Mangle - The PCXFireWall Mangle Table Module.


  use PCXFireWall::Mangle;
  my $obj = PCXFireWall::Mangle->new(configObj => $configObj,
            interfaceObj => $interfaceObj);


Mangle is the Module for the PCXFireWall representing the Mangle Table.


  scalar new(configObj, interfaceObj)
    Creates a new instance of the PCXFireWall::Mangle
    object.  This is called by the generator script.  configObj
    allows us to be aware of the config changes the user makes in
    regards to the installPath, comments, etc.  interfaceObj allows
    us to be aware of the network interfaces the user defines.
  void policy(chain, policy, preComment, postComment)
    Sets the default policy of chain to policy.  Valid values are
    ACCEPT or DENY for policy.
  void createChain(name, preComment, postComment)
    Makes an entry in userChains for the specified chain and then makes
    an entry in rules for the command to create the chain.
  void flushChain(name, preComment, postComment)
    name can be 'All' which will empty all user defined chains.
    A rule will be added which would flush the specified chain.
  void deleteChain(name, preComment, postComment)
    name can be 'All' which will delete all user defined chains.
    The chain(s) will be removed from userChains (if present) and then
    a rule(s) will be added which would delete the chain.  The chain(s)
    will have rules created to flush them before we delete it so that
    it will always work.  Thus you don't need to call flushChain unless
    you are not planning on deleting the chain.
  Valid parameters for the "rules" methods.  If string is empty, then
  that parameter is left out of the generated rule and iptables will
  use whatever default it deems fit.  Items marked with a * are boolean
  values and take 1 or 0.  If 0, then they are ignored (they default to
  being 0).  Any parameters marked with a ** are required.
  i = input interface (only valid in INPUT, PREROUTING, FORWARD)
  o = output interface (only valid in OUTPUT, POSTROUTING, FORWARD)
  s = source address (if value is inInterfaceIP then I will substitue
                      the IP address of i, else if value is
                      outInterfaceIP then I will substitue the IP
                      address of o, else we use the specified value.
                      If value is !inInterfaceIP or !outInterfaceIP,
                      then the resulting IP Address is prefixed with
                      a ! space.
                      inInterfaceBroadcast and outInterfaceBroadcast
                      will use the value of the shell variable
                      <interface>BROADCAST for the source address.)
  d = destination address (same as s for inInterfaceIP/outInterfaceIP
                        and inInterfaceBroadcast/outInterfaceBroadcast)
  f = fragment *
  nf = ! fragment (nf and f can not both be 1) *
  tcp-flags format is "!? flag,flag,flag flag,flag" (? = optional)
  syn = --syn *
  nsyn = ! --syn (syn and nsyn can not both be 1) *
  mac = -m mac (only valid with chain = PREROUTING, FORWARD or INPUT) *
    mac-source = !? MAC address to match (mac must = 1)
  limit = -m limit *
    limit-rate = --limit rate (limit must be 1)
    limit-burst (limit must be 1)
  multiport = -m multiport *
    source-port (multiport must be 1)
    destination-port (multiport must be 1)
    port (multiport must be 1)
  mark = -m mark *
    mark-value = --mark value
  state = -m state *
    states = --state
  unclean = -m unclean *
  tos = -m tos *
    tos-value = --tos tos
  chain = name of chain to use (INPUT, OUTPUT, FORWARD or user defined)**
  p = protocol (tcp, udp, icmp or "" = all)
  dport = destination port
  sport = source port
  (dport and sport are only valid when p = tcp or udp)
  int = interface ("" = all interfaces)
  insert = insert the rule at the specified offset. *
  append = append the rule to the chain. *  (This is the default action)
  rule-offset = Offset to insert the rule at.  Defaults to 1.
  (If append = 1 (by default) and insert = 1 then the insert and
  rule-offset values will be used, else we append the rule.)
  log (in all rules except log, generate a log rule before the action) *
    log-level = syslog level (defaults to notice)
    log-prefix = string to identify the log entry by.
    log-tcp-sequence *  (This is a security risk)
    log-tcp-options *
    log-ip-options *
    (to use any of these options, log must be = 1 or in rule log)
    log-limit = -m limit *
    log-limit-rate = --limit rate (log-limit must be 1)
    log-limit-burst (log-limit must be 1)
  tcp-option (only valid with p = tcp)
  icmp-type (only valid with p = icmp)
  ttl = --ttl ttl
  preComment - text before the rule.
  postComment - text after the rule.
  ruleMode - (setup or normal) Allows you to specify which array the rule
              should be placed in so that it gets output correctly.
  See the man page for iptables for valid combinations.
  NOTE: When using any of the following methods and you specify log => 1,
    you must also specify log-limit, log-limit-rate, log-limit-burst
    as seperate from limit, limit-rate and limit-burst if you want to
    limit the log rule and the parent rule at different rates.  If you
    only specify limit, limit-rate and limit-burst then only the parent
    rule will be limited, the log rule will not be limited.  Thus if you
    want to limit both the log and the parent rule you must specify both
    limit, log-limit, limit-rate, and log-limit-rate, etc.  This allows
    you to limit the logging but not the rule itself, and vice a versa.
    The parent rule will set log = 0 to make sure that any limiting you
    wanted to be done will take place.
  void log()
    A rule will be created to log the specified packets based upon the
    given parameters.  If nothing is specified, then the rule will be
    generated for all chains, all protocols, all interfaces.
  void queue()
     A rule will be created to QUEUE the packet to user space.
  void jump(dchain)
    A rule will be created to JUMP to the specified chain based upon
    the given parameters.  chain must be specified.  dchain is the
    destination chain to jump to and must also be specified.  dchain can
    only be a user defined chain.
  void mark(markValue)
    A rule will be created to MARK the packet with markValue.
  void tos(tosValue)
    A rule will be created to set the TOS of the packet to tosValue. If
    not specified then tosValue defaults to 16.
  void ttl(ttl-set, ttl-dec, ttl-inc)
    A rule will be created to set, decrement or increment the ttl
    of the specified packet.  Only one of ttl-set, ttl-dec or ttl-inc
    can be specified at a time.
  Helper methods for /proc entries.
    You must use the Proc modules methods.
  Internally used methods.
  void display(fh, mode)
    This routine will write the rules to the file via fh.  This is called
    by the generator script.  If mode = 'normal' then we display all rules
    from the rules array, else if mode = 'setup' then we display all
    rules from the setupRules array which contains chain creation,
    flushing, etc. and any rules that are detected to relate to DNS.
  void appendRule(rule, mode)
    This routine will append the rule to the end of the rules array.
    This is called internally by all the rule generating routines in this
    module.  If mode = 'normal' then the rule is appended to the rules
    array else if mode = 'setup' then the rule is appened to the
    setupRules array.


  userChains - The chains that the user creates.  Type is hash.
  rules - All rules that will be generated are stored here.
          Type is array.
  setupRules - All setup and dns related rules will be stored here.
               Type is array.
  NOTE:  All data fields are accessible by specifying the object
         and pointing to the data member to be modified on the
         left-hand side of the assignment.
         Ex.  $obj->variable($newValue); or $value = $obj->variable;


Xperience, Inc. (mailto:admin at