;  author: ktsaou;  state: Exp;  lines: +497 -256
Added helpers:

tos	- to set the TOS of packets
dscp	- to set the DSCP field of packets (both raw and class)


Added optional rule parameters:

tos	- to match the TOS of packets
mark	- to match the MARK ID of packets
dscp	- to match the DSCP field of packets (both raw and class)


Added the following actions to the rule() function:

dscp

The rule() function already had support for TOS and MARK.
----------------------------
revision 1.211
date: 2004/10/30 23:03:57;  author: ktsaou;  state: Exp;  lines: +35 -8
Created the complex service DHCP and removed the simple one.
The complex DHCP is now stateless to overcome all the problems that
arise due to the initial DHCP broadcast.
----------------------------
revision 1.210
date: 2004/10/30 22:41:21;  author: ktsaou;  state: Exp;  lines: +16 -12
Service SAMBA now includes MICROSOFT_DS (tcp/445). Also, updated samba
related documentation.
----------------------------
revision 1.209
date: 2004/10/30 21:27:00;  author: ktsaou;  state: Exp;  lines: +18 -8
Some error detection for /etc/firehol/services directory creation.
----------------------------
revision 1.208
date: 2004/10/30 21:13:26;  author: ktsaou;  state: Exp;  lines: +109 -5
Added service NIS.

Created by Carlos Rodrigues <crlf@users.sourceforge.net>
Feature Requests item #1050951 <https://sourceforge.net/tracker/?func=detail&atid=487695&aid=1050951&group_id=58425>

These rules work for client access only!

Pushing changes to slave servers won't work if these rules are active
somewhere between the master and its slaves, because it is impossible to
predict the ports where "yppush" will be listening on each push.

Pulling changes directly on the slaves will work, and could be improved
performance-wise if these rules are modified to open "fypxfrd". This wasn't
done because it doesn't make that much sense since pushing changes on the
master server is the most common, and recommended, way to replicate maps.
----------------------------
revision 1.207
date: 2004/10/28 23:03:06;  author: ktsaou;  state: Exp;  lines: +67 -13
Added support for externally defined services in files under directory:

/etc/firehol/services

This directory may contain files ending with .conf. Example: imap.conf
Each file should *start* with a line like this:

#FHVER: 1

This must be the FIRST line of the file.
The number 1 is the FIREHOL_SERVICES_API version number. If the API within
FireHOL changes, FireHOL will refuse to load all those services files that
their API version number does not match.
----------------------------
revision 1.206
date: 2004/10/28 22:02:43;  author: ktsaou;  state: Exp;  lines: +9 -5
Added service nut.
----------------------------
revision 1.205
date: 2004/10/08 22:30:52;  author: ktsaou;  state: Exp;  lines: +90 -46
Added helper 'tcpmss'.
Added service 'nntps'.
Converted all simple services' port definitions to numeric.
Updated documentation accordingly.
----------------------------
revision 1.204
date: 2004/09/26 00:52:55;  author: ktsaou;  state: Exp;  lines: +55 -6
Added services:

asterisk, darkstat, distcc, eserver, gift, giftui, h323, iax, iax2, icp,
rtp, sip, stun, upnp.
----------------------------
revision 1.203
date: 2004/09/14 21:15:44;  author: ktsaou;  state: Exp;  lines: +119 -7
Added support for options to the ACCEPT action in order to allow
a certain frequency of NEW connections per service.

Now the template for the ACCEPT action is this:

ACCEPT [with limit frequency burst [overflow action]]

for example:

server smtp accept with limit 10/s 100 overflow drop

which means there is now control for the frequency at which NEW incoming
connections are accepted and control is also provided for the overflow
NEW ones.

The default overflow action is REJECT which rejects TCP connections with
TCP-RESET and all others with ICMP-PORT-UNREACHABLE.

To add other optional rule parameters to the server/client/route command
just add them after the ACCEPT expression. For example:

server smtp accept with limit 10/s 1000 src 1.2.3.4

If there are overflow NEW connections, the firewall will log "OVERFLOW"
with the packets and the frequency of loglimit (controled via global
variables).

The overflow action cannot accept parameters.
----------------------------
revision 1.202
date: 2004/09/12 07:24:58;  author: ktsaou;  state: Exp;  lines: +8 -5
Added RDP service.
----------------------------
revision 1.201
date: 2004/09/12 06:57:47;  author: ktsaou;  state: Exp;  lines: +9 -5
Added service NXSERVER.
----------------------------
revision 1.200
date: 2004/09/10 22:07:18;  author: ktsaou;  state: Exp;  lines: +16 -5
Added a warning if wrong arguments are detected.
----------------------------
revision 1.199
date: 2004/09/10 21:36:26;  author: ktsaou;  state: Exp;  lines: +12 -5
Added rquotad to the NFS service.
----------------------------
revision 1.198
date: 2004/08/21 21:07:09;  author: ktsaou;  state: Exp;  lines: +6 -6
Updated RESERVED_IPS according to current IANA reserved IP range.
----------------------------
revision 1.197
date: 2004/07/31 22:31:08;  author: ktsaou;  state: Exp;  lines: +31 -33
Due to a bug in BASH 3.0, the unset bash function corrupts array variables.
Changed FireHOL to set all variables to empty instead of unseting them.
----------------------------
revision 1.196
date: 2004/07/29 22:31:14;  author: ktsaou;  state: Exp;  lines: +12 -6
Added documentation for DHCP and dropped packets.
Changed radius definition to use port numbers instead of port names
(gentoo has different names).
Added RADIUSPROXY and RADIUSOLDPROXY services.
----------------------------
revision 1.195
date: 2004/07/07 22:09:31;  author: ktsaou;  state: Exp;  lines: +14 -7
Added variable FIREHOL_TRUST_LOOPBACK=1 which if set to 0, FireHOL will not
trust the lo interface allowing the admin to setup a firewall on it.
----------------------------
revision 1.194
date: 2004/05/15 10:19:01;  author: ktsaou;  state: Exp;  lines: +9 -5
Added an iptables -nxvL command at the top of firehol.sh to initialize
iptables. Without it a few users have reported problems using firehol
during boot.
----------------------------
revision 1.193
date: 2004/05/05 23:41:19;  author: ktsaou;  state: Exp;  lines: +88 -11
Added helper 'ecn_shame' that once called, it looks if ECN is enabled in
the kernel, and if it is, it fetches:

http://urchin.earth.li/cgi-bin/ecn.pl?output=ip

and disables ECN for all communication with these hosts.
----------------------------
revision 1.192
date: 2004/05/04 21:39:33;  author: ktsaou;  state: Exp;  lines: +76 -5
Added grouping functionality. This is not yet finished. It has been added
to allow other developers test the functionality before optimizing all the
rules to use groups.
To use grouping, within an interface or router write:

group with [optional rule parameters]
   server x accept
   server y accept
group end

This will generate a much more optimized version of:

server "x y" accept [optional rule parameters]

by applying all the optional rule parameters once (instead of once per
service).
----------------------------
revision 1.191
date: 2004/04/23 22:15:18;  author: ktsaou;  state: Exp;  lines: +26 -15
Made the nat helpers print their real statements instead of always
appearing as 'nat'.
----------------------------
revision 1.190
date: 2004/04/23 07:36:12;  author: ktsaou;  state: Exp;  lines: +7 -7
Changed two:

tr [a-z] [A-Z]

to:

tr a-z A-Z

because a few versions of tr complain with the first format.
----------------------------
revision 1.189
date: 2004/04/23 07:32:01;  author: ktsaou;  state: Exp;  lines: +6 -6
Fixed a printf that was giving errors because an argument was not numeric.
----------------------------
revision 1.188
date: 2004/04/21 22:57:11;  author: ktsaou;  state: Exp;  lines: +5 -7
Removed the "press return to continue" from the 'debug' mode.
----------------------------
revision 1.187
date: 2004/04/21 22:39:40;  author: ktsaou;  state: Exp;  lines: +12 -7
FireHOL now checks that /var/lock/subsys (the dir RH uses for startup
services lock files) exists before using it.
----------------------------
revision 1.186
date: 2004/04/21 22:23:10;  author: ktsaou;  state: Exp;  lines: +8 -5
Added service WHOIS.
----------------------------
revision 1.185
date: 2004/04/21 21:48:32;  author: ktsaou;  state: Exp;  lines: +10 -5
Kernel configuration is now searched in this order:

1. /proc/config
2. /lib/modules/`uname -r`/build/.config
3. /boot/config-`uname -r`
4. /usr/src/linux/.config

Check No 3 was added now.
----------------------------
revision 1.184
date: 2004/04/21 21:35:29;  author: ktsaou;  state: Exp;  lines: +108 -49
IMPORTANT: My second kid was born a week ago!

