Fix merge conflicts

Shorewall/Perl/Shorewall/Chains.pm

@@ -167,7 +167,7 @@ our %EXPORT_TAGS = (
 
 Exporter::export_ok_tags('internal');
 
-our $VERSION = '4.4_4';
+our $VERSION = '4.4_5';
 
 #
 # Chain Table
@@ -1148,7 +1148,17 @@ sub finish_chain_section ($$) {
 
     $comment = '';
 
-    add_rule $chainref, "-m state --state $state -j ACCEPT" unless $config{FASTACCEPT};
+    unless ( $config{FASTACCEPT} ) {
+	if ( $chainref->{marked} ) {
+	    if ( $chainref->{marked} == @{$chainref->{rules}} ) {
+		insert_rule( $chainref, 0, "-m state --state $state -j ACCEPT" );
+	    } else {
+		add_rule $chainref, "-m state --state $state -j ACCEPT";
+	    }
+	} else {
+	    add_rule $chainref, "-m state --state $state -j ACCEPT";
+	}
+    }
 
     if ($sections{NEW} ) {
 	if ( $chainref->{is_policy} ) {
@@ -1187,6 +1197,7 @@ sub finish_section ( $ ) {
     for my $zone ( all_zones ) {
 	for my $zone1 ( all_zones ) {
 	    my $chainref = $chain_table{'filter'}{rules_chain( $zone, $zone1 )};
+
 	    finish_chain_section $chainref, $sections if $chainref->{referenced};
 	}
     }

Shorewall/Perl/Shorewall/Config.pm

@@ -127,7 +127,7 @@ our %EXPORT_TAGS = ( internal => [ qw( create_temp_script
 
 Exporter::export_ok_tags('internal');
 
-our $VERSION = '4.4_4';
+our $VERSION = '4.4_5';
 
 #
 # describe the current command, it's present progressive, and it's completion.
@@ -242,6 +242,7 @@ our %capdesc = ( NAT_ENABLED     => 'NAT',
 		 IPMARK_TARGET   => 'IPMARK Target',
 		 PERSISTENT_SNAT => 'Persistent SNAT',
 		 OLD_HL_MATCH    => 'Old Hash Limit Match',
+		 MARK_IN_FILTER  => 'MARK in Filter Table',
 		 CAPVERSION      => 'Capability Version',
 	       );
 #
@@ -619,6 +620,7 @@ sub initialize( $ ) {
 	       LOG_TARGET => 1,         # Assume that we have it.
 	       PERSISTENT_SNAT => undef,
 	       OLD_HL_MATCH => undef,
+	       MARK_IN_FILTER => undef,
 	       CAPVERSION => undef,
 	       );
     #
@@ -2031,6 +2033,7 @@ sub determine_capabilities( $ ) {
     $capabilities{LENGTH_MATCH}    = qt1( "$iptables -A $sillyname -m length --length 10:20 -j ACCEPT" );
     $capabilities{ENHANCED_REJECT} = qt1( "$iptables -A $sillyname -j REJECT --reject-with icmp6-admt-prohibited" );
     $capabilities{COMMENTS}        = qt1( qq($iptables -A $sillyname -j ACCEPT -m comment --comment "This is a comment" ) );
+    $capabilities{MARK_IN_FILTER}  = qt1( "$iptables -A $sillyname -j MARK --set-mark 1" );
 
     $capabilities{HASHLIMIT_MATCH} = qt1( "$iptables -A $sillyname -m hashlimit --hashlimit-upto 3/min --hashlimit-burst 3 --hashlimit-name $sillyname --hashlimit-mode srcip -j ACCEPT" );
 

