holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Add DROP support in tcrules

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2013-11-04 10:50:11 -08:00
parent 472ecc661f
commit e14d92c5ac
3 changed files with 42 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
Shorewall/Perl/Shorewall/Tc.pm
View File

@ -304,7 +304,13 @@ our %tccmd;
mark => NOMARK, mark => NOMARK,
mask => '', mask => '',
connmark => 0, connmark => 0,
} },
DROP => { match => sub( $ ) { $_[0] eq 'DROP' },
target => 'DROP',
mark => NOMARK,
mask => '',
connmark => 0
},
); );
} }
@ -559,7 +565,13 @@ our %tccmd;
} }
$cmd = ''; $cmd = '';
} },
DROP => sub()
{
assert ( $cmd eq 'DROP' );
$target = 'DROP';
$cmd = '';
},
); );
if ( $source ) { if ( $source ) {

23
Shorewall/manpages/shorewall-tcrules.xml
View File

@ -397,6 +397,13 @@
follow.</para> follow.</para>
</listitem> </listitem>
<listitem>
<para><emphasis role="bold">DROP</emphasis></para>
<para>Added in Shorewall 4.5.21.4. Causes matching packets to be
discarded.</para>
</listitem>
<listitem> <listitem>
<para><emphasis <para><emphasis
role="bold">DSCP</emphasis>(<replaceable>dscp</replaceable>)</para> role="bold">DSCP</emphasis>(<replaceable>dscp</replaceable>)</para>
@ -903,8 +910,8 @@ Normal-Service =&gt; 0x00</programlisting>
<emphasis>port range</emphasis>s; if the protocol is <emphasis <emphasis>port range</emphasis>s; if the protocol is <emphasis
role="bold">icmp</emphasis>, this column is interpreted as the role="bold">icmp</emphasis>, this column is interpreted as the
destination icmp-type(s). ICMP types may be specified as a numeric destination icmp-type(s). ICMP types may be specified as a numeric
type, a numeric type and code separated by a slash (e.g., 3/4), or type, a numeric type and code separated by a slash (e.g., 3/4), or a
a typename. See <ulink typename. See <ulink
url="http://www.shorewall.net/configuration_file_basics.htm#ICMP">http://www.shorewall.net/configuration_file_basics.htm#ICMP</ulink>.</para> url="http://www.shorewall.net/configuration_file_basics.htm#ICMP">http://www.shorewall.net/configuration_file_basics.htm#ICMP</ulink>.</para>
<para>If the protocol is <emphasis role="bold">ipp2p</emphasis>, <para>If the protocol is <emphasis role="bold">ipp2p</emphasis>,
@ -1139,8 +1146,8 @@ Normal-Service =&gt; 0x00</programlisting>
</emphasis><emphasis>helper</emphasis></term> </emphasis><emphasis>helper</emphasis></term>
<listitem> <listitem>
<para>Names a Netfilter protocol <firstterm>helper</firstterm> module <para>Names a Netfilter protocol <firstterm>helper</firstterm>
such as <option>ftp</option>, <option>sip</option>, module such as <option>ftp</option>, <option>sip</option>,
<option>amanda</option>, etc. A packet will match if it was accepted <option>amanda</option>, etc. A packet will match if it was accepted
by the named helper module.</para> by the named helper module.</para>
@ -1233,10 +1240,10 @@ Normal-Service =&gt; 0x00</programlisting>
4:T 0.0.0.0/0 0.0.0.0/0 ipp2p:all 4:T 0.0.0.0/0 0.0.0.0/0 ipp2p:all
SAVE:T 0.0.0.0/0 0.0.0.0/0 all - - - !0</programlisting> SAVE:T 0.0.0.0/0 0.0.0.0/0 all - - - !0</programlisting>
<para>If a packet hasn't been classified (packet mark is 0), copy the <para>If a packet hasn't been classified (packet mark is 0), copy
connection mark to the packet mark. If the packet mark is set, we're the connection mark to the packet mark. If the packet mark is set,
done. If the packet is P2P, set the packet mark to 4. If the packet we're done. If the packet is P2P, set the packet mark to 4. If the
mark has been set, save it to the connection mark.</para> packet mark has been set, save it to the connection mark.</para>
</listitem> </listitem>
</varlistentry> </varlistentry>

19
Shorewall6/manpages/shorewall6-tcrules.xml
View File

@ -402,6 +402,13 @@
it from any rules that follow.</para> it from any rules that follow.</para>
</listitem> </listitem>
<listitem>
<para><emphasis role="bold">DROP</emphasis></para>
<para>Added in Shorewall 4.5.21.4. Causes matching packets to be
discarded.</para>
</listitem>
<listitem> <listitem>
<para><emphasis <para><emphasis
role="bold">DSCP</emphasis>(<replaceable>dscp</replaceable>)</para> role="bold">DSCP</emphasis>(<replaceable>dscp</replaceable>)</para>
@ -779,8 +786,8 @@ Normal-Service =&gt; 0x00</programlisting>
<emphasis>port range</emphasis>s; if the protocol is <emphasis <emphasis>port range</emphasis>s; if the protocol is <emphasis
role="bold">ipv6-icmp</emphasis>, this column is interpreted as the role="bold">ipv6-icmp</emphasis>, this column is interpreted as the
destination icmp-type(s). ICMP types may be specified as a numeric destination icmp-type(s). ICMP types may be specified as a numeric
type, a numeric type and code separated by a slash (e.g., 3/4), or type, a numeric type and code separated by a slash (e.g., 3/4), or a
a typename. See <ulink typename. See <ulink
url="http://www.shorewall.net/configuration_file_basics.htm#ICMP">http://www.shorewall.net/configuration_file_basics.htm#ICMP</ulink>.</para> url="http://www.shorewall.net/configuration_file_basics.htm#ICMP">http://www.shorewall.net/configuration_file_basics.htm#ICMP</ulink>.</para>
<para>If the protocol is <emphasis role="bold">ipp2p</emphasis>, <para>If the protocol is <emphasis role="bold">ipp2p</emphasis>,
@ -1151,10 +1158,10 @@ Normal-Service =&gt; 0x00</programlisting>
4 ::/0 ::/0 ipp2p:all 4 ::/0 ::/0 ipp2p:all
SAVE ::/0 ::/0 all - - - !0</programlisting> SAVE ::/0 ::/0 all - - - !0</programlisting>
<para>If a packet hasn't been classified (packet mark is 0), copy the <para>If a packet hasn't been classified (packet mark is 0), copy
connection mark to the packet mark. If the packet mark is set, we're the connection mark to the packet mark. If the packet mark is set,
done. If the packet is P2P, set the packet mark to 4. If the packet we're done. If the packet is P2P, set the packet mark to 4. If the
mark has been set, save it to the connection mark.</para> packet mark has been set, save it to the connection mark.</para>
</listitem> </listitem>
</varlistentry> </varlistentry>
</variablelist> </variablelist>