onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-11 07:31:25 +02:00
Code Issues Releases Wiki Activity

checking for unsupported UserService objects in compilers for ipf, iosacl and pix

Browse Source
This commit is contained in:
Vadim Kurland
2008-06-07 03:44:57 +00:00
parent 47a435f7d3
commit 07be919f07
5 changed files with 85 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/iosacl/PolicyCompiler_iosacl.cpp
+2
View File
@@ -337,6 +337,8 @@ void PolicyCompiler_iosacl::compile()
add( new pickACL( true, "assign ACLs" ) ); add( new pickACL( true, "assign ACLs" ) );
add( new SpecialServices( "check for special services" ) ); add( new SpecialServices( "check for special services" ) );
add( new CheckForUnsupportedUserService("check for user service") );
add( new checkForZeroAddr( "check for zero addresses" ) ); add( new checkForZeroAddr( "check for zero addresses" ) );
add( new checkForDynamicInterface("check for dynamic interfaces" ) ); add( new checkForDynamicInterface("check for dynamic interfaces" ) );
src/pflib/PolicyCompiler_ipf.cpp
+31 -15
View File
@@ -408,7 +408,8 @@ void PolicyCompiler_ipf::compile()
add( new printTotalNumberOfRules( ) ); add( new printTotalNumberOfRules( ) );
add( new ItfNegation("process negation in Itf" ) ); add( new ItfNegation("process negation in Itf" ) );
add( new InterfacePolicyRules("process interface policy rules and store interface ids") ); add( new InterfacePolicyRules(
"process interface policy rules and store interface ids"));
add( new recursiveGroupsInSrc("check for recursive groups in SRC")); add( new recursiveGroupsInSrc("check for recursive groups in SRC"));
add( new recursiveGroupsInDst("check for recursive groups in DST")); add( new recursiveGroupsInDst("check for recursive groups in DST"));
@@ -420,11 +421,15 @@ void PolicyCompiler_ipf::compile()
add( new eliminateDuplicatesInDST("eliminate duplicates in DST") ); add( new eliminateDuplicatesInDST("eliminate duplicates in DST") );
add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV") ); add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV") );
add( new swapMultiAddressObjectsInSrc(" swap MultiAddress -> MultiAddressRunTime in Src") ); add( new swapMultiAddressObjectsInSrc(
add( new swapMultiAddressObjectsInDst(" swap MultiAddress -> MultiAddressRunTime in Dst") ); " swap MultiAddress -> MultiAddressRunTime in Src") );
add( new swapMultiAddressObjectsInDst(
" swap MultiAddress -> MultiAddressRunTime in Dst") );
add( new ExpandMultipleAddressesInSRC("expand objects with multiple addresses in SRC" ) ); add( new ExpandMultipleAddressesInSRC(
add( new ExpandMultipleAddressesInDST("expand objects with multiple addresses in DST" ) ); "expand objects with multiple addresses in SRC" ) );
add( new ExpandMultipleAddressesInDST(
"expand objects with multiple addresses in DST" ) );
add( new ConvertToAtomic("convert to atomic rules" ) ); add( new ConvertToAtomic("convert to atomic rules" ) );
add( new DetectShadowing("Detect shadowing" ) ); add( new DetectShadowing("Detect shadowing" ) );
add( new simplePrintProgress() ); add( new simplePrintProgress() );
@@ -451,39 +456,50 @@ void PolicyCompiler_ipf::compile()
add( new emptyGroupsInSrv("check for empty groups in SRV") ); add( new emptyGroupsInSrv("check for empty groups in SRV") );
add( new ItfNegation("process negation in Itf" ) ); add( new ItfNegation("process negation in Itf" ) );
add( new InterfacePolicyRules("process interface policy rules and store interface ids") ); add( new InterfacePolicyRules(
"process interface policy rules and store interface ids") );
add( new doSrcNegation("process negation in Src") ); add( new doSrcNegation("process negation in Src") );
add( new doDstNegation("process negation in Dst") ); add( new doDstNegation("process negation in Dst") );
add( new doSrvNegation("process negation in Srv") ); add( new doSrvNegation("process negation in Srv") );
add( new ExpandGroups( "expand groups") ); add( new ExpandGroups( "expand groups") );
add( new CheckForTCPEstablished("check for TCPService objects with flag \"established\"") ); add( new CheckForTCPEstablished(
"check for TCPService objects with flag \"established\"") );
add( new CheckForUnsupportedUserService("check for user service") );
add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC") ); add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC") );
add( new eliminateDuplicatesInDST("eliminate duplicates in DST") ); add( new eliminateDuplicatesInDST("eliminate duplicates in DST") );
add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV") ); add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV") );
add( new swapMultiAddressObjectsInSrc(" swap MultiAddress -> MultiAddressRunTime in Src") ); add( new swapMultiAddressObjectsInSrc(
add( new swapMultiAddressObjectsInDst(" swap MultiAddress -> MultiAddressRunTime in Dst") ); " swap MultiAddress -> MultiAddressRunTime in Src") );
add( new swapMultiAddressObjectsInDst(
" swap MultiAddress -> MultiAddressRunTime in Dst") );
add( new processMultiAddressObjectsInSrc("process MultiAddress objects in Src") ); add( new processMultiAddressObjectsInSrc(
add( new processMultiAddressObjectsInDst("process MultiAddress objects in Dst") ); "process MultiAddress objects in Src") );
add( new processMultiAddressObjectsInDst(
"process MultiAddress objects in Dst") );
add( new splitIfFirewallInSrc("split rule if firewall is in Src") ); add( new splitIfFirewallInSrc("split rule if firewall is in Src") );
add( new splitIfFirewallInDst("split rule if firewall is in Dst") ); add( new splitIfFirewallInDst("split rule if firewall is in Dst") );
add( new fillDirection("determine directions") ); add( new fillDirection("determine directions") );
add( new SplitDirection("split rules with direction 'both'" ) ); add( new SplitDirection("split rules with direction 'both'" ) );
add( new ExpandMultipleAddresses( "expand objects with multiple addresses" ) ); add( new ExpandMultipleAddresses(
add( new checkForDynamicInterfacesOfOtherObjects( "check for dynamic interfaces of other hosts and firewalls" ) ); "expand objects with multiple addresses") );
add( new checkForDynamicInterfacesOfOtherObjects(
"check for dynamic interfaces of other hosts and firewalls" ));
add( new MACFiltering("verify for MAC address filtering" ) ); add( new MACFiltering("verify for MAC address filtering" ) );
add( new checkForUnnumbered("check for unnumbered interfaces") ); add( new checkForUnnumbered("check for unnumbered interfaces") );
add( new specialCaseWithDynInterface( "check for a special cases with dynamic interface") ); add( new specialCaseWithDynInterface(
"check for a special cases with dynamic interface") );
add( new addressRanges("expand address range objects") ); add( new addressRanges("expand address range objects") );
add( new splitServices("split rules with different protocols") ); add( new splitServices("split rules with different protocols") );
add( new separateTCPWithFlags("separate TCP services with flags" ) ); add( new separateTCPWithFlags("separate TCP services with flags" ) );
add( new separateSrcPort("split on TCP and UDP with source ports")); add( new separateSrcPort("split on TCP and UDP with source ports"));
add( new verifyCustomServices( "verify custom services for this platform" ) ); add( new verifyCustomServices(
"verify custom services for this platform") );
add( new SpecialServices("check for special services" ) ); add( new SpecialServices("check for special services" ) );
add( new expandAnyService("expand ANY service for stateful rules") ); add( new expandAnyService("expand ANY service for stateful rules") );
/* /*
src/pix/PolicyCompiler_pix.cpp
+1
View File
@@ -761,6 +761,7 @@ void PolicyCompiler_pix::compile()
add( new pickACL_v6( "assign ACLs for v6" )); add( new pickACL_v6( "assign ACLs for v6" ));
add( new SpecialServices( "check for special services" )); add( new SpecialServices( "check for special services" ));
add( new CheckForUnsupportedUserService("check for user service") );
add( new checkForZeroAddr( "check for zero addresses" )); add( new checkForZeroAddr( "check for zero addresses" ));
add( new checkVersionAndDynamicInterface( add( new checkVersionAndDynamicInterface(
"check for dynamic interfaces in policy rule and verify version of PIX OS")); "check for dynamic interfaces in policy rule and verify version of PIX OS"));
test/ipf/run.all
+1 -1
View File
@@ -10,7 +10,7 @@ while (<>) {
$fw=$1; $fw=$1;
printf "\n"; printf "\n";
printf "echo '******* $fw'\n"; printf "echo '******* $fw'\n";
printf "fwb_ipf -v -f $XMLFILE $fw\n"; printf "fwb_ipf -v -f $XMLFILE -xt $fw\n";
$str=~ s/^.*<Firewall [^>]+name="$fw"[^>]+>//; $str=~ s/^.*<Firewall [^>]+name="$fw"[^>]+>//;
} }
} }