holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Simplify detection of action self-invocation

Browse Source
This commit is contained in:
Tom Eastep 2010-12-25 08:10:23 -08:00
parent 6240d41754
commit 1285b73d52
1 changed files with 25 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -297,6 +297,8 @@ sub process_actions1() {
new_action $action; new_action $action;
$targets{$action} = ACTION;
my $actionfile = find_file "action.$action"; my $actionfile = find_file "action.$action";
fatal_error "Missing Action File ($actionfile)" unless -f $actionfile; fatal_error "Missing Action File ($actionfile)" unless -f $actionfile;
@ -304,12 +306,7 @@ sub process_actions1() {
progress_message2 " Pre-processing $actionfile..."; progress_message2 " Pre-processing $actionfile...";
push_open( $actionfile ); push_open( $actionfile );
#
# We defer assigning a type to the action until we've processed it's action file.
# This allows us to easily catch the case where an action invokes itself.
#
my $actiontype = 0;
while ( read_a_line ) { while ( read_a_line ) {
my ($wholetarget, @rest ) = split_line1 1, 13, 'action file' , $rule_commands; my ($wholetarget, @rest ) = split_line1 1, 13, 'action file' , $rule_commands;
@ -318,32 +315,26 @@ sub process_actions1() {
# deals with the target and the parameter. We pass undef for the rest so we'll # deals with the target and the parameter. We pass undef for the rest so we'll
# know if we try to use one of them. # know if we try to use one of them.
# #
# process_rule_common() returns the NATONLY actiontype flag if the target process_rule_common( $action ,
# of the rule includes NATRULE, NATONLY or NONAT. The flag is LORed into the $wholetarget ,
# action's type below. '' , # Current Param
# undef, # source
$actiontype |= process_rule_common( $action , undef, # dest
$wholetarget , undef, # proto
'' , # Current Param undef, # ports
undef, # source undef, # sports
undef, # dest undef, # origdest
undef, # proto undef, # ratelimit
undef, # ports undef, # user
undef, # sports undef, # mark
undef, # origdest undef, # connlimit
undef, # ratelimit undef, # time
undef, # user undef, # headers
undef, # mark undef # wildcard
undef, # connlimit ) unless $wholetarget eq 'FORMAT' || $wholetarget eq 'COMMENT';
undef, # time
undef, # headers
undef # wildcard
) unless $wholetarget eq 'FORMAT' || $wholetarget eq 'COMMENT';
} }
pop_open; pop_open;
$targets{$action} = ACTION | $actiontype;
} }
} }
} }
@ -839,6 +830,7 @@ sub process_rule_common ( $$$$$$$$$$$$$$$$ ) {
$normalized_target = normalize_action( $basictarget, $loglevel, $param ); $normalized_target = normalize_action( $basictarget, $loglevel, $param );
if ( $inaction1 ) { if ( $inaction1 ) {
fatal_error "An action may not invoke itself" if $basictarget eq $inaction1;
add_requiredby( $normalized_target , $inaction1 ); add_requiredby( $normalized_target , $inaction1 );
} else { } else {
if ( my $ref = use_action( $normalized_target ) ) { if ( my $ref = use_action( $normalized_target ) ) {
@ -847,11 +839,10 @@ sub process_rule_common ( $$$$$$$$$$$$$$$$ ) {
} }
} }
# if ( $inaction1 ) {
# Return the NATRULE flag to the caller who will eventually add it $targets{$inaction1} |= NATRULE if $actiontype & (NATRULE | NONAT | NATONLY );
# to $targets{$inaction1} return 1;
# }
return ( $actiontype & ( NATRULE | NONAT | NATONLY ) ) ? NATRULE : 0 if $inaction1;
# #
# Take care of irregular syntax and targets # Take care of irregular syntax and targets
# #