Turn the patches into a quilt patch, and set source format to 3.0 (quilt).

Signed-off-by: Mattia Rizzolo <mattia@debian.org>

4 files changed, 721 insertions, 167 deletions

diff --git a/debian/patches/pre-3.0.patch b/debian/patches/pre-3.0.patch
new file mode 100644
index 0000000..acfe879
--- /dev/null
+++ b/debian/patches/pre-3.0.patch
@@ -0,0 +1,719 @@
+Description: All the patches that had been directly applied before the
+ conversion to source format 3.0 (quilt).
+Last-Update: 2018-10-09
+
+--- mason-1.0.0.orig/Makefile
++++ mason-1.0.0/Makefile
+@@ -35,11 +35,13 @@ MASONVER = 1.0.0
+ 
+ #No quotes around multi file specs.
+ BINDIR=$(DESTDIR)/usr/bin/
+-BINFILES=mason mason-gui-text mason-decide
++BINFILES=mason mason-gui-text 
+ CONFDIR=$(DESTDIR)/etc/
+ CONFFILE=masonrc
+ LIBDIR=$(DESTDIR)/var/lib/mason/
+-LIBFILES=masonlib baserules.sample graffiti-services moreservices nmap-services portsdb-services regression-test all-ip-numbers.txt
++LIBFILES=baserules.sample graffiti-services moreservices nmap-services portsdb-services regression-test all-ip-numbers.txt
++LIBSCRIPTDIR=$(DESTDIR)/var/lib/mason/
++LIBSCRIPTFILES=masonlib mason-decide
+ DOCDIR=$(DESTDIR)/usr/doc/mason-${MASONVER}/
+ DOCFILES=COPYING index.html mason.sgml mason.txt mason.html mason-1.html mason-2.html mason-3.html mason-4.html mason-5.html mason-6.html mason-7.html mason-8.html mason-9.html mason-10.html mason-11.html toc.gif prev.gif next.gif mason-banner.gif
+ #DOCDIR=$(DESTDIR)/usr/doc/mason/
+@@ -59,6 +61,8 @@ install:
+ 	@install -o root -g root -m 0755 -d ${LIBDIR}
+ 	@echo -n "${LIBFILES}... "
+ 	@install -o root -g root -m 0644 ${LIBFILES} ${LIBDIR}
++	@echo -n "${LIBSCRIPTFILES}... "
++	@install -o root -g root -m 0755 ${LIBSCRIPTFILES} ${LIBSCRIPTDIR}
+ 	@echo -n "doc directory... "
+ 	@install -o root -g root -m 0755 -d ${DOCDIR}
+ 	@echo -n "${DOCFILES}... "
+@@ -90,7 +94,7 @@ install:
+ docs:
+ 	sgml2html --imagebuttons mason.sgml \
+ 	&& sgml2txt -f mason.sgml \
+-	&& makedoc mason.txt mason.pdb 'The Mason HOWTO'
++#	&& makedoc mason.txt mason.pdb 'The Mason HOWTO'
+ 
+ regress:
+ 	@if ./regression-test ; then \
+--- mason-1.0.0.orig/baserules.sample
++++ mason-1.0.0/baserules.sample
+@@ -1,31 +1,45 @@
+-#Put any fixed rules you wish here.  Example:
+-
+-#if [ -f /proc/net/ip_fwchains ]; then
+-#	#Place the ipchains versions of your rules here
+-#	/sbin/ipchains -A forward -s 172.16.0.0/24 -j MASQ		#Masquerade from internal lan out
+-#elif [ -f /proc/net/ip_input ]; then
+-#	#Place the ipfwadm versions of your rules here.
+-#	/sbin/ipfwadm -F -a accept -m -S 172.16.0.0/24			#Masquerade from internal lan out
+-#else		#The old >>>elif [ -n "`lsmod | grep '^ip_tables '`" ]; then<<<< doesn't work as iptables can be kernel-resident.  Cross your fingers.
+-#	#Place the iptables versions of your rules here
+-#	#The following loads all netfilter modules - this may or may not be appropriate for you
+-#	MODDIR="/lib/modules/`uname -r`"
+-#	for MOD in \
+-#	 $MODDIR/ipv4/ip_* \
+-#	 $MODDIR/ipv4/ipt_* \
+-#	 $MODDIR/ipv4/iptable_* \
+-#	 $MODDIR/kernel/net/ipv4/netfilter/ip_* \
+-#	 $MODDIR/kernel/net/ipv4/netfilter/ipt_* \
+-#	 $MODDIR/kernel/net/ipv4/netfilter/iptable_* ; do
+-#	    insmod $MOD >/dev/null 2>/dev/null ; modprobe $MOD >/dev/null 2>/dev/null
+-#	done
+-#	#Masquerade from internal lan out - syntax from iptables howto; thanks, Rusty.
+-#	iptables -A POSTROUTING -t nat -s 172.16.0.0/24 -o ppp0 -j MASQUERADE
+-#	#The following will allow the response packets back in/out/through your firewall.
+-#	#This, too, may or may not be appropriate for you and should not be taken as a suggestion.
+-#	#It is only here as a convience.  If you use these, Mason will build a firewall
+-#	#of opening packets only.
+-#	iptables -A INPUT   -m state --state ESTABLISHED,RELATED                                                -j ACCEPT
+-#	iptables -A FORWARD -m state --state ESTABLISHED,RELATED                                                -j ACCEPT
+-#	iptables -A OUTPUT  -m state --state ESTABLISHED,RELATED                                                -j ACCEPT
+-#fi
++##!/bin/sh
++##=============================================================================
++## Example of a mason firewall script
++##=============================================================================
++#
++## ---------------------------------------------------------------------
++## Allow all local connections
++## ---------------------------------------------------------------------
++#/sbin/iptables -A INPUT  -i lo -j ACCEPT
++#/sbin/iptables -A OUTPUT -o lo -j ACCEPT
++#
++## ---------------------------------------------------------------------
++## Allow ESTABLISHED and RELATED packets globally, to drastically reduce
++## the number of reported rules in learning mode
++## ---------------------------------------------------------------------
++## Hint: "There is a certain feature in iptables that is not so well 
++## documented and may therefore be overlooked by a lot of people [...]
