Description: All the patches that had been directly applied before the
 conversion to source format 3.0 (quilt).
Last-Update: 2018-10-09

--- mason-1.0.0.orig/Makefile
+++ mason-1.0.0/Makefile
@@ -35,11 +35,13 @@ MASONVER = 1.0.0
 
 #No quotes around multi file specs.
 BINDIR=$(DESTDIR)/usr/bin/
-BINFILES=mason mason-gui-text mason-decide
+BINFILES=mason mason-gui-text 
 CONFDIR=$(DESTDIR)/etc/
 CONFFILE=masonrc
 LIBDIR=$(DESTDIR)/var/lib/mason/
-LIBFILES=masonlib baserules.sample graffiti-services moreservices nmap-services portsdb-services regression-test all-ip-numbers.txt
+LIBFILES=baserules.sample graffiti-services moreservices nmap-services portsdb-services regression-test all-ip-numbers.txt
+LIBSCRIPTDIR=$(DESTDIR)/var/lib/mason/
+LIBSCRIPTFILES=masonlib mason-decide
 DOCDIR=$(DESTDIR)/usr/doc/mason-${MASONVER}/
 DOCFILES=COPYING index.html mason.sgml mason.txt mason.html mason-1.html mason-2.html mason-3.html mason-4.html mason-5.html mason-6.html mason-7.html mason-8.html mason-9.html mason-10.html mason-11.html toc.gif prev.gif next.gif mason-banner.gif
 #DOCDIR=$(DESTDIR)/usr/doc/mason/
@@ -59,6 +61,8 @@ install:
 	@install -o root -g root -m 0755 -d ${LIBDIR}
 	@echo -n "${LIBFILES}... "
 	@install -o root -g root -m 0644 ${LIBFILES} ${LIBDIR}
+	@echo -n "${LIBSCRIPTFILES}... "
+	@install -o root -g root -m 0755 ${LIBSCRIPTFILES} ${LIBSCRIPTDIR}
 	@echo -n "doc directory... "
 	@install -o root -g root -m 0755 -d ${DOCDIR}
 	@echo -n "${DOCFILES}... "
@@ -90,7 +94,7 @@ install:
 docs:
 	sgml2html --imagebuttons mason.sgml \
 	&& sgml2txt -f mason.sgml \
-	&& makedoc mason.txt mason.pdb 'The Mason HOWTO'
+#	&& makedoc mason.txt mason.pdb 'The Mason HOWTO'
 
