extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-19 12:50:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

Correct handling of wildcard interfaces

Browse Source 
- chain_base[1] renamed var_base[1]
- $chain replaced by $var in renamed functions
- replace trailing '+' by '_plus' to provide uniqueness
- add sub chain_base() to the Chains module as an identity mapper

Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2012-12-28 10:39:19 -08:00
parent 643f419264
commit 51deec115b
5 changed files with 53 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -1567,6 +1567,14 @@ sub blacklist_chain($$) {
&rules_chain(@_) . '~'; &rules_chain(@_) . '~';
} }
#
# Create the base for a chain involving the passed interface -- we make this a function so it will be
# easy to change the mapping should the need ever arrive.
#
sub chain_base( $ ) {
$_[0];
}
# #
# Forward Chain for an interface # Forward Chain for an interface
# #
@ -5598,7 +5606,7 @@ sub mark_firewall_not_started() {
# Returns the name of the shell variable holding the first address of the passed interface # Returns the name of the shell variable holding the first address of the passed interface
# #
sub interface_address( $ ) { sub interface_address( $ ) {
my $variable = 'sw_' . chain_base( $_[0] ) . '_address'; my $variable = 'sw_' . var_base( $_[0] ) . '_address';
uc $variable; uc $variable;
} }
@ -5623,7 +5631,7 @@ sub get_interface_address ( $ ) {
# Returns the name of the shell variable holding the broadcast addresses of the passed interface # Returns the name of the shell variable holding the broadcast addresses of the passed interface
# #
sub interface_bcasts( $ ) { sub interface_bcasts( $ ) {
my $variable = 'sw_' . chain_base( $_[0] ) . '_bcasts'; my $variable = 'sw_' . var_base( $_[0] ) . '_bcasts';
uc $variable; uc $variable;
} }
@ -5646,7 +5654,7 @@ sub get_interface_bcasts ( $ ) {
# Returns the name of the shell variable holding the anycast addresses of the passed interface # Returns the name of the shell variable holding the anycast addresses of the passed interface
# #
sub interface_acasts( $ ) { sub interface_acasts( $ ) {
my $variable = 'sw_' . chain_base( $_[0] ) . '_acasts'; my $variable = 'sw_' . var_base( $_[0] ) . '_acasts';
uc $variable; uc $variable;
} }
@ -5669,7 +5677,7 @@ sub get_interface_acasts ( $ ) {
# Returns the name of the shell variable holding the gateway through the passed interface # Returns the name of the shell variable holding the gateway through the passed interface
# #
sub interface_gateway( $ ) { sub interface_gateway( $ ) {
my $variable = 'sw_' . chain_base( $_[0] ) . '_gateway'; my $variable = 'sw_' . var_base( $_[0] ) . '_gateway';
uc $variable; uc $variable;
} }
@ -5701,7 +5709,7 @@ sub get_interface_gateway ( $;$ ) {
# Returns the name of the shell variable holding the addresses of the passed interface # Returns the name of the shell variable holding the addresses of the passed interface
# #
sub interface_addresses( $ ) { sub interface_addresses( $ ) {
my $variable = 'sw_' . chain_base( $_[0] ) . '_addresses'; my $variable = 'sw_' . var_base( $_[0] ) . '_addresses';
uc $variable; uc $variable;
} }
@ -5731,7 +5739,7 @@ sub get_interface_addresses ( $ ) {
# Returns the name of the shell variable holding the networks routed out of the passed interface # Returns the name of the shell variable holding the networks routed out of the passed interface
# #
sub interface_nets( $ ) { sub interface_nets( $ ) {
my $variable = 'sw_' . chain_base( $_[0] ) . '_networks'; my $variable = 'sw_' . var_base( $_[0] ) . '_networks';
uc $variable; uc $variable;
} }
@ -5762,7 +5770,7 @@ sub get_interface_nets ( $ ) {
# Returns the name of the shell variable holding the MAC address of the gateway for the passed provider out of the passed interface # Returns the name of the shell variable holding the MAC address of the gateway for the passed provider out of the passed interface
# #
sub interface_mac( $$ ) { sub interface_mac( $$ ) {
my $variable = join( '_' , 'sw' , chain_base( $_[0] ) , chain_base( $_[1] ) , 'mac' ); my $variable = join( '_' , 'sw' , var_base( $_[0] ) , var_base( $_[1] ) , 'mac' );
uc $variable; uc $variable;
} }

