Merge branch 'EdW'

Shorewall/Perl/Shorewall/Compiler.pm

@@ -38,6 +38,8 @@ use Shorewall::IPAddrs;
 use Shorewall::Raw;
 use Shorewall::Misc;
 
+use strict;
+
 our @ISA = qw(Exporter);
 our @EXPORT = qw( compiler );
 our @EXPORT_OK = qw( $export );
@@ -705,9 +707,13 @@ sub compiler {
     #
     enable_script;
     #
+    # Validate the TC files so that the providers will know what interfaces have TC
+    #
+    my $tcinterfaces = process_tc;
+    #
     # Generate a function to bring up each provider
     #
-    process_providers;
+    process_providers( $tcinterfaces );
     #
     # [Re-]establish Routing
     #

Shorewall/Perl/Shorewall/Proc.pm

@@ -40,7 +40,7 @@ our @EXPORT = qw(
 		 setup_source_routing
 		 setup_forwarding
 		 );
-our @EXPORT_OK = qw( );
+our @EXPORT_OK = qw( setup_interface_proc );
 our $VERSION = 'MODULEVERSION';
 
 #
@@ -277,4 +277,45 @@ sub setup_forwarding( $$ ) {
     }
 }
 
+sub setup_interface_proc( $ ) {
+    my $interface = shift;
+    my $physical  = get_physical $interface;
+    my $value;
+    my @emitted;
+
+    if ( interface_has_option( $interface, 'arp_filter' , $value ) ) {
+	push @emitted, "echo $value > /proc/sys/net/ipv4/conf/$physical/arp_filter";
+    }
+	 
+    if ( interface_has_option( $interface, 'arp_ignore' , $value ) ) {
+	push @emitted, "echo $value > /proc/sys/net/ipv4/conf/$physical/arp_ignore";
+    }
+
+    if ( interface_has_option( $interface, 'routefilter' , $value ) ) {
+	push @emitted, "echo $value > /proc/sys/net/ipv4/conf/$physical/rp_filter";
+    }
+
+    if ( interface_has_option( $interface, 'logmartians' , $value ) ) {
+	push @emitted, "echo $value > /proc/sys/net/ipv4/conf/$physical/log_martians";
+    }
+
+    if ( interface_has_option( $interface, 'sourceroute' , $value ) ) {
+	push @emitted, "echo $value > /proc/sys/net/ipv4/conf/$physical/accept_source_route";
+    }
+
+    if ( interface_has_option( $interface, 'sourceroute' , $value ) ) {
+	push @emitted, "echo $value > /proc/sys/net/ipv4/conf/$physical/accept_source_route";
+    }
+
+    if ( @emitted ) {
+	emit( '',
+	      'if [ $COMMAND = enable ]; then' );
+	push_indent;
+	emit "$_" for @emitted;
+	pop_indent;
+	emit "fi\n";
+    }
+}
+	 
+
 1;

Shorewall/Perl/Shorewall/Providers.pm

@@ -29,6 +29,7 @@ use Shorewall::Config qw(:DEFAULT :internal);
 use Shorewall::IPAddrs;
 use Shorewall::Zones;
 use Shorewall::Chains qw(:DEFAULT :internal);
+use Shorewall::Proc qw( setup_interface_proc );
 
 use strict;
 
@@ -143,6 +144,8 @@ sub copy_table( $$$ ) {
     #
     my $filter = $family == F_IPV6 ? q(sed 's/ via :: / /' | ) : '';
 
+    emit '';
+
     if ( $realm ) {
 	emit  ( "\$IP -$family -o route show table $duplicate | sed -r 's/ realm [[:alnum:]_]+//' | while read net route; do" )
     } else {
@@ -175,6 +178,8 @@ sub copy_and_edit_table( $$$$ ) {
     #
     $copy =~ s/\+/*/;
     
+    emit '';
+
     if ( $realm ) {
 	emit  ( "\$IP -$family -o route show table $duplicate | sed -r 's/ realm [[:alnum:]]+//' | while read net route; do" )
     } else {
@@ -258,7 +263,9 @@ sub start_provider( $$$ ) {
     emit "echo \". \${VARDIR}/undo_${table}_routing\" >> \${VARDIR}/undo_routing";
 }
 
-sub add_a_provider( ) {
+sub add_a_provider( $ ) {
+
+    my $tcdevices = shift;
 
     my ($table, $number, $mark, $duplicate, $interface, $gateway,  $options, $copy ) = split_line 6, 8, 'providers file';
 