++## If you use state NEW, packets with the SYN bit unset will get through 
++## your firewall." Cited from: 
++## http://iptables-tutorial.frozentux.net/iptables-tutorial.html#NEWNOTSYN
++## ---------------------------------------------------------------------
++#/sbin/iptables -A INPUT                  -m state --state ESTABLISHED -j ACCEPT
++#/sbin/iptables -A INPUT                  -m state --state RELATED     -j ACCEPT
++#/sbin/iptables -A INPUT                  -m state --state INVALID     -j DROP
++#
++#/sbin/iptables -A OUTPUT                 -m state --state ESTABLISHED -j ACCEPT
++#/sbin/iptables -A OUTPUT                 -m state --state RELATED     -j ACCEPT
++#/sbin/iptables -A OUTPUT                 -m state --state INVALID     -j DROP
++#
++## ---------------------------------------------------------------------
++## Drop all new new tcp-connections without a sys-flag
++## ---------------------------------------------------------------------
++## Info: "There is a certain feature in iptables that is not so well 
++## documented and may therefore be overlooked by a lot of people [...]
++## If you use state NEW, packets with the SYN bit unset will get through 
++## your firewall." Cited from: 
++## http://iptables-tutorial.frozentux.net/iptables-tutorial.html#NEWNOTSYN
++## ---------------------------------------------------------------------
++#/sbin/iptables -A INPUT   -p tcp ! --syn -m state --state NEW         -j DROP
++#/sbin/iptables -A OUTPUT  -p tcp ! --syn -m state --state NEW         -j DROP
++#
++## ---------------------------------------------------------------------
++## Allowed connections 
++## ---------------------------------------------------------------------
++#
+--- mason-1.0.0.orig/firewall
++++ mason-1.0.0/firewall
+@@ -3,12 +3,22 @@
+ # firewall        Starts a Mason firewall.
+ #
+ #
++### BEGIN INIT INFO
++# Provides:          mason
++# Required-Start:    $network
++# Required-Stop:     $network
++# Default-Start:     2 3 4 5
++# Default-Stop:      0 1 6
++# Short-Description: Starts the mason firewall script
++# Description:       Starts the firewall script /etc/mason.baserules. The script was created with the mason firewall builder.
++### END INIT INFO
++#
+ # chkconfig: 2345 18 92
+ # description: firewall starts the firewall created by the Mason \
+ # firewall builder.  As a firewall is important to system security, \
+ # it should be always turned on.
+ 
+-# Debian init script derived from original script by Jeff Licquia.
++# Debian init script derived from original script by Jeff Licquia
+ 
+ # Debian flags for runlevels - similar to RH's chkconfig.
+ FLAGS="defaults 19"
+--- mason-1.0.0.orig/mason
++++ mason-1.0.0/mason
+@@ -146,7 +146,7 @@ for ONEIF in $DYNIF ; do
+ 		echo "export ${ONEIF}ADDR=\"0/0\"	${CMNT} ${CMNT}Use this if you want to match any address on $ONEIF."
+ 	fi
+ 	if [ "$DYNIFMODE" != "SPECIFICIP" ]; then echo -n "$CMNT $CMNT" ; fi
+-	echo "export ${ONEIF}ADDR=\"\`ifconfig $ONEIF 2>/dev/null | awk '/inet addr/{print substr($2,6)}'\`$SINGLEMACHSPEC\"	${CMNT} ${CMNT}Use this if you want to match a single address on $ONEIF."
++	echo "export ${ONEIF}ADDR=\"\`LC_ALL=C ifconfig $ONEIF 2>/dev/null | awk '/inet addr/{print substr(\$2,6)}'\`$SINGLEMACHSPEC\"	${CMNT} ${CMNT}Use this if you want to match a single address on $ONEIF."
+ 	if [ "$DYNIFMODE" != "SMALLESTRANGE" ]; then echo -n "$CMNT $CMNT" ; fi
+ #FIXME - what if the file is empty?
+ 	echo "export ${ONEIF}ADDR=\"$(encompassingnetworkof $(cat ${MASONDIR}${ONEIF}-ips | sort | uniq) || logfail $LINENO return encompassing network for $ONEIF)\"	${CMNT} ${CMNT}Use this if you want to match all addresses seen so far on $ONEIF."
+--- mason-1.0.0.orig/mason-decide
++++ mason-1.0.0/mason-decide
+@@ -176,7 +176,7 @@ while [ "$EXITNOW" != "YES" ] && read IN
+ 				echo $ENH "${WARN}$0: Can't create temp file.${NORM}"
+ 			else
+ 				echo "$CURRLINE" >$TMPFILE
+-				$EDITOR $TMPFILE <&10
++				eval $EDITOR $TMPFILE <&10
+ 				CURRLINE=`cat $TMPFILE`
+ 				rm -f $TMPFILE || :
+ 			fi	;;
+--- mason-1.0.0.orig/mason-gui-text
++++ mason-1.0.0/mason-gui-text
+@@ -4,6 +4,25 @@ set -e
+ #See top of Mason script for copyright and licensing information.
+ #Last YYYY code used: 0019, use 0020 next
+ 
++# ---------------------------------------------------------------------
++# Kill another instance of mason if this programm is started with
++# the option "--force" - 2008-06-27 - Scheffczyk
++# ---------------------------------------------------------------------
++if [ "$$"x != "`/bin/pidof -x /usr/bin/mason-gui-text`"x ]; then
++    if [ "$1"x == "--force"x ]; then
++	echo "Told to stop another instance of $0  ..."
