2009-05-09 vadim <vadim@vk.crocodile.org>

* platform/iptables.xml.in: Unified support for different iptables
appliances: configuration will require platform "iptables" and
host os that corresponds to the chosen appliance. This matches
support for Secuwall and is easier to maintain than separate
platform-os pairs for each appliance.

build_num

@@ -1 +1 @@
-#define BUILD_NUM 906
+#define BUILD_NUM 912

configure.in

@@ -465,9 +465,6 @@ AC_CONFIG_FILES([ src/res/platform/iptables.xml ])
 AC_CONFIG_FILES([ src/res/platform/pf.xml ])
 AC_CONFIG_FILES([ src/res/platform/pix.xml ])
 AC_CONFIG_FILES([ src/res/platform/iosacl.xml ])
-AC_CONFIG_FILES([ src/res/platform/ipcop.xml ])
-AC_CONFIG_FILES([ src/res/platform/endian.xml ])
-AC_CONFIG_FILES([ src/res/platform/oneshield.xml ])
 AC_CONFIG_FILES([ src/res/platform/unknown.xml ])
 
 

doc/ChangeLog

@@ -1,3 +1,11 @@
+2009-05-09  vadim  <vadim@vk.crocodile.org>
+
+	* platform/iptables.xml.in: Unified support for different iptables
+	appliances: configuration will require platform "iptables" and
+	host os that corresponds to the chosen appliance. This matches
+	support for Secuwall and is easier to maintain than separate
+	platform-os pairs for each appliance.
+
 2009-05-06  vadim  <vadim@vk.crocodile.org>
 
 	* FirewallInstallerCisco.cpp (FirewallInstallerCisco::activatePolicy):

src/gui/iptAdvancedDialog.cpp

@@ -77,10 +77,10 @@ iptAdvancedDialog::iptAdvancedDialog(QWidget *parent,FWObject *o)
                    obj->getStr("host_OS"),"user_can_change_install_dir").c_str());
 
     if (!Resources::getTargetOptionBool(
-            obj->getStr("host_OS"),"user_can_change_install_dir"))
+            obj->getStr("host_OS"), "user_can_change_install_dir"))
     {
         m_dialog->ipt_fw_dir->setEnabled(false);
-        fwoptions->setStr("firewall_dir","");
+        //fwoptions->setStr("firewall_dir", "");
     }
 
     //QString s = fwoptions->getStr("ipv4_6_order")

src/gui/newFirewallDialog.cpp

@@ -840,13 +840,15 @@ void newFirewallDialog::finishClicked()
             return;
         }
 
-        nfw=Firewall::cast(no);
+        nfw = Firewall::cast(no);
 
-        no->setStr("platform", platform);
+        // preserve platform and host OS from the template, do not
-        Resources::setDefaultTargetOptions(platform , nfw);
+        // reset from the first page of the dialog.
 
-        no->setStr("host_OS", host_os);
+        //no->setStr("platform", platform);
-        Resources::setDefaultTargetOptions(host_os , nfw);
+        //Resources::setDefaultTargetOptions(platform , nfw);
+        //no->setStr("host_OS", host_os);
+        //Resources::setDefaultTargetOptions(host_os , nfw);
 
 
     } else

src/gui/newfirewalldialog_q.ui

@@ -50,7 +50,7 @@
       </size>
      </property>
      <property name="currentIndex" >
-      <number>2</number>
+      <number>0</number>
      </property>
      <widget class="QWidget" name="page1" >
       <layout class="QGridLayout" name="gridLayout" >
@@ -1325,22 +1325,6 @@
     </hint>
    </hints>
   </connection>
-  <connection>
-   <sender>hostOS</sender>
-   <signal>activated(int)</signal>
-   <receiver>newFirewallDialog_q</receiver>
-   <slot>changed()</slot>
-   <hints>
-    <hint type="sourcelabel" >
-     <x>20</x>
-     <y>20</y>
-    </hint>
-    <hint type="destinationlabel" >
-     <x>20</x>
-     <y>20</y>
-    </hint>
-   </hints>
-  </connection>
   <connection>
    <sender>iface_list</sender>
    <signal>currentItemChanged(QTreeWidgetItem*,QTreeWidgetItem*)</signal>

src/ipt/ipt.cpp

@@ -336,11 +336,13 @@ bool processPolicyRuleSet(
     bool empty_output = true;
     string prolog_place = fw->getOptionsObject()->getStr("prolog_place");
     string platform = fw->getStr("platform");
-    bool flush_and_set_default_policy = Resources::getTargetCapabilityBool(
+    string host_os = fw->getStr("host_OS");
-        platform, "flush_and_set_default_policy");
+    bool flush_and_set_default_policy = Resources::getTargetOptionBool(
+        host_os, "default/flush_and_set_default_policy");
     string platform_family = Resources::platform_res[platform]->
         getResourceStr("/FWBuilderResources/Target/family");
-
+    string os_family = Resources::os_res[host_os]->
+        getResourceStr("/FWBuilderResources/Target/family");
 
