From 0ded969b45e625961d535865a6baa58d8c9471bb Mon Sep 17 00:00:00 2001 From: Vadim Kurland Date: Wed, 20 Jan 2010 20:06:32 +0000 Subject: [PATCH] * PolicyCompiler_cisco_acls.cpp (setInterfaceAndDirectionBySrc::processNext): fixes #1120 "redundant commands generated for ssh access". Compiler for PIX generated two "ssh address netmask inside" commands for the same rule that permits ssh to the firewall. --- build_num | 2 +- doc/ChangeLog | 5 ++++ src/cisco_lib/Helper.cpp | 2 ++ src/cisco_lib/PolicyCompiler_cisco.cpp | 5 +++- src/cisco_lib/PolicyCompiler_cisco_acls.cpp | 20 +++++++++---- src/cisco_lib/PolicyCompiler_pix.cpp | 1 + test/pix/cluster-tests.fwb | 32 +++++++++++++++++---- 7 files changed, 53 insertions(+), 14 deletions(-) diff --git a/build_num b/build_num index b65125f40..a62a32961 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 2397 +#define BUILD_NUM 2398 diff --git a/doc/ChangeLog b/doc/ChangeLog index 9c8a49f4a..d0eb2017c 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,5 +1,10 @@ 2010-01-20 vadim + * PolicyCompiler_cisco_acls.cpp (setInterfaceAndDirectionBySrc::processNext): + fixes #1120 "redundant commands generated for ssh + access". Compiler for PIX generated two "ssh address netmask + inside" commands for the same rule that permits ssh to the firewall. + * CompilerDriver_pix_run.cpp (CompilerDriver_pix::assembleFwScript): fixes #1106 "fwb_pix does not include prolog". Prolog script was not included in generated configuration if firewall object was diff --git a/src/cisco_lib/Helper.cpp b/src/cisco_lib/Helper.cpp index a3b3c3b47..cfdaa9ca4 100644 --- a/src/cisco_lib/Helper.cpp +++ b/src/cisco_lib/Helper.cpp @@ -228,7 +228,9 @@ list Helper::findInterfaceByNetzoneOrAll(RuleElement *re) string("findInterfaceByNetzoneOrAll failed to retrieve first " "object from the rule element; is argument not of " "the type RuleElementSrc or RuleElementDst ?")); + return intf_id_list; } + try { intf_id_list.push_back( findInterfaceByNetzone( a ) ); diff --git a/src/cisco_lib/PolicyCompiler_cisco.cpp b/src/cisco_lib/PolicyCompiler_cisco.cpp index f008943bd..92e09f9d3 100644 --- a/src/cisco_lib/PolicyCompiler_cisco.cpp +++ b/src/cisco_lib/PolicyCompiler_cisco.cpp @@ -507,7 +507,10 @@ bool PolicyCompiler_cisco::tcpServiceToFW::processNext() RuleElementDst *ndst=r->getDst(); ndst->clearChildren(); ndst->setAnyElement(); -// ndst->addRef( compiler->fw ); + + // Was commented out in r50 + ndst->addRef( compiler->fw ); + RuleElementSrv *nsrv=r->getSrv(); nsrv->clearChildren(); nsrv->add( cl.front() ); diff --git a/src/cisco_lib/PolicyCompiler_cisco_acls.cpp b/src/cisco_lib/PolicyCompiler_cisco_acls.cpp index bee999843..91e637577 100644 --- a/src/cisco_lib/PolicyCompiler_cisco_acls.cpp +++ b/src/cisco_lib/PolicyCompiler_cisco_acls.cpp @@ -60,13 +60,19 @@ using namespace libfwbuilder; using namespace fwcompiler; using namespace std; + +/* + * Call this rule processor after splitIfSrcMatchesFw and + * splitIfDstMatchesFw to make sure that if firewall or its interface + * or address is in src or dst, it is the only object there. + */ bool PolicyCompiler_cisco::setInterfaceAndDirectionBySrc::processNext() { PolicyRule *rule=getNext(); if (rule==NULL) return false; Helper helper(compiler); - //RuleElementItf *itfre = rule->getItf(); RuleElementSrc *srcre = rule->getSrc(); + RuleElementDst *dstre = rule->getDst(); list intf_id_list; @@ -95,9 +101,12 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionBySrc::processNext() new_rule->setBool("interface_and_direction_set_from_src",true); tmp_queue.push_back(new_rule); } - // preserve original rule as well to let - // setInterfaceAndDirectionByDst work on it. - tmp_queue.push_back(rule); + // If dst does not match firewall, preserve original rule as + // well to let setInterfaceAndDirectionByDst work on it. + FWObject *d = dstre->front(); + if (FWReference::cast(d)!=NULL) d = FWReference::cast(d)->getPointer(); + if (!compiler->complexMatch(Address::cast(d), compiler->fw)) + tmp_queue.push_back(rule); return true; } tmp_queue.push_back(rule); @@ -115,8 +124,7 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionByDst::processNext() return true; } - //RuleElementItf *itfre=rule->getItf(); - RuleElementDst *dstre=rule->getDst(); + RuleElementDst *dstre = rule->getDst(); list intf_id_list; diff --git a/src/cisco_lib/PolicyCompiler_pix.cpp b/src/cisco_lib/PolicyCompiler_pix.cpp index 72959f379..5d6d0b4c9 100644 --- a/src/cisco_lib/PolicyCompiler_pix.cpp +++ b/src/cisco_lib/PolicyCompiler_pix.cpp @@ -803,6 +803,7 @@ void PolicyCompiler_pix::compile() if (outbound_acl_supported ) { + // Call these after splitIfSrcMatchesFw and splitIfDstMatchesFw add( new setInterfaceAndDirectionBySrc( "Set interface and direction for rules with interface 'all' using SRC; v7")); add( new setInterfaceAndDirectionByDst( diff --git a/test/pix/cluster-tests.fwb b/test/pix/cluster-tests.fwb index 3c7d2a01c..900b77b49 100644 --- a/test/pix/cluster-tests.fwb +++ b/test/pix/cluster-tests.fwb @@ -282,7 +282,7 @@ - + @@ -345,7 +345,27 @@ - + + + + + + + + + + + + + + + + + + + + + @@ -363,7 +383,7 @@ - + @@ -381,7 +401,7 @@ - + @@ -399,7 +419,7 @@ - + @@ -417,7 +437,7 @@ - +