 regress:
 	@if ./regression-test ; then \
--- mason-1.0.0.orig/baserules.sample
+++ mason-1.0.0/baserules.sample
@@ -1,31 +1,45 @@
-#Put any fixed rules you wish here.  Example:
-
-#if [ -f /proc/net/ip_fwchains ]; then
-#	#Place the ipchains versions of your rules here
-#	/sbin/ipchains -A forward -s 172.16.0.0/24 -j MASQ		#Masquerade from internal lan out
-#elif [ -f /proc/net/ip_input ]; then
-#	#Place the ipfwadm versions of your rules here.
-#	/sbin/ipfwadm -F -a accept -m -S 172.16.0.0/24			#Masquerade from internal lan out
-#else		#The old >>>elif [ -n "`lsmod | grep '^ip_tables '`" ]; then<<<< doesn't work as iptables can be kernel-resident.  Cross your fingers.
-#	#Place the iptables versions of your rules here
-#	#The following loads all netfilter modules - this may or may not be appropriate for you
-#	MODDIR="/lib/modules/`uname -r`"
-#	for MOD in \
-#	 $MODDIR/ipv4/ip_* \
-#	 $MODDIR/ipv4/ipt_* \
-#	 $MODDIR/ipv4/iptable_* \
-#	 $MODDIR/kernel/net/ipv4/netfilter/ip_* \
-#	 $MODDIR/kernel/net/ipv4/netfilter/ipt_* \
-#	 $MODDIR/kernel/net/ipv4/netfilter/iptable_* ; do
-#	    insmod $MOD >/dev/null 2>/dev/null ; modprobe $MOD >/dev/null 2>/dev/null
-#	done
-#	#Masquerade from internal lan out - syntax from iptables howto; thanks, Rusty.
-#	iptables -A POSTROUTING -t nat -s 172.16.0.0/24 -o ppp0 -j MASQUERADE
-#	#The following will allow the response packets back in/out/through your firewall.
-#	#This, too, may or may not be appropriate for you and should not be taken as a suggestion.
-#	#It is only here as a convience.  If you use these, Mason will build a firewall
-#	#of opening packets only.
-#	iptables -A INPUT   -m state --state ESTABLISHED,RELATED                                                -j ACCEPT
-#	iptables -A FORWARD -m state --state ESTABLISHED,RELATED                                                -j ACCEPT
-#	iptables -A OUTPUT  -m state --state ESTABLISHED,RELATED                                                -j ACCEPT
-#fi
+##!/bin/sh
+##=============================================================================
+## Example of a mason firewall script
+##=============================================================================
+#
+## ---------------------------------------------------------------------
+## Allow all local connections
+## ---------------------------------------------------------------------
+#/sbin/iptables -A INPUT  -i lo -j ACCEPT
+#/sbin/iptables -A OUTPUT -o lo -j ACCEPT
+#
+## ---------------------------------------------------------------------
+## Allow ESTABLISHED and RELATED packets globally, to drastically reduce
+## the number of reported rules in learning mode
+## ---------------------------------------------------------------------
+## Hint: "There is a certain feature in iptables that is not so well 
+## documented and may therefore be overlooked by a lot of people [...]
+## If you use state NEW, packets with the SYN bit unset will get through 
+## your firewall." Cited from: 
+## http://iptables-tutorial.frozentux.net/iptables-tutorial.html#NEWNOTSYN
+## ---------------------------------------------------------------------
+#/sbin/iptables -A INPUT                  -m state --state ESTABLISHED -j ACCEPT
+#/sbin/iptables -A INPUT                  -m state --state RELATED     -j ACCEPT
+#/sbin/iptables -A INPUT                  -m state --state INVALID     -j DROP
+#
+#/sbin/iptables -A OUTPUT                 -m state --state ESTABLISHED -j ACCEPT
+#/sbin/iptables -A OUTPUT                 -m state --state RELATED     -j ACCEPT
+#/sbin/iptables -A OUTPUT                 -m state --state INVALID     -j DROP
+#
+## ---------------------------------------------------------------------
+## Drop all new new tcp-connections without a sys-flag
+## ---------------------------------------------------------------------
+## Info: "There is a certain feature in iptables that is not so well 
+## documented and may therefore be overlooked by a lot of people [...]
+## If you use state NEW, packets with the SYN bit unset will get through 
+## your firewall." Cited from: 
+## http://iptables-tutorial.frozentux.net/iptables-tutorial.html#NEWNOTSYN
+## ---------------------------------------------------------------------
+#/sbin/iptables -A INPUT   -p tcp ! --syn -m state --state NEW         -j DROP
+#/sbin/iptables -A OUTPUT  -p tcp ! --syn -m state --state NEW         -j DROP
+#
+## ---------------------------------------------------------------------
+## Allowed connections 
+## ---------------------------------------------------------------------
+#
--- mason-1.0.0.orig/firewall
+++ mason-1.0.0/firewall
@@ -3,12 +3,22 @@
 # firewall        Starts a Mason firewall.
 #
 #
+### BEGIN INIT INFO
+# Provides:          mason
+# Required-Start:    $network
+# Required-Stop:     $network
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Starts the mason firewall script
+# Description:       Starts the firewall script /etc/mason.baserules. The script was created with the mason firewall builder.
+### END INIT INFO
+#
 # chkconfig: 2345 18 92
 # description: firewall starts the firewall created by the Mason \
 # firewall builder.  As a firewall is important to system security, \
 # it should be always turned on.
 
-# Debian init script derived from original script by Jeff Licquia.
+# Debian init script derived from original script by Jeff Licquia
 
 # Debian flags for runlevels - similar to RH's chkconfig.
 FLAGS="defaults 19"
--- mason-1.0.0.orig/mason
+++ mason-1.0.0/mason
@@ -146,7 +146,7 @@ for ONEIF in $DYNIF ; do
 		echo "export ${ONEIF}ADDR=\"0/0\"	${CMNT} ${CMNT}Use this if you want to match any address on $ONEIF."
 	fi
 	if [ "$DYNIFMODE" != "SPECIFICIP" ]; then echo -n "$CMNT $CMNT" ; fi
-	echo "export ${ONEIF}ADDR=\"\`ifconfig $ONEIF 2>/dev/null | awk '/inet addr/{print substr($2,6)}'\`$SINGLEMACHSPEC\"	${CMNT} ${CMNT}Use this if you want to match a single address on $ONEIF."
+	echo "export ${ONEIF}ADDR=\"\`LC_ALL=C ifconfig $ONEIF 2>/dev/null | awk '/inet addr/{print substr(\$2,6)}'\`$SINGLEMACHSPEC\"	${CMNT} ${CMNT}Use this if you want to match a single address on $ONEIF."
 	if [ "$DYNIFMODE" != "SMALLESTRANGE" ]; then echo -n "$CMNT $CMNT" ; fi
 #FIXME - what if the file is empty?
 	echo "export ${ONEIF}ADDR=\"$(encompassingnetworkof $(cat ${MASONDIR}${ONEIF}-ips | sort | uniq) || logfail $LINENO return encompassing network for $ONEIF)\"	${CMNT} ${CMNT}Use this if you want to match all addresses seen so far on $ONEIF."
--- mason-1.0.0.orig/mason-decide
+++ mason-1.0.0/mason-decide
@@ -176,7 +176,7 @@ while [ "$EXITNOW" != "YES" ] && read IN
 				echo $ENH "${WARN}$0: Can't create temp file.${NORM}"
 			else
 				echo "$CURRLINE" >$TMPFILE
-				$EDITOR $TMPFILE <&10
+				eval $EDITOR $TMPFILE <&10
 				CURRLINE=`cat $TMPFILE`
 				rm -f $TMPFILE || :
 			fi	;;
--- mason-1.0.0.orig/mason-gui-text
+++ mason-1.0.0/mason-gui-text
@@ -4,6 +4,25 @@ set -e
 #See top of Mason script for copyright and licensing information.
 #Last YYYY code used: 0019, use 0020 next
 