     Policy *policy = Policy::cast(ruleset);
     assignRuleSetChain(policy);
@@ -352,7 +354,7 @@ bool processPolicyRuleSet(
 
     MangleTableCompiler_ipt *mangle_compiler;
 
-    if (platform_family == "ipcop")
+    if (os_family == "ipcop")
         mangle_compiler = new MangleTableCompiler_ipcop(
             objdb , fwobjectname.toUtf8().constData(),
             ipv6_policy , oscnf,
@@ -442,7 +444,7 @@ bool processPolicyRuleSet(
 
     PolicyCompiler_ipt *policy_compiler;
 
-    if (platform_family == "ipcop")
+    if (os_family == "ipcop")
         policy_compiler = new PolicyCompiler_ipcop(
             objdb,fwobjectname.toUtf8().constData(), ipv6_policy, oscnf,
             &minus_n_commands_filter);
@@ -855,11 +857,11 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
 
         string os_variant = DISTRO;
 
-        bool flush_and_set_default_policy = Resources::getTargetCapabilityBool(
+        bool flush_and_set_default_policy = Resources::getTargetOptionBool(
-            platform, "flush_and_set_default_policy");
+            host_os, "default/flush_and_set_default_policy");
 
 /* minimal sanity checking */
-        if (platform_family == "ipcop")
+        if (os_family == "ipcop")
         {
             os_variant = "ipcop";
 
@@ -1002,7 +1004,7 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
                 // being created for NAT
                 NATCompiler_ipt *nat_compiler;
 
-                if (platform_family == "ipcop")
+                if (os_family == "ipcop")
                     nat_compiler = new NATCompiler_ipcop(
                         objdb, fwobjectname.toUtf8().constData(), ipv6_policy,
                         oscnf, &minus_n_commands_nat);
@@ -1099,7 +1101,7 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
 
         RoutingCompiler_ipt *routing_compiler;
 
-        if (platform_family == "ipcop")
+        if (os_family == "ipcop")
             routing_compiler = new RoutingCompiler_ipcop(
                 objdb , fwobjectname.toUtf8().constData() , false, oscnf );
         else
@@ -1262,7 +1264,7 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
             prolog_done = true;
         }
 
-        if (platform_family != "ipcop")
+        if (os_family != "ipcop")
         {
             script << "  log '";
             if (omit_timestamp)

src/res/os/endian_os.xml

@@ -9,7 +9,13 @@
         <user_can_change_install_dir>false</user_can_change_install_dir>
         <default>
           <linux24_ip_forward>1</linux24_ip_forward>
+          <linux24_ipv6_forward></linux24_ipv6_forward>
           <loopback_interface>lo</loopback_interface>
+          <firewall_dir>/etc/rc.d/</firewall_dir>
+          <output_file>rc.firewall.local</output_file>
+          <admUser>root</admUser>
+          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
+          <flush_and_set_default_policy>False</flush_and_set_default_policy>
         </default>
 
         <activation>

src/res/os/endian_os.xml.in

@@ -9,7 +9,13 @@
         <user_can_change_install_dir>false</user_can_change_install_dir>
         <default>
           <linux24_ip_forward>1</linux24_ip_forward>
+          <linux24_ipv6_forward></linux24_ipv6_forward>
           <loopback_interface>lo</loopback_interface>
+          <firewall_dir>/etc/rc.d/</firewall_dir>
+          <output_file>rc.firewall.local</output_file>
+          <admUser>root</admUser>
+          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
+          <flush_and_set_default_policy>False</flush_and_set_default_policy>
         </default>
 
         <activation>

src/res/os/ipcop_os.xml

@@ -9,7 +9,13 @@
         <user_can_change_install_dir>false</user_can_change_install_dir>
         <default>
           <linux24_ip_forward>1</linux24_ip_forward>
+          <linux24_ipv6_forward></linux24_ipv6_forward>
           <loopback_interface>lo</loopback_interface>
+          <firewall_dir>/etc/rc.d/</firewall_dir>
+          <output_file>rc.firewall.local</output_file>
+          <admUser>root</admUser>
+          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
+          <flush_and_set_default_policy>False</flush_and_set_default_policy>
         </default>
 
         <activation>

src/res/os/ipcop_os.xml.in

@@ -9,7 +9,13 @@
         <user_can_change_install_dir>false</user_can_change_install_dir>
         <default>
           <linux24_ip_forward>1</linux24_ip_forward>
+          <linux24_ipv6_forward></linux24_ipv6_forward>
           <loopback_interface>lo</loopback_interface>
+          <firewall_dir>/etc/rc.d/</firewall_dir>
+          <output_file>rc.firewall.local</output_file>
+          <admUser>root</admUser>
+          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
+          <flush_and_set_default_policy>False</flush_and_set_default_policy>
         </default>
 