Shorewall/Perl/Shorewall/Policy.pm

@@ -129,8 +129,17 @@ sub add_or_modify_policy_chain( $$ ) {
 	    push @policy_chains, $chainref;
 	}
     } else {
-	push @policy_chains, ( new_policy_chain $zone, $zone1, 'CONTINUE', OPTIONAL );
+	push @policy_chains, ( $chainref = new_policy_chain $zone, $zone1, 'CONTINUE', OPTIONAL );
     }
+
+    unless ( $chainref->{marked} ) {
+	my $mark  = defined_zone( $zone )->{mark};
+	my $mark1 = defined_zone( $zone1 )->{mark} << VIRTUAL_BITS;
+
+	$chainref->{marked} = 1, add_rule $chainref, '-j MARK --or-mark ' . in_hex($mark)  if $mark && $zone1 eq firewall_zone;
+	$chainref->{marked}++  , add_rule $chainref, '-j MARK --or-mark ' . in_hex($mark1) if $mark1;
+    }
+    
 }
 
 sub print_policy($$$$) {
@@ -348,8 +357,16 @@ sub validate_policy()
 		    add_or_modify_policy_chain( $zone1, $zone );
 		}
 	    }
-	}
+ 	} elsif ( zone_type( $zone ) == VIRTUAL ) {
-    }
+	    for my $zone1 ( @{defined_zone( $zone )->{children}} ) {
+		for my $zone2 ( all_zones ) {
+		    unless ( $zone1 eq $zone2 ) {
+			add_or_modify_policy_chain( $zone1, $zone2 );
+			add_or_modify_policy_chain( $zone2, $zone1 );
+		    }
+		}
+	    }
+	}   }
 
     my $fn = open_file 'policy';
 

Shorewall/Perl/Shorewall/Providers.pm

@@ -311,6 +311,7 @@ sub add_a_provider( ) {
 	    }
 	} else {
 	    fatal_error "Invalid Mark Value ($mark)" unless $config{HIGH_ROUTE_MARKS} && $config{WIDE_TC_MARKS};
+	    fatal_error "Invalid Mark Value ($mark)" if $val > 0xf0000;
 	}
 
 	for my $providerref ( values %providers  ) {

Shorewall/Perl/Shorewall/Rules.pm

@@ -1692,12 +1692,14 @@ sub generate_matrix() {
     for my $zone ( @zones ) {
 	my $zoneref = find_zone( $zone );
 
-	next if @zones <= 2 && ! $zoneref->{options}{complex};
+	next if @zones <= 2 && ! ( $zoneref->{options}{complex} || $zoneref->{virtual} || $zoneref->{mark} );
 	#
 	# Complex zone and we have more than one non-firewall zone -- create a zone forwarding chain
 	#
 	my $frwd_ref = new_standard_chain zone_forward_chain( $zone );
 
+	add_rule $frwd_ref, '-j MARK --set-mark ' . in_hex( $zoneref->{mark} ) if $zoneref->{mark};
+
 	if ( $capabilities{POLICY_MATCH} ) {
 	    #
 	    # Because policy match only matches an 'in' or an 'out' policy (but not both), we have to place the
@@ -1724,10 +1726,11 @@ sub generate_matrix() {
 
 		for my $hostref ( @{$arrayref} ) {
 		    my $ipsec_match = match_ipsec_in $zone , $hostref;
+		    my $exclusion   = source_exclusion( $hostref->{exclusions}, $frwd_ref );
 		    for my $net ( @{$hostref->{hosts}} ) {
 			add_jump(
 				 $sourcechainref,
-				 source_exclusion( $hostref->{exclusions}, $frwd_ref ),
+				 $exclusion,
 				 ! @{$zoneref->{parents}},
 				 join( '', $interfacematch , match_source_net( $net ), $ipsec_match )
 				);
@@ -1759,6 +1762,7 @@ sub generate_matrix() {
 	my $nested           = $zoneref->{options}{nested};
 	my $parenthasnat     = 0;
 	my $parenthasnotrack = 0;
+	my $virtual          = $zoneref->{virtual};
 