++	kill -9 `ps aux | grep mason | egrep -v "(grep mason|$$)" | awk '{ print $2 }'`
++	if [ "$$"x != "`/bin/pidof -x /usr/bin/mason-gui-text`"x ]; then
++	    echo "Unable to stop another instance of $0. Exiting ...";
++	    exit 1;
++	fi;
++    else
++	echo "Another instance of $0 is running. Exiting ...";
++	exit 1;
++    fi;
++fi;
++
++
+ CKPTMGT=" mgt: Ground0" ; #ckpt $CKPTMGT
+ 
+ MASONDIR=${MASONDIR:-"/var/lib/mason/"}
+@@ -118,21 +137,41 @@ killrunningmason
+ 
+ while [ ! "$EXITCONTROL" = "YES" ]; do
+ 	clear
+-	echo $ENH "${HEADER}---- ${BLUE}Mason${HEADER} firewall builder for Linux                         ----$NORM"
+-	echo $ENH "${HEADER}---- Learning shell for Mason.                                ----$NORM"
+-	echo $ENH "${HEADER}---- see http://www.pobox.com/~wstearns/mason/ for more info. ----$NORM"
+-	echo $ENH "${HEADER}---- William Stearns <wstearns@pobox.com>                     ----$NORM"
++	echo "------------------------------------------------------------------"
++	echo $ENH "${HEADER}${BLUE}Mason${HEADER} firewall builder for Linux         $NORM"
++	echo "------------------------------------------------------------------"
++	echo $ENH "${HEADER}---- Learning shell for Mason.                                $NORM"
++	echo $ENH "${HEADER}---- see http://www.pobox.com/~wstearns/mason/ for more info. $NORM"
++	echo $ENH "${HEADER}---- Originally from William Stearns <wstearns@pobox.com>     $NORM"
+ 	if [ -n "$MASONVER" ]; then
+-		echo $ENH "${HEADER}(This is release $MASONVER)$NORM"
++	    echo $ENH "${HEADER}---- This is release $MASONVER $NORM"
+ 	fi
++	echo "------------------------------------------------------------------"
++        if [ -z  "`/bin/pidof -x /sbin/klogd`" ]; then
++           echo "Warning: No instance of klogd (kernel log deamon) is running,"
++           echo "         mason will not be able to learn new rules."
++	   echo "------------------------------------------------------------------"
++        fi
++        if [ ! -f  "$PACKETLOGFILE" ]; then
++           echo "Warning: The syslog file $PACKETLOGFILE does not exist,"
++           echo "         mason will not be able to learn new rules."
++	   echo "------------------------------------------------------------------"
++	else
++		if [ -z "` find $PACKETLOGFILE -cmin -60`" ]; then
++	        	echo "Warning: No messages was written to the syslog file $PACKETLOGFILE"
++	        	echo "         the last hour, the file is probably not in use by a"
++        		echo "         syslog deamon. Mason will not be able to learn new rules."
++	  		echo "------------------------------------------------------------------"
++		fi
++        fi
+ 	if [ -n "$MASONPID$MASONTAILPID" ]; then
+ 		echo Mason is currently in learn mode.
+-		echo
++		echo "------------------------------------------------------------------"
+ 		echo $ENH ${KEY}EL${NORM}: ${KEY}E${NORM}nd ${KEY}L${NORM}earning.
+ 		showstate 'Mason-gui-text: Main menu, learning in the background'
+ 	else
+ 		echo Mason IS NOT currently learning.
+-		echo
++		echo "------------------------------------------------------------------"
+ 		echo $ENH ${KEY}BL${NORM}: ${KEY}B${NORM}egin ${KEY}L${NORM}earning.
+ 		showstate 'Mason-gui-text: Main menu, not learning'
+ 	fi
+@@ -357,6 +396,12 @@ while [ ! "$EXITCONTROL" = "YES" ]; do
+ 		killrunningmason
+ 		flushfirewall
+ 		runfirewall STANDARD
++		# ---------------------------------------------------------------------
++		# Restart services that modify iptables rules - 2008-04-02 - Scheffczyk
++		# ---------------------------------------------------------------------
++		wrap Restarting services ...
++		RestartServices
++		wrap Done!
+ 																;;
+ 	*)	wrap ${WARN}Unknown choice.  Please enter the one or two character code.${NORM}
+ 																;;
+--- mason-1.0.0.orig/mason-gui-text.1
++++ mason-1.0.0/mason-gui-text.1
+@@ -1,20 +1,18 @@
+-.TH MASON-GUI-TEXT 1 
+ .\" NAME should be all caps, SECTION should be 1-8, maybe w/ subsection
+ .\" other parms are allowed: see man(7), man(1)
+-.SH NAME
++.TH "MASON-GUI-TEXT" "1" "" "" ""
++.SH "NAME"
+ mason\-gui\-text \- front end to mason
+-.SH SYNOPSIS
+-.B mason\-gui\-text
++.SH "SYNOPSIS"
++.B \fBmason\-gui\-text\fR [\fB\-\-force\fR]
+ .SH "DESCRIPTION"
+ .B mason\-gui\-text
+-is a "textual GUI" front end to mason, the interactive firewall
+-builder.  When it is run, it allows you to control mason's behavior
+-through simple keystroke commands.  It can start and stop mason, allow 
+-you to edit the rules generated (and re-merge them into the currently
+-running rule set), and change mason's settings.  It also has a
+-"console lock" setting for locking the console down if necessary.
++is a "textual GUI" front end to mason, the interactive firewall builder.  When it is run, it allows you to control mason's behavior through simple keystroke commands.  It can start and stop mason, allow you to edit the rules generated (and re\-merge them into the currently running rule set), and change mason's settings.  It also has a "console lock" setting for locking the console down if necessary.
++.SH "OPTIONS"
++Default behaviour of mason\-gui\-text ist to exit if another instance of it is already running.
++.IP "\fB\-\-force\fR
++Try to stop other instances of mason\-gui\-text and continue running
+ .SH "SEE ALSO"
+-.B "QuickStart, mason(1)"
+-.SH AUTHOR
+-This manual page was written by Jeff Licquia <jeff@luci.org>,
+-for the Debian GNU/Linux system (but may be used by others).
++.B "mason(1)"
++.SH "AUTHOR"
++This manual page was written by Jeff Licquia <jeff@luci.org> for the Debian GNU/Linux system (but may be used by others) and supplemented by Thomas Scheffczyk <scheffczyk@debian.org>.
+--- mason-1.0.0.orig/mason.1
++++ mason-1.0.0/mason.1
+@@ -1,17 +1,17 @@
+-.TH MASON 1 
+ .\" NAME should be all caps, SECTION should be 1-8, maybe w/ subsection
+ .\" other parms are allowed: see man(7), man(1)
+-.SH NAME
++.TH "MASON" "1" "" "" ""
++.SH "NAME"
+ mason \- interactively create a firewall
+-.SH SYNOPSIS
++.SH "SYNOPSIS"
+ .B mason
+ .I "< logfile > rulefile"
+-.br
++.br 
+ .SH "DESCRIPTION"
+ This manual page briefly documents the
+ .BR mason 
+ command.
