From 2276f0bfce69be97ced07fe5834fb2a18a61f779 Mon Sep 17 00:00:00 2001 From: Vadim Kurland Date: Sat, 9 May 2009 23:04:23 +0000 Subject: [PATCH] 2009-05-09 vadim * platform/iptables.xml.in: Unified support for different iptables appliances: configuration will require platform "iptables" and host os that corresponds to the chosen appliance. This matches support for Secuwall and is easier to maintain than separate platform-os pairs for each appliance. --- build_num | 2 +- configure.in | 3 - doc/ChangeLog | 8 +++ src/gui/iptAdvancedDialog.cpp | 4 +- src/gui/newFirewallDialog.cpp | 12 ++-- src/gui/newfirewalldialog_q.ui | 18 +----- src/ipt/ipt.cpp | 24 +++---- src/res/os/endian_os.xml | 6 ++ src/res/os/endian_os.xml.in | 6 ++ src/res/os/ipcop_os.xml | 6 ++ src/res/os/ipcop_os.xml.in | 6 ++ src/res/os/linksys.xml | 3 + src/res/os/linksys.xml.in | 3 + src/res/os/linux24.xml | 1 + src/res/os/linux24.xml.in | 1 + src/res/os/oneshield_os.xml | 6 ++ src/res/os/oneshield_os.xml.in | 6 ++ src/res/platform/endian.xml | 101 ------------------------------ src/res/platform/endian.xml.in | 101 ------------------------------ src/res/platform/ipcop.xml | 101 ------------------------------ src/res/platform/ipcop.xml.in | 101 ------------------------------ src/res/platform/iptables.xml | 3 +- src/res/platform/iptables.xml.in | 3 +- src/res/platform/oneshield.xml | 101 ------------------------------ src/res/platform/oneshield.xml.in | 101 ------------------------------ src/res/templates.xml | 4 +- src/res/templates.xml.in | 4 +- 27 files changed, 82 insertions(+), 653 deletions(-) delete mode 100644 src/res/platform/endian.xml delete mode 100644 src/res/platform/endian.xml.in delete mode 100644 src/res/platform/ipcop.xml delete mode 100644 src/res/platform/ipcop.xml.in delete mode 100644 src/res/platform/oneshield.xml delete mode 100644 src/res/platform/oneshield.xml.in diff --git a/build_num b/build_num index 9b32b3a8c..6c80b7edd 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 906 +#define BUILD_NUM 912 diff --git a/configure.in b/configure.in index df831a126..af5bc3da6 100644 --- a/configure.in +++ b/configure.in @@ -465,9 +465,6 @@ AC_CONFIG_FILES([ src/res/platform/iptables.xml ]) AC_CONFIG_FILES([ src/res/platform/pf.xml ]) AC_CONFIG_FILES([ src/res/platform/pix.xml ]) AC_CONFIG_FILES([ src/res/platform/iosacl.xml ]) -AC_CONFIG_FILES([ src/res/platform/ipcop.xml ]) -AC_CONFIG_FILES([ src/res/platform/endian.xml ]) -AC_CONFIG_FILES([ src/res/platform/oneshield.xml ]) AC_CONFIG_FILES([ src/res/platform/unknown.xml ]) diff --git a/doc/ChangeLog b/doc/ChangeLog index f30608e13..0eac593b8 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,3 +1,11 @@ +2009-05-09 vadim + + * platform/iptables.xml.in: Unified support for different iptables + appliances: configuration will require platform "iptables" and + host os that corresponds to the chosen appliance. This matches + support for Secuwall and is easier to maintain than separate + platform-os pairs for each appliance. + 2009-05-06 vadim * FirewallInstallerCisco.cpp (FirewallInstallerCisco::activatePolicy): diff --git a/src/gui/iptAdvancedDialog.cpp b/src/gui/iptAdvancedDialog.cpp index 6de3495a7..8b2fca101 100644 --- a/src/gui/iptAdvancedDialog.cpp +++ b/src/gui/iptAdvancedDialog.cpp @@ -77,10 +77,10 @@ iptAdvancedDialog::iptAdvancedDialog(QWidget *parent,FWObject *o) obj->getStr("host_OS"),"user_can_change_install_dir").c_str()); if (!Resources::getTargetOptionBool( - obj->getStr("host_OS"),"user_can_change_install_dir")) + obj->getStr("host_OS"), "user_can_change_install_dir")) { m_dialog->ipt_fw_dir->setEnabled(false); - fwoptions->setStr("firewall_dir",""); + //fwoptions->setStr("firewall_dir", ""); } //QString s = fwoptions->getStr("ipv4_6_order") diff --git a/src/gui/newFirewallDialog.cpp b/src/gui/newFirewallDialog.cpp index f8c18d4b2..14a504a98 100644 --- a/src/gui/newFirewallDialog.cpp +++ b/src/gui/newFirewallDialog.cpp @@ -840,13 +840,15 @@ void newFirewallDialog::finishClicked() return; } - nfw=Firewall::cast(no); + nfw = Firewall::cast(no); - no->setStr("platform", platform); - Resources::setDefaultTargetOptions(platform , nfw); + // preserve platform and host OS from the template, do not + // reset from the first page of the dialog. - no->setStr("host_OS", host_os); - Resources::setDefaultTargetOptions(host_os , nfw); + //no->setStr("platform", platform); + //Resources::setDefaultTargetOptions(platform , nfw); + //no->setStr("host_OS", host_os); + //Resources::setDefaultTargetOptions(host_os , nfw); } else diff --git a/src/gui/newfirewalldialog_q.ui b/src/gui/newfirewalldialog_q.ui index d3ec439b9..280ebd900 100644 --- a/src/gui/newfirewalldialog_q.ui +++ b/src/gui/newfirewalldialog_q.ui @@ -50,7 +50,7 @@ - 2 + 0 @@ -1325,22 +1325,6 @@ - - hostOS - activated(int) - newFirewallDialog_q - changed() - - - 20 - 20 - - - 20 - 20 - - - iface_list currentItemChanged(QTreeWidgetItem*,QTreeWidgetItem*) diff --git a/src/ipt/ipt.cpp b/src/ipt/ipt.cpp index 6dd44db4b..f4e9187b7 100644 --- a/src/ipt/ipt.cpp +++ b/src/ipt/ipt.cpp @@ -336,11 +336,13 @@ bool processPolicyRuleSet( bool empty_output = true; string prolog_place = fw->getOptionsObject()->getStr("prolog_place"); string platform = fw->getStr("platform"); - bool flush_and_set_default_policy = Resources::getTargetCapabilityBool( - platform, "flush_and_set_default_policy"); + string host_os = fw->getStr("host_OS"); + bool flush_and_set_default_policy = Resources::getTargetOptionBool( + host_os, "default/flush_and_set_default_policy"); string platform_family = Resources::platform_res[platform]-> getResourceStr("/FWBuilderResources/Target/family"); - + string os_family = Resources::os_res[host_os]-> + getResourceStr("/FWBuilderResources/Target/family"); Policy *policy = Policy::cast(ruleset); assignRuleSetChain(policy); @@ -352,7 +354,7 @@ bool processPolicyRuleSet( MangleTableCompiler_ipt *mangle_compiler; - if (platform_family == "ipcop") + if (os_family == "ipcop") mangle_compiler = new MangleTableCompiler_ipcop( objdb , fwobjectname.toUtf8().constData(), ipv6_policy , oscnf, @@ -442,7 +444,7 @@ bool processPolicyRuleSet( PolicyCompiler_ipt *policy_compiler; - if (platform_family == "ipcop") + if (os_family == "ipcop") policy_compiler = new PolicyCompiler_ipcop( objdb,fwobjectname.toUtf8().constData(), ipv6_policy, oscnf, &minus_n_commands_filter); @@ -855,11 +857,11 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi string os_variant = DISTRO; - bool