diff options
Diffstat (limited to 'debian/patches/pre-3.0.patch')
| -rw-r--r-- | debian/patches/pre-3.0.patch | 719 |
1 files changed, 719 insertions, 0 deletions
diff --git a/debian/patches/pre-3.0.patch b/debian/patches/pre-3.0.patch new file mode 100644 index 0000000..acfe879 --- /dev/null +++ b/debian/patches/pre-3.0.patch @@ -0,0 +1,719 @@ +Description: All the patches that had been directly applied before the + conversion to source format 3.0 (quilt). +Last-Update: 2018-10-09 + +--- mason-1.0.0.orig/Makefile ++++ mason-1.0.0/Makefile +@@ -35,11 +35,13 @@ MASONVER = 1.0.0 + + #No quotes around multi file specs. + BINDIR=$(DESTDIR)/usr/bin/ +-BINFILES=mason mason-gui-text mason-decide ++BINFILES=mason mason-gui-text + CONFDIR=$(DESTDIR)/etc/ + CONFFILE=masonrc + LIBDIR=$(DESTDIR)/var/lib/mason/ +-LIBFILES=masonlib baserules.sample graffiti-services moreservices nmap-services portsdb-services regression-test all-ip-numbers.txt ++LIBFILES=baserules.sample graffiti-services moreservices nmap-services portsdb-services regression-test all-ip-numbers.txt ++LIBSCRIPTDIR=$(DESTDIR)/var/lib/mason/ ++LIBSCRIPTFILES=masonlib mason-decide + DOCDIR=$(DESTDIR)/usr/doc/mason-${MASONVER}/ + DOCFILES=COPYING index.html mason.sgml mason.txt mason.html mason-1.html mason-2.html mason-3.html mason-4.html mason-5.html mason-6.html mason-7.html mason-8.html mason-9.html mason-10.html mason-11.html toc.gif prev.gif next.gif mason-banner.gif + #DOCDIR=$(DESTDIR)/usr/doc/mason/ +@@ -59,6 +61,8 @@ install: + @install -o root -g root -m 0755 -d ${LIBDIR} + @echo -n "${LIBFILES}... " + @install -o root -g root -m 0644 ${LIBFILES} ${LIBDIR} ++ @echo -n "${LIBSCRIPTFILES}... " ++ @install -o root -g root -m 0755 ${LIBSCRIPTFILES} ${LIBSCRIPTDIR} + @echo -n "doc directory... " + @install -o root -g root -m 0755 -d ${DOCDIR} + @echo -n "${DOCFILES}... " +@@ -90,7 +94,7 @@ install: + docs: + sgml2html --imagebuttons mason.sgml \ + && sgml2txt -f mason.sgml \ +- && makedoc mason.txt mason.pdb 'The Mason HOWTO' ++# && makedoc mason.txt mason.pdb 'The Mason HOWTO' + + regress: + @if ./regression-test ; then \ +--- mason-1.0.0.orig/baserules.sample ++++ mason-1.0.0/baserules.sample +@@ -1,31 +1,45 @@ +-#Put any fixed rules you wish here. Example: +- +-#if [ -f /proc/net/ip_fwchains ]; then +-# #Place the ipchains versions of your rules here +-# /sbin/ipchains -A forward -s 172.16.0.0/24 -j MASQ #Masquerade from internal lan out +-#elif [ -f /proc/net/ip_input ]; then +-# #Place the ipfwadm versions of your rules here. +-# /sbin/ipfwadm -F -a accept -m -S 172.16.0.0/24 #Masquerade from internal lan out +-#else #The old >>>elif [ -n "`lsmod | grep '^ip_tables '`" ]; then<<<< doesn't work as iptables can be kernel-resident. Cross your fingers. +-# #Place the iptables versions of your rules here +-# #The following loads all netfilter modules - this may or may not be appropriate for you +-# MODDIR="/lib/modules/`uname -r`" +-# for MOD in \ +-# $MODDIR/ipv4/ip_* \ +-# $MODDIR/ipv4/ipt_* \ +-# $MODDIR/ipv4/iptable_* \ +-# $MODDIR/kernel/net/ipv4/netfilter/ip_* \ +-# $MODDIR/kernel/net/ipv4/netfilter/ipt_* \ +-# $MODDIR/kernel/net/ipv4/netfilter/iptable_* ; do +-# insmod $MOD >/dev/null 2>/dev/null ; modprobe $MOD >/dev/null 2>/dev/null +-# done +-# #Masquerade from internal lan out - syntax from iptables howto; thanks, Rusty. +-# iptables -A POSTROUTING -t nat -s 172.16.0.0/24 -o ppp0 -j MASQUERADE +-# #The following will allow the response packets back in/out/through your firewall. +-# #This, too, may or may not be appropriate for you and should not be taken as a suggestion. +-# #It is only here as a convience. If you use these, Mason will build a firewall +-# #of opening packets only. +-# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT +-# iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT +-# iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT +-#fi ++##!