         <activation>

src/res/os/linksys.xml

@@ -10,6 +10,9 @@
         <default>
           <linux24_ip_forward>1</linux24_ip_forward>
           <loopback_interface>lo</loopback_interface>
+          <firewall_dir>/tmp</firewall_dir>
+          <admUser>root</admUser>
+          <flush_and_set_default_policy>True</flush_and_set_default_policy>
           <prompt1>$ </prompt1>
           <prompt2> # </prompt2>
         </default>

src/res/os/linksys.xml.in

@@ -10,6 +10,9 @@
         <default>
           <linux24_ip_forward>1</linux24_ip_forward>
           <loopback_interface>lo</loopback_interface>
+          <firewall_dir>/tmp</firewall_dir>
+          <admUser>root</admUser>
+          <flush_and_set_default_policy>True</flush_and_set_default_policy>
           <prompt1>$ </prompt1>
           <prompt2> # </prompt2>
         </default>

src/res/os/linux24.xml

@@ -10,6 +10,7 @@
         <default>
           <linux24_ip_forward>1</linux24_ip_forward>
           <loopback_interface>lo</loopback_interface>
+          <flush_and_set_default_policy>True</flush_and_set_default_policy>
         </default>
 
         <activation>

src/res/os/linux24.xml.in

@@ -10,6 +10,7 @@
         <default>
           <linux24_ip_forward>1</linux24_ip_forward>
           <loopback_interface>lo</loopback_interface>
+          <flush_and_set_default_policy>True</flush_and_set_default_policy>
         </default>
 
         <activation>

src/res/os/oneshield_os.xml

@@ -9,7 +9,13 @@
         <user_can_change_install_dir>false</user_can_change_install_dir>
         <default>
           <linux24_ip_forward>1</linux24_ip_forward>
+          <linux24_ipv6_forward></linux24_ipv6_forward>
           <loopback_interface>lo</loopback_interface>
+          <firewall_dir>/etc/rc.d/</firewall_dir>
+          <output_file>rc.firewall.local</output_file>
+          <admUser>root</admUser>
+          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
+          <flush_and_set_default_policy>False</flush_and_set_default_policy>
         </default>
 
         <activation>

src/res/os/oneshield_os.xml.in

@@ -9,7 +9,13 @@
         <user_can_change_install_dir>false</user_can_change_install_dir>
         <default>
           <linux24_ip_forward>1</linux24_ip_forward>
+          <linux24_ipv6_forward></linux24_ipv6_forward>
           <loopback_interface>lo</loopback_interface>
+          <firewall_dir>/etc/rc.d/</firewall_dir>
+          <output_file>rc.firewall.local</output_file>
+          <admUser>root</admUser>
+          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
+          <flush_and_set_default_policy>False</flush_and_set_default_policy>
         </default>
 
         <activation>

src/res/platform/endian.xml

@@ -1,101 +0,0 @@
-<?xml version="1.0"?>
-<FWBuilderResources version="3.1.0">
-    <Target name="endian">
-      <description>Endian Firewall Apliance (iptables)</description>
-      <group>Appliances</group>
-      <compiler>fwb_ipt</compiler>
-      <dialog>ipcop</dialog>
-      <supported_os>endian_os</supported_os>
-      <family>ipcop</family>
-
-      <options>
-        <default>
-          <load_modules>true</load_modules>
-          <verify_interfaces>true</verify_interfaces>
-          <firewall_is_part_of_any_and_networks>true</firewall_is_part_of_any_and_networks>
-          <accept_new_tcp_with_no_syn>true</accept_new_tcp_with_no_syn>
-          <accept_established>true</accept_established>
-          <configure_interfaces>true</configure_interfaces>
-          <manage_virtual_addr>true</manage_virtual_addr>
-          <log_level>info</log_level>
-          <log_prefix>RULE %N -- %A </log_prefix>
-          <ulog_nlgroup>1</ulog_nlgroup>
-          <limit_value>0</limit_value>
-          <check_shading>true</check_shading>
-          <verify_interfaces>true</verify_interfaces>
-          <local_nat>false</local_nat>
-          <!-- defaults for ipcop -->
-          <firewall_dir>/etc/rc.d/</firewall_dir>
-          <output_file>rc.firewall.local</output_file>
-          <admUser>root</admUser>
-          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
-          <linux24_ip_forward></linux24_ip_forward>
-          <linux24_ipv6_forward></linux24_ipv6_forward>
-        </default>
-      </options>
-
-      <capabilities>
-        <negation_in_interface_policy>True</negation_in_interface_policy>
-        <negation_in_policy>True</negation_in_policy>
-        <negation_in_nat>True</negation_in_nat>
-        <logging_in_policy>True</logging_in_policy>
-        <options_in_policy>True</options_in_policy>
-        <supports_nat>True</supports_nat>
-        <supports_time>True</supports_time>
-        <supports_accounting>True</supports_accounting>
-        <supports_routing_itf>True</supports_routing_itf>
-        <security_levels>False</security_levels>
-        <network_zones>False</network_zones>
-        <unprotected_interfaces>False</unprotected_interfaces>
-        <supports_prolog_epilog>True</supports_prolog_epilog>
-        <flush_and_set_default_policy>False</flush_and_set_default_policy>
-        <actions>
-            <Accept>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Accept>
-            <Deny>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Deny>
-            <Reject>
-                <supported>True</supported>
-                <parameter>Reject</parameter>
-            </Reject>
-            <Accounting>
-                <supported>True</supported>
-                <parameter>AccountingStr</parameter>
-            </Accounting>
-            <Tag>
-                <supported>True</supported>
-                <parameter>TagInt</parameter>
-            </Tag>
-            <Pipe>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Pipe>
-            <Classify>
-                <supported>True</supported>
-                <parameter>ClassifyStr</parameter>
-            </Classify>
-            <Custom>
-                <supported>True</supported>
-                <parameter>CustomStr</parameter>
-            </Custom>
-            <Branch>
-                <supported>True</supported>
-                <parameter>BranchChain</parameter>
-            </Branch>
-            <Route>
-                <supported>True</supported>
-                <parameter>RouteIPT</parameter>
-            </Route>
-            <Continue>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Continue>
-        </actions>
-      </capabilities>
-    </Target>
-
-</FWBuilderResources>