flush_and_set_default_policy = Resources::getTargetCapabilityBool( - platform, "flush_and_set_default_policy"); + bool flush_and_set_default_policy = Resources::getTargetOptionBool( + host_os, "default/flush_and_set_default_policy"); /* minimal sanity checking */ - if (platform_family == "ipcop") + if (os_family == "ipcop") { os_variant = "ipcop"; @@ -1002,7 +1004,7 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi // being created for NAT NATCompiler_ipt *nat_compiler; - if (platform_family == "ipcop") + if (os_family == "ipcop") nat_compiler = new NATCompiler_ipcop( objdb, fwobjectname.toUtf8().constData(), ipv6_policy, oscnf, &minus_n_commands_nat); @@ -1099,7 +1101,7 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi RoutingCompiler_ipt *routing_compiler; - if (platform_family == "ipcop") + if (os_family == "ipcop") routing_compiler = new RoutingCompiler_ipcop( objdb , fwobjectname.toUtf8().constData() , false, oscnf ); else @@ -1262,7 +1264,7 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi prolog_done = true; } - if (platform_family != "ipcop") + if (os_family != "ipcop") { script << " log '"; if (omit_timestamp) diff --git a/src/res/os/endian_os.xml b/src/res/os/endian_os.xml index 9a151d096..9d1a4f95e 100644 --- a/src/res/os/endian_os.xml +++ b/src/res/os/endian_os.xml @@ -9,7 +9,13 @@ false 1 + lo + /etc/rc.d/ + rc.firewall.local + root + /etc/rc.d/rc.firewall restart + False diff --git a/src/res/os/endian_os.xml.in b/src/res/os/endian_os.xml.in index de5139e78..8f832d490 100644 --- a/src/res/os/endian_os.xml.in +++ b/src/res/os/endian_os.xml.in @@ -9,7 +9,13 @@ false 1 + lo + /etc/rc.d/ + rc.firewall.local + root + /etc/rc.d/rc.firewall restart + False diff --git a/src/res/os/ipcop_os.xml b/src/res/os/ipcop_os.xml index 4b8edd2ef..64298a03c 100644 --- a/src/res/os/ipcop_os.xml +++ b/src/res/os/ipcop_os.xml @@ -9,7 +9,13 @@ false 1 + lo + /etc/rc.d/ + rc.firewall.local + root + /etc/rc.d/rc.firewall restart + False diff --git a/src/res/os/ipcop_os.xml.in b/src/res/os/ipcop_os.xml.in index f948a8d15..6ea21aa61 100644 --- a/src/res/os/ipcop_os.xml.in +++ b/src/res/os/ipcop_os.xml.in @@ -9,7 +9,13 @@ false 1 + lo + /etc/rc.d/ + rc.firewall.local + root + /etc/rc.d/rc.firewall restart + False diff --git a/src/res/os/linksys.xml b/src/res/os/linksys.xml index 44f96e9c4..87657eeb2 100644 --- a/src/res/os/linksys.xml +++ b/src/res/os/linksys.xml @@ -10,6 +10,9 @@ 1 lo + /tmp + root + True $ # diff --git a/src/res/os/linksys.xml.in b/src/res/os/linksys.xml.in index 3f34e6c84..14d1a8cb9 100644 --- a/src/res/os/linksys.xml.in +++ b/src/res/os/linksys.xml.in @@ -10,6 +10,9 @@ 1 lo + /tmp + root + True $ # diff --git a/src/res/os/linux24.xml b/src/res/os/linux24.xml index 2baf8a053..9eb66421a 100644 --- a/src/res/os/linux24.xml +++ b/src/res/os/linux24.xml @@ -10,6 +10,7 @@ 1 lo + True diff --git a/src/res/os/linux24.xml.in b/src/res/os/linux24.xml.in index a5afd5f2c..bbfed6d4e 100644 --- a/src/res/os/linux24.xml.in +++ b/src/res/os/linux24.xml.in @@ -10,6 +10,7 @@ 1 lo + True diff --git a/src/res/os/oneshield_os.xml b/src/res/os/oneshield_os.xml index afed039b0..e0754be71 100644 --- a/src/res/os/oneshield_os.xml +++ b/src/res/os/oneshield_os.xml @@ -9,7 +9,13 @@ false 1 + lo + /etc/rc.d/ + rc.firewall.local + root + /etc/rc.d/rc.firewall restart + False diff --git a/src/res/os/oneshield_os.xml.in b/src/res/os/oneshield_os.xml.in index e280d155a..1b0821391 100644 --- a/src/res/os/oneshield_os.xml.in +++ b/src/res/os/oneshield_os.xml.in @@ -9,7 +9,13 @@ false 1 + lo + /etc/rc.d/ + rc.firewall.local + root + /etc/rc.d/rc.firewall restart + False diff --git a/src/res/platform/endian.xml b/src/res/platform/endian.xml deleted file mode 100644 index d46b42172..000000000 --- a/src/res/platform/endian.xml +++ /dev/null @@ -1,101 +0,0 @@ - - - - Endian Firewall Apliance (iptables) - Appliances - fwb_ipt - ipcop - endian_os - ipcop - - - - true - true - true - true - true - true - true - info - RULE %N -- %A - 1 - 0 - true - true - false - - /etc/rc.d/ - rc.firewall.local - root - /etc/rc.d/rc.firewall restart - - - - - - - True - True - True - True - True - True - True - True - True - False - False - False - True - False - - - True - None - - - True - None - - - True - Reject - - - True - AccountingStr - - - True - TagInt - - - True - None - - - True - ClassifyStr - - - True - CustomStr - - - True - BranchChain - - - True - RouteIPT - - - True - None - - - - - - diff --git a/src/res/platform/endian.xml.in b/src/res/platform/endian.xml.in deleted file mode 100644 index 4418d0087..000000000 --- a/src/res/platform/endian.xml.in +++ /dev/null @@ -1,101 +0,0 @@ - - - - Endian Firewall Apliance (iptables) - Appliances - fwb_ipt - ipcop - endian_os - ipcop - - - - true - true - true - true - true - true - true - info - RULE %N -- %A - 1 - 0 - true - true - false - - /etc/rc.d/ - rc.firewall.local - root - /etc/rc.d/rc.firewall restart - - - - - - - True - True - True - True - True - True - True - True - True - False - False - False - True - False - - - True - None - - - True - None - - - True - Reject - - - True - AccountingStr - - - True - TagInt - - - True - None - - - True - ClassifyStr - - - True - CustomStr - - - True - BranchChain - - - True - RouteIPT - - - True - None - - - - - - diff --git a/src/res/platform/ipcop.xml b/src/res/platform/ipcop.xml deleted file mode 100644 index f7a421e41..000000000 --- a/src/res/platform/ipcop.xml +++ /dev/null @@ -1,101 +0,0 @@ - - - - IPCOP Firewall Apliance (iptables) - Appliances - fwb_ipt - ipcop - ipcop_os - ipcop - - - - true - true - true - true - true - true - true - info - RULE %N -- %A - 1 - 0 - true - true - false - - /etc/rc.d/ - rc.firewall.local - root - /etc/rc.d/rc.firewall restart - - - - - - - True - True - True - True - True - True - True - True - True - False - False - False - True - False - - - True - None - - - True - None - - - True - Reject - - - True - AccountingStr - - - True - TagInt - - - True - None - - - True - ClassifyStr - - - True - CustomStr - - - True - BranchChain - - - True - RouteIPT - - - True - None - - - - - - diff --git a/src/res/platform/ipcop.xml.in b/src/res/platform/ipcop.xml.in deleted file mode 100644 index a8a2c8e02..000000000 --- a/src/res/platform/ipcop.xml.in +++ /dev/null @@ -1,101 +0,0 @@ - - - - IPCOP Firewall Apliance (iptables) - Appliances - fwb_ipt - ipcop - ipcop_os - ipcop - - - - true - true - true - true - true - true - true - info - RULE %N -- %A - 1 - 0 - true - true - false - - /etc/rc.d/ - rc.firewall.local - root - /etc/rc.d/rc.firewall restart - - - - - - - True - True - True - True - True - True - True - True - True - False - False - False - True - False - - - True - None - - - True - None - - - True - Reject - - - True - AccountingStr - - - True - TagInt - - - True - None - - - True - ClassifyStr - - - True - CustomStr - - - True - BranchChain - - - True - RouteIPT - - - True - None - - - - - - diff --git a/src/res/platform/iptables.xml b/src/res/platform/iptables.xml index 1daca5128..e201394e5 100644 --- a/src/res/platform/iptables.xml +++ b/src/res/platform/iptables.xml @@ -8,7 +8,7 @@ - linux24,linksys + linux24,linksys,ipcop_os,endian_os,oneshield_os iptables @@ -44,7 +44,6 @@ False False True - True True diff --git a/src/res/platform/iptables.xml.in b/src/res/platform/iptables.xml.in index 3af21943d..67c7379e7 100644 --- a/src/res/platform/iptables.xml.in +++ b/src/res/platform/iptables.xml.in @@ -8,7 +8,7 @@ - linux24,linksys + linux24,linksys,ipcop_os,endian_os,oneshield_os iptables @@ -44,7 +44,6 @@ False False True - True True diff --git a/src/res/platform/oneshield.xml b/src/res/platform/oneshield.xml deleted file mode 100644 index 878f20ef6..000000000 --- a/src/res/platform/oneshield.xml +++ /dev/null @@ -1,101 +0,0 @@ - - - - OneShield Firewall Apliance (iptables) - Appliances - fwb_ipt - ipcop - oneshield_os - ipcop - - - - true - true - true - true - true - true - true - info - RULE %N -- %A - 1 - 0 - true - true - false - - /etc/rc.d/ - rc.firewall.local - root - /etc/rc.d/rc.firewall restart - - - - - - - True - True - True - True - True - True - True - True - True - False - False - False - True - False - - - True - None - - - True - None - - - True - Reject - - - True - AccountingStr - - - True - TagInt - - - True - None - - - True - ClassifyStr - - - True - CustomStr - - - True - BranchChain - - - True - RouteIPT - - - True - None - - - - - - diff --git a/src/res/platform/oneshield.xml.in b/src/res/platform/oneshield.xml.in deleted file mode 100644 index f97a1de01..000000000 --- a/src/res/platform/oneshield.xml.in +++ /dev/null @@ -1,101 +0,0 @@ - - - - OneShield Firewall Apliance (iptables) - Appliances - fwb_ipt - ipcop - oneshield_os - ipcop - - - - true - true - true - true - true - true - true - info - RULE %N -- %A - 1 - 0 - true - true - false - - /etc/rc.d/ - rc.firewall.local - root - /etc/rc.d/rc.firewall restart - - - - - - - True - True - True - True - True - True - True - True - True - False - False - False - True - False - - - True - None - - - True - None - - - True - Reject - - - True - AccountingStr - - - True - TagInt - - - True - None - - - True - ClassifyStr - - - True - CustomStr - - - True - BranchChain - - - True - RouteIPT - - - True - None - - - - - - diff --git a/src/res/templates.xml b/src/res/templates.xml index da456d3cb..e3efd8856 100644 --- a/src/res/templates.xml +++ b/src/res/templates.xml @@ -1705,7 +1705,7 @@ - + @@ -1768,7 +1768,7 @@ - + diff --git a/src/res/templates.xml.in b/src/res/templates.xml.in index b5c2a4c67..40964c61b 100644 --- a/src/res/templates.xml.in +++ b/src/res/templates.xml.in @@ -1705,7 +1705,7 @@ - + @@ -1768,7 +1768,7 @@ - +