onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-11 07:31:25 +02:00
Code Issues Releases Wiki Activity

Support for UserService in compiler for iptables

Browse Source
This commit is contained in:
Vadim Kurland
2008-06-06 02:08:54 +00:00
parent 4ed299b019
commit 3e10a9b6f5
6 changed files with 566 additions and 202 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/ChangeLog
+4
View File
@@ -1,5 +1,9 @@
2008-06-05 Vadim Kurland <vadim@vk.crocodile.org> 2008-06-05 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (checkUserServiceInWrongChains::processNext):
Support for UserService in compiler for iptables. FR #1948872:
"User based rules"
* IPv4Dialog, NetworkDialog, newHostDialog, newFirewallDialog: * IPv4Dialog, NetworkDialog, newHostDialog, newFirewallDialog:
netmask can be entered as bit length, in addition to the bit mask netmask can be entered as bit length, in addition to the bit mask
format supported before. Both formats are recognized. FR #995452, format supported before. Both formats are recognized. FR #995452,
src/ipt/PolicyCompiler_PrintRule.cpp
+11 -1
View File
@@ -45,6 +45,7 @@
#include "fwbuilder/Firewall.h" #include "fwbuilder/Firewall.h"
#include "fwbuilder/Resources.h" #include "fwbuilder/Resources.h"
#include "fwbuilder/AddressTable.h" #include "fwbuilder/AddressTable.h"
#include "fwbuilder/UserService.h"
#include "fwbuilder/Inet6AddrMask.h" #include "fwbuilder/Inet6AddrMask.h"
@@ -592,7 +593,11 @@ string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv)
PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler); PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
string version=compiler->fw->getStr("version"); string version=compiler->fw->getStr("version");
string s; string s;
if (! srv->isAny() && !CustomService::isA(srv) && !TagService::isA(srv)) if (! srv->isAny() &&
!CustomService::isA(srv) &&
!TagService::isA(srv) &&
!UserService::isA(srv)
)
{ {
string pn=srv->getProtocolName(); string pn=srv->getProtocolName();
if (pn=="ip") pn="all"; if (pn=="ip") pn="all";
@@ -858,6 +863,11 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel)
ostr << "-m mark --mark " ostr << "-m mark --mark "
<< TagService::cast(srv)->getCode() << " "; << TagService::cast(srv)->getCode() << " ";
} }
if (UserService::isA(srv))
{
ostr << "-m owner --uid-owner "
<< UserService::cast(srv)->getUserId() << " ";
}
} else } else
{ {
/* use multiport */ /* use multiport */
src/ipt/PolicyCompiler_ipt.cpp
+214 -196
View File
@@ -44,6 +44,7 @@
#include "fwbuilder/Network.h" #include "fwbuilder/Network.h"
#include "fwbuilder/AddressTable.h" #include "fwbuilder/AddressTable.h"
#include "fwbuilder/DNSName.h" #include "fwbuilder/DNSName.h"
#include "fwbuilder/UserService.h"
#include "combinedAddress.h" #include "combinedAddress.h"
@@ -3022,6 +3023,26 @@ bool PolicyCompiler_ipt::checkMACinOUTPUTChain::processNext()
return true; return true;
} }
bool PolicyCompiler_ipt::checkUserServiceInWrongChains::processNext()
{
PolicyRule *rule=getNext(); if (rule==NULL) return false;
Service *srv = compiler->getFirstSrv(rule); assert(srv);
string chain = rule->getStr("ipt_chain");
string upstream_chain = rule->getStr("upstream_rule_chain");
if (UserService::cast(srv) != NULL &&
chain != "OUTPUT" &&
upstream_chain != "OUTPUT")
{
compiler->warning("Iptables does not support module 'owner' in a chain "
"other than OUTPUT; Rule " + rule->getLabel());
return true;
}
tmp_queue.push_back(rule);
return true;
}
bool PolicyCompiler_ipt::separatePortRanges::processNext() bool PolicyCompiler_ipt::separatePortRanges::processNext()
{ {
@@ -3655,58 +3676,57 @@ void PolicyCompiler_ipt::compile()
if (ipv6) cout << ", IPv6"; if (ipv6) cout << ", IPv6";
cout << endl << flush; cout << endl << flush;
try {
Compiler::compile(); Compiler::compile();
bool check_for_recursive_groups=true; bool check_for_recursive_groups=true;
addPredefinedPolicyRules(); addPredefinedPolicyRules();
if ( fw->getOptionsObject()->getBool ("check_shading") ) if ( fw->getOptionsObject()->getBool ("check_shading") )
{ {
add( new Begin("Detecting rule shadowing")); add( new Begin("Detecting rule shadowing"));
addRuleFilter(); addRuleFilter();
add( new printTotalNumberOfRules()); add( new printTotalNumberOfRules());
add( new ItfNegation( "process negation in Itf" ) ); add( new ItfNegation( "process negation in Itf" ) );
add( new InterfacePolicyRules( add( new InterfacePolicyRules(
"process interface policy rules and store interface ids")); "process interface policy rules and store interface ids"));
add( new convertAnyToNotFWForShadowing("convert 'any' to '!fw'" ) ); add( new convertAnyToNotFWForShadowing("convert 'any' to '!fw'" ) );
