From 37dda74afaf15881b703cb5d9efcadf3306487d4 Mon Sep 17 00:00:00 2001 From: Vadim Kurland Date: Sat, 5 Jul 2008 21:02:05 +0000 Subject: [PATCH] bug 1812388: add srcip,dstip to choices for hashlimit mode --- doc/ChangeLog | 7 ++++ src/gui/RuleOptionsDialog.cpp | 8 ++-- src/ipt/PolicyCompiler_PrintRule.cpp | 34 +++++++++++++++- src/ipt/PolicyCompiler_ipt.cpp | 6 +++ src/ipt/PolicyCompiler_ipt.h | 11 ++++++ test/ipt/objects-for-regression-tests.fwb | 48 ++++++++++++++++++++++- 6 files changed, 106 insertions(+), 8 deletions(-) diff --git a/doc/ChangeLog b/doc/ChangeLog index b8c12dda9..387e9d95a 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,3 +1,10 @@ +2008-07-05 Vadim Kurland + + * PolicyCompiler_PrintRule.cpp (PrintRule::_printModules): + Implemented support for combinations of srcip, dstip, srcport, + dstport options of the hashlimit module for iptables per bug + #1812388: "add srcip,dstip to choices for hashlimit mode" + 2008-07-03 Vadim Kurland * fwbuilder.1: updated man page for fwbuilder GUI. diff --git a/src/gui/RuleOptionsDialog.cpp b/src/gui/RuleOptionsDialog.cpp index c6f6de8dc..e49c8604a 100644 --- a/src/gui/RuleOptionsDialog.cpp +++ b/src/gui/RuleOptionsDialog.cpp @@ -134,10 +134,10 @@ void RuleOptionsDialog::loadFWObject(FWObject *o) data.registerOption( m_dialog->ipt_hashlimit , ropt, "hashlimit_value" ); data.registerOption( m_dialog->ipt_hashlimit_suffix , ropt, "hashlimit_suffix" ); data.registerOption( m_dialog->ipt_hashlimit_burst , ropt, "hashlimit_burst" ); - data.registerOption( m_dialog->cb_srcip , ropt, "ipt_hashlimit_mode_srcip" ); - data.registerOption( m_dialog->cb_dstip , ropt, "ipt_hashlimit_mode_dstip" ); - data.registerOption( m_dialog->cb_srcport , ropt, "ipt_hashlimit_mode_srcport" ); - data.registerOption( m_dialog->cb_dstport , ropt, "ipt_hashlimit_mode_dstport" ); + data.registerOption( m_dialog->cb_srcip , ropt, "hashlimit_mode_srcip" ); + data.registerOption( m_dialog->cb_dstip , ropt, "hashlimit_mode_dstip" ); + data.registerOption( m_dialog->cb_srcport , ropt, "hashlimit_mode_srcport" ); + data.registerOption( m_dialog->cb_dstport , ropt, "hashlimit_mode_dstport" ); data.registerOption( m_dialog->ipt_hashlimit_dstlimit , ropt, "hashlimit_dstlimit"); data.registerOption( m_dialog->ipt_hashlimit_name , ropt, "hashlimit_name"); data.registerOption( m_dialog->ipt_hashlimit_size , ropt, "hashlimit_size"); diff --git a/src/ipt/PolicyCompiler_PrintRule.cpp b/src/ipt/PolicyCompiler_PrintRule.cpp index e586b9a89..d1297229b 100644 --- a/src/ipt/PolicyCompiler_PrintRule.cpp +++ b/src/ipt/PolicyCompiler_PrintRule.cpp @@ -234,8 +234,38 @@ string PolicyCompiler_ipt::PrintRule::_printModules(PolicyRule *rule) int lb=ruleopt->getInt("hashlimit_burst"); if (lb>0) ostr << " --" << module_name << "-burst " << lb; - ls=ruleopt->getStr("hashlimit_mode"); - if (!ls.empty()) ostr << " --" << module_name << "-mode " << ls; + ls = ruleopt->getStr("hashlimit_mode"); + if (ls.empty()) + { + /* syntax "--hashlimit-mode srcip,srcport " (i.e. with options + separated by commas) tested with iptables 1.3.6 + */ + list opts; + string sopts; + bool f; + + f = ruleopt->getBool("hashlimit_mode_srcip"); + if (f) opts.push_back("srcip"); + + f = ruleopt->getBool("hashlimit_mode_dstip"); + if (f) opts.push_back("dstip"); + + f = ruleopt->getBool("hashlimit_mode_srcport"); + if (f) opts.push_back("srcport"); + + f = ruleopt->getBool("hashlimit_mode_dstport"); + if (f) opts.push_back("dstport"); + + for_each(opts.begin(), opts.end(), join(&sopts, ",")); + if (!sopts.empty()) + ostr << " --" << module_name << "-mode " << sopts; + } else + // hashlimit_mode is v2.1 option. In v3 we have options + // hashlimit_mode_srcip + // hashlimit_mode_dstip + // hashlimit_mode_srcport + // hashlimit_mode_dstport + ostr << " --" << module_name << "-mode " << ls; string hl_name = ruleopt->getStr("hashlimit_name"); if (hl_name.empty()) diff --git a/src/ipt/PolicyCompiler_ipt.cpp b/src/ipt/PolicyCompiler_ipt.cpp index ca4362301..fd9ad1269 100644 --- a/src/ipt/PolicyCompiler_ipt.cpp +++ b/src/ipt/PolicyCompiler_ipt.cpp @@ -96,6 +96,12 @@ const std::list& PolicyCompiler_ipt::getStandardChains() return standard_chains; } +void join::operator()(std::string &s) +{ + if (!result->empty()) *result += separator; + *result += s; +} + string PolicyCompiler_ipt::myPlatformName() { return "iptables"; } string PolicyCompiler_ipt::getInterfaceVarName(FWObject *iface) diff --git a/src/ipt/PolicyCompiler_ipt.h b/src/ipt/PolicyCompiler_ipt.h index 98a3a34b9..d91cbd2e4 100644 --- a/src/ipt/PolicyCompiler_ipt.h +++ b/src/ipt/PolicyCompiler_ipt.h @@ -49,6 +49,17 @@ namespace libfwbuilder { #define TCP_SYN_OBJ_ID "__tcp_syn_obj__" #define BCAST_255_OBJ_ID "__bcast_255_obj__" +// a functor to join list into a string with separator sep +class join : public std::unary_function +{ + std::string *result; + std::string separator; +public: + join(std::string *res, const std::string &s) + { result = res; separator = s; } + void operator()(std::string &s); +}; + namespace fwcompiler { diff --git a/test/ipt/objects-for-regression-tests.fwb b/test/ipt/objects-for-regression-tests.fwb index ac11607b5..b91f73842 100644 --- a/test/ipt/objects-for-regression-tests.fwb +++ b/test/ipt/objects-for-regression-tests.fwb @@ -1,6 +1,6 @@ - + @@ -3352,7 +3352,7 @@ - + @@ -3780,7 +3780,29 @@ + + + + + + + + + + + + + + + + + + + + + + @@ -3800,7 +3822,29 @@ + + + + + + + + + + + + + + + + + + + + + +