/bin/sh ++##============================================================================= ++## Example of a mason firewall script ++##============================================================================= ++# ++## --------------------------------------------------------------------- ++## Allow all local connections ++## --------------------------------------------------------------------- ++#/sbin/iptables -A INPUT -i lo -j ACCEPT ++#/sbin/iptables -A OUTPUT -o lo -j ACCEPT ++# ++## --------------------------------------------------------------------- ++## Allow ESTABLISHED and RELATED packets globally, to drastically reduce ++## the number of reported rules in learning mode ++## --------------------------------------------------------------------- ++## Hint: "There is a certain feature in iptables that is not so well ++## documented and may therefore be overlooked by a lot of people [...] ++## If you use state NEW, packets with the SYN bit unset will get through ++## your firewall." Cited from: ++## http://iptables-tutorial.frozentux.net/iptables-tutorial.html#NEWNOTSYN ++## --------------------------------------------------------------------- ++#/sbin/iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT ++#/sbin/iptables -A INPUT -m state --state RELATED -j ACCEPT ++#/sbin/iptables -A INPUT -m state --state INVALID -j DROP ++# ++#/sbin/iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT ++#/sbin/iptables -A OUTPUT -m state --state RELATED -j ACCEPT ++#/sbin/iptables -A OUTPUT -m state --state INVALID -j DROP ++# ++## --------------------------------------------------------------------- ++## Drop all new new tcp-connections without a sys-flag ++## --------------------------------------------------------------------- ++## Info: "There is a certain feature in iptables that is not so well ++## documented and may therefore be overlooked by a lot of people [...] ++## If you use state NEW, packets with the SYN bit unset will get through ++## your firewall." Cited from: ++## http://iptables-tutorial.frozentux.net/iptables-tutorial.html#NEWNOTSYN ++## --------------------------------------------------------------------- ++#/sbin/iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP ++#/sbin/iptables -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP ++# ++## --------------------------------------------------------------------- ++## Allowed connections ++## --------------------------------------------------------------------- ++# +--- mason-1.0.0.orig/firewall ++++ mason-1.0.0/firewall +@@ -3,12 +3,22 @@ + # firewall Starts a Mason firewall. + # + # ++### BEGIN INIT INFO ++# Provides: mason ++# Required-Start: $network ++# Required-Stop: $network ++# Default-Start: 2 3 4 5 ++# Default-Stop: 0 1 6 ++# Short-Description: Starts the mason firewall script ++# Description: Starts the firewall script /etc/mason.baserules. The script was created with the mason firewall builder. ++### END INIT INFO ++# + # chkconfig: 2345 18 92 + # description: firewall starts the firewall created by the Mason \ + # firewall builder. As a firewall is important to system security, \ + # it should be always turned on. + +-# Debian init script derived from original script by Jeff Licquia. ++# Debian init script derived from original script by Jeff Licquia + + # Debian flags for runlevels - similar to RH's chkconfig. + FLAGS="defaults 19" +--- mason-1.0.0.orig/mason ++++ mason-1.0.0/mason +@@ -146,7 +146,7 @@ for ONEIF in $DYNIF ; do + echo "export ${ONEIF}ADDR=\"0/0\" ${CMNT} ${CMNT}Use this if you want to match any address on $ONEIF." + fi + if [ "$DYNIFMODE" != "SPECIFICIP" ]; then echo -n "$CMNT $CMNT" ; fi +- echo "export ${ONEIF}ADDR=\"\`ifconfig $ONEIF 2>/dev/null | awk '/inet addr/{print substr($2,6)}'\`$SINGLEMACHSPEC\" ${CMNT} ${CMNT}Use this if you want to match a single address on $ONEIF." ++ echo "export ${ONEIF}ADDR=\"\`LC_ALL=C ifconfig $ONEIF 2>/dev/null | awk '/inet addr/{print substr(\$2,6)}'\`$SINGLEMACHSPEC\" ${CMNT} ${CMNT}Use this if you want to match a single address on $ONEIF." + if [ "$DYNIFMODE" != "SMALLESTRANGE" ]; then echo -n "$CMNT $CMNT" ; fi + #FIXME - what if the file is empty? + echo "export ${ONEIF}ADDR=\"$(encompassingnetworkof $(cat ${MASONDIR}${ONEIF}-ips | sort | uniq) || logfail $LINENO return encompassing network for $ONEIF)\" ${CMNT} ${CMNT}Use this if you want to match all addresses seen so far on $ONEIF." +--- mason-1.0.0.orig/mason-decide ++++ mason-1.0.0/mason-decide +@@ -176,7 +176,7 @@ while [ "$EXITNOW" != "YES" ] && read IN + echo $ENH "${WARN}$0: Can't create temp file.