#if 0 #if 0
add( new splitIfSrcAnyForShadowing("split rule if src is any" ) ); add( new splitIfSrcAnyForShadowing("split rule if src is any" ) );
add( new splitIfDstAnyForShadowing("split rule if dst is any" ) ); add( new splitIfDstAnyForShadowing("split rule if dst is any" ) );
add( new SrcNegation( true, "process negation in Src" ) ); add( new SrcNegation( true, "process negation in Src" ) );
add( new DstNegation( true, "process negation in Dst" ) ); add( new DstNegation( true, "process negation in Dst" ) );
#endif #endif
add( new recursiveGroupsInSrc("check for recursive groups in SRC")); add( new recursiveGroupsInSrc("check for recursive groups in SRC"));
add( new recursiveGroupsInDst("check for recursive groups in DST")); add( new recursiveGroupsInDst("check for recursive groups in DST"));
add( new recursiveGroupsInSrv("check for recursive groups in SRV")); add( new recursiveGroupsInSrv("check for recursive groups in SRV"));
check_for_recursive_groups=false; check_for_recursive_groups=false;
add( new ExpandGroups("expand groups" ) ); add( new ExpandGroups("expand groups" ) );
add( new dropRuleWithEmptyRE( add( new dropRuleWithEmptyRE(
"drop rules with empty rule elements")); "drop rules with empty rule elements"));
add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC") ); add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC") );
add( new eliminateDuplicatesInDST("eliminate duplicates in DST") ); add( new eliminateDuplicatesInDST("eliminate duplicates in DST") );
add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV") ); add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV") );
add( new swapMultiAddressObjectsInSrc( add( new swapMultiAddressObjectsInSrc(
" swap MultiAddress -> MultiAddressRunTime in Src") ); " swap MultiAddress -> MultiAddressRunTime in Src") );
add( new swapMultiAddressObjectsInDst( add( new swapMultiAddressObjectsInDst(
" swap MultiAddress -> MultiAddressRunTime in Dst") ); " swap MultiAddress -> MultiAddressRunTime in Dst") );
/* behavior of processors ExpandMultiple... has been changed in /* behavior of processors ExpandMultiple... has been changed in
* virtual method _expandInterface */ * virtual method _expandInterface */
add( new ExpandMultipleAddressesInSRC( add( new ExpandMultipleAddressesInSRC(
"expand objects with multiple addresses in SRC" ) ); "expand objects with multiple addresses in SRC" ) );
add( new ExpandMultipleAddressesInDST( add( new ExpandMultipleAddressesInDST(
"expand objects with multiple addresses in DST" ) ); "expand objects with multiple addresses in DST" ) );
add( new dropRuleWithEmptyRE( add( new dropRuleWithEmptyRE(
"drop rules with empty rule elements")); "drop rules with empty rule elements"));
add( new ConvertToAtomic("convert to atomic rules" ) ); add( new ConvertToAtomic("convert to atomic rules" ) );
/* /*
* This assumes that all rules that go into the mangle table are * This assumes that all rules that go into the mangle table are
@@ -3716,64 +3736,64 @@ void PolicyCompiler_ipt::compile()
* MARK) are indeed non-terminating. * MARK) are indeed non-terminating.
*/ */
add( new SkipActionContinueWithNoLogging( add( new SkipActionContinueWithNoLogging(
"drop rules with action Continue") ); "drop rules with action Continue") );
if (my_table=="mangle" && if (my_table=="mangle" &&
!fw->getOptionsObject()->getBool("classify_mark_terminating") !fw->getOptionsObject()->getBool("classify_mark_terminating")
) )
{ {
add( new dropTerminatingTargets( add( new dropTerminatingTargets(
"Drop rules with terminating targets") ); "Drop rules with terminating targets") );
add( new DetectShadowingForNonTerminatingRules( add( new DetectShadowingForNonTerminatingRules(
"Detect shadowing for non-terminating rules" ) ); "Detect shadowing for non-terminating rules" ) );
} else } else
add( new DetectShadowing("Detect shadowing" ) ); add( new DetectShadowing("Detect shadowing" ) );
add( new simplePrintProgress() ); add( new simplePrintProgress() );
runRuleProcessors(); runRuleProcessors();
deleteRuleProcessors(); deleteRuleProcessors();
} }
add( new PolicyCompiler::Begin() ); add( new PolicyCompiler::Begin() );
add( new addPredefinedRules("Add some predefined rules" ) ); add( new addPredefinedRules("Add some predefined rules" ) );
addRuleFilter(); addRuleFilter();
add( new printTotalNumberOfRules( ) ); add( new printTotalNumberOfRules( ) );
add( new Route("process route rules" ) ); add( new Route("process route rules" ) );
add( new storeAction("store original action of this rule" ) ); add( new storeAction("store original action of this rule" ) );
add( new splitIfTagAndConnmark("Tag+CONNMARK combo")); add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