Added a lot of information to the generated iptables command line to
debug both the commands generated and what FireHOL did.

Fixed a bug in kernel module management: check_kernel_module() was supposed
to be a runtime function, but accidentaly I had it generating commands
to be run later - which of course were not run.
----------------------------
revision 1.183
date: 2004/04/01 23:30:28;  author: ktsaou;  state: Exp;  lines: +19 -9
Added finer control to control INVALID packets.
The default is now not to drop invalid packets globaly, but to drop them
as part of the protection statement (i.e. protection invalid). The default
full/strong/all protections include the invalid match.

To enable invalid packets dropping globaly (the previous behaviour) one
can give:

FIREHOL_DROP_INVALID=1

at the top of the configuration file.
----------------------------
revision 1.182
date: 2004/03/04 22:05:53;  author: ktsaou;  state: Exp;  lines: +5 -6
Removed a tcp-flags match from protection because it was a subset of
another one already defined.
----------------------------
revision 1.181
date: 2004/03/03 23:18:43;  author: ktsaou;  state: Exp;  lines: +40 -36
Fixed the required commands finder to stop properly when some system
command is not found in the system path.
----------------------------
revision 1.180
date: 2004/03/03 22:19:15;  author: ktsaou;  state: Exp;  lines: +6 -5
Added:

--tcp-flags SYN,RST,PSH,ACK,URG SYN,RST,PSH,URG

to the list of malformed packets.
----------------------------
revision 1.179
date: 2004/03/03 21:24:41;  author: ktsaou;  state: Exp;  lines: +12 -15
Minor mac optional rule parameter fix.
----------------------------
revision 1.178
date: 2004/03/03 20:32:35;  author: ktsaou;  state: Exp;  lines: +11 -6
Completed the mac optional rule parameter. This was implemented since
v1.134 but it was producing rules for both input and output packets.

Now, it produces mac rules only for packets comming in the firewall
(interfaces and routers).
----------------------------
revision 1.177
date: 2004/02/07 00:43:11;  author: ktsaou;  state: Exp;  lines: +6 -6
BUG 891471:
Multicast CIDR block is actually 224.0.0.0/4.
It extends from 224-239.

Fixed.
----------------------------
revision 1.176
date: 2004/01/10 18:44:39;  author: ktsaou;  state: Exp;  lines: +8 -6
Further optimized and reduced PRIVATE_IPS using:
http://www.vergenet.net/linux/aggregate/

The supplied get-iana.sh uses 'aggregate-flim' if it finds it in the path.
(aggregate-flim is the name of this program when installed on Gentoo)
----------------------------
revision 1.175
date: 2004/01/02 22:32:28;  author: ktsaou;  state: Exp;  lines: +6 -6
Fixed a warning generated incorrectly by the mark helper.
----------------------------
revision 1.174
date: 2003/12/29 22:46:00;  author: ktsaou;  state: Exp;  lines: +7 -7
Aesthetic changes.
----------------------------
revision 1.173
date: 2003/12/29 22:40:11;  author: ktsaou;  state: Exp;  lines: +70 -11
Added count of iptables commands generated.
----------------------------
revision 1.172
date: 2003/12/01 05:03:11;  author: ktsaou;  state: Exp;  lines: +17 -8
Added FIREHOL_LOG_MODE which can either be LOG or ULOG to select the
logging mode for iptables. All FireHOL optional rule parameters use this.

Updated documentation to reflect the change.
----------------------------
revision 1.171
date: 2003/11/23 19:27:58;  author: ktsaou;  state: Exp;  lines: +6 -6
Changed a "head -1" to "head -n 1" because head does not support the first
syntax anymore. Thanks to Maik Schreiber <blizzy@blizzy.de> for reporting
this.
----------------------------
revision 1.170
date: 2003/11/23 13:43:19;  author: ktsaou;  state: Exp;  lines: +11 -5
Added support for kernel config in /lib/modules/`uname -r`/build/.config

Updated documentation.
----------------------------
revision 1.169
date: 2003/11/18 23:00:48;  author: ktsaou;  state: Exp;  lines: +6 -6
There was an extra - (minus) in the iptables command generation for
negative protocol expressions. Fixed.
----------------------------
revision 1.168
date: 2003/11/04 21:43:02;  author: ktsaou;  state: Exp;  lines: +21 -6
NETBIOS initiates based on the broadcast address of an interface
(request goes to broadcast address) but the server responds from
its own IP address. This makes the server samba accept statement
drop the server reply.
Bellow is a hack, that allows a linux samba server to respond
correctly, as it allows new outgoing connections from the well
known netbios-ns port to the clients high ports.
For clients and routers this hack is not applied because it
would be a huge security hole.
----------------------------
revision 1.167
date: 2003/11/03 20:43:09;  author: ktsaou;  state: Exp;  lines: +6 -6
Added again 172.16.0.0/12 to PRIVATE_IPS.
----------------------------
revision 1.166
date: 2003/10/26 21:40:30;  author: ktsaou;  state: Exp;  lines: +67 -56
Fixed PRIVATE_IPS (there was an duplicate entry and a wrong entry).
----------------------------
revision 1.165
date: 2003/10/26 21:27:31;  author: ktsaou;  state: Exp;  lines: +102 -8
Changed kernel module management to read kernel configuration and detect
if a module is compiled in the kernel or needs to be loaded separately.

(note: this is not finished yet)
----------------------------
revision 1.164
date: 2003/10/22 06:58:27;  author: ktsaou;  state: Exp;  lines: +6 -6
Changed TIME service ports to numeric since a few versions of bash get
confused by the use of the reserved keywork "time".
----------------------------
revision 1.163
date: 2003/10/20 17:49:56;  author: ktsaou;  state: Exp;  lines: +7 -7
Fixed service CUPS according to the following:

> The firehol system defines the 'cups' protocol as:
>
> server_cups_ports="tcp/631"
> client_cups_ports="default"
>
> This isn't a complete definition - CUPS also has an internal printer
> browsing protocol that operates over UDP, on port 631.
>
> The following definition is more correct:
>
> server_cups_ports="tcp/631 udp/631"
> client_cups_ports="default 631"
----------------------------
revision 1.162
date: 2003/10/18 09:40:45;  author: ktsaou;  state: Exp;  lines: +8 -5
Added Distributed Checksum Clearinghouses (DCC) service.
----------------------------
revision 1.161
date: 2003/10/16 22:05:22;  author: ktsaou;  state: Exp;  lines: +194 -84
Added the PHYSIN and PHYSOUT optional rule parameters to match the
physical network interface in cases where iptables defines as inface
and outface a virtual interface such as a bridge.
----------------------------
revision 1.160
date: 2003/10/13 18:50:30;  author: ktsaou;  state: Exp;  lines: +13 -5
Added services ORACLE and GKRELLMD.
----------------------------
revision 1.159
date: 2003/10/09 10:01:26;  author: ktsaou;  state: Exp;  lines: +9 -5
Added service Veritas NetBackup.
----------------------------
revision 1.158
date: 2003/10/07 22:31:06;  author: ktsaou;  state: Exp;  lines: +12 -7
Added lockd support in service NFS, as suggested by
"Daniel Pittman" <daniel@rimspace.net>
----------------------------
revision 1.157
date: 2003/10/06 00:17:23;  author: ktsaou;  state: Exp;  lines: +18 -6
Fixed TFTP service according to Goetz Bock <bock@blacknet.de> suggestions.
----------------------------
revision 1.156
date: 2003/10/05 22:58:57;  author: ktsaou;  state: Exp;  lines: +110 -68
Cleaned up all complex services.
Added complex service TFTP.
----------------------------
revision 1.155
date: 2003/09/18 20:54:25;  author: ktsaou;  state: Exp;  lines: +8 -5
When I first started FireHOL (about a year before) I started with the
header part of /etc/init.d/iptables (of redhat 7.2). This header
just checked the kernel version and made a check on whether ipchains
was running. If any of the above was faulty (kernel version less than
2.3 or ipchains loaded into the kernel) it was exiting silently.

