diff --git a/build_num b/build_num index 1c9fcc9bc..39acaa7d4 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 3146 +#define BUILD_NUM 3149 diff --git a/src/iptlib/NATCompiler_PrintRule.cpp b/src/iptlib/NATCompiler_PrintRule.cpp index 8dc67d8ef..6df9f30ca 100644 --- a/src/iptlib/NATCompiler_PrintRule.cpp +++ b/src/iptlib/NATCompiler_PrintRule.cpp @@ -501,6 +501,20 @@ string NATCompiler_ipt::PrintRule::_printDstService(RuleElementOSrv *rel) return ostr.str(); } +string NATCompiler_ipt::PrintRule::_printIpSetMatch(Address *o, RuleElement *rel) +{ + NATCompiler_ipt *ipt_comp=dynamic_cast(compiler); + string set_name = + dynamic_cast(ipt_comp->osconfigurator)->normalizeSetName(o->getName()); + string suffix = "dst"; + if (RuleElementOSrc::isA(rel)) suffix = "src"; + if (RuleElementODst::isA(rel)) suffix = "dst"; + string set_match = "--set " + set_name + " " + suffix; + ostringstream ostr; + ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match); + return ostr.str(); +} + // Note print_mask is true by default, print_range is false by default. string NATCompiler_ipt::PrintRule::_printAddr(Address *o, bool , @@ -659,9 +673,17 @@ bool NATCompiler_ipt::PrintRule::processNext() const InetAddr *osrc_addr = osrc->getAddressPtr(); if (osrc_addr==NULL || !osrc_addr->isAny()) { - string osrc_out = _printAddr(osrc); - if (!osrc_out.empty()) - cmdout << _printSingleOptionWithNegation(" -s", osrcrel, osrc_out); + MultiAddressRunTime *atrt = MultiAddressRunTime::cast(osrc); + if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME && + ipt_comp->using_ipset) + { + cmdout << _printIpSetMatch(osrc, osrcrel); + } else + { + string osrc_out = _printAddr(osrc); + if (!osrc_out.empty()) + cmdout << _printSingleOptionWithNegation(" -s", osrcrel, osrc_out); + } } // cmdout << " -s "; @@ -676,7 +698,13 @@ bool NATCompiler_ipt::PrintRule::processNext() if (!odst->isAny()) { - cmdout << _printSingleOptionWithNegation(" -d", odstrel, _printAddr(odst)); + MultiAddressRunTime *atrt = MultiAddressRunTime::cast(odst); + if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME && + ipt_comp->using_ipset) + { + cmdout << _printIpSetMatch(odst, odstrel); + } else + cmdout << _printSingleOptionWithNegation(" -d", odstrel, _printAddr(odst)); } cmdout << " "; diff --git a/src/iptlib/NATCompiler_ipt.cpp b/src/iptlib/NATCompiler_ipt.cpp index 006f63897..bb33894e8 100644 --- a/src/iptlib/NATCompiler_ipt.cpp +++ b/src/iptlib/NATCompiler_ipt.cpp @@ -214,6 +214,10 @@ int NATCompiler_ipt::prolog() } } + string version = fw->getStr("version"); + using_ipset = (XMLTools::version_compare(version, "1.4.1.1") >= 0 && + fwopt->getBool("use_m_set")); + return n; } diff --git a/src/iptlib/NATCompiler_ipt.h b/src/iptlib/NATCompiler_ipt.h index d5ec84b30..4f93ea21a 100644 --- a/src/iptlib/NATCompiler_ipt.h +++ b/src/iptlib/NATCompiler_ipt.h @@ -60,7 +60,8 @@ namespace fwcompiler { class PrintRule; NATCompiler_ipt::PrintRule *printRule; - bool have_dynamic_interfaces; + bool have_dynamic_interfaces; + bool using_ipset; std::map chain_usage_counter; // use minus_n_commands map to track creation of chains. @@ -535,6 +536,8 @@ namespace fwcompiler { virtual std::string _printAddr(libfwbuilder::Address *o, bool print_mask=true, bool print_range=false); + virtual std::string _printIpSetMatch( + libfwbuilder::Address *o, libfwbuilder::RuleElement *rel); virtual std::string _printChainDirectionAndInterface(libfwbuilder::NATRule *r); virtual std::string _printSingleObjectNegation(libfwbuilder::RuleElement *rel); diff --git a/src/iptlib/PolicyCompiler_PrintRule.cpp b/src/iptlib/PolicyCompiler_PrintRule.cpp index 2e46bd02e..b8e9ce30d 100644 --- a/src/iptlib/PolicyCompiler_PrintRule.cpp +++ b/src/iptlib/PolicyCompiler_PrintRule.cpp @@ -1133,14 +1133,7 @@ string PolicyCompiler_ipt::PrintRule::_printSrcAddr(RuleElement *rel, Address * if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME && ipt_comp->using_ipset) { - ipt_comp->actually_used_module_set = true; - string set_name = - dynamic_cast(ipt_comp->osconfigurator)->normalizeSetName(o->getName()); - ipt_comp->ipset_tables[set_name] = atrt->getSourceName(); - string set_match = "--set " + set_name + " src"; - ostringstream ostr; - ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match); - return ostr.str(); + return _printIpSetMatch(o, rel); } return _printSingleOptionWithNegation(" -s", rel, _printAddr(o)); @@ -1170,19 +1163,26 @@ string PolicyCompiler_ipt::PrintRule::_printDstAddr(RuleElement *rel, Address * if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME && ipt_comp->using_ipset) { - ipt_comp->actually_used_module_set = true; - string set_name = - dynamic_cast(ipt_comp->osconfigurator)->normalizeSetName(o->getName()); - ipt_comp->ipset_tables[set_name] = atrt->getSourceName(); - string set_match = "--set " + set_name + " dst"; - ostringstream ostr; - ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match); - return ostr.str(); + return _printIpSetMatch(o, rel); } return _printSingleOptionWithNegation(" -d", rel, _printAddr(o)); } +string PolicyCompiler_ipt::PrintRule::_printIpSetMatch(Address *o, RuleElement *rel) +{ + PolicyCompiler_ipt *ipt_comp=dynamic_cast(compiler); + string set_name = + dynamic_cast(ipt_comp->osconfigurator)->normalizeSetName(o->getName()); + string suffix = "dst"; + if (RuleElementSrc::isA(rel)) suffix = "src"; + if (RuleElementDst::isA(rel)) suffix = "dst"; + string set_match = "--set " + set_name + " " + suffix; + ostringstream ostr; + ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match); + return ostr.str(); +} + string PolicyCompiler_ipt::PrintRule::_printAddr(Address *o) { PolicyCompiler_ipt *ipt_comp=dynamic_cast(compiler); diff --git a/src/iptlib/PolicyCompiler_ipt.h b/src/iptlib/PolicyCompiler_ipt.h index 851a7a0ac..b2e9afb3c 100644 --- a/src/iptlib/PolicyCompiler_ipt.h +++ b/src/iptlib/PolicyCompiler_ipt.h @@ -1005,6 +1005,8 @@ public: virtual std::string _printDstAddr(libfwbuilder::RuleElement *rel, libfwbuilder::Address *o); virtual std::string _printAddr(libfwbuilder::Address *o); + virtual std::string _printIpSetMatch( + libfwbuilder::Address *o, libfwbuilder::RuleElement *rel); virtual std::string _printSingleObjectNegation( libfwbuilder::RuleElement *rel); virtual std::string _printChain(libfwbuilder::PolicyRule *r); diff --git a/test/ipt/objects-for-regression-tests.fwb b/test/ipt/objects-for-regression-tests.fwb index 6473222dc..648c53f39 100644 --- a/test/ipt/objects-for-regression-tests.fwb +++ b/test/ipt/objects-for-regression-tests.fwb @@ -53353,8 +53353,71 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -53705,8 +53768,71 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +