Support for UserService in compiler for iptables

doc/ChangeLog

@@ -1,5 +1,9 @@
 2008-06-05  Vadim Kurland  <vadim@vk.crocodile.org>
 
+	* PolicyCompiler_ipt.cpp (checkUserServiceInWrongChains::processNext): 
+	Support for UserService in compiler for iptables. FR #1948872:
+	"User based rules"
+
 	* IPv4Dialog, NetworkDialog, newHostDialog, newFirewallDialog:
 	netmask can be entered as bit length, in addition to the bit mask
 	format supported before. Both formats are recognized. FR #995452,

src/ipt/PolicyCompiler_PrintRule.cpp

@@ -45,6 +45,7 @@
 #include "fwbuilder/Firewall.h"
 #include "fwbuilder/Resources.h"
 #include "fwbuilder/AddressTable.h"
+#include "fwbuilder/UserService.h"
 
 #include "fwbuilder/Inet6AddrMask.h"
 
@@ -592,7 +593,11 @@ string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv)
     PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
     string version=compiler->fw->getStr("version");
     string s;
-    if (! srv->isAny() && !CustomService::isA(srv)  && !TagService::isA(srv))
+    if (! srv->isAny() &&
+        !CustomService::isA(srv) &&
+        !TagService::isA(srv) &&
+        !UserService::isA(srv)
+    )
     {
         string pn=srv->getProtocolName();
         if (pn=="ip") pn="all";
@@ -858,6 +863,11 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv  *rel)
 	    ostr << "-m mark --mark "
                  << TagService::cast(srv)->getCode() << " ";
         }
+        if (UserService::isA(srv))
+        {
+	    ostr << "-m owner --uid-owner "
+                 << UserService::cast(srv)->getUserId() << " ";
+        }
     } else 
     {
 /* use multiport */

src/ipt/PolicyCompiler_ipt.cpp

@@ -44,6 +44,7 @@
 #include "fwbuilder/Network.h"
 #include "fwbuilder/AddressTable.h"
 #include "fwbuilder/DNSName.h"
+#include "fwbuilder/UserService.h"
 
 #include "combinedAddress.h"
 
@@ -3022,6 +3023,26 @@ bool PolicyCompiler_ipt::checkMACinOUTPUTChain::processNext()
     return true;
 }
 
+bool PolicyCompiler_ipt::checkUserServiceInWrongChains::processNext()
+{
+    PolicyRule *rule=getNext(); if (rule==NULL) return false;
+    Service *srv = compiler->getFirstSrv(rule);  assert(srv);
+    string chain = rule->getStr("ipt_chain");
+    string upstream_chain = rule->getStr("upstream_rule_chain");
+
+    if (UserService::cast(srv) != NULL &&
+        chain != "OUTPUT" &&
+        upstream_chain != "OUTPUT")
+    {
+        compiler->warning("Iptables does not support module 'owner' in a chain "
+                          "other than OUTPUT; Rule " + rule->getLabel());
+        return true;
+    }
+
+    tmp_queue.push_back(rule);
+    return true;
+}
+
 
 bool PolicyCompiler_ipt::separatePortRanges::processNext()
 {
@@ -3655,7 +3676,6 @@ void PolicyCompiler_ipt::compile()
     if (ipv6) cout << ", IPv6";
     cout <<  endl << flush;
 
-    try {
 
     Compiler::compile();
     bool check_for_recursive_groups=true;
@@ -3967,6 +3987,8 @@ void PolicyCompiler_ipt::compile()
 
     add( new checkForZeroAddr("check for zero addresses") );
     add( new checkMACinOUTPUTChain("check for MAC in OUTPUT chain") );
+    add( new checkUserServiceInWrongChains(
+             "Check for UserSErvice ojects in chains other than OUTPUT"));
 
     add( new ConvertToAtomicForIntervals(
              "convert to atomic rules by interval element") );
@@ -3984,10 +4006,6 @@ void PolicyCompiler_ipt::compile()
 
     runRuleProcessors();
 