+# ---------------------------------------------------------------------
+# Kill another instance of mason if this programm is started with
+# the option "--force" - 2008-06-27 - Scheffczyk
+# ---------------------------------------------------------------------
+if [ "$$"x != "`/bin/pidof -x /usr/bin/mason-gui-text`"x ]; then
+    if [ "$1"x == "--force"x ]; then
+	echo "Told to stop another instance of $0  ..."
+	kill -9 `ps aux | grep mason | egrep -v "(grep mason|$$)" | awk '{ print $2 }'`
+	if [ "$$"x != "`/bin/pidof -x /usr/bin/mason-gui-text`"x ]; then
+	    echo "Unable to stop another instance of $0. Exiting ...";
+	    exit 1;
+	fi;
+    else
+	echo "Another instance of $0 is running. Exiting ...";
+	exit 1;
+    fi;
+fi;
+
+
 CKPTMGT=" mgt: Ground0" ; #ckpt $CKPTMGT
 
 MASONDIR=${MASONDIR:-"/var/lib/mason/"}
@@ -118,21 +137,41 @@ killrunningmason
 
 while [ ! "$EXITCONTROL" = "YES" ]; do
 	clear
-	echo $ENH "${HEADER}---- ${BLUE}Mason${HEADER} firewall builder for Linux                         ----$NORM"
-	echo $ENH "${HEADER}---- Learning shell for Mason.                                ----$NORM"
-	echo $ENH "${HEADER}---- see http://www.pobox.com/~wstearns/mason/ for more info. ----$NORM"
-	echo $ENH "${HEADER}---- William Stearns <wstearns@pobox.com>                     ----$NORM"
+	echo "------------------------------------------------------------------"
+	echo $ENH "${HEADER}${BLUE}Mason${HEADER} firewall builder for Linux         $NORM"
+	echo "------------------------------------------------------------------"
+	echo $ENH "${HEADER}---- Learning shell for Mason.                                $NORM"
+	echo $ENH "${HEADER}---- see http://www.pobox.com/~wstearns/mason/ for more info. $NORM"
+	echo $ENH "${HEADER}---- Originally from William Stearns <wstearns@pobox.com>     $NORM"
 	if [ -n "$MASONVER" ]; then
-		echo $ENH "${HEADER}(This is release $MASONVER)$NORM"
+	    echo $ENH "${HEADER}---- This is release $MASONVER $NORM"
 	fi
+	echo "------------------------------------------------------------------"
+        if [ -z  "`/bin/pidof -x /sbin/klogd`" ]; then
+           echo "Warning: No instance of klogd (kernel log deamon) is running,"
+           echo "         mason will not be able to learn new rules."
+	   echo "------------------------------------------------------------------"
+        fi
+        if [ ! -f  "$PACKETLOGFILE" ]; then
+           echo "Warning: The syslog file $PACKETLOGFILE does not exist,"
+           echo "         mason will not be able to learn new rules."
+	   echo "------------------------------------------------------------------"
+	else
+		if [ -z "` find $PACKETLOGFILE -cmin -60`" ]; then
+	        	echo "Warning: No messages was written to the syslog file $PACKETLOGFILE"
+	        	echo "         the last hour, the file is probably not in use by a"
+        		echo "         syslog deamon. Mason will not be able to learn new rules."
+	  		echo "------------------------------------------------------------------"
+		fi
+        fi
 	if [ -n "$MASONPID$MASONTAILPID" ]; then
 		echo Mason is currently in learn mode.
-		echo
+		echo "------------------------------------------------------------------"
 		echo $ENH ${KEY}EL${NORM}: ${KEY}E${NORM}nd ${KEY}L${NORM}earning.
 		showstate 'Mason-gui-text: Main menu, learning in the background'
 	else
 		echo Mason IS NOT currently learning.
-		echo
+		echo "------------------------------------------------------------------"
 		echo $ENH ${KEY}BL${NORM}: ${KEY}B${NORM}egin ${KEY}L${NORM}earning.
 		showstate 'Mason-gui-text: Main menu, not learning'
 	fi
@@ -357,6 +396,12 @@ while [ ! "$EXITCONTROL" = "YES" ]; do
 		killrunningmason
 		flushfirewall
 		runfirewall STANDARD
+		# ---------------------------------------------------------------------
+		# Restart services that modify iptables rules - 2008-04-02 - Scheffczyk
+		# ---------------------------------------------------------------------
+		wrap Restarting services ...
+		RestartServices
+		wrap Done!
 																;;
 	*)	wrap ${WARN}Unknown choice.  Please enter the one or two character code.${NORM}
 																;;
--- mason-1.0.0.orig/mason-gui-text.1
+++ mason-1.0.0/mason-gui-text.1
@@ -1,20 +1,18 @@
-.TH MASON-GUI-TEXT 1 
 .\" NAME should be all caps, SECTION should be 1-8, maybe w/ subsection
