onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-03-21 10:47:16 +01:00
Code Issues Releases Wiki Activity

* CompilerDriver_pix_run.cpp (pixSecurityLevelChecks): see #2351

Browse Source 
Security levels of ASA and FWSM interfaces do not have to be
unique. Removed check that enforced this.
This commit is contained in:
Vadim Kurland 2011-04-14 18:58:36 -07:00
parent dbb1e8ab57
commit 14258139ee
2 changed files with 19 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/ChangeLog
View File

@ -1,5 +1,9 @@
2011-04-14 vadim <vadim@netcitadel.com>
* CompilerDriver_pix_run.cpp (pixSecurityLevelChecks): see #2351
Security levels of ASA and FWSM interfaces do not have to be
unique. Removed check that enforced this.
* IPTImporterRun.cpp (run): see #2275 Importer for iptables now
correctly handles both "intrapositioned" ("-s ! address") and
"extrapositioned" ("! -s address") negation.

29
src/cisco_lib/CompilerDriver_pix_run.cpp
View File

@ -638,20 +638,21 @@ void CompilerDriver_pix::pixSecurityLevelChecks(Firewall *fw,
iface2->getOptionsObject()->getBool("cluster_interface"))
continue;
if (iface->getSecurityLevel()==iface2->getSecurityLevel())
{
QString err(
"Security level of each interface should be unique, "
"however interfaces %1 (%2) and %3 (%4)"
" have the same security level."
);
abort(fw, NULL, NULL,
err.arg(iface->getName().c_str())
.arg(iface->getLabel().c_str())
.arg(iface2->getName().c_str())
.arg(iface2->getLabel().c_str()).toStdString());
throw FatalErrorInSingleRuleCompileMode();
}
// see #2351. Security levels do not have to be unique
// if (iface->getSecurityLevel()==iface2->getSecurityLevel())
// {
// QString err(
// "Security level of each interface should be unique, "
// "however interfaces %1 (%2) and %3 (%4)"
// " have the same security level."
// );
// abort(fw, NULL, NULL,
// err.arg(iface->getName().c_str())
// .arg(iface->getLabel().c_str())
// .arg(iface2->getName().c_str())
// .arg(iface2->getLabel().c_str()).toStdString());
// throw FatalErrorInSingleRuleCompileMode();
// }
if (iface->getLabel()==iface2->getLabel())
{