//add( new setChainForMangle("set chain for other rules in mangle")); //add( new setChainForMangle("set chain for other rules in mangle"));
add( new Logging1("check global logging override option" ) ); add( new Logging1("check global logging override option" ) );
add( new ItfNegation("process negation in Itf" ) ); add( new ItfNegation("process negation in Itf" ) );
// add( new InterfacePolicyRulesWithOptimization("process interface policy rules and store interface ids") ); // add( new InterfacePolicyRulesWithOptimization("process interface policy rules and store interface ids") );
add( new decideOnChainForClassify("set chain for action is Classify") ); add( new decideOnChainForClassify("set chain for action is Classify") );
add( new InterfaceAndDirection("fill in interface and direction" ) ); add( new InterfaceAndDirection("fill in interface and direction" ) );
// if an action requires chain POSTROUTING (e.g. Classify), set chain // if an action requires chain POSTROUTING (e.g. Classify), set chain
// BEFORE calling splitIfIfaceAndDirectionBoth // BEFORE calling splitIfIfaceAndDirectionBoth
add( new splitIfIfaceAndDirectionBoth( add( new splitIfIfaceAndDirectionBoth(
"split interface rule with direction 'both'")); "split interface rule with direction 'both'"));
if (check_for_recursive_groups) if (check_for_recursive_groups)
{ {
add( new recursiveGroupsInSrc("check for recursive groups in SRC")); add( new recursiveGroupsInSrc("check for recursive groups in SRC"));
add( new recursiveGroupsInDst("check for recursive groups in DST")); add( new recursiveGroupsInDst("check for recursive groups in DST"));
add( new recursiveGroupsInSrv("check for recursive groups in SRV")); add( new recursiveGroupsInSrv("check for recursive groups in SRV"));
} }
add( new emptyGroupsInSrc("check for empty groups in SRC" ) ); add( new emptyGroupsInSrc("check for empty groups in SRC" ) );
add( new emptyGroupsInDst("check for empty groups in DST" ) ); add( new emptyGroupsInDst("check for empty groups in DST" ) );
add( new emptyGroupsInSrv("check for empty groups in SRV" ) ); add( new emptyGroupsInSrv("check for empty groups in SRV" ) );
/* /*
* commented out to fix bug #727324. "-p tcp --destination-port ! 25" * commented out to fix bug #727324. "-p tcp --destination-port ! 25"
* means "all TCP with port != 25", which is not the same as "all * means "all TCP with port != 25", which is not the same as "all
@@ -3782,38 +3802,38 @@ void PolicyCompiler_ipt::compile()
* element. * element.
*/ */
// add( new singleSrvNegation("negation in Srv if it holds 1 object")); // add( new singleSrvNegation("negation in Srv if it holds 1 object"));
add( new splitRuleIfSrvAnyActionReject( add( new splitRuleIfSrvAnyActionReject(
"split rule if action is reject and srv is any" ) ); "split rule if action is reject and srv is any" ) );
add( new SrvNegation( false, "process negation in Srv" ) ); add( new SrvNegation( false, "process negation in Srv" ) );
add( new expandGroupsInSrv("expand groups in Srv" )); add( new expandGroupsInSrv("expand groups in Srv" ));
add( new CheckForTCPEstablished("TCPService with \"established\"") ); add( new CheckForTCPEstablished("TCPService with \"established\"") );
// add( new splitRuleIfSrvAnyActionReject( // add( new splitRuleIfSrvAnyActionReject(
// "split rule if action is reject and srv is any" ) ); // "split rule if action is reject and srv is any" ) );
add( new fillActionOnReject("fill in action_on_reject" ) ); add( new fillActionOnReject("fill in action_on_reject" ) );
add( new splitServicesIfRejectWithTCPReset( add( new splitServicesIfRejectWithTCPReset(
"check and split if action on reject is TCP reset")); "check and split if action on reject is TCP reset"));
add( new fillActionOnReject("fill in action_on_reject 2" ) ); add( new fillActionOnReject("fill in action_on_reject 2" ) );
add( new splitServicesIfRejectWithTCPReset( add( new splitServicesIfRejectWithTCPReset(
"check and split if action on reject is TCP reset 2")); "check and split if action on reject is TCP reset 2"));
add( new singleSrcNegation( add( new singleSrcNegation(
"process negation in Src if it holds single object" ) ); "process negation in Src if it holds single object" ) );
add( new singleDstNegation( add( new singleDstNegation(
"process negation in Dst if it holds single object" ) ); "process negation in Dst if it holds single object" ) );
/* /*
* phased out these processors, they are not needed anymore because we use variable * phased out these processors, they are not needed anymore because we use variable
* for dynamic interfaces. * for dynamic interfaces.
