onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-03-21 18:57:14 +01:00
Code Issues Releases Wiki Activity

see #2472 fixed import of table definitions without file name and with shortcut network defines

Browse Source
This commit is contained in:
Vadim Kurland 2011-06-03 23:34:25 -07:00
parent 6d6038370c
commit 30ec7d1e72
12 changed files with 1765 additions and 1032 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/import/PFImporter.cpp
View File

@ -1242,16 +1242,21 @@ void PFImporter::newAddressTableObject(const string &name,
list<AddressSpec> &addresses)
{
ObjectMaker maker(Library::cast(library), error_tracker);
FWObject *og =
FWObject *og =
commitObject(maker.createObject(ObjectGroup::TYPENAME, name.c_str()));
assert(og!=NULL);
address_table_registry[name.c_str()] = og;
QStringList addr_list;
list<AddressSpec>::iterator it;
for (it=addresses.begin(); it!=addresses.end(); ++it)
{
addr_list << QString("%1/%2").arg(it->address.c_str()).arg(it->netmask.c_str());;
FWObject *obj = makeAddressObj(*it);
if (obj) og->addRef(obj);
}
addMessageToLog(QString("Address Table: <%1>: %2")
.arg(name.c_str()).arg(addr_list.join(", ")));
}

499
src/parsers/PFCfgLexer.cpp
View File

@ -44,213 +44,214 @@ PFCfgLexer::PFCfgLexer(const ANTLR_USE_NAMESPACE(antlr)LexerSharedInputState& st
void PFCfgLexer::initLiterals()
{
literals["badhead"] = 196;
literals["notifications"] = 230;
literals["badhead"] = 197;
literals["notifications"] = 231;
literals["state-policy"] = 25;
literals["floating"] = 27;
literals["no"] = 82;
literals["esp"] = 124;
literals["routersol"] = 155;
literals["no"] = 83;
literals["counters"] = 71;
literals["esp"] = 125;
literals["routersol"] = 156;
literals["frags"] = 59;
literals["reply-to"] = 137;
literals["reply-to"] = 138;
literals["icmp.first"] = 45;
literals["string-key"] = 97;
literals["gre"] = 123;
literals["pass"] = 84;
literals["string-key"] = 98;
literals["gre"] = 124;
literals["pass"] = 85;
literals["scrub"] = 64;
literals["warnings"] = 231;
literals["warnings"] = 232;
literals["skip"] = 31;
literals["timeout"] = 12;
literals["eigrp"] = 126;
literals["icmp-type"] = 146;
literals["transit"] = 194;
literals["inet"] = 113;
literals["no-df"] = 141;
literals["eigrp"] = 127;
literals["icmp-type"] = 147;
literals["transit"] = 195;
literals["inet"] = 114;
literals["no-df"] = 142;
literals["network"] = 76;
literals["photuris"] = 171;
literals["igmp"] = 118;
literals["unreach"] = 149;
literals["range"] = 223;
literals["rsvp"] = 122;
literals["debugging"] = 226;
literals["host-tos"] = 184;
literals["paramprob"] = 157;
literals["user"] = 110;
literals["interface"] = 212;
literals["photuris"] = 172;
literals["igmp"] = 119;
literals["unreach"] = 150;
literals["range"] = 224;
literals["rsvp"] = 123;
literals["debugging"] = 227;
literals["host-tos"] = 185;
literals["paramprob"] = 158;
literals["user"] = 111;
literals["interface"] = 213;
literals["adaptive.end"] = 54;
literals["limit"] = 20;
literals["state-defaults"] = 28;
literals["hex-key"] = 96;
literals["net-unk"] = 178;
literals["hex-key"] = 97;
literals["net-unk"] = 179;
literals["antispoof"] = 8;
literals["udp.single"] = 43;
literals["inforeq"] = 160;
literals["ipv6-here"] = 168;
literals["redir"] = 151;
literals["static-port"] = 86;
literals["common-adv"] = 193;
literals["inforeq"] = 161;
literals["ipv6-here"] = 169;
literals["redir"] = 152;
literals["static-port"] = 87;
literals["common-adv"] = 194;
literals["loginterface"] = 21;
literals["ip"] = 116;
literals["mobregreq"] = 169;
literals["ip"] = 117;
literals["mobregreq"] = 170;
literals["conservative"] = 16;
literals["ospf"] = 127;
literals["proto-unr"] = 174;
literals["ospf"] = 128;
literals["proto-unr"] = 175;
literals["peer"] = 78;
literals["inforep"] = 161;
literals["errors"] = 228;
literals["inforep"] = 162;
literals["errors"] = 229;
literals["tables-entries"] = 63;
literals["any"] = 134;
literals["mobregrep"] = 170;
literals["label"] = 209;
literals["pptp"] = 219;
literals["synproxy"] = 207;
literals["any"] = 135;
literals["mobregrep"] = 171;
literals["label"] = 210;
literals["pptp"] = 220;
literals["synproxy"] = 208;
literals["debug"] = 33;
literals["alerts"] = 224;
literals["all"] = 109;
literals["state"] = 208;
literals["tag"] = 204;
literals["in"] = 106;
literals["alerts"] = 225;
literals["all"] = 110;
literals["state"] = 209;
literals["tag"] = 205;
literals["in"] = 107;
literals["tables"] = 62;
literals["file"] = 72;
literals["nos"] = 216;
literals["nos"] = 217;
literals["src-nodes"] = 61;
literals["ipv6-where"] = 167;
literals["ipv6-where"] = 168;
literals["require-order"] = 29;
literals["udp"] = 120;
literals["udp"] = 121;
literals["states"] = 60;
literals["sticky-address"] = 99;
literals["return-icmp"] = 104;
literals["redir-tos-net"] = 190;
literals["pim"] = 218;
literals["emergencies"] = 227;
literals["squench"] = 150;
literals["disable"] = 232;
literals["flags"] = 145;
literals["tcp"] = 119;
literals["net-tos"] = 183;
literals["sticky-address"] = 100;
literals["return-icmp"] = 105;
literals["redir-tos-net"] = 191;
literals["pim"] = 219;
literals["emergencies"] = 228;
literals["squench"] = 151;
literals["disable"] = 233;
literals["flags"] = 146;
literals["tcp"] = 120;
literals["net-tos"] = 184;
literals["reassemble"] = 34;
literals["adaptive.start"] = 53;
literals["frag"] = 50;
literals["port"] = 90;
literals["icmp"] = 117;
literals["to"] = 111;
literals["return-rst"] = 102;
literals["normal-adv"] = 192;
literals["port"] = 91;
literals["icmp"] = 118;
literals["to"] = 112;
literals["return-rst"] = 103;
literals["normal-adv"] = 193;
literals["optimization"] = 14;
literals["log"] = 108;
literals["fragment"] = 138;
literals["snp"] = 221;
literals["log"] = 109;
literals["fragment"] = 139;
literals["snp"] = 222;
literals["broadcast"] = 77;
literals["icmp6-type"] = 202;
literals["icmp6-type"] = 203;
literals["normal"] = 18;
literals["code"] = 147;
literals["code"] = 148;
literals["if-bound"] = 26;
literals["src.track"] = 52;
literals["drop-ovl"] = 140;
literals["routeradv"] = 154;
literals["drop-ovl"] = 141;
literals["routeradv"] = 155;
literals["other.single"] = 48;
literals["bitmask"] = 93;
literals["maskreq"] = 162;
literals["ipip"] = 128;
literals["bitmask"] = 94;
literals["maskreq"] = 163;
literals["ipip"] = 129;
literals["tcp.closed"] = 41;
literals["block"] = 101;
literals["block"] = 102;
literals["high-latency"] = 17;
literals["udp.first"] = 42;
literals["badlen"] = 198;
literals["badlen"] = 199;
literals["tcp.first"] = 36;
literals["host-unr"] = 173;
literals["ah"] = 125;
literals["random-id"] = 144;
literals["modulate"] = 206;
literals["host-unr"] = 174;
literals["ah"] = 126;
literals["random-id"] = 145;
literals["modulate"] = 207;
literals["interval"] = 51;
literals["maskrep"] = 163;
literals["maskrep"] = 164;
literals["ruleset-optimization"] = 13;
literals["trace"] = 164;
literals["rip"] = 220;
literals["urpf-failed"] = 133;
literals["trace"] = 165;
literals["rip"] = 221;
literals["urpf-failed"] = 134;
literals["set"] = 11;
literals["source-hash"] = 95;
literals["critical"] = 225;
literals["quit"] = 211;
literals["source-hash"] = 96;
literals["critical"] = 226;
literals["quit"] = 212;
literals["icmp.error"] = 46;
literals["const"] = 70;
literals["altq"] = 9;
literals["tcp.closing"] = 39;
literals["port-unr"] = 175;
literals["port-unr"] = 176;
literals["table"] = 66;
literals["redir-tos-host"] = 191;
literals["redir-tos-host"] = 192;
literals["fingerprints"] = 30;
literals["return"] = 24;
literals["optmiss"] = 197;
literals["optmiss"] = 198;
literals["match"] = 65;
literals["keep"] = 205;
literals["net-prohib"] = 181;
literals["inet6"] = 114;
literals["from"] = 132;
literals["keep"] = 206;
literals["net-prohib"] = 182;
literals["inet6"] = 115;
literals["from"] = 133;
literals["tcp.finwait"] = 40;
literals["hostid"] = 35;
literals["proto"] = 115;
literals["vrrp"] = 129;
literals["proto"] = 116;
literals["vrrp"] = 130;
literals["drop"] = 23;
literals["l2tp"] = 130;
literals["max-mss"] = 143;
literals["isolate"] = 180;
literals["timereq"] = 158;
literals["l2tp"] = 131;
literals["max-mss"] = 144;
literals["isolate"] = 181;
literals["timereq"] = 159;
literals["aggressive"] = 15;
literals["icmp6"] = 213;
literals["echoreq"] = 153;
literals["icmp6"] = 214;
literals["echoreq"] = 154;
literals["tcp.established"] = 38;
literals["decrypt-fail"] = 201;
literals["mobredir"] = 166;
literals["decrypt-fail"] = 202;
literals["mobredir"] = 167;
literals["other.first"] = 47;
literals["ipsec"] = 215;
literals["no-route"] = 135;
literals["random"] = 94;
literals["binat"] = 100;
literals["srcfail"] = 177;
literals["ipsec"] = 216;
literals["no-route"] = 136;
literals["random"] = 95;
literals["binat"] = 101;
literals["srcfail"] = 178;
literals["self"] = 79;
literals["timerep"] = 159;
literals["crop"] = 139;
literals["host-preced"] = 186;
literals["host"] = 222;
literals["echorep"] = 148;
literals["timerep"] = 160;
literals["crop"] = 140;
literals["host-preced"] = 187;
literals["host"] = 223;
literals["echorep"] = 149;
literals["other.multiple"] = 49;
literals["althost"] = 152;
literals["althost"] = 153;
literals["udp.multiple"] = 44;
literals["cutoff-preced"] = 187;
literals["redir-host"] = 189;
literals["rdr"] = 87;
literals["tagged"] = 203;
literals["cutoff-preced"] = 188;
literals["redir-host"] = 190;
literals["rdr"] = 88;
literals["tagged"] = 204;
literals["on"] = 32;
literals["round-robin"] = 98;
literals["pcp"] = 217;
literals["round-robin"] = 99;
literals["pcp"] = 218;
literals["block-policy"] = 22;
literals["persist"] = 69;
literals["unknown-ind"] = 199;
literals["redir-net"] = 188;
literals["filter-prohib"] = 185;
literals["nat"] = 83;
literals["unknown-ind"] = 200;
literals["redir-net"] = 189;
literals["filter-prohib"] = 186;
literals["nat"] = 84;
literals["satellite"] = 19;
literals["informational"] = 229;
literals["needfrag"] = 176;
literals["informational"] = 230;
literals["needfrag"] = 177;
literals["tcp.opening"] = 37;
literals["igrp"] = 214;
literals["quick"] = 112;
literals["timex"] = 156;
literals["host-unk"] = 179;
literals["route-to"] = 136;
literals["dataconv"] = 165;
literals["rdp"] = 121;
literals["net-unr"] = 172;
literals["igrp"] = 215;
literals["quick"] = 113;
literals["timex"] = 157;
literals["host-unk"] = 180;
literals["route-to"] = 137;
literals["dataconv"] = 166;
literals["rdp"] = 122;
literals["net-unr"] = 173;