src/res/platform/endian.xml.in

@@ -1,101 +0,0 @@
-<?xml version="1.0"?>
-<FWBuilderResources version="@VERSION@">
-    <Target name="endian">
-      <description>Endian Firewall Apliance (iptables)</description>
-      <group>Appliances</group>
-      <compiler>fwb_ipt</compiler>
-      <dialog>ipcop</dialog>
-      <supported_os>endian_os</supported_os>
-      <family>ipcop</family>
-
-      <options>
-        <default>
-          <load_modules>true</load_modules>
-          <verify_interfaces>true</verify_interfaces>
-          <firewall_is_part_of_any_and_networks>true</firewall_is_part_of_any_and_networks>
-          <accept_new_tcp_with_no_syn>true</accept_new_tcp_with_no_syn>
-          <accept_established>true</accept_established>
-          <configure_interfaces>true</configure_interfaces>
-          <manage_virtual_addr>true</manage_virtual_addr>
-          <log_level>info</log_level>
-          <log_prefix>RULE %N -- %A </log_prefix>
-          <ulog_nlgroup>1</ulog_nlgroup>
-          <limit_value>0</limit_value>
-          <check_shading>true</check_shading>
-          <verify_interfaces>true</verify_interfaces>
-          <local_nat>false</local_nat>
-          <!-- defaults for ipcop -->
-          <firewall_dir>/etc/rc.d/</firewall_dir>
-          <output_file>rc.firewall.local</output_file>
-          <admUser>root</admUser>
-          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
-          <linux24_ip_forward></linux24_ip_forward>
-          <linux24_ipv6_forward></linux24_ipv6_forward>
-        </default>
-      </options>
-
-      <capabilities>
-        <negation_in_interface_policy>True</negation_in_interface_policy>
-        <negation_in_policy>True</negation_in_policy>
-        <negation_in_nat>True</negation_in_nat>
-        <logging_in_policy>True</logging_in_policy>
-        <options_in_policy>True</options_in_policy>
-        <supports_nat>True</supports_nat>
-        <supports_time>True</supports_time>
-        <supports_accounting>True</supports_accounting>
-        <supports_routing_itf>True</supports_routing_itf>
-        <security_levels>False</security_levels>
-        <network_zones>False</network_zones>
-        <unprotected_interfaces>False</unprotected_interfaces>
-        <supports_prolog_epilog>True</supports_prolog_epilog>
-        <flush_and_set_default_policy>False</flush_and_set_default_policy>
-        <actions>
-            <Accept>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Accept>
-            <Deny>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Deny>
-            <Reject>
-                <supported>True</supported>
-                <parameter>Reject</parameter>
-            </Reject>
-            <Accounting>
-                <supported>True</supported>
-                <parameter>AccountingStr</parameter>
-            </Accounting>
-            <Tag>
-                <supported>True</supported>
-                <parameter>TagInt</parameter>
-            </Tag>
-            <Pipe>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Pipe>
-            <Classify>
-                <supported>True</supported>
-                <parameter>ClassifyStr</parameter>
-            </Classify>
-            <Custom>
-                <supported>True</supported>
-                <parameter>CustomStr</parameter>
-            </Custom>
-            <Branch>
-                <supported>True</supported>
-                <parameter>BranchChain</parameter>
-            </Branch>
-            <Route>
-                <supported>True</supported>
-                <parameter>RouteIPT</parameter>
-            </Route>
-            <Continue>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Continue>
-        </actions>
-      </capabilities>
-    </Target>
-
-</FWBuilderResources>

