ubuntu 13.04英文版裝中文輸入(注音)

apt-get install scim-chewing scim-modules-table
System Settings > Language Support > Install / Remove Languages… 選Chinese

System Settings > Language Support > keyboard input method system 選SCIM

接著啟動SCIM刪除不必要的輸入法


增加切換下一個輸入法的組合鍵

RFC 5952 - A Recommendation for IPv6 Address Text Representation 之筆記

1. Introduction

RFC 5952主要在定義IPv6 address的表示法的標準化，主要原因是因為RFC 4291 - IP Version 6 Addressing Architecture定義了IPv6 address，且提供了一些彈性表示法，卻也因為彈性導致相同的address卻有不同的表示法(換言之，不同的表示法卻是指向同一address)，這會導致一些問題產生。

以下的IPv6 address都是相同的：

2001:db8:0:0:1:0:0:1
2001:0db8:0:0:1:0:0:1 
2001:db8::1:0:0:1
2001:db8::0:1:0:0:1 
2001:0db8::1:0:0:1
2001:db8:0:0:1::1 
2001:db8:0000:0:1::1
2001:DB8:0:0:1::1 

2. Text Representation Flexibility of RFC 4291

2.1. Leading Zeros in a 16-Bit Field
'It is not necessary to write the leading zeros in an individual field.'
以0為開頭的字沒必要寫，因為這樣，所以0開頭的字母可寫可不寫，如：

2001:db8:aaaa:bbbb:cccc:dddd:eeee:0001
2001:db8:aaaa:bbbb:cccc:dddd:eeee:001
2001:db8:aaaa:bbbb:cccc:dddd:eeee:01
2001:db8:aaaa:bbbb:cccc:dddd:eeee:1

2.2. Zero Compression
'A special syntax is available to compress the zeros. The use of "::" indicates one or more groups of 16 bits of zeros.'
'The "::" can only appear once in an address.'
可以將1個或多個的"0000"用::這個特殊寫法表示，不過只能出現一次如：

2001:db8:0:0:0::1
2001:db8:0:0::1
2001:db8:0::1
2001:db8::1

2.3. Uppercase or Lowercase
RFC 4291並沒有特別指明說要用大寫或小寫表示之。

3. Problems Encountered with the Flexible Model

簡單來說，就是比對會有問題，比如對eth0指定IPv6網址2001:db8:0:0:1::1，之後用ifconfig eth0| grep 來找卻找不到，因為ifconfig顯示的是2001:db8::1:0:0:1這個IPv6 address。大小寫的差異在UNIX系統更是常見，比如2001:db8:0:0:1:0:0:1和2001:DB8:0:0:1:0:0:1在比對沒有特別指明case insensitive參數就會視為不同。

4. A Recommendation for IPv6 Text Representation

4.1. Handling Leading Zeros in a 16-Bit Field
Leading zeros MUST be suppressed.0開頭的字母都必須被省略，如2001:0db8::0001這是不行的，必須寫成2001:db8::1。

4.2. "::" Usage
The use of the symbol "::" MUST be used to its maximum capability. The symbol "::" MUST NOT be used to shorten just one 16-bit 0 field.
表示式必須盡可能的簡化，而且只有一個"0000"時不能簡化。所以2001:db8:0:0:0:0:2:1是不正確的，應該被寫成2001:db8::2:1。而2001:db8::1:1:1:1:1卻是不正確的，應該被寫成2001:db8:0:1:1:1:1:1。
When there is an alternative choice in the placement of a "::", the longest run of consecutive 16-bit 0 fields MUST be shortened. When the length of the consecutive 16-bit 0 fields are equal, the first sequence of zero bits MUST be shortened.
簡而言之，就是如果有兩個可以簡化::的地方，挑表示式最小，如果都是最小，則挑第一個位置。如2001:0:0:1:0:0:0:1必須被簡化為2001::1:0:0:0:1。

4.3. Lowercase
用小寫表示之。

5. Text Representation of Special Addresses

IPv4-Mapped IPv6 addresses [RFC5214]的寫法要符合前面的規則，且後面為IPv4寫法，如0:0:0:0:0:ffff:192.0.2.1應該被寫成::ffff:192.0.2.1。

6. Notes on Combining IPv6 Addresses with Port Numbers

以下是一般結合port的寫法：

• [2001:db8::1]:80
• 2001:db8::1:80
• 2001:db8::1.80
• 2001:db8::1 port 80
• 2001:db8::1p80
• 2001:db8::1#80

建議使用第一種寫法[2001:db8::1]:80。

Packet Filtering HOWTO 讀後筆記II

原文：Packet Filtering HOWTO

Packet Filtering HOWTO 讀後筆記I

7. Using iptables

Extensions to iptables: New Matches
iptables具備可擴充性(extensible)，這表示我們可以在kernel或是iptable上新增新的功能。目前kernel和iptables已經具備許多的標準擴充功能，您可以在kernel/net/netfilter目錄底下看到許多的xt_XXX.c。在iptables也會有相對應的extensions，在extensions/libxt_XXX.c，iptables的extensions會被build成shared library，需要使用-m將extensions載入。如果要取得extensions('-p'的說明，只要在後面加上-h或是--help即可。

# iptables -p tcp --help
iptables v1.4.12

Usage: iptables -[ACD] chain rule-specification [options]
       iptables -I chain [rulenum] rule-specification [options]
       iptables -R chain rulenum rule-specification [options]
       iptables -D chain rulenum [options]
       iptables -[LS] [chain [rulenum]] [options]
       iptables -[FZ] [chain] [options]
       iptables -[NX] chain
       iptables -E old-chain-name new-chain-name
       iptables -P chain target [options]
       iptables -h (print this help information)

Commands:
Either long or short options are allowed.
  --append  -A chain            Append to chain
  --check   -C chain            Check for the existence of a rule
  --delete  -D chain            Delete matching rule from chain
  --delete  -D chain rulenum
                                Delete rule rulenum (1 = first) from chain
  --insert  -I chain [rulenum]
                                Insert in chain as rulenum (default 1=first)
  --replace -R chain rulenum
                                Replace rule rulenum (1 = first) in chain
  --list    -L [chain [rulenum]]
                                List the rules in a chain or all chains
  --list-rules -S [chain [rulenum]]
                                Print the rules in a chain or all chains
  --flush   -F [chain]          Delete all rules in  chain or all chains
  --zero    -Z [chain [rulenum]]
                                Zero counters in chain or all chains
  --new     -N chain            Create a new user-defined chain
  --delete-chain
            -X [chain]          Delete a user-defined chain
  --policy  -P chain target
                                Change policy on chain to target
  --rename-chain
            -E old-chain new-chain
                                Change chain name, (moving any references)
Options:
    --ipv4      -4              Nothing (line is ignored by ip6tables-restore)
    --ipv6      -6              Error (line is ignored by iptables-restore)
[!] --proto     -p proto        protocol: by number or name, eg. `tcp'
[!] --source    -s address[/mask][...]
                                source specification
[!] --destination -d address[/mask][...]
                                destination specification
[!] --in-interface -i input name[+]
                                network interface name ([+] for wildcard)
 --jump -j target
                                target for rule (may load target extension)
  --goto      -g chain
                              jump to chain with no return
  --match       -m match
                                extended match (may load extension)
  --numeric     -n              numeric output of addresses and ports
[!] --out-interface -o output name[+]
                                network interface name ([+] for wildcard)
  --table       -t table        table to manipulate (default: `filter')
  --verbose     -v              verbose mode
  --line-numbers                print line numbers when listing
  --exact       -x              expand numbers (display exact values)
[!] --fragment  -f              match second or further fragments only
  --modprobe=          try to insert modules using this command
  --set-counters PKTS BYTES     set the counter during insert/append
[!] --version   -V              print package version.

tcp match options:
[!] --tcp-flags mask comp       match when TCP flags & mask == comp
                                (Flags: SYN ACK FIN RST URG PSH ALL NONE)
[!] --syn                       match when only SYN flag set
                                (equivalent to --tcp-flags SYN,RST,ACK,FIN SYN)
[!] --source-port port[:port]
 --sport ...
                                match source port(s)
[!] --destination-port port[:port]
 --dport ...
                                match destination port(s)
[!] --tcp-option number        match if TCP option set

Other Match Extensions
mac 這個module必須用'-m mac'或'--match mac'載入，用於比對source MAC，只能用於PREOUTING和INPUT這兩個chain。
limit 這個module必須用'-m limit'或'--match limit'載入，用於限制match的速率。--limit單位可以是/second、/minute、/hour或是/day，如5/s，每秒5個。--limit-burstnumber to match in a burst。用下圖來描述這兩者的涵義

limit-burst就是水桶的容量，limit就是水桶流出的流量，當packet裝滿水桶，後面的就會被丟棄，隨著時間過去，水桶會流出lmit個packet，就是可以再允許limit流進水桶。

7.4 Target Specifications
何謂target？what to do to the packets which match our tests. This is called a rule's target.(當match我們的條件之後，所要採取的動作就稱為rule的target)。target也可以是User-defined chains。

iptables是first match，packet進入INPUT這個chain後，會由第一條rule開始比對，如果比對成功並且有明確的target(ACCRPT/DROP)就會執行丟棄/同意packet並且終止比對，當target是另外一個chain時，就會jump到該chain中繼續進行比對，如果都沒有match，就會再回到原來的chain中繼續往下比對。

# iptables -A INPUT -p icmp
# iptables -A INPUT -p icmp -j LOG
# iptables -A INPUT -p icmp -j ACCEPT
# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

    0     0            icmp --  any    any     anywhere             anywhere

    0     0 LOG        icmp --  any    any     anywhere             anywhere
         LOG level warning
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere


Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination


Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

# ping 127.0.0.1 -c 1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
[ 6975.682678] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.
0.0.1 DST=127.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 C
ODE=0 ID=4908 SEQ=0
[ 6975.697694] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.
0.0.1 DST=127.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=49768 PROTO=ICMP TYPE=0
CODE=0 ID=4908 SEQ=0
64 bytes from 127.0.0.1: seq=0 ttl=64 time=34.397 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 34.397/34.397/34.397 ms
# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

    2   168            icmp --  any    any     anywhere             anywhere

    2   168 LOG        icmp --  any    any     anywhere             anywhere
         LOG level warning
    2   168 ACCEPT     icmp --  any    any     anywhere             anywhere


Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination


Chain OUTPUT (policy ACCEPT 2 packets, 168 bytes)
 pkts bytes target     prot opt in     out     source               destination

Extensions to iptables: New Targets
還有LOG、REJECT、RETURN和QUEUE等target。詳細用法請自行參考該page。