extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-20 09:47:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Make the source-net and dest-match routines more readable

Browse Source
This commit is contained in:
Tom Eastep 2011-02-14 20:11:38 -08:00
parent 32f341c279
commit 99f38bfca1
1 changed files with 55 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

84
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -1896,7 +1896,7 @@ sub optimize_level4( $$ ) {
# #
# Chain has a single rule # Chain has a single rule
# #
if ( $firstrule =~ /^-A -[jg] ([^\s]+)(\s+-m comment .*)?\s*$/ ) { if ( $firstrule =~ /^-A -[jg] ([^\s])(\s+-m comment .*)?\s*$/ ) {
# #
# Easy case -- the rule is a simple jump # Easy case -- the rule is a simple jump
# #
@ -2812,15 +2812,21 @@ sub match_source_net( $;$\$ ) {
my ($addr1, $addr2) = ( $2, $3 ); my ($addr1, $addr2) = ( $2, $3 );
$net =~ s/!// if my $invert = $1 ? '! ' : ''; $net =~ s/!// if my $invert = $1 ? '! ' : '';
validate_range $addr1, $addr2; validate_range $addr1, $addr2;
iprange_match . "${invert}--src-range $net "; return iprange_match . "${invert}--src-range $net ";
} elsif ( $net =~ /^!?~/ ) { }
if ( $net =~ /^!?~/ ) {
fatal_error "A MAC address($net) cannot be used in this context" if $restriction >= OUTPUT_RESTRICT; fatal_error "A MAC address($net) cannot be used in this context" if $restriction >= OUTPUT_RESTRICT;
$$macref = 1 if $macref; $$macref = 1 if $macref;
mac_match $net; return mac_match $net;
} elsif ( $net =~ /^(!?)\+[a-zA-Z][-\w]*(\[.*\])?/ ) { }
if ( $net =~ /^(!?)\+[a-zA-Z][-\w]*(\[.*\])?/ ) {
require_capability( 'IPSET_MATCH' , 'ipset names in Shorewall configuration files' , '' ); require_capability( 'IPSET_MATCH' , 'ipset names in Shorewall configuration files' , '' );
join( '', '-m set ', $1 ? '! ' : '', get_set_flags( $net, 'src' ) ); return join( '', '-m set ', $1 ? '! ' : '', get_set_flags( $net, 'src' ) );
} elsif ( $net =~ /^\+\[(.+)\]$/ ) { }
if ( $net =~ /^\+\[(.+)\]$/ ) {
my $result = ''; my $result = '';
my @sets = mysplit $1; my @sets = mysplit $1;
@ -2831,20 +2837,24 @@ sub match_source_net( $;$\$ ) {
$result .= join( '', '-m set ', $1 ? '! ' : '', get_set_flags( $net, 'src' ) ); $result .= join( '', '-m set ', $1 ? '! ' : '', get_set_flags( $net, 'src' ) );
} }
$result; return $result;
} elsif ( $net =~ s/^!// ) {
if ( $net =~ /^&(.+)/ ) {
'! -s ' . record_runtime_address $1;
} else {
validate_net $net, 1;
"! -s $net ";
} }
} elsif ( $net =~ /^&(.+)/ ) {
'-s ' . record_runtime_address $1; if ( $net =~ s/^!// ) {
} else { if ( $net =~ /^&(.+)/ ) {
return '! -s ' . record_runtime_address $1;
}
validate_net $net, 1;
return "! -s $net ";
}
if ( $net =~ /^&(.+)/ ) {
return '-s ' . record_runtime_address $1;
}
validate_net $net, 1; validate_net $net, 1;
$net eq ALLIP ? '' : "-s $net "; $net eq ALLIP ? '' : "-s $net ";
}
} }
# #
@ -2858,11 +2868,15 @@ sub match_dest_net( $ ) {
my ($addr1, $addr2) = ( $2, $3 ); my ($addr1, $addr2) = ( $2, $3 );
$net =~ s/!// if my $invert = $1 ? '! ' : ''; $net =~ s/!// if my $invert = $1 ? '! ' : '';
validate_range $addr1, $addr2; validate_range $addr1, $addr2;
iprange_match . "${invert}--dst-range $net "; return iprange_match . "${invert}--dst-range $net ";
} elsif ( $net =~ /^(!?)\+[a-zA-Z][-\w]*(\[.*\])?$/ ) { }
if ( $net =~ /^(!?)\+[a-zA-Z][-\w]*(\[.*\])?$/ ) {
require_capability( 'IPSET_MATCH' , 'ipset names in Shorewall configuration files' , ''); require_capability( 'IPSET_MATCH' , 'ipset names in Shorewall configuration files' , '');
join( '', '-m set ', $1 ? '! ' : '', get_set_flags( $net, 'dst' ) ); return join( '', '-m set ', $1 ? '! ' : '', get_set_flags( $net, 'dst' ) );
} elsif ( $net =~ /^\+\[(.+)\]$/ ) { }
if ( $net =~ /^\+\[(.+)\]$/ ) {
my $result = ''; my $result = '';
my @sets = mysplit $1; my @sets = mysplit $1;
@ -2873,20 +2887,24 @@ sub match_dest_net( $ ) {
$result .= join( '', '-m set ', $1 ? '! ' : '', get_set_flags( $net, 'dst' ) ); $result .= join( '', '-m set ', $1 ? '! ' : '', get_set_flags( $net, 'dst' ) );
} }
$result; return $result;
} elsif ( $net =~ s/^!// ) {
if ( $net =~ /^&(.+)/ ) {
'! -d ' . record_runtime_address $1;
} else {
validate_net $net, 1;
"! -d $net ";
} }
} elsif ( $net =~ /^&(.+)/ ) {
'-d ' . record_runtime_address $1; if ( $net =~ s/^!// ) {
} else { if ( $net =~ /^&(.+)/ ) {
return '! -d ' . record_runtime_address $1;
}
validate_net $net, 1;
return "! -d $net ";
}
if ( $net =~ /^&(.+)/ ) {
return '-d ' . record_runtime_address $1;
}
validate_net $net, 1; validate_net $net, 1;
$net eq ALLIP ? '' : "-d $net "; $net eq ALLIP ? '' : "-d $net ";
}
} }
# #