Although I still keep this logic, now FireHOL will print a warning
instead of just exiting silently.
----------------------------
revision 1.154
date: 2003/09/13 01:03:46;  author: ktsaou;  state: Exp;  lines: +26 -5
Added helper 'mark'

Abstract from the documentation:

mark <NUMBER> <WHERE> [optional rule parameters]

The mark helper marks the traffic with a specific mark NUMBER
that can be matched by traffic shapping tools for controlling the
traffic.

Parameters

    * NUMBER is a number to mark the packets with.

    * WHERE tells FireHOL where to search for the specific traffic
      to be marked.
      Currently, WHERE can be one of the build-in iptables chains
      attached to table mangle. (for example: INPUT, FORWARD, OUTPUT,
      PREROUTING, POSTROUTING - case does matter here).

    * optional rule parameters is a set of rules that allow further
      restriction of the traffic that gets matched by this rule.
      See Optional Rules Parameters for more information.

Example 1: mark 1 OUTPUT
   will mark with 1 all packets send by the local machine.

Example 2: mark 2 FORWARD
   will mark with 2 all packets passing through the local machine.

Example 3: mark 3 FORWARD proto tcp dport 25 dst 1.1.1.1 src 2.2.2.2
   will match with 3 all packets sent by 2.2.2.2, passing through the
   local machine and targeting port TCP/25 of host 1.1.1.1.
----------------------------
revision 1.153
date: 2003/08/31 22:21:49;  author: ktsaou;  state: Exp;  lines: +8 -5
Added service XDMCP.
----------------------------
revision 1.152
date: 2003/08/23 23:26:50;  author: ktsaou;  state: Exp;  lines: +6 -6
Bug #793889:
Change #!/bin/sh to #!/bin/bash to allow FireHOL run on systems that
bash is not linked to /bin/sh.
----------------------------
revision 1.151
date: 2003/08/23 22:50:14;  author: ktsaou;  state: Exp;  lines: +7 -7
Bug #893887:
Added -q to modprobe in order not to complain about modules already
loaded in kernel 2.6.x with module-init-tools
----------------------------
revision 1.150
date: 2003/08/23 22:27:34;  author: ktsaou;  state: Exp;  lines: +35 -11
Made the blacklist helper produce only one set of chains for all its runs.
This will keep the produced rules clearer and the firewall smaller.
----------------------------
revision 1.149
date: 2003/08/23 21:42:35;  author: ktsaou;  state: Exp;  lines: +54 -5
Added "blacklist" helper to create blacklists.

Abstract from the documentation:

blacklist [option] <IP>
The blacklist helper creates a blacklist for the IP addresses given.
It supports two modes of operation based on the option given (or the
absence of it).

The option can be:

    * one of the words them, him, her, it, this, these, input in which
      case it will generate a unidirectional statefull blacklist,
      meaning that you will be able to ask (initiate connections)
      anything from them, but they will not be able to ask (initiate
      connections) anything from you or the remote hosts you protect
      (routing).

    * one of the words all, full or ommitted (no option given), in
      which case FireHOL will create bidirectional stateless rules
      that will DROP all traffic comming in from these IPs and will
      REJECT all traffic going to them.

The blacklist helper affects both interfaces and routers.

Example 1: blacklist this 195.97.5.202
Example 2: blacklist full 195.97.5.202

Suggested by: Mikkel Schubert
----------------------------
revision 1.148
date: 2003/08/19 22:21:32;  author: ktsaou;  state: Exp;  lines: +6 -6
Fixed a minor bug in kernel module handling that made it not detect that
ip_tables is already compiled (or loaded) in the kernel.
----------------------------
revision 1.147
date: 2003/07/31 20:44:45;  author: ktsaou;  state: Exp;  lines: +7 -7
More Gentoo compatibility (mainly change of port names to port numbers in
services).
----------------------------
revision 1.146
date: 2003/07/27 22:58:59;  author: ktsaou;  state: Exp;  lines: +21 -8
Minor changes for gentoo compatibility (SAVE feature)
.
----------------------------
revision 1.145
date: 2003/07/20 22:45:50;  author: ktsaou;  state: Exp;  lines: +43 -7
Added service HYLAFAX, although experimental.
----------------------------
revision 1.144
date: 2003/07/20 22:14:28;  author: ktsaou;  state: Exp;  lines: +37 -37
As suggested by "Francisco Javier FĂ©lix Belmonte" <ffelix@gescosoft.com>
fixed all EOF statements in order to produce cleaner iptables run script.
----------------------------
revision 1.143
date: 2003/07/20 21:52:41;  author: ktsaou;  state: Exp;  lines: +8 -5
Added service POSTGRES.
----------------------------
revision 1.142
date: 2003/07/20 21:50:29;  author: ktsaou;  state: Exp;  lines: +8 -5
Added TIME service.
----------------------------
revision 1.141
date: 2003/07/20 21:48:01;  author: ktsaou;  state: Exp;  lines: +6 -6
Changed service CUPS ports to numeric. Gentoo does not have this defined.
----------------------------
revision 1.140
date: 2003/07/20 21:46:41;  author: ktsaou;  state: Exp;  lines: +131 -86
Added --cmd-owner support.
----------------------------
revision 1.139
date: 2003/06/30 22:18:46;  author: ktsaou;  state: Exp;  lines: +8 -5
Added service webmin.
----------------------------
revision 1.138
date: 2003/06/30 22:07:01;  author: ktsaou;  state: Exp;  lines: +11 -5
Added jabber and jabberd services.
----------------------------
revision 1.137
date: 2003/06/28 23:22:49;  author: ktsaou;  state: Exp;  lines: +9 -7
Aesthetic changes in mac helper.
----------------------------
revision 1.136
date: 2003/06/28 21:26:20;  author: ktsaou;  state: Exp;  lines: +6 -6
Updated service LPD according to RFCs, and now it accepts only ports
721 to 731 inclusive, plus the default client ports.
----------------------------
revision 1.135
date: 2003/06/28 20:52:09;  author: ktsaou;  state: Exp;  lines: +7 -7
Reverted DEFAULT_CLIENT_PORTS to 1024+ (was 1000+)

Made LPD client ports "any".
----------------------------
revision 1.134
date: 2003/06/18 22:56:24;  author: ktsaou;  state: Exp;  lines: +120 -52
Added the "mac" optional rule parameter, that matches the source mac
address of packets.