*/ */
add( new splitIfSrcNegAndFw("split rule if src has negation and fw")); add( new splitIfSrcNegAndFw("split rule if src has negation and fw"));
add( new splitIfDstNegAndFw("split rule if dst has negation and fw")); add( new splitIfDstNegAndFw("split rule if dst has negation and fw"));
add( new SrcNegation( false, "process negation in Src" )); add( new SrcNegation( false, "process negation in Src" ));
add( new DstNegation( false, "process negation in Dst" )); add( new DstNegation( false, "process negation in Dst" ));
add( new TimeNegation( false, "process negation in Time" )); add( new TimeNegation( false, "process negation in Time" ));
add( new Logging2( "process logging" )); add( new Logging2( "process logging" ));
/* this is just a patch for those who do not understand how does /* this is just a patch for those who do not understand how does
* "assume firewall is part of any" work. It also eliminates redundant * "assume firewall is part of any" work. It also eliminates redundant
@@ -3822,172 +3842,170 @@ void PolicyCompiler_ipt::compile()
*/ */
// add( new decideOnChainIfLoopback("any-any rule on loopback" ) ); // add( new decideOnChainIfLoopback("any-any rule on loopback" ) );
add( new splitIfSrcAny("split rule if src is any") ); add( new splitIfSrcAny("split rule if src is any") );
add( new setChainForMangle("set chain for other rules in mangle")); add( new setChainForMangle("set chain for other rules in mangle"));
// call setChainPreroutingForTag before splitIfDstAny // call setChainPreroutingForTag before splitIfDstAny
add( new setChainPreroutingForTag("chain PREROUTING for Tag")); add( new setChainPreroutingForTag("chain PREROUTING for Tag"));
add( new splitIfDstAny("split rule if dst is any") ); add( new splitIfDstAny("split rule if dst is any") );
add( new setChainPostroutingForTag("chain POSTROUTING for Tag")); add( new setChainPostroutingForTag("chain POSTROUTING for Tag"));
add( new ExpandGroups( "expand all groups" )); add( new ExpandGroups( "expand all groups" ));
add( new dropRuleWithEmptyRE("drop rules with empty rule elements")); add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC" )); add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC" ));
add( new eliminateDuplicatesInDST("eliminate duplicates in DST" )); add( new eliminateDuplicatesInDST("eliminate duplicates in DST" ));
add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV" )); add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV" ));
add( new swapMultiAddressObjectsInSrc( add( new swapMultiAddressObjectsInSrc(
" swap MultiAddress -> MultiAddressRunTime in Src")); " swap MultiAddress -> MultiAddressRunTime in Src"));
add( new swapMultiAddressObjectsInDst( add( new swapMultiAddressObjectsInDst(
" swap MultiAddress -> MultiAddressRunTime in Dst")); " swap MultiAddress -> MultiAddressRunTime in Dst"));
add( new processMultiAddressObjectsInSrc( add( new processMultiAddressObjectsInSrc(
"process MultiAddress objects in Src")); "process MultiAddress objects in Src"));
add( new processMultiAddressObjectsInDst( add( new processMultiAddressObjectsInDst(
"process MultiAddress objects in Dst")); "process MultiAddress objects in Dst"));
/* /*
* should expand address range before splitIfSrcMatchesFw because some * should expand address range before splitIfSrcMatchesFw because some
* addresses in the range may match firewall * addresses in the range may match firewall
*/ */
add( new addressRanges( "process address ranges" ) ); add( new addressRanges( "process address ranges" ) );
add( new dropRuleWithEmptyRE("drop rules with empty rule elements")); add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
add( new splitIfSrcMatchesFw( "split rule if src matches FW" ) ); add( new splitIfSrcMatchesFw( "split rule if src matches FW" ) );
add( new splitIfDstMatchesFw( "split rule if dst matches FW" ) ); add( new splitIfDstMatchesFw( "split rule if dst matches FW" ) );
/* at this point in all rules where firewall is in either src or dst, /* at this point in all rules where firewall is in either src or dst,
* firewall is a single object in that rule element. Other rule * firewall is a single object in that rule element. Other rule
* elements may contain multiple objects yet * elements may contain multiple objects yet
*/ */
add( new specialCaseWithFW1( "special case with firewall" ) ); add( new specialCaseWithFW1( "special case with firewall" ) );
add( new decideOnChainIfDstFW( "decide on chain if Dst has fw" ) ); add( new decideOnChainIfDstFW( "decide on chain if Dst has fw" ) );
add( new splitIfSrcFWNetwork( add( new splitIfSrcFWNetwork(
"split rule if src has a net fw has interface on" ) ); "split rule if src has a net fw has interface on" ) );
add( new decideOnChainIfSrcFW( "decide on chain if Src has fw" ) ); add( new decideOnChainIfSrcFW( "decide on chain if Src has fw" ) );
add( new splitIfDstFWNetwork( add( new splitIfDstFWNetwork(
"split rule if dst has a net fw has interface on" ) ); "split rule if dst has a net fw has interface on" ) );
add( new specialCaseWithFW2( add( new specialCaseWithFW2(
"replace fw with its interfaces if src==dst==fw" ) ); "replace fw with its interfaces if src==dst==fw" ) );
/* behavior of processors ExpandMultiple... has been changed in the /* behavior of processors ExpandMultiple... has been changed in the
* virtual method expandInterface * virtual method expandInterface
*/ */
add( new expandMultipleAddressesIfNotFWinSrc( add( new expandMultipleAddressesIfNotFWinSrc(
"expand multiple addresses if not FW in Src") ); "expand multiple addresses if not FW in Src") );
add( new expandMultipleAddressesIfNotFWinDst( add( new expandMultipleAddressesIfNotFWinDst(
"expand multiple addresses if not FW in Dst") ); "expand multiple addresses if not FW in Dst") );
add( new expandLoopbackInterfaceAddress( add( new expandLoopbackInterfaceAddress(
"check for loopback interface in the rule objects") ); "check for loopback interface in the rule objects") );
// processors that expand objects with multiple addresses // processors that expand objects with multiple addresses
// check addresses against current address family using member // check addresses against current address family using member
// ipv6. If all addresses do not match, we may end up with // ipv6. If all addresses do not match, we may end up with
// empty rule element. // empty rule element.
