Author: Johannes Hubertz johannes@hubertz.de Date: 2015-02-10 Version: 0.9.13 License: GNU General Public License version 3 or later
This little helper is intended to optimize a large ruleset in iptables packetfilter chains, optimization target is throughput.
All chains are partitioned now, sorting is done inside the partitions. Sequence of partitions is never changed, these are kept untouched for not destroying admistrators artwork.
You will need a wrapper script, f.e. iptables-optimizer
Comments, suggestions, improvements welcome!
Have Fun!
this is representation of one chain
first fill in some content, line by line
find out, where to insert rule due to pkt-cntrs
make_partitions creates a list of 2-Elements-lists, each representing a consecutive sequence with ACCEPT, DROP, or the like. One 2-Element-list is called a partition, it is [p_strt, p_ende], and taken form self.liste Numbers in partions are Element-Positions, not indices! It returns len(self.partitions), used for testing purpose.
move position upwards where it belongs to list_point is found in cntrs (value start with 0), insert_point in kernel(value starts with 1)
optimize this chain due to packet counters
this is a filter group, may be filter, mangle, nat, raw, optimizer looks on filter group only!
optimize all chains, one pass, and ready return sum of moved counts and partitions list for debugging
keep track of all chainnames, predefined first with policy
after sorting rules, print them out
given is a string: ‘[pkt_cntr:byt_cntr]’, we need pkt_cntr and byt_cntr as set of return value for comparison
some first tests for class Chain
Chain_Test: create a chainobject
Chain_Test: make partitions from no rules
Chain_Test: make partitions from one rule a
Chain_Test: make partitions from one rule d
Chain_Test: make partitions from one rule r
Chain_Test: make partitions from one rule l
Chain_Test: make partitions from two rules aa
Chain_Test: make partitions from two rules ad
Chain_Test: make partitions from five rules adaaa
Chain_Test: optimize an empty chainobject
Chain_Test: optimize three rules aaa
Chain_Test: optimize three rules aar
Chain_Test: optimize five rules aalaa
some first tests for class Filter
Filter_Test: non existant input-file
Filter_Test: read reference-input
Filter_Test: optimize, check 30 moves and partitions
Filter_Test: check output for reference-input