On Thu, 2011-07-07 at 04:22 -0700, J. Randall Owens wrote: > I take that back now. While it's not on that page, I see where Tc.pm has > a place for picking out an IP address as a third parameter. In that case, > I'd say that process_tc_rule is messing up at line 206/208, where it > checks $originalmark to make sure splitting it on colons doesn't produce > three or more fields, which was safe with the old MARK values which never > had addresses, either IPv4 or IPv6, but might have a colon in there > before the [CFPTI] values. And when it finds three (though the second is > that empty non-space between the colons), it spits out that error message. > > (And this time, Tom, I'm looking at a git checkout, not an ancient 4.4.17. > ;) :-)
Attached is a patch which allows an IPv6 address in the third parameter. Enclosing the address in [...] or <...> is optional. Now for the manpages. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
diff --git a/Shorewall/Perl/Shorewall/Tc.pm b/Shorewall/Perl/Shorewall/Tc.pm
index 9a2cea2..3721a09 100644
--- a/Shorewall/Perl/Shorewall/Tc.pm
+++ b/Shorewall/Perl/Shorewall/Tc.pm
@@ -205,7 +205,15 @@ sub process_tc_rule( ) {
my ( $mark, $designator, $remainder ) = split( /:/, $originalmark, 3 );
- fatal_error "Invalid MARK ($originalmark)" if defined $remainder || ! defined $mark || $mark eq '';
+ fatal_error "Invalid MARK ($originalmark)" unless defined $mark || $mark eq '';
+
+ if ( $remainder ) {
+ if ( $originalmark =~ /^\w+\(?.*\)$/ ) {
+ $mark = $originalmark; # Most likely, an IPv6 address is included in the parameter list
+ } else {
+ fatal_error "Invalid MARK ($originalmark)";
+ }
+ }
my $chain = $globals{MARKING_CHAIN};
my $target = 'MARK --set-mark';
@@ -376,6 +384,10 @@ sub process_tc_rule( ) {
$target .= " --on-port $port";
if ( supplied $ip ) {
+ if ( $family == F_IPV6 ) {
+ $ip = $1 if $ip =~ /^\[(.+)\]$/ || $ip =~ /^<(.+)>$/;
+ }
+
validate_address $ip, 1;
$target .= " --on-ip $ip";
}
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ All of the data generated in your IT infrastructure is seriously valuable. Why? It contains a definitive record of application performance, security threats, fraudulent activity, and more. Splunk takes this data and makes sense of it. IT sense. And common sense. http://p.sf.net/sfu/splunk-d2d-c2
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
