From 18e3dd40e6e01b7ba935e97f1847d8ffd470342d Mon Sep 17 00:00:00 2001
From: Tom Eastep <teastep@shorewall.net>
Date: Tue, 26 Jul 2011 13:15:10 -0700
Subject: [PATCH] Add an IPv6 ipset manpage and clarify +[...]

Signed-off-by: Tom Eastep <teastep@shorewall.net>
---
 manpages/shorewall-ipsets.xml   |   6 +-
 manpages6/shorewall6-ipsets.xml | 125 ++++++++++++++++++++++++++++++++
 2 files changed, 129 insertions(+), 2 deletions(-)
 create mode 100644 manpages6/shorewall6-ipsets.xml

diff --git a/manpages/shorewall-ipsets.xml b/manpages/shorewall-ipsets.xml
index 35b5a83f2..70644b691 100644
--- a/manpages/shorewall-ipsets.xml
+++ b/manpages/shorewall-ipsets.xml
@@ -72,8 +72,10 @@
 
     <para>Beginning with Shorewall 4.4.14, multiple source or destination
     matches may be specified by enclosing the set names within +[...]. The set
-    names need not be prefixed with '+'. For information about set lists and
-    exclusion, see <ulink
+    names need not be prefixed with '+'. When such a list of sets is
+    specified, matching packets must match all of the listed sets.</para>
+
+    <para>For information about set lists and exclusion, see <ulink
     url="shorewall-exclusion.html">shorewall-exclusion</ulink> (5).</para>
   </refsect1>
 
diff --git a/manpages6/shorewall6-ipsets.xml b/manpages6/shorewall6-ipsets.xml
new file mode 100644
index 000000000..417cb604b
--- /dev/null
+++ b/manpages6/shorewall6-ipsets.xml
@@ -0,0 +1,125 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<refentry>
+  <refmeta>
+    <refentrytitle>shorewall-ipsets</refentrytitle>
+
+    <manvolnum>5</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>ipsets</refname>
+
+    <refpurpose>Specifying the name if an ipset in Shorewall6 configuration
+    files</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <cmdsynopsis>
+      <command>+<replaceable>ipsetname</replaceable></command>
+    </cmdsynopsis>
+
+    <cmdsynopsis>
+      <command>+<replaceable>ipsetname</replaceable>[<replaceable>flag</replaceable>,...]</command>
+    </cmdsynopsis>
+
+    <cmdsynopsis>
+      <command>+[ipsetname,...]</command>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para>Note: In the above syntax descriptions, the square brackets ("[]")
+    are to be taken literally rather than as meta-characters.</para>
+
+    <para>In most places where a network address may be entered, an ipset may
+    be substituted. Set names must be prefixed by the character "+", must
+    start with a letter and may be composed of alphanumeric characters, "-"
+    and "_".</para>
+
+    <para>Whether the set is matched against the packet source or destination
+    is determined by which column the set name appears (SOURCE or DEST). For
+    those set types that specify a tupple, two alternative syntaxes are
+    available:</para>
+
+    <simplelist>
+      <member>[<replaceable>number</replaceable>] - Indicates that 'src' or
+      'dst' should repleated number times. Example: myset[2].</member>
+
+      <member>[<replaceable>flag</replaceable>,...] where
+      <replaceable>flag</replaceable> is <option>src</option> or
+      <option>dst</option>. Example: myset[src,dst].</member>
+    </simplelist>
+
+    <para>In a SOURCE column, the following pairs are equivalent:</para>
+
+    <itemizedlist>
+      <listitem>
+        <para>+myset[2] and +myset[src,src]</para>
+      </listitem>
+    </itemizedlist>
+
+    <para>In a DEST column, the following paris are equivalent:</para>
+
+    <itemizedlist>
+      <listitem>
+        <para>+myset[2] and +myset[dst,dst]</para>
+      </listitem>
+    </itemizedlist>
+
+    <para>Beginning with Shorewall 4.4.14, multiple source or destination
+    matches may be specified by enclosing the set names within +[...]. The set
+    names need not be prefixed with '+'. When such a list of sets is
+    specified, matching packets must match all of the listed sets.</para>
+
+    <para>For information about set lists and exclusion, see <ulink
+    url="shorewall-exclusion.html">shorewall-exclusion</ulink> (5).</para>
+  </refsect1>
+
+  <refsect1>
+    <title>Examples</title>
+
+    <para>+myset</para>
+
+    <para>+myset[src]</para>
+
+    <para>+myset[2]</para>
+
+    <para>+[myset1,myset2[dst]]</para>
+  </refsect1>
+
+  <refsect1>
+    <title>FILES</title>
+
+    <para>/etc/shorewall6/accounting</para>
+
+    <para>/etc/shorewall6/blacklist</para>
+
+    <para>/etc/shorewall6/hosts -- <emphasis role="bold">Note:</emphasis>
+    Multiple matches enclosed in +[...] may not be used in this file.</para>
+
+    <para>/etc/shorewall6/maclist -- <emphasis role="bold">Note:</emphasis>
+    Multiple matches enclosed in +[...] may not be used in this file.</para>
+
+    <para>/etc/shorewall6/rules</para>
+
+    <para>/etc/shorewall6/secmarks</para>
+
+    <para>/etc/shorewall6/tcrules</para>
+  </refsect1>
+
+  <refsect1>
+    <title>See ALSO</title>
+
+    <para>shorewall6(8), shorewall6-actions(5), shorewall6-blacklist(5),
+    shorewall6-hosts(5), shorewall6-interfaces(5), shorewall6-maclist(5),
+    shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5),
+    shorewall6-route_rules(5), shorewall6-routestopped(5),
+    shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5),
+    shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-tcrules(5),
+    shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)</para>
+  </refsect1>
+</refentry>