 	if ( $nested ) {
 	    #
@@ -1799,6 +1803,11 @@ sub generate_matrix() {
 	#
 	# Take care of PREROUTING, INPUT and OUTPUT jumps
 	#
+	if ( $virtual ) {
+	    add_jump $filter_table->{OUTPUT}, $chain1, 0, "-m mark ! --mark 0/" . in_hex($virtual << VIRTUAL_BITS) . ' ' if $chain1; 
+	    add_jump $filter_table->{INPUT}, $chain2, 0, "-m mark ! --mark 0/" . in_hex($virtual) . ' '                  if $chain2; 
+	}
+
 	for my $typeref ( values %$source_hosts_ref ) {
 	    for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$typeref ) {
 		my $arrayref = $typeref->{$interface};
@@ -1953,6 +1962,11 @@ sub generate_matrix() {
 	} else {
 	    @dest_zones =  @zones ;
 	}
+
+	if ( $frwd_ref ) {
+	    add_jump $filter_table->{FORWARD}, $frwd_ref, 0, "-m mark ! --mark 0/" . in_hex($virtual) . ' ' if $virtual;
+	}
+
 	#
 	# Here it is -- THE BIG UGLY!!!!!!!!!!!!
 	#
@@ -1961,6 +1975,7 @@ sub generate_matrix() {
 	#
 	for my $zone1 ( @dest_zones ) {
 	    my $zone1ref = find_zone( $zone1 );
+	    my $virtual1 = $zone1ref->{virtual} << VIRTUAL_BITS;
 
 	    next if $filter_table->{rules_chain( ${zone}, ${zone1} )}->{policy}  eq 'NONE';
 
@@ -1990,13 +2005,16 @@ sub generate_matrix() {
 			    next if $hostref->{options}{sourceonly};
 			    if ( $zone ne $zone1 || $num_ifaces > 1 || $hostref->{options}{routeback} ) {
 				my $ipsec_out_match = match_ipsec_out $zone1 , $hostref;
+				my $exclusion = dest_exclusion( $hostref->{exclusions}, $chain);
 				for my $net ( @{$hostref->{hosts}} ) {
-				    add_jump $frwd_ref, dest_exclusion( $hostref->{exclusions}, $chain), 0, join( '', match_dest_dev( $interface) , match_dest_net($net), $ipsec_out_match );
+				    add_jump( $frwd_ref, $exclusion, 0, join( '', match_dest_dev( $interface) , match_dest_net($net), $ipsec_out_match ) );
 				}
 			    }
 			}
 		    }
 		}
+			
+		add_jump( $frwd_ref, $chain, 0, '-m mark ! --mark 0/' . in_hex( $virtual1 ) . ' ' ) if $virtual1;
 	    } else {
 		#
 		# More compilcated case. If the interface is associated with a single simple zone, we try to combine the interface's forwarding chain with the rules chain
@@ -2032,6 +2050,7 @@ sub generate_matrix() {
 					for my $host1ref ( @$array1ref ) {
 					    next if $host1ref->{options}{sourceonly};
 					    my $ipsec_out_match = match_ipsec_out $zone1 , $host1ref;
+					    my $exclusion = dest_exclusion( $host1ref->{exclusions}, $chain );
 					    for my $net1 ( @{$host1ref->{hosts}} ) {
 						unless ( $interface eq $interface1 && $net eq $net1 && ! $host1ref->{options}{routeback} ) {
 						    #
@@ -2039,7 +2058,7 @@ sub generate_matrix() {
 						    #
 						    add_jump(
 							     $excl3ref ,
-							     dest_exclusion( $host1ref->{exclusions}, $chain ),
+							     $exclusion,
 							     0,
 							     join( '',
 								   $match_source_dev,
@@ -2047,9 +2066,18 @@ sub generate_matrix() {
 								   match_source_net($net),
 								   match_dest_net($net1),
 								   $ipsec_out_match )
-							    );
+							    );	     
 						}
 					    }
+
+					    add_rule ( $excl3ref, 
+						       $chain,
+						       join( '',
+							     $match_source_dev,
+							     match_source_net($net),
+							     '-m mark ! --mark 0/',
+							     in_hex( $virtual1 ),
+							     ' ' ) ) if $virtual1;
 					}
 				    }
 				}

