holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Some more micro-optimizations

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@5697 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2007-03-26 02:53:51 +00:00
parent 377b23e183
commit da9c54a426
3 changed files with 123 additions and 124 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
New/Shorewall/Common.pm
View File

@ -37,7 +37,8 @@ our @EXPORT = qw(ALLIPv4
split_line
create_temp_object
finalize_object
emit
emit
emitj
emit_unindented
emit_as_is
save_progress_message
@ -179,6 +180,18 @@ sub emit ( $ ) {
}
}
sub emitj {
if ( $object ) {
#
# 'compile' as opposed to 'check'
#
for my $line ( @_ ) {
emit $line;
}
}
}
#
# Write passed message to the object with no indentation.
#

107
New/Shorewall/Providers.pm
View File

@ -100,21 +100,20 @@ sub setup_providers() {
$match =~ s/ /\|/g;
emit join ( "\n",
"ip route show table $duplicate | while read net route; do",
' case $net in',
' default|nexthop)',
' ;;',
' *)',
" run_ip route add table $number \$net \$route",
' case $(find_device $route) in',
" $match)",
" run_ip route add table $number \$net \$route",
' ;;',
' esac',
' ;;',
' esac',
"done\n" );
emitj ( "ip route show table $duplicate | while read net route; do",
' case $net in',
' default|nexthop)',
' ;;',
' *)',
" run_ip route add table $number \$net \$route",
' case $(find_device $route) in',
" $match)",
" run_ip route add table $number \$net \$route",
' ;;',
' esac',
' ;;',
' esac',
"done\n" );
}
sub balance_default_route( $$$ ) {
@ -186,14 +185,13 @@ sub setup_providers() {
$gateway = '-' unless $gateway;
if ( $gateway eq 'detect' ) {
emit join( "\n",
"gateway=\$(detect_gateway $interface)\n",
'if [ -n "$gateway" ]; then',
" run_ip route replace \$gateway src \$(find_first_interface_address $interface) dev $interface table $number",
" run_ip route add default via \$gateway dev $interface table $number",
'else',
" fatal_error \"Unable to detect the gateway through interface $interface\"",
"fi\n" );
emitj ( "gateway=\$(detect_gateway $interface)\n",
'if [ -n "$gateway" ]; then',
" run_ip route replace \$gateway src \$(find_first_interface_address $interface) dev $interface table $number",
" run_ip route add default via \$gateway dev $interface table $number",
'else',
" fatal_error \"Unable to detect the gateway through interface $interface\"",
"fi\n" );
} elsif ( $gateway && $gateway ne '-' ) {
emit "run_ip route replace $gateway src \$(find_first_interface_address $interface) dev $interface table $number";
emit "run_ip route add default via $gateway dev $interface table $number";
@ -262,13 +260,12 @@ sub setup_providers() {
emit "\nrulenum=0\n";
emit join( "\n" ,
"find_interface_addresses $interface | while read address; do",
' qt ip rule del from $address',
" run_ip rule add from \$address pref \$(( $rulebase + \$rulenum )) table $number",
" echo \"qt ip rule del from \$address\" >> \${VARDIR}/undo_routing",
' rulenum=$(($rulenum + 1))',
'done' );
emitj ( "find_interface_addresses $interface | while read address; do",
' qt ip rule del from $address',
" run_ip rule add from \$address pref \$(( $rulebase + \$rulenum )) table $number",
" echo \"qt ip rule del from \$address\" >> \${VARDIR}/undo_routing",
' rulenum=$(($rulenum + 1))',
'done' );
} else {
emit "\nfind_interface_addresses $interface | while read address; do";
emit ' qt ip rule del from $address';
@ -345,23 +342,22 @@ sub setup_providers() {
emit "\nif [ -z \"\$NOROUTES\" ]; then";
push_indent;
emit join( "\n",
'#',
'# Undo any changes made since the last time that we [re]started -- this will not restore the default route',
'#',
'undo_routing',
'#',
'# Save current routing table database so that it can be restored later',
'#',
'cp /etc/iproute2/rt_tables ${VARDIR}/',
'#',
'# Capture the default route(s) if we don\'t have it (them) already.',
'#',
'[ -f ${VARDIR}/default_route ] || ip route ls | grep -E \'^\s*(default |nexthop )\' > ${VARDIR}/default_route',
'#',
'# Initialize the file that holds \'undo\' commands',
'#',
'> ${VARDIR}/undo_routing' );
emitj ( '#',
'# Undo any changes made since the last time that we [re]started -- this will not restore the default route',
'#',
'undo_routing',
'#',
'# Save current routing table database so that it can be restored later',
'#',
'cp /etc/iproute2/rt_tables ${VARDIR}/',
'#',
'# Capture the default route(s) if we don\'t have it (them) already.',
'#',
'[ -f ${VARDIR}/default_route ] || ip route ls | grep -E \'^\s*(default |nexthop )\' > ${VARDIR}/default_route',
'#',
'# Initialize the file that holds \'undo\' commands',
'#',
'> ${VARDIR}/undo_routing' );
save_progress_message 'Adding Providers...';
@ -387,15 +383,14 @@ sub setup_providers() {
if ( $providers ) {
if ( $balance ) {
emit join ( "\n",
'if [ -n "$DEFAULT_ROUTE" ]; then',
' run_ip route replace default scope global $DEFAULT_ROUTE',
" progress_message \"Default route '\$(echo \$DEFAULT_ROUTE | sed 's/\$\\s*//')' Added\"",
'else',
' error_message "WARNING: No Default route added (all \'balance\' providers are down)"',
' restore_default_route',
'fi',
'' );
emitj ( 'if [ -n "$DEFAULT_ROUTE" ]; then',
' run_ip route replace default scope global $DEFAULT_ROUTE',
" progress_message \"Default route '\$(echo \$DEFAULT_ROUTE | sed 's/\$\\s*//')' Added\"",
'else',
' error_message "WARNING: No Default route added (all \'balance\' providers are down)"',
' restore_default_route',
'fi',
'' );
} else {
emit "#\n# We don't have any 'balance' providers so we restore any default route that we've saved\n#";
emit 'restore_default_route';