@@ -290,7 +297,8 @@ sub add_a_provider( ) {
     fatal_error "A bridge port ($interface) may not be configured as a provider interface" if port_to_bridge $interface;
 
     my $physical    = get_physical $interface;
-    my $base        = uc chain_base $physical;
+    my $dev         = chain_base $physical;
+    my $base        = uc $dev;
     my $gatewaycase = '';
 
     if ( $gateway eq 'detect' ) {
@@ -438,7 +446,6 @@ sub add_a_provider( ) {
 	} else {
 	    start_provider( $table, $number, "if interface_is_usable $physical; then" );
 	}
-
 	$provider_interfaces{$interface} = $table;
 
 	if ( $gatewaycase eq 'none' ) {
@@ -450,6 +457,8 @@ sub add_a_provider( ) {
 	}
     }
 
+    setup_interface_proc( $interface );
+
     if ( $mark ne '-' ) {
 	my $mask = have_capability 'FWMARK_RT_MASK' ? '/' . in_hex $globals{PROVIDER_MASK} : '';
 
@@ -545,6 +554,7 @@ sub add_a_provider( ) {
 
     emit "\nadd_${table}_routing_rules";
     emit "add_${table}_routes";
+    emit "setup_${dev}_tc" if $tcdevices->{$interface};
 
     emit( '',
 	  'if [ $COMMAND = enable ]; then'
@@ -594,7 +604,7 @@ sub add_a_provider( ) {
 
     pop_indent;
 
-    emit "} # End of start_provider_$table()";
+    emit '}'; # End of start_provider_$table();
 
     if ( $optional ) {
 	emit( '',
@@ -894,14 +904,16 @@ sub finish_providers() {
     }
 }
 
-sub process_providers() {
+sub process_providers( $ ) {
+    my $tcdevices = shift;
+
     our $providers = 0;
 
     $lastmark = 0;
 
     if ( my $fn = open_file 'providers' ) {
 	first_entry "$doing $fn..."; 
-	add_a_provider, $providers++ while read_a_line;
+	add_a_provider( $tcdevices ), $providers++ while read_a_line;
     }
 
     if ( $providers ) {

Shorewall/Perl/Shorewall/Tc.pm

@@ -38,7 +38,7 @@ use Shorewall::Providers;
 use strict;
 
 our @ISA = qw(Exporter);
-our @EXPORT = qw( setup_tc );
+our @EXPORT = qw( process_tc setup_tc );
 our @EXPORT_OK = qw( process_tc_rule initialize );
 our $VERSION = 'MODULEVERSION';
 
@@ -152,7 +152,7 @@ my  $ipp2p;
 #                                                  guarantee => <sum of rates of sub-classes>
 #                                                  options   => { tos  => [ <value1> , <value2> , ... ];
 #                                                  tcp_ack   => 1 ,
-#                                                  ...
+#                                                  filters   => [ filter list ]
 #                                                }
 #                                     }
 #             }
@@ -504,6 +504,8 @@ sub process_simple_device() {
     my $physical = physical_name $device;
     my $dev      = chain_base( $physical );
 
+    push @tcdevices, $device;
+
     if ( $type ne '-' ) {
 	if ( lc $type eq 'external' ) {
 	    $type = 'nfct-src';
@@ -530,6 +532,15 @@ sub process_simple_device() {
 	$in_bandwidth = rate_to_kbit( $in_bandwidth );
     }
 
+    emit( '',
+	  '#',
+	  "# Setup Simple Traffic Shaping for $physical",
+	  '#',
+	  "setup_${dev}_tc() {"
+	);
+
+    push_indent;
+
     emit "if interface_is_up $physical; then";
 
     push_indent;
@@ -607,7 +618,9 @@ sub process_simple_device() {
     emit qq(error_message "WARNING: Device $physical is not in the UP state -- traffic-shaping configuration skipped");
     emit "${dev}_exists=";
     pop_indent;
-    emit "fi\n";
+    emit 'fi';
+    pop_indent;
+    emit "}\n";
 
     progress_message "  Simple tcdevice \"$currentline\" $done.";
 }
@@ -711,7 +724,8 @@ sub validate_tc_device( ) {
 			    qdisc         => $qdisc,
 			    guarantee     => 0,
 			    name          => $device,
-			    physical      => physical_name $device
+			    physical      => physical_name $device,
+			    filters       => []
 			  } ,
 
     push @tcdevices, $device;
@@ -1018,6 +1032,8 @@ sub process_tc_filter() {
 
     my $tcref = $tcclasses{$device};
 
