• Nils Goroll's avatar
    +fold acl flag: remove subnets and fold adjacent entries · 01bf0dd2
    Nils Goroll authored
    Function:
    
    With the fold acl flag enabled (default: disabled, keeping the
    existing behavior), ACLs are optimized in that subnets contained in
    other entries are skipped (e.g. if 1.2.3.0/24 is part of the ACL, an
    entry for 1.2.3.128/25 will not be added) and adjacent entries get
    folded (e.g. if both 1.2.3.0/25 and 1.2.3.128/25 are added, they will
    be folded to 1.2.3.0/24).
    
    Skip and fold operations on VCL entries are output as warnings during
    VCL compilation as entries from the VCL are processed in order.
    
    Logging under the VCL_acl tag can change with this parameter enabled:
    Matches on skipped subnet entries are now logged as matches on the
    respective supernet entry. Matches on folded entries are logged with a
    shorter netmask which might not be contained in the original ACL as
    defined in VCL. Such log entries are marked by "fixed: folded".
    
    Negated ACL entries are excluded from folds.
    
    Implementation:
    
    The sort functions are changed such that the previous semantics are
    preserved: negative return values signify "a < b", positive return
    values signify "a > b". But additionally the values -2/2 and -3/3 are
    introduced (and given enums) to signify "contained in supernet" and
    "directly adjacent to". This allows for mostly unchanged code with
    vcc_acl_fold disabled.
    
    For the "subnet contained in supernet" case, all contained subnets are
    removed. By sort order, caontained subnets are always to be found left
    of supernets.
    
    For the "fold adjacent" case, the netmask of the entry with the
    smaller network number is decreased by one and the other entry
    removed. Because changing the netmask might affect sort order, we
    reinsert the changed entry.
    01bf0dd2
Name
Last commit
Last update
..
compat Loading commit data...
tbl Loading commit data...
vapi Loading commit data...
Makefile.am Loading commit data...
generate.py Loading commit data...
libvcc.h Loading commit data...
miniobj.h Loading commit data...
vas.h Loading commit data...
vav.h Loading commit data...
vbh.h Loading commit data...
vbm.h Loading commit data...
vbm_test.c Loading commit data...
vcc_interface.h Loading commit data...
vcli.h Loading commit data...
vcli_serve.h Loading commit data...
vcs.h Loading commit data...
vct.h Loading commit data...
vcurses.h Loading commit data...
vdef.h Loading commit data...
venc.h Loading commit data...
vend.h Loading commit data...
vev.h Loading commit data...
vfil.h Loading commit data...
vfl.h Loading commit data...
vin.h Loading commit data...
vjsn.h Loading commit data...
vlu.h Loading commit data...
vmb.h Loading commit data...
vnum.h Loading commit data...
vpf.h Loading commit data...
vqueue.h Loading commit data...
vre.h Loading commit data...
vre_pcre2.h Loading commit data...
vrnd.h Loading commit data...
vrt.h Loading commit data...
vsa.h Loading commit data...
vsb.h Loading commit data...
vsc_priv.h Loading commit data...
vsha256.h Loading commit data...
vsl_priv.h Loading commit data...
vsm_priv.h Loading commit data...
vss.h Loading commit data...
vsub.h Loading commit data...
vtcp.h Loading commit data...
vte.h Loading commit data...
vtim.h Loading commit data...
vtree.h Loading commit data...
vus.h Loading commit data...
vut.h Loading commit data...
vut_options.h Loading commit data...