2
Shorewall/Perl/Shorewall/Misc.pm
View File

@ -1124,7 +1124,7 @@ sub add_common_rules ( $ ) {
for $interface ( @$list ) { for $interface ( @$list ) {
my $chainref = $filter_table->{input_option_chain $interface}; my $chainref = $filter_table->{input_option_chain $interface};
my $base = uc chain_base get_physical $interface; my $base = uc var_base get_physical $interface;
my $optional = interface_is_optional( $interface ); my $optional = interface_is_optional( $interface );
my $variable = get_interface_gateway( $interface, ! $optional ); my $variable = get_interface_gateway( $interface, ! $optional );

12
Shorewall/Perl/Shorewall/Providers.pm
View File

@ -658,7 +658,7 @@ sub add_a_provider( $$ ) {
my $what = $providerref->{what}; my $what = $providerref->{what};
my $label = $pseudo ? 'Optional Interface' : 'Provider'; my $label = $pseudo ? 'Optional Interface' : 'Provider';
my $dev = chain_base $physical; my $dev = var_base $physical;
my $base = uc $dev; my $base = uc $dev;
my $realm = ''; my $realm = '';
@ -1282,7 +1282,7 @@ sub process_providers( $ ) {
for ( grep interface_is_optional( $_ ) && ! $provider_interfaces{ $_ }, all_real_interfaces ) { for ( grep interface_is_optional( $_ ) && ! $provider_interfaces{ $_ }, all_real_interfaces ) {
# #
# TABLE NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY # TABLE NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY
$currentline = chain_base($_) ." 0 - - $_ - - -"; $currentline = var_base($_) ." 0 - - $_ - - -";
# #
$pseudoproviders += process_a_provider(1); $pseudoproviders += process_a_provider(1);
} }
@ -1732,7 +1732,7 @@ sub handle_optional_interfaces( $ ) {
# #
# Clear the '_IS_USABLE' variables # Clear the '_IS_USABLE' variables
# #
emit( join( '_', 'SW', uc chain_base( get_physical( $_ ) ) , 'IS_USABLE=' ) ) for @$interfaces; emit( join( '_', 'SW', uc var_base( get_physical( $_ ) ) , 'IS_USABLE=' ) ) for @$interfaces;
if ( $wildcards ) { if ( $wildcards ) {
# #
@ -1752,7 +1752,7 @@ sub handle_optional_interfaces( $ ) {
for my $interface ( grep $provider_interfaces{$_}, @$interfaces ) { for my $interface ( grep $provider_interfaces{$_}, @$interfaces ) {
my $provider = $provider_interfaces{$interface}; my $provider = $provider_interfaces{$interface};
my $physical = get_physical $interface; my $physical = get_physical $interface;
my $base = uc chain_base( $physical ); my $base = uc var_base( $physical );
my $providerref = $providers{$provider}; my $providerref = $providers{$provider};
emit( "$physical)" ), push_indent if $wildcards; emit( "$physical)" ), push_indent if $wildcards;
@ -1773,7 +1773,7 @@ sub handle_optional_interfaces( $ ) {
for my $interface ( grep ! $provider_interfaces{$_}, @$interfaces ) { for my $interface ( grep ! $provider_interfaces{$_}, @$interfaces ) {
my $physical = get_physical $interface; my $physical = get_physical $interface;
my $base = uc chain_base( $physical ); my $base = uc var_base( $physical );
my $case = $physical; my $case = $physical;
my $wild = $case =~ s/\+$/*/; my $wild = $case =~ s/\+$/*/;
@ -1861,7 +1861,7 @@ sub handle_stickiness( $ ) {
for my $providerref ( @routemarked_providers ) { for my $providerref ( @routemarked_providers ) {
my $interface = $providerref->{physical}; my $interface = $providerref->{physical};
my $base = uc chain_base $interface; my $base = uc var_base $interface;
my $mark = $providerref->{mark}; my $mark = $providerref->{mark};
for ( grep rule_target($_) eq 'sticky', @{$tcpreref->{rules}} ) { for ( grep rule_target($_) eq 'sticky', @{$tcpreref->{rules}} ) {