-    } catch (FWException &ex) {
-	error(ex.toString());
-	exit(1);
-    }
 }
 
 string PolicyCompiler_ipt::debugPrintRule(Rule *r)

src/ipt/PolicyCompiler_ipt.h

@@ -638,6 +638,12 @@ namespace fwcompiler {
 	 */
         DECLARE_POLICY_RULE_PROCESSOR(checkMACinOUTPUTChain);
 
+	/**
+	 * iptables permits using "--m owner --uid-owner" only in
+	 * the OUTPUT chain
+	 */
+        DECLARE_POLICY_RULE_PROCESSOR(checkUserServiceInWrongChains);
+
 
 	/**
 	 * expand groups in Srv

src/ipt/ipt.cpp

@@ -972,13 +972,15 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
         cerr << "Error while opening or writing to the output file" << endl;
         return 1;
 #endif
+
     } catch (const std::string &s) {
 	cerr << s << endl;
         return 1;
     } catch (const std::exception &ex) {
 	cerr << ex.what() << endl;
         return 1;
-    } catch (...) {
+    }
+    catch (...) {
 	cerr << _("Unsupported exception") << endl;
         return 1;
     }

test/ipt/objects-for-regression-tests.fwb

@@ -1,10 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1212696652" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1212717910" id="root">
   <Library color="#d2ffd0" comment="User defined objects" id="syslib001" name="User">
     <ObjectGroup id="stdid01_1" name="Objects">
       <ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables">
-        <AddressTable comment="" filename="/home/vadim/Projects/fwb2.1/fwb2/fwbuilder2/test/ipt/addr-table-1.tbl" id="id4385C1081434" name="addrtbl 1" run_time="False"/>
+        <AddressTable comment="" filename="addr-table-1.tbl" id="id4385C1081434" name="addrtbl 1" run_time="False"/>
         <AddressTable comment="" filename="addr-table-1.tbl" id="id4389EE9018346" name="addr-table-1" run_time="False"/>
         <AddressTable comment="this is run-time table" filename="block-hosts.tbl" id="id4389EE9118346" name="block these" run_time="True"/>
         <AddressTable comment="the name contains character that is special to shell" filename="/home/vadim/tmp/bug-1544488/addr-table-1.tbl" id="id44F7056328576" name="atbl.1" run_time="True"/>
@@ -847,7 +847,10 @@
       </ObjectGroup>
     </ObjectGroup>
     <ServiceGroup id="stdid05_1" name="Services">
-      <ServiceGroup id="stdid05_1_userservices" name="Users"/>
+      <ServiceGroup id="stdid05_1_userservices" name="Users">
+        <UserService comment="" id="id4849253720246" name="user500" userid="500"/>
+        <UserService comment="" id="id4849253820246" name="user2000" userid="2000"/>
+      </ServiceGroup>
       <ServiceGroup id="stdid05_1_og_tag_1" name="TagServices">
         <TagService comment="" id="id43EC877332486" name="tag16" tagcode="16"/>
         <TagService comment="" id="id449328D824380" name="Tag1" tagcode="1"/>
@@ -16629,7 +16632,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing AddressTable" host_OS="linux24" id="id43868A331434" lastCompiled="1188097112" lastInstalled="1142003872" lastModified="0" name="firewall32" platform="iptables" ro="False" version="">
+      <Firewall comment="testing AddressTable" host_OS="linux24" id="id43868A331434" lastCompiled="1188097112" lastInstalled="1142003872" lastModified="1212717910" name="firewall32" platform="iptables" ro="False" version="">
         <NAT id="id43868A6D1434" name="NAT">
           <NATRule disabled="False" id="id43868A6E1434" position="0">
             <OSrc neg="False">
@@ -25669,6 +25672,327 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
+      <Firewall comment="testing rules using UserService object&#10;Note that iptables does not allow entering&#10;iptables command that tries to match using module 'owner' in any chain&#10;other than OUTPUT. This includes user defined chains too (it checks&#10;how control passes to user defined chain and blocks command if&#10;it appears that user defined chain gets control not from OUTPUT)&#10;&#10;" host_OS="linux24" id="id4848F19020246" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1212717699" name="firewall62" platform="iptables" ro="False" version="1.4.0">
+        <NAT id="id4848F1D320246" name="NAT"/>
+        <Policy id="id4848F19620246" name="Policy">
+          <PolicyRule action="Accept" comment="OUTPUT and INPUT chains" direction="Both" disabled="False" id="id4848F19720246" log="False" position="0">