${NORM}" + else + echo "$CURRLINE" >$TMPFILE +- $EDITOR $TMPFILE <&10 ++ eval $EDITOR $TMPFILE <&10 + CURRLINE=`cat $TMPFILE` + rm -f $TMPFILE || : + fi ;; +--- mason-1.0.0.orig/mason-gui-text ++++ mason-1.0.0/mason-gui-text +@@ -4,6 +4,25 @@ set -e + #See top of Mason script for copyright and licensing information. + #Last YYYY code used: 0019, use 0020 next + ++# --------------------------------------------------------------------- ++# Kill another instance of mason if this programm is started with ++# the option "--force" - 2008-06-27 - Scheffczyk ++# --------------------------------------------------------------------- ++if [ "$$"x != "`/bin/pidof -x /usr/bin/mason-gui-text`"x ]; then ++ if [ "$1"x == "--force"x ]; then ++ echo "Told to stop another instance of $0 ..." ++ kill -9 `ps aux | grep mason | egrep -v "(grep mason|$$)" | awk '{ print $2 }'` ++ if [ "$$"x != "`/bin/pidof -x /usr/bin/mason-gui-text`"x ]; then ++ echo "Unable to stop another instance of $0. Exiting ..."; ++ exit 1; ++ fi; ++ else ++ echo "Another instance of $0 is running. Exiting ..."; ++ exit 1; ++ fi; ++fi; ++ ++ + CKPTMGT=" mgt: Ground0" ; #ckpt $CKPTMGT + + MASONDIR=${MASONDIR:-"/var/lib/mason/"} +@@ -118,21 +137,41 @@ killrunningmason + + while [ ! "$EXITCONTROL" = "YES" ]; do + clear +- echo $ENH "${HEADER}---- ${BLUE}Mason${HEADER} firewall builder for Linux ----$NORM" +- echo $ENH "${HEADER}---- Learning shell for Mason. ----$NORM" +- echo $ENH "${HEADER}---- see http://www.pobox.com/~wstearns/mason/ for more info. ----$NORM" +- echo $ENH "${HEADER}---- William Stearns <wstearns@pobox.com> ----$NORM" ++ echo "------------------------------------------------------------------" ++ echo $ENH "${HEADER}${BLUE}Mason${HEADER} firewall builder for Linux $NORM" ++ echo "------------------------------------------------------------------" ++ echo $ENH "${HEADER}---- Learning shell for Mason. $NORM" ++ echo $ENH "${HEADER}---- see http://www.pobox.com/~wstearns/mason/ for more info. $NORM" ++ echo $ENH "${HEADER}---- Originally from William Stearns <wstearns@pobox.com> $NORM" + if [ -n "$MASONVER" ]; then +- echo $ENH "${HEADER}(This is release $MASONVER)$NORM" ++ echo $ENH "${HEADER}---- This is release $MASONVER $NORM" + fi ++ echo "------------------------------------------------------------------" ++ if [ -z "`/bin/pidof -x /sbin/klogd`" ]; then ++ echo "Warning: No instance of klogd (kernel log deamon) is running," ++ echo " mason will not be able to learn new rules." ++ echo "------------------------------------------------------------------" ++ fi ++ if [ ! -f "$PACKETLOGFILE" ]; then ++ echo "Warning: The syslog file $PACKETLOGFILE does not exist," ++ echo " mason will not be able to learn new rules." ++ echo "------------------------------------------------------------------" ++ else ++ if [ -z "` find $PACKETLOGFILE -cmin -60`" ]; then ++ echo "Warning: No messages was written to the syslog file $PACKETLOGFILE" ++ echo " the last hour, the file is probably not in use by a" ++ echo " syslog deamon. Mason will not be able to learn new rules." ++ echo "------------------------------------------------------------------" ++ fi ++ fi + if [ -n "$MASONPID$MASONTAILPID" ]; then + echo Mason is currently in learn mode. +- echo ++ echo "------------------------------------------------------------------" + echo $ENH ${KEY}EL${NORM}: ${KEY}E${NORM}nd ${KEY}L${NORM}earning. + showstate 'Mason-gui-text: Main menu, learning in the background' + else + echo Mason IS NOT currently learning. +- echo ++ echo "------------------------------------------------------------------" + echo $ENH ${KEY}BL${NORM}: ${KEY}B${NORM}egin ${KEY}L${NORM}earning. + showstate 'Mason-gui-text: Main menu, not learning' + fi +@@ -357,6 +396,12 @@ while [ ! "$EXITCONTROL" = "YES" ]; do + killrunningmason + flushfirewall + runfirewall STANDARD ++ # --------------------------------------------------------------------- ++ # Restart services that modify iptables rules - 2008-04-02 - Scheffczyk ++ # --------------------------------------------------------------------- ++ wrap Restarting services ... ++ RestartServices ++ wrap Done! + ;; + *) wrap ${WARN}Unknown choice. Please enter the one or two character code.${NORM} + ;; +--- mason-1.0.0.orig/mason-gui-text.1 ++++ mason-1.0.0/mason-gui-text.1 +@@ -1,20 +1,18 @@ +-.TH MASON-GUI-TEXT 1 + .\" NAME should be all caps, SECTION should be 1-8, maybe w/ subsection + .\" other parms are allowed: see man(7), man(1) +-.SH NAME ++.TH "MASON-GUI-TEXT" "1" "" "" "" ++.SH "NAME" + mason\-gui\-text \- front end to mason +-.SH SYNOPSIS +-.B mason\-gui\-text ++.SH "SYNOPSIS" ++.B \fBmason\-gui\-text\fR [\fB\-\-force\fR] + .SH "DESCRIPTION" + .B mason\-gui\-text +-is a "textual GUI" front end to mason, the interactive firewall +-builder. When it is run, it allows you to control mason's behavior +-through simple keystroke commands. It can start and stop mason, allow +-you to edit the rules generated (and re-merge them into the currently +-running rule set), and change mason's settings. It also has a +-"console lock" setting for locking the console down if necessary. ++is a "textual GUI" front end to mason, the interactive firewall builder. When it is run, it allows you to control mason's behavior through simple keystroke commands. It can start and stop mason, allow you to edit the rules generated (and re\-merge them into the currently running rule set), and change mason's settings. It also has a "console lock" setting for locking the console down if necessary. ++.SH "OPTIONS" ++Default behaviour of mason\-gui\-text ist to exit if another instance of it is already running. ++.IP "\fB\-\-force\fR ++Try to stop other instances of mason\-gui\-text and continue running + .SH "SEE ALSO" +-.B "QuickStart, mason(1)" +-.SH AUTHOR +-This manual page was written by Jeff Licquia <jeff@luci.org>, +-for the Debian GNU/Linux system (but may be used by others). ++.B "mason(1)" ++.SH "AUTHOR" ++This manual page was written by Jeff Licquia <jeff@luci.org> for the Debian GNU/Linux system (but may be used by others) and supplemented by Thomas Scheffczyk <scheffczyk@debian.org>. +--- mason-1.0.0.orig/mason.1 ++++ mason-1.0.0/mason.1 +@@ -1,17 +1,17 @@ +-.TH MASON 1 + .\" NAME should be all caps, SECTION should be 1-8, maybe w/ subsection + .\" other parms are allowed: see man(7), man(1) +-.SH NAME ++.TH "MASON" "1" "" "" "" ++.SH "NAME" + mason \- interactively create a firewall +-.SH SYNOPSIS ++.SH "SYNOPSIS" + .B mason + .I "< logfile > rulefile" +-.br ++.br + .SH "DESCRIPTION" + This manual page briefly documents the + .BR mason + command. +-.PP ++.PP + .B mason + interactively generates a set of firewall rules for a Linux\-based + firewall. This is done by turning on full IP logging, watching the +@@ -21,20 +21,20 @@ seen. + is familiar with most of the quirks of various connection types (such + as ftp and IRC), and can output rules for 2.0.x ipfwadm, 2.2.x + ipchains, and Cisco packet filters. +-.PP ++.PP + .B mason + operates by reading in log file information from standard input and + writing firewall rules to standard output. This allows + .B mason +-to work offline or on a separate system. Real-time firewall ++to work offline or on a separate system. Real\-time firewall + generation can be achieved with a command like tail(1). +-.PP ++.PP + Most