security-policies: Cache output of proposal generators

These functions are really really slow and the output stays
constants as long as the configuration is not being changed.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/functions/functions.constants b/src/functions/functions.constants
index c56b1be635a6e6e9863e856913fdba1f05117fd7..64dacb73bf5c23bbd8da4a8c9320027217957131 100644 (file)
--- a/src/functions/functions.constants
+++ b/src/functions/functions.constants
@@ -37,6 +37,7 @@ NETWORK_HOOKS_DIR=/usr/lib/network/hooks
 NETWORK_HELPERS_DIR=/usr/lib/network/helpers
 NETWORK_TRIGGERS_DIR=/usr/lib/network/triggers
 NETWORK_SHARE_DIR=/usr/share/network
+NETWORK_CACHE_DIR=/var/cache/network
 
 NETWORK_IPSEC_CONNS_DIR="${NETWORK_CONFIG_DIR}/vpn/ipsec/connections"
 NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR="/etc/swanctl/connections"

diff --git a/src/functions/functions.util b/src/functions/functions.util
index 4b032b04fce158d96435e53c9bd6d79edc86f375..e083f6a7de3515a3a11ad88e46488c1012c9788a 100644 (file)
--- a/src/functions/functions.util
+++ b/src/functions/functions.util
@@ -190,7 +190,7 @@ fwrite() {
        assert isset file
        shift
 
-       if [ ! -w "${file}" ]; then
+       if [ -e "${file}" ] && [ ! -w "${file}" ]; then
                log ERROR "${file}: No such file"
                return ${EXIT_ERROR}
        fi
@@ -198,6 +198,37 @@ fwrite() {
        print "%s" "$@" >> ${file} 2>/dev/null
 }
 
+file_exists() {
+       local file=${1}
+
+       [ -e "${file}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
+}
+
+file_is_newer_than() {
+       local file1="${1}"
+       local file2="${2}"
+
+       local age1=$(file_get_age "${file1}")
+       local age2=$(file_get_age "${file2}")
+
+       if [ ${age1} -gt ${age2} ]; then
+               return ${EXIT_TRUE}
+       else
+               return ${EXIT_FALSE}
+       fi
+}
+
+file_get_age() {
+       local file="${1}"
+
+       if [ -e "${file}" ]; then
+               stat --format="%Y" "${file}"
+               return $?
+       fi
+
+       return ${EXIT_ERROR}
+}
+
 make_parent_dir() {
        local path="${1}"
 

diff --git a/src/functions/functions.vpn-security-policies b/src/functions/functions.vpn-security-policies
index f73670be61b4edebab4be57f5cba89a0baa94b97..fef1512741da49a4b1b93422b1d79a406ed61691 100644 (file)
--- a/src/functions/functions.vpn-security-policies
+++ b/src/functions/functions.vpn-security-policies
@@ -893,6 +893,33 @@ vpn_security_policies_cipher_is_aead() {
 vpn_security_policies_make_ah_proposal() {
        local name=${1}
 
+       if ! vpn_security_policy_exists ${name}; then
+               return ${EXIT_ERROR}
+       fi
+
+       local config_path="$(vpn_security_policies_path ${name})"
+       local cache_path="${NETWORK_CACHE_DIR}/vpn/security-policies/${name}/ah-proposal"
+
+       # Get data from cache if possible
+       if file_exists "${cache_path}" && ! file_is_newer_than "${config_path}" "${cache_path}"; then
+               fread "${cache_path}"
+               return ${EXIT_OK}
+       fi
+
+       # No or invalid cache data found
+       local proposal=$(_vpn_security_policies_make_ah_proposal "${name}")
+
+       # Write proposal to cache
+       if ! make_parent_dir "${cache_path}" || ! fwrite "${cache_path}" "${proposal}"; then
+               log WARNING "Could not write to cache: ${cache_path}"
+       fi
+
+       print "${proposal}"
+}
+
+_vpn_security_policies_make_ah_proposal() {
+       local name=${1}
+
        # Read the config settings
        local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
        if ! vpn_security_policies_read_config "${name}"; then
@@ -942,6 +969,33 @@ vpn_security_policies_make_ah_proposal() {
 vpn_security_policies_make_esp_proposal() {
        local name=${1}
 
+       if ! vpn_security_policy_exists ${name}; then
+               return ${EXIT_ERROR}
+       fi
+
+       local config_path="$(vpn_security_policies_path ${name})"
+       local cache_path="${NETWORK_CACHE_DIR}/vpn/security-policies/${name}/esp-proposal"
+
+       # Get data from cache if possible
+       if file_exists "${cache_path}" && ! file_is_newer_than "${config_path}" "${cache_path}"; then
+               fread "${cache_path}"
+               return ${EXIT_OK}
+       fi
+
+       # No or invalid cache data found
+       local proposal=$(_vpn_security_policies_make_esp_proposal "${name}")
+
+       # Write proposal to cache
+       if ! make_parent_dir "${cache_path}" || ! fwrite "${cache_path}" "${proposal}"; then
+               log WARNING "Could not write to cache: ${cache_path}"
+       fi
+
+       print "${proposal}"
+}
+
+_vpn_security_policies_make_esp_proposal() {
+       local name=${1}
+
        # Read the config settings
        local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
        if ! vpn_security_policies_read_config "${name}"; then