extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-02-18 18:51:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

Emit 'expensive' matches last unless there are '-m nfacct' matches in the rule.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2013-05-26 08:03:54 -07:00
parent 31f9ea5b93
commit 0b5a316cfc
1 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -613,6 +613,7 @@ use constant { UNIQUE => 1,
CONTROL => 16, CONTROL => 16,
COMPLEX => 32, COMPLEX => 32,
NFACCT => 64, NFACCT => 64,
EXPENSIVE => 128,
}; };
our %opttype = ( rule => CONTROL, our %opttype = ( rule => CONTROL,
@ -645,6 +646,9 @@ our %opttype = ( rule => CONTROL,
nfacct => NFACCT, nfacct => NFACCT,
set => EXPENSIVE,
geoip => EXPENSIVE,
conntrack => COMPLEX, conntrack => COMPLEX,
jump => TARGET, jump => TARGET,
@ -827,7 +831,7 @@ sub set_rule_option( $$$ ) {
if ( exists $ruleref->{$option} ) { if ( exists $ruleref->{$option} ) {
assert( defined( my $value1 = $ruleref->{$option} ) , $ruleref ); assert( defined( my $value1 = $ruleref->{$option} ) , $ruleref );
if ( $opttype & ( MATCH | NFACCT ) ) { if ( $opttype & ( MATCH | NFACCT | EXPENSIVE ) ) {
if ( $globals{KLUDGEFREE} ) { if ( $globals{KLUDGEFREE} ) {
unless ( reftype $value1 ) { unless ( reftype $value1 ) {
unless ( reftype $value ) { unless ( reftype $value ) {
@ -1013,6 +1017,8 @@ sub format_rule( $$;$ ) {
# The code the follows can be destructive of the rule so we clone it # The code the follows can be destructive of the rule so we clone it
# #
my $ruleref = $rulerefp->{complex} ? clone_rule( $rulerefp ) : $rulerefp; my $ruleref = $rulerefp->{complex} ? clone_rule( $rulerefp ) : $rulerefp;
my $nfacct = $rulerefp->{nfacct};
my $expensive;
for ( @{$ruleref->{matches}} ) { for ( @{$ruleref->{matches}} ) {
my $type = $opttype{$_} || 0; my $type = $opttype{$_} || 0;
@ -1031,7 +1037,24 @@ sub format_rule( $$;$ ) {
} }
next; next;
} elsif ( $type == EXPENSIVE ) {
#
# Only emit expensive matches now if there are '-m nfacct' matches in the rule
#
if ( $nfacct ) {
$rule .= format_option( $_, pop_match( $ruleref, $_ ) );
} else { } else {
$expensive = 1;
}
} else {
$rule .= format_option( $_, pop_match( $ruleref, $_ ) );
}
}
#
# Emit expensive matches last unless we had '-m nfacct' matches in the rule.
#
if ( $expensive ) {
for ( grep( ( $opttype{$_} || 0 ) == EXPENSIVE, @{$ruleref->{matches}} ) ) {
$rule .= format_option( $_, pop_match( $ruleref, $_ ) ); $rule .= format_option( $_, pop_match( $ruleref, $_ ) );
} }
} }