Shorewall/Perl/Shorewall/Tc.pm

@@ -40,7 +40,7 @@ use strict;
 our @ISA = qw(Exporter);
 our @EXPORT = qw( setup_tc );
 our @EXPORT_OK = qw( process_tc_rule initialize );
-our $VERSION = '4.4_4';
+our $VERSION = '4.4_5';
 
 our %tcs = ( T => { chain  => 'tcpost',
 		    connmark => 0,
@@ -1235,6 +1235,7 @@ sub setup_tc() {
 
 	if ( $capabilities{MANGLE_FORWARD} ) {
 	    add_rule $mangle_table->{FORWARD} ,     '-j tcfor';
+	    add_rule $mangle_table->{POSTROUTING},  '-j MARK --and-mark 0xffffff'; # Clear virtual marks
 	    add_rule $mangle_table->{POSTROUTING} , '-j tcpost';
 	}
 
@@ -1246,7 +1247,7 @@ sub setup_tc() {
 	    # In POSTROUTING, we only want to clear routing mark and not IPMARK.
 	    #
 	    insert_rule1 $mangle_table->{POSTROUTING}, 0, $config{WIDE_TC_MARKS} ? '-m mark --mark 0/0xFFFF -j MARK --and-mark 0' : '-m mark --mark 0/0xFF -j MARK --and-mark 0';
-	}
+	}	
     }
 
     if ( $globals{TC_SCRIPT} ) {

Shorewall/Perl/Shorewall/Zones.pm

@@ -40,6 +40,8 @@ our @EXPORT = qw( NOTHING
 		  IP
 		  BPORT
 		  IPSEC
+		  VIRTUAL
+		  VIRTUAL_BITS
 
 		  determine_zones
 		  zone_report
@@ -75,7 +77,7 @@ our @EXPORT = qw( NOTHING
 		 );
 
 our @EXPORT_OK = qw( initialize );
-our $VERSION = '4.4_4';
+our $VERSION = '4.4_5';
 
 #
 # IPSEC Option types
@@ -104,6 +106,8 @@ use constant { NOTHING    => 'NOTHING',
 #                        children =>   [ <children> ]
 #                        interfaces => { <interfaces1> => 1, ... }
 #                        bridge =>     <bridge>
+#                        virtual =>    <virtual zone mark>
+#                        mark =>       <LORed virtual zone marks of parent virtual zones>
 #                        hosts { <type> } => [ { <interface1> => { ipsec   => 'ipsec'|'none'
 #                                                                  options => { <option1> => <value1>
 #                                                                               ...
@@ -156,11 +160,13 @@ our @bport_zones;
 our %ipsets;
 our %physical;
 our $family;
+our $virtualmark;
 
 use constant { FIREWALL => 1,
 	       IP       => 2,
 	       BPORT    => 3,
-	       IPSEC    => 4 };
+	       IPSEC    => 4,
+	       VIRTUAL  => 5 };
 
 use constant { SIMPLE_IF_OPTION   => 1,
 	       BINARY_IF_OPTION   => 2,
@@ -176,6 +182,11 @@ use constant { SIMPLE_IF_OPTION   => 1,
 	       IF_OPTION_HOST     => 16,
 	   };
 
+use constant { VIRTUAL_BASE       => 0x1000000 ,
+	       VIRTUAL_MASK       => 0xf000000 ,
+	       VIRTUAL_BITS       => 4            #Bits for virtual MASK numbers
+	   };
+
 our %validinterfaceoptions;
 
 our %validhostoptions;
@@ -201,6 +212,7 @@ sub initialize( $ ) {
     @bport_zones = ();
     %ipsets = ();
     %physical = ();
+    $virtualmark = VIRTUAL_BASE;
 
     if ( $family == F_IPV4 ) {
 	%validinterfaceoptions = (arp_filter  => BINARY_IF_OPTION,
@@ -353,6 +365,9 @@ sub process_zone( \$ ) {
 
     my ($zone, $type, $options, $in_options, $out_options ) = split_line 1, 5, 'zones file';
 