 .\" other parms are allowed: see man(7), man(1)
-.SH NAME
+.TH "MASON-GUI-TEXT" "1" "" "" ""
+.SH "NAME"
 mason\-gui\-text \- front end to mason
-.SH SYNOPSIS
-.B mason\-gui\-text
+.SH "SYNOPSIS"
+.B \fBmason\-gui\-text\fR [\fB\-\-force\fR]
 .SH "DESCRIPTION"
 .B mason\-gui\-text
-is a "textual GUI" front end to mason, the interactive firewall
-builder.  When it is run, it allows you to control mason's behavior
-through simple keystroke commands.  It can start and stop mason, allow 
-you to edit the rules generated (and re-merge them into the currently
-running rule set), and change mason's settings.  It also has a
-"console lock" setting for locking the console down if necessary.
+is a "textual GUI" front end to mason, the interactive firewall builder.  When it is run, it allows you to control mason's behavior through simple keystroke commands.  It can start and stop mason, allow you to edit the rules generated (and re\-merge them into the currently running rule set), and change mason's settings.  It also has a "console lock" setting for locking the console down if necessary.
+.SH "OPTIONS"
+Default behaviour of mason\-gui\-text ist to exit if another instance of it is already running.
+.IP "\fB\-\-force\fR
+Try to stop other instances of mason\-gui\-text and continue running
 .SH "SEE ALSO"
-.B "QuickStart, mason(1)"
-.SH AUTHOR
-This manual page was written by Jeff Licquia <jeff@luci.org>,
-for the Debian GNU/Linux system (but may be used by others).
+.B "mason(1)"
+.SH "AUTHOR"
+This manual page was written by Jeff Licquia <jeff@luci.org> for the Debian GNU/Linux system (but may be used by others) and supplemented by Thomas Scheffczyk <scheffczyk@debian.org>.
--- mason-1.0.0.orig/mason.1
+++ mason-1.0.0/mason.1
@@ -1,17 +1,17 @@
-.TH MASON 1 
 .\" NAME should be all caps, SECTION should be 1-8, maybe w/ subsection
 .\" other parms are allowed: see man(7), man(1)
-.SH NAME
+.TH "MASON" "1" "" "" ""
+.SH "NAME"
 mason \- interactively create a firewall
-.SH SYNOPSIS
+.SH "SYNOPSIS"
 .B mason
 .I "< logfile > rulefile"
-.br
+.br 
 .SH "DESCRIPTION"
 This manual page briefly documents the
 .BR mason 
 command.
-.PP
+.PP 
 .B mason
 interactively generates a set of firewall rules for a Linux\-based
 firewall.  This is done by turning on full IP logging, watching the
@@ -21,20 +21,20 @@ seen.
 is familiar with most of the quirks of various connection types (such
 as ftp and IRC), and can output rules for 2.0.x ipfwadm, 2.2.x
 ipchains, and Cisco packet filters.
-.PP
+.PP 
 .B mason
 operates by reading in log file information from standard input and
 writing firewall rules to standard output.  This allows
 .B mason
-to work offline or on a separate system.  Real-time firewall
+to work offline or on a separate system.  Real\-time firewall
 generation can be achieved with a command like tail(1).
-.PP
+.PP 
 Most users will want to run mason with a user\-friendly interface such
 as mason\-gui\-text(1).
-.SH ENVIRONMENT
+.SH "ENVIRONMENT"
 .B mason
 is configured using the following environment variables.
-.TP
+.TP 
 .B ECHOCOMMAND
 Sets the type of firewall rules that
 .B mason
@@ -43,7 +43,7 @@ should output to standard out.  Allowed
 .B mason
 outputs whatever kind of rules are supported by the currently running
 Linux kernel.
-.TP
+.TP 
 .B DOCOMMAND
 Sets the type of firewall rules that
 .B mason
@@ -52,20 +52,20 @@ include "ipfwadm" and "ipchains".  By de
 .B mason
 outputs whatever kind of rules are supported by the currently running
 Linux kernel.
-.TP
+.TP 
 .B HEARTBEAT
 If set to "yes",
 .B mason
-will output a "+" or "-" to standard error whenever a rule generated
+will output a "+" or "\-" to standard error whenever a rule generated
 by
 .B mason
 has been triggered.
-.TP
+.TP 
 .B DYNIP
 Set this to the list of interfaces that have dynamically assigned
 addresses, separated by spaces.
 .SH "SEE ALSO"
-.B "mason.txt, mason\-gui\-text(1)"
-.SH AUTHOR
+.B "mason\-gui\-text(1)"
+.SH "AUTHOR"
 This manual page was written by Jeff Licquia <jeff@luci.org>,
 for the Debian GNU/Linux system (but may be used by others).
--- mason-1.0.0.orig/masonlib
+++ mason-1.0.0/masonlib
@@ -26,10 +26,10 @@
 #		  || logfail $LINENO masonlib: YYYY #### the_command_that_was_supposed_to_run
 #Last YYYY code used: 0149, use 0150 next
 
