Allow tc config during 'enable'

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall/Perl/Shorewall/Compiler.pm

@@ -38,6 +38,8 @@ use Shorewall::IPAddrs;
 use Shorewall::Raw;
 use Shorewall::Misc;
 
+use strict;
+
 our @ISA = qw(Exporter);
 our @EXPORT = qw( compiler );
 our @EXPORT_OK = qw( $export );
@@ -705,9 +707,13 @@ sub compiler {
     #
     enable_script;
     #
+    # Validate the TC files so that the providers will know what interfaces have TC
+    #
+    my $tcinterfaces = process_tc;
+    #
     # Generate a function to bring up each provider
     #
-    process_providers;
+    process_providers( $tcinterfaces );
     #
     # [Re-]establish Routing
     #

Shorewall/Perl/Shorewall/Providers.pm

@@ -258,7 +258,9 @@ sub start_provider( $$$ ) {
     emit "echo \". \${VARDIR}/undo_${table}_routing\" >> \${VARDIR}/undo_routing";
 }
 
-sub add_a_provider( ) {
+sub add_a_provider( $ ) {
+
+    my $tcdevices = shift;
 
     my ($table, $number, $mark, $duplicate, $interface, $gateway,  $options, $copy ) = split_line 6, 8, 'providers file';
 
@@ -290,7 +292,8 @@ sub add_a_provider( ) {
     fatal_error "A bridge port ($interface) may not be configured as a provider interface" if port_to_bridge $interface;
 
     my $physical    = get_physical $interface;
-    my $base        = uc chain_base $physical;
+    my $dev         = chain_base $physical;
+    my $base        = uc $dev;
     my $gatewaycase = '';
 
     if ( $gateway eq 'detect' ) {
@@ -545,6 +548,7 @@ sub add_a_provider( ) {
 
     emit "\nadd_${table}_routing_rules";
     emit "add_${table}_routes";
+    emit "setup_${dev}_tc" if $tcdevices->{$interface};
 
     emit( '',
 	  'if [ $COMMAND = enable ]; then'
@@ -594,7 +598,7 @@ sub add_a_provider( ) {
 
     pop_indent;
 
-    emit "} # End of start_provider_$table()";
+    emit '}'; # End of start_provider_$table();
 
     if ( $optional ) {
 	emit( '',
@@ -894,14 +898,16 @@ sub finish_providers() {
     }
 }
 
-sub process_providers() {
+sub process_providers( $ ) {
+    my $tcdevices = shift;
+
     our $providers = 0;
 
     $lastmark = 0;
 
     if ( my $fn = open_file 'providers' ) {
 	first_entry "$doing $fn..."; 
-	add_a_provider, $providers++ while read_a_line;
+	add_a_provider( $tcdevices ), $providers++ while read_a_line;
     }
 
     if ( $providers ) {

Shorewall/Perl/Shorewall/Tc.pm

@@ -38,7 +38,7 @@ use Shorewall::Providers;
 use strict;
 
 our @ISA = qw(Exporter);
-our @EXPORT = qw( setup_tc );
+our @EXPORT = qw( process_tc setup_tc );
 our @EXPORT_OK = qw( process_tc_rule initialize );
 our $VERSION = 'MODULEVERSION';
 
@@ -152,7 +152,7 @@ my  $ipp2p;
 #                                                  guarantee => <sum of rates of sub-classes>
 #                                                  options   => { tos  => [ <value1> , <value2> , ... ];
 #                                                  tcp_ack   => 1 ,
-#                                                  ...
+#                                                  filters   => [ filter list ]
 #                                                }
 #                                     }
 #             }
@@ -504,6 +504,8 @@ sub process_simple_device() {
     my $physical = physical_name $device;
     my $dev      = chain_base( $physical );
 
+    push @tcdevices, $device;
+
     if ( $type ne '-' ) {
 	if ( lc $type eq 'external' ) {
 	    $type = 'nfct-src';
@@ -530,6 +532,15 @@ sub process_simple_device() {
 	$in_bandwidth = rate_to_kbit( $in_bandwidth );
     }
 
