onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-11 15:41:41 +02:00
Code Issues Releases Wiki Activity

Support for UserService in compiler for iptables

Browse Source
This commit is contained in:
Vadim Kurland
2008-06-06 02:08:54 +00:00
parent 4ed299b019
commit 3e10a9b6f5
6 changed files with 566 additions and 202 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/ChangeLog
+4
View File
@@ -1,5 +1,9 @@
2008-06-05 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (checkUserServiceInWrongChains::processNext):
Support for UserService in compiler for iptables. FR #1948872:
"User based rules"
* IPv4Dialog, NetworkDialog, newHostDialog, newFirewallDialog:
netmask can be entered as bit length, in addition to the bit mask
format supported before. Both formats are recognized. FR #995452,
src/ipt/PolicyCompiler_PrintRule.cpp
+11 -1
View File
@@ -45,6 +45,7 @@
#include "fwbuilder/Firewall.h"
#include "fwbuilder/Resources.h"
#include "fwbuilder/AddressTable.h"
#include "fwbuilder/UserService.h"
#include "fwbuilder/Inet6AddrMask.h"
@@ -592,7 +593,11 @@ string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv)
PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
string version=compiler->fw->getStr("version");
string s;
if (! srv->isAny() && !CustomService::isA(srv) && !TagService::isA(srv))
if (! srv->isAny() &&
!CustomService::isA(srv) &&
!TagService::isA(srv) &&
!UserService::isA(srv)
)
{
string pn=srv->getProtocolName();
if (pn=="ip") pn="all";
@@ -858,6 +863,11 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel)
ostr << "-m mark --mark "
<< TagService::cast(srv)->getCode() << " ";
}
if (UserService::isA(srv))
{
ostr << "-m owner --uid-owner "
<< UserService::cast(srv)->getUserId() << " ";
}
} else
{
/* use multiport */
src/ipt/PolicyCompiler_ipt.cpp
+23 -5
View File
@@ -44,6 +44,7 @@
#include "fwbuilder/Network.h"
#include "fwbuilder/AddressTable.h"
#include "fwbuilder/DNSName.h"
#include "fwbuilder/UserService.h"
#include "combinedAddress.h"
@@ -3022,6 +3023,26 @@ bool PolicyCompiler_ipt::checkMACinOUTPUTChain::processNext()
return true;
}
bool PolicyCompiler_ipt::checkUserServiceInWrongChains::processNext()
{
PolicyRule *rule=getNext(); if (rule==NULL) return false;
Service *srv = compiler->getFirstSrv(rule); assert(srv);
string chain = rule->getStr("ipt_chain");
string upstream_chain = rule->getStr("upstream_rule_chain");
if (UserService::cast(srv) != NULL &&
chain != "OUTPUT" &&
upstream_chain != "OUTPUT")
{
compiler->warning("Iptables does not support module 'owner' in a chain "
"other than OUTPUT; Rule " + rule->getLabel());
return true;
}
tmp_queue.push_back(rule);
return true;
}
bool PolicyCompiler_ipt::separatePortRanges::processNext()
{
@@ -3655,7 +3676,6 @@ void PolicyCompiler_ipt::compile()
if (ipv6) cout << ", IPv6";
cout << endl << flush;
try {
Compiler::compile();
bool check_for_recursive_groups=true;
@@ -3967,6 +3987,8 @@ void PolicyCompiler_ipt::compile()
add( new checkForZeroAddr("check for zero addresses") );
add( new checkMACinOUTPUTChain("check for MAC in OUTPUT chain") );
add( new checkUserServiceInWrongChains(
"Check for UserSErvice ojects in chains other than OUTPUT"));
add( new ConvertToAtomicForIntervals(
"convert to atomic rules by interval element") );
@@ -3984,10 +4006,6 @@ void PolicyCompiler_ipt::compile()
runRuleProcessors();
} catch (FWException &ex) {
error(ex.toString());
exit(1);
}
}
string PolicyCompiler_ipt::debugPrintRule(Rule *r)
src/ipt/PolicyCompiler_ipt.h
+6
View File
@@ -638,6 +638,12 @@ namespace fwcompiler {
*/
DECLARE_POLICY_RULE_PROCESSOR(checkMACinOUTPUTChain);
/**
* iptables permits using "--m owner --uid-owner" only in
* the OUTPUT chain
*/
DECLARE_POLICY_RULE_PROCESSOR(checkUserServiceInWrongChains);
/**
* expand groups in Srv
src/ipt/ipt.cpp
+3 -1
View File
@@ -972,13 +972,15 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
cerr << "Error while opening or writing to the output file" << endl;
return 1;
#endif
} catch (const std::string &s) {
cerr << s << endl;
return 1;
} catch (const std::exception &ex) {
cerr << ex.what() << endl;
return 1;
} catch (...) {
}
catch (...) {
cerr << _("Unsupported exception") << endl;
return 1;
}
test/ipt/objects-for-regression-tests.fwb
+328 -4
View File
@@ -1,10 +1,10 @@
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1212696652" id="root">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1212717910" id="root">
<Library color="#d2ffd0" comment="User defined objects" id="syslib001" name="User">
<ObjectGroup id="stdid01_1" name="Objects">
<ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables">
<AddressTable comment="" filename="/home/vadim/Projects/fwb2.1/fwb2/fwbuilder2/test/ipt/addr-table-1.tbl" id="id4385C1081434" name="addrtbl 1" run_time="False"/>
<AddressTable comment="" filename="addr-table-1.tbl" id="id4385C1081434" name="addrtbl 1" run_time="False"/>