-if [ -f /usr/lib/samlib/samlib ]; then
-	. /usr/lib/samlib/samlib
+if [ -f /var/lib/mason/samlib ]; then
+	. /var/lib/mason/samlib
 else
-	echo "/usr/lib/samlib/samlib is missing - please get it from" >/dev/stderr
+	echo "/var/lib/mason/samlib is missing - please get it from" >/dev/stderr
 	echo "http://www.stearns.org/samlib/" >/dev/stderr
 	echo "Exiting." >/dev/stderr
 	exit 1
@@ -44,7 +44,7 @@ for ONEFUNC in askYN encompassingnetwork
 	fi
 done
 
-MASONVER="1.0.0, 5/12/2002"
+MASONVER="1.0.0-11 - 2008-06-27"
 
 #-------------------------------------------------------------------------
 # addcounts procedure, adds the packet counts to the rules in a file.
@@ -289,7 +289,7 @@ checkconf () {
 	#SYSTEMRULEFILE=${SYSTEMRULEFILE:-"${MASONDIR}systemrules"} ;	if [ ! -f $SYSTEMRULEFILE ]; then touch $SYSTEMRULEFILE || logfail $LINENO masonlib: 0015 touch $SYSTEMRULEFILE ; fi
 	PACKETLOGFILE=${PACKETLOGFILE:-"/var/log/messages"}
 	MASONEXE=${MASONEXE:-"/usr/bin/mason"}
-	MASONDECIDE=${MASONDECIDE:-"/usr/bin/mason-decide"}
+	MASONDECIDE=${MASONDECIDE:-"/var/lib/mason/mason-decide"}
 
 	CKPTCHECKCONF=" checkconf: Set up ANSI escape codes" ; #ckpt $CKPTCHECKCONF
 	if [ "$USEANSI" != "NO" ]; then
@@ -301,7 +301,8 @@ checkconf () {
 		     BLUE="\033[1;34m"
 		     PINK="\033[1;35m"
 		TURQUOISE="\033[1;36m"
-		     NORM="\033[1;37m"
+#		     NORM="\033[1;37m"
+		     NORM="`tput sgr0 2`"
 		   BRIGHT="\033[1;39m"
 	else
 		      ENH=""
@@ -448,7 +449,7 @@ checkconf () {
 	[Nn][Oo]|[Nn][Oo][Nn][Ee])									ECHOCOMMAND="none"		;;
 	*)	if [ -f /proc/net/ip_fwchains ]; then					ECHOCOMMAND="ipchains"
 		elif [ -f /proc/net/ip_input ]; then					ECHOCOMMAND="ipfwadm"
-		elif [ -n "`lsmod | grep '^ip_tables '`" ]; then		ECHOCOMMAND="iptables"
+		elif [ -f /proc/net/ip_tables_names ]; then		ECHOCOMMAND="iptables"
 		else													ECHOCOMMAND="ipchains"			#Set default here
 		fi																				;;
 	esac
@@ -478,7 +479,7 @@ checkconf () {
 	[Ii][Pp][Tt][Aa][Bb][Ll][Ee][Ss])
 		DOCOMMAND="iptables"
 		#FIXME - how to reliably test for kernel iptables support
-		#if [ -z "`lsmod | grep '^ip_tables '`" ]; then
+		#if -z "`lsmod | grep '^ip_tables '`" ]; then
 		#	wrap ${WARN}WARNING! User has requested iptables, but it appears to be unavailable. Proceeding, but this is not likely to work.${NORM} >/dev/stderr
 		#	sleep 10
 		#fi
@@ -682,10 +683,15 @@ checkconf () {
 
