gistfile1.txt
· 947 B · Text
原始文件
function rule::_apply_identity_rule() {
local peer_name="${1:-}" client_ip="${2:-}"
local identity_name
identity_name=$(identity::get_name "$peer_name")
[[ -z "$identity_name" ]] && return 0
local rules
rules=$(identity::rules "$identity_name")
[[ -z "$rules" ]] && return 0
local strict
strict=$(identity::rule_flags "$identity_name" "strict_rule")
if [[ "$strict" == "true" ]]; then
# Strict: flush and apply only identity rules — peer rule ignored
fw::flush_peer "$client_ip"
while IFS= read -r rule_name; do
[[ -z "$rule_name" ]] && continue
rule::exists "$rule_name" && rule::apply "$rule_name" "$client_ip" || true
done <<< "$rules"
else
# Additive: apply identity rules on top of peer rule
while IFS= read -r rule_name; do
[[ -z "$rule_name" ]] && continue
rule::exists "$rule_name" && rule::apply "$rule_name" "$client_ip" || true
done <<< "$rules"
fi
}
| 1 | function rule::_apply_identity_rule() { |
| 2 | local peer_name="${1:-}" client_ip="${2:-}" |
| 3 | |
| 4 | local identity_name |
| 5 | identity_name=$(identity::get_name "$peer_name") |
| 6 | [[ -z "$identity_name" ]] && return 0 |
| 7 | |
| 8 | local rules |
| 9 | rules=$(identity::rules "$identity_name") |
| 10 | [[ -z "$rules" ]] && return 0 |
| 11 | |
| 12 | local strict |
| 13 | strict=$(identity::rule_flags "$identity_name" "strict_rule") |
| 14 | |
| 15 | if [[ "$strict" == "true" ]]; then |
| 16 | # Strict: flush and apply only identity rules — peer rule ignored |
| 17 | fw::flush_peer "$client_ip" |
| 18 | while IFS= read -r rule_name; do |
| 19 | [[ -z "$rule_name" ]] && continue |
| 20 | rule::exists "$rule_name" && rule::apply "$rule_name" "$client_ip" || true |
| 21 | done <<< "$rules" |
| 22 | else |
| 23 | # Additive: apply identity rules on top of peer rule |
| 24 | while IFS= read -r rule_name; do |
| 25 | [[ -z "$rule_name" ]] && continue |
| 26 | rule::exists "$rule_name" && rule::apply "$rule_name" "$client_ip" || true |
| 27 | done <<< "$rules" |
| 28 | fi |
| 29 | } |