Added the "mac" helper that verifies that packets comming in from a
specific source IP address, always come from a specific MAC address.
This applies to the whole firewall (INPUT and FORWARD).
----------------------------
revision 1.133
date: 2003/06/18 21:44:52;  author: ktsaou;  state: Exp;  lines: +19 -5
Added FIREHOL_INPUT_ACTIVATION_POLICY, FIREHOL_OUTPUT_ACTIVATION_POLICY,
and FIREHOL_FORWARD_ACTIVATION_POLICY to control the firewall default
policy during firewall activation.
----------------------------
revision 1.132
date: 2003/06/11 07:00:24;  author: ktsaou;  state: Exp;  lines: +7 -7
Optimized RESERVED_IPS as suggested by Marc 'HE' Brockschmidt
<marc@marcbrockschmidt.de>.
----------------------------
revision 1.131
date: 2003/06/10 21:27:46;  author: ktsaou;  state: Exp;  lines: +11 -5
Added MSN and DCPP services.
----------------------------
revision 1.130
date: 2003/06/10 20:44:27;  author: ktsaou;  state: Exp;  lines: +7 -8
Added man page for firehol.conf, contributed by
"Marc 'HE' Brockschmidt" <marc@marcbrockschmidt.de>

Thanks Marc.
----------------------------
revision 1.129
date: 2003/05/22 19:39:53;  author: ktsaou;  state: Exp;  lines: +56 -29
Made FireHOL mv /etc/firehol.conf to /etc/firehol/firehol.conf, if
/etc/firehol (directory) does not exist.

Also, made _CMD variables better detect wrong situations, such as
multiple instanses of the same command, command not found, etc.
----------------------------
revision 1.128
date: 2003/05/01 01:30:24;  author: ktsaou;  state: Exp;  lines: +9 -9
Made default config in /etc/firehol/firehol.conf to comform with various
distributions that prefer it this way (Gentoo).

This will also allow to have services.d within this directory.
----------------------------
revision 1.127
date: 2003/04/30 23:29:47;  author: ktsaou;  state: Exp;  lines: +9 -9

"Marc 'HE' Brockschmidt" <marc@marcbrockschmidt.de> wrote:

Today, I've tried to debianize firehol, but noticed a few problems
(eg. the need for a force-reload-option for every init-script [you could
realize it as an alias for restart]).
I've corrected a few " !!!" (As a reader of Terry Pratchett, I had to
kill them ;-)
I'm attaching a patch for these issues.

I've also created a manpage for FireHOL, and I'm working on the manpage
for firehole.conf.

---
Thank you Marc.
----------------------------
revision 1.126
date: 2003/04/24 08:15:08;  author: ktsaou;  state: Exp;  lines: +6 -6
Fixed a 'touch' cmd to use the external command system.
----------------------------
revision 1.125
date: 2003/04/24 08:12:51;  author: ktsaou;  state: Exp;  lines: +12 -5
Made HELPME detect duplicate routers and prevent multiple definitions
of them.
----------------------------
revision 1.124
date: 2003/04/23 20:42:26;  author: ktsaou;  state: Exp;  lines: +18 -7
Eliminated duplicate router definitions in HELPME, when an interface
has multiple IPs on the same subnet.
----------------------------
revision 1.123
date: 2003/04/20 10:18:10;  author: ktsaou;  state: Exp;  lines: +27 -7
FireHOL now stops the firewall with its own logic (without calling
/etc/init.d/iptables) since some distribution do not have this.
----------------------------
revision 1.122
date: 2003/04/18 20:52:44;  author: ktsaou;  state: Exp;  lines: +48 -13
Module management can now be controlled with FIREHOL_LOAD_KERNEL_MODULES.
Default value is 1, it can be set to 0 to disable module management.

Also, now FireHOL automatically detects if ip_tables and ip_conntrack
are build into the kernel, by looking for relative files in /proc/net.
----------------------------
revision 1.121
date: 2003/04/08 00:12:02;  author: ktsaou;  state: Exp;  lines: +184 -150
Removed all hard-coded references to external commands and made a dynamic
list at the top of FireHOL. Now FireHOL will refuse to run if some command
is missing.
----------------------------
revision 1.120
date: 2003/03/19 21:51:56;  author: ktsaou;  state: Exp;  lines: +16 -6
Fixed MIRROR statements to produce REJECT on the OUTPUT of the host.
----------------------------
revision 1.119
date: 2003/03/18 21:27:35;  author: ktsaou;  state: Exp;  lines: +9 -9
Copyright notices now print year 2003.
----------------------------
revision 1.118
date: 2003/03/17 23:03:00;  author: ktsaou;  state: Exp;  lines: +13 -6
Cosmetic changes in 'helpme'
----------------------------
revision 1.117
date: 2003/03/17 22:57:26;  author: ktsaou;  state: Exp;  lines: +7 -6
Fixed broken 'helpme' detection of networks behind gateways. Now it works.
----------------------------
revision 1.116
date: 2003/03/17 22:42:18;  author: ktsaou;  state: Exp;  lines: +46 -9
'helpme' now detects multiple overlapping networks defined for the same
interface. In such cases it only defines the wider network.
----------------------------
revision 1.115
date: 2003/03/16 22:13:30;  author: ktsaou;  state: Exp;  lines: +138 -50
Made 'helpme' detect point-to-point routes better.
----------------------------
revision 1.114
date: 2003/03/15 01:24:19;  author: ktsaou;  state: Exp;  lines: +8 -5
Added service 'socks'.
----------------------------
revision 1.113
date: 2003/03/15 00:59:27;  author: ktsaou;  state: Exp;  lines: +25 -5
'panic' now prevent you from loosing the SSH you are issuing this command
by allowing the established connection specified in the environment
variable SSH_CLIENT (only if it exists: it is lost if you su -, you should
su without the minus).

Also, the panic argument takes one optional argument. This can be an IP
address in which case all established connections between the host and this
IP will be allowed.
----------------------------
revision 1.112
date: 2003/03/14 21:22:37;  author: ktsaou;  state: Exp;  lines: +6 -6
The squid service has been defined with numeric port numbers because
Debian systems have not this service defined.
----------------------------
revision 1.111
date: 2003/03/14 20:59:07;  author: ktsaou;  state: Exp;  lines: +26 -7
Command line argument 'panic' does not call the system's iptables script
but blocks all traffic by itself, since many systems do not have the
'panic' argument.
----------------------------
revision 1.110
date: 2003/03/14 20:36:52;  author: ktsaou;  state: Exp;  lines: +30 -10
Added FIREHOL_AUTOSAVE variable that controls the file that is saved with
the 'save' argument of FireHOL. By default this variable is empty in which
case FireHOL detects RedHat and Debian systems and saves it to the right
place.
----------------------------
revision 1.109
date: 2003/03/07 23:34:29;  author: ktsaou;  state: Exp;  lines: +7 -5
'helpme' now allows ICMP traffic by default.
----------------------------
revision 1.108
date: 2003/03/07 23:17:38;  author: ktsaou;  state: Exp;  lines: +15 -15
Fixed double quoting in router statements produced by 'helpme'.
----------------------------
revision 1.107
date: 2003/03/07 23:12:15;  author: ktsaou;  state: Exp;  lines: +15 -7
'helpme' handles multiple networks in router statements.
----------------------------
revision 1.106
date: 2003/03/07 23:01:31;  author: ktsaou;  state: Exp;  lines: +6 -6
'helpme' mode does not require a configuration file present.
----------------------------
revision 1.105
date: 2003/03/07 09:19:19;  author: ktsaou;  state: Exp;  lines: +6 -6
Made it not ignore the default route in 'helpme' routers.
----------------------------
revision 1.104
date: 2003/03/06 08:18:49;  author: ktsaou;  state: Exp;  lines: +17 -14
Minor changes in 'helpme' generation.
----------------------------
revision 1.103
date: 2003/03/05 22:06:51;  author: ktsaou;  state: Exp;  lines: +23 -14
Made it ignore a default gateway when there was a P-t-P default gateways
found.
----------------------------
revision 1.102
date: 2003/03/05 18:23:57;  author: ktsaou;  state: Exp;  lines: +106 -72
Made the 'helpme' feature append another interface for the default gateway.
----------------------------
revision 1.101
date: 2003/03/05 00:33:56;  author: ktsaou;  state: Exp;  lines: +23 -10
Minor changes in the default help page presented by FireHOL.
----------------------------
revision 1.100
date: 2003/03/05 00:11:56;  author: ktsaou;  state: Exp;  lines: +232 -154
Re-wrote 'helpme' to detect multiple IPs and networks per interfaces,
and to produce multiple interfaces for each IP. This means that FireHOL
is somewhat smart to match IPs with networks and interfaces, to detect
networks behind gateways, default gateways on point-to-point interfaces,
and to produce router statements matching the interfaces detected above.
----------------------------
revision 1.99
date: 2003/03/03 21:51:04;  author: ktsaou;  state: Exp;  lines: +22 -10
Made 'helpme' ignore interfaces that do not have an IP or no traffic is
routed to them (no route).
----------------------------
revision 1.98
date: 2003/02/26 22:26:16;  author: ktsaou;  state: Exp;  lines: +6 -6
Minor changes in 'helpme' and changes in documentation to reflect the
'helpme' feature addition.
----------------------------
revision 1.97
date: 2003/02/25 21:35:06;  author: ktsaou;  state: Exp;  lines: +151 -61
'helpme' now produces router statements for each network each interface
is attached to. This produces templates to be used in cases where one
interface is used for routing traffic between multiple networks.