add( new dropRuleWithEmptyRE("drop rules with empty rule elements")); add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
if (ipv6) if (ipv6)
add( new DropIPv4Rules("drop ipv4 rules")); add( new DropIPv4Rules("drop ipv4 rules"));
else else
add( new DropIPv6Rules("drop ipv6 rules")); add( new DropIPv6Rules("drop ipv6 rules"));
add( new dropRuleWithEmptyRE("drop rules with empty rule elements")); add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
// trying process rules with multiple interfaces as late as possible // trying process rules with multiple interfaces as late as possible
add( new InterfacePolicyRulesWithOptimization( add( new InterfacePolicyRulesWithOptimization(
"process interface policy rules and store interface ids") ); "process interface policy rules and store interface ids") );
/* this is just a patch for those who do not understand how does /* this is just a patch for those who do not understand how does
* "assume firewall is part of any" work. It also eliminates redundant * "assume firewall is part of any" work. It also eliminates redundant
* and useless rules in the FORWARD chain for rules assigned to a * and useless rules in the FORWARD chain for rules assigned to a
* loopback interface. * loopback interface.
*/ */
add( new decideOnChainIfLoopback("any-any rule on loopback" ) ); add( new decideOnChainIfLoopback("any-any rule on loopback" ) );
// add( new decideOnChainForClassify("set chain if action is Classify")); // add( new decideOnChainForClassify("set chain if action is Classify"));
add( new finalizeChain( "decide on chain" ) ); add( new finalizeChain( "decide on chain" ) );
add( new decideOnTarget( "decide on target" ) ); add( new decideOnTarget( "decide on target" ) );
add( new checkForRestoreMarkInOutput( add( new checkForRestoreMarkInOutput(
"check if we need -A OUTPUT -j CONNMARK --restore-mark")); "check if we need -A OUTPUT -j CONNMARK --restore-mark"));
/* /*
* removed call to processor removeFW to make changes for bug #685947: * removed call to processor removeFW to make changes for bug #685947:
* "Rules with firewall object allow too much. " * "Rules with firewall object allow too much. "
*/ */
add( new removeFW( "remove fw" ) ); add( new removeFW( "remove fw" ) );
add( new ExpandMultipleAddresses("expand multiple addresses" ) ); add( new ExpandMultipleAddresses("expand multiple addresses" ) );
add( new dropRuleWithEmptyRE("drop rules with empty rule elements")); add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
add( new checkForUnnumbered("check for unnumbered interfaces" ) ); add( new checkForUnnumbered("check for unnumbered interfaces" ) );
add( new checkForDynamicInterfacesOfOtherObjects( add( new checkForDynamicInterfacesOfOtherObjects(
"check for dynamic interfaces of other hosts and firewalls")); "check for dynamic interfaces of other hosts and firewalls"));
if ( fwopt->getBool("bridging_fw") ) if ( fwopt->getBool("bridging_fw") )
add( new bridgingFw("handle bridging firewall cases")); add( new bridgingFw("handle bridging firewall cases"));
add( new specialCaseWithUnnumberedInterface( add( new specialCaseWithUnnumberedInterface(
"check for a special cases with unnumbered interface" ) ); "check for a special cases with unnumbered interface" ) );
// add( new splitServices( "split on services" ) ); // add( new splitServices( "split on services" ) );
// add( new prepareForMultiport("prepare for multiport" ) ); // add( new prepareForMultiport("prepare for multiport" ) );
add( new optimize1( "optimization 1, pass 1" ) ); add( new optimize1( "optimization 1, pass 1" ) );
add( new optimize1( "optimization 1, pass 2" ) ); add( new optimize1( "optimization 1, pass 2" ) );
add( new optimize1( "optimization 1, pass 3" ) ); add( new optimize1( "optimization 1, pass 3" ) );
add( new splitServices( "split on services" )); add( new splitServices( "split on services" ));
add( new separateTCPWithFlags( "split on TCP services with flags" )); add( new separateTCPWithFlags( "split on TCP services with flags" ));
add( new verifyCustomServices( "verify custom services" )); add( new verifyCustomServices( "verify custom services" ));
add( new specialCasesWithCustomServices( add( new specialCasesWithCustomServices(
"scpecial cases with some custom services" ) ); "scpecial cases with some custom services" ) );
add( new separatePortRanges( "separate port ranges" )); add( new separatePortRanges( "separate port ranges" ));
add( new separateSrcPort( "split on TCP and UDP with source ports")); add( new separateSrcPort( "split on TCP and UDP with source ports"));
// add( new optimize1( "optimization 1, pass 1" ) ); // add( new optimize1( "optimization 1, pass 1" ) );
// add( new optimize1( "optimization 1, pass 2" ) ); // add( new optimize1( "optimization 1, pass 2" ) );
add( new optimize2( "optimization 2" ) ); add( new optimize2( "optimization 2" ) );
add( new accounting( "Accounting" ) ); add( new accounting( "Accounting" ) );