+            <Src neg="False">
+              <ObjectRef ref="id4848F19020246"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id4849253820246"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="OUTPUT chain" direction="Outbound" disabled="False" group="" id="id484A8D2620246" log="False" position="1">
+            <Src neg="False">
+              <ObjectRef ref="id4848F19020246"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id4849253820246"/>
+              <ServiceRef ref="tcp-HTTP"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="OUTPUT and INPUT chains" direction="Both" disabled="False" group="" id="id484A599620246" log="False" position="2">
+            <Src neg="False">
+              <ObjectRef ref="id4848F19020246"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id4849253820246"/>
+              <ServiceRef ref="tcp-HTTP"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="OUTPUT chain" direction="Outbound" disabled="False" group="" id="id484A8D3820246" log="False" position="3">
+            <Src neg="False">
+              <ObjectRef ref="id4848F19020246"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id4849253820246"/>
+              <ServiceRef ref="tcp-HTTP"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="OUTPUT and INPUT chains&#10;(b/c direction is Both)" direction="Both" disabled="False" group="" id="id4848F1A320246" log="False" position="4">
+            <Src neg="False">
+              <ObjectRef ref="id4848F1D520246"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id4849253820246"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="INPUT, OUTPUT and FORWARD chain&#10;UserService can be used only in OUTPUT" direction="Both" disabled="False" group="" id="id4848F1AF20246" log="False" position="5">
+            <Src neg="False">
+              <ObjectRef ref="id3CEBFDFC"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id4849253820246"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="INPUT and OUTPUT chain&#10;User Service can be used in OUTPUT" direction="Both" disabled="False" group="" id="id4848F1BB20246" log="False" position="6">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id4848F19020246"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id4849253820246"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="INPUT chain, UserService can not be used" direction="Inbound" disabled="False" group="" id="id484AF47A20246" log="False" position="7">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id4848F19020246"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id4849253820246"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A261420246" log="False" position="8">
+            <Src neg="True">
+              <ObjectRef ref="id3CEBFDFC"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id4849253820246"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A260320246" log="False" position="9">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="True">
+              <ObjectRef ref="id4848F19020246"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id4849253820246"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4848F1C720246" log="False" position="10">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+        </Policy>
+        <Routing id="id4848F1D420246" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id4848F1D520246" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id4848F1D720246" name="firewall62:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id4848F1D820246" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id4848F1DA20246" name="firewall62:eth1:ip" address="222.222.222.222" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
+          <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
+          <FWBDManagement enabled="False" identity="" port="-1"/>
+          <PolicyInstallScript arguments="" command="" enabled="False"/>
+        </Management>
+        <FirewallOptions>
+          <Option name="accept_established">True</Option>
+          <Option name="accept_new_tcp_with_no_syn">True</Option>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="add_check_state_rule">true</Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
+          <Option name="bridging_fw">False</Option>