<AddressTable comment="" filename="addr-table-1.tbl" id="id4389EE9018346" name="addr-table-1" run_time="False"/>
<AddressTable comment="this is run-time table" filename="block-hosts.tbl" id="id4389EE9118346" name="block these" run_time="True"/>
<AddressTable comment="the name contains character that is special to shell" filename="/home/vadim/tmp/bug-1544488/addr-table-1.tbl" id="id44F7056328576" name="atbl.1" run_time="True"/>
@@ -847,7 +847,10 @@
</ObjectGroup>
</ObjectGroup>
<ServiceGroup id="stdid05_1" name="Services">
<ServiceGroup id="stdid05_1_userservices" name="Users"/>
<ServiceGroup id="stdid05_1_userservices" name="Users">
<UserService comment="" id="id4849253720246" name="user500" userid="500"/>
<UserService comment="" id="id4849253820246" name="user2000" userid="2000"/>
</ServiceGroup>
<ServiceGroup id="stdid05_1_og_tag_1" name="TagServices">
<TagService comment="" id="id43EC877332486" name="tag16" tagcode="16"/>
<TagService comment="" id="id449328D824380" name="Tag1" tagcode="1"/>
@@ -16629,7 +16632,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
<Option name="verify_interfaces">False</Option>
</FirewallOptions>
</Firewall>
<Firewall comment="testing AddressTable" host_OS="linux24" id="id43868A331434" lastCompiled="1188097112" lastInstalled="1142003872" lastModified="0" name="firewall32" platform="iptables" ro="False" version="">
<Firewall comment="testing AddressTable" host_OS="linux24" id="id43868A331434" lastCompiled="1188097112" lastInstalled="1142003872" lastModified="1212717910" name="firewall32" platform="iptables" ro="False" version="">
<NAT id="id43868A6D1434" name="NAT">
<NATRule disabled="False" id="id43868A6E1434" position="0">
<OSrc neg="False">
@@ -25669,6 +25672,327 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
<Option name="verify_interfaces">False</Option>
</FirewallOptions>
</Firewall>
<Firewall comment="testing rules using UserService object&#10;Note that iptables does not allow entering&#10;iptables command that tries to match using module 'owner' in any chain&#10;other than OUTPUT. This includes user defined chains too (it checks&#10;how control passes to user defined chain and blocks command if&#10;it appears that user defined chain gets control not from OUTPUT)&#10;&#10;" host_OS="linux24" id="id4848F19020246" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1212717699" name="firewall62" platform="iptables" ro="False" version="1.4.0">
<NAT id="id4848F1D320246" name="NAT"/>
<Policy id="id4848F19620246" name="Policy">
<PolicyRule action="Accept" comment="OUTPUT and INPUT chains" direction="Both" disabled="False" id="id4848F19720246" log="False" position="0">
<Src neg="False">
<ObjectRef ref="id4848F19020246"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="OUTPUT chain" direction="Outbound" disabled="False" group="" id="id484A8D2620246" log="False" position="1">
<Src neg="False">
<ObjectRef ref="id4848F19020246"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
<ServiceRef ref="tcp-HTTP"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="OUTPUT and INPUT chains" direction="Both" disabled="False" group="" id="id484A599620246" log="False" position="2">
<Src neg="False">
<ObjectRef ref="id4848F19020246"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
<ServiceRef ref="tcp-HTTP"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="OUTPUT chain" direction="Outbound" disabled="False" group="" id="id484A8D3820246" log="False" position="3">
<Src neg="False">
<ObjectRef ref="id4848F19020246"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
<ServiceRef ref="tcp-HTTP"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="OUTPUT and INPUT chains&#10;(b/c direction is Both)" direction="Both" disabled="False" group="" id="id4848F1A320246" log="False" position="4">
<Src neg="False">
<ObjectRef ref="id4848F1D520246"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="INPUT, OUTPUT and FORWARD chain&#10;UserService can be used only in OUTPUT" direction="Both" disabled="False" group="" id="id4848F1AF20246" log="False" position="5">
<Src neg="False">
<ObjectRef ref="id3CEBFDFC"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="INPUT and OUTPUT chain&#10;User Service can be used in OUTPUT" direction="Both" disabled="False" group="" id="id4848F1BB20246" log="False" position="6">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id4848F19020246"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="INPUT chain, UserService can not be used" direction="Inbound" disabled="False" group="" id="id484AF47A20246" log="False" position="7">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id4848F19020246"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A261420246" log="False" position="8">
<Src neg="True">
<ObjectRef ref="id3CEBFDFC"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A260320246" log="False" position="9">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="True">