add( new prepareForMultiport("prepare for multiport" ) ); add( new prepareForMultiport("prepare for multiport" ) );
add( new splitNonTerminatingTargets( add( new splitNonTerminatingTargets(
"split rules using non-terminating targets" ) ); "split rules using non-terminating targets" ) );
add( new ConvertToAtomicForAddresses( add( new ConvertToAtomicForAddresses(
"convert to atomic rules by address elements") ); "convert to atomic rules by address elements") );
add( new checkForZeroAddr("check for zero addresses") ); add( new checkForZeroAddr("check for zero addresses") );
add( new checkMACinOUTPUTChain("check for MAC in OUTPUT chain") ); add( new checkMACinOUTPUTChain("check for MAC in OUTPUT chain") );
add( new checkUserServiceInWrongChains(
"Check for UserSErvice ojects in chains other than OUTPUT"));
add( new ConvertToAtomicForIntervals( add( new ConvertToAtomicForIntervals(
"convert to atomic rules by interval element") ); "convert to atomic rules by interval element") );
add( new SkipActionContinueWithNoLogging( add( new SkipActionContinueWithNoLogging(
"drop rules with action Continue") ); "drop rules with action Continue") );
add( new convertInterfaceIdToStr("prepare interface assignments") ); add( new convertInterfaceIdToStr("prepare interface assignments") );
add( new optimize3("optimization 3") ); add( new optimize3("optimization 3") );
add( new countChainUsage("Count chain usage")); add( new countChainUsage("Count chain usage"));
add( createPrintRuleProcessor() ); add( createPrintRuleProcessor() );
add( new simplePrintProgress()); add( new simplePrintProgress());
runRuleProcessors(); runRuleProcessors();
} catch (FWException &ex) {
error(ex.toString());
exit(1);
}
} }
string PolicyCompiler_ipt::debugPrintRule(Rule *r) string PolicyCompiler_ipt::debugPrintRule(Rule *r)
src/ipt/PolicyCompiler_ipt.h
+6
View File
@@ -638,6 +638,12 @@ namespace fwcompiler {
*/ */
DECLARE_POLICY_RULE_PROCESSOR(checkMACinOUTPUTChain); DECLARE_POLICY_RULE_PROCESSOR(checkMACinOUTPUTChain);
/**
* iptables permits using "--m owner --uid-owner" only in
* the OUTPUT chain
*/
DECLARE_POLICY_RULE_PROCESSOR(checkUserServiceInWrongChains);
/** /**
* expand groups in Srv * expand groups in Srv
src/ipt/ipt.cpp
+3 -1
View File
@@ -972,13 +972,15 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
cerr << "Error while opening or writing to the output file" << endl; cerr << "Error while opening or writing to the output file" << endl;
return 1; return 1;
#endif #endif
} catch (const std::string &s) { } catch (const std::string &s) {
cerr << s << endl; cerr << s << endl;
return 1; return 1;
} catch (const std::exception &ex) { } catch (const std::exception &ex) {
cerr << ex.what() << endl; cerr << ex.what() << endl;
return 1; return 1;
} catch (...) { }
catch (...) {
cerr << _("Unsupported exception") << endl; cerr << _("Unsupported exception") << endl;
return 1; return 1;
} }
test/ipt/objects-for-regression-tests.fwb
+328 -4
View File
@@ -1,10 +1,10 @@
<?xml version="1.0" encoding="utf-8"?> <?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd"> <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1212696652" id="root"> <FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1212717910" id="root">
<Library color="#d2ffd0" comment="User defined objects" id="syslib001" name="User"> <Library color="#d2ffd0" comment="User defined objects" id="syslib001" name="User">
<ObjectGroup id="stdid01_1" name="Objects"> <ObjectGroup id="stdid01_1" name="Objects">
<ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables"> <ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables">
<AddressTable comment="" filename="/home/vadim/Projects/fwb2.1/fwb2/fwbuilder2/test/ipt/addr-table-1.tbl" id="id4385C1081434" name="addrtbl 1" run_time="False"/> <AddressTable comment="" filename="addr-table-1.tbl" id="id4385C1081434" name="addrtbl 1" run_time="False"/>
<AddressTable comment="" filename="addr-table-1.tbl" id="id4389EE9018346" name="addr-table-1" run_time="False"/> <AddressTable comment="" filename="addr-table-1.tbl" id="id4389EE9018346" name="addr-table-1" run_time="False"/>
<AddressTable comment="this is run-time table" filename="block-hosts.tbl" id="id4389EE9118346" name="block these" run_time="True"/> <AddressTable comment="this is run-time table" filename="block-hosts.tbl" id="id4389EE9118346" name="block these" run_time="True"/>
<AddressTable comment="the name contains character that is special to shell" filename="/home/vadim/tmp/bug-1544488/addr-table-1.tbl" id="id44F7056328576" name="atbl.1" run_time="True"/> <AddressTable comment="the name contains character that is special to shell" filename="/home/vadim/tmp/bug-1544488/addr-table-1.tbl" id="id44F7056328576" name="atbl.1" run_time="True"/>
@@ -847,7 +847,10 @@
</ObjectGroup> </ObjectGroup>
</ObjectGroup> </ObjectGroup>
<ServiceGroup id="stdid05_1" name="Services"> <ServiceGroup id="stdid05_1" name="Services">