125
New/compiler.pl
View File

@ -71,25 +71,22 @@ sub generate_script_1 {
emit join ( '', "#\n# Compiled firewall script generated by Shorewall-pl ", $env{VERSION}, " - $date\n#" );
if ( $ENV{EXPORT} ) {
emit join ( "\n",
'SHAREDIR=/usr/share/shorewall-lite',
'CONFDIR=/etc/shorewall-lite',
'VARDIR=/var/lib/shorewall-lite',
'PRODUCT="Shorewall Lite"' );
emitj ( 'SHAREDIR=/usr/share/shorewall-lite',
'CONFDIR=/etc/shorewall-lite',
'VARDIR=/var/lib/shorewall-lite',
'PRODUCT="Shorewall Lite"' );
copy "$env{SHAREDIR}/lib.base";
emit join ( "\n",
'################################################################################',
'# End of /usr/share/shorewall/lib.base',
'################################################################################' );
emitj ( '################################################################################',
'# End of /usr/share/shorewall/lib.base',
'################################################################################' );
} else {
emit join ( "\n",
'SHAREDIR=/usr/share/shorewall',
'CONFDIR=/etc/shorewall',
'VARDIR=/var/lib/shorewall',
'PRODUCT=\'Shorewall\'',
'. /usr/share/shorewall/lib.base' );
emitj ( 'SHAREDIR=/usr/share/shorewall',
'CONFDIR=/etc/shorewall',
'VARDIR=/var/lib/shorewall',
'PRODUCT=\'Shorewall\'',
'. /usr/share/shorewall/lib.base' );
}
emit 'TEMPFILE=';
@ -110,38 +107,35 @@ sub generate_script_1 {
push_indent;
if ( $ENV{EXPORT} ) {
emit join ( "\n",
'#',
'# These variables are required by the library functions called in this script',
'#',
'CONFIG_PATH="/etc/shorewall-lite:/usr/share/shorewall-lite"' );
emitj ( '#',
'# These variables are required by the library functions called in this script',
'#',
'CONFIG_PATH="/etc/shorewall-lite:/usr/share/shorewall-lite"' );
} else {
emit join ( "\n",
'if [ ! -f ${SHAREDIR}/version ]; then',
' fatal_error "This script requires Shorewall which do not appear to be installed on this system (did you forget \"-e\" when you compiled?)"',
'fi',
'',
'local version=$(cat ${SHAREDIR}/version)',
'',
'if [ ${SHOREWALL_LIBVERSION:-0} -lt 30401 ]; then',
' fatal_error "This script requires Shorewall version 3.4.2 or later; current version is $version"',
'fi',
'#',
'# These variables are required by the library functions called in this script',
'#',
"CONFIG_PATH=\"$config{CONFIG_PATH}\"" );
emitj ( 'if [ ! -f ${SHAREDIR}/version ]; then',
' fatal_error "This script requires Shorewall which do not appear to be installed on this system (did you forget \"-e\" when you compiled?)"',
'fi',
'',
'local version=$(cat ${SHAREDIR}/version)',
'',
'if [ ${SHOREWALL_LIBVERSION:-0} -lt 30401 ]; then',
' fatal_error "This script requires Shorewall version 3.4.2 or later; current version is $version"',