+    my $mark = 0;
+    my $virtual = 0;
+
     if ( $zone =~ /(\w+):([\w,]+)/ ) {
 	$zone = $1;
 	@parents = split_list $2, 'zone';
@@ -361,6 +376,7 @@ sub process_zone( \$ ) {
 	    fatal_error "Invalid Parent List ($2)" unless $p;
 	    fatal_error "Unknown parent zone ($p)" unless $zones{$p};
 	    fatal_error 'Subzones of firewall zone not allowed' if $zones{$p}{type} == FIREWALL;
+	    $mark |= $zones{$p}{virtual};
 	    push @{$zones{$p}{children}}, $zone;
 	}
     }
@@ -376,6 +392,12 @@ sub process_zone( \$ ) {
     } elsif ( $type =~ /^ipsec([46])?$/i ) {
 	fatal_error "Invalid zone type ($type)" if $1 && $1 != $family;
 	$type = IPSEC;
+
+	for ( @parents ) {
+	    unless ( $zones{$_}{type} == IPSEC ) {
+		set_super( $zones{$_} );
+	    }
+	}
     } elsif ( $type =~ /^bport([46])?$/i ) {
 	fatal_error "Invalid zone type ($type)" if $1 && $1 != $family;
 	warning_message "Bridge Port zones should have a parent zone" unless @parents;
@@ -387,6 +409,12 @@ sub process_zone( \$ ) {
 	$firewall_zone = $zone;
 	$ENV{FW} = $zone;
 	$type = FIREWALL;
+    } elsif ( $type eq 'virtual' ) {
+	require_capability 'MARK_IN_FILTER' , 'virtual zones', '';
+	fatal_error "Too many virtual zones" unless $virtualmark & VIRTUAL_MASK;
+	$virtual = $virtualmark;
+	$virtualmark = $virtualmark << 1;
+	$type = VIRTUAL;
     } elsif ( $type eq '-' ) {
 	$type = IP;
 	$$ip = 1;
@@ -394,14 +422,6 @@ sub process_zone( \$ ) {
 	fatal_error "Invalid zone type ($type)" ;
     }
 
-    if ( $type eq IPSEC ) {
-	for ( @parents ) {
-	    unless ( $zones{$_}{type} == IPSEC ) {
-		set_super( $zones{$_} );
-	    }
-	}
-    }
-
     for ( $options, $in_options, $out_options ) {
 	$_ = '' if $_ eq '-';
     }
@@ -409,6 +429,8 @@ sub process_zone( \$ ) {
     $zones{$zone} = { type       => $type,
 		      parents    => \@parents,
 		      bridge     => '',
+		      virtual    => $virtual,
+		      mark       => $mark ,
 		      options    => { in_out  => parse_zone_option_list( $options || '', $type ) ,
 				      in      => parse_zone_option_list( $in_options || '', $type ) ,
 				      out     => parse_zone_option_list( $out_options || '', $type ) ,
@@ -485,9 +507,9 @@ sub zone_report()
     my @translate;
 
     if ( $family == F_IPV4 ) {
-	@translate = ( undef, 'firewall', 'ipv4', 'bport4', 'ipsec4' );
+	@translate = ( undef, 'firewall', 'ipv4', 'bport4', 'ipsec4', 'virtual' );
     } else {
-	@translate = ( undef, 'firewall', 'ipv6', 'bport6', 'ipsec6' );
+	@translate = ( undef, 'firewall', 'ipv6', 'bport6', 'ipsec6', 'virtual' );
     }
 
     for my $zone ( @zones )
@@ -530,9 +552,8 @@ sub zone_report()
 
 	unless ( $printed ) {
 	    fatal_error "No bridge has been associated with zone $zone" if $type == BPORT && ! $zoneref->{bridge};
-	    warning_message "*** $zone is an EMPTY ZONE ***" unless $type == FIREWALL;
+	    warning_message "*** $zone is an EMPTY ZONE ***" unless $type == FIREWALL || ( $type == VIRTUAL && @{$zoneref->{children}} );
 	}
-
     }
 }
 