+-.PP
++.PP 
+ .B mason
+ interactively generates a set of firewall rules for a Linux\-based
+ firewall.  This is done by turning on full IP logging, watching the
+@@ -21,20 +21,20 @@ seen.
+ is familiar with most of the quirks of various connection types (such
+ as ftp and IRC), and can output rules for 2.0.x ipfwadm, 2.2.x
+ ipchains, and Cisco packet filters.
+-.PP
++.PP 
+ .B mason
+ operates by reading in log file information from standard input and
+ writing firewall rules to standard output.  This allows
+ .B mason
+-to work offline or on a separate system.  Real-time firewall
++to work offline or on a separate system.  Real\-time firewall
+ generation can be achieved with a command like tail(1).
+-.PP
++.PP 
+ Most users will want to run mason with a user\-friendly interface such
+ as mason\-gui\-text(1).
+-.SH ENVIRONMENT
++.SH "ENVIRONMENT"
+ .B mason
+ is configured using the following environment variables.
+-.TP
++.TP 
+ .B ECHOCOMMAND
+ Sets the type of firewall rules that
+ .B mason
+@@ -43,7 +43,7 @@ should output to standard out.  Allowed
+ .B mason
+ outputs whatever kind of rules are supported by the currently running
+ Linux kernel.
+-.TP
++.TP 
+ .B DOCOMMAND
+ Sets the type of firewall rules that
+ .B mason
+@@ -52,20 +52,20 @@ include "ipfwadm" and "ipchains".  By de
+ .B mason
+ outputs whatever kind of rules are supported by the currently running
+ Linux kernel.
+-.TP
++.TP 
+ .B HEARTBEAT
+ If set to "yes",
+ .B mason
+-will output a "+" or "-" to standard error whenever a rule generated
++will output a "+" or "\-" to standard error whenever a rule generated
+ by
+ .B mason
+ has been triggered.
+-.TP
++.TP 
+ .B DYNIP
+ Set this to the list of interfaces that have dynamically assigned
+ addresses, separated by spaces.
+ .SH "SEE ALSO"
+-.B "mason.txt, mason\-gui\-text(1)"
+-.SH AUTHOR
++.B "mason\-gui\-text(1)"
++.SH "AUTHOR"
+ This manual page was written by Jeff Licquia <jeff@luci.org>,
+ for the Debian GNU/Linux system (but may be used by others).
+--- mason-1.0.0.orig/masonlib
++++ mason-1.0.0/masonlib
+@@ -26,10 +26,10 @@
+ #		  || logfail $LINENO masonlib: YYYY #### the_command_that_was_supposed_to_run
+ #Last YYYY code used: 0149, use 0150 next
+ 
+-if [ -f /usr/lib/samlib/samlib ]; then
+-	. /usr/lib/samlib/samlib
++if [ -f /var/lib/mason/samlib ]; then
++	. /var/lib/mason/samlib
+ else
+-	echo "/usr/lib/samlib/samlib is missing - please get it from" >/dev/stderr
++	echo "/var/lib/mason/samlib is missing - please get it from" >/dev/stderr
+ 	echo "http://www.stearns.org/samlib/" >/dev/stderr
+ 	echo "Exiting." >/dev/stderr
+ 	exit 1
+@@ -44,7 +44,7 @@ for ONEFUNC in askYN encompassingnetwork
+ 	fi
+ done
+ 
+-MASONVER="1.0.0, 5/12/2002"
++MASONVER="1.0.0-11 - 2008-06-27"
+ 
+ #-------------------------------------------------------------------------
+ # addcounts procedure, adds the packet counts to the rules in a file.
+@@ -289,7 +289,7 @@ checkconf () {
+ 	#SYSTEMRULEFILE=${SYSTEMRULEFILE:-"${MASONDIR}systemrules"} ;	if [ ! -f $SYSTEMRULEFILE ]; then touch $SYSTEMRULEFILE || logfail $LINENO masonlib: 0015 touch $SYSTEMRULEFILE ; fi
+ 	PACKETLOGFILE=${PACKETLOGFILE:-"/var/log/messages"}
+ 	MASONEXE=${MASONEXE:-"/usr/bin/mason"}
+-	MASONDECIDE=${MASONDECIDE:-"/usr/bin/mason-decide"}
++	MASONDECIDE=${MASONDECIDE:-"/var/lib/mason/mason-decide"}
+ 
+ 	CKPTCHECKCONF=" checkconf: Set up ANSI escape codes" ; #ckpt $CKPTCHECKCONF
+ 	if [ "$USEANSI" != "NO" ]; then
+@@ -301,7 +301,8 @@ checkconf () {
+ 		     BLUE="\033[1;34m"
+ 		     PINK="\033[1;35m"
+ 		TURQUOISE="\033[1;36m"
+-		     NORM="\033[1;37m"
++#		     NORM="\033[1;37m"
++		     NORM="`tput sgr0 2`"
+ 		   BRIGHT="\033[1;39m"
+ 	else
+ 		      ENH=""
+@@ -448,7 +449,7 @@ checkconf () {
+ 	[Nn][Oo]|[Nn][Oo][Nn][Ee])									ECHOCOMMAND="none"		;;
+ 	*)	if [ -f /proc/net/ip_fwchains ]; then					ECHOCOMMAND="ipchains"
+ 		elif [ -f /proc/net/ip_input ]; then					ECHOCOMMAND="ipfwadm"
+-		elif [ -n "`lsmod | grep '^ip_tables '`" ]; then		ECHOCOMMAND="iptables"
++		elif [ -f /proc/net/ip_tables_names ]; then		ECHOCOMMAND="iptables"
+ 		else													ECHOCOMMAND="ipchains"			#Set default here
+ 		fi																				;;
+ 	esac
+@@ -478,7 +479,7 @@ checkconf () {
+ 	[Ii][Pp][Tt][Aa][Bb][Ll][Ee][Ss])
+ 		DOCOMMAND="iptables"
+ 		#FIXME - how to reliably test for kernel iptables support
+-		#if [ -z "`lsmod | grep '^ip_tables '`" ]; then
++		#if -z "`lsmod | grep '^ip_tables '`" ]; then