+    my $filtersref = $devref->{filters};
+
     fatal_error "No Classes were defined for INTERFACE $device" unless $tcref;
 
     my $classnum = hex_value $class;
@@ -1036,17 +1052,6 @@ sub process_tc_filter() {
 
     my $have_rule = 0;
 
-    if ( $devref->{physical} ne $lastdevice ) {
-	if ( $lastdevice ) {
-	    pop_indent;
-	    emit "fi\n";
-	}
-
-	$lastdevice = $devref->{physical};
-	emit "if interface_is_up $lastdevice; then";
-	push_indent;
-    }
-
     my $rule = "filter add dev $devref->{physical} protocol $ip parent $devnum:0 prio $prio u32";
 
     if ( $source ne '-' ) {
@@ -1101,7 +1106,7 @@ sub process_tc_filter() {
 
     if ( $portlist eq '-' && $sportlist eq '-' ) {
 	if ( $have_rule ) {
-	    emit( "\nrun_tc $rule\\" ,
+	    push @$filtersref , ( "\nrun_tc $rule\\" ,
 				  "   flowid $devnum:$class" ,
 				  '' );
 	} else {
@@ -1129,16 +1134,16 @@ sub process_tc_filter() {
 	    $lasttnum = $tnum;
 	    $lastrule = $rule;
 
-	    emit( "\nrun_tc filter add dev $devref->{physical} parent $devnum:0 protocol $ip prio $prio handle $tnum: u32 divisor 1" );
+	    push @$filtersref, ( "\nrun_tc filter add dev $devref->{physical} parent $devnum:0 protocol $ip prio $prio handle $tnum: u32 divisor 1" );
 	}
 	#
 	# And link to it using the current contents of $rule
 	#
 	if ( $family == F_IPV4 ) {
-	    emit( "\nrun_tc $rule\\" ,
+	    push @$filtersref, ( "\nrun_tc $rule\\" ,
 				 "   link $tnum:0 offset at 0 mask 0x0F00 shift 6 plus 0 eat" );
 	} else {
-	    emit( "\nrun_tc $rule\\" ,
+	    push @$filtersref, ( "\nrun_tc $rule\\" ,
 				 "   link $tnum:0 offset plus 40 eat" );
 	}    
 	#
@@ -1165,7 +1170,7 @@ sub process_tc_filter() {
 			$rule1 = "match u32 0x${sport}0000 0x${smask}0000 at nexthdr+0" ,
 		    }
 
-		    emit( "\nrun_tc $rule\\" ,
+		    push @$filtersref, ( "\nrun_tc $rule\\" ,
 					 "   $rule1\\" ,
 					 "   flowid $devnum:$class" );
 		}
@@ -1183,7 +1188,7 @@ sub process_tc_filter() {
 
 		    my $rule1 = "   match icmp type $icmptype 0xff";
 		    $rule1   .= "\\\n   match icmp code $icmpcode 0xff" if defined $icmpcode;
-		    emit( "\nrun_tc ${rule}\\" ,
+		    push @$filtersref, ( "\nrun_tc ${rule}\\" ,
 					 "$rule1\\" ,
 					 "   flowid $devnum:$class" );
 		} elsif ( $protonumber == IPv6_ICMP ) {
@@ -1194,7 +1199,7 @@ sub process_tc_filter() {
 
 		    my $rule1 = "   match icmp6 type $icmptype 0xff";
 		    $rule1   .= "\\\n   match icmp6 code $icmpcode 0xff" if defined $icmpcode;
-		    emit( "\nrun_tc ${rule}\\" ,
+		    push @$filtersref, ( "\nrun_tc ${rule}\\" ,
 					 "$rule1\\" ,
 					 "   flowid $devnum:$class" );
 		} else {
@@ -1214,7 +1219,7 @@ sub process_tc_filter() {
 			}
 
 			if ( $sportlist eq '-' ) {
-			    emit( "\nrun_tc ${rule}\\" ,
+			    push @$filtersref, ( "\nrun_tc ${rule}\\" ,
 						 "   $rule1\\" ,
 						 "   flowid $devnum:$class" );
 			} else {
@@ -1234,7 +1239,7 @@ sub process_tc_filter() {
 					$rule2 = "match u32 0x${sport}0000 0x${smask}0000 at nexthdr+0" ,
 				    }
 
-				    emit( "\nrun_tc ${rule}\\",
+				    push @$filtersref, ( "\nrun_tc ${rule}\\",
 							 "   $rule1\\" ,
 							 "   $rule2\\" ,
 							 "   flowid $devnum:$class" );
@@ -1268,12 +1273,13 @@ sub process_tc_filter() {
 
