holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Clean up of u32 filter code

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@8306 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2008-03-19 16:15:03 +00:00
parent affa4684b8
commit f7e5b3124b
1 changed files with 35 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
Shorewall-perl/Shorewall/Tc.pm
View File

@ -553,17 +553,28 @@ sub process_tc_filter( $$$$$$ ) {
} }
} }
unless ( $port eq '-' ) { unless ( $port eq '-' && $sport eq '-' ) {
fatal_error "Only TCP, UDP, SCTP and ICMP may specify DEST PORT" #
unless $protonumber == TCP || $protonumber == UDP || $protonumber == SCTP || $protonumber == ICMP; # In order to be able to access the protocol header, we must create another hash table and link to it.
#
# Create the Table:
#
my $tnum = in_hex3 $devref->{tablenumber}++; my $tnum = in_hex3 $devref->{tablenumber}++;
emit( "run_tc filter add dev $device parent $devref->{number}:0 protocol ip pref 10 handle $tnum: u32 divisor 1" ); emit( "run_tc filter add dev $device parent $devref->{number}:0 protocol ip pref 10 handle $tnum: u32 divisor 1" );
#
# And link to it using the current contents of $rule
#
emit( "run_tc $rule link $tnum:0 offset at 0 mask 0x0F00 shift 6 plus 0 eat" ); emit( "run_tc $rule link $tnum:0 offset at 0 mask 0x0F00 shift 6 plus 0 eat" );
#
# The rule to match the port(s) will be inserted into the new table
#
$rule = "filter add dev $device protocol ip parent $devref->{number}:0 pref 10 u32 ht $tnum:0"; $rule = "filter add dev $device protocol ip parent $devref->{number}:0 pref 10 u32 ht $tnum:0";
unless ( $port eq '-' ) {
fatal_error "Only TCP, UDP, SCTP and ICMP may specify DEST PORT"
unless $protonumber == TCP || $protonumber == UDP || $protonumber == SCTP || $protonumber == ICMP;
if ( $protonumber == ICMP ) { if ( $protonumber == ICMP ) {
my ( $icmptype , $icmpcode ) = split '//', validate_icmp( $port ); my ( $icmptype , $icmpcode ) = split '//', validate_icmp( $port );
@ -583,18 +594,10 @@ sub process_tc_filter( $$$$$$ ) {
unless $protonumber == TCP || $protonumber == UDP || $protonumber == SCTP; unless $protonumber == TCP || $protonumber == UDP || $protonumber == SCTP;
my $portnumber = in_hex8 validate_port( $protonumber , $sport ); my $portnumber = in_hex8 validate_port( $protonumber , $sport );
if ( $port eq '-' ) {
my $tnum = in_hex3 $devref->{tablenumber}++;
emit( "run_tc filter add dev $device parent $devref->{number}:0 protocol ip pref 10 handle $tnum: u32 divisor 1" );
emit( "run_tc $rule link $tnum:0 offset at 0 mask 0x0F00 shift 6 plus 0 eat" );
$rule = "filter add dev $device protocol ip parent $devref->{number}:0 pref 10 u32 ht $tnum:0";
}
$portnumber =~ s/0x0000/0x/; $portnumber =~ s/0x0000/0x/;
$rule .= "\\\n match u32 ${portnumber}0000 0xFFFF0000 at nexthdr+0"; $rule .= "\\\n match u32 ${portnumber}0000 0xFFFF0000 at nexthdr+0";
} }
}
emit( "run_tc $rule\\" , emit( "run_tc $rule\\" ,
" flowid $devref->{number}:$class" , " flowid $devref->{number}:$class" ,