Updates from Debian/Ubuntu

Via Tomas Jacik <tomas.jacik@sunfox.cz>
    - added ipv6 regex while searching for RESERVED adresses
    - fixed msn port
    - added OpenVPN port
    - added Nagios NRPE daemon port
    - added default firehol setting probing for debian based systems
    - added wizzard support wlan
    - added wait for interface feature
      Unlike the original patch, this does not source /etc/default/firehol,
      instead we honour the WAIT_FOR_IFACE environment variable if it is set.
      The debian init script needs to export it, as it does for the sanewall
      package.
Handle 2-digit kernel versions correctly
Deal with new variants on Kernel versions

 - Such as 3.8-1-amd64
 - Thanks to Cristian Ionescu-Idbohrn
Disable automatic startup

As applied to Redhat/Fedora packages since Oct 2008
Use Official GPL stanza in firehol.in

Signed-off-by: Jari Aalto <jari.aalto@cante.net>
Remove 10.0.0.0/8 from RESERVED_IPS

Leave in PRIVATE_IPS where it belongs.
Add further command alternatives for other systems

With the following additional choices, firehol can be made to run
on an openwrt system:
  awk if gawk is not available
  insmod if modprobe is not available
  nothing if renice is not available
Change activation policy for FORWARD chain TO DROP

Close the gap where a "router all accept" will allow connections established
in the setup window to continue afterwards by preventing routed traffic
during the activation.

By leaving the policy intact for INPUT and OUTPUT, there is no chance of
interfering with a remote connection being used to update the firewall.

Existing connections will have packets dropped during the activation period
but TCP connections should recover once the setup is finished.

Does nothing to address "client all accept" on a host, which should not
really be used on an internet-facing server unless you change the other
policies in the configuration as a minimum.
Default to DROP as the activation policy

Make DROP the default activation policy for all filter chains.

Added a new variable FIREHOL_ESTABLISHED_ACTIVATION_ACCEPT which if
set to 1 (the default) will emit temporary rules to allow established
traffic to continue that are deleted when the firewall is complete.
Make activation policy part of initial chain setup

The activation policy is now worked out and used in a single pass.

Previously we set the filter table chains to ACCEPT, then subsequently
set them to the activation policy value.
Apply Gentoo patch firehol-1.273-log-output

File: firehol-1.273-log-output.patch (CVS rev 1.1)
Purpose: Ensure all error output goes to stderr
Apply Gentoo patch firehol-1.273-CVE-2008-4953

File: firehol-1.273-CVE-2008-4953.patch (CVS rev 1.1)
Purpose: Cleanup temporary directory handling and fix (very slim)
         opportunity for symlink attack
Stop warnings when -- is passed after start

Parameters after -- are passed to the config script, so there is no need
to warn about extra parameters after some commands (e.g. start).
Remove ecn_shame helper

 - The list that was used (http://urchin.earth.li/cgi-bin/ecn.pl?output=ip)
   is no longer available
Clean up service definitions

Descriptions are maintained separately
Rename webcache to httpalt

 - http_alt is preferred name for port 8080, since many things use it
 - Added alias webcache for httpalt
 - Added alias tomcat for httpalt
Replace use of netstat with ss

Originally submitted for firehol by Jiri Popelka:
  http://sourceforge.net/support/tracker.php?aid=3523571

Notes:
  - ss will list some IPv4 addresses in the form ::ffff:192.168.122.1
    which the original patch does not allow for, fixed here
  - ip has long been used in firehol, it made good sense to use this in
    the config file too, rather than ifconfig. This file has been removed
    from distribution, however, so no change needed.

Bug reports:
  https://bugzilla.redhat.com/show_bug.cgi?id=784520
Improve worst-case error handling

 - When the generated script fails but we don't know why
   we now leave the temporary files behind
 - Ensure execution happens in current shell context so we don't
   lose variables defined as part of the configuration
Do not try to add DROP rules to NAT chains

 - It is no longer possible (and was never really needed).

 - Patch derived from the one attached here by Andrew Schulman:
     http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=536675
Fix selection of FIREHOL_CONFIG_DIR

 - Submitted by Jerome Benoit