 }
 
+#
+# Process the tcfilter file storing the compiled filters in the %tcdevices table
+#
 sub process_tcfilters() {
 
     my $fn = open_file 'tcfilters';
 
-    our $lastdevice = '';
-
     if ( $fn ) {
 	my @family = ( $family );
 	
@@ -1301,15 +1307,12 @@ sub process_tcfilters() {
 	}
 
 	Shorewall::IPAddrs::initialize( $family = pop @family );
-
-	if ( $lastdevice ) {
-	    pop_indent;
-	    emit "fi\n";
-	}
-
     }
 }
 
+#
+# Process a tcpri record
+#
 sub process_tc_priority() {
     my ( $band, $proto, $ports , $address, $interface, $helper ) = split_line1 1, 6, 'tcpri';
 
@@ -1371,27 +1374,31 @@ sub process_tc_priority() {
     }
 }
 
-sub setup_simple_traffic_shaping() {
+#
-    my $interfaces;
+# Process tcinterfaces
-
+#
-    save_progress_message q("Setting up Traffic Control...");
+sub process_tcinterfaces() {
 
     my $fn = open_file 'tcinterfaces';
 
     if ( $fn ) {
 	first_entry "$doing $fn...";
-	process_simple_device, $interfaces++ while read_a_line;
+	process_simple_device while read_a_line;
-    } else {
-	$fn = find_file 'tcinterfaces';
     }
+}
 
+#
+# Process tcpri
+#
+sub process_tcpri() {
+    my $fn  = find_file 'tcinterfaces';
     my $fn1 = open_file 'tcpri';
 
     if ( $fn1 ) {
 	first_entry
 	    sub {
 		progress_message2 "$doing $fn1...";
-		warning_message "There are entries in $fn1 but $fn was empty" unless $interfaces || $family == F_IPV6;
+		warning_message "There are entries in $fn1 but $fn was empty" unless @tcdevices || $family == F_IPV6;
 	    };
 
 	process_tc_priority while read_a_line;
@@ -1413,10 +1420,10 @@ sub setup_simple_traffic_shaping() {
     }
 }
 
-sub setup_traffic_shaping() {
+#
-    our $lastrule = '';
+# Process the compilex traffic shaping files storing the configuration in %tcdevices and %tcclasses
-
+#
-    save_progress_message q("Setting up Traffic Control...");
+sub process_traffic_shaping() {
 
     my $fn = open_file 'tcdevices';
 
@@ -1426,9 +1433,6 @@ sub setup_traffic_shaping() {
 	validate_tc_device while read_a_line;
     }
 
-    my $sfq = 0;
-    my $sfqinhex;
-
     $devnum = $devnum > 10 ? 10 : 1;
 
     $fn = open_file 'tcclasses';
@@ -1439,6 +1443,11 @@ sub setup_traffic_shaping() {
 	validate_tc_class while read_a_line;
     }
 
+    process_tcfilters;
+
+    my $sfq = 0;
+    my $sfqinhex;
+
     for my $device ( @tcdevices ) {
 	my $devref  = $tcdevices{$device};
 	my $defmark = in_hexp ( $devref->{default} || 0 );
@@ -1451,6 +1460,14 @@ sub setup_traffic_shaping() {
 
 	my $dev = chain_base( $device );
 
+	emit( '',
+	      '#',
+	      "# Configure Traffic Shaping for $device",
+	      '#',
+	      "setup_${dev}_tc() {" );
+
+	push_indent;
+
 	unless ( $config{TC_ENABLED} eq 'Shared' ) {
 
 	    emit "if interface_is_up $device; then";
@@ -1500,31 +1517,17 @@ sub setup_traffic_shaping() {
 		emit( "run_tc filter add dev $rdev parent ffff: protocol all u32 match u32 0 0 action mirred egress redirect dev $device > /dev/null" );
 	    }
 
-	    save_progress_message_short qq("   TC Device $device defined.");
-
-	    pop_indent;
-	    emit 'else';
-	    push_indent;
-
-	    emit qq(error_message "WARNING: Device $device is not in the UP state -- traffic-shaping configuration skipped");
-	    emit "${dev}_exists=";
-	    pop_indent;
-	    emit "fi\n";
-	}
-    }
-
-    my $lastdevice = '';
-
 	    for my $class ( @tcclasses ) {
 		#
 		# The class number in the tcclasses array is expressed in decimal.
 		#
-	my ( $device, $decimalclassnum ) = split /:/, $class;
+		my ( $d, $decimalclassnum ) = split /:/, $class;
+
+		next unless $d eq $device;
 		#
 		# For inclusion in 'tc' commands, we also need the hex representation
 		#
 		my $classnum = in_hexp $decimalclassnum;
-	my $devref   = $tcdevices{$device};
 		#
 		# The decimal value of the class number is also used as the key for the hash at $tcclasses{$device}
 		#
@@ -1538,22 +1541,9 @@ sub setup_traffic_shaping() {
 		$classids{$classid}=$device;
 		$device = physical_name $device;
 