6
Shorewall/Perl/Shorewall/Tc.pm
View File

@ -823,7 +823,7 @@ sub process_simple_device() {
fatal_error "Unknown interface( $device )" unless known_interface $device; fatal_error "Unknown interface( $device )" unless known_interface $device;
my $physical = physical_name $device; my $physical = physical_name $device;
my $dev = chain_base( $physical ); my $dev = var_base( $physical );
push @tcdevices, $device; push @tcdevices, $device;
@ -1932,7 +1932,7 @@ sub process_traffic_shaping() {
unless ( $config{TC_ENABLED} eq 'Shared' ) { unless ( $config{TC_ENABLED} eq 'Shared' ) {
my $dev = chain_base( $device ); my $dev = var_base( $device );
emit( '', emit( '',
'#', '#',
@ -2170,7 +2170,7 @@ sub setup_traffic_shaping() {
for my $device ( @tcdevices ) { for my $device ( @tcdevices ) {
my $interfaceref = known_interface( $device ); my $interfaceref = known_interface( $device );
my $dev = chain_base( $interfaceref ? $interfaceref->{physical} : $device ); my $dev = var_base( $interfaceref ? $interfaceref->{physical} : $device );
emit "setup_${dev}_tc"; emit "setup_${dev}_tc";
} }