+    emit( '',
+	  '#',
+	  "# Setup Simple Traffic Shaping for $physical",
+	  '#',
+	  "setup_${dev}_tc() {"
+	);
+
+    push_indent;
+
     emit "if interface_is_up $physical; then";
 
     push_indent;
@@ -607,7 +618,9 @@ sub process_simple_device() {
     emit qq(error_message "WARNING: Device $physical is not in the UP state -- traffic-shaping configuration skipped");
     emit "${dev}_exists=";
     pop_indent;
-    emit "fi\n";
+    emit 'fi';
+    pop_indent;
+    emit "}\n";
 
     progress_message "  Simple tcdevice \"$currentline\" $done.";
 }
@@ -711,7 +724,8 @@ sub validate_tc_device( ) {
 			    qdisc         => $qdisc,
 			    guarantee     => 0,
 			    name          => $device,
-			    physical      => physical_name $device
+			    physical      => physical_name $device,
+			    filters       => []
 			  } ,
 
     push @tcdevices, $device;
@@ -1018,6 +1032,8 @@ sub process_tc_filter() {
 
     my $tcref = $tcclasses{$device};
 
+    my $filtersref = $devref->{filters};
+
     fatal_error "No Classes were defined for INTERFACE $device" unless $tcref;
 
     my $classnum = hex_value $class;
@@ -1036,17 +1052,6 @@ sub process_tc_filter() {
 
     my $have_rule = 0;
 
-    if ( $devref->{physical} ne $lastdevice ) {
-	if ( $lastdevice ) {
-	    pop_indent;
-	    emit "fi\n";
-	}
-
-	$lastdevice = $devref->{physical};
-	emit "if interface_is_up $lastdevice; then";
-	push_indent;
-    }
-
     my $rule = "filter add dev $devref->{physical} protocol $ip parent $devnum:0 prio $prio u32";
 
     if ( $source ne '-' ) {
@@ -1101,7 +1106,7 @@ sub process_tc_filter() {
 
     if ( $portlist eq '-' && $sportlist eq '-' ) {
 	if ( $have_rule ) {
-	    emit( "\nrun_tc $rule\\" ,
+	    push @$filtersref , ( "\nrun_tc $rule\\" ,
 				  "   flowid $devnum:$class" ,
 				  '' );
 	} else {
@@ -1129,16 +1134,16 @@ sub process_tc_filter() {
 	    $lasttnum = $tnum;
 	    $lastrule = $rule;
 
-	    emit( "\nrun_tc filter add dev $devref->{physical} parent $devnum:0 protocol $ip prio $prio handle $tnum: u32 divisor 1" );
+	    push @$filtersref, ( "\nrun_tc filter add dev $devref->{physical} parent $devnum:0 protocol $ip prio $prio handle $tnum: u32 divisor 1" );
 	}
 	#
 	# And link to it using the current contents of $rule
 	#
 	if ( $family == F_IPV4 ) {
-	    emit( "\nrun_tc $rule\\" ,
+	    push @$filtersref, ( "\nrun_tc $rule\\" ,
 				 "   link $tnum:0 offset at 0 mask 0x0F00 shift 6 plus 0 eat" );
 	} else {
-	    emit( "\nrun_tc $rule\\" ,
+	    push @$filtersref, ( "\nrun_tc $rule\\" ,
 				 "   link $tnum:0 offset plus 40 eat" );
 	}    
 	#
@@ -1165,7 +1170,7 @@ sub process_tc_filter() {
 			$rule1 = "match u32 0x${sport}0000 0x${smask}0000 at nexthdr+0" ,
 		    }
 
-		    emit( "\nrun_tc $rule\\" ,
+		    push @$filtersref, ( "\nrun_tc $rule\\" ,
 					 "   $rule1\\" ,
 					 "   flowid $devnum:$class" );
 		}
@@ -1183,7 +1188,7 @@ sub process_tc_filter() {
 
 		    my $rule1 = "   match icmp type $icmptype 0xff";
 		    $rule1   .= "\\\n   match icmp code $icmpcode 0xff" if defined $icmpcode;
-		    emit( "\nrun_tc ${rule}\\" ,
+		    push @$filtersref, ( "\nrun_tc ${rule}\\" ,
 					 "$rule1\\" ,
 					 "   flowid $devnum:$class" );
 		} elsif ( $protonumber == IPv6_ICMP ) {
@@ -1194,7 +1199,7 @@ sub process_tc_filter() {
 