Additionally, 'helpme' produces example SNAT statements to be used instead
of masquerade when the IPs of the interfaces are statically assigned.
----------------------------
revision 1.96
date: 2003/02/24 23:30:21;  author: ktsaou;  state: Exp;  lines: +48 -58
The helpme wizard now detects interfaces using:

ip link show

detects interface IPs using:

ip addr show

and detects interface networks using:

ip route show

This makes the 'helpme' wizard support any kind of interfaces,
configurations and interfaces aliases.
----------------------------
revision 1.95
date: 2003/02/22 03:50:55;  author: ktsaou;  state: Exp;  lines: +15 -7
Minor changes to helpme output.
----------------------------
revision 1.94
date: 2003/02/22 03:41:16;  author: ktsaou;  state: Exp;  lines: +203 -33
The helpme command line argument is now somewhat useful.
It produces a FireHOL configuration file in standard output.
----------------------------
revision 1.93
date: 2003/02/21 23:47:22;  author: ktsaou;  state: Exp;  lines: +6 -5
Added a modprobe ip_tables before iptables-save to make sure that the
later will not fail during boot.
----------------------------
revision 1.92
date: 2003/02/20 22:32:56;  author: ktsaou;  state: Exp;  lines: +126 -5
Fixed snmptrap and syslog.

Added the still 'under construction' wizard mode.
----------------------------
revision 1.91
date: 2003/02/18 20:42:20;  author: ktsaou;  state: Exp;  lines: +4 -4
Updated RESERVED_IPS according to the latest IANA Reserved IPv4 address
space.
----------------------------
revision 1.90
date: 2003/02/11 22:20:07;  author: ktsaou;  state: Exp;  lines: +25 -9
Added /sbin in front of two sysctl statements that were producing errors
in a few systems.

Added control option FIREHOL_LOG_LEVEL and the optional argument 'level'
to the 'log' parameter in order to accept custom log levels per rule.

Now, to have different log levels, one could write:

	server dhcp accept log "my-dhcp" src 1.1.1.1

to get the default controlled by FIREHOL_LOG_LEVEL, or

	server dhcp accept log "my-dhcp" level critical src 1.1.1.1

Note that the 'level' is NOT a FireHOL optional rule parameter. It is an
optional argument to the 'log' parameter. This for example is invalid:

	server dhcp accept level critical log "my-dhcp" src 1.1.1.1

The new definition of the 'log' optional rule parameter is:

                    log "some text" [level a_level]
----------------------------
revision 1.89
date: 2003/02/03 23:11:49;  author: ktsaou;  state: Exp;  lines: +52 -3
Added service emule.
----------------------------
revision 1.88
date: 2003/01/30 21:39:36;  author: ktsaou;  state: Exp;  lines: +6 -6
Fixed a typo.
----------------------------
revision 1.87
date: 2003/01/30 21:36:07;  author: ktsaou;  state: Exp;  lines: +65 -15
Added TOS and MARK actions in FireHOL's core to support Type-Of-Service and
MARKing (for traffic shapping) in the future.

Also, added an error handler that detects use of SNAT, DNAT, REDIRECT
outside the 'nat' table and TOS, MARK outside the 'mangle' table.
----------------------------
revision 1.86
date: 2003/01/29 23:19:20;  author: ktsaou;  state: Exp;  lines: +26 -12
The nat helper was wrongly producing duplicate logs when log/loglimit was
present in the optional rule parameters. Fixed.
----------------------------
revision 1.85
date: 2003/01/28 19:47:31;  author: ktsaou;  state: Exp;  lines: +4 -4
Made masquerade handle correctly interfaces given directly to it.
----------------------------
revision 1.84
date: 2003/01/28 19:42:09;  author: ktsaou;  state: Exp;  lines: +4 -4
Made it handle the 'reverse' keyword of masquerade correctly.
----------------------------
revision 1.83
date: 2003/01/25 02:33:59;  author: ktsaou;  state: Exp;  lines: +77 -36
FireHOL now supports runtime ERRORs and WARNINGs.

ERRORs are assumed to be situations where FireHOL cannot continue, and it
will exit just after restoring the previous firewall.

WARNINGs are situations where FireHOL cannot determine if the firewall
will or won't work, and it will just present the warning and continue.
----------------------------
revision 1.82
date: 2003/01/25 01:46:11;  author: ktsaou;  state: Exp;  lines: +15 -9
Made FireHOL not stop processing if some required kernel module is not
present. This behaviour is required when the required module is compiled
in the kernel, instead of being a module.

However, FireHOL still calls /sbin/modprobe which will print some error
to the console (this will not make FireHOL stop functioning).
----------------------------
revision 1.81
date: 2003/01/25 00:37:37;  author: ktsaou;  state: Exp;  lines: +25 -9
Added redirect helper to implement port redirections.
----------------------------
revision 1.80
date: 2003/01/22 21:14:21;  author: ktsaou;  state: Exp;  lines: +4 -4
Fixed a small typo.
----------------------------
revision 1.79
date: 2003/01/22 21:02:43;  author: ktsaou;  state: Exp;  lines: +11 -5
Added some comments to the just added code.
----------------------------
revision 1.78
date: 2003/01/22 20:54:05;  author: ktsaou;  state: Exp;  lines: +56 -93
Fixed a bug in 'REJECT with auto' that made FireHOL produce wrong iptables
statements in some versions of BASH.