<ServiceGroup id="stdid05_1_userservices" name="Users"/> <ServiceGroup id="stdid05_1_userservices" name="Users">
<UserService comment="" id="id4849253720246" name="user500" userid="500"/>
<UserService comment="" id="id4849253820246" name="user2000" userid="2000"/>
</ServiceGroup>
<ServiceGroup id="stdid05_1_og_tag_1" name="TagServices"> <ServiceGroup id="stdid05_1_og_tag_1" name="TagServices">
<TagService comment="" id="id43EC877332486" name="tag16" tagcode="16"/> <TagService comment="" id="id43EC877332486" name="tag16" tagcode="16"/>
<TagService comment="" id="id449328D824380" name="Tag1" tagcode="1"/> <TagService comment="" id="id449328D824380" name="Tag1" tagcode="1"/>
@@ -16629,7 +16632,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
<Option name="verify_interfaces">False</Option> <Option name="verify_interfaces">False</Option>
</FirewallOptions> </FirewallOptions>
</Firewall> </Firewall>
<Firewall comment="testing AddressTable" host_OS="linux24" id="id43868A331434" lastCompiled="1188097112" lastInstalled="1142003872" lastModified="0" name="firewall32" platform="iptables" ro="False" version=""> <Firewall comment="testing AddressTable" host_OS="linux24" id="id43868A331434" lastCompiled="1188097112" lastInstalled="1142003872" lastModified="1212717910" name="firewall32" platform="iptables" ro="False" version="">
<NAT id="id43868A6D1434" name="NAT"> <NAT id="id43868A6D1434" name="NAT">
<NATRule disabled="False" id="id43868A6E1434" position="0"> <NATRule disabled="False" id="id43868A6E1434" position="0">
<OSrc neg="False"> <OSrc neg="False">
@@ -25669,6 +25672,327 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
<Option name="verify_interfaces">False</Option> <Option name="verify_interfaces">False</Option>
</FirewallOptions> </FirewallOptions>
</Firewall> </Firewall>
<Firewall comment="testing rules using UserService object&#10;Note that iptables does not allow entering&#10;iptables command that tries to match using module 'owner' in any chain&#10;other than OUTPUT. This includes user defined chains too (it checks&#10;how control passes to user defined chain and blocks command if&#10;it appears that user defined chain gets control not from OUTPUT)&#10;&#10;" host_OS="linux24" id="id4848F19020246" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1212717699" name="firewall62" platform="iptables" ro="False" version="1.4.0">
<NAT id="id4848F1D320246" name="NAT"/>
<Policy id="id4848F19620246" name="Policy">
<PolicyRule action="Accept" comment="OUTPUT and INPUT chains" direction="Both" disabled="False" id="id4848F19720246" log="False" position="0">
<Src neg="False">
<ObjectRef ref="id4848F19020246"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="OUTPUT chain" direction="Outbound" disabled="False" group="" id="id484A8D2620246" log="False" position="1">
<Src neg="False">
<ObjectRef ref="id4848F19020246"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
<ServiceRef ref="tcp-HTTP"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="OUTPUT and INPUT chains" direction="Both" disabled="False" group="" id="id484A599620246" log="False" position="2">
<Src neg="False">
<ObjectRef ref="id4848F19020246"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
<ServiceRef ref="tcp-HTTP"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="OUTPUT chain" direction="Outbound" disabled="False" group="" id="id484A8D3820246" log="False" position="3">
<Src neg="False">
<ObjectRef ref="id4848F19020246"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
<ServiceRef ref="tcp-HTTP"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="OUTPUT and INPUT chains&#10;(b/c direction is Both)" direction="Both" disabled="False" group="" id="id4848F1A320246" log="False" position="4">
<Src neg="False">
<ObjectRef ref="id4848F1D520246"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="INPUT, OUTPUT and FORWARD chain&#10;UserService can be used only in OUTPUT" direction="Both" disabled="False" group="" id="id4848F1AF20246" log="False" position="5">
<Src neg="False">
<ObjectRef ref="id3CEBFDFC"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="INPUT and OUTPUT chain&#10;User Service can be used in OUTPUT" direction="Both" disabled="False" group="" id="id4848F1BB20246" log="False" position="6">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id4848F19020246"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="INPUT chain, UserService can not be used" direction="Inbound" disabled="False" group="" id="id484AF47A20246" log="False" position="7">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id4848F19020246"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A261420246" log="False" position="8">
<Src neg="True">
<ObjectRef ref="id3CEBFDFC"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A260320246" log="False" position="9">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="True">
<ObjectRef ref="id4848F19020246"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Deny" direction="Both" disabled="False" id="id4848F1C720246" log="False" position="10">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