+ 		#	wrap ${WARN}WARNING! User has requested iptables, but it appears to be unavailable. Proceeding, but this is not likely to work.${NORM} >/dev/stderr
+ 		#	sleep 10
+ 		#fi
+@@ -682,10 +683,15 @@ checkconf () {
+ 
+ 	CKPTCHECKCONF=" checkconf: Check editor" ; #ckpt $CKPTCHECKCONF
+ 	if [ -z "$EDITOR" ]; then
+-		for TRYEDITOR in `type -path mcedit || :` `type -path pico || :` `type -path vi || :` `type -path jove || :` `type -path nedit || :` `type -path emacs || :` ; do
++		for TRYEDITOR in `type -path emacs || :` `type -path vi || :` `type -path nano || :` `type -path mcedit || :` `type -path pico || :` `type -path jove || :` `type -path nedit || :`  ; do
++		        # 2008-06-27 - Scheffczyk: Added the -nw switch if emacs is choosen as an editor 
+ 			if [ -z "$EDITOR" ]; then
++			    if [ "$TRYEDITOR"x == "emacs"x ]; then
++				EDITOR="emacs -nw";
++			    else
+ 				EDITOR=$TRYEDITOR
+-				wrap Editor default of $EDITOR taken. >/dev/stderr
++			    fi
++			    wrap Editor default of $EDITOR taken. >/dev/stderr
+ 			fi
+ 		done
+ 		unset TRYEDITOR || :
+@@ -716,7 +722,7 @@ checksys () {
+ 		exit 0
+ 	fi
+ 
+-	if [ ! -f /proc/net/ip_fwchains ] && [ ! -f /proc/net/ip_input ] && [ -z "`lsmod | grep '^ip_tables '`" ]; then
++	if [ ! -f /proc/net/ip_fwchains ] && [ ! -f /proc/net/ip_input ] && [ ! -f /proc/net/ip_tables_names ]; then
+ 		wrap ${WARN}This kernel does not support ipchains, ipfwadm or iptables!${NORM} >/dev/stderr
+ 		#DOCOMMAND="none"		#Should we force to none?
+ 	fi
+@@ -1199,13 +1205,12 @@ dorule () {
+ 	esac #Case $1=action
+ } #End of dorule
+ 
+-
+-
+ #-------------------------------------------------------------------------
+ #Flush the existing rules so we start with a clean slate.
+ #-------------------------------------------------------------------------
+ flushfirewall () {	#SUDO checked
+ 	CKPTFLUSHFIREWALL=" flushfirewall: Start" ; #ckpt $CKPTFLUSHFIREWALL
++	savepacketstats
+ 	updatecounts
+ 	echo -n Flushing... >/dev/stderr
+ 
+@@ -1229,7 +1234,7 @@ flushfirewall () {	#SUDO checked
+ 		dorule f "$ONECHAIN" '' '' '' '' '' '' '' '' '' '' '' '' '' || logfail $LINENO masonlib: 0039/0041/0043/0048/0050/0052
+ 	done
+ 
+-	if [ -f /proc/net/ip_fwchains ] || [ -n "`lsmod | grep '^ip_tables '`" ]; then
++	if [ -f /proc/net/ip_fwchains ] || [ -f /proc/net/ip_tables_names ]; then
+ 		#Flush the nolog chains if they exist, create them if not.
+ 		CKPTFLUSHFIREWALL=" flushfirewall: Create or flush nolog chains." ; #ckpt $CKPTFLUSHFIREWALL
+ 		if [ -n "$NOLOGSUFFIX" ]; then
+@@ -1257,15 +1262,19 @@ flushornewchain () {	#SUDO checked
+ 		if [ -f /proc/net/ip_fwchains ]; then
+ 			#REMOVEME
+ 			#if [ `$SUDO $IPCHAINSBIN -L -n | grep "^Chain $CHAINNAME" | wc -l` -gt 0 ]; then
+-			if $SUDO $IPCHAINSBIN -L $CHAINNAME >/dev/null 2>/dev/null ; then	#If chain exists
++		        # 2008-03-25 - Scheffczyk: Added the '-n' switch to the call of 'iptables -L' 
++		        # to avoid DNS calls when merely checking for the exisitence of a chain.
++			if $SUDO $IPCHAINSBIN -n -L $CHAINNAME >/dev/null 2>/dev/null ; then	#If chain exists
+ 				$SUDO $IPCHAINSBIN -F $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0044/0070/0089/0134 $IPCHAINSBIN -F $CHAINNAME
+ 			else
+ 				$SUDO $IPCHAINSBIN -N $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0045/0071/0090 $IPCHAINSBIN -N $CHAINNAME
+ 			fi
+-		elif [ -n "`lsmod | grep '^ip_tables '`" ]; then
++		elif [ -f /proc/net/ip_tables_names ]; then
+ #FIXME, check everywhere.
+ #if iptables -L -n >/dev/null 2>/dev/null ; then echo iptables successful ; fi
+-			if $SUDO $IPTABLESBIN -L $CHAINNAME >/dev/null 2>/dev/null ; then	#If chain exists
++		        # 2008-03-25 - Scheffczyk: Added the '-n' switch to the call of 'iptables -L' 
++		        # to avoid DNS calls when merely checking for the exisitence of a chain.
++			if $SUDO $IPTABLESBIN -n -L $CHAINNAME >/dev/null 2>/dev/null ; then	#If chain exists
+ 				$SUDO $IPTABLESBIN -F $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0135 $IPTABLESBIN -F $CHAINNAME
+ 			else
+ 				$SUDO $IPTABLESBIN -N $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0136 $IPTABLESBIN -N $CHAINNAME
+@@ -1901,7 +1910,7 @@ runfirewall () {	#SUDO checked
+ 		done
+ 	else echo -n No Blockedhost blocks... ; fi
+ 
+-	if [ -f /proc/net/ip_fwchains ] || [ -n "`lsmod | grep '^ip_tables '`" ]; then
++	if [ -f /proc/net/ip_fwchains ] || [ -f /proc/net/ip_tables_names ]; then
+ 		CKPTRUNFIREWALL=" runfirewall: ipchains/iptables spoofblocks" ; #ckpt $CKPTRUNFIREWALL
+ 		if [ "$SPOOFBLOCKS" = "YES" ]; then
+ 			echo -n Spoof blocks...
