aurore/firewall
10
0
Fork 0
Code Issues Pull requests Releases Activity

Don't create an anon set for single IP prefixes

Browse source
This commit is contained in:
jeltz 2022-09-07 06:26:02 +02:00
parent 713fb018fc
commit 667b5d743c
Signed by: jeltz
GPG key ID: 800882B66C0C3326
1 changed files with 15 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
compile.ml
View file

@ -1,4 +1,5 @@
open Ipaddr open Ipaddr
open Utils
module Prefix = struct module Prefix = struct
type t = Ipv4 of V4.Prefix.t | Ipv6 of V6.Prefix.t | Not of t type t = Ipv4 of V4.Prefix.t | Ipv6 of V6.Prefix.t | Not of t
@ -89,19 +90,25 @@ module Rules = struct
[] []
|> List.map expr |> List.map expr
let wrap_set = function
| [] -> None
| [ x ] -> Some x
| xs -> Some (Expr.Set xs)
let compile_match_addrs getter expr field zones addrs_list = let compile_match_addrs getter expr field zones addrs_list =
let equal = compile_addrs_list getter expr false zones addrs_list in let equal = compile_addrs_list getter expr false zones addrs_list in
let not_equal = compile_addrs_list getter expr true zones addrs_list in let not_equal = compile_addrs_list getter expr true zones addrs_list in
let stmts = let stmts =
match equal with [
| [] -> [] Option.map
| _ -> [ Stmt.Match (Match.Eq, Expr.Payload field, Expr.Set equal) ] (fun e -> Stmt.Match (Match.Eq, Expr.Payload field, e))
(wrap_set equal);
Option.map
(fun e -> Stmt.Match (Match.NotEq, Expr.Payload field, e))
(wrap_set not_equal);
]
in in
match not_equal with deoptionalise stmts
| [] -> stmts
| _ ->
Stmt.Match (Match.NotEq, Expr.Payload field, Expr.Set not_equal)
:: stmts
let compile_match_ipv4 field = let compile_match_ipv4 field =
compile_match_addrs Prefix.to_ipv4_list Expr.ipv4 (Payload.Ipv4 field) compile_match_addrs Prefix.to_ipv4_list Expr.ipv4 (Payload.Ipv4 field)