56
Shorewall/Perl/Shorewall/Zones.pm
View File

@ -62,7 +62,7 @@ our @EXPORT = ( qw( NOTHING
off_firewall_zones off_firewall_zones
non_firewall_zones non_firewall_zones
single_interface single_interface
chain_base var_base
validate_interfaces_file validate_interfaces_file
all_interfaces all_interfaces
all_real_interfaces all_real_interfaces
@ -897,9 +897,9 @@ sub is_a_bridge( $ ) {
# #
# Transform the passed interface name into a legal shell variable name. # Transform the passed interface name into a legal shell variable name.
# #
sub chain_base($) { sub var_base($) {
my $chain = $_[0]; my $var = $_[0];
my $name = $basemap{$chain}; my $name = $basemap{$var};
# #
# Return existing mapping, if any # Return existing mapping, if any
# #
@ -907,31 +907,31 @@ sub chain_base($) {
# #
# Remember initial value # Remember initial value
# #
my $key = $chain; my $key = $var;
# #
# Handle VLANs and wildcards # Handle VLANs and wildcards
# #
$chain =~ s/\+$//; $var =~ s/\+$/_plus/;
$chain =~ tr/./_/; $var =~ tr/./_/;
if ( $chain eq '' || $chain =~ /^[0-9]/ || $chain =~ /[^\w]/ ) { if ( $var eq '' || $var =~ /^[0-9]/ || $var =~ /[^\w]/ ) {
# #
# Must map. Remove all illegal characters # Must map. Remove all illegal characters
# #
$chain =~ s/[^\w]//g; $var =~ s/[^\w]//g;
# #
# Prefix with if_ if it begins with a digit # Prefix with if_ if it begins with a digit
# #
$chain = join( '' , 'if_', $chain ) if $chain =~ /^[0-9]/; $var = join( '' , 'if_', $var ) if $var =~ /^[0-9]/;
# #
# Create a new unique name # Create a new unique name
# #
1 while $mapbase{$name = join ( '_', $chain, ++$baseseq )}; 1 while $mapbase{$name = join ( '_', $var, ++$baseseq )};
} else { } else {
# #
# We'll store the identity mapping if it is unique # We'll store the identity mapping if it is unique
# #
$chain = join( '_', $key , ++$baseseq ) while $mapbase{$name = $chain}; $var = join( '_', $key , ++$baseseq ) while $mapbase{$name = $var};
} }
# #
# Store the reverse mapping # Store the reverse mapping
@ -946,9 +946,9 @@ sub chain_base($) {
# #
# This is a slightly relaxed version of the above that allows '-' in the generated name. # This is a slightly relaxed version of the above that allows '-' in the generated name.
# #
sub chain_base1($) { sub var_base1($) {
my $chain = $_[0]; my $var = $_[0];
my $name = $basemap1{$chain}; my $name = $basemap1{$var};
# #
# Return existing mapping, if any # Return existing mapping, if any
# #
@ -956,31 +956,31 @@ sub chain_base1($) {
# #
# Remember initial value # Remember initial value
# #
my $key = $chain; my $key = $var;
# #
# Handle VLANs and wildcards # Handle VLANs and wildcards
# #
$chain =~ s/\+$//; $var =~ s/\+$//;
$chain =~ tr/./_/; $var =~ tr/./_/;
if ( $chain eq '' || $chain =~ /^[0-9]/ || $chain =~ /[^-\w]/ ) { if ( $var eq '' || $var =~ /^[0-9]/ || $var =~ /[^-\w]/ ) {
# #
# Must map. Remove all illegal characters # Must map. Remove all illegal characters
# #
$chain =~ s/[^\w]//g; $var =~ s/[^\w]//g;
# #
# Prefix with if_ if it begins with a digit # Prefix with if_ if it begins with a digit
# #
$chain = join( '' , 'if_', $chain ) if $chain =~ /^[0-9]/; $var = join( '' , 'if_', $var ) if $var =~ /^[0-9]/;
# #
# Create a new unique name # Create a new unique name
# #
1 while $mapbase1{$name = join ( '_', $chain, ++$baseseq )}; 1 while $mapbase1{$name = join ( '_', $var, ++$baseseq )};
} else { } else {
# #
# We'll store the identity mapping if it is unique # We'll store the identity mapping if it is unique
# #
$chain = join( '_', $key , ++$baseseq ) while $mapbase1{$name = $chain}; $var = join( '_', $key , ++$baseseq ) while $mapbase1{$name = $var};
} }
# #
# Store the reverse mapping # Store the reverse mapping
@ -1242,7 +1242,7 @@ sub process_interface( $$ ) {
if ( $netsref eq 'dynamic' ) { if ( $netsref eq 'dynamic' ) {
my $ipset = $family == F_IPV4 ? "${zone}" : "6_${zone}"; my $ipset = $family == F_IPV4 ? "${zone}" : "6_${zone}";
$ipset = join( '_', $ipset, chain_base1( $physical ) ) unless $zoneref->{options}{in_out}{dynamic_shared}; $ipset = join( '_', $ipset, var_base1( $physical ) ) unless $zoneref->{options}{in_out}{dynamic_shared};
$netsref = [ "+$ipset" ]; $netsref = [ "+$ipset" ];
$ipsets{$ipset} = 1; $ipsets{$ipset} = 1;
} }
@ -1277,7 +1277,7 @@ sub process_interface( $$ ) {
options => \%options , options => \%options ,
zone => '', zone => '',
physical => $physical , physical => $physical ,
base => chain_base( $physical ), base => var_base( $physical ),
zones => {}, zones => {},
}; };
@ -1401,7 +1401,7 @@ sub known_interface($)
name => $i , name => $i ,
number => $interfaceref->{number} , number => $interfaceref->{number} ,
physical => $physical , physical => $physical ,
base => chain_base( $physical ) , base => var_base( $physical ) ,
}; };
} }
} }
@ -1748,7 +1748,7 @@ sub verify_required_interfaces( $ ) {
my $physical = get_physical $interface; my $physical = get_physical $interface;
if ( $physical =~ /\+$/ ) { if ( $physical =~ /\+$/ ) {
my $base = uc chain_base $physical; my $base = uc var_base $physical;
$physical =~ s/\+$/*/; $physical =~ s/\+$/*/;
@ -1895,7 +1895,7 @@ sub process_host( ) {
my $set = $family == F_IPV4 ? "${zone}" : "6_${zone}"; my $set = $family == F_IPV4 ? "${zone}" : "6_${zone}";
unless ( $zoneref->{options}{in_out}{dynamic_shared} ) { unless ( $zoneref->{options}{in_out}{dynamic_shared} ) {
my $physical = chain_base1( physical_name $interface ); my $physical = var_base1( physical_name $interface );
$set = join( '_', $set, $physical ); $set = join( '_', $set, $physical );
} }