bug 1812388: add srcip,dstip to choices for hashlimit mode

doc/ChangeLog

@@ -1,3 +1,10 @@
+2008-07-05  Vadim Kurland  <vadim@vk.crocodile.org>
+
+	* PolicyCompiler_PrintRule.cpp (PrintRule::_printModules):
+	Implemented support for combinations of srcip, dstip, srcport,
+	dstport options of the hashlimit module for iptables per bug
+	#1812388: "add srcip,dstip to choices for hashlimit mode"
+
 2008-07-03  Vadim Kurland  <vadim@vk.crocodile.org>
 
 	* fwbuilder.1: updated man page for fwbuilder GUI.

src/gui/RuleOptionsDialog.cpp

@@ -134,10 +134,10 @@ void RuleOptionsDialog::loadFWObject(FWObject *o)
         data.registerOption( m_dialog->ipt_hashlimit            , ropt,  "hashlimit_value" );
         data.registerOption( m_dialog->ipt_hashlimit_suffix     , ropt,  "hashlimit_suffix" );
         data.registerOption( m_dialog->ipt_hashlimit_burst      , ropt,  "hashlimit_burst" );
-        data.registerOption( m_dialog->cb_srcip                 , ropt,  "ipt_hashlimit_mode_srcip" );
+        data.registerOption( m_dialog->cb_srcip                 , ropt,  "hashlimit_mode_srcip" );
-        data.registerOption( m_dialog->cb_dstip                 , ropt,  "ipt_hashlimit_mode_dstip" );
+        data.registerOption( m_dialog->cb_dstip                 , ropt,  "hashlimit_mode_dstip" );
-        data.registerOption( m_dialog->cb_srcport               , ropt,  "ipt_hashlimit_mode_srcport" );
+        data.registerOption( m_dialog->cb_srcport               , ropt,  "hashlimit_mode_srcport" );
-        data.registerOption( m_dialog->cb_dstport               , ropt,  "ipt_hashlimit_mode_dstport" );
+        data.registerOption( m_dialog->cb_dstport               , ropt,  "hashlimit_mode_dstport" );
         data.registerOption( m_dialog->ipt_hashlimit_dstlimit   , ropt,  "hashlimit_dstlimit");
         data.registerOption( m_dialog->ipt_hashlimit_name       , ropt,  "hashlimit_name");
         data.registerOption( m_dialog->ipt_hashlimit_size       , ropt,  "hashlimit_size");

src/ipt/PolicyCompiler_PrintRule.cpp

@@ -234,8 +234,38 @@ string PolicyCompiler_ipt::PrintRule::_printModules(PolicyRule *rule)
         int lb=ruleopt->getInt("hashlimit_burst");
         if (lb>0) ostr << " --" << module_name << "-burst " << lb;
 
-        ls=ruleopt->getStr("hashlimit_mode");
+        ls = ruleopt->getStr("hashlimit_mode");
-        if (!ls.empty()) ostr << " --" << module_name << "-mode " << ls;
+        if (ls.empty())
+        {
+            /* syntax "--hashlimit-mode srcip,srcport " (i.e. with options
+               separated by commas) tested with iptables 1.3.6
+            */
+            list<string> opts;
+            string sopts;
+            bool f;
+
+            f = ruleopt->getBool("hashlimit_mode_srcip");
+            if (f) opts.push_back("srcip");
+
+            f = ruleopt->getBool("hashlimit_mode_dstip");
+            if (f) opts.push_back("dstip");
+
+            f = ruleopt->getBool("hashlimit_mode_srcport");
+            if (f) opts.push_back("srcport");
+
+            f = ruleopt->getBool("hashlimit_mode_dstport");
+            if (f) opts.push_back("dstport");
+
+            for_each(opts.begin(), opts.end(), join(&sopts, ","));
+            if (!sopts.empty())
+                ostr << " --" << module_name << "-mode " << sopts;
+        } else 
+            // hashlimit_mode is v2.1 option. In v3 we have options
+            // hashlimit_mode_srcip
+            // hashlimit_mode_dstip
+            // hashlimit_mode_srcport
+            // hashlimit_mode_dstport
+            ostr << " --" << module_name << "-mode " << ls;
 
         string hl_name = ruleopt->getStr("hashlimit_name");
         if (hl_name.empty())

src/ipt/PolicyCompiler_ipt.cpp

@@ -96,6 +96,12 @@ const std::list<std::string>& PolicyCompiler_ipt::getStandardChains()
     return standard_chains;
 }
 
