mirror of
https://gitlab.com/shorewall/code.git
synced 2025-03-07 11:01:19 +01:00
Clean up the Embedded Perl section in the Actions documentation.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep
parent
e8720e9f78
commit
2b9af94c59
184
docs/Actions.xml
184
docs/Actions.xml
@ -319,6 +319,10 @@ ACCEPT - - tcp 135,139,445
|
|||||||
<option>inline</option> in the OPTIONS column of
|
<option>inline</option> in the OPTIONS column of
|
||||||
<filename>/etc/shorewall/actions</filename>.</para>
|
<filename>/etc/shorewall/actions</filename>.</para>
|
||||||
|
|
||||||
|
<para>Beginning in Shorewall 4.5.11, the <option>nolog</option> option
|
||||||
|
may be specified; see the <link linkend="Logging">logging
|
||||||
|
section</link> below for details.</para>
|
||||||
|
|
||||||
<para>Shorewall includes pre-defined actions for DROP and REJECT --
|
<para>Shorewall includes pre-defined actions for DROP and REJECT --
|
||||||
see above.</para>
|
see above.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
@ -595,7 +599,9 @@ LogAndAccept loc $FW tcp 22</programlisting>
|
|||||||
|
|
||||||
<para>Specifying a log level in a rule that specifies a user-defined or
|
<para>Specifying a log level in a rule that specifies a user-defined or
|
||||||
Shorewall-defined action will cause each rule in the action to be logged
|
Shorewall-defined action will cause each rule in the action to be logged
|
||||||
with the specified level (and tag).</para>
|
with the specified level (and tag), unless the <option>nolog</option>
|
||||||
|
option is specified in the action's entry in
|
||||||
|
<filename>/etc/shorewall/actions</filename>.</para>
|
||||||
|
|
||||||
<para>The extent to which logging of action rules occur is governed by the
|
<para>The extent to which logging of action rules occur is governed by the
|
||||||
following:</para>
|
following:</para>
|
||||||
@ -656,21 +662,32 @@ bar:debug</programlisting>
|
|||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section>
|
<section>
|
||||||
<title>Using BEGIN PERL .... END PERL in an Action</title>
|
<title>Using Embedded Perl in an Action</title>
|
||||||
|
|
||||||
|
<para>There may be cases where you wish to create a chain with rules that
|
||||||
|
can't be constructed using the tools defined in the
|
||||||
|
<filename>action.template</filename>. Such rules can be constructed using
|
||||||
|
<ulink url="configuration_file_basics.htm#Embedded">Embedded Perl.</ulink>
|
||||||
|
For those who are comfortable using Perl, embedded Perl is more efficient
|
||||||
|
that using complicated conditional entries. The Perl compiler is invoked
|
||||||
|
only once for a BEGIN PERL...END PERL block; it is invoked most times that
|
||||||
|
an expression is evaluated in an ?IF, ?ELSEIF or ?SET directive.</para>
|
||||||
|
|
||||||
<para>The Shorewall compiler provides a set of services that are available
|
<para>The Shorewall compiler provides a set of services that are available
|
||||||
to Perl code embedded in an action file.</para>
|
to Perl code embedded in an action file. These services are not available
|
||||||
|
in in-line actions.</para>
|
||||||
|
|
||||||
<variablelist>
|
<variablelist>
|
||||||
<varlistentry>
|
<varlistentry>
|
||||||
<term>Shorewall::Config::get_action_params( $ )</term>
|
<term>Shorewall::Config::get_action_params(
|
||||||
|
<replaceable>$howmany</replaceable> )</term>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>This function returns an array containing the functions
|
<para>This function returns an array containing the functions
|
||||||
parameters. The scalar argument is the number of parameters that you
|
parameters. The scalar argument <replaceable>$howmany</replaceable>
|
||||||
expect to be passed. You can ensure that at least this many
|
is the number of parameters that you expect to be passed. You can
|
||||||
parameters are passed by including a DEFAULTS line prior to the
|
ensure that at least this many parameters are passed by including a
|
||||||
embedded Perl.</para>
|
DEFAULTS line prior to the embedded Perl.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
</varlistentry>
|
</varlistentry>
|
||||||
|
|
||||||
@ -691,14 +708,161 @@ bar:debug</programlisting>
|
|||||||
log tag specified when the action was invoked. Note that you must
|
log tag specified when the action was invoked. Note that you must
|
||||||
use this function rather than @loglevel and @logtag within embedded
|
use this function rather than @loglevel and @logtag within embedded
|
||||||
Perl, as the compiler does not expand <ulink
|
Perl, as the compiler does not expand <ulink
|
||||||
url="configuration_file_basics.html#ShorewallVariables">Shorewall
|
url="configuration_file_basics.htm#ShorewallVariables">Shorewall
|
||||||
Variables</ulink> within embedded Perl (or embedded shell).</para>
|
Variables</ulink> within embedded Perl (or embedded shell).</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
</varlistentry>