+          <Option name="check_shading">True</Option>
+          <Option name="clamp_mss_to_mtu">False</Option>
+          <Option name="classify_mark_terminating">False</Option>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
+          <Option name="configure_interfaces">True</Option>
+          <Option name="debug">False</Option>
+          <Option name="drop_invalid">False</Option>
+          <Option name="eliminate_duplicates">true</Option>
+          <Option name="enable_ipv6">False</Option>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir">/etc</Option>
+          <Option name="firewall_is_part_of_any_and_networks">True</Option>
+          <Option name="freebsd_ip_forward">1</Option>
+          <Option name="ignore_empty_groups">False</Option>
+          <Option name="in_out_code">true</Option>
+          <Option name="iosacl_add_clear_statements">true</Option>
+          <Option name="iosacl_assume_fw_part_of_any">true</Option>
+          <Option name="iosacl_include_comments">true</Option>
+          <Option name="ipv4_6_order">ipv4_first</Option>
+          <Option name="limit_suffix"></Option>
+          <Option name="limit_value">0</Option>
+          <Option name="linux24_ip_forward">1</Option>
+          <Option name="load_modules">True</Option>
+          <Option name="local_nat">False</Option>
+          <Option name="log_all">False</Option>
+          <Option name="log_invalid">False</Option>
+          <Option name="log_ip_opt">False</Option>
+          <Option name="log_level">info</Option>
+          <Option name="log_prefix">RULE %N -- %A </Option>
+          <Option name="log_tcp_opt">False</Option>
+          <Option name="log_tcp_seq">False</Option>
+          <Option name="loopback_interface">lo0</Option>
+          <Option name="macosx_ip_forward">1</Option>
+          <Option name="manage_virtual_addr">True</Option>
+          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_ssh">False</Option>
+          <Option name="no_ipv6_default_policy">False</Option>
+          <Option name="openbsd_ip_forward">1</Option>
+          <Option name="output_file"></Option>
+          <Option name="pass_all_out">false</Option>
+          <Option name="pf_limit_frags">5000</Option>
+          <Option name="pf_limit_states">10000</Option>
+          <Option name="pf_scrub_maxmss">1460</Option>
+          <Option name="pf_timeout_frag">30</Option>
+          <Option name="pf_timeout_interval">10</Option>
+          <Option name="pix_add_clear_statements">true</Option>
+          <Option name="pix_assume_fw_part_of_any">true</Option>
+          <Option name="pix_default_logint">300</Option>
+          <Option name="pix_emblem_log_format">false</Option>
+          <Option name="pix_emulate_out_acl">true</Option>
+          <Option name="pix_floodguard">true</Option>
+          <Option name="pix_include_comments">true</Option>
+          <Option name="pix_route_dnat_supported">true</Option>
+          <Option name="pix_rule_syslog_settings">false</Option>
+          <Option name="pix_security_fragguard_supported">true</Option>
+          <Option name="pix_syslog_device_id_supported">false</Option>
+          <Option name="pix_use_acl_remarks">true</Option>
+          <Option name="prolog_place">top</Option>
+          <Option name="prolog_script"></Option>
+          <Option name="prompt1">$ </Option>
+          <Option name="prompt2"> # </Option>
+          <Option name="solaris_ip_forward">1</Option>
+          <Option name="sshArgs"></Option>
+          <Option name="ulog_cprange">0</Option>
+          <Option name="ulog_nlgroup">1</Option>
+          <Option name="ulog_qthreshold">1</Option>
+          <Option name="use_ULOG">False</Option>
+          <Option name="use_iptables_restore">False</Option>
+          <Option name="use_numeric_log_levels">False</Option>
+          <Option name="verify_interfaces">True</Option>
+        </FirewallOptions>
+      </Firewall>
     </ObjectGroup>
     <IntervalGroup id="stdid11_1" name="Time">
       <Interval comment="" days_of_week="0,1" from_day="-1" from_hour="1" from_minute="1" from_month="-1" from_weekday="0" from_year="-1" id="id3D6864D0" name="test time 1" to_day="-1" to_hour="2" to_minute="2" to_month="-1" to_weekday="1" to_year="-1"/>