onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-11 15:41:41 +02:00
Code Issues Releases Wiki Activity

bug 1812388: add srcip,dstip to choices for hashlimit mode

Browse Source
This commit is contained in:
Vadim Kurland
2008-07-05 21:02:05 +00:00
parent f396b6c7fb
commit 37dda74afa
6 changed files with 106 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/ChangeLog
+7
View File
@@ -1,3 +1,10 @@
2008-07-05 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printModules):
Implemented support for combinations of srcip, dstip, srcport,
dstport options of the hashlimit module for iptables per bug
#1812388: "add srcip,dstip to choices for hashlimit mode"
2008-07-03 Vadim Kurland <vadim@vk.crocodile.org>
* fwbuilder.1: updated man page for fwbuilder GUI.
src/gui/RuleOptionsDialog.cpp
+4 -4
View File
@@ -134,10 +134,10 @@ void RuleOptionsDialog::loadFWObject(FWObject *o)
data.registerOption( m_dialog->ipt_hashlimit , ropt, "hashlimit_value" );
data.registerOption( m_dialog->ipt_hashlimit_suffix , ropt, "hashlimit_suffix" );
data.registerOption( m_dialog->ipt_hashlimit_burst , ropt, "hashlimit_burst" );
data.registerOption( m_dialog->cb_srcip , ropt, "ipt_hashlimit_mode_srcip" );
data.registerOption( m_dialog->cb_dstip , ropt, "ipt_hashlimit_mode_dstip" );
data.registerOption( m_dialog->cb_srcport , ropt, "ipt_hashlimit_mode_srcport" );
data.registerOption( m_dialog->cb_dstport , ropt, "ipt_hashlimit_mode_dstport" );
data.registerOption( m_dialog->cb_srcip , ropt, "hashlimit_mode_srcip" );
data.registerOption( m_dialog->cb_dstip , ropt, "hashlimit_mode_dstip" );
data.registerOption( m_dialog->cb_srcport , ropt, "hashlimit_mode_srcport" );
data.registerOption( m_dialog->cb_dstport , ropt, "hashlimit_mode_dstport" );
data.registerOption( m_dialog->ipt_hashlimit_dstlimit , ropt, "hashlimit_dstlimit");
data.registerOption( m_dialog->ipt_hashlimit_name , ropt, "hashlimit_name");
data.registerOption( m_dialog->ipt_hashlimit_size , ropt, "hashlimit_size");
src/ipt/PolicyCompiler_PrintRule.cpp
+31 -1
View File
@@ -235,7 +235,37 @@ string PolicyCompiler_ipt::PrintRule::_printModules(PolicyRule *rule)
if (lb>0) ostr << " --" << module_name << "-burst " << lb;
ls = ruleopt->getStr("hashlimit_mode");
if (!ls.empty()) ostr << " --" << module_name << "-mode " << ls;
if (ls.empty())
{
/* syntax "--hashlimit-mode srcip,srcport " (i.e. with options
separated by commas) tested with iptables 1.3.6
*/
list<string> opts;
string sopts;
bool f;
f = ruleopt->getBool("hashlimit_mode_srcip");
if (f) opts.push_back("srcip");
f = ruleopt->getBool("hashlimit_mode_dstip");
if (f) opts.push_back("dstip");
f = ruleopt->getBool("hashlimit_mode_srcport");
if (f) opts.push_back("srcport");
f = ruleopt->getBool("hashlimit_mode_dstport");
if (f) opts.push_back("dstport");
for_each(opts.begin(), opts.end(), join(&sopts, ","));
if (!sopts.empty())
ostr << " --" << module_name << "-mode " << sopts;
} else
// hashlimit_mode is v2.1 option. In v3 we have options
// hashlimit_mode_srcip
// hashlimit_mode_dstip
// hashlimit_mode_srcport
// hashlimit_mode_dstport
ostr << " --" << module_name << "-mode " << ls;
string hl_name = ruleopt->getStr("hashlimit_name");
if (hl_name.empty())
src/ipt/PolicyCompiler_ipt.cpp
+6
View File
@@ -96,6 +96,12 @@ const std::list<std::string>& PolicyCompiler_ipt::getStandardChains()
return standard_chains;
}
void join::operator()(std::string &s)
{
if (!result->empty()) *result += separator;
*result += s;
}
string PolicyCompiler_ipt::myPlatformName() { return "iptables"; }
string PolicyCompiler_ipt::getInterfaceVarName(FWObject *iface)
src/ipt/PolicyCompiler_ipt.h
+11
View File
@@ -49,6 +49,17 @@ namespace libfwbuilder {
#define TCP_SYN_OBJ_ID "__tcp_syn_obj__"
#define BCAST_255_OBJ_ID "__bcast_255_obj__"
// a functor to join list<string> into a string with separator sep
class join : public std::unary_function<std::string, void>