-	unless ( $config{TC_ENABLED} eq 'Shared' ) {
-	    my $dev      = chain_base $device;
 		my $priority = $tcref->{priority} << 8;
 		my $parent   = in_hexp $tcref->{parent};
 		
-	    if ( $lastdevice ne $device ) {
-		if ( $lastdevice ) {
-		    pop_indent;
-		    emit "fi\n";
-		}
-
-		emit qq(if [ -n "\$${dev}_exists" ]; then);
-		push_indent;
-		$lastdevice = $device;
-	    }
-
 		emit ( "[ \$${dev}_mtu -gt $quantum ] && quantum=\$${dev}_mtu || quantum=$quantum" );
 
 		if ( $devref->{qdisc} eq 'htb' ) {
@@ -1601,15 +1591,58 @@ sub setup_traffic_shaping() {
 		emit '';
 
 	    }
-
 	}
 
-    if ( $lastdevice ) {
+	emit '';
+
+	emit "$_" for @{$devref->{filters}};
+	
+	save_progress_message_short qq("   TC Device $device defined.");
+
+	pop_indent;
+	emit 'else';
+	push_indent;
+
+	emit qq(error_message "WARNING: Device $device is not in the UP state -- traffic-shaping configuration skipped");
+	emit "${dev}_exists=";
 	pop_indent;
 	emit "fi\n";
+
+	pop_indent;
+	emit "}\n";
+    }
+}
+
+#
+# Validate the TC configuration storing basic information in %tcdevices and %tcdevices
+#
+sub process_tc() {
+    if ( $config{TC_ENABLED} eq 'Internal' || $config{TC_ENABLED} eq 'Shared' ) {
+	process_traffic_shaping;
+    } elsif ( $config{TC_ENABLED} eq 'Simple' ) {
+	process_tcinterfaces;
+    }
+    #
+    # The Providers module needs to know which devices are tc-enabled so that
+    # it can call the appropriate 'setup_x_tc" function when the device is
+    # enabled.
+
+    \%tcdevices;
+}
+
+#
+# Call the setup_${dev}_tc functions
+#
+sub setup_traffic_shaping() {
+    save_progress_message q("Setting up Traffic Control...");
+
+    for my $device ( @tcdevices ) {
+	my $interfaceref = known_interface( $device );
+	my $dev          = chain_base( $interfaceref ? $interfaceref->{physical} : $device );
+
+	emit "setup_${dev}_tc";
     }
 
-    process_tcfilters;
 }
 
 #
@@ -1723,10 +1756,9 @@ sub setup_tc() {
     if ( $globals{TC_SCRIPT} ) {
 	save_progress_message q('Setting up Traffic Control...');
 	append_file $globals{TC_SCRIPT};
-    } elsif ( $config{TC_ENABLED} eq 'Internal' || $config{TC_ENABLED} eq 'Shared' ) {
+    } else {
+	process_tcpri if $config{TC_ENABLED} eq 'Simple';
 	setup_traffic_shaping;
-    } elsif ( $config{TC_ENABLED} eq 'Simple' ) {
-	setup_simple_traffic_shaping;
     }
 
     if ( $config{TC_ENABLED} ) {

Shorewall/Perl/Shorewall/Zones.pm

@@ -73,6 +73,7 @@ our @EXPORT = qw( NOTHING
 		  find_interfaces_by_option
 		  find_interfaces_by_option1
 		  get_interface_option
+		  interface_has_option
 		  set_interface_option
 		  interface_zones
 		  verify_required_interfaces
@@ -1409,6 +1410,22 @@ sub get_interface_option( $$ ) {
     
 }
 
+#
+# Return the value of an option for an interface
+#
+sub interface_has_option( $$\$ ) {
+    my ( $interface, $option, $value ) = @_;
+
+    my $ref = $interfaces{$interface};
+
+    $ref = known_interface( $interface ) unless $ref;
+
+    if ( exists $ref->{options}{$option} ) {
+	$$value = $ref->{options}{$option};
+	1;
+    }
+}
+
 #
 # Set an option for an interface
 #