Fixed a problem of some early 2.4 kernels where not all mangle default
chains are defined. Now, FireHOL detects which chains are present.
----------------------------
revision 1.77
date: 2003/01/22 19:13:27;  author: ktsaou;  state: Exp;  lines: +5 -5
Some text changes.
----------------------------
revision 1.76
date: 2003/01/20 22:10:56;  author: ktsaou;  state: Exp;  lines: +15 -5
Allowed multiple 'to' arguments to DNAT and SNAT.
----------------------------
revision 1.75
date: 2003/01/20 21:50:36;  author: ktsaou;  state: Exp;  lines: +6 -3
Added service cvspserver as suggested by Florian Thiel <thiel@ksan.de>
----------------------------
revision 1.74
date: 2003/01/16 00:55:36;  author: ktsaou;  state: Exp;  lines: +38 -27
Made snat and dnat use one core function named 'nat'.
----------------------------
revision 1.73
date: 2003/01/16 00:33:26;  author: ktsaou;  state: Exp;  lines: +166 -70
Added experimental "snat" and "dnat" helpers.
----------------------------
revision 1.72
date: 2003/01/14 21:49:23;  author: ktsaou;  state: Exp;  lines: +5 -5
*** empty log message ***
----------------------------
revision 1.71
date: 2003/01/13 23:31:03;  author: ktsaou;  state: Exp;  lines: +406 -281
Added user (uid), group (gid), process (pid), session (sid) to optional
rule parameters. Modified FireHOL to apply such parameters only to
traffic send by the localhost and silently ignore them on incoming and
passing through traffic.
----------------------------
revision 1.70
date: 2003/01/08 23:33:25;  author: ktsaou;  state: Exp;  lines: +68 -6
Added detection of overwritten optional rule parameters.
----------------------------
revision 1.69
date: 2003/01/08 22:42:46;  author: ktsaou;  state: Exp;  lines: +9 -6
changed helpers to overwrite illegal optional parameters in order to avoid
building rules that match nothing.

transparent_squid now passes some rule parameters to the rules matching
the user ids. This makes it possible to use succesfully negative rules,
such as:

dst not "A B C"

to make the transparent cache exclude these.
----------------------------
revision 1.68
date: 2003/01/07 20:21:57;  author: ktsaou;  state: Exp;  lines: +39 -30
Made transparent_squid accept multiple users
----------------------------
revision 1.67
date: 2003/01/07 01:51:47;  author: ktsaou;  state: Exp;  lines: +4 -22
Made internal parameters of masquerade to overwrite its optional ones.
Made the version command optional.
----------------------------
revision 1.66
date: 2003/01/06 16:13:34;  author: ktsaou;  state: Exp;  lines: +186 -93
The previous implementation of the "with" parameter was conflicting with
negative expressions. Fixed.

Now each action (ACCEPT, REJECT, etc) can have each own optional rule
parameters. Currently only REJECT (with) and REDIRECT (to-port) have
such parameters.

Implemented the REDIRECT action (usefull in NAT).

Introduced a new concept in FireHOL: helpers

Helpers are functions that do some job for you, like a shortcut.

Implemented the transparent_squid helper.
----------------------------
revision 1.65
date: 2003/01/06 01:16:41;  author: ktsaou;  state: Exp;  lines: +19 -3
I have added a not-to-be-documented command line argument:

gimme-the-services-defs

An application can choose to run FireHOL with this argument to have all
the service definitions FireHOL knows in the environment variables.
----------------------------
revision 1.64
date: 2003/01/06 00:41:10;  author: ktsaou;  state: Exp;  lines: +736 -671
Changed the method with which the current command line was saved for the
error handler. The new way saved a fork() and gave some speed improvements.

Re-arranged the code so that the global variables and the services
definitions will be at the top of the file firehol.sh

Developed a work-around for a bug in iptables-save where:

! --uid-owner A

was saved as

--uid-owner !A

which was giving errors during restoration.
Unfortunatelly this made firehol saving the running firewall without the
use of /etc/init.d/iptables save.
The "save" argument to firehol saves the firewall to:

/etc/sysconfig/iptables
----------------------------
revision 1.63
date: 2003/01/05 20:03:07;  author: ktsaou;  state: Exp;  lines: +29 -3
Added service ping
----------------------------
revision 1.62
date: 2003/01/03 23:34:37;  author: ktsaou;  state: Exp;  lines: +16 -4
Added protocols as services: ICMP, AH, GRE, ESP
----------------------------
revision 1.61
date: 2003/01/01 04:32:48;  author: ktsaou;  state: Exp;  lines: +6 -3
Added service: microsoft_ds
----------------------------
revision 1.60
date: 2003/01/01 03:12:17;  author: ktsaou;  state: Exp;  lines: +51 -38
FireHOL has been changed to be "smart" when REJECTing packets.
If the packet to be rejected is a TCP packet, it will send back a tcp-reset
message, while for any other protocol it will send icmp-port-unreachable.

This is now the default behavior, without specifing a 'with' parameter.

Also, the multicast service has been changed to additionally match
protocol No 2.
----------------------------
revision 1.59
date: 2002/12/31 09:10:15;  author: ktsaou;  state: Exp;  lines: +20 -12
Extended REJECT control ('with' parameter) to work on 'policy' and on the
default firewall policies.
----------------------------
revision 1.58
date: 2002/12/31 08:55:42;  author: ktsaou;  state: Exp;  lines: +19 -4
Added optional rule parameter "with" which is only valid just after the
action "REJECT" on all rules. "with" allows finer control over the method
of packet rejection.
----------------------------
revision 1.57
date: 2002/12/23 14:39:19;  author: ktsaou;  state: Exp;  lines: +609 -501
Code cleanup and code comments
----------------------------
revision 1.56
date: 2002/12/23 13:49:09;  author: ktsaou;  state: Exp;  lines: +27 -4
Error handles now shows the command line that generated the error
as-is in the configuration file.
----------------------------
revision 1.55
date: 2002/12/22 14:02:54;  author: ktsaou;  state: Exp;  lines: +6 -3
Added service APCUPSDNIS.
----------------------------
revision 1.54
date: 2002/12/20 20:31:11;  author: ktsaou;  state: Exp;  lines: +10 -6
Added variable FIREHOL_AMANDA_PORTS to control which ports amanda has been
compiled with.

Added service CUPS.
----------------------------
revision 1.53
date: 2002/12/19 22:52:15;  author: ktsaou;  state: Exp;  lines: +43 -3
Added service AMANDA.
----------------------------
revision 1.52
date: 2002/12/18 23:36:07;  author: ktsaou;  state: Exp;  lines: +98 -42
Fixed a bug in command line parsing when there was a configuration file
specified in the command line together with a command.
Now, when a filename is specified only three commands are valid:
debug, try, start

Fixed error handling to detect errors in a few functions that were
ignored.

Updated documentation to reflect the above changes.

Updated interactive mode help and added directive 'in' as a shortcut to
interface eth0 internet
----------------------------
revision 1.51
date: 2002/12/18 22:05:37;  author: ktsaou;  state: Exp;  lines: +20 -5
Enhanced the error handler to detect errors separately for each protection.
----------------------------
revision 1.50
date: 2002/12/18 20:44:08;  author: ktsaou;  state: Exp;  lines: +78 -71
Fixed a potential security hole where UDP traffic could come in
uncoditionally from source port 53 when there was a:

client dns accept

This means that DNS is back to statefull mode.

Also, removed from ICMP the RELATED state, since it will be matched
at the end of the end of the interface or firewall.
----------------------------
revision 1.49
date: 2002/12/18 20:18:53;  author: ktsaou;  state: Exp;  lines: +13 -5
Fixed active FTP bug. It was not working.
----------------------------
revision 1.48
date: 2002/12/18 00:35:42;  author: ktsaou;  state: Exp;  lines: +7 -3
Added help entry for explain.
----------------------------
revision 1.47
date: 2002/12/18 00:30:28;  author: ktsaou;  state: Exp;  lines: +67 -13
More changes regarding explain.
Added interactive commands 'help', 'show' and 'quit'.
Now the interactive mode automatically generates a configuration file
from all the successfull commands.
Made interactive mode accept variable definitions and loops.
----------------------------
revision 1.46
date: 2002/12/17 20:47:34;  author: ktsaou;  state: Exp;  lines: +100 -24
Added command line argument "explain" to run in interactive debugging
mode.

This resulted in discovering bugs in NFS (fixed) and masquerade (fixed).

Also, enriched the error handler to be more descriptive about what
FireHOL is doing.
----------------------------
revision 1.45
date: 2002/12/16 20:41:39;  author: ktsaou;  state: Exp;  lines: +56 -86
Added service DHCP Relay.

Made kernel modules loaded during run time.

Saving of old firewall takes now place before processing the configuration
file, in order to make sure it will not be altered by accident due to
some illegal commands in the configuration file.

FireHOL enables kernel routing automatically when there is at least a
router defined in the configuration.

