diff --git a/docs/Actions.xml b/docs/Actions.xml index 6fce15efd..c79639d91 100644 --- a/docs/Actions.xml +++ b/docs/Actions.xml @@ -319,6 +319,10 @@ ACCEPT - - tcp 135,139,445 in the OPTIONS column of /etc/shorewall/actions. + Beginning in Shorewall 4.5.11, the option + may be specified; see the logging + section below for details. + Shorewall includes pre-defined actions for DROP and REJECT -- see above. @@ -595,7 +599,9 @@ LogAndAccept loc $FW tcp 22 Specifying a log level in a rule that specifies a user-defined or Shorewall-defined action will cause each rule in the action to be logged - with the specified level (and tag). + with the specified level (and tag), unless the + option is specified in the action's entry in + /etc/shorewall/actions. The extent to which logging of action rules occur is governed by the following: @@ -656,21 +662,32 @@ bar:debug
- Using BEGIN PERL .... END PERL in an Action + Using Embedded Perl in an Action + + There may be cases where you wish to create a chain with rules that + can't be constructed using the tools defined in the + action.template. Such rules can be constructed using + Embedded Perl. + For those who are comfortable using Perl, embedded Perl is more efficient + that using complicated conditional entries. The Perl compiler is invoked + only once for a BEGIN PERL...END PERL block; it is invoked most times that + an expression is evaluated in an ?IF, ?ELSEIF or ?SET directive. The Shorewall compiler provides a set of services that are available - to Perl code embedded in an action file. + to Perl code embedded in an action file. These services are not available + in in-line actions. - Shorewall::Config::get_action_params( $ ) + Shorewall::Config::get_action_params( + $howmany ) This function returns an array containing the functions - parameters. The scalar argument is the number of parameters that you - expect to be passed. You can ensure that at least this many - parameters are passed by including a DEFAULTS line prior to the - embedded Perl. + parameters. The scalar argument $howmany + is the number of parameters that you expect to be passed. You can + ensure that at least this many parameters are passed by including a + DEFAULTS line prior to the embedded Perl. @@ -691,14 +708,161 @@ bar:debug log tag specified when the action was invoked. Note that you must use this function rather than @loglevel and @logtag within embedded Perl, as the compiler does not expand Shorewall + url="configuration_file_basics.htm#ShorewallVariables">Shorewall Variables within embedded Perl (or embedded shell). + + + Shorewall::Chains::add_rule( + $chainref, $rule + [, $expandports ] ) + + + This function adds a rule to a chain. Arguments are: + + + + $chainref + + + Normally, you get this from get_action_chain() described + above. + + + + + $rule + + + The matches and target for the rule that you want + added. + + + + + $expandports (optional) + + + This optional argument is for compiler-internal use + only. Either omit it or pass a false value. + + + + + + + + Shorewall::Chains::log_rule_limit( + $level, + $chainref, + $chain, + $disposition, + $limit, $tag, + $command, + $matches ) + + + This function adds a logging rule to a chain. Arguments + are: + + + + $level + + + Either a syslog level or a ULOG or NFLOG target + expression (e.g., "NFLOG(1,0,1)"). Specifies how you want the + logging done. + + + + + $chainref + + + Normally, you get this from get_action_chain() described + above. + + + + + $chain + + + The value you want substituted for the first %s + formatting directive in the LOGFORMAT setting in + /etc/shorewall/shorewall.conf. + + + + + $disposition + + + This is the value substituted for the second '%s' + formatting directive in the LOGFORMAT setting in + /etc/shorewall/shorewall.conf. + + + + + $limit + + + If you want to use the default limit set in LOGLIMIT + (/etc/shorewall/shorewall.conf), you can + specify your own '-limit' match. Otherwise, if you want to use + the default, pass 0 or "". If you want the rule to be + unlimited, pass '-'. + + + + + $tag + + + Log tag. + + + + + $command + + + Pass 'add' here, unless you want the rule to be inserted + at the front of the chain. + + + + + $matches + + + Zero or more iptables matches that limit when logging + will occur. If this parameter is other than the empty string, + the last character must be a space. + + + + + + + + Shorewall::Chains::allow::optimize( + chainref ) + + + This allows the passed action chain to be optimized away + (jumps to the chain are replaced by the chain's rule(s)). The + chainref argument is usually obtained + from get_action_chain() described above. + + For an example of using these services, look at the standard action - /usr/share/shorewall/action.dropBroadcast. + /usr/share/shorewall/action.Broadcast.