literals["queue"] = 10;
literals["isis"] = 131;
literals["reassemb"] = 195;
literals["inactive"] = 233;
literals["out"] = 107;
literals["min-ttl"] = 142;
literals["auth-fail"] = 200;
literals["exit"] = 210;
literals["host-prohib"] = 182;
literals["isis"] = 132;
literals["reassemb"] = 196;
literals["inactive"] = 234;
literals["out"] = 108;
literals["min-ttl"] = 143;
literals["auth-fail"] = 201;
literals["exit"] = 211;
literals["host-prohib"] = 183;
}
ANTLR_USE_NAMESPACE(antlr)RefToken PFCfgLexer::nextToken()
@ -558,11 +559,11 @@ void PFCfgLexer::mLINE_COMMENT(bool _createToken) {
}
}
else {
goto _loop248;
goto _loop249;
}
}
_loop248:;
_loop249:;
} // ( ... )*
mNEWLINE(false);
if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@ -594,9 +595,9 @@ void PFCfgLexer::mNEWLINE(bool _createToken) {
}
if ( inputState->guessing==0 ) {
#line 1890 "pf.g"
#line 1899 "pf.g"
newline();
#line 600 "PFCfgLexer.cpp"
#line 601 "PFCfgLexer.cpp"
}
if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
_token = makeToken(_ttype);
@ -675,9 +676,9 @@ void PFCfgLexer::mWhitespace(bool _createToken) {
}
}
if ( inputState->guessing==0 ) {
#line 1885 "pf.g"
#line 1894 "pf.g"
_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
#line 681 "PFCfgLexer.cpp"
#line 682 "PFCfgLexer.cpp"
}
if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
_token = makeToken(_ttype);
@ -902,10 +903,10 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
_ttype = NUMBER_ADDRESS_OR_WORD;
ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
bool synPredMatched301 = false;
bool synPredMatched302 = false;
if ((((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_3.member(LA(2))) && (_tokenSet_3.member(LA(3))))) {
int _m301 = mark();
synPredMatched301 = true;
int _m302 = mark();
synPredMatched302 = true;
inputState->guessing++;
try {
{
@ -916,12 +917,12 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched301 = false;
synPredMatched302 = false;
}
rewind(_m301);
rewind(_m302);
inputState->guessing--;
}
if ( synPredMatched301 ) {
if ( synPredMatched302 ) {
{
mNUM_3DIGIT(false);
match('.' /* charlit */ );
@ -932,144 +933,144 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
mNUM_3DIGIT(false);
}
if ( inputState->guessing==0 ) {
#line 1945 "pf.g"
#line 1954 "pf.g"
_ttype = IPV4;
#line 938 "PFCfgLexer.cpp"
#line 939 "PFCfgLexer.cpp"
}
}
else {
bool synPredMatched308 = false;
bool synPredMatched309 = false;
if ((((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_3.member(LA(2))) && (_tokenSet_3.member(LA(3))))) {
int _m308 = mark();
synPredMatched308 = true;
int _m309 = mark();
synPredMatched309 = true;
inputState->guessing++;
try {
{
{ // ( ... )+
int _cnt305=0;
int _cnt306=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt305>=1 ) { goto _loop305; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt306>=1 ) { goto _loop306; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt305++;
_cnt306++;
}
_loop305:;
_loop306:;
} // ( ... )+
match('.' /* charlit */ );
{ // ( ... )+
int _cnt307=0;
int _cnt308=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt307>=1 ) { goto _loop307; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt308>=1 ) { goto _loop308; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt307++;
_cnt308++;
}
_loop307:;
_loop308:;
} // ( ... )+
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched308 = false;
synPredMatched309 = false;
}
rewind(_m308);
rewind(_m309);
inputState->guessing--;
}
if ( synPredMatched308 ) {
if ( synPredMatched309 ) {
{
{ // ( ... )+
int _cnt311=0;
int _cnt312=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt311>=1 ) { goto _loop311; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt312>=1 ) { goto _loop312; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt311++;
_cnt312++;
}
_loop311:;
_loop312:;
} // ( ... )+
match('.' /* charlit */ );
{ // ( ... )+
int _cnt313=0;
int _cnt314=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt313>=1 ) { goto _loop313; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt314>=1 ) { goto _loop314; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt313++;
_cnt314++;
}
_loop313:;
_loop314:;
} // ( ... )+
}
if ( inputState->guessing==0 ) {
#line 1948 "pf.g"
#line 1957 "pf.g"
_ttype = NUMBER;
#line 1021 "PFCfgLexer.cpp"
#line 1022 "PFCfgLexer.cpp"
}
}
else {
bool synPredMatched276 = false;
bool synPredMatched277 = false;
if (((_tokenSet_2.member(LA(1))) && (_tokenSet_4.member(LA(2))) && (true))) {
int _m276 = mark();
synPredMatched276 = true;
int _m277 = mark();
synPredMatched277 = true;
inputState->guessing++;
try {
{
{ // ( ... )+
int _cnt275=0;
int _cnt276=0;
for (;;) {
if ((_tokenSet_2.member(LA(1)))) {
mHEX_DIGIT(false);
}
else {
if ( _cnt275>=1 ) { goto _loop275; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt276>=1 ) { goto _loop276; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt275++;
_cnt276++;
}
_loop275:;
_loop276:;
} // ( ... )+
match(':' /* charlit */ );
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched276 = false;
synPredMatched277 = false;
}
rewind(_m276);
rewind(_m277);
inputState->guessing--;
}
if ( synPredMatched276 ) {
if ( synPredMatched277 ) {
{
{
{ // ( ... )+
int _cnt280=0;
int _cnt281=0;
for (;;) {
if ((_tokenSet_2.member(LA(1)))) {
mHEX_DIGIT(false);
}
else {
if ( _cnt280>=1 ) { goto _loop280; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt281>=1 ) { goto _loop281; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt280++;
_cnt281++;
}
_loop280:;
_loop281:;
} // ( ... )+
{ // ( ... )+
int _cnt284=0;
int _cnt285=0;
for (;;) {
if ((LA(1) == 0x3a /* ':' */ )) {
match(':' /* charlit */ );
@ -1079,34 +1080,34 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
mHEX_DIGIT(false);
}
else {
goto _loop283;
goto _loop284;
}
}
_loop283:;
_loop284:;
} // ( ... )*
}
else {
if ( _cnt284>=1 ) { goto _loop284; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt285>=1 ) { goto _loop285; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt284++;
_cnt285++;
}
_loop284:;
_loop285:;
} // ( ... )+
}
if ( inputState->guessing==0 ) {
#line 1930 "pf.g"
#line 1939 "pf.g"
_ttype = IPV6;
#line 1102 "PFCfgLexer.cpp"
#line 1103 "PFCfgLexer.cpp"
}
}
}
else {
bool synPredMatched286 = false;
bool synPredMatched287 = false;
if (((LA(1) == 0x3a /* ':' */ ))) {
int _m286 = mark();
synPredMatched286 = true;
int _m287 = mark();
synPredMatched287 = true;
inputState->guessing++;
try {
{
@ -1114,93 +1115,93 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched286 = false;
synPredMatched287 = false;
}
rewind(_m286);
rewind(_m287);
inputState->guessing--;
}
if ( synPredMatched286 ) {
if ( synPredMatched287 ) {
{
bool synPredMatched291 = false;
bool synPredMatched292 = false;
if (((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (_tokenSet_2.member(LA(3))))) {
int _m291 = mark();
synPredMatched291 = true;
int _m292 = mark();
synPredMatched292 = true;
inputState->guessing++;
try {
{
match(':' /* charlit */ );
match(':' /* charlit */ );
{ // ( ... )+
int _cnt290=0;
int _cnt291=0;
for (;;) {
if ((_tokenSet_2.member(LA(1)))) {
mHEX_DIGIT(false);
}
else {
if ( _cnt290>=1 ) { goto _loop290; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt291>=1 ) { goto _loop291; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt290++;
_cnt291++;
}
_loop290:;
_loop291:;
} // ( ... )+
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched291 = false;
synPredMatched292 = false;
}
rewind(_m291);
rewind(_m292);
inputState->guessing--;
}
if ( synPredMatched291 ) {
if ( synPredMatched292 ) {
{
match(':' /* charlit */ );
match(':' /* charlit */ );
{ // ( ... )+
int _cnt294=0;
int _cnt295=0;
for (;;) {
if ((_tokenSet_2.member(LA(1)))) {
mHEX_DIGIT(false);
}
else {
if ( _cnt294>=1 ) { goto _loop294; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt295>=1 ) { goto _loop295; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt294++;
_cnt295++;
}
_loop294:;
_loop295:;
} // ( ... )+
{ // ( ... )*
for (;;) {
if ((LA(1) == 0x3a /* ':' */ )) {
match(':' /* charlit */ );
{ // ( ... )+
int _cnt297=0;
int _cnt298=0;
for (;;) {
if ((_tokenSet_2.member(LA(1)))) {
mHEX_DIGIT(false);
}
else {
if ( _cnt297>=1 ) { goto _loop297; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt298>=1 ) { goto _loop298; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt297++;
_cnt298++;
}
_loop297:;
_loop298:;
} // ( ... )+
}
else {
goto _loop298;
goto _loop299;
}
}
_loop298:;
_loop299:;
} // ( ... )*
}
if ( inputState->guessing==0 ) {
#line 1936 "pf.g"
#line 1945 "pf.g"
_ttype = IPV6;
#line 1204 "PFCfgLexer.cpp"
#line 1205 "PFCfgLexer.cpp"
}
}
else if ((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (true)) {
@ -1209,17 +1210,17 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
match(':' /* charlit */ );
}
if ( inputState->guessing==0 ) {
#line 1938 "pf.g"
#line 1947 "pf.g"
_ttype = IPV6;
#line 1215 "PFCfgLexer.cpp"
#line 1216 "PFCfgLexer.cpp"
}
}
else if ((LA(1) == 0x3a /* ':' */ ) && (true)) {
match(':' /* charlit */ );
if ( inputState->guessing==0 ) {
#line 1940 "pf.g"
#line 1949 "pf.g"
_ttype = COLON;
#line 1223 "PFCfgLexer.cpp"
#line 1224 "PFCfgLexer.cpp"
}
}
else {
@ -1230,23 +1231,23 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
else if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
{ // ( ... )+
int _cnt315=0;
int _cnt316=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt315>=1 ) { goto _loop315; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt316>=1 ) { goto _loop316; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt315++;
_cnt316++;
}
_loop315:;
_loop316:;
} // ( ... )+
if ( inputState->guessing==0 ) {
#line 1950 "pf.g"
#line 1959 "pf.g"
_ttype = INT_CONST;
#line 1250 "PFCfgLexer.cpp"
#line 1251 "PFCfgLexer.cpp"
}
}
else if ((_tokenSet_5.member(LA(1))) && (true) && (true)) {
@ -1462,16 +1463,16 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
default:
{
goto _loop318;
goto _loop319;
}
}
}
_loop318:;
_loop319:;
} // ( ... )*
if ( inputState->guessing==0 ) {
#line 1961 "pf.g"
#line 1970 "pf.g"
_ttype = WORD;
#line 1475 "PFCfgLexer.cpp"
#line 1476 "PFCfgLexer.cpp"
}
}
else {
@ -1499,11 +1500,11 @@ void PFCfgLexer::mSTRING(bool _createToken) {
matchNot('\"' /* charlit */ );
}
else {
goto _loop321;
goto _loop322;
}
}
_loop321:;
_loop322:;
} // ( ... )*
match('\"' /* charlit */ );
if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {

1076
src/parsers/PFCfgParser.cpp
View File

File diff suppressed because it is too large Load Diff

312
src/parsers/PFCfgParserTokenTypes.hpp
View File

@ -89,162 +89,162 @@ struct CUSTOM_API PFCfgParserTokenTypes {
PEER = 78,
SELF = 79,
IPV4 = 80,
SLASH = 81,
NO = 82,
NAT = 83,
PASS = 84,
MINUS = 85,
STATIC_PORT = 86,
RDR = 87,
OPENING_PAREN = 88,
CLOSING_PAREN = 89,
PORT = 90,
IPV6 = 91,
STAR = 92,
BITMASK = 93,
RANDOM = 94,
SOURCE_HASH = 95,
HEX_KEY = 96,
STRING_KEY = 97,
ROUND_ROBIN = 98,
STICKY_ADDRESS = 99,
BINAT = 100,
BLOCK = 101,
RETURN_RST = 102,
TTL = 103,
RETURN_ICMP = 104,
RETURN_ICMP6 = 105,
IN = 106,
OUT = 107,
LOG = 108,
ALL = 109,
USER = 110,
TO = 111,
QUICK = 112,
INET = 113,
INET6 = 114,
PROTO = 115,
IP = 116,
ICMP = 117,
IGMP = 118,
TCP = 119,
UDP = 120,
RDP = 121,
RSVP = 122,
GRE = 123,
ESP = 124,
AH = 125,
EIGRP = 126,
OSPF = 127,
IPIP = 128,
VRRP = 129,
L2TP = 130,
ISIS = 131,
FROM = 132,
URPF_FAILED = 133,
ANY = 134,
NO_ROUTE = 135,
ROUTE_TO = 136,
REPLY_TO = 137,
LITERAL_fragment = 138,
LITERAL_crop = 139,
// "drop-ovl" = 140
// "no-df" = 141
// "min-ttl" = 142
// "max-mss" = 143
// "random-id" = 144
FLAGS = 145,
ICMP_TYPE = 146,
ICMP_CODE = 147,
LITERAL_echorep = 148,
LITERAL_unreach = 149,
LITERAL_squench = 150,
LITERAL_redir = 151,
LITERAL_althost = 152,
LITERAL_echoreq = 153,
LITERAL_routeradv = 154,
LITERAL_routersol = 155,
LITERAL_timex = 156,
LITERAL_paramprob = 157,
LITERAL_timereq = 158,
LITERAL_timerep = 159,
LITERAL_inforeq = 160,
LITERAL_inforep = 161,
LITERAL_maskreq = 162,
LITERAL_maskrep = 163,
LITERAL_trace = 164,
LITERAL_dataconv = 165,
LITERAL_mobredir = 166,
// "ipv6-where" = 167
// "ipv6-here" = 168
LITERAL_mobregreq = 169,
LITERAL_mobregrep = 170,
LITERAL_photuris = 171,
// "net-unr" = 172
// "host-unr" = 173
// "proto-unr" = 174
// "port-unr" = 175
LITERAL_needfrag = 176,
LITERAL_srcfail = 177,
// "net-unk" = 178
// "host-unk" = 179
LITERAL_isolate = 180,
// "net-prohib" = 181
// "host-prohib" = 182
// "net-tos" = 183
// "host-tos" = 184
// "filter-prohib" = 185
// "host-preced" = 186
// "cutoff-preced" = 187
// "redir-net" = 188
// "redir-host" = 189
// "redir-tos-net" = 190
// "redir-tos-host" = 191
// "normal-adv" = 192
// "common-adv" = 193
LITERAL_transit = 194,
LITERAL_reassemb = 195,
LITERAL_badhead = 196,
LITERAL_optmiss = 197,
LITERAL_badlen = 198,
// "unknown-ind" = 199
// "auth-fail" = 200
// "decrypt-fail" = 201
ICMP6_TYPE = 202,
TAGGED = 203,
TAG = 204,
KEEP = 205,
MODULATE = 206,
SYNPROXY = 207,
STATE = 208,
LABEL = 209,
EXIT = 210,
QUIT = 211,
INTRFACE = 212,
ICMP6 = 213,
IGRP = 214,
IPSEC = 215,
NOS = 216,
PCP = 217,
PIM = 218,
PPTP = 219,
RIP = 220,
SNP = 221,
HOST = 222,
RANGE = 223,
LOG_LEVEL_ALERTS = 224,
LOG_LEVEL_CRITICAL = 225,
LOG_LEVEL_DEBUGGING = 226,
LOG_LEVEL_EMERGENCIES = 227,
LOG_LEVEL_ERRORS = 228,
LOG_LEVEL_INFORMATIONAL = 229,
LOG_LEVEL_NOTIFICATIONS = 230,
LOG_LEVEL_WARNINGS = 231,
LOG_LEVEL_DISABLE = 232,
LOG_LEVEL_INACTIVE = 233,
Whitespace = 234,
HEX_CONST = 235,
NUMBER = 236,
NUMBER = 81,
SLASH = 82,
NO = 83,
NAT = 84,
PASS = 85,
MINUS = 86,
STATIC_PORT = 87,
RDR = 88,
OPENING_PAREN = 89,
CLOSING_PAREN = 90,
PORT = 91,
IPV6 = 92,
STAR = 93,
BITMASK = 94,
RANDOM = 95,
SOURCE_HASH = 96,
HEX_KEY = 97,
STRING_KEY = 98,
ROUND_ROBIN = 99,
STICKY_ADDRESS = 100,
BINAT = 101,
BLOCK = 102,
RETURN_RST = 103,
TTL = 104,
RETURN_ICMP = 105,
RETURN_ICMP6 = 106,
IN = 107,
OUT = 108,
LOG = 109,
ALL = 110,
USER = 111,
TO = 112,
QUICK = 113,
INET = 114,
INET6 = 115,
PROTO = 116,
IP = 117,
ICMP = 118,
IGMP = 119,
TCP = 120,
UDP = 121,
RDP = 122,
RSVP = 123,
GRE = 124,
ESP = 125,
AH = 126,
EIGRP = 127,
OSPF = 128,
IPIP = 129,
VRRP = 130,
L2TP = 131,
ISIS = 132,
FROM = 133,
URPF_FAILED = 134,
ANY = 135,
NO_ROUTE = 136,
ROUTE_TO = 137,
REPLY_TO = 138,
LITERAL_fragment = 139,
LITERAL_crop = 140,
// "drop-ovl" = 141
// "no-df" = 142
// "min-ttl" = 143
// "max-mss" = 144
// "random-id" = 145
FLAGS = 146,
ICMP_TYPE = 147,
ICMP_CODE = 148,
LITERAL_echorep = 149,
LITERAL_unreach = 150,
LITERAL_squench = 151,
LITERAL_redir = 152,
LITERAL_althost = 153,
LITERAL_echoreq = 154,
LITERAL_routeradv = 155,
LITERAL_routersol = 156,
LITERAL_timex = 157,
LITERAL_paramprob = 158,
LITERAL_timereq = 159,
LITERAL_timerep = 160,
LITERAL_inforeq = 161,
LITERAL_inforep = 162,
LITERAL_maskreq = 163,
LITERAL_maskrep = 164,
LITERAL_trace = 165,
LITERAL_dataconv = 166,
LITERAL_mobredir = 167,
// "ipv6-where" = 168
// "ipv6-here" = 169
LITERAL_mobregreq = 170,
LITERAL_mobregrep = 171,
LITERAL_photuris = 172,
// "net-unr" = 173
// "host-unr" = 174
// "proto-unr" = 175
// "port-unr" = 176
LITERAL_needfrag = 177,
LITERAL_srcfail = 178,
// "net-unk" = 179
// "host-unk" = 180
LITERAL_isolate = 181,
// "net-prohib" = 182
// "host-prohib" = 183
// "net-tos" = 184
// "host-tos" = 185
// "filter-prohib" = 186
// "host-preced" = 187
// "cutoff-preced" = 188
// "redir-net" = 189
// "redir-host" = 190
// "redir-tos-net" = 191
// "redir-tos-host" = 192
// "normal-adv" = 193
// "common-adv" = 194
LITERAL_transit = 195,
LITERAL_reassemb = 196,
LITERAL_badhead = 197,
LITERAL_optmiss = 198,
LITERAL_badlen = 199,
// "unknown-ind" = 200
// "auth-fail" = 201
// "decrypt-fail" = 202
ICMP6_TYPE = 203,
TAGGED = 204,
TAG = 205,
KEEP = 206,
MODULATE = 207,
SYNPROXY = 208,
STATE = 209,
LABEL = 210,
EXIT = 211,
QUIT = 212,
INTRFACE = 213,
ICMP6 = 214,
IGRP = 215,
IPSEC = 216,
NOS = 217,
PCP = 218,
PIM = 219,
PPTP = 220,
RIP = 221,
SNP = 222,
HOST = 223,
RANGE = 224,
LOG_LEVEL_ALERTS = 225,
LOG_LEVEL_CRITICAL = 226,
LOG_LEVEL_DEBUGGING = 227,
LOG_LEVEL_EMERGENCIES = 228,
LOG_LEVEL_ERRORS = 229,
LOG_LEVEL_INFORMATIONAL = 230,
LOG_LEVEL_NOTIFICATIONS = 231,
LOG_LEVEL_WARNINGS = 232,
LOG_LEVEL_DISABLE = 233,
LOG_LEVEL_INACTIVE = 234,
Whitespace = 235,
HEX_CONST = 236,
NEG_INT_CONST = 237,
HEX_DIGIT = 238,
DIGIT = 239,

