mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-23 22:58:52 +01:00
Fix release documents re IPMARK; correct encode/decode
This commit is contained in:
parent
2db6130c26
commit
5b6769a722
@ -15,6 +15,8 @@ Changes in Shorewall 4.3.10
|
||||
|
||||
7) Fix compile for export.
|
||||
|
||||
8) Optimize IPMARK.
|
||||
|
||||
Changes in Shorewall 4.3.9
|
||||
|
||||
1) Logging rules now create separate chain.
|
||||
|
@ -127,7 +127,21 @@ None.
|
||||
column) must be >= 65536 (0x10000) and must be a multiple of 65536
|
||||
(0x1000, 0x20000, 0x30000, ...).
|
||||
|
||||
2) In the 'shorewall compile' command, the filename '-' is now causes
|
||||
/sbin/shorewall supports an 'encode' and a 'decode' command for
|
||||
mapping back and forth using the new method:
|
||||
|
||||
Example:
|
||||
|
||||
$ shorewall encode 100 #Maps a MARK value to a class number
|
||||
Class Number = 4064
|
||||
$ shorewall decode 4064 #Maks a class number (hex) to a MARK value
|
||||
Mark = 100
|
||||
$
|
||||
|
||||
2) The implementation of IPMARK has changed. Please see item 16) in
|
||||
the 'New Features in 4.3' section below.
|
||||
|
||||
3) In the 'shorewall compile' command, the filename '-' is now causes
|
||||
the compiled script to be written to Standard Out. As a side
|
||||
effect, the effective VERBOSITY is set to -1 (silent).
|
||||
|
||||
@ -144,7 +158,7 @@ None.
|
||||
issued by /sbin/shorewall (/sbin/shorewall6) when a compilation
|
||||
begins.
|
||||
|
||||
3) Supplying an interface name in the SOURCE column of
|
||||
4) Supplying an interface name in the SOURCE column of
|
||||
/etc/shorewall/masq is now deprecated. Entering the name of an
|
||||
interface there will result in a compile-time warning.
|
||||
|
||||
@ -486,6 +500,18 @@ None.
|
||||
a) A new IPMARK MARKing command in /etc/shorewall/tcrules.
|
||||
b) A new 'occurs' OPTION in /etc/shorewall/tcclasses.
|
||||
|
||||
The facility is currently only available with IPv4.
|
||||
|
||||
In a sense, the IPMARK target is more like an IPCLASSIFY target in
|
||||
that the mark value is later interpreted as a class ID. A packet
|
||||
mark is 32 bits wide; so is a class ID. The <major> class occupies
|
||||
the high-order 16 bits and the <minor> class occupies the low-order
|
||||
16 bits. So the class ID 1:4ff (remember that class IDs are always
|
||||
in hex) is equivalent to a mark value of 0x104ff. Remember that
|
||||
Shorewall uses the interface number as the <major> number where the
|
||||
first interface in tcdevices has <major> number 1, the second has
|
||||
<major> number 2, and so on.
|
||||
|
||||
The IPMARK target assigns a mark to each matching packet based on
|
||||
the either the source or destination IP address. By default, it
|
||||
assigns a mark value equal to the low-order 8 bits of the source
|
||||
@ -505,10 +531,9 @@ None.
|
||||
'src' and 'dst' specify whether the mark is to be based on the
|
||||
source or destination address respectively.
|
||||
|
||||
The selected address is first LANDed with <mask1> then LORed with
|
||||
<mask2>.
|
||||
|
||||
The result is then shifted <shift> bits to the right.
|
||||
The selected address is first shifted right by <shift>, then
|
||||
LANDed with <mask1> and then LORed with <mask2>. The <shift>
|
||||
argument is intended to be used primarily with IPv6 addresses.
|
||||
|
||||
Example:
|
||||
|
||||
@ -522,8 +547,23 @@ None.
