holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Don't emit degenerate tcfilters

Browse Source
This commit is contained in:
Tom Eastep
2011-05-15 09:15:52 -07:00
parent 6f0591f68c
commit b776668fe9
1 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
Shorewall/Perl/Shorewall/Tc.pm
View File

@ -863,6 +863,7 @@ sub validate_tc_class( ) {
$dmax = convert_delay( $dmax ); $dmax = convert_delay( $dmax );
$umax = convert_size( $umax ); $umax = convert_size( $umax );
fatal_error "DMAX must be specified when UMAX is specified" if $umax && ! $dmax; fatal_error "DMAX must be specified when UMAX is specified" if $umax && ! $dmax;
$parentclass ||= 1;
} else { } else {
$rate = convert_rate ( $ratemax, $rate, 'RATE' , $ratename ); $rate = convert_rate ( $ratemax, $rate, 'RATE' , $ratename );
} }
@ -1022,6 +1023,8 @@ sub process_tc_filter() {
return; return;
} }
my $have_rule = 0;
if ( $devref->{physical} ne $lastdevice ) { if ( $devref->{physical} ne $lastdevice ) {
if ( $lastdevice ) { if ( $lastdevice ) {
pop_indent; pop_indent;
@ -1038,11 +1041,13 @@ sub process_tc_filter() {
if ( $source ne '-' ) { if ( $source ne '-' ) {
my ( $net , $mask ) = decompose_net( $source ); my ( $net , $mask ) = decompose_net( $source );
$rule .= "\\\n match $ip32 src $net/$mask"; $rule .= "\\\n match $ip32 src $net/$mask";
$have_rule = 1;
} }
if ( $dest ne '-' ) { if ( $dest ne '-' ) {
my ( $net , $mask ) = decompose_net( $dest ); my ( $net , $mask ) = decompose_net( $dest );
$rule .= "\\\n match $ip32 dst $net/$mask"; $rule .= "\\\n match $ip32 dst $net/$mask";
$have_rule = 1;
} }
if ( $tos ne '-' ) { if ( $tos ne '-' ) {
@ -1061,6 +1066,7 @@ sub process_tc_filter() {
} }
$rule .= "\\\n match $ip32 tos $tosval $mask"; $rule .= "\\\n match $ip32 tos $tosval $mask";
$have_rule = 1;
} }
if ( $length ne '-' ) { if ( $length ne '-' ) {
@ -1068,6 +1074,7 @@ sub process_tc_filter() {
my $mask = $validlengths{$len}; my $mask = $validlengths{$len};
fatal_error "Invalid LENGTH ($length)" unless $mask; fatal_error "Invalid LENGTH ($length)" unless $mask;
$rule .="\\\n match u16 0x0000 $mask at $lo"; $rule .="\\\n match u16 0x0000 $mask at $lo";
$have_rule = 1;
} }
my $protonumber = 0; my $protonumber = 0;
@ -1075,13 +1082,20 @@ sub process_tc_filter() {
unless ( $proto eq '-' ) { unless ( $proto eq '-' ) {
$protonumber = resolve_proto $proto; $protonumber = resolve_proto $proto;
fatal_error "Unknown PROTO ($proto)" unless defined $protonumber; fatal_error "Unknown PROTO ($proto)" unless defined $protonumber;
$rule .= "\\\n match $ip32 protocol $protonumber 0xff" if $protonumber; if ( $protonumber ) {
$rule .= "\\\n match $ip32 protocol $protonumber 0xff";
$have_rule = 1;
}
} }
if ( $portlist eq '-' && $sportlist eq '-' ) { if ( $portlist eq '-' && $sportlist eq '-' ) {
emit( "\nrun_tc $rule\\" , if ( $have_rule ) {
" flowid $devnum:$class" , emit( "\nrun_tc $rule\\" ,
'' ); " flowid $devnum:$class" ,
'' );
} else {
warning_message "Degenerate tcfilter ignored";
}
} else { } else {
fatal_error "Ports may not be specified without a PROTO" unless $protonumber; fatal_error "Ports may not be specified without a PROTO" unless $protonumber;
our $lastrule; our $lastrule;