 	CKPTCHECKCONF=" checkconf: Check editor" ; #ckpt $CKPTCHECKCONF
 	if [ -z "$EDITOR" ]; then
-		for TRYEDITOR in `type -path mcedit || :` `type -path pico || :` `type -path vi || :` `type -path jove || :` `type -path nedit || :` `type -path emacs || :` ; do
+		for TRYEDITOR in `type -path emacs || :` `type -path vi || :` `type -path nano || :` `type -path mcedit || :` `type -path pico || :` `type -path jove || :` `type -path nedit || :`  ; do
+		        # 2008-06-27 - Scheffczyk: Added the -nw switch if emacs is choosen as an editor 
 			if [ -z "$EDITOR" ]; then
+			    if [ "$TRYEDITOR"x == "emacs"x ]; then
+				EDITOR="emacs -nw";
+			    else
 				EDITOR=$TRYEDITOR
-				wrap Editor default of $EDITOR taken. >/dev/stderr
+			    fi
+			    wrap Editor default of $EDITOR taken. >/dev/stderr
 			fi
 		done
 		unset TRYEDITOR || :
@@ -716,7 +722,7 @@ checksys () {
 		exit 0
 	fi
 
-	if [ ! -f /proc/net/ip_fwchains ] && [ ! -f /proc/net/ip_input ] && [ -z "`lsmod | grep '^ip_tables '`" ]; then
+	if [ ! -f /proc/net/ip_fwchains ] && [ ! -f /proc/net/ip_input ] && [ ! -f /proc/net/ip_tables_names ]; then
 		wrap ${WARN}This kernel does not support ipchains, ipfwadm or iptables!${NORM} >/dev/stderr
 		#DOCOMMAND="none"		#Should we force to none?
 	fi
@@ -1199,13 +1205,12 @@ dorule () {
 	esac #Case $1=action
 } #End of dorule
 
-
-
 #-------------------------------------------------------------------------
 #Flush the existing rules so we start with a clean slate.
 #-------------------------------------------------------------------------
 flushfirewall () {	#SUDO checked
 	CKPTFLUSHFIREWALL=" flushfirewall: Start" ; #ckpt $CKPTFLUSHFIREWALL
+	savepacketstats
 	updatecounts
 	echo -n Flushing... >/dev/stderr
 
@@ -1229,7 +1234,7 @@ flushfirewall () {	#SUDO checked
 		dorule f "$ONECHAIN" '' '' '' '' '' '' '' '' '' '' '' '' '' || logfail $LINENO masonlib: 0039/0041/0043/0048/0050/0052
 	done
 
-	if [ -f /proc/net/ip_fwchains ] || [ -n "`lsmod | grep '^ip_tables '`" ]; then
+	if [ -f /proc/net/ip_fwchains ] || [ -f /proc/net/ip_tables_names ]; then
 		#Flush the nolog chains if they exist, create them if not.
 		CKPTFLUSHFIREWALL=" flushfirewall: Create or flush nolog chains." ; #ckpt $CKPTFLUSHFIREWALL
 		if [ -n "$NOLOGSUFFIX" ]; then
@@ -1257,15 +1262,19 @@ flushornewchain () {	#SUDO checked
 		if [ -f /proc/net/ip_fwchains ]; then
 			#REMOVEME
 			#if [ `$SUDO $IPCHAINSBIN -L -n | grep "^Chain $CHAINNAME" | wc -l` -gt 0 ]; then
-			if $SUDO $IPCHAINSBIN -L $CHAINNAME >/dev/null 2>/dev/null ; then	#If chain exists
+		        # 2008-03-25 - Scheffczyk: Added the '-n' switch to the call of 'iptables -L' 
+		        # to avoid DNS calls when merely checking for the exisitence of a chain.
+			if $SUDO $IPCHAINSBIN -n -L $CHAINNAME >/dev/null 2>/dev/null ; then	#If chain exists
 				$SUDO $IPCHAINSBIN -F $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0044/0070/0089/0134 $IPCHAINSBIN -F $CHAINNAME
 			else
 				$SUDO $IPCHAINSBIN -N $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0045/0071/0090 $IPCHAINSBIN -N $CHAINNAME
 			fi
-		elif [ -n "`lsmod | grep '^ip_tables '`" ]; then
+		elif [ -f /proc/net/ip_tables_names ]; then
 #FIXME, check everywhere.
 #if iptables -L -n >/dev/null 2>/dev/null ; then echo iptables successful ; fi
-			if $SUDO $IPTABLESBIN -L $CHAINNAME >/dev/null 2>/dev/null ; then	#If chain exists
+		        # 2008-03-25 - Scheffczyk: Added the '-n' switch to the call of 'iptables -L' 
+		        # to avoid DNS calls when merely checking for the exisitence of a chain.
+			if $SUDO $IPTABLESBIN -n -L $CHAINNAME >/dev/null 2>/dev/null ; then	#If chain exists
 				$SUDO $IPTABLESBIN -F $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0135 $IPTABLESBIN -F $CHAINNAME
 			else
 				$SUDO $IPTABLESBIN -N $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0136 $IPTABLESBIN -N $CHAINNAME
@@ -1901,7 +1910,7 @@ runfirewall () {	#SUDO checked
 		done
 	else echo -n No Blockedhost blocks... ; fi
 