@@ -544,9 +565,9 @@ sub dump_zone_contents()
     my @xlate;
 
     if ( $family == F_IPV4 ) {
-	@xlate = ( undef, 'firewall', 'ipv4', 'bport4', 'ipsec4' );
+	@xlate = ( undef, 'firewall', 'ipv4', 'bport4', 'ipsec4', 'virtual' );
     } else {
-	@xlate = ( undef, 'firewall', 'ipv6', 'bport6', 'ipsec6' );
+	@xlate = ( undef, 'firewall', 'ipv6', 'bport6', 'ipsec6', 'virtual' );
     }
 
     for my $zone ( @zones )
@@ -587,6 +608,12 @@ sub dump_zone_contents()
 	    }
 	}
 
+	if ( $type == VIRTUAL && @{$zoneref->{children}} ) {
+	    $entry .= " (";
+	    $entry .= "$_," for @{$zoneref->{children}};
+	    $entry =~ s/,$/) /;
+	}
+
 	emit_unindented $entry;
     }
 }

Shorewall/changelog.txt

@@ -12,6 +12,8 @@ Changes in Shorewall 4.4.5
 
 6)  Fix 'show policies' in Shorewall6.
 
+7)  Implement 'virtual' zones.
+
 Changes in Shorewall 4.4.4
 
 1)  Change STARTUP_LOG and LOG_VERBOSITY in default shorewall6.conf.

Shorewall/lib.base

@@ -30,7 +30,7 @@
 #
 
 SHOREWALL_LIBVERSION=40000
-SHOREWALL_CAPVERSION=40402
+SHOREWALL_CAPVERSION=40405
 
 [ -n "${VARDIR:=/var/lib/shorewall}" ]
 [ -n "${SHAREDIR:=/usr/share/shorewall}" ]
@@ -828,6 +828,7 @@ determine_capabilities() {
     IPMARK_TARGET=
     LOG_TARGET=Yes
     PERSISTENT_SNAT=
+    MARK_IN_FILTER=
 
     chain=fooX$$
 
@@ -958,6 +959,7 @@ determine_capabilities() {
     qt $IPTABLES -A $chain -g $chain1 && GOTO_TARGET=Yes
     qt $IPTABLES -A $chain -j LOGMARK && LOGMARK_TARGET=Yes
     qt $IPTABLES -A $chain -j LOG || LOG_TARGET=
+    qt $IPTABLES -A $chain -j MARK --set-mark 1 && MARK_IN_FILTER=Yes
 
     qt $IPTABLES -F $chain
     qt $IPTABLES -X $chain
@@ -1026,6 +1028,7 @@ report_capabilities() {
 	report_capability "IPMARK Target" $IPMARK_TARGET
 	report_capability "LOG Target" $LOG_TARGET
 	report_capability "Persistent SNAT" $PERSISTENT_SNAT
+	report_capability "Mark in Filter Table" $MARK_IN_FILTER
     fi
 
     [ -n "$PKTTYPE" ] || USEPKTTYPE=
@@ -1085,6 +1088,7 @@ report_capabilities1() {
     report_capability1 IPMARK_TARGET
     report_capability1 LOG_TARGET
     report_capability1 PERSISTENT_SNAT
+    report_capability1 MARK_IN_FILTER
     
     echo CAPVERSION=$SHOREWALL_CAPVERSION
 }

Shorewall/releasenotes.txt

@@ -230,6 +230,41 @@ None.
     	     $FW             dmz             REJECT          info
     	     $FW             all             ACCEPT
 
+3)  Shorewall 4.4.5 introduces 'virtual' zones. A virtual zone is used
+    to group together a set of sub-zones. A virtual zone is declared
+    as TYPE 'virtual' in /etc/shorewall/zones.
+
+    Example:
+
+	virt		virtual
+
+    The virtual zone must have no definition in
+    /etc/shorewall/interfaces or /etc/shorewall/hosts. Virtual zones
+    can themselves be nested in other virtual zones but there is a
+    limit of four virtual zones per configuration (that limitation
+    derives from the fact that each virtual zone requires 2 bits in the
+    packet mark).
+
+    Virtual zones are used as parent zones for other zones using the
+    <zone>:<parent> syntax in /etc/shorewall/zones:
+
+    Example:
+
+	virt			virtual
+    	loc:virt		ipv4
+    	vpn:virt		ipsec    
+
+    As shown in the example, a virtual zone may be a parent for
+    multiple zone types.
+    
+    Virtual zones are intended to be used with
+    IMPLICIT_CONTINUE=No. They provide semantic behavior similar to
+    IMPLICIT_CONTINUE=Yes in that connections that do not match rules
+    for the sub-zone are applied to the parent zone. 
+
+    For more information, see
+    http://www.shorewall.net/manpages/shorewall-nesting.html
+
 ----------------------------------------------------------------------------
                 N E W   F E A T U R E S   I N   4 . 4 . 0
 ----------------------------------------------------------------------------

Shorewall6/lib.base

@@ -33,7 +33,7 @@
 #
 
 SHOREWALL_LIBVERSION=40300
-SHOREWALL_CAPVERSION=40402
+SHOREWALL_CAPVERSION=40405
 
 [ -n "${VARDIR:=/var/lib/shorewall6}" ]
 [ -n "${SHAREDIR:=/usr/share/shorewall6}" ]
@@ -737,6 +737,7 @@ determine_capabilities() {
     GOTO_TARGET=
     IPMARK_TARGET=
     LOG_TARGET=Yes
+    MARK_IN_FILTER=Yes
 
     chain=fooX$$
 
@@ -864,6 +865,7 @@ determine_capabilities() {
     qt $IP6TABLES -A $chain -m connlimit --connlimit-above 8 -j DROP && CONNLIMIT_MATCH=Yes
     qt $IP6TABLES -A $chain -m time --timestart 23:00 -j DROP && TIME_MATCH=Yes
     qt $IP6TABLES -A $chain -g $chain1 && GOTO_TARGET=Yes
+    qt $IP6TABLES -A $chain -j MARK --set-mark 1 && MARK_IN_FILTER=Yes
     qt $IP6TABLES -A $chain -j LOG || LOG_TARGET=
 
     qt $IP6TABLES -F $chain

manpages/shorewall-nesting.xml

@@ -154,14 +154,14 @@
     to change the 'net' interface to something other than ppp0. That way, it
     won't match ppp+.</para>
 
-    <para>If you are running Shorewall version 4.1.4 or later, a second way is
+    <para>A second way is to simply make the nested zones
-    to simply make the nested zones explicit:<programlisting>        #ZONE    TYPE        OPTION
+    explicit:<programlisting>        #ZONE    TYPE        OPTION
         fw       firewall
         loc      ipv4
         net:loc  ipv4
         dmz      ipv4</programlisting></para>
 
-    <para>If you take this approach, be sure to set IMPLICIT_CONTINUE=No in
+    <para>If you take this approach, be sure to set IMPLICIT_CONTINUE=Yes in
     <filename>shorewall.conf</filename>.</para>
 
     <para>When using other Shorewall versions, another way is to rewrite the
@@ -183,6 +183,56 @@
         loc      ppp+:192.168.2.0/23</programlisting></para>
   </refsect1>
 
+  <refsect1 id="Virtual">
+    <title>Virtual Zones</title>
+
+    <para>Beginning with Shorewall 4.4.5, Shorewall allows the declaration of
+    <firstterm>virtual</firstterm> zones. A virtual zone has no definition in
+    <filename>/etc/shorewall/interfaces</filename> or in
+    <filename>/etc/shorewall/hosts</filename>. Rather, it is used as a parent
+    zone for other zones in <filename>/etc/shorewall/zones</filename>.</para>
+
+    <para>Example:</para>
+
+    <para><filename>/etc/shorewall/zones</filename>:</para>
+
+    <programlisting>        #ZONE            TYPE          OPTIONS
+        fw               firewall
+        net              ipv4
+        loc              virtual       #Virtual Zone
+        loc1:loc         ipv4
+        loc2:loc         ipv4</programlisting>
+
+    <para><filename>/etc/shorewall/interfaces</filename>:</para>
+
+    <programlisting>        #ZONE   INTERFACE       BROADCAST       OPTIONS
+        net     eth0            detect          dhcp,tcpflags,nosmurfs,routefilter,logmartians
+        -       eth1            detect          tcpflags,nosmurfs,routefilter,logmartians</programlisting>
+
+    <para><filename>/etc/shorewall/hosts</filename>:</para>
+
+    <programlisting>        #ZONE   HOST(S)                         OPTIONS
+        loc1    eth1:192.168.1.0/24
+        loc2    eth1:192.168.2.0/24</programlisting>
+
+    <para>There are several restrictions on virtual zones:</para>
+
+    <itemizedlist>
+      <listitem>
+        <para>A maximum of four virtual zones may be defined.</para>
+      </listitem>
+
+      <listitem>
+        <para>They should not be used with IMPLICIT_CONTINUE=Yes in <ulink
+        url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
+      </listitem>
+    </itemizedlist>
+
+    <para>When a connection request to/from a sub-zone of a virtual zone does
+    not match the rules for the sub-zone, the connection is compared against
+    the rules (and policies) for the parent virtual zone.</para>
+  </refsect1>
+
   <refsect1>
     <title>FILES</title>
 