 		    my $rule1 = "   match icmp6 type $icmptype 0xff";
 		    $rule1   .= "\\\n   match icmp6 code $icmpcode 0xff" if defined $icmpcode;
-		    emit( "\nrun_tc ${rule}\\" ,
+		    push @$filtersref, ( "\nrun_tc ${rule}\\" ,
 					 "$rule1\\" ,
 					 "   flowid $devnum:$class" );
 		} else {
@@ -1214,7 +1219,7 @@ sub process_tc_filter() {
 			}
 
 			if ( $sportlist eq '-' ) {
-			    emit( "\nrun_tc ${rule}\\" ,
+			    push @$filtersref, ( "\nrun_tc ${rule}\\" ,
 						 "   $rule1\\" ,
 						 "   flowid $devnum:$class" );
 			} else {
@@ -1234,7 +1239,7 @@ sub process_tc_filter() {
 					$rule2 = "match u32 0x${sport}0000 0x${smask}0000 at nexthdr+0" ,
 				    }
 
-				    emit( "\nrun_tc ${rule}\\",
+				    push @$filtersref, ( "\nrun_tc ${rule}\\",
 							 "   $rule1\\" ,
 							 "   $rule2\\" ,
 							 "   flowid $devnum:$class" );
@@ -1272,8 +1277,6 @@ sub process_tcfilters() {
 
     my $fn = open_file 'tcfilters';
 
-    our $lastdevice = '';
-
     if ( $fn ) {
 	my @family = ( $family );
 	
@@ -1301,12 +1304,6 @@ sub process_tcfilters() {
 	}
 
 	Shorewall::IPAddrs::initialize( $family = pop @family );
-
-	if ( $lastdevice ) {
-	    pop_indent;
-	    emit "fi\n";
-	}
-
     }
 }
 
@@ -1371,10 +1368,9 @@ sub process_tc_priority() {
     }
 }
 
-sub setup_simple_traffic_shaping() {
+sub process_simple_traffic_shaping() {
-    my $interfaces;
 
-    save_progress_message q("Setting up Traffic Control...");
+    my $interfaces;
 
     my $fn = open_file 'tcinterfaces';
 
@@ -1413,10 +1409,7 @@ sub setup_simple_traffic_shaping() {
     }
 }
 
-sub setup_traffic_shaping() {
+sub process_traffic_shaping() {
-    our $lastrule = '';
-
-    save_progress_message q("Setting up Traffic Control...");
 
     my $fn = open_file 'tcdevices';
 
@@ -1426,9 +1419,6 @@ sub setup_traffic_shaping() {
 	validate_tc_device while read_a_line;
     }
 
-    my $sfq = 0;
-    my $sfqinhex;
-
     $devnum = $devnum > 10 ? 10 : 1;
 
     $fn = open_file 'tcclasses';
@@ -1439,6 +1429,11 @@ sub setup_traffic_shaping() {
 	validate_tc_class while read_a_line;
     }
 
+    process_tcfilters;
+
+    my $sfq = 0;
+    my $sfqinhex;
+
     for my $device ( @tcdevices ) {
 	my $devref  = $tcdevices{$device};
 	my $defmark = in_hexp ( $devref->{default} || 0 );
@@ -1451,6 +1446,14 @@ sub setup_traffic_shaping() {
 
 	my $dev = chain_base( $device );
 
+	emit( '',
+	      '#',
+	      "# Configure Traffic Shaping for $device",
+	      '#',
+	      "setup_${dev}_tc() {" );
+
+	push_indent;
+
 	unless ( $config{TC_ENABLED} eq 'Shared' ) {
 
 	    emit "if interface_is_up $device; then";
@@ -1500,31 +1503,17 @@ sub setup_traffic_shaping() {
 		emit( "run_tc filter add dev $rdev parent ffff: protocol all u32 match u32 0 0 action mirred egress redirect dev $device > /dev/null" );
 	    }
 
