fixed #1633 use ipset module in NATCompiler_ipt

build_num

@@ -1 +1 @@
-#define BUILD_NUM 3146
+#define BUILD_NUM 3149

src/iptlib/NATCompiler_PrintRule.cpp

@@ -501,6 +501,20 @@ string NATCompiler_ipt::PrintRule::_printDstService(RuleElementOSrv  *rel)
     return ostr.str();
 }
 
+string NATCompiler_ipt::PrintRule::_printIpSetMatch(Address  *o, RuleElement *rel)
+{
+    NATCompiler_ipt *ipt_comp=dynamic_cast<NATCompiler_ipt*>(compiler);
+    string set_name =
+        dynamic_cast<OSConfigurator_linux24*>(ipt_comp->osconfigurator)->normalizeSetName(o->getName());
+    string suffix = "dst";
+    if (RuleElementOSrc::isA(rel)) suffix = "src";
+    if (RuleElementODst::isA(rel)) suffix = "dst";
+    string set_match = "--set " + set_name + " " + suffix;
+    ostringstream ostr;
+    ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match);
+    return ostr.str();
+}
+
 // Note print_mask is true by default, print_range is false by default.
 string NATCompiler_ipt::PrintRule::_printAddr(Address  *o,
                                               bool ,
@@ -659,9 +673,17 @@ bool NATCompiler_ipt::PrintRule::processNext()
         const InetAddr *osrc_addr = osrc->getAddressPtr();
         if (osrc_addr==NULL || !osrc_addr->isAny())
         {
-            string osrc_out = _printAddr(osrc);
+            MultiAddressRunTime *atrt = MultiAddressRunTime::cast(osrc);
-            if (!osrc_out.empty())
+            if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME &&
-                cmdout << _printSingleOptionWithNegation(" -s", osrcrel, osrc_out);
+                ipt_comp->using_ipset)
+            {
+                cmdout << _printIpSetMatch(osrc, osrcrel);
+            } else
+            {
+                string osrc_out = _printAddr(osrc);
+                if (!osrc_out.empty())
+                    cmdout << _printSingleOptionWithNegation(" -s", osrcrel, osrc_out);
+            }
         }
 
 //	cmdout << " -s ";
@@ -676,7 +698,13 @@ bool NATCompiler_ipt::PrintRule::processNext()
 
     if (!odst->isAny())
     {
-        cmdout << _printSingleOptionWithNegation(" -d", odstrel, _printAddr(odst));
+        MultiAddressRunTime *atrt = MultiAddressRunTime::cast(odst);
+        if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME &&
+            ipt_comp->using_ipset)
+        {
+            cmdout << _printIpSetMatch(odst, odstrel);
+        } else
+            cmdout << _printSingleOptionWithNegation(" -d", odstrel, _printAddr(odst));
     }
 
     cmdout << " ";

src/iptlib/NATCompiler_ipt.cpp

@@ -214,6 +214,10 @@ int NATCompiler_ipt::prolog()
 	}
     }
 
+    string version = fw->getStr("version");
+    using_ipset = (XMLTools::version_compare(version, "1.4.1.1") >= 0 &&
+                          fwopt->getBool("use_m_set"));
+
     return n;
 }
 

src/iptlib/NATCompiler_ipt.h

@@ -60,7 +60,8 @@ namespace fwcompiler {
         class PrintRule;
 
         NATCompiler_ipt::PrintRule *printRule;
-        bool   have_dynamic_interfaces;
+        bool have_dynamic_interfaces;
+        bool using_ipset;
         std::map<std::string, int> chain_usage_counter;
 
         // use minus_n_commands map to track creation of chains.
@@ -535,6 +536,8 @@ namespace fwcompiler {
             virtual std::string _printAddr(libfwbuilder::Address  *o,
                                            bool print_mask=true,
                                            bool print_range=false);
+            virtual std::string _printIpSetMatch(
+                libfwbuilder::Address *o, libfwbuilder::RuleElement *rel);
             virtual std::string _printChainDirectionAndInterface(libfwbuilder::NATRule *r);
             virtual std::string _printSingleObjectNegation(libfwbuilder::RuleElement *rel);
 

src/iptlib/PolicyCompiler_PrintRule.cpp

@@ -1133,14 +1133,7 @@ string PolicyCompiler_ipt::PrintRule::_printSrcAddr(RuleElement *rel, Address  *
     if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME &&
         ipt_comp->using_ipset)
     {
-        ipt_comp->actually_used_module_set = true;
+        return _printIpSetMatch(o, rel);
-        string set_name =
-            dynamic_cast<OSConfigurator_linux24*>(ipt_comp->osconfigurator)->normalizeSetName(o->getName());
-        ipt_comp->ipset_tables[set_name] = atrt->getSourceName();
-        string set_match = "--set " + set_name + " src";
-        ostringstream ostr;
-        ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match);
-        return ostr.str();
     }
 