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>Shorewall::Chains::add_rule(
|
||||||
|
<replaceable>$chainre</replaceable>f, <replaceable>$rule</replaceable>
|
||||||
|
[, <replaceable>$expandports</replaceable> ] )</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>This function adds a rule to a chain. Arguments are:</para>
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>$chainref</replaceable></term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Normally, you get this from get_action_chain() described
|
||||||
|
above.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>$rule</replaceable></term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>The matches and target for the rule that you want
|
||||||
|
added.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>$expandports</replaceable> (optional)</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>This optional argument is for compiler-internal use
|
||||||
|
only. Either omit it or pass a false value.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
</variablelist>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>Shorewall::Chains::log_rule_limit(
|
||||||
|
<replaceable>$level</replaceable>,
|
||||||
|
$<replaceable>chainref</replaceable>,
|
||||||
|
<replaceable>$chain</replaceable>,
|
||||||
|
<replaceable>$disposition</replaceable>,
|
||||||
|
<replaceable>$limit</replaceable>, <replaceable>$tag</replaceable>,
|
||||||
|
<replaceable>$command</replaceable>,
|
||||||
|
<replaceable>$matches</replaceable> )</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>This function adds a logging rule to a chain. Arguments
|
||||||
|
are:</para>
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>$level</replaceable></term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Either a syslog level or a ULOG or NFLOG target
|
||||||
|
expression (e.g., "NFLOG(1,0,1)"). Specifies how you want the
|
||||||
|
logging done.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>$chainref</replaceable></term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Normally, you get this from get_action_chain() described
|
||||||
|
above.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>$chain</replaceable></term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>The value you want substituted for the first %s
|
||||||
|
formatting directive in the LOGFORMAT setting in
|
||||||
|
<filename>/etc/shorewall/shorewall.conf</filename>.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>$disposition</replaceable></term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>This is the value substituted for the second '%s'
|
||||||
|
formatting directive in the LOGFORMAT setting in
|
||||||
|
<filename>/etc/shorewall/shorewall.conf</filename>.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>$limit</replaceable></term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>If you want to use the default limit set in LOGLIMIT
|
||||||
|
(<filename>/etc/shorewall/shorewall.conf</filename>), you can
|
||||||
|
specify your own '-limit' match. Otherwise, if you want to use
|
||||||
|
the default, pass 0 or "". If you want the rule to be
|
||||||
|
unlimited, pass '-'.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>$tag</replaceable></term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Log tag.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><replaceable>$command</replaceable></term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Pass 'add' here, unless you want the rule to be inserted
|
||||||
|
at the front of the chain.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><firstterm>$matches</firstterm></term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Zero or more iptables matches that limit when logging
|
||||||
|
will occur. If this parameter is other than the empty string,
|
||||||
|
the last character must be a space.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
</variablelist>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>Shorewall::Chains::allow::optimize(
|
||||||
|
<replaceable>chainref</replaceable> )</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>This allows the passed action chain to be optimized away
|
||||||
|
(jumps to the chain are replaced by the chain's rule(s)). The
|
||||||
|
<replaceable>chainref</replaceable> argument is usually obtained
|
||||||
|
from get_action_chain() described above.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
</variablelist>
|
</variablelist>
|
||||||
|
|
||||||
<para>For an example of using these services, look at the standard action
|
<para>For an example of using these services, look at the standard action
|
||||||
<filename>/usr/share/shorewall/action.dropBroadcast</filename>.</para>
|
<filename>/usr/share/shorewall/action.Broadcast</filename>.</para>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section id="Extension">
|
<section id="Extension">
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user