-	    save_progress_message_short qq("   TC Device $device defined.");
-
-	    pop_indent;
-	    emit 'else';
-	    push_indent;
-
-	    emit qq(error_message "WARNING: Device $device is not in the UP state -- traffic-shaping configuration skipped");
-	    emit "${dev}_exists=";
-	    pop_indent;
-	    emit "fi\n";
-	}
-    }
-
-    my $lastdevice = '';
-
 	    for my $class ( @tcclasses ) {
 		#
 		# The class number in the tcclasses array is expressed in decimal.
 		#
-	my ( $device, $decimalclassnum ) = split /:/, $class;
+		my ( $d, $decimalclassnum ) = split /:/, $class;
+
+		next unless $d eq $device;
 		#
 		# For inclusion in 'tc' commands, we also need the hex representation
 		#
 		my $classnum = in_hexp $decimalclassnum;
-	my $devref   = $tcdevices{$device};
 		#
 		# The decimal value of the class number is also used as the key for the hash at $tcclasses{$device}
 		#
@@ -1538,22 +1527,9 @@ sub setup_traffic_shaping() {
 		$classids{$classid}=$device;
 		$device = physical_name $device;
 
-	unless ( $config{TC_ENABLED} eq 'Shared' ) {
-	    my $dev      = chain_base $device;
 		my $priority = $tcref->{priority} << 8;
 		my $parent   = in_hexp $tcref->{parent};
 		
-	    if ( $lastdevice ne $device ) {
-		if ( $lastdevice ) {
-		    pop_indent;
-		    emit "fi\n";
-		}
-
-		emit qq(if [ -n "\$${dev}_exists" ]; then);
-		push_indent;
-		$lastdevice = $device;
-	    }
-
 		emit ( "[ \$${dev}_mtu -gt $quantum ] && quantum=\$${dev}_mtu || quantum=$quantum" );
 
 		if ( $devref->{qdisc} eq 'htb' ) {
@@ -1601,15 +1577,54 @@ sub setup_traffic_shaping() {
 		emit '';
 
 	    }
-
 	}
 
-    if ( $lastdevice ) {
+	emit '';
+
+	emit "$_" for @{$devref->{filters}};
+	
+	save_progress_message_short qq("   TC Device $device defined.");
+
+	pop_indent;
+	emit 'else';
+	push_indent;
+
+	emit qq(error_message "WARNING: Device $device is not in the UP state -- traffic-shaping configuration skipped");
+	emit "${dev}_exists=";
 	pop_indent;
 	emit "fi\n";
+
+	pop_indent;
+	emit "}\n";
+    }
 }
 
-    process_tcfilters;
+#
+# Validate the TC configuration storing basic information in %tcdevices
+#
+sub process_tc() {
+    if ( $config{TC_ENABLED} eq 'Internal' || $config{TC_ENABLED} eq 'Shared' ) {
+	process_traffic_shaping;
+    } elsif ( $config{TC_ENABLED} eq 'Simple' ) {
+	process_simple_traffic_shaping;
+    }
+    #
+    # The Providers module needs to know which devices are tc-enabled so that
+    # it can call the appropriate 'setup_x_tc" function when the device is
+    # enabled.
+
+    \%tcdevices;
+}
+
+sub setup_traffic_shaping() {
+    save_progress_message q("Setting up Traffic Control...");
+
+    for my $device ( @tcdevices ) {
+	my $interfaceref = find_interface( $device );
+	my $dev          = chain_base $interfaceref->{physical};
+
+	emit "setup_${dev}_tc";
+    }
 }
 
 #
@@ -1723,10 +1738,8 @@ sub setup_tc() {
     if ( $globals{TC_SCRIPT} ) {
 	save_progress_message q('Setting up Traffic Control...');
 	append_file $globals{TC_SCRIPT};
-    } elsif ( $config{TC_ENABLED} eq 'Internal' || $config{TC_ENABLED} eq 'Shared' ) {
+    } else {
 	setup_traffic_shaping;
-    } elsif ( $config{TC_ENABLED} eq 'Simple' ) {
-	setup_simple_traffic_shaping;
     }
 
     if ( $config{TC_ENABLED} ) {