'fi',
'#',
'# These variables are required by the library functions called in this script',
'#',
"CONFIG_PATH=\"$config{CONFIG_PATH}\"" );
}
propagateconfig;
emit join ( "\n" ,
'[ -n "${COMMAND:=restart}" ]',
'[ -n "${VERBOSE:=0}" ]',
'[ -n "${RESTOREFILE:=$RESTOREFILE}" ]',
'[ -n "$LOGFORMAT" ] || LOGFORMAT="Shorewall:%s:%s:"',
qq(VERSION="$env{VERSION}") ,
qq(PATH="$config{PATH}") ,
'TERMINATOR=fatal_error' );
emitj ( '[ -n "${COMMAND:=restart}" ]',
'[ -n "${VERBOSE:=0}" ]',
'[ -n "${RESTOREFILE:=$RESTOREFILE}" ]',
'[ -n "$LOGFORMAT" ] || LOGFORMAT="Shorewall:%s:%s:"',
qq(VERSION="$env{VERSION}") ,
qq(PATH="$config{PATH}") ,
'TERMINATOR=fatal_error' );
if ( $config{IPTABLES} ) {
emit "IPTABLES=\"$config{IPTABLES}\"\n";
@ -154,14 +148,13 @@ sub generate_script_1 {
append_file 'params' if $config{EXPORTPARAMS};
emit join ( "\n",
'',
"STOPPING=",
"COMMENT=\n", # Maintain compability with lib.base
'#',
'# The library requires that ${VARDIR} exist',
'#',
'[ -d ${VARDIR} ] || mkdir -p ${VARDIR}' );
emitj ( '',
"STOPPING=",
"COMMENT=\n", # Maintain compability with lib.base
'#',
'# The library requires that ${VARDIR} exist',
'#',
'[ -d ${VARDIR} ] || mkdir -p ${VARDIR}' );
pop_indent;
@ -319,13 +312,12 @@ stop_firewall() {
if ( @$criticalhosts ) {
if ( $config{ADMINISABSENTMINDED} ) {
emit join ( "\n",
' for chain in INPUT OUTPUT; do',
' setpolicy $chain ACCEPT',
" done\n",
" setpolicy FORWARD DROP\n",
' deleteallchains',
'' );
emitj ( ' for chain in INPUT OUTPUT; do',
' setpolicy $chain ACCEPT',
" done\n",
" setpolicy FORWARD DROP\n",
' deleteallchains',
'' );
for my $hosts ( @$criticalhosts ) {
my ( $interface, $host ) = ( split /:/, $hosts );
@ -488,16 +480,15 @@ sub generate_script_2 () {
emit '';
for my $interface ( @{find_interfaces_by_option 'norfc1918'} ) {
emit join( "\n",
"addr=\$(ip -f inet addr show $interface 2> /dev/null | grep 'inet\ ' | head -n1)",
'if [ -n "$addr" ]; then',
' addr=$(echo $addr | sed \'s/inet //;s/\/.*//;s/ peer.*//\')',
' for network in 10.0.0.0/8 176.16.0.0/12 192.168.0.0/16; do',
' if in_network $addr $network; then',
" startup_error \"The 'norfc1918' option has been specified on an interface with an RFC 1918 address. Interface:$interface\"",
' fi',
' done',
"fi\n" );
emitj ( "addr=\$(ip -f inet addr show $interface 2> /dev/null | grep 'inet\ ' | head -n1)",
'if [ -n "$addr" ]; then',
' addr=$(echo $addr | sed \'s/inet //;s/\/.*//;s/ peer.*//\')',
' for network in 10.0.0.0/8 176.16.0.0/12 192.168.0.0/16; do',
' if in_network $addr $network; then',
" startup_error \"The 'norfc1918' option has been specified on an interface with an RFC 1918 address. Interface:$interface\"",
' fi',
' done',
"fi\n" );
}
emit "run_init_exit\n";