314
src/parsers/PFCfgParserTokenTypes.txt
View File

@ -67,7 +67,7 @@ LESS_THAN=67
GREATER_THAN=68
PERSIST="persist"=69
CONST="const"=70
COUNTERS=71
COUNTERS="counters"=71
FILE="file"=72
STRING=73
EXLAMATION=74
@ -77,162 +77,162 @@ BROADCAST="broadcast"=77
PEER="peer"=78
SELF="self"=79
IPV4=80
SLASH=81
NO="no"=82
NAT="nat"=83
PASS="pass"=84
MINUS=85
STATIC_PORT="static-port"=86
RDR="rdr"=87
OPENING_PAREN=88
CLOSING_PAREN=89
PORT="port"=90
IPV6=91
STAR=92
BITMASK="bitmask"=93
RANDOM="random"=94
SOURCE_HASH="source-hash"=95
HEX_KEY="hex-key"=96
STRING_KEY="string-key"=97
ROUND_ROBIN="round-robin"=98
STICKY_ADDRESS="sticky-address"=99
BINAT="binat"=100
BLOCK="block"=101
RETURN_RST="return-rst"=102
TTL=103
RETURN_ICMP="return-icmp"=104
RETURN_ICMP6=105
IN="in"=106
OUT="out"=107
LOG="log"=108
ALL="all"=109
USER="user"=110
TO="to"=111
QUICK="quick"=112
INET="inet"=113
INET6="inet6"=114
PROTO="proto"=115
IP="ip"=116
ICMP="icmp"=117
IGMP="igmp"=118
TCP="tcp"=119
UDP="udp"=120
RDP="rdp"=121
RSVP="rsvp"=122
GRE="gre"=123
ESP="esp"=124
AH="ah"=125
EIGRP="eigrp"=126
OSPF="ospf"=127
IPIP="ipip"=128
VRRP="vrrp"=129
L2TP="l2tp"=130
ISIS="isis"=131
FROM="from"=132
URPF_FAILED="urpf-failed"=133
ANY="any"=134
NO_ROUTE="no-route"=135
ROUTE_TO="route-to"=136
REPLY_TO="reply-to"=137
LITERAL_fragment="fragment"=138
LITERAL_crop="crop"=139
"drop-ovl"=140
"no-df"=141
"min-ttl"=142
"max-mss"=143
"random-id"=144
FLAGS="flags"=145
ICMP_TYPE="icmp-type"=146
ICMP_CODE="code"=147
LITERAL_echorep="echorep"=148
LITERAL_unreach="unreach"=149
LITERAL_squench="squench"=150
LITERAL_redir="redir"=151
LITERAL_althost="althost"=152
LITERAL_echoreq="echoreq"=153
LITERAL_routeradv="routeradv"=154
LITERAL_routersol="routersol"=155
LITERAL_timex="timex"=156
LITERAL_paramprob="paramprob"=157
LITERAL_timereq="timereq"=158
LITERAL_timerep="timerep"=159
LITERAL_inforeq="inforeq"=160
LITERAL_inforep="inforep"=161
LITERAL_maskreq="maskreq"=162
LITERAL_maskrep="maskrep"=163
LITERAL_trace="trace"=164
LITERAL_dataconv="dataconv"=165
LITERAL_mobredir="mobredir"=166
"ipv6-where"=167
"ipv6-here"=168
LITERAL_mobregreq="mobregreq"=169
LITERAL_mobregrep="mobregrep"=170
LITERAL_photuris="photuris"=171
"net-unr"=172
"host-unr"=173
"proto-unr"=174
"port-unr"=175
LITERAL_needfrag="needfrag"=176
LITERAL_srcfail="srcfail"=177
"net-unk"=178
"host-unk"=179
LITERAL_isolate="isolate"=180
"net-prohib"=181
"host-prohib"=182
"net-tos"=183
"host-tos"=184
"filter-prohib"=185
"host-preced"=186
"cutoff-preced"=187
"redir-net"=188
"redir-host"=189
"redir-tos-net"=190
"redir-tos-host"=191
"normal-adv"=192
"common-adv"=193
LITERAL_transit="transit"=194
LITERAL_reassemb="reassemb"=195
LITERAL_badhead="badhead"=196
LITERAL_optmiss="optmiss"=197
LITERAL_badlen="badlen"=198
"unknown-ind"=199
"auth-fail"=200
"decrypt-fail"=201
ICMP6_TYPE="icmp6-type"=202
TAGGED="tagged"=203
TAG="tag"=204
KEEP="keep"=205
MODULATE="modulate"=206
SYNPROXY="synproxy"=207
STATE="state"=208
LABEL="label"=209
EXIT="exit"=210
QUIT="quit"=211
INTRFACE="interface"=212
ICMP6="icmp6"=213
IGRP="igrp"=214
IPSEC="ipsec"=215
NOS="nos"=216
PCP="pcp"=217
PIM="pim"=218
PPTP="pptp"=219
RIP="rip"=220
SNP="snp"=221
HOST="host"=222
RANGE="range"=223
LOG_LEVEL_ALERTS="alerts"=224
LOG_LEVEL_CRITICAL="critical"=225
LOG_LEVEL_DEBUGGING="debugging"=226
LOG_LEVEL_EMERGENCIES="emergencies"=227
LOG_LEVEL_ERRORS="errors"=228
LOG_LEVEL_INFORMATIONAL="informational"=229
LOG_LEVEL_NOTIFICATIONS="notifications"=230
LOG_LEVEL_WARNINGS="warnings"=231
LOG_LEVEL_DISABLE="disable"=232
LOG_LEVEL_INACTIVE="inactive"=233
Whitespace=234
HEX_CONST=235
NUMBER=236
NUMBER=81
SLASH=82
NO="no"=83
NAT="nat"=84
PASS="pass"=85
MINUS=86
STATIC_PORT="static-port"=87
RDR="rdr"=88
OPENING_PAREN=89
CLOSING_PAREN=90
PORT="port"=91
IPV6=92
STAR=93
BITMASK="bitmask"=94
RANDOM="random"=95
SOURCE_HASH="source-hash"=96
HEX_KEY="hex-key"=97
STRING_KEY="string-key"=98
ROUND_ROBIN="round-robin"=99
STICKY_ADDRESS="sticky-address"=100
BINAT="binat"=101
BLOCK="block"=102
RETURN_RST="return-rst"=103
TTL=104
RETURN_ICMP="return-icmp"=105
RETURN_ICMP6=106
IN="in"=107
OUT="out"=108
LOG="log"=109
ALL="all"=110
USER="user"=111
TO="to"=112
QUICK="quick"=113
INET="inet"=114
INET6="inet6"=115
PROTO="proto"=116
IP="ip"=117
ICMP="icmp"=118
IGMP="igmp"=119
TCP="tcp"=120
UDP="udp"=121
RDP="rdp"=122
RSVP="rsvp"=123
GRE="gre"=124
ESP="esp"=125
AH="ah"=126
EIGRP="eigrp"=127
OSPF="ospf"=128
IPIP="ipip"=129
VRRP="vrrp"=130
L2TP="l2tp"=131
ISIS="isis"=132
FROM="from"=133
URPF_FAILED="urpf-failed"=134
ANY="any"=135
NO_ROUTE="no-route"=136
ROUTE_TO="route-to"=137
REPLY_TO="reply-to"=138
LITERAL_fragment="fragment"=139
LITERAL_crop="crop"=140
"drop-ovl"=141
"no-df"=142
"min-ttl"=143
"max-mss"=144
"random-id"=145
FLAGS="flags"=146
ICMP_TYPE="icmp-type"=147
ICMP_CODE="code"=148
LITERAL_echorep="echorep"=149
LITERAL_unreach="unreach"=150
LITERAL_squench="squench"=151
LITERAL_redir="redir"=152
LITERAL_althost="althost"=153
LITERAL_echoreq="echoreq"=154
LITERAL_routeradv="routeradv"=155
LITERAL_routersol="routersol"=156
LITERAL_timex="timex"=157
LITERAL_paramprob="paramprob"=158
LITERAL_timereq="timereq"=159
LITERAL_timerep="timerep"=160
LITERAL_inforeq="inforeq"=161
LITERAL_inforep="inforep"=162
LITERAL_maskreq="maskreq"=163
LITERAL_maskrep="maskrep"=164
LITERAL_trace="trace"=165
LITERAL_dataconv="dataconv"=166
LITERAL_mobredir="mobredir"=167
"ipv6-where"=168
"ipv6-here"=169
LITERAL_mobregreq="mobregreq"=170
LITERAL_mobregrep="mobregrep"=171
LITERAL_photuris="photuris"=172
"net-unr"=173
"host-unr"=174
"proto-unr"=175
"port-unr"=176
LITERAL_needfrag="needfrag"=177
LITERAL_srcfail="srcfail"=178
"net-unk"=179
"host-unk"=180
LITERAL_isolate="isolate"=181
"net-prohib"=182
"host-prohib"=183
"net-tos"=184
"host-tos"=185
"filter-prohib"=186
"host-preced"=187
"cutoff-preced"=188
"redir-net"=189
"redir-host"=190
"redir-tos-net"=191
"redir-tos-host"=192
"normal-adv"=193
"common-adv"=194
LITERAL_transit="transit"=195
LITERAL_reassemb="reassemb"=196
LITERAL_badhead="badhead"=197
LITERAL_optmiss="optmiss"=198
LITERAL_badlen="badlen"=199
"unknown-ind"=200
"auth-fail"=201
"decrypt-fail"=202
ICMP6_TYPE="icmp6-type"=203
TAGGED="tagged"=204
TAG="tag"=205
KEEP="keep"=206
MODULATE="modulate"=207
SYNPROXY="synproxy"=208
STATE="state"=209
LABEL="label"=210
EXIT="exit"=211
QUIT="quit"=212
INTRFACE="interface"=213
ICMP6="icmp6"=214
IGRP="igrp"=215
IPSEC="ipsec"=216
NOS="nos"=217
PCP="pcp"=218
PIM="pim"=219
PPTP="pptp"=220
RIP="rip"=221
SNP="snp"=222
HOST="host"=223
RANGE="range"=224
LOG_LEVEL_ALERTS="alerts"=225
LOG_LEVEL_CRITICAL="critical"=226
LOG_LEVEL_DEBUGGING="debugging"=227
LOG_LEVEL_EMERGENCIES="emergencies"=228
LOG_LEVEL_ERRORS="errors"=229
LOG_LEVEL_INFORMATIONAL="informational"=230
LOG_LEVEL_NOTIFICATIONS="notifications"=231
LOG_LEVEL_WARNINGS="warnings"=232
LOG_LEVEL_DISABLE="disable"=233
LOG_LEVEL_INACTIVE="inactive"=234
Whitespace=235
HEX_CONST=236
NEG_INT_CONST=237
HEX_DIGIT=238
DIGIT=239