+void join::operator()(std::string &s)
+{
+    if (!result->empty()) *result += separator;
+    *result += s;
+}
+
 string PolicyCompiler_ipt::myPlatformName() { return "iptables"; }
 
 string PolicyCompiler_ipt::getInterfaceVarName(FWObject *iface)

src/ipt/PolicyCompiler_ipt.h

@@ -49,6 +49,17 @@ namespace libfwbuilder {
 #define TCP_SYN_OBJ_ID   "__tcp_syn_obj__"
 #define BCAST_255_OBJ_ID "__bcast_255_obj__"
 
+// a functor to join list<string> into a string with separator sep
+class join : public std::unary_function<std::string, void>
+{
+    std::string *result;
+    std::string  separator;
+public:
+    join(std::string *res, const std::string &s)
+    { result = res; separator = s; }
+    void operator()(std::string &s);
+};
+    
 
 namespace fwcompiler {
 

test/ipt/objects-for-regression-tests.fwb

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1215124221" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1215290981" id="root">
   <Library id="sysid99" name="Deleted Objects" ro="False">
     <ICMP6Service id="idE0C27650" name="ipv6 dest unreachable" comment="No route to destination" code="0" type="1"/>
     <IPv4 id="id41D295E2" name="firewall30:ppp.200*:ip" address="192.168.1.1" netmask="255.255.255.0"/>
@@ -3352,7 +3352,7 @@
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3AF5AA0A" name="firewall1" comment="this object is used to test all kinds of negation in policy and NAT rules" host_OS="linux24" inactive="False" lastCompiled="1210000488" lastInstalled="1142003872" lastModified="1210000492" platform="iptables" ro="False" version="">
+      <Firewall id="id3AF5AA0A" name="firewall1" comment="this object is used to test all kinds of negation in policy and NAT rules" host_OS="linux24" inactive="False" lastCompiled="1210000488" lastInstalled="1142003872" lastModified="1215290981" platform="iptables" ro="False" version="">
         <NAT id="id3AF5AA0D" name="NAT">
           <NATRule id="id3C98491C" disabled="False" position="0">
             <OSrc neg="False">
@@ -3780,7 +3780,29 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="connlimit_masklen">0</Option>
+              <Option name="connlimit_value">0</Option>
+              <Option name="firewall_is_part_of_any_and_networks">False</Option>
+              <Option name="hashlimit_burst">2</Option>
+              <Option name="hashlimit_dstlimit">False</Option>
+              <Option name="hashlimit_expire">0</Option>
+              <Option name="hashlimit_gcinterval">0</Option>
+              <Option name="hashlimit_max">0</Option>
+              <Option name="hashlimit_mode_dstip">False</Option>
+              <Option name="hashlimit_mode_dstport">False</Option>
+              <Option name="hashlimit_mode_srcip">True</Option>
+              <Option name="hashlimit_mode_srcport">True</Option>
+              <Option name="hashlimit_name"></Option>
+              <Option name="hashlimit_size">0</Option>
+              <Option name="hashlimit_suffix">/hour</Option>
+              <Option name="hashlimit_value">1</Option>
+              <Option name="limit_burst">0</Option>
+              <Option name="limit_suffix"></Option>
+              <Option name="limit_value">0</Option>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
+              <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CD34BEF" action="Deny" direction="Both" disabled="False" log="False" position="1">
@@ -3800,7 +3822,29 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="connlimit_masklen">0</Option>
+              <Option name="connlimit_value">0</Option>
+              <Option name="firewall_is_part_of_any_and_networks">False</Option>
+              <Option name="hashlimit_burst">2</Option>
+              <Option name="hashlimit_dstlimit">False</Option>
+              <Option name="hashlimit_expire">0</Option>
+              <Option name="hashlimit_gcinterval">0</Option>
+              <Option name="hashlimit_max">0</Option>
+              <Option name="hashlimit_mode_dstip">True</Option>
+              <Option name="hashlimit_mode_dstport">True</Option>
+              <Option name="hashlimit_mode_srcip">False</Option>
+              <Option name="hashlimit_mode_srcport">False</Option>
+              <Option name="hashlimit_name"></Option>
+              <Option name="hashlimit_size">0</Option>
+              <Option name="hashlimit_suffix">/hour</Option>
+              <Option name="hashlimit_value">1</Option>
+              <Option name="limit_burst">0</Option>
+              <Option name="limit_suffix"></Option>
+              <Option name="limit_value">0</Option>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
+              <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AF5AAB4" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="2">