-	if [ -f /proc/net/ip_fwchains ] || [ -n "`lsmod | grep '^ip_tables '`" ]; then
+	if [ -f /proc/net/ip_fwchains ] || [ -f /proc/net/ip_tables_names ]; then
 		CKPTRUNFIREWALL=" runfirewall: ipchains/iptables spoofblocks" ; #ckpt $CKPTRUNFIREWALL
 		if [ "$SPOOFBLOCKS" = "YES" ]; then
 			echo -n Spoof blocks...
@@ -1913,7 +1922,7 @@ runfirewall () {	#SUDO checked
 			#$IPCHAINSBIN -I input -j NoSpoof || logfail $LINENO masonlib: YYYY 0072
 			dorule i input '' '' '' '' '' '' '' '' '' "NoSpoof" '' '' '' || logfail $LINENO masonlib: YYYY 0072
 			#In iptables, we have to check for spoofing on the forward chain as well.
-			if [ -n "`lsmod | grep '^ip_tables '`" ]; then
+			if [ -f /proc/net/ip_tables_names ]; then
 				dorule i forward '' '' '' '' '' '' '' '' '' "NoSpoof" '' '' '' || logfail $LINENO masonlib: YYYY 0137
 			fi
 
@@ -2313,7 +2322,9 @@ sortrulefile () {
 		for SECTION in `seqfunc 0 $FILECOUNT` ; do
 			if [ -f "$ONEFILE.$SECTION" ]; then
 				if [ `grep '#\^' $ONEFILE.$SECTION | wc -l` -gt 0 ]; then
-					sort -t '^' +1 -n -r $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0120
+					# 2007-03-23 Scheffczyk
+					# Original line was: sort -t '^' +1 -n -r $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0120
+					sort -t '^' -k 1 -n -r $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0120
 				else
 					cat $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0121
 				fi
@@ -2350,12 +2361,14 @@ uniqrulefile () {
 	cp -pf $1 $1.bak || logfail $LINENO masonlib: YYYY 0125
 	#sort -t '#' +1 $1 | uniq >$1.sorted			#This worked until we had mark values.
 	CKPTUNIQRULEFILE=" uniqrulefile: main pipeline" ; #ckpt $CKPTUNIQRULEFILE
+        # 2007-03-23 Scheffczyk
+	# Original line was: sort -t '#' +1 | \
 	cat $1 | \
 	sed -e 's/^/!!! /' \
 		-e 's/^!!! \(.* -m \)\([0-9][0-9]*\)\( .*\)/\2 \1ZzMaRkZz\3/' | \
 	sort +1 | \
 	uniq -1 | \
-	sort -t '#' +1 | \
+	sort -t '#' -k 1 | \
 	uniq -1 | \
 	sed -e 's/^\([0-9][0-9]*\) \(.* -m \)ZzMaRkZz\( .*\)/\2\1\3/' \
 		-e 's/^!!! //' >$1.sorted || logfail $LINENO masonlib: YYYY 0126
@@ -2419,3 +2432,49 @@ updatecounts () {
 } #End of updatecounts
 
 
+#-------------------------------------------------------------------------
+# Save packet stats to a file for each chain - 2008-04-03 - Scheffczyk
+#-------------------------------------------------------------------------
+savepacketstats () {
+    if [ "$PACKETSTATS_SAVE"x = "yes"x ]
+    then
+	if [ -z "$PACKETSTATS_LOGDIR" ]; then
+	    $PACKETSTATS_LOGDIR="/var/log/mason";
+	fi;
+	if [ ! -d "$PACKETSTATS_LOGDIR" ]; then
+	    mkdir -p $PACKETSTATS_LOGDIR;
+	fi;
+	if [ -z "$PACKETSTATS_MAX_AGE" ]
+	then
+	     find $PACKETSTATS_LOGDIR/ -mtime +$PACKETSTATS_MAX_AGE -exec rm {} \;
+	fi
+	PACKETSTATS_TIMESTAMP=$(date +%Y.%m.%d.%H.%M.%S)
+	TABLES="nat filter"
+	for TABLE in $TABLES
+	do
+	  CHAINS=`$IPTABLESBIN -L -n -t $TABLE | fgrep Chain | awk '{ print $2; }'`
+	  for CHAIN in $CHAINS
+	  do
+	    $IPTABLESBIN -n -x -v -t $TABLE -L $CHAIN > $PACKETSTATS_LOGDIR/$TABLE.$CHAIN.$PACKETSTATS_TIMESTAMP
+	  done
+	done
+    fi 
+}
+
+# ---------------------------------------------------------------------
+# Restart services that modify iptables rules - 2008-04-02 - Scheffczyk
+# ---------------------------------------------------------------------
+RestartServices() {
+    unset SERVICE;
+    if [ -z "$SERVICE_RESTART_DIR" ]; then
+	SERVICE_RESTART_DIR="/etc/mason.d/restart.d";
+    fi;
+    if [ ! -d "$SERVICE_RESTART_DIR" ]; then
+	mkdir -p $SERVICE_RESTART_DIR;
+    fi;
+    if [ $(ls -1 "$SERVICE_RESTART_DIR/" | wc -l) -ne 0 ]; then
+	for SERVICE in $(ls -1 $SERVICE_RESTART_DIR/*| egrep -v "[#~]"); do
+	    $SERVICE restart
+	done;
+    fi;
+}
--- mason-1.0.0.orig/masonrc
+++ mason-1.0.0/masonrc
@@ -1,5 +1,8 @@
-#WARNING - If you are upgrading from a previous version, the uncommented
-#lines in your old masonrc have been appended to the end of this file.  
+#===========================================================
+# WARNING - If you are upgrading from a previous version, the uncommented
+# lines in your old masonrc have been appended to the end of this file.  
+#===========================================================
+
 #Please note that the NAMECACHE, NETCACHE, and SERVICES fields are no longer used.
 
