holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Drop chain-ending rules whose target is 'RETURN'.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2013-01-25 14:03:04 -08:00
parent b7273d6999
commit b8cc9c5a6a
1 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -2961,6 +2961,7 @@ sub optimize_level4( $$ ) {
# A chain with a single 'RETURN' rule -- get rid of it # A chain with a single 'RETURN' rule -- get rid of it
# #
delete_chain_and_references( $chainref ); delete_chain_and_references( $chainref );
$progress = 1;
} else { } else {
# #
# Replace all references to this chain with references to the target # Replace all references to this chain with references to the target
@ -2969,10 +2970,13 @@ sub optimize_level4( $$ ) {
$progress = 1; $progress = 1;
} }
} elsif ( $firstrule->{target} ) { } elsif ( $firstrule->{target} ) {
if ( $firstrule->{target} eq 'RETURN' ) {
# #
# Not so easy -- the rule contains matches # A chain with a single 'RETURN' rule -- get rid of it
# #
if ( $chainref->{builtin} || ! $globals{KLUDGEFREE} || $firstrule->{policy} ) { delete_chain_and_references( $chainref );
$progress = 1;
} elsif ( $chainref->{builtin} || ! $globals{KLUDGEFREE} || $firstrule->{policy} ) {
# #
# This case requires a new rule merging algorithm. Ignore this chain for # This case requires a new rule merging algorithm. Ignore this chain for
# now on. # now on.
@ -2992,6 +2996,15 @@ sub optimize_level4( $$ ) {
# #
my $rulesref = $chainref->{rules}; my $rulesref = $chainref->{rules};
if ( ( $lastref->{target} || '' ) eq 'RETURN' ) {
#
# The last rule is a RETURN -- get rid of it
#
pop @$rulesref;
$lastref = $rulesref->[-1];
$progress = 1;
}
if ( $lastref->{simple} && $lastref->{target} && ! $lastref->{targetopts} ) { if ( $lastref->{simple} && $lastref->{target} && ! $lastref->{targetopts} ) {
my $target = $lastref->{target}; my $target = $lastref->{target};
my $count = 0; my $count = 0;