11
src/parsers/pf.g
View File

@ -538,6 +538,13 @@ table_rule :
importer->newAddressTableObject(
name->getText(), importer->tmp_group);
}
|
NEWLINE
{
// Special case: table definition without file name or list of addresses.
// Create run-time AddressTable object with name but no file spec.
importer->newAddressTableObject(name->getText(), "");
}
)
;
@ -583,7 +590,8 @@ tableaddr_spec { AddressSpec as; } :
as.address = "self";
}
|
IPV4
// match NUMBER and INT_CONST to account for 10/8, 172.16/12 cases.
( IPV4 | NUMBER | INT_CONST )
{
as.at = AddressSpec::HOST_ADDRESS;
as.address = LT(0)->getText();
@ -1842,6 +1850,7 @@ tokens
TABLE = "table";
CONST = "const";
PERSIST = "persist";
COUNTERS = "counters";
FILE = "file";
QUEUE = "queue";

19
src/unit_tests/PFImporterTest/PFImporterTest.cpp
View File

@ -465,5 +465,24 @@ void PFImporterTest::scrubCommandsNew()
"pf-scrub-commands-new.output");
}
void PFImporterTest::tableDefinitions()
{
platform = "pf";
std::istringstream instream(
openTestFile("test_data/pf-tables.conf"));
Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
CPPUNIT_ASSERT_NO_THROW( imp->run() );
imp->finalize();
db->setPredictableIds();
db->saveFile("pf-tables.fwb");
compareResults(logger, "test_data/pf-tables.output", "pf-tables.output");
compareFwbFiles("test_data/pf-tables.fwb", "pf-tables.fwb");
}

2
src/unit_tests/PFImporterTest/PFImporterTest.h
View File

@ -71,6 +71,7 @@ public:
void setTimeoutCommands();
void scrubCommandsOld();
void scrubCommandsNew();
void tableDefinitions();
CPPUNIT_TEST_SUITE(PFImporterTest);
@ -87,6 +88,7 @@ public:
CPPUNIT_TEST(setTimeoutCommands);
CPPUNIT_TEST(scrubCommandsOld);
CPPUNIT_TEST(scrubCommandsNew);
CPPUNIT_TEST(tableDefinitions);
CPPUNIT_TEST_SUITE_END();

4
src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.output
View File

@ -1,4 +1,8 @@
2: Address Table: <dst_addresses_1>: 192.168.1.1/, 192.168.1.2/, 192.168.2.0/24
3: New interface: pcn0
3: Address Table: <dst_addresses_2>: pcn0/, pcn0/
4: Address Table: <dst_addresses_3>: pcn0/, pcn0/
5: Address Table: <dst_addresses_4>: www.fwbuilder.org/, www.netcitadel.com/
8: filtering rule: action pass; interfaces:
9: filtering rule: action pass; interfaces:
9: Error: import of 'interface:broadcast' is not supported.

12
src/unit_tests/PFImporterTest/test_data/pf-tables.conf Normal file
View File

@ -0,0 +1,12 @@
table <mike> persist
table <BLOCKTEMP> counters
table <BLOCKPERM> counters file "./pf_block_permanent"
table <BLOCK> file "./pf_table"
table <spamd-white>
table <private> const { 10/8, 172.16/12, 192.168/16 }
table <dst_addresses_1> { 192.168.1.1, 192.168.1.2, 192.168.2.0/24 }
table <dst_addresses_2> { pcn0, pcn0:network }
table <dst_addresses_3> { pcn0:peer, pcn0:0 }
table <dst_addresses_4> { www.fwbuilder.org, www.netcitadel.com }