 #For instructions on how to set the parameters in this file, refer to 
@@ -60,6 +63,59 @@
 #FLUSHEDPOLICY="reject"
 #FLUSHEDPOLICY="deny"
 
+#===========================================================
+# New settings for the debian version of mason - BEGIN
+#===========================================================
+# Property: SERVICE_RESTART_DIR 
+#-----------------------------------------------------------
+# Type    : string
+# value   : the name of a directory
+# Default : /etc/mason.d/restart.d
+# Descr.  : All scripts in this directory will be executed 
+#           with the command line parameter 'restart'. 
+# Hints   : - A common way to use this feature is to link to 
+#             init scripts, for example:
+#             ln -s /etc/init.d/fail2ban /etc/mason.d/restart.d/
+#-----------------------------------------------------------
+# SERVICE_RESTART_DIR="/etc/mason.d/restart.d"
+
+#-----------------------------------------------------------
+# Property: PACKETSTATS_SAVE 
+#-----------------------------------------------------------
+# Type    : string
+# value   : "yes" or "no"
+# Default : "no"
+# Descr.  : If the value of this property is set to "yes" 
+#           the counters for each rule a saved before the
+#           iptables chains are flushed 
+#-----------------------------------------------------------
+# PACKETSTATS_SAVE="no"
+
+#-----------------------------------------------------------
+# Property: PACKETSTATS_MAX_AGE
+#-----------------------------------------------------------
+# Type    : integer
+# value   : maximum age of saved saved counters in days
+# Default : 30
+# Descr.  : If the value of this property is set, saved
+#           counters are deleted when older as set here
+#-----------------------------------------------------------
+# PACKETSTATS_MAX_AGE=30
+
+#-----------------------------------------------------------
+# Property: PACKETSTATS_LOGDIR
+#-----------------------------------------------------------
+# Type    : string
+# value   : the name of a directory
+# Default : /var/log/mason
+# Descr.  : The directory where the counters are saved
+#-----------------------------------------------------------
+# PACKETSTATS_LOGDIR="/var/log/mason"
+
+#===========================================================
+# New settings for the debian version of mason - END
+#===========================================================
+
 #-----------------------------------------------------------
 # Moderate likelihood you may wish to tune these, probably once.
 #-----------------------------------------------------------
@@ -154,6 +210,7 @@
 #Use ANSI escape sequences to enhance display.  Default YES.
 #Set this to no if your terminal doesn't support ANSI colors, etc.
 #USEANSI="YES"
+USEANSI="NO"
 
 # The range of ports considered to be IRC server ports.
 # Default: 6666 to 6671
@@ -458,7 +515,7 @@
 #Location of runtime changeable files and configuration.
 #Make sure you include the trailing slash.
 # Default: "/var/lib/mason/"
-#MASONDIR="/var/lib/mason/"
+MASONDIR="/var/lib/mason/"
 
 #This is the configuration file mason uses.  It can be changed while
 #Mason is running as long as the SIGUSR1 signal is sent to Mason afterwards.
@@ -507,7 +564,7 @@
 #/etc/rc.d/init.d/firewall start
 #
 #MASONEXE="/usr/bin/mason"
-#MASONDECIDE="/usr/bin/mason-decide"
+#MASONDECIDE="/var/lib/mason/mason-decide"
 #IPFWADMBIN="/sbin/ipfwadm"
 #IPCHAINSBIN="/sbin/ipchains"
 #Note - ipnatctl is not used any more.
--- mason-1.0.0.orig/samlib
+++ mason-1.0.0/samlib
@@ -617,7 +617,7 @@ fi
 requireutil ifconfig awk || exit 1
 #Checks done on the following function: 
 ipof () {	#SUDO checked
-    ifconfig $1 2>/dev/null | awk '/inet addr/{print substr($2,6)}'
+    LC_ALL=C ifconfig $1 2>/dev/null | awk '/inet addr/{print substr($2,6)}'
 } #End of ipof
 if [ "$DOREGRESSIONTEST" = "YES" ]; then
 	echo -n ipof...