Commit 2a788938 authored by Kaarle Ritvanen's avatar Kaarle Ritvanen

global variables eliminated

(except for the DNS resolution cache)
context, IPTables, and IPSet objects introduced
parent 4bfc8d8b
...@@ -36,9 +36,9 @@ end ...@@ -36,9 +36,9 @@ end
local function readconfig() local function readconfig()
config = {} local config = {}
awall.model.reset() local iptables = awall.iptables.new()
awall.iptables.reset() local context = {input=config, iptables=iptables}
for i, dir in ipairs(confdirs) do for i, dir in ipairs(confdirs) do
local fnames = {} local fnames = {}
...@@ -93,7 +93,7 @@ local function readconfig() ...@@ -93,7 +93,7 @@ local function readconfig()
function insertrule(trule) function insertrule(trule)
local t = awall.iptables.config[trule.family][trule.table][trule.chain] local t = iptables.config[trule.family][trule.table][trule.chain]
if trule.position == 'prepend' then if trule.position == 'prepend' then
table.insert(t, 1, trule.opts) table.insert(t, 1, trule.opts)
else else
...@@ -106,7 +106,8 @@ local function readconfig() ...@@ -106,7 +106,8 @@ local function readconfig()
for i, mod in ipairs(modules) do for i, mod in ipairs(modules) do
for path, cls in pairs(mod.classmap) do for path, cls in pairs(mod.classmap) do
if config[path] then if config[path] then
awall.util.map(config[path], cls.morph) awall.util.map(config[path],
function(obj) return cls.morph(obj, context) end)
table.insert(locations, config[path]) table.insert(locations, config[path])
end end
end end
...@@ -120,16 +121,20 @@ local function readconfig() ...@@ -120,16 +121,20 @@ local function readconfig()
for i, trule in ipairs(rule:trules()) do insertrule(trule) end for i, trule in ipairs(rule:trules()) do insertrule(trule) end
end end
end end
context.ipset = awall.ipset.new(config.ipset)
return context
end end
function dump() function dump()
readconfig() local context = readconfig()
awall.ipset.dump(ipsfile) context.ipset:dump(ipsfile)
awall.iptables.dump(iptdir) context.iptables:dump(iptdir)
end end
function test() function test()
readconfig() local context = readconfig()
awall.ipset.create() context.ipset:create()
awall.iptables.test() context.iptables:test()
end end
...@@ -7,11 +7,18 @@ Licensed under the terms of GPL2 ...@@ -7,11 +7,18 @@ Licensed under the terms of GPL2
module(..., package.seeall) module(..., package.seeall)
local function commands() local IPSet = {}
local config = awall.config
function new(config)
local res = {config=config}
setmetatable(res, {__index=IPSet})
return res
end
function IPSet:commands()
local res = {} local res = {}
if config.ipset then if self.config then
for name, params in pairs(config.ipset) do for name, params in pairs(self.config) do
if not params.type then error('Type not defined for set '..name) end if not params.type then error('Type not defined for set '..name) end
local line = 'create '..name..' '..params.type local line = 'create '..name..' '..params.type
if params.family then line = line..' family '..params.family end if params.family then line = line..' family '..params.family end
...@@ -21,8 +28,8 @@ local function commands() ...@@ -21,8 +28,8 @@ local function commands()
return res return res
end end
function create() function IPSet:create()
for i, line in ipairs(commands()) do for i, line in ipairs(self:commands()) do
local pid, stdin = lpc.run('ipset', '-!', 'restore') local pid, stdin = lpc.run('ipset', '-!', 'restore')
stdin:write(line) stdin:write(line)
stdin:close() stdin:close()
...@@ -32,8 +39,8 @@ function create() ...@@ -32,8 +39,8 @@ function create()
end end
end end
function dump(ipsfile) function IPSet:dump(ipsfile)
local file = io.output(ipsfile) local file = io.output(ipsfile)
for i, line in ipairs(commands()) do file:write(line) end for i, line in ipairs(self:commands()) do file:write(line) end
file:close() file:close()
end end
...@@ -18,20 +18,25 @@ local families = {inet={cmd='iptables-restore', file='rules-save'}, ...@@ -18,20 +18,25 @@ local families = {inet={cmd='iptables-restore', file='rules-save'},
local builtin = {'INPUT', 'FORWARD', 'OUTPUT', local builtin = {'INPUT', 'FORWARD', 'OUTPUT',
'PREROUTING', 'POSTROUTING'} 'PREROUTING', 'POSTROUTING'}
function reset() local IPTables = {}
config = {}
function new()
local config = {}
setmetatable(config, setmetatable(config,
{__index=function(t, k) {__index=function(t, k)