528
src/unit_tests/PFImporterTest/test_data/pf-tables.fwb Normal file
View File

@ -0,0 +1,528 @@
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1307169228" id="root">
<Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
<AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
<AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
<AnyInterval id="sysid2" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1" name="Any" comment="Any Interval" ro="False"/>
<ObjectGroup id="stdid01" name="Objects" comment="" ro="False">
<ObjectGroup id="stdid16" name="Addresses" comment="" ro="False">
<IPv4 id="id2001X88798" name="all-hosts" comment="" ro="False" address="224.0.0.1" netmask="0.0.0.0"/>
<IPv4 id="id2002X88798" name="all-routers" comment="" ro="False" address="224.0.0.2" netmask="0.0.0.0"/>
<IPv4 id="id2003X88798" name="all DVMRP" comment="" ro="False" address="224.0.0.4" netmask="0.0.0.0"/>
<IPv4 id="id2117X88798" name="OSPF (all routers)" comment="RFC2328" ro="False" address="224.0.0.5" netmask="0.0.0.0"/>
<IPv4 id="id2128X88798" name="OSPF (designated routers)" comment="RFC2328" ro="False" address="224.0.0.6" netmask="0.0.0.0"/>
<IPv4 id="id2430X88798" name="RIP" comment="RFC1723" ro="False" address="224.0.0.9" netmask="0.0.0.0"/>
<IPv4 id="id2439X88798" name="EIGRP" comment="" ro="False" address="224.0.0.10" netmask="0.0.0.0"/>
<IPv4 id="id2446X88798" name="DHCP server, relay agent" comment="RFC 1884" ro="False" address="224.0.0.12" netmask="0.0.0.0"/>
<IPv4 id="id2455X88798" name="PIM" comment="" ro="False" address="224.0.0.13" netmask="0.0.0.0"/>
<IPv4 id="id2462X88798" name="RSVP" comment="" ro="False" address="224.0.0.14" netmask="0.0.0.0"/>
<IPv4 id="id2469X88798" name="VRRP" comment="RFC3768" ro="False" address="224.0.0.18" netmask="0.0.0.0"/>
<IPv4 id="id2777X88798" name="IGMP" comment="" ro="False" address="224.0.0.22" netmask="0.0.0.0"/>
<IPv4 id="id2784X88798" name="OSPFIGP-TE" comment="RFC4973" ro="False" address="224.0.0.24" netmask="0.0.0.0"/>
<IPv4 id="id3094X88798" name="HSRP" comment="" ro="False" address="224.0.0.102" netmask="0.0.0.0"/>
<IPv4 id="id3403X88798" name="mDNS" comment="" ro="False" address="224.0.0.251" netmask="0.0.0.0"/>
<IPv4 id="id3410X88798" name="LLMNR" comment="Link-Local Multicast Name Resolution, RFC4795" ro="False" address="224.0.0.252" netmask="0.0.0.0"/>
<IPv4 id="id3411X88798" name="Teredo" comment="" ro="False" address="224.0.0.253" netmask="0.0.0.0"/>
</ObjectGroup>
<ObjectGroup id="stdid17" name="DNS Names" comment="" ro="False"/>
<ObjectGroup id="stdid18" name="Address Tables" comment="" ro="False"/>
<ObjectGroup id="stdid04" name="Groups" comment="" ro="False">
<ObjectGroup id="id3DC75CE8" name="rfc1918-nets" comment="" ro="False">
<ObjectRef ref="id3DC75CE5"/>
<ObjectRef ref="id3DC75CE6"/>
<ObjectRef ref="id3DC75CE7"/>
</ObjectGroup>
<ObjectGroup id="id3292X75851" name="ipv6 private" comment="These are various ipv6 networks that should not be routed on the Internet&#10;" ro="False">
<ObjectRef ref="id2088X75851"/>
<ObjectRef ref="id2986X75851"/>
<ObjectRef ref="id2383X75851"/>
</ObjectGroup>
</ObjectGroup>
<ObjectGroup id="stdid02" name="Hosts" comment="" ro="False">
<Host id="id3D84EECE" name="internal server" comment="This host is used in examples and template objects" ro="False">
<Interface id="id3D84EED2" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
<IPv4 id="id3D84EED3" name="ip" comment="" ro="False" address="192.168.1.10" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="192.168.1.10">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions>
<Option name="snmp_contact"></Option>
<Option name="snmp_description"></Option>
<Option name="snmp_location"></Option>
<Option name="use_mac_addr">false</Option>
<Option name="use_mac_addr_filter">False</Option>
</HostOptions>
</Host>
<Host id="id3D84EECF" name="server on dmz" comment="This host is used in examples and template objects" ro="False">
<Interface id="id3D84EEE3" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
<IPv4 id="id3D84EEE4" name="ip" comment="" ro="False" address="192.168.2.10" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="192.168.2.10">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions>
<Option name="snmp_contact"></Option>
<Option name="snmp_description"></Option>
<Option name="snmp_location"></Option>
<Option name="use_mac_addr">false</Option>
<Option name="use_mac_addr_filter">False</Option>
</HostOptions>
</Host>
</ObjectGroup>
<ObjectGroup id="stdid03" name="Networks" comment="" ro="False">
<Network id="id3DC75CEC" name="all multicasts" comment="224.0.0.0/4 - This block, formerly known as the Class D address&#10;space, is allocated for use in IPv4 multicast address assignments.&#10;The IANA guidelines for assignments from this space are described in&#10;[RFC3171].&#10;" ro="False" address="224.0.0.0" netmask="240.0.0.0"/>
<Network id="id3F4ECE3E" name="link-local" comment="169.254.0.0/16 - This is the &quot;link local&quot; block. It is allocated for&#10;communication between hosts on a single link. Hosts obtain these&#10;addresses by auto-configuration, such as when a DHCP server may not&#10;be found.&#10;" ro="False" address="169.254.0.0" netmask="255.255.0.0"/>
<Network id="id3F4ECE3D" name="loopback-net" comment="127.0.0.0/8 - This block is assigned for use as the Internet host&#10;loopback address. A datagram sent by a higher level protocol to an&#10;address anywhere within this block should loop back inside the host.&#10;This is ordinarily implemented using only 127.0.0.1/32 for loopback,&#10;but no addresses within this block should ever appear on any network&#10;anywhere [RFC1700, page 5].&#10;" ro="False" address="127.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE5" name="net-10.0.0.0" comment="10.0.0.0/8 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet." ro="False" address="10.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE7" name="net-172.16.0.0" comment="172.16.0.0/12 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet.&#10;" ro="False" address="172.16.0.0" netmask="255.240.0.0"/>
<Network id="id3DC75CE6" name="net-192.168.0.0" comment="192.168.0.0/16 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet.&#10;" ro="False" address="192.168.0.0" netmask="255.255.0.0"/>
<Network id="id3F4ECE3F" name="test-net" comment="192.0.2.0/24 - This block is assigned as &quot;TEST-NET&quot; for use in&#10;documentation and example code. It is often used in conjunction with&#10;domain names example.com or example.net in vendor and protocol&#10;documentation. Addresses within this block should not appear on the&#10;public Internet.&#10;" ro="False" address="192.0.2.0" netmask="255.255.255.0"/>
<Network id="id3F4ECE40" name="this-net" comment="0.0.0.0/8 - Addresses in this block refer to source hosts on &quot;this&quot;&#10;network. Address 0.0.0.0/32 may be used as a source address for this&#10;host on this network; other addresses within 0.0.0.0/8 may be used to&#10;refer to specified hosts on this network [RFC1700, page 4]." ro="False" address="0.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE7-1" name="net-192.168.1.0" comment="192.168.1.0/24 - Address often used for home and small office networks.&#10;" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
<Network id="id3DC75CE7-2" name="net-192.168.2.0" comment="192.168.2.0/24 - Address often used for home and small office networks.&#10;" ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
<NetworkIPv6 id="id2088X75851" name="documentation net" comment="RFC3849" ro="False" address="2001:db8::" netmask="32"/>
<NetworkIPv6 id="id2383X75851" name="link-local ipv6" comment="RFC4291 Link-local unicast net" ro="False" address="fe80::" netmask="10"/>
<NetworkIPv6 id="id2685X75851" name="multicast ipv6" comment="RFC4291 ipv6 multicast addresses" ro="False" address="ff00::" netmask="8"/>
<NetworkIPv6 id="id2986X75851" name="experimental ipv6" comment="RFC2928, RFC4773 &#10;&#10;&quot;The block of Sub-TLA IDs assigned to the IANA&#10;(i.e., 2001:0000::/29 - 2001:01F8::/29) is for&#10;assignment for testing and experimental usage to&#10;support activities such as the 6bone, and&#10;for new approaches like exchanges.&quot; [RFC2928]&#10;&#10;" ro="False" address="2001::" netmask="23"/>
</ObjectGroup>
<ObjectGroup id="stdid15" name="Address Ranges" comment="" ro="False">
<AddressRange id="id3F6D115C" name="broadcast" comment="" ro="False" start_address="255.255.255.255" end_address="255.255.255.255"/>
<AddressRange id="id3F6D115D" name="old-broadcast" comment="" ro="False" start_address="0.0.0.0" end_address="0.0.0.0"/>
</ObjectGroup>
</ObjectGroup>
<ServiceGroup id="stdid05" name="Services" comment="" ro="False">
<CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
<CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
</CustomService>
<CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
<CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
</CustomService>
<ServiceGroup id="stdid10" name="Groups" comment="" ro="False">
<ServiceGroup id="sg-DHCP" name="DHCP" comment="" ro="False">
<ServiceRef ref="udp-bootpc"/>
<ServiceRef ref="udp-bootps"/>
</ServiceGroup>
<ServiceGroup id="id3F530CC8" name="DNS" comment="" ro="False">
<ServiceRef ref="udp-DNS"/>
<ServiceRef ref="tcp-DNS"/>
</ServiceGroup>
<ServiceGroup id="id3CB1279B" name="IPSEC" comment="" ro="False">
<ServiceRef ref="id3CB12797"/>
<ServiceRef ref="ip-IPSEC"/>
</ServiceGroup>
<ServiceGroup id="sg-NETBIOS" name="NETBIOS" comment="" ro="False">
<ServiceRef ref="udp-netbios-dgm"/>
<ServiceRef ref="udp-netbios-ns"/>
<ServiceRef ref="id3E755609"/>
</ServiceGroup>
<ServiceGroup id="id3CB131CC" name="PCAnywhere" comment="" ro="False">
<ServiceRef ref="id3CB131CA"/>
<ServiceRef ref="id3CB131C8"/>
</ServiceGroup>
<ServiceGroup id="sg-Useful_ICMP" name="Useful_ICMP" comment="" ro="False">
<ServiceRef ref="icmp-Time_exceeded"/>
<ServiceRef ref="icmp-Time_exceeded_in_transit"/>
<ServiceRef ref="icmp-ping_reply"/>
<ServiceRef ref="icmp-Unreachables"/>
</ServiceGroup>
<ServiceGroup id="id1569X4889" name="Ipv6 unreachable messages" comment="" ro="False">
<ServiceRef ref="idE0D27650"/>
<ServiceRef ref="idCFE27650"/>
<ServiceRef ref="idE0B27650"/>
<ServiceRef ref="id1519Z388"/>
</ServiceGroup>
<ServiceGroup id="id3B4FEDD9" name="kerberos" comment="" ro="False">
<ServiceRef ref="id3B4FEDA5"/>
<ServiceRef ref="id3B4FEDA9"/>
<ServiceRef ref="id3B4FEDA7"/>
<ServiceRef ref="id3B4FEDAB"/>
<ServiceRef ref="id3B4FEDA3"/>
<ServiceRef ref="id3B4FEE21"/>
<ServiceRef ref="id3B4FEE23"/>
<ServiceRef ref="id3E7E3EA2"/>
</ServiceGroup>
<ServiceGroup id="id3B4FF35E" name="nfs" comment="" ro="False">
<ServiceRef ref="id3B4FEE7A"/>
<ServiceRef ref="id3B4FEE78"/>
</ServiceGroup>
<ServiceGroup id="id3B4FEFFA" name="quake" comment="" ro="False">
<ServiceRef ref="id3B4FEF7C"/>
<ServiceRef ref="id3B4FEF7E"/>
</ServiceGroup>
<ServiceGroup id="id3D703C9A" name="Real Player" comment="" ro="False">
<ServiceRef ref="id3D703C99"/>
<ServiceRef ref="id3D703C8B"/>
</ServiceGroup>
<ServiceGroup id="id3E7E3E95" name="WinNT" comment="" ro="False">
<ServiceRef ref="sg-NETBIOS"/>
<ServiceRef ref="id3DC8C8BB"/>
<ServiceRef ref="id3E7E3D58"/>
</ServiceGroup>
<ServiceGroup id="id3E7E3E9A" name="Win2000" comment="" ro="False">
<ServiceRef ref="id3E7E3E95"/>
<ServiceRef ref="udp-DNS"/>
<ServiceRef ref="id3DC8C8BC"/>
<ServiceRef ref="id3E7E3EA2"/>
<ServiceRef ref="id3AECF778"/>
<ServiceRef ref="id3D703C90"/>
<ServiceRef ref="id3E7E4039"/>
<ServiceRef ref="id3E7E403A"/>
<ServiceRef ref="id3B4FEDA5"/>
<ServiceRef ref="tcp-DNS"/>
</ServiceGroup>
<ServiceGroup id="id41291786" name="UPnP" comment="" ro="False">
<ServiceRef ref="id41291784"/>
<ServiceRef ref="id41291785"/>
<ServiceRef ref="id41291783"/>
<ServiceRef ref="id412Z18A9"/>
</ServiceGroup>
</ServiceGroup>
<ServiceGroup id="stdid07" name="ICMP" comment="" ro="False">
<ICMPService id="icmp-Unreachables" code="-1" type="3" name="all ICMP unreachables" comment="" ro="False"/>
<ICMPService id="id3C20EEB5" code="-1" type="-1" name="any ICMP" comment="" ro="False"/>
<ICMPService id="icmp-Host_unreach" code="1" type="3" name="host_unreach" comment="" ro="False"/>
<ICMPService id="icmp-ping_reply" code="0" type="0" name="ping reply" comment="" ro="False"/>
<ICMPService id="icmp-ping_request" code="0" type="8" name="ping request" comment="" ro="False"/>
<ICMPService id="icmp-Port_unreach" code="3" type="3" name="port unreach" comment="Port unreachable" ro="False"/>
<ICMPService id="icmp-Time_exceeded" code="0" type="11" name="time exceeded" comment="ICMP messages of this type are needed for traceroute" ro="False"/>
<ICMPService id="icmp-Time_exceeded_in_transit" code="1" type="11" name="time exceeded in transit" comment="" ro="False"/>
<ICMP6Service id="ipv6-icmp-ping_request" code="0" type="128" name="ipv6 ping request" comment="IPv6 ping request" ro="False"/>
<ICMP6Service id="ipv6-icmp-ping_reply" code="0" type="129" name="ipv6 ping reply" comment="IPv6 ping reply" ro="False"/>
<ICMP6Service id="ipv6-icmp-routersol" code="0" type="133" name="ipv6 routersol" comment="IPv6 router solicitation" ro="False"/>
<ICMP6Service id="ipv6-icmp-routeradv" code="0" type="134" name="ipv6 routeradv" comment="IPv6 router advertisement" ro="False"/>
<ICMP6Service id="ipv6-icmp-neighbrsol" code="0" type="135" name="ipv6 neighbrsol" comment="IPv6 neighbor solicitation" ro="False"/>
<ICMP6Service id="ipv6-icmp-neighbradv" code="0" type="136" name="ipv6 neighbradv" comment="IPv6 neighbor advertisement" ro="False"/>
<ICMP6Service id="ipv6-icmp-redir" code="0" type="137" name="ipv6 redir" comment="IPv6 redirect: shorter route exists" ro="False"/>
<ICMP6Service id="id1519Z388" code="-1" type="4" name="ipv6 parameter problem" comment="IPv6 Parameter Problem: RFC4443" ro="False"/>
<ICMP6Service id="idCFE27650" code="0" type="3" name="ipv6 time exceeded" comment="Time exceeded in transit" ro="False"/>
<ICMP6Service id="idCFF27650" code="1" type="3" name="ipv6 time exceeded in reassembly" comment="Time exceeded in reassembly" ro="False"/>
<ICMP6Service id="idE0B27650" code="-1" type="2" name="ipv6 packet too big" comment="" ro="False"/>
<ICMP6Service id="idE0D27650" code="-1" type="1" name="ipv6 all dest unreachable" comment="All icmpv6 codes for type &quot;destination unreachable&quot;&#10;" ro="False"/>
<ICMP6Service id="idCFE27660" code="-1" type="-1" name="ipv6 any ICMP6" comment="any ICMPv6" ro="False"/>
</ServiceGroup>
<ServiceGroup id="stdid06" name="IP" comment="" ro="False">
<IPService id="id3CB12797" fragm="False" lsrr="False" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False" name="AH" comment="IPSEC Authentication Header Protocol" ro="False"/>