users will want to run mason with a user\-friendly interface such + as mason\-gui\-text(1). +-.SH ENVIRONMENT ++.SH "ENVIRONMENT" + .B mason + is configured using the following environment variables. +-.TP ++.TP + .B ECHOCOMMAND + Sets the type of firewall rules that + .B mason +@@ -43,7 +43,7 @@ should output to standard out. Allowed + .B mason + outputs whatever kind of rules are supported by the currently running + Linux kernel. +-.TP ++.TP + .B DOCOMMAND + Sets the type of firewall rules that + .B mason +@@ -52,20 +52,20 @@ include "ipfwadm" and "ipchains". By de + .B mason + outputs whatever kind of rules are supported by the currently running + Linux kernel. +-.TP ++.TP + .B HEARTBEAT + If set to "yes", + .B mason +-will output a "+" or "-" to standard error whenever a rule generated ++will output a "+" or "\-" to standard error whenever a rule generated + by + .B mason + has been triggered. +-.TP ++.TP + .B DYNIP + Set this to the list of interfaces that have dynamically assigned + addresses, separated by spaces. + .SH "SEE ALSO" +-.B "mason.txt, mason\-gui\-text(1)" +-.SH AUTHOR ++.B "mason\-gui\-text(1)" ++.SH "AUTHOR" + This manual page was written by Jeff Licquia <jeff@luci.org>, + for the Debian GNU/Linux system (but may be used by others). +--- mason-1.0.0.orig/masonlib ++++ mason-1.0.0/masonlib +@@ -26,10 +26,10 @@ + # || logfail $LINENO masonlib: YYYY #### the_command_that_was_supposed_to_run + #Last YYYY code used: 0149, use 0150 next + +-if [ -f /usr/lib/samlib/samlib ]; then +- . /usr/lib/samlib/samlib ++if [ -f /var/lib/mason/samlib ]; then ++ . /var/lib/mason/samlib + else +- echo "/usr/lib/samlib/samlib is missing - please get it from" >/dev/stderr ++ echo "/var/lib/mason/samlib is missing - please get it from" >/dev/stderr + echo "http://www.stearns.org/samlib/" >/dev/stderr + echo "Exiting." >/dev/stderr + exit 1 +@@ -44,7 +44,7 @@ for ONEFUNC in askYN encompassingnetwork + fi + done + +-MASONVER="1.0.0, 5/12/2002" ++MASONVER="1.0.0-11 - 2008-06-27" + + #------------------------------------------------------------------------- + # addcounts procedure, adds the packet counts to the rules in a file. +@@ -289,7 +289,7 @@ checkconf () { + #SYSTEMRULEFILE=${SYSTEMRULEFILE:-"${MASONDIR}systemrules"} ; if [ ! -f $SYSTEMRULEFILE ]; then touch $SYSTEMRULEFILE || logfail $LINENO masonlib: 0015 touch $SYSTEMRULEFILE ; fi + PACKETLOGFILE=${PACKETLOGFILE:-"/var/log/messages"} + MASONEXE=${MASONEXE:-"/usr/bin/mason"} +- MASONDECIDE=${MASONDECIDE:-"/usr/bin/mason-decide"} ++ MASONDECIDE=${MASONDECIDE:-"/var/lib/mason/mason-decide"} + + CKPTCHECKCONF=" checkconf: Set up ANSI escape codes" ; #ckpt $CKPTCHECKCONF + if [ "$USEANSI" != "NO" ]; then +@@ -301,7 +301,8 @@ checkconf () { + BLUE="\033[1;34m" + PINK="\033[1;35m" + TURQUOISE="\033[1;36m" +- NORM="\033[1;37m" ++# NORM="\033[1;37m" ++ NORM="`tput sgr0 2`" + BRIGHT="\033[1;39m" + else + ENH="" +@@ -448,7 +449,7 @@ checkconf () { + [Nn][Oo]|[Nn][Oo][Nn][Ee]) ECHOCOMMAND="none" ;; + *) if [ -f /proc/net/ip_fwchains ]; then ECHOCOMMAND="ipchains" + elif [ -f /proc/net/ip_input ]; then ECHOCOMMAND="ipfwadm" +- elif [ -n "`lsmod | grep '^ip_tables '`" ]; then ECHOCOMMAND="iptables" ++ elif [ -f /proc/net/ip_tables_names ]; then ECHOCOMMAND="iptables" + else ECHOCOMMAND="ipchains" #Set default here + fi ;; + esac +@@ -478,7 +479,7 @@ checkconf () { + [Ii][Pp][Tt][Aa][Bb][Ll][Ee][Ss]) + DOCOMMAND="iptables" + #FIXME - how to reliably test for kernel iptables support +- #if [ -z "`lsmod | grep '^ip_tables '`" ]; then ++ #if -z "`lsmod | grep '^ip_tables '`" ]; then + # wrap ${WARN}WARNING! User has requested iptables, but it appears to be unavailable. Proceeding, but this is not likely to work.${NORM} >/dev/stderr + # sleep 10 + #fi +@@ -682,10 +683,15 @@ checkconf () { + + CKPTCHECKCONF=" checkconf: Check editor" ; #ckpt $CKPTCHECKCONF + if [ -z "$EDITOR" ]; then +- for TRYEDITOR in `type -path mcedit || :` `type -path pico || :` `type -path vi || :` `type -path jove || :` `type -path nedit || :` `type -path emacs || :` ; do ++ for TRYEDITOR in `type -path emacs || :` `type -path vi || :` `type -path nano || :` `type -path mcedit || :` `type -path pico || :` `type -path jove || :` `type -path nedit || :` ; do ++ # 2008-06-27 - Scheffczyk: Added the -nw switch if emacs is choosen as an editor + if [ -z "$EDITOR" ]; then ++ if [ "$TRYEDITOR"x == "emacs"x ]; then ++ EDITOR="emacs -nw"; ++ else + EDITOR=$TRYEDITOR +- wrap Editor default of $EDITOR taken. >/dev/stderr ++ fi ++ wrap Editor default of $EDITOR taken. >/dev/stderr + fi + done + unset TRYEDITOR || : +@@ -716,7 +722,7 @@ checksys () { + exit 0 + fi + +- if [ ! -f /proc/net/ip_fwchains ] && [ ! -f /proc/net/ip_input ] && [ -z "`lsmod | grep '^ip_tables '`" ]; then ++ if [ ! -f /proc/net/ip_fwchains ] && [ ! -f /proc/net/ip_input ] && [ ! -f /proc/net/ip_tables_names ]; then + wrap ${WARN}This kernel does not support ipchains, ipfwadm or iptables!${NORM} >/dev/stderr + #DOCOMMAND="none" #Should we force to none? + fi +@@ -1199,13 +1205,12 @@ dorule () { + esac #Case $1=action + } #End of dorule + +- +- + #------------------------------------------------------------------------- + #Flush the existing rules so we start with a clean slate. + #------------------------------------------------------------------------- + flushfirewall () { #SUDO checked + CKPTFLUSHFIREWALL=" flushfirewall: Start" ; #ckpt $CKPTFLUSHFIREWALL ++ savepacketstats + updatecounts + echo -n Flushing... >/dev/stderr + +@@ -1229,7 +1234,7 @@ flushfirewall () { #SUDO checked + dorule f "$ONECHAIN" '' '' '' '' '' '' '' '' '' '' '' '' '' || logfail $LINENO masonlib: 0039/0041/0043/0048/0050/0052 + done + +- if [ -f /proc/net/ip_fwchains ] || [ -n "`lsmod | grep '^ip_tables '`" ]; then ++ if [ -f /proc/net/ip_fwchains ] || [ -f /proc/net/ip_tables_names ]; then + #Flush the nolog chains if they exist, create them if not. + CKPTFLUSHFIREWALL=" flushfirewall: Create or flush nolog chains." ; #ckpt $CKPTFLUSHFIREWALL + if [ -n "$NOLOGSUFFIX" ]; then +@@ -1257,15 +1262,19 @@ flushornewchain () { #SUDO checked + if [ -f /proc/net/ip_fwchains ]; then + #REMOVEME + #if [ `$SUDO $IPCHAINSBIN -L -n | grep "^Chain $CHAINNAME" | wc -l` -gt 0 ]; then +- if $SUDO $IPCHAINSBIN -L $CHAINNAME >/dev/null 2>/dev/null ; then #If chain exists ++ # 2008-03-25 - Scheffczyk: Added the '-n' switch to the call of 'iptables -L' ++ # to avoid DNS calls when merely checking for the exisitence of a chain. ++ if $SUDO $IPCHAINSBIN -n -L $CHAINNAME >/dev/null 2>/dev/null ; then #If chain exists + $SUDO $IPCHAINSBIN -F $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0044/0070/0089/0134 $IPCHAINSBIN -F $CHAINNAME + else + $SUDO $IPCHAINSBIN -N $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0045/0071/0090 $IPCHAINSBIN -N $CHAINNAME + fi +- elif [ -n "`lsmod | grep '^ip_tables '`" ]; then ++ elif [ -f /proc/net/ip_tables_names ]; then + #FIXME, check everywhere. + #if iptables -L -n >/dev/null 2>/dev/null ; then echo iptables successful ; fi +- if $SUDO $IPTABLESBIN -L $CHAINNAME >/dev/null 2>/dev/null ; then #If chain exists ++ # 2008-03-25 - Scheffczyk: Added the '-n' switch to the call of 'iptables -L' ++ # to avoid DNS calls when merely checking for the exisitence of a chain. ++ if $SUDO $IPTABLESBIN -n -L $CHAINNAME >/dev/null 2>/dev/null ; then #If chain exists + $SUDO $IPTABLESBIN -F $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0135 $IPTABLESBIN -F $CHAINNAME + else + $SUDO $IPTABLESBIN -N $CHAINNAME >/dev/null 2>/dev/null || logfail $LINENO masonlib: 0136 $IPTABLESBIN -N $CHAINNAME +@@ -1901,7 +1910,7 @@ runfirewall () { #SUDO checked + done + else echo -n No Blockedhost blocks... ; fi + +- if [ -f /proc/net/ip_fwchains ] || [ -n "`lsmod | grep '^ip_tables '`" ]; then ++ if [ -f /proc/net/ip_fwchains ] || [ -f /proc/net/ip_tables_names ]; then + CKPTRUNFIREWALL=" runfirewall: ipchains/iptables spoofblocks" ; #ckpt $CKPTRUNFIREWALL + if [ "$SPOOFBLOCKS" = "YES" ]; then + echo -n Spoof blocks... +@@ -1913,7 +1922,7 @@ runfirewall () { #SUDO checked + #$IPCHAINSBIN -I input -j NoSpoof || logfail $LINENO masonlib: YYYY 0072 + dorule i input '' '' '' '' '' '' '' '' '' "NoSpoof" '' '' '' || logfail $LINENO masonlib: YYYY 0072 + #In iptables, we have to check for spoofing on the forward chain as well. +- if [ -n "`lsmod | grep '^ip_tables '`" ]; then ++ if [ -f /proc/net/ip_tables_names ]; then + dorule i forward '' '' '' '' '' '' '' '' '' "NoSpoof" '' '' '' || logfail $LINENO masonlib: YYYY 0137 + fi + +@@ -2313,7 +2322,9 @@ sortrulefile () { + for SECTION in `seqfunc 0 $FILECOUNT` ; do + if [ -f "$ONEFILE.$SECTION" ]; then + if [ `grep '#\^' $ONEFILE.$SECTION | wc -l` -gt 0 ]; then +- sort -t '^' +1 -n -r $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0120 ++ # 2007-03-23 Scheffczyk ++ # Original line was: sort -t '^' +1 -n -r $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0120 ++ sort -t '^' -k 1 -n -r $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0120 + else + cat $ONEFILE.$SECTION >>$ONEFILE.new || logfail $LINENO masonlib: YYYY 0121 + fi +@@ -2350,12 +2361,14 @@ uniqrulefile () { + cp -pf $1 $1.bak || logfail $LINENO masonlib: YYYY 0125 + #sort -t '#' +1 $1 | uniq >$1.sorted #This worked until we had mark values. + CKPTUNIQRULEFILE=" uniqrulefile: main pipeline" ; #ckpt $CKPTUNIQRULEFILE ++ # 2007-03-23 Scheffczyk ++ # Original line was: sort -t '#' +1 | \ + cat $1 | \ + sed -e 's/^/!!! /' \ + -e 's/^!!! \(.* -m \)\([0-9][0-9]*\)\( .*\)/\2 \1ZzMaRkZz\3/' | \ + sort +1 | \ + uniq -1 | \ +- sort -t '#' +1 | \ ++ sort -t '#' -k 1 | \ + uniq -1 | \ + sed -e 's/^\([0-9][0-9]*\) \(.* -m \)ZzMaRkZz\( .*\)/\2\1\3/' \ + -e 's/^!!! //' >$1.sorted || logfail $LINENO masonlib: YYYY 0126 +@@ -2419,3 +2432,49 @@ updatecounts () { + } #End of updatecounts + + ++#------------------------------------------------------------------------- ++# Save packet stats to a file for each chain - 2008-04-03 - Scheffczyk ++#------------------------------------------------------------------------- ++savepacketstats () { ++ if [ "$PACKETSTATS_SAVE"x = "yes"x ] ++ then ++ if [ -z "$PACKETSTATS_LOGDIR" ]; then ++ $PACKETSTATS_LOGDIR="/var/log/mason"; ++ fi; ++ if [ ! -d "$PACKETSTATS_LOGDIR" ]; then ++ mkdir -p $PACKETSTATS_LOGDIR; ++ fi; ++ if [ -z "$PACKETSTATS_MAX_AGE" ] ++ then ++ find $PACKETSTATS_LOGDIR/ -mtime +$PACKETSTATS_MAX_AGE -exec rm {} \; ++ fi ++ PACKETSTATS_TIMESTAMP=$(date +%Y.%m.%d.%H.%M.%S) ++ TABLES="nat filter" ++ for TABLE in $TABLES ++ do ++ CHAINS=`$IPTABLESBIN -L -n -t $TABLE | fgrep Chain | awk '{ print $2; }'` ++ for CHAIN in $CHAINS ++ do ++ $IPTABLESBIN -n -x -v -t $TABLE -L $CHAIN > $PACKETSTATS_LOGDIR/$TABLE.$CHAIN.$PACKETSTATS_TIMESTAMP ++ done ++ done ++ fi ++} ++ ++# --------------------------------------------------------------------- ++# Restart services that modify iptables rules - 2008-04-02 - Scheffczyk ++# --------------------------------------------------------------------- ++RestartServices() { ++ unset SERVICE; ++ if [ -z "$SERVICE_RESTART_DIR" ]; then ++ SERVICE_RESTART_DIR="/etc/mason.d/restart.d"; ++ fi; ++ if [ ! -d "$SERVICE_RESTART_DIR" ]; then ++ mkdir -p $SERVICE_RESTART_DIR; ++ fi; ++ if [ $(ls -1 "$SERVICE_RESTART_DIR/" | wc -l) -ne 0 ]; then ++ for SERVICE in $(ls -1 $SERVICE_RESTART_DIR/*| egrep -v "[#~]"); do ++ $SERVICE restart ++ done; ++ fi; ++} +--- mason-1.0.0.orig/masonrc ++++ mason-1.0.0/masonrc +@@ -1,5 +1,8 @@ +-#WARNING - If you are upgrading from a previous version, the uncommented +-#lines in your old masonrc have been appended to the end of this file. ++#=========================================================== ++# WARNING - If you are upgrading from a previous version, the uncommented ++# lines in your old masonrc have been appended to the end of this file. ++#=========================================================== ++ + #Please