@@ -60,9 +60,8 @@ func (d Policy) String() string {
60
60
}
61
61
if d .Counter != nil {
62
62
return fmt .Sprintf ("%s%s %s %s" , prefix , d .Chain , d .Action , d .Counter .String ())
63
- } else {
64
- return fmt .Sprintf ("%s%s %s" , prefix , d .Chain , d .Action )
65
63
}
64
+ return fmt .Sprintf ("%s%s %s" , prefix , d .Chain , d .Action )
66
65
}
67
66
68
67
// Rule represents a rule in an iptables dump. Normally the start with -A.
@@ -144,7 +143,6 @@ func (r Rule) Spec() (ret []string) {
144
143
} else {
145
144
ret = append (ret , "!" , "-f" )
146
145
}
147
-
148
146
}
149
147
if r .IPv4 {
150
148
ret = append (ret , "-4" )
@@ -154,7 +152,6 @@ func (r Rule) Spec() (ret []string) {
154
152
}
155
153
if len (r .Matches ) > 0 {
156
154
for _ , m := range r .Matches {
157
-
158
155
ret = append (ret , m .Spec ()... )
159
156
}
160
157
}
@@ -169,8 +166,8 @@ func (r Rule) Spec() (ret []string) {
169
166
170
167
// EqualTo returns true, if the rules are
171
168
// equal to each other.
172
- func (r1 Rule ) EqualTo (r2 Rule ) bool {
173
- return reflect .DeepEqual (r1 , r2 )
169
+ func (r Rule ) EqualTo (r2 Rule ) bool {
170
+ return reflect .DeepEqual (r , r2 )
174
171
}
175
172
176
173
// DNSOrIPPair either holds an IP or DNS and a flag.
@@ -187,6 +184,7 @@ func (d DNSOrIPPair) String(f string) string {
187
184
return strings .Join (d .Spec (f ), " " )
188
185
}
189
186
187
+ // Spec returns a DNSOrIPPair how coreos' iptables package would expect it.
190
188
func (d DNSOrIPPair ) Spec (f string ) []string {
191
189
s := []string {"!" , f , d .Value .String ()}
192
190
if ! d .Not {
@@ -256,6 +254,7 @@ func (sp StringPair) String(f string) string {
256
254
return strings .Join (sp .Spec (f ), " " )
257
255
}
258
256
257
+ // Spec returns a StringPair how coreos' iptables package would expect it.
259
258
func (sp StringPair ) Spec (f string ) []string {
260
259
ret := []string {"!" , f , sp .Value }
261
260
if ! sp .Not {
@@ -285,6 +284,7 @@ func (m Match) String() string {
285
284
return strings .Join (m .Spec (), " " )
286
285
}
287
286
287
+ // Spec returns a Match how coreos' iptables package would expect it.
288
288
func (m Match ) Spec () []string {
289
289
ret := make ([]string , 2 , 2 + len (m .Flags )* 2 )
290
290
ret [0 ], ret [1 ] = "-m" , m .Type
@@ -305,6 +305,7 @@ func (fl Flag) String(f string) string {
305
305
return strings .Join (fl .Spec (f ), " " )
306
306
}
307
307
308
+ // Spec returns a Flag how coreos' iptables package would expect it.
308
309
func (fl Flag ) Spec (f string ) []string {
309
310
ret := []string {"!" , f }
310
311
ret = append (ret , fl .Values ... )
@@ -314,6 +315,7 @@ func (fl Flag) Spec(f string) []string {
314
315
return ret
315
316
}
316
317
318
+ // Target represents a Target Extension. See iptables-extensions(8).
317
319
type Target struct {
318
320
Name string
319
321
Flags map [string ]Flag
@@ -323,6 +325,7 @@ func (t Target) String(name string) string {
323
325
return strings .Join (t .Spec (name ), " " )
324
326
}
325
327
328
+ // Spec returns a Target how coreos' iptables package would expect it.
326
329
func (t Target ) Spec (f string ) []string {
327
330
ret := make ([]string , 2 , 2 + len (t .Flags )* 2 )
328
331
ret [0 ], ret [1 ] = f , t .Name
@@ -332,17 +335,17 @@ func (t Target) Spec(f string) []string {
332
335
return ret
333
336
}
334
337
335
- // Max buffer size of the ring buffer in the parser.
336
- const BUF_SIZE = 10
338
+ // BUFSIZE is the max buffer size of the ring buffer in the parser.
339
+ const BUFSIZE = 16
337
340
338
341
// Parser represents a parser.