src/res/platform/ipcop.xml

@@ -1,101 +0,0 @@
-<?xml version="1.0"?>
-<FWBuilderResources version="3.1.0">
-    <Target name="endian">
-      <description>IPCOP Firewall Apliance (iptables)</description>
-      <group>Appliances</group>
-      <compiler>fwb_ipt</compiler>
-      <dialog>ipcop</dialog>
-      <supported_os>ipcop_os</supported_os>
-      <family>ipcop</family>
-
-      <options>
-        <default>
-          <load_modules>true</load_modules>
-          <verify_interfaces>true</verify_interfaces>
-          <firewall_is_part_of_any_and_networks>true</firewall_is_part_of_any_and_networks>
-          <accept_new_tcp_with_no_syn>true</accept_new_tcp_with_no_syn>
-          <accept_established>true</accept_established>
-          <configure_interfaces>true</configure_interfaces>
-          <manage_virtual_addr>true</manage_virtual_addr>
-          <log_level>info</log_level>
-          <log_prefix>RULE %N -- %A </log_prefix>
-          <ulog_nlgroup>1</ulog_nlgroup>
-          <limit_value>0</limit_value>
-          <check_shading>true</check_shading>
-          <verify_interfaces>true</verify_interfaces>
-          <local_nat>false</local_nat>
-          <!-- defaults for ipcop -->
-          <firewall_dir>/etc/rc.d/</firewall_dir>
-          <output_file>rc.firewall.local</output_file>
-          <admUser>root</admUser>
-          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
-          <linux24_ip_forward></linux24_ip_forward>
-          <linux24_ipv6_forward></linux24_ipv6_forward>
-        </default>
-      </options>
-
-      <capabilities>
-        <negation_in_interface_policy>True</negation_in_interface_policy>
-        <negation_in_policy>True</negation_in_policy>
-        <negation_in_nat>True</negation_in_nat>
-        <logging_in_policy>True</logging_in_policy>
-        <options_in_policy>True</options_in_policy>
-        <supports_nat>True</supports_nat>
-        <supports_time>True</supports_time>
-        <supports_accounting>True</supports_accounting>
-        <supports_routing_itf>True</supports_routing_itf>
-        <security_levels>False</security_levels>
-        <network_zones>False</network_zones>
-        <unprotected_interfaces>False</unprotected_interfaces>
-        <supports_prolog_epilog>True</supports_prolog_epilog>
-        <flush_and_set_default_policy>False</flush_and_set_default_policy>
-        <actions>
-            <Accept>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Accept>
-            <Deny>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Deny>
-            <Reject>
-                <supported>True</supported>
-                <parameter>Reject</parameter>
-            </Reject>
-            <Accounting>
-                <supported>True</supported>
-                <parameter>AccountingStr</parameter>
-            </Accounting>
-            <Tag>
-                <supported>True</supported>
-                <parameter>TagInt</parameter>
-            </Tag>
-            <Pipe>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Pipe>
-            <Classify>
-                <supported>True</supported>
-                <parameter>ClassifyStr</parameter>
-            </Classify>
-            <Custom>
-                <supported>True</supported>
-                <parameter>CustomStr</parameter>
-            </Custom>
-            <Branch>
-                <supported>True</supported>
-                <parameter>BranchChain</parameter>
-            </Branch>
-            <Route>
-                <supported>True</supported>
-                <parameter>RouteIPT</parameter>
-            </Route>
-            <Continue>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Continue>
-        </actions>
-      </capabilities>
-    </Target>
-
-</FWBuilderResources>