note that the NAMECACHE, NETCACHE, and SERVICES fields are no longer used. + + #For instructions on how to set the parameters in this file, refer to +@@ -60,6 +63,59 @@ + #FLUSHEDPOLICY="reject" + #FLUSHEDPOLICY="deny" + ++#=========================================================== ++# New settings for the debian version of mason - BEGIN ++#=========================================================== ++# Property: SERVICE_RESTART_DIR ++#----------------------------------------------------------- ++# Type : string ++# value : the name of a directory ++# Default : /etc/mason.d/restart.d ++# Descr. : All scripts in this directory will be executed ++# with the command line parameter 'restart'. ++# Hints : - A common way to use this feature is to link to ++# init scripts, for example: ++# ln -s /etc/init.d/fail2ban /etc/mason.d/restart.d/ ++#----------------------------------------------------------- ++# SERVICE_RESTART_DIR="/etc/mason.d/restart.d" ++ ++#----------------------------------------------------------- ++# Property: PACKETSTATS_SAVE ++#----------------------------------------------------------- ++# Type : string ++# value : "yes" or "no" ++# Default : "no" ++# Descr. : If the value of this property is set to "yes" ++# the counters for each rule a saved before the ++# iptables chains are flushed ++#----------------------------------------------------------- ++# PACKETSTATS_SAVE="no" ++ ++#----------------------------------------------------------- ++# Property: PACKETSTATS_MAX_AGE ++#----------------------------------------------------------- ++# Type : integer ++# value : maximum age of saved saved counters in days ++# Default : 30 ++# Descr. : If the value of this property is set, saved ++# counters are deleted when older as set here ++#----------------------------------------------------------- ++# PACKETSTATS_MAX_AGE=30 ++ ++#----------------------------------------------------------- ++# Property: PACKETSTATS_LOGDIR ++#----------------------------------------------------------- ++# Type : string ++# value : the name of a directory ++# Default : /var/log/mason ++# Descr. : The directory where the counters are saved ++#----------------------------------------------------------- ++# PACKETSTATS_LOGDIR="/var/log/mason" ++ ++#=========================================================== ++# New settings for the debian version of mason - END ++#=========================================================== ++ + #----------------------------------------------------------- + # Moderate likelihood you may wish to tune these, probably once. + #----------------------------------------------------------- +@@ -154,6 +210,7 @@ + #Use ANSI escape sequences to enhance display. Default YES. + #Set this to no if your terminal doesn't support ANSI colors, etc. + #USEANSI="YES" ++USEANSI="NO" + + # The range of ports considered to be IRC server ports. + # Default: 6666 to 6671 +@@ -458,7 +515,7 @@ + #Location of runtime changeable files and configuration. + #Make sure you include the trailing slash. + # Default: "/var/lib/mason/" +-#MASONDIR="/var/lib/mason/" ++MASONDIR="/var/lib/mason/" + + #This is the configuration file mason uses. It can be changed while + #Mason is running as long as the SIGUSR1 signal is sent to Mason afterwards. +@@ -507,7 +564,7 @@ + #/etc/rc.d/init.d/firewall start + # + #MASONEXE="/usr/bin/mason" +-#MASONDECIDE="/usr/bin/mason-decide" ++#MASONDECIDE="/var/lib/mason/mason-decide" + #IPFWADMBIN="/sbin/ipfwadm" + #IPCHAINSBIN="/sbin/ipchains" + #Note - ipnatctl is not used any more. +--- mason-1.0.0.orig/samlib ++++ mason-1.0.0/samlib +@@ -617,7 +617,7 @@ fi + requireutil ifconfig awk || exit 1 + #Checks done on the following function: + ipof () { #SUDO checked +- ifconfig $1 2>/dev/null | awk '/inet addr/{print substr($2,6)}' ++ LC_ALL=C ifconfig $1 2>/dev/null | awk '/inet addr/{print substr($2,6)}' + } #End of ipof + if [ "$DOREGRESSIONTEST" = "YES" ]; then + echo -n ipof... |