339
342
type Parser struct {
340
343
s * scanner
341
344
buf struct {
342
- toks [BUF_SIZE ]Token // token buffer
343
- lits [BUF_SIZE ]string // literal buffer
344
- p int // current position in the buffer (max=BUF_SIZE)
345
- n int // offset (max=BUF_SIZE)
345
+ toks [BUFSIZE ]Token // token buffer
346
+ lits [BUFSIZE ]string // literal buffer
347
+ p int // current position in the buffer (max=BUF_SIZE)
348
+ n int // offset (max=BUF_SIZE)
346
349
}
347
350
}
348
351
@@ -371,7 +374,7 @@ func (p *Parser) Parse() (l Line, err error) {
371
374
case COLON :
372
375
return p .parseDefault (p .s .scanLine ())
373
376
case EOF :
374
- return nil , io .EOF //ErrEOF
377
+ return nil , io .EOF // ErrEOF
375
378
case NEWLINE :
376
379
return nil , errors .New ("empty line" )
377
380
default :
@@ -392,8 +395,10 @@ func (p *Parser) ParseRule() (*Rule, error) {
392
395
}
393
396
}
394
397
395
- var matchModules map [string ]struct {}
396
- var targetExtensions map [string ]struct {}
398
+ var (
399
+ matchModules map [string ]struct {}
400
+ targetExtensions map [string ]struct {}
401
+ )
397
402
398
403
func init () {
399
404
matchModules = make (map [string ]struct {})
@@ -430,17 +435,17 @@ func (p *Parser) parseDefault(lit string) (Line, error) {
430
435
func parseCounter (bytes []byte ) (Counter , error ) {
431
436
var c Counter
432
437
pc := regCounter .ReplaceAll (bytes , []byte ("$1" ))
433
- if i , err := strconv .ParseUint (string (pc ), 10 , 0 ); err != nil {
438
+ i , err := strconv .ParseUint (string (pc ), 10 , 0 )
439
+ if err != nil {
434
440
return c , fmt .Errorf ("Could not parse counter: %w" , err )
435
- } else {
436
- c .packets = i
437
441
}
442
+ c .packets = i
438
443
pc = regCounter .ReplaceAll (bytes , []byte ("$2" ))
439
- if i , err := strconv .ParseUint (string (pc ), 10 , 0 ); err != nil {
444
+ i , err = strconv .ParseUint (string (pc ), 10 , 0 )
445
+ if err != nil {
440
446
return c , fmt .Errorf ("Could not parse counter: %w" , err )
441
- } else {
442
- c .bytes = i
443
447
}
448
+ c .bytes = i
444
449
return c , nil
445
450
}
446
451
@@ -579,7 +584,6 @@ func (p *Parser) parseRule() (Line, error) {
579
584
// Avoid scanning the next token, if an error occured.
580
585
nextValue = nextValue && err == nil
581
586
}
582
-
583
587
}
584
588
return r , nil
585
589
}
@@ -608,7 +612,7 @@ func (p *Parser) parsePolicy(d bool) (Line, error) {
608
612
return ret , nil
609
613
}
610
614
if tok , lit := p .scanIgnoreWhitespace (); tok != EOF && tok != NEWLINE {
611
- return nil , fmt .Errorf ("found %q, expected EOF or newline. " , lit )
615
+ return nil , fmt .Errorf ("found %q, expected EOF or newline" , lit )
612
616
}
613
617
return ret , nil
614
618
}
@@ -648,9 +652,8 @@ func (p *Parser) parseStringPair(sp *StringPair, not bool) (state, error) {
648
652
* sp = StringPair {Value : "" , Not : not }
649
653
p .unscan (1 )
650
654
return sStart , errors .New ("unexpected token, expected IDENT" )
651
- } else {
652
- * sp = StringPair {Value : lit , Not : not }
653
655
}
656
+ * sp = StringPair {Value : lit , Not : not }
654
657
return sStart , nil
655
658
}
656
659
@@ -666,14 +669,14 @@ func (p *Parser) scan() (tok Token, lit string) {
666
669
// If we have a token on the buffer, return it.
667
670
if p .buf .n != 0 {
668
671
p .buf .n --
669
- return p .buf .toks [mod (p .buf .p - p .buf .n - 1 , BUF_SIZE )], p .buf .lits [mod (p .buf .p - p .buf .n - 1 , BUF_SIZE )]
672
+ return p .buf .toks [mod (p .buf .p - p .buf .n - 1 , BUFSIZE )], p .buf .lits [mod (p .buf .p - p .buf .n - 1 , BUFSIZE )]
670
673
}
671
674
// Otherwise read the next token from the scanner.
672
675
tok , lit = p .s .scan ()
673
676
// Save it to the buffer in case we unscan later.
674
677
p .buf .toks [p .buf .p ], p .buf .lits [p .buf .p ] = tok , lit
675
678
p .buf .p ++ // increase the pointer of the ring buffer.
676
- p .buf .p %= BUF_SIZE
679
+ p .buf .p %= BUFSIZE
677
680
return
678
681
}
679
682
@@ -689,28 +692,12 @@ func (p *Parser) scanIgnoreWhitespace() (tok Token, lit string) {
689
692
// unscan reverts the pointer on the buffer, callers should not unscan more then what was
690
693
// previously read, or values larger then BUF_SIZE.
691
694
func (p * Parser ) unscan (n int ) {
692
- if p .buf .n + n >= BUF_SIZE {
695
+ if p .buf .n + n >= BUFSIZE {
693
696
panic ("size exceeds buffer" )
694
697
}
695
698
p .buf .n += n
696
699
}
697
700
698
- func (p * Parser ) unscanIgnoreWhitespace (n int ) error {
699
- for i := 0 ; i < BUF_SIZE ; i ++ {
700
- if p .buf .toks [p .buf .n ] == ILLEGAL {
701
- break
702
- }
703
- if p .buf .toks [p .buf .n ] == WS {
704
- p .unscan (1 )
705
- } else {
706
- if n -- ; n == 0 {
707
- return nil
708
- }
709
- }
710
- }
711
- return errors .New ("buffer has no none whitespace characters" )
712
- }
713
-
714
701
var hasWS * regexp.Regexp = regexp .MustCompile (`\s` )
715
702
716
703
func enquoteIfWS (s []string ) []string {
0 commit comments