     return _printSingleOptionWithNegation(" -s", rel, _printAddr(o));
@@ -1170,19 +1163,26 @@ string PolicyCompiler_ipt::PrintRule::_printDstAddr(RuleElement *rel, Address  *
     if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME &&
         ipt_comp->using_ipset)
     {
-        ipt_comp->actually_used_module_set = true;
+        return _printIpSetMatch(o, rel);
-        string set_name =
-            dynamic_cast<OSConfigurator_linux24*>(ipt_comp->osconfigurator)->normalizeSetName(o->getName());
-        ipt_comp->ipset_tables[set_name] = atrt->getSourceName();
-        string set_match = "--set " + set_name + " dst";
-        ostringstream ostr;
-        ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match);
-        return ostr.str();
     }
 
     return _printSingleOptionWithNegation(" -d", rel, _printAddr(o));
 }
 
+string PolicyCompiler_ipt::PrintRule::_printIpSetMatch(Address *o, RuleElement *rel)
+{
+    PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
+    string set_name =
+        dynamic_cast<OSConfigurator_linux24*>(ipt_comp->osconfigurator)->normalizeSetName(o->getName());
+    string suffix = "dst";
+    if (RuleElementSrc::isA(rel)) suffix = "src";
+    if (RuleElementDst::isA(rel)) suffix = "dst";
+    string set_match = "--set " + set_name + " " + suffix;
+    ostringstream ostr;
+    ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match);
+    return ostr.str();
+}
+
 string PolicyCompiler_ipt::PrintRule::_printAddr(Address  *o)
 {
     PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);

src/iptlib/PolicyCompiler_ipt.h

@@ -1005,6 +1005,8 @@ public:
             virtual std::string _printDstAddr(libfwbuilder::RuleElement *rel,
                                               libfwbuilder::Address *o);
             virtual std::string _printAddr(libfwbuilder::Address *o);
+            virtual std::string _printIpSetMatch(
+                libfwbuilder::Address *o, libfwbuilder::RuleElement *rel);
             virtual std::string _printSingleObjectNegation(
                 libfwbuilder::RuleElement *rel);
             virtual std::string _printChain(libfwbuilder::PolicyRule *r);

test/ipt/objects-for-regression-tests.fwb

@@ -53353,8 +53353,71 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id56583X26628" host_OS="linux24" inactive="False" lastCompiled="1279850008" lastInstalled="0" lastModified="1279855256" platform="iptables" version="1.4.1.1" name="firewall41-1" comment="testing run time address table objects with module set" ro="False">
+      <Firewall id="id56583X26628" host_OS="linux24" inactive="False" lastCompiled="1279850008" lastInstalled="0" lastModified="1279949656" platform="iptables" version="1.4.1.1" name="firewall41-1" comment="testing run time address table objects with module set" ro="False">
         <NAT id="id56688X26628" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id985478X9995" disabled="False" position="0" action="Translate" comment="">
+            <OSrc neg="False">
+              <ObjectRef ref="id44F7056328576"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id56591X26628"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id2287813X9995" disabled="False" group="" position="1" action="Translate" comment="">
+            <OSrc neg="True">
+              <ObjectRef ref="id44F7056328576"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id56591X26628"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id985500X9995" disabled="False" group="" position="2" action="Translate" comment="">
+            <OSrc neg="False">
+              <ObjectRef ref="sysid0"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="id44F7056328576"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="id46523X95438"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <NATRuleOptions/>
+          </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id56601X26628" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
@@ -53705,8 +53768,71 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id4374266X29460" host_OS="openwrt" inactive="False" lastCompiled="1279850008" lastInstalled="0" lastModified="1279855986" platform="iptables" version="1.4.3" name="firewall41-2" comment="testing run time address table objects with module set&#10;use module set is turned off&#10;" ro="False">
+      <Firewall id="id4374266X29460" host_OS="openwrt" inactive="False" lastCompiled="1279850008" lastInstalled="0" lastModified="1279949642" platform="iptables" version="1.4.3" name="firewall41-2" comment="testing run time address table objects with module set&#10;use module set is turned off&#10;" ro="False">
         <NAT id="id4374396X29460" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id1543124X9995" disabled="False" group="" position="0" action="Translate" comment="">
+            <OSrc neg="False">
+              <ObjectRef ref="id44F7056328576"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id56591X26628"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id2101361X9995" disabled="False" group="" position="1" action="Translate" comment="">
+            <OSrc neg="True">
+              <ObjectRef ref="id44F7056328576"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id56591X26628"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id1543070X9995" disabled="False" group="" position="2" action="Translate" comment="">
+            <OSrc neg="False">
+              <ObjectRef ref="sysid0"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="id44F7056328576"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="id46523X95438"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <NATRuleOptions/>
+          </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id4374284X29460" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">