Now the configuration accepts command line arguments given to FireHOL.
To send a set of arguments to the script, either just append them to
FireHOL command line or (in case it is not clear if the argument is going
to be used by FireHOL or the configuration) precede the configuration
arguments by -- (two dashes).
----------------------------
revision 1.44
date: 2002/12/16 18:57:30;  author: ktsaou;  state: Exp;  lines: +12 -12
Restored gawk stuff to previous methodology, using <<"EOF" since escaping
produced warnings in debian systems.
----------------------------
revision 1.43
date: 2002/12/13 21:52:19;  author: ktsaou;  state: Exp;  lines: +13 -17
Further optimizations in the error handler.
----------------------------
revision 1.42
date: 2002/12/13 19:56:11;  author: ktsaou;  state: Exp;  lines: +93 -113
Made tons of optimizations for better FireHOL speed.
----------------------------
revision 1.41
date: 2002/12/12 20:07:47;  author: ktsaou;  state: Exp;  lines: +22 -4
Added services: APTPROXY, APCUPSD, ISAKMP
Removed Service: TFTP
----------------------------
revision 1.40
date: 2002/12/11 20:51:38;  author: ktsaou;  state: Exp;  lines: +4 -4
Changed service submission to be presented by number instead of name
because debian does not have this service in /etc/services.
----------------------------
revision 1.39
date: 2002/12/10 23:31:32;  author: ktsaou;  state: Exp;  lines: +3 -3
Made default protections burst 50.
----------------------------
revision 1.38
date: 2002/12/10 23:08:07;  author: ktsaou;  state: Exp;  lines: +5 -3
Added FIREHOL_LOG_FREQUENCY and FIREHOL_LOG_BURST to allow control on
the frequency of the loglimit rule parameter.
----------------------------
revision 1.37
date: 2002/12/10 18:10:38;  author: ktsaou;  state: Exp;  lines: +4 -4
Fixed a bug in netbios_ns
----------------------------
revision 1.36
date: 2002/12/09 21:13:35;  author: ktsaou;  state: Exp;  lines: +9 -9
Fixed a typo in protections, that made them unusable in the previous
version.
----------------------------
revision 1.35
date: 2002/12/08 22:05:40;  author: ktsaou;  state: Exp;  lines: +8 -2
The command line argument stop was not working. Fixed.
----------------------------
revision 1.34
date: 2002/12/07 18:12:43;  author: ktsaou;  state: Exp;  lines: +26 -13
Now protections can be applied on both directions of a router.

When running firehol with a configuration file as the first argument, now
you can specify an action (start, debug, try, etc) as the second argument.
----------------------------
revision 1.33
date: 2002/12/07 00:47:30;  author: ktsaou;  state: Exp;  lines: +27 -174
Re-organized parameters parsing to prevent processing a possible file
in the current directory with filename the name of the FireHOL command.

Now FireHOL locks the subsys firehol, in addition to iptables.
----------------------------
revision 1.32
date: 2002/12/05 09:23:36;  author: ktsaou;  state: Exp;  lines: +31 -2
Added many new services.
----------------------------
revision 1.31
date: 2002/12/05 09:03:37;  author: ktsaou;  state: Exp;  lines: +13 -3
The problem with line numbers on debian systems found to be an awk
alternative those systems use. Now FireHOL uses gawk instead of awk.

Added service SUBMISSION (SMTP or SSL/TLS).
----------------------------
revision 1.30
date: 2002/12/04 23:12:10;  author: ktsaou;  state: Exp;  lines: +35 -2
Fixed a problem where empty parameters to src, dst, etc where not giving
an error and where not producing any iptables statements.
This was happening because FireHOL relies on nested BASH loops, and bash
does not loop with empty iterations...
----------------------------
revision 1.29
date: 2002/12/04 22:41:13;  author: ktsaou;  state: Exp;  lines: +155 -114
Re-wrote the negative expressions handling to archieve near hand-made
(i.e. optimum) quality of iptables firewall.
Now, instead of the linked-list that was created for negative expressions,
we match all positive expressions before the negatives and all the
negatives are together in one chain.
This also fixed possible performance problems due to the large number
of chains and rules that the packets had to traverse in order to get
matched (or not matched).

The fact that now positive rules are matched before negatives has also the
benefit that not all traffic has to be matched against the negatives. Now,
first we select what might be good for a rule, and then we check if this
breaks the negative expressions.

Last, this made the iptables firewall much more clear and human readable.
----------------------------
revision 1.28
date: 2002/12/04 21:32:26;  author: ktsaou;  state: Exp;  lines: +17 -14
Fixed a bug that FireHOL was incorrectly choosing LOCAL_CLIENT_PORTS on
router configurations. This bug appeared when the router configurations
were made to accept normal server/client statements.
----------------------------
revision 1.27
date: 2002/12/04 07:20:19;  author: ktsaou;  state: Exp;  lines: +13 -2
Error handler now works on protections too.
----------------------------
revision 1.26
date: 2002/12/03 22:49:16;  author: ktsaou;  state: Exp;  lines: +75 -20
Changed the banner to be much more descriptive. It now also shows the
services FireHOL supports (removed the services parameter).
----------------------------
revision 1.25
date: 2002/12/03 22:07:09;  author: ktsaou;  state: Exp;  lines: +12 -3
Fixed the usage banner to show the "services" parameter.
----------------------------
revision 1.24
date: 2002/12/03 22:03:00;  author: ktsaou;  state: Exp;  lines: +87 -7
Another work around to fix the problem of LINENO not working in debian
systems.

Added command line argument "services" which shows all the service
definitions firehol knows about.
----------------------------
revision 1.23
date: 2002/12/02 17:48:41;  author: ktsaou;  state: Exp;  lines: +13 -8
Fixed a bug where some versions of BASH do not handle correctly cat >>"EOF".
They treat it as cat >>EOF and thus they do variable substitution on the
text.
Now, FireHOL uses cat >>EOF but the text has been escaped in order to avoid
variable substitution.

The problem has been reported by Florian Thiel <thiel@ksan.de>.
----------------------------
revision 1.22
date: 2002/12/02 00:01:24;  author: ktsaou;  state: Exp;  lines: +14 -7
Fixed parameter 'custom' processing. It is not an array now, but it is
treated specially to support BASH special characters such as !
Quoting things in parameters 'custom' needs tweaking still.
----------------------------
revision 1.21
date: 2002/12/01 04:34:00;  author: ktsaou;  state: Exp;  lines: +48 -61
More quoting issues fixed. Changed the core to work with BASH arrays in
order to handle quoted arguments accurately.

Fixed a bug in postprocessing error handler that did not present the
command line that produced the error.
----------------------------
revision 1.20
date: 2002/11/30 22:53:55;  author: ktsaou;  state: Exp;  lines: +235 -186
Fixed various problems related to quoted arguments.
Fixed iptables generation to support quoted arguments.
Made chain names shorter.

Every single element in the firehol config now gets its own chain.
Previously, the same services (e.g. smtp servers) were implemented using
only one pair of chains.

Enhanced the error handler of logical and syntactical error. Now it says
were and why an error has occured.
----------------------------
revision 1.19
date: 2002/11/30 14:33:33;  author: ktsaou;  state: Exp;  lines: +77 -57
As suggested by Florian Thiel <thiel@ksan.de>:
a. Fixed service IRC to work on TCP instead of UDP.
b. Added services: UUCP, VNC, WEBCACHE, IMAPS, IKE.

Also fixed the home-router.conf example (it was outdated).
----------------------------
revision 1.18
date: 2002/11/03 13:17:39;  author: ktsaou;  state: Exp;  lines: +30 -10
Minor aesthetic changes.
----------------------------
revision 1.17
date: 2002/11/01 19:37:20;  author: ktsaou;  state: Exp;  lines: +82 -1
Added service: any
Any allows the administrator to define any stateful rule to match services
that cannot have source and destination ports, such as unusual protocols,
etc.

Syntax: type any name action [optional rule parameters]

type: server/client/route
name: the name for the service (used for the chain)
action: accept, reject, etc.


Added service: multicast
Multicast allows the administrator to match packets with destination
224.0.0.0/8 in both directions (input/output).
----------------------------
revision 1.16
date: 2002/10/31 15:31:52;  author: ktsaou;  state: Exp;  lines: +61 -13
Added command line parameter 'try' (in addition to 'start', 'stop', etc)
that when used it activates the firewall and waits 30 seconds for the
administrator to type 'commit' in order to keep the firewall active.
If the administrator does not write 'commit' or the timeout passes, FireHOL
restores the previous firewall.

Also, if you break (Ctrl-C) FireHOL while activating the new firewall,
FireHOL will restore the old firewall.
----------------------------
revision 1.15
date: 2002/10/30 23:25:07;  author: ktsaou;  state: Exp;  lines: +80 -61
Rearranged default RELATED rules to match after normal processing and
protections.
Made the core of FireHOL operate on multiple tables (not assuming the
rules refer to the 'filter' table). This will allow FireHOL to support
all kinds of NAT chains in the future.
----------------------------
revision 1.14
date: 2002/10/29 22:20:41;  author: ktsaou;  state: Exp;  lines: +79 -27
Client and server keywords now work on routers too.
(The old 'route' subcommand is an alias for the 'server' subcommand -
within a router).
Protection can be reversed on routers to match outface instead of inface.
Masquerade can be used in interfaces, routers (matches outface - but can
be reverse(ed) to match inface) or as a primary command with all the
interfaces to be masqueraded in an argument.
----------------------------
revision 1.13
date: 2002/10/28 19:47:02;  author: ktsaou;  state: Exp;  lines: +31 -27
Protection has been extented to work on routers too.
Made a few minor aesthetic changes on the generated code. Now in/out chains
on routers match the inface/outface correctly.
----------------------------
revision 1.12
date: 2002/10/28 18:45:54;  author: ktsaou;  state: Exp;  lines: +35 -14
Added support for ICMP floods protection and from BAD TCP flags protection.
This was suggested by: Fco.Felix Belmonte (ffelix@gescosoft.com).
----------------------------
revision 1.11
date: 2002/10/27 12:47:48;  author: ktsaou;  state: Exp;  lines: +5 -0
Added CVS versioning to all files.
----------------------------
revision 1.10
date: 2002/10/27 02:49:34;  author: ktsaou;  state: Exp;  lines: +66 -5
Added service IRC.
Extended kernel modules handling to simple services too.
Simple services can now have:

require_myservice_modules="module"
require_myservice_nat_modules="module"

in order to have these modules installed if and when "myservice" is
used.

Added the "masquerade" interfaces subcommand, that gives a shortcut to
masquerade on the output of an interface.

FireHOL, now have a separate rule to match all RELATED sockets on all
chains. This is always added at the top of the firewall.

FireHOL, now DROPs all INVALID packets, as suggested by the iptables
HOW-TO.

Various other minor enhancements.
----------------------------
revision 1.9
date: 2002/10/26 15:14:52;  author: ktsaou;  state: Exp;  lines: +40 -26
Added logging options support as suggested by:
Fco.Felix Belmonte <ffelix@gescosoft.com>
----------------------------
revision 1.8
date: 2002/10/24 21:10:01;  author: ktsaou;  state: Exp;  lines: +86 -9
Removed service TFTP since this requires a kernel module for stateful
operation.

After suggestions by Fco.Felix Belmonte (ffelix@gescosoft.com),
I have added:

a) RESERVED_IPS, PRIVATE_IPS, MULTICAST_IPS and UNROUTABLE_IPS
You can use the above in SRC (not) parameters to match them.
The use of UNROUTABLE_IPS is suggested for cases where an interface is
exclusivelly public.

b) kernel module requirements per complex service and for the
configuration file as a whole.
Now you can use:

# one line for each module, somewhere in your config file
require_kernel_module <kernel_module>

to have FireHOL require some kernel module to succesfully complete
the firewall configuration.

As an option for those running NAT, you can use:

FIREHOL_NAT=1 # put this at the top of your config file

to make the complex services require also the NAT modules for the
services they implement.

Finally, I have added a get-iana.sh script that produces one BASH
statement for RESERVED_IPS.
----------------------------
revision 1.7
date: 2002/10/20 19:09:18;  author: ktsaou;  state: Exp;  lines: +1 -1
Changed TFTP from TCP to UDP.
----------------------------
revision 1.6
date: 2002/10/11 21:09:11;  author: ktsaou;  state: Exp;  lines: +18 -0
Added services RNDC, FINGER, ECHO, DAYTIME, NNTP
----------------------------
revision 1.5
date: 2002/10/04 17:35:49;  author: ktsaou;  state: Exp;  lines: +137 -7
Fixed negative expressions in FireHOL statements.
By default, when multiple instances of interfaces/ports/addresses exist
FireHOL produces one rule for each instance. However when negative
expressions were defined the previous approach was producing ORed iptables
statements instead of ANDed statements.
The new code, now produces linked lists of iptables chains for all negative
expressions so that only if ALL the negative are matched, one rule for each
positive expression will be produced.

Example: interface eth0 myname src "1.1.1.1 2.2.2.2"

This will correctly produce two indepedent rules, one for each IP address.
But:

interface eth0 myname src NOT "1.1.1.1 2.2.2.2"

was incorrectly producing two indepedent rules. Now the later statement
produces a linked list that first matches that the source of the packets
is not 1.1.1.1, in which case it forwards the packets to the second chain
in the lists that confirms that the packets are not comming from 2.2.2.2,
which finally sends the packets to their destination to be checked if they
are comming from eth0.

Note: I don't know the overhead of this linked list thing. I hope iptables
is fast enough...
----------------------------
revision 1.4
date: 2002/10/03 23:53:09;  author: ktsaou;  state: Exp;  lines: +68 -58
Added control for unmatched packets using:
UNMATCHED_INPUT_POLICY=
UNMATCHED_OUTPUT_POLICY=
UNMATCHED_ROUTER_POLICY=
and removed DEFAULT_ROUTER_POLICY since iptables accepts only DROP and ACCEPT.

To control what will happen to unmatched packets just set the above variables
in /etc/firehol.conf

Note that in any case (e.g. UMATCHED_ROUTER_POLICY=ACCEPT) the packets will
still be logged to syslog.

Made also various aesthetic changes in the code.

Rules programmers can now include their service names in the
ALL_SHOULD_ALSO_RUN variable and the "all" service will run them
automatically.
----------------------------
revision 1.3
date: 2002/10/03 16:28:16;  author: ktsaou;  state: Exp;  lines: +60 -7
Service ntp is now both TCP and UDP and accepts clients from default ports.
DNS over TCP is stateful but over UDP is now not stateful. This will not bother your syslog if your DNS server fails to reply within the stateful UDP timeout of iptables.
Added service rsync.
Added service vmwareauth.
Added service vmwareweb.
Added DEFAULT_ROUTER_POLICY to control how firehol handles its routing.
Fixed a bug where firehol script arguments were not passed to /etc/init.d/iptables.
Increased version number to 5.
----------------------------
revision 1.2
date: 2002/09/08 12:05:10;  author: ktsaou;  state: Exp;  lines: +28 -18
Release 4.
Made it work on non RedHat systems.
client/server/route now accept many services on the same line.
Other minor fixes and enhancements.
Verified NFS operation.
----------------------------
revision 1.1
date: 2002/09/05 20:57:59;  author: ktsaou;  state: Exp;
branches:  1.1.1;
Initial revision
----------------------------
revision 1.1.1.1
date: 2002/09/05 20:57:59;  author: ktsaou;  state: Exp;  lines: +0 -0
First Public Release
=============================================================================