manpages/shorewall-zones.xml

@@ -169,6 +169,17 @@ c:a,b     ipv4</programlisting>
                 single bridge.</para>
               </listitem>
             </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">virtual</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.4.5. Virtual zones are containers
+                for other zones. See <ulink
+                url="shorewall-nesting.html">shorewall-nesting (5)</ulink> for
+                details.</para>
+              </listitem>
+            </varlistentry>
           </variablelist>
         </listitem>
       </varlistentry>

manpages6/shorewall6-nesting.xml

@@ -87,6 +87,56 @@
     significant.</para>
   </refsect1>
 
+  <refsect1 id="Virtual">
+    <title>Virtual Zones</title>
+
+    <para>Beginning with Shorewall 4.4.5, Shorewall allows the declaration of
+    <firstterm>virtual</firstterm> zones. A virtual zone has no definition in
+    <filename>/etc/shorewall6/interfaces</filename> or in
+    <filename>/etc/shorewall6/hosts</filename>. Rather, it is used as a parent
+    zone for other zones in <filename>/etc/shorewall6/zones</filename>.</para>
+
+    <para>Example:</para>
+
+    <para><filename>/etc/shorewall6/zones</filename>:</para>
+
+    <programlisting>        #ZONE            TYPE          OPTIONS
+        fw               firewall
+        net              ipv6
+        loc              virtual       #Virtual Zone
+        loc1:loc         ipv6
+        loc2:loc         ipv6</programlisting>
+
+    <para><filename>/etc/shorewall/interfaces</filename>:</para>
+
+    <programlisting>        #ZONE   INTERFACE       BROADCAST       OPTIONS
+        net     eth0            detect          dhcp,tcpflags
+        -       eth1            detect          tcpflags</programlisting>
+
+    <para><filename>/etc/shorewall/hosts</filename>:</para>
+
+    <programlisting>        #ZONE   HOST(S)                         OPTIONS
+        loc1    eth1:2001:19f0:feee:1::/48
+        loc2    eth1:2001:19f0:feee:2::/48</programlisting>
+
+    <para>There are several restrictions on virtual zones:</para>
+
+    <itemizedlist>
+      <listitem>
+        <para>A maximum of four virtual zones may be defined.</para>
+      </listitem>
+
+      <listitem>
+        <para>They should not be used with IMPLICIT_CONTINUE=Yes in <ulink
+        url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
+      </listitem>
+    </itemizedlist>
+
+    <para>When a connection request to/from a sub-zone of a virtual zone does
+    not match the rules for the sub-zone, the connection is compared against
+    the rules (and policies) for the parent virtual zone.</para>
+  </refsect1>
+
   <refsect1>
     <title>FILES</title>
 

manpages6/shorewall6-zones.xml

@@ -169,6 +169,17 @@ c:a,b     ipv6</programlisting>
                 single bridge.</para>
               </listitem>
             </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">virtual</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.4.5. Virtual zones are containers
+                for other zones. See <ulink
+                url="shorewall6-nesting.html">shorewall6-nesting (5)</ulink>
+                for details.</para>
+              </listitem>
+            </varlistentry>
           </variablelist>
         </listitem>
       </varlistentry>