{
std::string *result;
std::string separator;
public:
join(std::string *res, const std::string &s)
{ result = res; separator = s; }
void operator()(std::string &s);
};
namespace fwcompiler {
test/ipt/objects-for-regression-tests.fwb
+46 -2
View File
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1215124221" id="root">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1215290981" id="root">
<Library id="sysid99" name="Deleted Objects" ro="False">
<ICMP6Service id="idE0C27650" name="ipv6 dest unreachable" comment="No route to destination" code="0" type="1"/>
<IPv4 id="id41D295E2" name="firewall30:ppp.200*:ip" address="192.168.1.1" netmask="255.255.255.0"/>
@@ -3352,7 +3352,7 @@
<Option name="verify_interfaces">True</Option>
</FirewallOptions>
</Firewall>
<Firewall id="id3AF5AA0A" name="firewall1" comment="this object is used to test all kinds of negation in policy and NAT rules" host_OS="linux24" inactive="False" lastCompiled="1210000488" lastInstalled="1142003872" lastModified="1210000492" platform="iptables" ro="False" version="">
<Firewall id="id3AF5AA0A" name="firewall1" comment="this object is used to test all kinds of negation in policy and NAT rules" host_OS="linux24" inactive="False" lastCompiled="1210000488" lastInstalled="1142003872" lastModified="1215290981" platform="iptables" ro="False" version="">
<NAT id="id3AF5AA0D" name="NAT">
<NATRule id="id3C98491C" disabled="False" position="0">
<OSrc neg="False">
@@ -3780,7 +3780,29 @@
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="connlimit_masklen">0</Option>
<Option name="connlimit_value">0</Option>
<Option name="firewall_is_part_of_any_and_networks">False</Option>
<Option name="hashlimit_burst">2</Option>
<Option name="hashlimit_dstlimit">False</Option>
<Option name="hashlimit_expire">0</Option>
<Option name="hashlimit_gcinterval">0</Option>
<Option name="hashlimit_max">0</Option>
<Option name="hashlimit_mode_dstip">False</Option>
<Option name="hashlimit_mode_dstport">False</Option>
<Option name="hashlimit_mode_srcip">True</Option>
<Option name="hashlimit_mode_srcport">True</Option>
<Option name="hashlimit_name"></Option>
<Option name="hashlimit_size">0</Option>
<Option name="hashlimit_suffix">/hour</Option>
<Option name="hashlimit_value">1</Option>
<Option name="limit_burst">0</Option>
<Option name="limit_suffix"></Option>
<Option name="limit_value">0</Option>
<Option name="log_level"></Option>
<Option name="log_prefix"></Option>
<Option name="stateless">True</Option>
<Option name="ulog_nlgroup">1</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule id="id3CD34BEF" action="Deny" direction="Both" disabled="False" log="False" position="1">
@@ -3800,7 +3822,29 @@
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="connlimit_masklen">0</Option>
<Option name="connlimit_value">0</Option>
<Option name="firewall_is_part_of_any_and_networks">False</Option>
<Option name="hashlimit_burst">2</Option>
<Option name="hashlimit_dstlimit">False</Option>
<Option name="hashlimit_expire">0</Option>
<Option name="hashlimit_gcinterval">0</Option>
<Option name="hashlimit_max">0</Option>
<Option name="hashlimit_mode_dstip">True</Option>
<Option name="hashlimit_mode_dstport">True</Option>
<Option name="hashlimit_mode_srcip">False</Option>
<Option name="hashlimit_mode_srcport">False</Option>
<Option name="hashlimit_name"></Option>
<Option name="hashlimit_size">0</Option>
<Option name="hashlimit_suffix">/hour</Option>
<Option name="hashlimit_value">1</Option>
<Option name="limit_burst">0</Option>
<Option name="limit_suffix"></Option>
<Option name="limit_value">0</Option>
<Option name="log_level"></Option>
<Option name="log_prefix"></Option>
<Option name="stateless">True</Option>
<Option name="ulog_nlgroup">1</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule id="id3AF5AAB4" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="2">