</Policy>
<Routing id="id4848F1D420246" name="Routing"/>
<Interface bridgeport="False" comment="" dyn="False" id="id4848F1D520246" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
<IPv4 comment="" id="id4848F1D720246" name="firewall62:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
</Interface>
<Interface bridgeport="False" comment="" dyn="False" id="id4848F1D820246" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
<IPv4 comment="" id="id4848F1DA20246" name="firewall62:eth1:ip" address="222.222.222.222" netmask="255.255.255.0"/>
</Interface>
<Management address="192.168.1.1">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<FirewallOptions>
<Option name="accept_established">True</Option>
<Option name="accept_new_tcp_with_no_syn">True</Option>
<Option name="action_on_reject"></Option>
<Option name="activationCmd"></Option>
<Option name="add_check_state_rule">true</Option>
<Option name="admUser"></Option>
<Option name="altAddress"></Option>
<Option name="bridging_fw">False</Option>
<Option name="check_shading">True</Option>
<Option name="clamp_mss_to_mtu">False</Option>
<Option name="classify_mark_terminating">False</Option>
<Option name="cmdline"></Option>
<Option name="compiler"></Option>
<Option name="configure_interfaces">True</Option>
<Option name="debug">False</Option>
<Option name="drop_invalid">False</Option>
<Option name="eliminate_duplicates">true</Option>
<Option name="enable_ipv6">False</Option>
<Option name="epilog_script"></Option>
<Option name="firewall_dir">/etc</Option>
<Option name="firewall_is_part_of_any_and_networks">True</Option>
<Option name="freebsd_ip_forward">1</Option>
<Option name="ignore_empty_groups">False</Option>
<Option name="in_out_code">true</Option>
<Option name="iosacl_add_clear_statements">true</Option>
<Option name="iosacl_assume_fw_part_of_any">true</Option>
<Option name="iosacl_include_comments">true</Option>
<Option name="ipv4_6_order">ipv4_first</Option>
<Option name="limit_suffix"></Option>
<Option name="limit_value">0</Option>
<Option name="linux24_ip_forward">1</Option>
<Option name="load_modules">True</Option>
<Option name="local_nat">False</Option>
<Option name="log_all">False</Option>
<Option name="log_invalid">False</Option>
<Option name="log_ip_opt">False</Option>
<Option name="log_level">info</Option>
<Option name="log_prefix">RULE %N -- %A </Option>
<Option name="log_tcp_opt">False</Option>
<Option name="log_tcp_seq">False</Option>
<Option name="loopback_interface">lo0</Option>
<Option name="macosx_ip_forward">1</Option>
<Option name="manage_virtual_addr">True</Option>
<Option name="mgmt_addr"></Option>
<Option name="mgmt_ssh">False</Option>
<Option name="no_ipv6_default_policy">False</Option>
<Option name="openbsd_ip_forward">1</Option>
<Option name="output_file"></Option>
<Option name="pass_all_out">false</Option>
<Option name="pf_limit_frags">5000</Option>
<Option name="pf_limit_states">10000</Option>
<Option name="pf_scrub_maxmss">1460</Option>
<Option name="pf_timeout_frag">30</Option>
<Option name="pf_timeout_interval">10</Option>
<Option name="pix_add_clear_statements">true</Option>
<Option name="pix_assume_fw_part_of_any">true</Option>
<Option name="pix_default_logint">300</Option>
<Option name="pix_emblem_log_format">false</Option>
<Option name="pix_emulate_out_acl">true</Option>
<Option name="pix_floodguard">true</Option>
<Option name="pix_include_comments">true</Option>
<Option name="pix_route_dnat_supported">true</Option>
<Option name="pix_rule_syslog_settings">false</Option>
<Option name="pix_security_fragguard_supported">true</Option>
<Option name="pix_syslog_device_id_supported">false</Option>
<Option name="pix_use_acl_remarks">true</Option>
<Option name="prolog_place">top</Option>
<Option name="prolog_script"></Option>
<Option name="prompt1">$ </Option>
<Option name="prompt2"> # </Option>
<Option name="solaris_ip_forward">1</Option>
<Option name="sshArgs"></Option>
<Option name="ulog_cprange">0</Option>
<Option name="ulog_nlgroup">1</Option>
<Option name="ulog_qthreshold">1</Option>
<Option name="use_ULOG">False</Option>
<Option name="use_iptables_restore">False</Option>
<Option name="use_numeric_log_levels">False</Option>
<Option name="verify_interfaces">True</Option>
</FirewallOptions>
</Firewall>
</ObjectGroup> </ObjectGroup>
<IntervalGroup id="stdid11_1" name="Time"> <IntervalGroup id="stdid11_1" name="Time">
<Interval comment="" days_of_week="0,1" from_day="-1" from_hour="1" from_minute="1" from_month="-1" from_weekday="0" from_year="-1" id="id3D6864D0" name="test time 1" to_day="-1" to_hour="2" to_minute="2" to_month="-1" to_weekday="1" to_year="-1"/> <Interval comment="" days_of_week="0,1" from_day="-1" from_hour="1" from_minute="1" from_month="-1" from_weekday="0" from_year="-1" id="id3D6864D0" name="test time 1" to_day="-1" to_hour="2" to_minute="2" to_month="-1" to_weekday="1" to_year="-1"/>