t[k] = {} t[k] = {}
setmetatable(t[k], getmetatable(t)) setmetatable(t[k], getmetatable(t))
return t[k] return t[k]
end}) end})
local res = {config=config}
setmetatable(res, {__index=IPTables})
return res
end end
reset()
local function dumpfile(family, iptfile) function IPTables:dumpfile(family, iptfile)
iptfile:write('# '..families[family].file..' generated by awall\n') iptfile:write('# '..families[family].file..' generated by awall\n')
for tbl, chains in pairs(config[family]) do for tbl, chains in pairs(self.config[family]) do
iptfile:write('*'..tbl..'\n') iptfile:write('*'..tbl..'\n')
for chain, rules in pairs(chains) do for chain, rules in pairs(chains) do
iptfile:write(':'..chain..' '..(contains(builtin, chain) and iptfile:write(':'..chain..' '..(contains(builtin, chain) and
...@@ -46,17 +51,17 @@ local function dumpfile(family, iptfile) ...@@ -46,17 +51,17 @@ local function dumpfile(family, iptfile)
end end
end end
function test() function IPTables:test()
for family, tbls in pairs(config) do for family, tbls in pairs(self.config) do
local pid, stdin = lpc.run(families[family].cmd, '-t') local pid, stdin = lpc.run(families[family].cmd, '-t')
dumpfile(family, stdin) self:dumpfile(family, stdin)
stdin:close() stdin:close()
assert(lpc.wait(pid) == 0) assert(lpc.wait(pid) == 0)
end end
end end
function dump(dir) function IPTables:dump(dir)
for family, tbls in pairs(config) do for family, tbls in pairs(self.config) do
dumpfile(family, io.output(dir..'/'..families[family].file)) self:dumpfile(family, io.output(dir..'/'..families[family].file))
end end
end end
...@@ -28,8 +28,14 @@ function class(base) ...@@ -28,8 +28,14 @@ function class(base)
return inst return inst
end end
function cls:morph() function cls:morph(context)
setmetatable(self, mt) setmetatable(self, mt)
if context then
self.context = context
self.root = context.input
end
self:init() self:init()
end end
...@@ -78,13 +84,11 @@ Rule = class(Object) ...@@ -78,13 +84,11 @@ Rule = class(Object)
function Rule:init() function Rule:init()
local config = awall.config
for i, prop in ipairs({'in', 'out'}) do for i, prop in ipairs({'in', 'out'}) do
self[prop] = self[prop] and util.maplist(self[prop], self[prop] = self[prop] and util.maplist(self[prop],
function(z) function(z)
return z == '_fw' and fwzone or return z == '_fw' and fwzone or
config.zone[z] or self.root.zone[z] or
error('Invalid zone: '..z) error('Invalid zone: '..z)
end) or self:defaultzones() end) or self:defaultzones()
end end
...@@ -93,7 +97,7 @@ function Rule:init() ...@@ -93,7 +97,7 @@ function Rule:init()
if type(self.service) == 'string' then self.label = self.service end if type(self.service) == 'string' then self.label = self.service end
self.service = util.maplist(self.service, self.service = util.maplist(self.service,
function(s) function(s)
return config.service[s] or error('Invalid service: '..s) return self.root.service[s] or error('Invalid service: '..s)
end) end)
end end
end end
...@@ -280,7 +284,7 @@ function Rule:trules() ...@@ -280,7 +284,7 @@ function Rule:trules()
for i, ipset in util.listpairs(self.ipset) do for i, ipset in util.listpairs(self.ipset) do
if not ipset.name then error('Set name not defined') end if not ipset.name then error('Set name not defined') end
local setdef = awall.config.ipset and awall.config.ipset[ipset.name] local setdef = self.root.ipset and self.root.ipset[ipset.name]
if not setdef then error('Invalid set name') end if not setdef then error('Invalid set name') end
if not ipset.args then if not ipset.args then
...@@ -352,18 +356,16 @@ end ...@@ -352,18 +356,16 @@ end
function Rule:extraoptfrags() return {} end function Rule:extraoptfrags() return {} end
local lastid = {}
function Rule:newchain(base) function Rule:newchain(base)
if not self.context.lastid then self.context.lastid = {} end
local lastid = self.context.lastid
if self.label then base = base..'-'..self.label end if self.label then base = base..'-'..self.label end
if not lastid[base] then lastid[base] = -1 end if not lastid[base] then lastid[base] = -1 end
lastid[base] = lastid[base] + 1 lastid[base] = lastid[base] + 1
return base..'-'..lastid[base] return base..'-'..lastid[base]
end end
function reset()
lastid = {}
end
classmap = {zone=Zone} classmap = {zone=Zone}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment