From 664c5640370868af3fbf265cf6aea46b13e42d23 Mon Sep 17 00:00:00 2001 From: Vadim Kurland Date: Thu, 16 Jul 2009 00:30:12 +0000 Subject: [PATCH] * PolicyCompiler_ipt_optimizer.cpp (optimizeForMinusIOPlus::processNext): fixed bug #2822098: "IPT: adds useless "-i +" iin some cases". Added optimization to remove redundant "-i +" and "-o +" if chain is INPUT or OUTPUT. --- build_num | 2 +- doc/ChangeLog | 7 ++ src/ipt/PolicyCompiler_ipt.cpp | 1 + src/ipt/PolicyCompiler_ipt.h | 5 + src/ipt/PolicyCompiler_ipt_optimizer.cpp | 23 +++++ test/ipt/objects-for-regression-tests.fwb | 120 +++++++++++++++------- 6 files changed, 121 insertions(+), 37 deletions(-) diff --git a/build_num b/build_num index 172bd9810..b34ff31f8 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 1156 +#define BUILD_NUM 1163 diff --git a/doc/ChangeLog b/doc/ChangeLog index e0f972b40..65de9762b 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,3 +1,10 @@ +2009-07-15 vadim + + * PolicyCompiler_ipt_optimizer.cpp (optimizeForMinusIOPlus::processNext): + fixed bug #2822098: "IPT: adds useless "-i +" iin some cases". + Added optimization to remove redundant "-i +" and "-o +" if + chain is INPUT or OUTPUT. + 2009-07-14 vadim * PolicyCompiler_ipt.cpp (singleItfNegation::processNext): fixed diff --git a/src/ipt/PolicyCompiler_ipt.cpp b/src/ipt/PolicyCompiler_ipt.cpp index 045b50113..93887f20e 100644 --- a/src/ipt/PolicyCompiler_ipt.cpp +++ b/src/ipt/PolicyCompiler_ipt.cpp @@ -4243,6 +4243,7 @@ void PolicyCompiler_ipt::compile() "drop rules with action Continue") ); add( new convertInterfaceIdToStr("prepare interface assignments") ); add( new optimize3("optimization 3") ); + add( new optimizeForMinusIOPlus("optimize for '-i +' / '-o +'") ); add( new countChainUsage("Count chain usage")); diff --git a/src/ipt/PolicyCompiler_ipt.h b/src/ipt/PolicyCompiler_ipt.h index c26f43add..dd3db8789 100644 --- a/src/ipt/PolicyCompiler_ipt.h +++ b/src/ipt/PolicyCompiler_ipt.h @@ -794,6 +794,11 @@ namespace fwcompiler { }; friend class PolicyCompiler_ipt::optimize3; + /** + * Optimize rules by dropping "-i +" or "-o +" if chain is + * INPUT or OUTPUT respectively. + */ + DECLARE_POLICY_RULE_PROCESSOR(optimizeForMinusIOPlus); /** * split rules so multiport module can be used diff --git a/src/ipt/PolicyCompiler_ipt_optimizer.cpp b/src/ipt/PolicyCompiler_ipt_optimizer.cpp index 9ba2350f8..24d5a755d 100644 --- a/src/ipt/PolicyCompiler_ipt_optimizer.cpp +++ b/src/ipt/PolicyCompiler_ipt_optimizer.cpp @@ -307,3 +307,26 @@ bool PolicyCompiler_ipt::optimize3::processNext() return true; } + +bool PolicyCompiler_ipt::optimizeForMinusIOPlus::processNext() +{ + PolicyRule *rule; + rule=getNext(); if (rule==NULL) return false; + + string iface_name = rule->getInterfaceStr(); + if (iface_name.empty() || iface_name=="nil" ) + { + tmp_queue.push_back(rule); + return true; + } + + string chain = rule->getStr("ipt_chain"); + + RuleElementItf *itfrel = rule->getItf(); + if (itfrel->isAny() && (chain == "INPUT" || chain == "OUTPUT")) + rule->setInterfaceStr(""); + + tmp_queue.push_back(rule); + return true; +} + diff --git a/test/ipt/objects-for-regression-tests.fwb b/test/ipt/objects-for-regression-tests.fwb index a067a393c..79fa71f7c 100644 --- a/test/ipt/objects-for-regression-tests.fwb +++ b/test/ipt/objects-for-regression-tests.fwb @@ -1,6 +1,6 @@ - + @@ -1744,23 +1744,8 @@ - - - - - - - - - - - - - - - @@ -2889,7 +2874,7 @@ - + @@ -3640,7 +3625,7 @@ - + @@ -8589,7 +8574,7 @@ - + @@ -8885,7 +8870,7 @@ - + @@ -43330,7 +43315,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43393,7 +43378,67 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -43413,7 +43458,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43433,7 +43478,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43453,7 +43498,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43473,7 +43518,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43493,7 +43538,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43513,7 +43558,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43533,7 +43578,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43553,7 +43598,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43573,7 +43618,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43593,7 +43638,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43613,7 +43658,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43633,7 +43678,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43653,7 +43698,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43673,7 +43718,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -43701,6 +43746,9 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% + + +