+@@ -1913,7 +1922,7 @@ runfirewall () {	#SUDO checked
+ 			#$IPCHAINSBIN -I input -j NoSpoof || logfail $LINENO masonlib: YYYY 0072
+ 			dorule i input '' '' '' '' '' '' '' '' '' "NoSpoof" '' '' '' || logfail $LINENO masonlib: YYYY 0072
+ 			#In iptables, we have to check for spoofing on the forward chain as well.
+-			if [ -n "`lsmod | grep '^ip_tables '`" ]; then
++			if [ -f /proc/net/ip_tables_names ]; then
+ 				dorule i forward '' '' '' '' '' '' '' '' '' "NoSpoof" '' '' '' || logfail $LINENO masonlib: YYYY 0137
+ 			fi
+ 
+@@ -2313,7 +2322,9 @@ sortrulefile () {
+ 		for SECTION in `seqfunc 0 $FILECOUNT` ; do
+ 			if [ -f "$ONEFILE.$SECTION" ]; then
+ 				if [ `grep '#\^' $ONEFILE.$SECTION | wc -l` -gt 0 ]; then
+-					sort -t '^' +1 -n -r $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0120
++					# 2007-03-23 Scheffczyk
++					# Original line was: sort -t '^' +1 -n -r $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0120
++					sort -t '^' -k 1 -n -r $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0120
+ 				else
+ 					cat $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0121
+ 				fi
+@@ -2350,12 +2361,14 @@ uniqrulefile () {
+ 	cp -pf $1 $1.bak || logfail $LINENO masonlib: YYYY 0125
+ 	#sort -t '#' +1 $1 | uniq >$1.sorted			#This worked until we had mark values.
+ 	CKPTUNIQRULEFILE=" uniqrulefile: main pipeline" ; #ckpt $CKPTUNIQRULEFILE
++        # 2007-03-23 Scheffczyk
++	# Original line was: sort -t '#' +1 | \
+ 	cat $1 | \
+ 	sed -e 's/^/!!! /' \
+ 		-e 's/^!!! \(.* -m \)\([0-9][0-9]*\)\( .*\)/\2 \1ZzMaRkZz\3/' | \
+ 	sort +1 | \
+ 	uniq -1 | \
+-	sort -t '#' +1 | \
++	sort -t '#' -k 1 | \
+ 	uniq -1 | \
+ 	sed -e 's/^\([0-9][0-9]*\) \(.* -m \)ZzMaRkZz\( .*\)/\2\1\3/' \
+ 		-e 's/^!!! //' >$1.sorted || logfail $LINENO masonlib: YYYY 0126
+@@ -2419,3 +2432,49 @@ updatecounts () {
+ } #End of updatecounts
+ 
+ 
++#-------------------------------------------------------------------------
++# Save packet stats to a file for each chain - 2008-04-03 - Scheffczyk
++#-------------------------------------------------------------------------
++savepacketstats () {
++    if [ "$PACKETSTATS_SAVE"x = "yes"x ]
++    then
++	if [ -z "$PACKETSTATS_LOGDIR" ]; then
++	    $PACKETSTATS_LOGDIR="/var/log/mason";
++	fi;
++	if [ ! -d "$PACKETSTATS_LOGDIR" ]; then
++	    mkdir -p $PACKETSTATS_LOGDIR;
++	fi;
++	if [ -z "$PACKETSTATS_MAX_AGE" ]
++	then
++	     find $PACKETSTATS_LOGDIR/ -mtime +$PACKETSTATS_MAX_AGE -exec rm {} \;
++	fi
++	PACKETSTATS_TIMESTAMP=$(date +%Y.%m.%d.%H.%M.%S)
++	TABLES="nat filter"
++	for TABLE in $TABLES
++	do
++	  CHAINS=`$IPTABLESBIN -L -n -t $TABLE | fgrep Chain | awk '{ print $2; }'`
++	  for CHAIN in $CHAINS
++	  do
++	    $IPTABLESBIN -n -x -v -t $TABLE -L $CHAIN > $PACKETSTATS_LOGDIR/$TABLE.$CHAIN.$PACKETSTATS_TIMESTAMP
++	  done
++	done
++    fi 
++}
++
++# ---------------------------------------------------------------------
++# Restart services that modify iptables rules - 2008-04-02 - Scheffczyk
++# ---------------------------------------------------------------------
++RestartServices() {
++    unset SERVICE;
++    if [ -z "$SERVICE_RESTART_DIR" ]; then
++	SERVICE_RESTART_DIR="/etc/mason.d/restart.d";
++    fi;
++    if [ ! -d "$SERVICE_RESTART_DIR" ]; then
++	mkdir -p $SERVICE_RESTART_DIR;
++    fi;
++    if [ $(ls -1 "$SERVICE_RESTART_DIR/" | wc -l) -ne 0 ]; then
++	for SERVICE in $(ls -1 $SERVICE_RESTART_DIR/*| egrep -v "[#~]"); do
++	    $SERVICE restart
++	done;
++    fi;
++}
+--- mason-1.0.0.orig/masonrc
++++ mason-1.0.0/masonrc
+@@ -1,5 +1,8 @@
+-#WARNING - If you are upgrading from a previous version, the uncommented
+-#lines in your old masonrc have been appended to the end of this file.  
++#===========================================================
++# WARNING - If you are upgrading from a previous version, the uncommented
++# lines in your old masonrc have been appended to the end of this file.  
++#===========================================================
++
+ #Please note that the NAMECACHE, NETCACHE, and SERVICES fields are no longer used.