|
||||
|
||||
Mark = 0x84 = 132
|
||||
|
||||
The 'occurs' option causes the class definition to be replicated
|
||||
many times. The synax is:
|
||||
It is important to realize that, while class IDs are composed of a
|
||||
<major> and a <minor> value, the set of values must be unique. That
|
||||
is, the same numeric value cannot be used as both a <major> and a
|
||||
<minor> number for the same interface unless class nesting occurs
|
||||
(which is not currently possible with Shorewall). You should keep
|
||||
this in mind when deciding how to map IP addresses to class IDs.
|
||||
|
||||
For example, suppose that your internal network is 192.168.1.0/29
|
||||
(host IP addresses 192.168.1.1 - 192.168.1.6). Your first notion
|
||||
might be to use IPMARK(src,0xFF,0x10000) so as to produce class IDs
|
||||
1:1 through 1:6. But 1:1 is an invalid class ID since the <major>
|
||||
and <minor> classes are equal. So you might chose instent to use
|
||||
IPMARK(src,0xFF,0x10100) so that all of your <minor> classes will
|
||||
have a value > 256.
|
||||
|
||||
The 'occurs' option in /etc/shorewall/tcclasses causes the class
|
||||
definition to be replicated many times. The synax is:
|
||||
|
||||
occurs=<number>
|
||||
|
||||
@ -533,6 +573,8 @@ None.
|
||||
b) The class may not be the default class.
|
||||
c) The class may not have any 'tos=' options (including
|
||||
'tcp-ack').
|
||||
d) The class should not specify a MARK value. Any MARK value
|
||||
given is ignored with a warning.
|
||||
|
||||
The 'RATE' and 'CEIL' parameters apply to each instance of the
|
||||
class. So the total RATE represented by an entry with 'occurs' will
|
||||
@ -540,28 +582,23 @@ None.
|
||||
|
||||
Example:
|
||||
|
||||
/etc/shorewall/tcdevices:
|
||||
|
||||
#INTERFACE IN-BANDWIDTH OUT-BANDWIDTH
|
||||
eth0 100mbit 100mbit
|
||||
|
||||
/etc/shorewall/tcclasses:
|
||||
|
||||
#DEVICE MARK RATE CEIL PRIORITY OPTIONS
|
||||
eth0 100 1kbit 230kbit 4 occurs=32
|
||||
eth0:101 - 1kbit 230kbit 4 occurs=6
|
||||
|
||||
The above defines 32 classes with MARK values 100-131. Each
|
||||
class has a guaranteed rate of 1kbit/second.
|
||||
The above defines 6 classes with class IDs 0x101-0x106. Each
|
||||
class has a guaranteed rate of 1kbit/second and a ceiling of
|
||||
230kbit.
|
||||
|
||||
As part of this change, the generation of class ids from mark
|
||||
values has been changed. The class number is now
|
||||
/etc/shoreall/tcrules:
|
||||
|
||||
( <devnum> << 10 ) | <mask>
|
||||
#MARK SOURCE DEST
|
||||
IPMARK(src,0xff,0x10100):F 192.168.1.0/29 eth0
|
||||
|
||||
/sbin/shorewall has an 'encode' and 'decode' command to translate a
|
||||
device number, mark pair to/from a classid:
|
||||
|
||||
encode <devnum> <mark>
|
||||
decode <classnum>
|
||||
|
||||
Example:
|
||||
|
||||
$ shorewall decode 3172
|
||||
Device = 3 Mark = 100
|
||||
$ shorewall encode 3 100
|
||||
Class number = 3172
|
||||
$
|
||||
|
||||
|
@ -1996,11 +1996,11 @@ case "$COMMAND" in
|
||||
;;
|
||||
decode)
|
||||
[ $# -eq 2 ] || usage 1
|
||||
echo "Mark = $((0x$2 & 0x3fff))"
|
||||
echo "Mark =" $((0x$2 & 0x3fff))
|
||||
;;
|
||||
encode)
|
||||
[ $# -eq 2 ] || usage 1
|
||||
echo "Class Number = 4$(printf '0%x', $2)"
|
||||
echo "Class Number = 4$(printf '0%x' $2)"
|
||||
;;
|
||||
call)
|
||||
get_config
|
||||
|
Loading…
Reference in New Issue
Block a user