<IPService id="ip-IPSEC" fragm="False" lsrr="False" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False" name="ESP" comment="IPSEC Encapsulating Security Payload Protocol" ro="False"/>
<IPService id="ip-RR" fragm="False" lsrr="False" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False" name="RR" comment="Route recording packets" ro="False"/>
<IPService id="ip-SRR" fragm="False" lsrr="True" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False" name="SRR" comment="All sorts of Source Routing Packets" ro="False"/>
<IPService id="ip-IP_Fragments" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False" name="ip_fragments" comment="'Short' fragments" ro="False"/>
<IPService id="id3D703C8E" fragm="False" lsrr="False" protocol_num="57" rr="False" short_fragm="False" ssrr="False" ts="False" name="SKIP" comment="IPSEC Simple Key Management for Internet Protocols" ro="False"/>
<IPService id="id3D703C8F" fragm="False" lsrr="False" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False" name="GRE" comment="Generic Routing Encapsulation&#10;" ro="False"/>
<IPService id="id3D703C95" fragm="False" lsrr="False" protocol_num="112" rr="False" short_fragm="False" ssrr="False" ts="False" name="vrrp" comment="Virtual Router Redundancy Protocol" ro="False"/>
<IPService id="ip-IGMP" fragm="False" lsrr="False" protocol_num="2" rr="False" rtralt="True" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="IGMP" comment="Internet Group Management Protocol, Version 3, RFC 3376" ro="False"/>
<IPService id="ip-PIM" fragm="False" lsrr="False" protocol_num="103" rr="False" rtralt="False" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="PIM" comment="Protocol Independent Multicast - Dense Mode (PIM-DM), RFC 3973, or Protocol Independent Multicast-Sparse Mode (PIM-SM) RFC 2362" ro="False"/>
</ServiceGroup>
<ServiceGroup id="stdid09" name="TCP" comment="" ro="False">
<TCPService id="tcp-ALL_TCP_Masqueraded" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ALL TCP Masqueraded" comment="ipchains used to use this range of port numbers for masquerading. " ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id3D703C94" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="AOL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5190" dst_range_end="5190"/>
<TCPService id="tcp-All_TCP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id3CB131C4" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Citrix-ICA" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1494" dst_range_end="1494"/>
<TCPService id="id3D703C91" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-Admin" comment="Entrust CA Administration Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="709" dst_range_end="709"/>
<TCPService id="id3D703C92" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-KeyMgmt" comment="Entrust CA Key Management Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="710" dst_range_end="710"/>
<TCPService id="id3AEDBEAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="H323" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1720" dst_range_end="1720"/>
<TCPService id="id412Z18A9" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="icslap" comment="Sometimes this protocol is called icslap, but Microsoft does not call it that and just says that DSPP uses port 2869 in Windows XP SP2" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2869" dst_range_end="2869"/>
<TCPService id="id3E7E4039" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3268" dst_range_end="3268"/>
<TCPService id="id3E7E403A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC SSL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3269" dst_range_end="3269"/>
<TCPService id="id3D703C83" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="OpenWindows" comment="Open Windows" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2000" dst_range_end="2000"/>
<TCPService id="id3CB131C8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="PCAnywhere-data" comment="data channel for PCAnywhere v7.52 and later " ro="False" src_range_start="0" src_range_end="0" dst_range_start="5631" dst_range_end="5631"/>
<TCPService id="id3D703C8B" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Real-Audio" comment="RealNetworks PNA Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7070" dst_range_end="7070"/>
<TCPService id="id3D703C93" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="RealSecure" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2998" dst_range_end="2998"/>
<TCPService id="id3DC8C8BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="SMB" comment="SMB over TCP (without NETBIOS)&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="445" dst_range_end="445"/>
<TCPService id="id3D703C8D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TACACSplus" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="49" dst_range_end="49"/>
<TCPService id="id3D703C84" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TCP high ports" comment="TCP high ports" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
<TCPService id="id3E7E3D58" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="WINS replication" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="42" dst_range_end="42"/>
<TCPService id="id3D703C82" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="X11" comment="X Window System" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6000" dst_range_end="6063"/>
<TCPService id="tcp-Auth" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="auth" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="113" dst_range_end="113"/>
<TCPService id="id3AEDBE6E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
<TCPService id="tcp-DNS" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
<TCPService id="id3B4FEDA3" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="eklogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2105" dst_range_end="2105"/>
<TCPService id="id3AECF774" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="finger" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="79" dst_range_end="79"/>
<TCPService id="tcp-FTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="21" dst_range_end="21"/>
<TCPService id="tcp-FTP_data" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data" comment="FTP data channel.&#10; Note: FTP protocol does not really require server to use source port 20 for the data channel, &#10; but many ftp server implementations do so." ro="False" src_range_start="20" src_range_end="20" dst_range_start="1024" dst_range_end="65535"/>
<TCPService id="id3E7553BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data passive" comment="FTP data channel for passive mode transfers&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="20" dst_range_end="20"/>
<TCPService id="tcp-HTTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="http" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
<TCPService id="id3B4FED69" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="https" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="443" dst_range_end="443"/>
<TCPService id="id3AECF776" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="143" dst_range_end="143"/>
<TCPService id="id3B4FED9F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imaps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="993" dst_range_end="993"/>
<TCPService id="id3B4FF13C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="irc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
<TCPService id="id3E7E3EA2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
<TCPService id="id3B4FEE21" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="klogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="543" dst_range_end="543"/>
<TCPService id="id3B4FEE23" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ksh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="544" dst_range_end="544"/>
<TCPService id="id3AECF778" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="389" dst_range_end="389"/>
<TCPService id="id3D703C90" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldaps" comment="Lightweight Directory Access Protocol over TLS/SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="636" dst_range_end="636"/>
<TCPService id="id3B4FF000" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="linuxconf" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="98" dst_range_end="98"/>
<TCPService id="id3D703C97" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="lpr" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
<TCPService id="id3DC8C8BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
<TCPService id="id3D703C98" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ms-sql" comment="Microsoft SQL Server" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1433" dst_range_end="1433"/>
<TCPService id="id3B4FEEEE" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="mysql" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3306" dst_range_end="3306"/>
<TCPService id="id3E755609" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
<TCPService id="id3B4FEE7A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
<TCPService id="tcp-NNTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="119" dst_range_end="119"/>
<TCPService id="id3E7553BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntps" comment="NNTP over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="563" dst_range_end="563"/>
<TCPService id="id3B4FEE1D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="110" dst_range_end="110"/>
<TCPService id="id3E7553BA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3s" comment="POP-3 over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="995" dst_range_end="995"/>
<TCPService id="id3B4FF0EA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="postgres" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5432" dst_range_end="5432"/>
<TCPService id="id3AECF782" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="printer" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
<TCPService id="id3B4FEF7C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
<TCPService id="id3AECF77A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rexec" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="512" dst_range_end="512"/>
<TCPService id="id3AECF77C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rlogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
<TCPService id="id3AECF77E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rshell" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
<TCPService id="id3D703C99" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtsp" comment="Real Time Streaming Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="554" dst_range_end="554"/>
<TCPService id="id3B4FEF34" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rwhois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4321" dst_range_end="4321"/>
<TCPService id="id3D703C89" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="securidprop" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5510" dst_range_end="5510"/>
<TCPService id="tcp-SMTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
<TCPService id="id3B4FF04C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="465" dst_range_end="465"/>
<TCPService id="id3B4FEE76" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="socks" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
<TCPService id="id3D703C87" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sqlnet1" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1521" dst_range_end="1521"/>
<TCPService id="id3B4FF09A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="squid" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
<TCPService id="tcp-SSH" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ssh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
<TCPService id="id3AEDBE00" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
<TCPService id="tcp-TCP-SYN" ack_flag="False" ack_flag_mask="True" fin_flag="False" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" name="tcp-syn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="tcp-Telnet" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="telnet" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="23" dst_range_end="23"/>
<TCPService id="tcp-uucp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="uucp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="540" dst_range_end="540"/>
<TCPService id="id3CB131C6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="winterm" comment="Windows Terminal Services" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3389" dst_range_end="3389"/>
<TCPService id="id3B4FF1B8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7100" dst_range_end="7100"/>
<TCPService id="id3C685B2B" ack_flag="True" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan - full" comment="This service object matches TCP packet with all six flags set." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id4127E949" ack_flag="False" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="False" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan" comment="This service object matches TCP packet with flags FIN, PSH and URG set and other flags cleared. This is a &quot;christmas scan&quot; as defined in snort rules. Nmap can generate this scan, too." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id4127EA72" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
<TCPService id="id4127EBAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="distcc" comment="distributed compiler" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3632" dst_range_end="3632"/>
<TCPService id="id4127ECF1" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvspserver" comment="CVS client/server operations" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2401" dst_range_end="2401"/>
<TCPService id="id4127ECF2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvsup" comment="CVSup file transfer/John Polstra/FreeBSD" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5999" dst_range_end="5999"/>
<TCPService id="id4127ED5E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="afp" comment="AFP (Apple file sharing) over TCP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="548" dst_range_end="548"/>
<TCPService id="id4127EDF6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="whois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="43" dst_range_end="43"/>
<TCPService id="id4127F04F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="bgp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="179" dst_range_end="179"/>