<ObjectRef ref="id4848F19020246"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id4849253820246"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Deny" direction="Both" disabled="False" id="id4848F1C720246" log="False" position="10">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
</Policy>
<Routing id="id4848F1D420246" name="Routing"/>
<Interface bridgeport="False" comment="" dyn="False" id="id4848F1D520246" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
<IPv4 comment="" id="id4848F1D720246" name="firewall62:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
</Interface>
<Interface bridgeport="False" comment="" dyn="False" id="id4848F1D820246" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
<IPv4 comment="" id="id4848F1DA20246" name="firewall62:eth1:ip" address="222.222.222.222" netmask="255.255.255.0"/>
</Interface>
<Management address="192.168.1.1">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<FirewallOptions>
<Option name="accept_established">True</Option>
<Option name="accept_new_tcp_with_no_syn">True</Option>
<Option name="action_on_reject"></Option>
<Option name="activationCmd"></Option>
<Option name="add_check_state_rule">true</Option>
<Option name="admUser"></Option>
<Option name="altAddress"></Option>
<Option name="bridging_fw">False</Option>
<Option name="check_shading">True</Option>
<Option name="clamp_mss_to_mtu">False</Option>
<Option name="classify_mark_terminating">False</Option>
<Option name="cmdline"></Option>
<Option name="compiler"></Option>
<Option name="configure_interfaces">True</Option>
<Option name="debug">False</Option>
<Option name="drop_invalid">False</Option>
<Option name="eliminate_duplicates">true</Option>
<Option name="enable_ipv6">False</Option>
<Option name="epilog_script"></Option>
<Option name="firewall_dir">/etc</Option>
<Option name="firewall_is_part_of_any_and_networks">True</Option>
<Option name="freebsd_ip_forward">1</Option>
<Option name="ignore_empty_groups">False</Option>
<Option name="in_out_code">true</Option>
<Option name="iosacl_add_clear_statements">true</Option>
<Option name="iosacl_assume_fw_part_of_any">true</Option>
<Option name="iosacl_include_comments">true</Option>
<Option name="ipv4_6_order">ipv4_first</Option>
<Option name="limit_suffix"></Option>
<Option name="limit_value">0</Option>
<Option name="linux24_ip_forward">1</Option>
<Option name="load_modules">True</Option>
<Option name="local_nat">False</Option>
<Option name="log_all">False</Option>
<Option name="log_invalid">False</Option>
<Option name="log_ip_opt">False</Option>
<Option name="log_level">info</Option>
<Option name="log_prefix">RULE %N -- %A </Option>
<Option name="log_tcp_opt">False</Option>
<Option name="log_tcp_seq">False</Option>
<Option name="loopback_interface">lo0</Option>
<Option name="macosx_ip_forward">1</Option>
<Option name="manage_virtual_addr">True</Option>
<Option name="mgmt_addr"></Option>
<Option name="mgmt_ssh">False</Option>
<Option name="no_ipv6_default_policy">False</Option>
<Option name="openbsd_ip_forward">1</Option>
<Option name="output_file"></Option>
<Option name="pass_all_out">false</Option>
<Option name="pf_limit_frags">5000</Option>
<Option name="pf_limit_states">10000</Option>
<Option name="pf_scrub_maxmss">1460</Option>
<Option name="pf_timeout_frag">30</Option>
<Option name="pf_timeout_interval">10</Option>
<Option name="pix_add_clear_statements">true</Option>
<Option name="pix_assume_fw_part_of_any">true</Option>
<Option name="pix_default_logint">300</Option>
<Option name="pix_emblem_log_format">false</Option>
<Option name="pix_emulate_out_acl">true</Option>
<Option name="pix_floodguard">true</Option>
<Option name="pix_include_comments">true</Option>
<Option name="pix_route_dnat_supported">true</Option>
<Option name="pix_rule_syslog_settings">false</Option>
<Option name="pix_security_fragguard_supported">true</Option>
<Option name="pix_syslog_device_id_supported">false</Option>
<Option name="pix_use_acl_remarks">true</Option>
<Option name="prolog_place">top</Option>
<Option name="prolog_script"></Option>
<Option name="prompt1">$ </Option>
<Option name="prompt2"> # </Option>
<Option name="solaris_ip_forward">1</Option>
<Option name="sshArgs"></Option>
<Option name="ulog_cprange">0</Option>
<Option name="ulog_nlgroup">1</Option>
<Option name="ulog_qthreshold">1</Option>
<Option name="use_ULOG">False</Option>
<Option name="use_iptables_restore">False</Option>
<Option name="use_numeric_log_levels">False</Option>
<Option name="verify_interfaces">True</Option>
</FirewallOptions>
</Firewall>
</ObjectGroup>
<IntervalGroup id="stdid11_1" name="Time">
<Interval comment="" days_of_week="0,1" from_day="-1" from_hour="1" from_minute="1" from_month="-1" from_weekday="0" from_year="-1" id="id3D6864D0" name="test time 1" to_day="-1" to_hour="2" to_minute="2" to_month="-1" to_weekday="1" to_year="-1"/>