src/res/platform/ipcop.xml.in

@@ -1,101 +0,0 @@
-<?xml version="1.0"?>
-<FWBuilderResources version="@VERSION@">
-    <Target name="endian">
-      <description>IPCOP Firewall Apliance (iptables)</description>
-      <group>Appliances</group>
-      <compiler>fwb_ipt</compiler>
-      <dialog>ipcop</dialog>
-      <supported_os>ipcop_os</supported_os>
-      <family>ipcop</family>
-
-      <options>
-        <default>
-          <load_modules>true</load_modules>
-          <verify_interfaces>true</verify_interfaces>
-          <firewall_is_part_of_any_and_networks>true</firewall_is_part_of_any_and_networks>
-          <accept_new_tcp_with_no_syn>true</accept_new_tcp_with_no_syn>
-          <accept_established>true</accept_established>
-          <configure_interfaces>true</configure_interfaces>
-          <manage_virtual_addr>true</manage_virtual_addr>
-          <log_level>info</log_level>
-          <log_prefix>RULE %N -- %A </log_prefix>
-          <ulog_nlgroup>1</ulog_nlgroup>
-          <limit_value>0</limit_value>
-          <check_shading>true</check_shading>
-          <verify_interfaces>true</verify_interfaces>
-          <local_nat>false</local_nat>
-          <!-- defaults for ipcop -->
-          <firewall_dir>/etc/rc.d/</firewall_dir>
-          <output_file>rc.firewall.local</output_file>
-          <admUser>root</admUser>
-          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
-          <linux24_ip_forward></linux24_ip_forward>
-          <linux24_ipv6_forward></linux24_ipv6_forward>
-        </default>
-      </options>
-
-      <capabilities>
-        <negation_in_interface_policy>True</negation_in_interface_policy>
-        <negation_in_policy>True</negation_in_policy>
-        <negation_in_nat>True</negation_in_nat>
-        <logging_in_policy>True</logging_in_policy>
-        <options_in_policy>True</options_in_policy>
-        <supports_nat>True</supports_nat>
-        <supports_time>True</supports_time>
-        <supports_accounting>True</supports_accounting>
-        <supports_routing_itf>True</supports_routing_itf>
-        <security_levels>False</security_levels>
-        <network_zones>False</network_zones>
-        <unprotected_interfaces>False</unprotected_interfaces>
-        <supports_prolog_epilog>True</supports_prolog_epilog>
-        <flush_and_set_default_policy>False</flush_and_set_default_policy>
-        <actions>
-            <Accept>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Accept>
-            <Deny>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Deny>
-            <Reject>
-                <supported>True</supported>
-                <parameter>Reject</parameter>
-            </Reject>
-            <Accounting>
-                <supported>True</supported>
-                <parameter>AccountingStr</parameter>
-            </Accounting>
-            <Tag>
-                <supported>True</supported>
-                <parameter>TagInt</parameter>
-            </Tag>
-            <Pipe>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Pipe>
-            <Classify>
-                <supported>True</supported>
-                <parameter>ClassifyStr</parameter>
-            </Classify>
-            <Custom>
-                <supported>True</supported>
-                <parameter>CustomStr</parameter>
-            </Custom>
-            <Branch>
-                <supported>True</supported>
-                <parameter>BranchChain</parameter>
-            </Branch>
-            <Route>
-                <supported>True</supported>
-                <parameter>RouteIPT</parameter>
-            </Route>
-            <Continue>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Continue>
-        </actions>
-      </capabilities>
-    </Target>
-
-</FWBuilderResources>

src/res/platform/iptables.xml

@@ -8,7 +8,7 @@
       <!-- maintian order of supported os names to make them appear in the dialog
         in the right order
         -->
-      <supported_os>linux24,linksys</supported_os>
+      <supported_os>linux24,linksys,ipcop_os,endian_os,oneshield_os</supported_os>
       <family>iptables</family>
 
       <options>
@@ -44,7 +44,6 @@
         <network_zones>False</network_zones>
         <unprotected_interfaces>False</unprotected_interfaces>
         <supports_prolog_epilog>True</supports_prolog_epilog>
-        <flush_and_set_default_policy>True</flush_and_set_default_policy>
         <actions>
             <Accept>
                 <supported>True</supported>

src/res/platform/iptables.xml.in

@@ -8,7 +8,7 @@
       <!-- maintian order of supported os names to make them appear in the dialog
         in the right order
         -->
-      <supported_os>linux24,linksys</supported_os>
+      <supported_os>linux24,linksys,ipcop_os,endian_os,oneshield_os</supported_os>
       <family>iptables</family>
 
       <options>
@@ -44,7 +44,6 @@
         <network_zones>False</network_zones>
         <unprotected_interfaces>False</unprotected_interfaces>
         <supports_prolog_epilog>True</supports_prolog_epilog>
-        <flush_and_set_default_policy>True</flush_and_set_default_policy>
         <actions>
             <Accept>
                 <supported>True</supported>