<TCPService id="id4127F146" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius" comment="Radius protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1812" dst_range_end="1812"/>
<TCPService id="id4127F147" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius acct" comment="Radius Accounting" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1813" dst_range_end="1813"/>
<TCPService id="id41291784" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5000" dst_range_end="5000"/>
<TCPService id="id41291785" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp-5431" comment="Although UPnP specification say it should use TCP port 5000, Linksys running Sveasoft firmware listens on port 5431" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5431" dst_range_end="5431"/>
<TCPService id="id41291787" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-0" comment="Java VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5800" dst_range_end="5800"/>
<TCPService id="id41291788" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-0" comment="Regular VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5900" dst_range_end="5900"/>
<TCPService id="id41291887" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-1" comment="Java VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5801" dst_range_end="5801"/>
<TCPService id="id41291888" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-1" comment="Regular VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5901" dst_range_end="5901"/>
<TCPService id="id463FE5FE11008" ack_flag="False" ack_flag_mask="False" established="True" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP established" comment="Some firewall platforms can match TCP packets with flags ACK or RST set; the option is usually called &quot;established&quot;.&#10;&#10;Note that you can use this object only in the policy rules of the firewall that supports this option.&#10;&#10;If you need to match reply packets for a specific TCP service and wish to use option &quot;established&quot;, make a copy of this object and set source port range to match the service.&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id1577X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtmp" comment="Real Time Messaging Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1935" dst_range_end="1935"/>
<TCPService id="id1590X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5222" dst_range_end="5222"/>
<TCPService id="id1609X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5269" dst_range_end="5269"/>
<TCPService id="id1622X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client-ssl" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5223" dst_range_end="5223"/>
<TCPService id="id1631X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server-ssl" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5270" dst_range_end="5270"/>
<TCPService id="id1644X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nrpe" comment="NRPE add-on for Nagios http://www.nagios.org/&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5666" dst_range_end="5666"/>
</ServiceGroup>
<ServiceGroup id="stdid08" name="UDP" comment="" ro="False">
<UDPService id="udp-ALL_UDP_Masqueraded" name="ALL UDP Masqueraded" comment="ipchains used to use this port range for masqueraded packets" ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
<UDPService id="udp-All_UDP" name="All UDP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<UDPService id="id3D703C96" name="ICQ" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4000" dst_range_end="4000"/>
<UDPService id="id3CB129D2" name="IKE" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="500" dst_range_end="500"/>
<UDPService id="id3CB131CA" name="PCAnywhere-status" comment="status channel for PCAnywhere v7.52 and later" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5632" dst_range_end="5632"/>
<UDPService id="id3AED0D6B" name="RIP" comment="routing protocol RIP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="520" dst_range_end="520"/>
<UDPService id="id3D703C8C" name="Radius" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1645" dst_range_end="1645"/>
<UDPService id="id3D703C85" name="UDP high ports" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
<UDPService id="id3D703C86" name="Who" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
<UDPService id="id3B4FEDA1" name="afs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7000" dst_range_end="7009"/>
<UDPService id="udp-bootpc" name="bootpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="68" dst_range_end="68"/>
<UDPService id="udp-bootps" name="bootps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="67" dst_range_end="67"/>
<UDPService id="id3AEDBE70" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
<UDPService id="udp-DNS" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
<UDPService id="id3D703C8A" name="interphone" comment="VocalTec Internet Phone" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22555" dst_range_end="22555"/>
<UDPService id="id3B4FEDA5" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
<UDPService id="id3B4FEDA9" name="kerberos-adm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="749" dst_range_end="750"/>
<UDPService id="id3B4FEDA7" name="kpasswd" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="464" dst_range_end="464"/>
<UDPService id="id3B4FEDAB" name="krb524" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4444" dst_range_end="4444"/>
<UDPService id="id3F865B0D" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
<UDPService id="udp-netbios-dgm" name="netbios-dgm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="138" dst_range_end="138"/>
<UDPService id="udp-netbios-ns" name="netbios-ns" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="137" dst_range_end="137"/>
<UDPService id="udp-netbios-ssn" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
<UDPService id="id3B4FEE78" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
<UDPService id="udp-ntp" name="ntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="123" dst_range_end="123"/>
<UDPService id="id3B4FEF7E" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
<UDPService id="id3D703C88" name="secureid-udp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="1024"/>
<UDPService id="udp-SNMP" name="snmp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="161" dst_range_end="161"/>
<UDPService id="id3AED0D69" name="snmp-trap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="162" dst_range_end="162"/>
<UDPService id="id3AEDBE19" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
<UDPService id="id3AECF780" name="syslog" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
<UDPService id="id3AED0D67" name="tftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="69" dst_range_end="69"/>
<UDPService id="id3AED0D8C" name="traceroute" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="33434" dst_range_end="33524"/>
<UDPService id="id4127EA73" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
<UDPService id="id41291783" name="SSDP" comment="Simple Service Discovery Protocol (used for UPnP)" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1900" dst_range_end="1900"/>
<UDPService id="id41291883" name="OpenVPN" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1194" dst_range_end="1194"/>
</ServiceGroup>
<ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
<CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
</ServiceGroup>
<ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
<ServiceGroup id="stdid20" name="UserServices" comment="" ro="False"/>
</ServiceGroup>
<ObjectGroup id="stdid12" name="Firewalls" comment="" ro="False"/>
<ObjectGroup id="stdid21" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="stdid11" name="Time" comment="" ro="False">
<Interval id="int-workhours" days_of_week="1,2,3,4,5" from_day="-1" from_hour="9" from_minute="0" from_month="-1" from_weekday="1" from_year="-1" to_day="-1" to_hour="17" to_minute="0" to_month="-1" to_weekday="5" to_year="-1" name="workhours" comment="any day, 9:00am through 5:00pm" ro="False"/>
<Interval id="int-weekends" days_of_week="6,0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="weekends" comment="weekends: Saturday 0:00 through Sunday 23:59 " ro="False"/>
<Interval id="int-afterhours" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1" name="afterhours" comment="any day 6:00pm - 12:00am" ro="False"/>
<Interval id="id3C63479C" days_of_week="6" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1" name="Sat" comment="" ro="False"/>
<Interval id="id3C63479E" days_of_week="0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="Sun" comment="" ro="False"/>
</IntervalGroup>
</Library>
<Library id="sysid99" name="Deleted Objects" comment="" ro="False"/>
<Library id="id0" name="User" comment="" ro="False">
<ObjectGroup id="id1" name="Objects" comment="" ro="False">
<ObjectGroup id="id2" name="Addresses" comment="" ro="False">
<IPv4 id="id3" name="h-192.168.1.1" comment="Created during import of line 9" ro="False" address="192.168.1.1" netmask="255.255.255.255"/>
<IPv4 id="id4" name="h-192.168.1.2" comment="Created during import of line 9" ro="False" address="192.168.1.2" netmask="255.255.255.255"/>
</ObjectGroup>
<ObjectGroup id="id5" name="DNS Names" comment="" ro="False">
<DNSName id="id6" dnsrec="www.fwbuilder.org" dnsrectype="A" run_time="True" name="www.fwbuilder.org" comment="" ro="False"/>
<DNSName id="id7" dnsrec="www.netcitadel.com" dnsrectype="A" run_time="True" name="www.netcitadel.com" comment="" ro="False"/>
</ObjectGroup>
<ObjectGroup id="id8" name="Address Tables" comment="" ro="False">
<AddressTable id="id9" filename="" run_time="True" name="mike" comment="" ro="False"/>
<AddressTable id="id10" filename="" run_time="True" name="BLOCKTEMP" comment="" ro="False"/>
<AddressTable id="id11" filename="&quot;./pf_block_permanent&quot;" run_time="True" name="BLOCKPERM" comment="" ro="False"/>
<AddressTable id="id12" filename="&quot;./pf_table&quot;" run_time="True" name="BLOCK" comment="" ro="False"/>
<AddressTable id="id13" filename="" run_time="True" name="spamd-white" comment="" ro="False"/>
</ObjectGroup>
<ObjectGroup id="id14" name="Groups" comment="" ro="False">
<ObjectGroup id="id15" name="private" comment="Created during import of line 7" ro="False">
<ObjectRef ref="id34"/>
<ObjectRef ref="id35"/>
<ObjectRef ref="id36"/>
</ObjectGroup>
<ObjectGroup id="id19" name="dst_addresses_1" comment="Created during import of line 9" ro="False">
<ObjectRef ref="id3"/>
<ObjectRef ref="id4"/>
<ObjectRef ref="id37"/>
</ObjectGroup>
<ObjectGroup id="id23" name="dst_addresses_2" comment="Created during import of line 10" ro="False">
<ObjectRef ref="id57"/>
<ObjectRef ref="id58"/>
</ObjectGroup>
<ObjectGroup id="id26" name="dst_addresses_3" comment="Created during import of line 11" ro="False">
<ObjectRef ref="id57"/>
<ObjectRef ref="id57"/>
</ObjectGroup>
<ObjectGroup id="id29" name="dst_addresses_4" comment="Created during import of line 12" ro="False">
<ObjectRef ref="id6"/>
<ObjectRef ref="id7"/>
</ObjectGroup>
</ObjectGroup>
<ObjectGroup id="id32" name="Hosts" comment="" ro="False"/>
<ObjectGroup id="id33" name="Networks" comment="" ro="False">
<Network id="id34" name="net-10/255.0.0.0" comment="Created during import of line 7" ro="False" address="255.192.0.0" netmask="255.0.0.0"/>
<Network id="id35" name="net-172.16/255.240.0.0" comment="Created during import of line 7" ro="False" address="172.16.0.0" netmask="255.240.0.0"/>
<Network id="id36" name="net-192.168/255.255.0.0" comment="Created during import of line 7" ro="False" address="192.168.0.0" netmask="255.255.0.0"/>
<Network id="id37" name="net-192.168.2.0/255.255.255.0" comment="Created during import of line 9" ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
</ObjectGroup>
<ObjectGroup id="id38" name="Address Ranges" comment="" ro="False"/>
</ObjectGroup>
<ServiceGroup id="id39" name="Services" comment="" ro="False">
<ServiceGroup id="id40" name="Groups" comment="" ro="False"/>
<ServiceGroup id="id41" name="ICMP" comment="" ro="False"/>
<ServiceGroup id="id42" name="IP" comment="" ro="False"/>
<ServiceGroup id="id43" name="TCP" comment="" ro="False"/>
<ServiceGroup id="id44" name="UDP" comment="" ro="False"/>
<ServiceGroup id="id45" name="Users" comment="" ro="False"/>
<ServiceGroup id="id46" name="Custom" comment="" ro="False"/>
<ServiceGroup id="id47" name="TagServices" comment="" ro="False"/>
</ServiceGroup>
<ObjectGroup id="id48" name="Firewalls" comment="" ro="False">
<Firewall id="id49" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of line 10" ro="False">
<NAT id="id53" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</NAT>
<Policy id="id51" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</Policy>
<Routing id="id55" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</Routing>
<Interface id="id57" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="pcn0" comment="Created during import of line 10" ro="False">
<InterfaceOptions/>
<AttachedNetworks id="id58" name="pcn0-net" comment="" ro="False"/>
</Interface>
<FirewallOptions>
<Option name="check_shading">true</Option>
<Option name="configure_interfaces">true</Option>
<Option name="firewall_dir">/etc</Option>
<Option name="freebsd_ip_forward">1</Option>
<Option name="in_out_code">true</Option>
<Option name="log_prefix">RULE %N -- %A </Option>
<Option name="loopback_interface">lo0</Option>
<Option name="manage_virtual_addr">true</Option>
<Option name="pass_all_out">false</Option>
<Option name="pf_limit_frags">5000</Option>
<Option name="pf_limit_states">10000</Option>
<Option name="pf_scrub_maxmss">1460</Option>
<Option name="pf_timeout_frag">30</Option>
<Option name="pf_timeout_interval">10</Option>
</FirewallOptions>
</Firewall>
</ObjectGroup>
<ObjectGroup id="id60" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="id61" name="Time" comment="" ro="False"/>
</Library>
</FWObjectDatabase>

13
src/unit_tests/PFImporterTest/test_data/pf-tables.output Normal file
View File

@ -0,0 +1,13 @@
2: Address Table: <mike> file
3: Address Table: <BLOCKTEMP> file
4: Address Table: <BLOCKPERM> file "./pf_block_permanent"
5: Address Table: <BLOCK> file "./pf_table"
6: Address Table: <spamd-white> file
7: Address Table: <private>: 10/8, 172.16/12, 192.168/16
9: Address Table: <dst_addresses_1>: 192.168.1.1/, 192.168.1.2/, 192.168.2.0/24
10: New interface: pcn0
10: Address Table: <dst_addresses_2>: pcn0/, pcn0/
11: Address Table: <dst_addresses_3>: pcn0/, pcn0/
12: Address Table: <dst_addresses_4>: www.fwbuilder.org/, www.netcitadel.com/
Could not find enough information in the data file to create any firewall rules.