Updates from Debian/Ubuntu

Via Tomas Jacik <tomas.jacik@sunfox.cz>
    - added ipv6 regex while searching for RESERVED adresses
    - fixed msn port
    - added OpenVPN port
    - added Nagios NRPE daemon port
    - added default firehol setting probing for debian based systems
    - added wizzard support wlan
    - added wait for interface feature
      Unlike the original patch, this does not source /etc/default/firehol,
      instead we honour the WAIT_FOR_IFACE environment variable if it is set.
      The debian init script needs to export it, as it does for the sanewall
      package.
Deal with new variants on Kernel versions

 - Such as 3.8-1-amd64
 - Thanks to Cristian Ionescu-Idbohrn
Remove 10.0.0.0/8 from RESERVED_IPS

Leave in PRIVATE_IPS where it belongs.
Add further command alternatives for other systems

With the following additional choices, firehol can be made to run
on an openwrt system:
  awk if gawk is not available
  insmod if modprobe is not available
  nothing if renice is not available
Apply Gentoo patch firehol-1.273-log-output

File: firehol-1.273-log-output.patch (CVS rev 1.1)
Purpose: Ensure all error output goes to stderr
Apply Gentoo patch firehol-1.273-CVE-2008-4953

File: firehol-1.273-CVE-2008-4953.patch (CVS rev 1.1)
Purpose: Cleanup temporary directory handling and fix (very slim)
         opportunity for symlink attack
Stop warnings when -- is passed after start

Parameters after -- are passed to the config script, so there is no need
to warn about extra parameters after some commands (e.g. start).
Remove ecn_shame helper

 - The list that was used (http://urchin.earth.li/cgi-bin/ecn.pl?output=ip)
   is no longer available
Clean up service definitions

Descriptions are maintained separately in doc/services-db.data
Added alias tomcat for httpalt
Replace use of netstat with ss

Originally submitted for firehol by Jiri Popelka:
  http://sourceforge.net/support/tracker.php?aid=3523571

Notes:
  - ip has long been used in firehol, it made good sense to use ss, which
    is from the same package

  - ss will list some IPv4 addresses in the form ::ffff:192.168.122.1
    which the original patch does not allow for, fixed here

Bug reports:
  https://bugzilla.redhat.com/show_bug.cgi?id=784520
Do not try to add DROP rules to NAT chains

 - It is no longer possible (and was never really needed).

 - Patch derived from the one attached here by Andrew Schulman:
     http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=536675
Allow some configuration to be set by environment

 - Variables that can now be set by environment variables:
     FIREHOL_ESTABLISHED_ACTIVATION_ACCEPT
     FIREHOL_FORWARD_ACTIVATION_POLICY
     FIREHOL_INPUT_ACTIVATION_POLICY
     FIREHOL_OUTPUT_ACTIVATION_POLICY
     FIREHOL_AUTOSAVE
     FIREHOL_LOAD_KERNEL_MODULES
     FIREHOL_NAT
     FIREHOL_ROUTING
 - This can still _only_ be set by an environment variable:
     WAIT_FOR_IFACE
Fix iptables intrapositioned negation --mac-source

 - All other examples already correct (--tos, --state)
 - Went from deprecated in iptables 1.4.3 (Mar 2009)
   to not working in iptables 1.4.13 (Jul 2011)
 - Thanks to Alexander Prokopyev
Add an easy way to switch on bash debugging
Fix behaviour of condrestart to be standard

See http://fedoraproject.org/wiki/Packaging:SysVInitScript#Required_Actions
Slight improvements to wizard output

 - Do not output a blank line at the top
 - Do not emit a #! line - configurations cannot be used in this way
Make activation policy part of initial chain setup
Bring documentation in line for condrestart