src/res/platform/oneshield.xml

@@ -1,101 +0,0 @@
-<?xml version="1.0"?>
-<FWBuilderResources version="3.1.0">
-    <Target name="endian">
-      <description>OneShield Firewall Apliance (iptables)</description>
-      <group>Appliances</group>
-      <compiler>fwb_ipt</compiler>
-      <dialog>ipcop</dialog>
-      <supported_os>oneshield_os</supported_os>
-      <family>ipcop</family>
-
-      <options>
-        <default>
-          <load_modules>true</load_modules>
-          <verify_interfaces>true</verify_interfaces>
-          <firewall_is_part_of_any_and_networks>true</firewall_is_part_of_any_and_networks>
-          <accept_new_tcp_with_no_syn>true</accept_new_tcp_with_no_syn>
-          <accept_established>true</accept_established>
-          <configure_interfaces>true</configure_interfaces>
-          <manage_virtual_addr>true</manage_virtual_addr>
-          <log_level>info</log_level>
-          <log_prefix>RULE %N -- %A </log_prefix>
-          <ulog_nlgroup>1</ulog_nlgroup>
-          <limit_value>0</limit_value>
-          <check_shading>true</check_shading>
-          <verify_interfaces>true</verify_interfaces>
-          <local_nat>false</local_nat>
-          <!-- defaults for ipcop -->
-          <firewall_dir>/etc/rc.d/</firewall_dir>
-          <output_file>rc.firewall.local</output_file>
-          <admUser>root</admUser>
-          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
-          <linux24_ip_forward></linux24_ip_forward>
-          <linux24_ipv6_forward></linux24_ipv6_forward>
-        </default>
-      </options>
-
-      <capabilities>
-        <negation_in_interface_policy>True</negation_in_interface_policy>
-        <negation_in_policy>True</negation_in_policy>
-        <negation_in_nat>True</negation_in_nat>
-        <logging_in_policy>True</logging_in_policy>
-        <options_in_policy>True</options_in_policy>
-        <supports_nat>True</supports_nat>
-        <supports_time>True</supports_time>
-        <supports_accounting>True</supports_accounting>
-        <supports_routing_itf>True</supports_routing_itf>
-        <security_levels>False</security_levels>
-        <network_zones>False</network_zones>
-        <unprotected_interfaces>False</unprotected_interfaces>
-        <supports_prolog_epilog>True</supports_prolog_epilog>
-        <flush_and_set_default_policy>False</flush_and_set_default_policy>
-        <actions>
-            <Accept>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Accept>
-            <Deny>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Deny>
-            <Reject>
-                <supported>True</supported>
-                <parameter>Reject</parameter>
-            </Reject>
-            <Accounting>
-                <supported>True</supported>
-                <parameter>AccountingStr</parameter>
-            </Accounting>
-            <Tag>
-                <supported>True</supported>
-                <parameter>TagInt</parameter>
-            </Tag>
-            <Pipe>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Pipe>
-            <Classify>
-                <supported>True</supported>
-                <parameter>ClassifyStr</parameter>
-            </Classify>
-            <Custom>
-                <supported>True</supported>
-                <parameter>CustomStr</parameter>
-            </Custom>
-            <Branch>
-                <supported>True</supported>
-                <parameter>BranchChain</parameter>
-            </Branch>
-            <Route>
-                <supported>True</supported>
-                <parameter>RouteIPT</parameter>
-            </Route>
-            <Continue>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Continue>
-        </actions>
-      </capabilities>
-    </Target>
-
-</FWBuilderResources>

src/res/platform/oneshield.xml.in

@@ -1,101 +0,0 @@
-<?xml version="1.0"?>
-<FWBuilderResources version="@VERSION@">
-    <Target name="endian">
-      <description>OneShield Firewall Apliance (iptables)</description>
-      <group>Appliances</group>
-      <compiler>fwb_ipt</compiler>
-      <dialog>ipcop</dialog>
-      <supported_os>oneshield_os</supported_os>
-      <family>ipcop</family>
-
-      <options>
-        <default>
-          <load_modules>true</load_modules>
-          <verify_interfaces>true</verify_interfaces>
-          <firewall_is_part_of_any_and_networks>true</firewall_is_part_of_any_and_networks>
-          <accept_new_tcp_with_no_syn>true</accept_new_tcp_with_no_syn>
-          <accept_established>true</accept_established>
-          <configure_interfaces>true</configure_interfaces>
-          <manage_virtual_addr>true</manage_virtual_addr>
-          <log_level>info</log_level>
-          <log_prefix>RULE %N -- %A </log_prefix>
-          <ulog_nlgroup>1</ulog_nlgroup>
-          <limit_value>0</limit_value>
-          <check_shading>true</check_shading>
-          <verify_interfaces>true</verify_interfaces>
-          <local_nat>false</local_nat>
-          <!-- defaults for ipcop -->
-          <firewall_dir>/etc/rc.d/</firewall_dir>
-          <output_file>rc.firewall.local</output_file>
-          <admUser>root</admUser>
-          <activationCmd>/etc/rc.d/rc.firewall restart</activationCmd>
-          <linux24_ip_forward></linux24_ip_forward>
-          <linux24_ipv6_forward></linux24_ipv6_forward>
-        </default>
-      </options>
-
-      <capabilities>
-        <negation_in_interface_policy>True</negation_in_interface_policy>
-        <negation_in_policy>True</negation_in_policy>
-        <negation_in_nat>True</negation_in_nat>
-        <logging_in_policy>True</logging_in_policy>
-        <options_in_policy>True</options_in_policy>
-        <supports_nat>True</supports_nat>
-        <supports_time>True</supports_time>
-        <supports_accounting>True</supports_accounting>
-        <supports_routing_itf>True</supports_routing_itf>
-        <security_levels>False</security_levels>
-        <network_zones>False</network_zones>
-        <unprotected_interfaces>False</unprotected_interfaces>
-        <supports_prolog_epilog>True</supports_prolog_epilog>
-        <flush_and_set_default_policy>False</flush_and_set_default_policy>
-        <actions>
-            <Accept>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Accept>
-            <Deny>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Deny>
-            <Reject>
-                <supported>True</supported>
-                <parameter>Reject</parameter>
-            </Reject>
-            <Accounting>
-                <supported>True</supported>
-                <parameter>AccountingStr</parameter>
-            </Accounting>
-            <Tag>
-                <supported>True</supported>
-                <parameter>TagInt</parameter>
-            </Tag>
-            <Pipe>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Pipe>
-            <Classify>
-                <supported>True</supported>
-                <parameter>ClassifyStr</parameter>
-            </Classify>
-            <Custom>
-                <supported>True</supported>
-                <parameter>CustomStr</parameter>
-            </Custom>
-            <Branch>
-                <supported>True</supported>
-                <parameter>BranchChain</parameter>
-            </Branch>
-            <Route>
-                <supported>True</supported>
-                <parameter>RouteIPT</parameter>
-            </Route>
-            <Continue>
-                <supported>True</supported>
-                <parameter>None</parameter>
-            </Continue>
-        </actions>
-      </capabilities>
-    </Target>
-
-</FWBuilderResources>