+ 
+ #For instructions on how to set the parameters in this file, refer to 
+@@ -60,6 +63,59 @@
+ #FLUSHEDPOLICY="reject"
+ #FLUSHEDPOLICY="deny"
+ 
++#===========================================================
++# New settings for the debian version of mason - BEGIN
++#===========================================================
++# Property: SERVICE_RESTART_DIR 
++#-----------------------------------------------------------
++# Type    : string
++# value   : the name of a directory
++# Default : /etc/mason.d/restart.d
++# Descr.  : All scripts in this directory will be executed 
++#           with the command line parameter 'restart'. 
++# Hints   : - A common way to use this feature is to link to 
++#             init scripts, for example:
++#             ln -s /etc/init.d/fail2ban /etc/mason.d/restart.d/
++#-----------------------------------------------------------
++# SERVICE_RESTART_DIR="/etc/mason.d/restart.d"
++
++#-----------------------------------------------------------
++# Property: PACKETSTATS_SAVE 
++#-----------------------------------------------------------
++# Type    : string
++# value   : "yes" or "no"
++# Default : "no"
++# Descr.  : If the value of this property is set to "yes" 
++#           the counters for each rule a saved before the
++#           iptables chains are flushed 
++#-----------------------------------------------------------
++# PACKETSTATS_SAVE="no"
++
++#-----------------------------------------------------------
++# Property: PACKETSTATS_MAX_AGE
++#-----------------------------------------------------------
++# Type    : integer
++# value   : maximum age of saved saved counters in days
++# Default : 30
++# Descr.  : If the value of this property is set, saved
++#           counters are deleted when older as set here
++#-----------------------------------------------------------
++# PACKETSTATS_MAX_AGE=30
++
++#-----------------------------------------------------------
++# Property: PACKETSTATS_LOGDIR
++#-----------------------------------------------------------
++# Type    : string
++# value   : the name of a directory
++# Default : /var/log/mason
++# Descr.  : The directory where the counters are saved
++#-----------------------------------------------------------
++# PACKETSTATS_LOGDIR="/var/log/mason"
++
++#===========================================================
++# New settings for the debian version of mason - END
++#===========================================================
++
+ #-----------------------------------------------------------
+ # Moderate likelihood you may wish to tune these, probably once.
+ #-----------------------------------------------------------
+@@ -154,6 +210,7 @@
+ #Use ANSI escape sequences to enhance display.  Default YES.
+ #Set this to no if your terminal doesn't support ANSI colors, etc.
+ #USEANSI="YES"
++USEANSI="NO"
+ 
+ # The range of ports considered to be IRC server ports.
+ # Default: 6666 to 6671
+@@ -458,7 +515,7 @@
+ #Location of runtime changeable files and configuration.
+ #Make sure you include the trailing slash.
+ # Default: "/var/lib/mason/"
+-#MASONDIR="/var/lib/mason/"
++MASONDIR="/var/lib/mason/"
+ 
+ #This is the configuration file mason uses.  It can be changed while
+ #Mason is running as long as the SIGUSR1 signal is sent to Mason afterwards.
+@@ -507,7 +564,7 @@
+ #/etc/rc.d/init.d/firewall start
+ #
+ #MASONEXE="/usr/bin/mason"
+-#MASONDECIDE="/usr/bin/mason-decide"
++#MASONDECIDE="/var/lib/mason/mason-decide"
+ #IPFWADMBIN="/sbin/ipfwadm"
+ #IPCHAINSBIN="/sbin/ipchains"
+ #Note - ipnatctl is not used any more.
+--- mason-1.0.0.orig/samlib
++++ mason-1.0.0/samlib
+@@ -617,7 +617,7 @@ fi
+ requireutil ifconfig awk || exit 1
+ #Checks done on the following function: 
+ ipof () {	#SUDO checked
+-    ifconfig $1 2>/dev/null | awk '/inet addr/{print substr($2,6)}'
++    LC_ALL=C ifconfig $1 2>/dev/null | awk '/inet addr/{print substr($2,6)}'
+ } #End of ipof
+ if [ "$DOREGRESSIONTEST" = "YES" ]; then
+ 	echo -n ipof...
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..a60419c
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1 @@
+pre-3.0.patch
diff --git a/debian/source/format b/debian/source/format
new file mode 100644
index 0000000..163aaf8
--- /dev/null
+++ b/debian/source/format
@@ -0,0 +1 @@
+3.0 (quilt)
diff --git a/ttt b/ttt
deleted file mode 100644
index 953091a..0000000
--- a/ttt
+++ /dev/null
@@ -1,167 +0,0 @@
-mason (1.0.0-10) unstable; urgency=low
-
-  * Added finnish debconf template translation. (Thanks to Esko Arajaervi) 
-  (closes: #473372)
-  * Added galician debconf template translation. (Thanks to Jacobo Tarrio) 
-  (closes: #473502)
-  * Added russian debconf template translation. (Thanks to Yuri Kozlov) 
-  (closes: #473790)
-  * Added basque debconf template translation. (Thanks to Piarres Beobide) 
-  (closes: #473968)
-  * Added turkish debconf template translation. (Thanks to Mert Dirik) 
-  (closes: #486566)
-  * New functionality: mason can now restart services after resetting the 
-  iptables rules. (Necessary for services that manipulate or add own 
-  iptables rules, e.g. fail2ban)
-  * Added documentation for additional properties of the debian version 
-  of mason (see masonrc)
-  * Moved not interactively usable script mason-decide from /usr/bin to 
-  /var/lib/mason 
-  * Changed encoding of this changelog file to utf-8
-  * Minor changes to fix warnings reported by lintian for version 1.0.0-9
-
- -- Thomas Scheffczyk <thomas.scheffczyk@verwaltung.uni-mainz.de>  Mon, 23 Jun 2008 13:38:36 +0200
-
-mason (1.0.0-9) unstable; urgency=low
-
-  * Added spanish debconf template translation. (Thanks to Maria Germana Oliveira) 
-    (closes: #469341)
-  * Fixed a small typo in the spanish translation (Thanks to Alvaro Herrera)
-  * Changed behaviour: When mason is purged, the init.d link will be removed now, too
-  * Added the '-n' switch to the call of 'iptables -L' when flushing chains 
-    to avoid DNS calls when merely checking for the exisitence of a chain.
-  * Changed Standards-Version from 3.7.2 to 3.7.3; no changes required.
-
- -- Thomas Scheffczyk <thomas.scheffczyk@verwaltung.uni-mainz.de>  Tue, 25 Mar 2008 12:29:34 +0100
-
-mason (1.0.0-8) unstable; urgency=low
-
-  * Added dutch debconf template translation. (Thanks to cobaco (aka Bart Cornelis))
-    (closes: #448932)
-  * Removed national encoding in changelog of 1.0.0-7
-  * Changed property 'Build-Depends-Indep' to 'Build-Depends' in the rules file
-
- -- Thomas Scheffczyk <thomas.scheffczyk@verwaltung.uni-mainz.de>  Fri,  2 Nov 2007 10:53:00 +0100
-
-mason (1.0.0-7) unstable; urgency=low
-
-  * Added functionality again, to save the packet counters for filter rules 
-    automatically when the rules are changed to allow long time statistics 
-    (undo reverting changes done in 1.0.0-6)
-  * Added checks for running klogd and for a recently used logfile 
-    (both necessary for mason to learn new rules)
-  * Added Portuguese debconf template translation. (Thanks to Luisa Lourenco)
-    (closes: #415631)
-  * Changed deprecated sort syntax used in masonlib ("sort +<number>" to "sort -k <number>")
-
- -- Thomas Scheffczyk <thomas.scheffczyk@verwaltung.uni-mainz.de>  Fri, 23 Mar 2007 10:25:10 +0100
-
-mason (1.0.0-6) unstable; urgency=low
-
-  * revert undokumented changes to masonlib which prevent mason from going
-    into etch
-
- -- Christoph Martin <christoph.martin@uni-mainz.de>  Fri, 16 Mar 2007 09:43:10 +0100
-
-mason (1.0.0-5) unstable; urgency=low
-
-  * Changed the dependency from debconf to debconf|debconf-2.0 (closes #332022)
-  * Changed the po file for the danish translation from da_DK.po to da.po
-    (closes #349955)
-  * Added Swedish debconf template translation. (Thanks to Daniel Nylander)
-    (closes: #334799)
-  * integrate changes from NMU -4.1
-    from Ana Beatriz Guerrero Lopez <ana@debian.org>
-    * Added the compat file, bumped compat to 5 and remove the conffile since 
-      it is not necessary anymore
-    * Bumped Standards-Version to 3.7.2, no changes required.
-    * Removed full stop "." character from the "Description" field. 
-  * added German debconf template translation (closes: #411390)
-
- -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed, 14 Mar 2007 11:31:08 +0100
-
-mason (1.0.0-4) unstable; urgency=low
-
-  * Added an update of the danish template translation (Thanks to Claus Hindsgaul) (closes: #319233)
-
- -- Thomas Scheffczyk <thomas.scheffczyk@verwaltung.uni-mainz.de>  Fri, 22 Jul 2005 07:46:17 +0200
-
-mason (1.0.0-3) unstable; urgency=low
-
-  * Incorporated NMU changes (Thanks to Lucas Wall) (closes: #250264,
-    #301321)
-  * fix postinst to correctly install startup links (closes: #222384)
-  * upgrade to policy 3.6.1.0
-  * Added Vietnamese debconf template translation (Thanks to Clytie
-    Siddall) (closes: #312752)
-
- -- Thomas Scheffczyk <thomas.scheffczyk@verwaltung.uni-mainz.de>  Fri, 24 Jun 2005 11:41:10 +0200
-
-mason (1.0.0-2.1) unstable; urgency=low
-
-  * Non-maintainer upload
-  * Switched to po-debconf. (closes: #250264)
-  * Added Brazilian Portuguese debconf template translation. (closes: #301321)
-  * Added Czech debconf template translation.
-  * Added French debconf template translation.
-  * Added Norwegian debconf template translation.
-
- -- Lucas Wall <lwall@debian.org>  Tue, 12 Apr 2005 10:17:05 -0300
-
-mason (1.0.0-2) unstable; urgency=low
-
-  * fix masonlib to support iptables static in kernel
-  * fix init.d levels so that mason will be startet directly after
-    configuring the interfaces and will not be stopped on shutdown
-
- -- Thomas Scheffczyk <thomas.scheffczyk@verwaltung.uni-mainz.de>  Thu,  8 May 2003 13:57:43 +0200
-
-mason (1.0.0-1) unstable; urgency=low
-
-  * New maintainer upload (closes: #143724)
-  * Exit if another instance of mason-gui-text is running (closes:
-    #186599, #169221)
-  * fix duplicate text in README.Debian (closes: #171709)
-  * add Danish debconf template (closes: #174789)
-
- -- Thomas Scheffczyk <thomas.scheffczyk@verwaltung.uni-mainz.de>  Tue, 15 Apr 2003 14:49:58 +0200
-
-mason (1.0.0-0.1) unstable; urgency=low
-
-  * new upstream
-
- -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed, 22 May 2002 17:46:26 +0200
-
-mason (0.13.0.92-2) unstable; urgency=low
-
-  * Added config questions for default policies to prevent boot-time
-  questions. (closes bug #50745)
-  * Changed maintainer address to jive with other packages.
-  * Fixed problem with *-ips files being created in current directory
-  instead of /var/lib/mason.
-  * Moved baserules from /var/lib/mason to /etc/mason.baserules (by request;
-  so config backups of /etc work properly).
-  * Fixed pristine source problem (it's uploaded now :-).
-
- -- Jeff Licquia <licquia@debian.org>  Wed, 24 Nov 1999 23:55:13 -0600
-
-mason (0.13.0.92-1) unstable; urgency=low
-
-  * Newer upstream version.
-  * Real working package, this time. :-)
-
- -- Jeff Licquia <licquia@debian.org>  Thu, 28 Oct 1999 16:30:12 -0500
-
-mason (0.13.0.92-1) unstable; urgency=low
-
-  * Newer upstream version.
-  * Real working package, this time. :-)
-
- -- Jeff Licquia <licquia@debian.org>  Thu, 28 Oct 1999 16:30:12 -0500
-
-mason (0.12.0-1) unstable; urgency=low
-
-  * Initial Release.
-
- -- Jeff Licquia <jeff@luci.org>  Wed, 31 Mar 1999 21:49:35 -0600
-