src/res/templates.xml

@@ -1705,7 +1705,7 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3836X47925" host_OS="endian_os" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1239820196" platform="endian" version="" name="IPCOP or Endian appliance (2 interfaces)" comment="Endian firewall appliance, 2 interfaces:&#10;br0 is GREEN&#10;eth1 is RED&#10;Do not forget to change IP addresses to &#10;match your firewall." ro="False">
+      <Firewall id="id3836X47925" host_OS="ipcop_os" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1239820196" platform="iptables" version="" name="IPCOP or Endian appliance (2 interfaces)" comment="Endian firewall appliance, 2 interfaces:&#10;br0 is GREEN&#10;eth1 is RED&#10;Do not forget to change IP addresses to &#10;match your firewall." ro="False">
         <NAT id="id3840X47925" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
         <Policy id="id3839X47925" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
         <Routing id="id3841X47925" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
@@ -1768,7 +1768,7 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3872X48257" host_OS="endian_os" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1239820203" platform="endian" version="" name="IPCOP or Endian appliance (3 interfaces)" comment="Endian firewall appliance, 3 interfaces:&#10;br0 is GREEN&#10;eth1 is RED&#10;eth2 is ORANGE&#10;Do not forget to change IP addresses to &#10;match your firewall." ro="False">
+      <Firewall id="id3872X48257" host_OS="ipcop_os" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1239820203" platform="iptables" version="" name="IPCOP or Endian appliance (3 interfaces)" comment="Endian firewall appliance, 3 interfaces:&#10;br0 is GREEN&#10;eth1 is RED&#10;eth2 is ORANGE&#10;Do not forget to change IP addresses to &#10;match your firewall." ro="False">
         <NAT id="id3879X48257" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
         <Policy id="id3878X48257" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
         <Routing id="id3880X48257" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>

src/res/templates.xml.in

@@ -1705,7 +1705,7 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3836X47925" host_OS="endian_os" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1239820196" platform="endian" version="" name="IPCOP or Endian appliance (2 interfaces)" comment="Endian firewall appliance, 2 interfaces:&#10;br0 is GREEN&#10;eth1 is RED&#10;Do not forget to change IP addresses to &#10;match your firewall." ro="False">
+      <Firewall id="id3836X47925" host_OS="ipcop_os" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1239820196" platform="iptables" version="" name="IPCOP or Endian appliance (2 interfaces)" comment="Endian firewall appliance, 2 interfaces:&#10;br0 is GREEN&#10;eth1 is RED&#10;Do not forget to change IP addresses to &#10;match your firewall." ro="False">
         <NAT id="id3840X47925" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
         <Policy id="id3839X47925" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
         <Routing id="id3841X47925" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
@@ -1768,7 +1768,7 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3872X48257" host_OS="endian_os" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1239820203" platform="endian" version="" name="IPCOP or Endian appliance (3 interfaces)" comment="Endian firewall appliance, 3 interfaces:&#10;br0 is GREEN&#10;eth1 is RED&#10;eth2 is ORANGE&#10;Do not forget to change IP addresses to &#10;match your firewall." ro="False">
+      <Firewall id="id3872X48257" host_OS="ipcop_os" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1239820203" platform="iptables" version="" name="IPCOP or Endian appliance (3 interfaces)" comment="Endian firewall appliance, 3 interfaces:&#10;br0 is GREEN&#10;eth1 is RED&#10;eth2 is ORANGE&#10;Do not forget to change IP addresses to &#10;match your firewall." ro="False">
         <NAT id="id3879X48257" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
         <Policy id="id3878X48257" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>
         <Routing id="id3880X48257" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"/>