mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-09-11 07:31:25 +02:00
Support for UserService in compiler for iptables
This commit is contained in:
Vadim Kurland
@@ -1,5 +1,9 @@
|
||||
2008-06-05 Vadim Kurland <vadim@vk.crocodile.org>
|
||||
|
||||
* PolicyCompiler_ipt.cpp (checkUserServiceInWrongChains::processNext):
|
||||
Support for UserService in compiler for iptables. FR #1948872:
|
||||
"User based rules"
|
||||
|
||||
* IPv4Dialog, NetworkDialog, newHostDialog, newFirewallDialog:
|
||||
netmask can be entered as bit length, in addition to the bit mask
|
||||
format supported before. Both formats are recognized. FR #995452,
|
||||
|
||||
@@ -45,6 +45,7 @@
|
||||
#include "fwbuilder/Firewall.h"
|
||||
#include "fwbuilder/Resources.h"
|
||||
#include "fwbuilder/AddressTable.h"
|
||||
#include "fwbuilder/UserService.h"
|
||||
|
||||
#include "fwbuilder/Inet6AddrMask.h"
|
||||
|
||||
@@ -592,7 +593,11 @@ string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv)
|
||||
PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
|
||||
string version=compiler->fw->getStr("version");
|
||||
string s;
|
||||
if (! srv->isAny() && !CustomService::isA(srv) && !TagService::isA(srv))
|
||||
if (! srv->isAny() &&
|
||||
!CustomService::isA(srv) &&
|
||||
!TagService::isA(srv) &&
|
||||
!UserService::isA(srv)
|
||||
)
|
||||
{
|
||||
string pn=srv->getProtocolName();
|
||||
if (pn=="ip") pn="all";
|
||||
@@ -858,6 +863,11 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel)
|
||||
ostr << "-m mark --mark "
|
||||
<< TagService::cast(srv)->getCode() << " ";
|
||||
}
|
||||
if (UserService::isA(srv))
|
||||
{
|
||||
ostr << "-m owner --uid-owner "
|
||||
<< UserService::cast(srv)->getUserId() << " ";
|
||||
}
|
||||
} else
|
||||
{
|
||||
/* use multiport */
|
||||
|
||||
+214
-196
@@ -44,6 +44,7 @@
|
||||
#include "fwbuilder/Network.h"
|
||||
#include "fwbuilder/AddressTable.h"
|
||||
#include "fwbuilder/DNSName.h"
|
||||
#include "fwbuilder/UserService.h"
|
||||
|
||||
#include "combinedAddress.h"
|
||||
|
||||
@@ -3022,6 +3023,26 @@ bool PolicyCompiler_ipt::checkMACinOUTPUTChain::processNext()
|
||||
return true;
|
||||
}
|
||||
|
||||
bool PolicyCompiler_ipt::checkUserServiceInWrongChains::processNext()
|
||||
{
|
||||
PolicyRule *rule=getNext(); if (rule==NULL) return false;
|
||||
Service *srv = compiler->getFirstSrv(rule); assert(srv);
|
||||
string chain = rule->getStr("ipt_chain");
|
||||
string upstream_chain = rule->getStr("upstream_rule_chain");
|
||||
|
||||
if (UserService::cast(srv) != NULL &&
|
||||
chain != "OUTPUT" &&
|
||||
upstream_chain != "OUTPUT")
|
||||
{
|
||||
compiler->warning("Iptables does not support module 'owner' in a chain "
|
||||
"other than OUTPUT; Rule " + rule->getLabel());
|
||||
return true;
|
||||
}
|
||||
|
||||
tmp_queue.push_back(rule);
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
bool PolicyCompiler_ipt::separatePortRanges::processNext()
|
||||
{
|
||||
@@ -3655,58 +3676,57 @@ void PolicyCompiler_ipt::compile()
|
||||
if (ipv6) cout << ", IPv6";
|
||||
cout << endl << flush;
|
||||
|
||||
try {
|
||||
|
||||
Compiler::compile();
|
||||
bool check_for_recursive_groups=true;
|
||||
Compiler::compile();
|
||||
bool check_for_recursive_groups=true;
|
||||
|
||||
addPredefinedPolicyRules();
|
||||
addPredefinedPolicyRules();
|
||||
|
||||
if ( fw->getOptionsObject()->getBool ("check_shading") )
|
||||
{
|
||||
add( new Begin("Detecting rule shadowing"));
|
||||
if ( fw->getOptionsObject()->getBool ("check_shading") )
|
||||
{
|
||||
add( new Begin("Detecting rule shadowing"));
|
||||
|
||||
addRuleFilter();
|
||||
addRuleFilter();
|
||||
|
||||
add( new printTotalNumberOfRules());
|
||||
add( new printTotalNumberOfRules());
|
||||
|
||||
add( new ItfNegation( "process negation in Itf" ) );
|
||||
add( new InterfacePolicyRules(
|
||||
"process interface policy rules and store interface ids"));
|
||||
add( new convertAnyToNotFWForShadowing("convert 'any' to '!fw'" ) );
|
||||
add( new ItfNegation( "process negation in Itf" ) );
|
||||
add( new InterfacePolicyRules(
|
||||
"process interface policy rules and store interface ids"));
|
||||
add( new convertAnyToNotFWForShadowing("convert 'any' to '!fw'" ) );
|
||||
#if 0
|
||||
add( new splitIfSrcAnyForShadowing("split rule if src is any" ) );
|
||||
add( new splitIfDstAnyForShadowing("split rule if dst is any" ) );
|
||||
add( new SrcNegation( true, "process negation in Src" ) );
|
||||
add( new DstNegation( true, "process negation in Dst" ) );
|
||||
add( new splitIfSrcAnyForShadowing("split rule if src is any" ) );
|
||||
add( new splitIfDstAnyForShadowing("split rule if dst is any" ) );
|
||||
add( new SrcNegation( true, "process negation in Src" ) );
|
||||
add( new DstNegation( true, "process negation in Dst" ) );
|
||||
#endif
|
||||
add( new recursiveGroupsInSrc("check for recursive groups in SRC"));
|
||||
add( new recursiveGroupsInDst("check for recursive groups in DST"));
|
||||
add( new recursiveGroupsInSrv("check for recursive groups in SRV"));
|
||||
check_for_recursive_groups=false;
|
||||
add( new recursiveGroupsInSrc("check for recursive groups in SRC"));
|
||||
add( new recursiveGroupsInDst("check for recursive groups in DST"));
|
||||
add( new recursiveGroupsInSrv("check for recursive groups in SRV"));
|
||||
check_for_recursive_groups=false;
|
||||
|
||||
add( new ExpandGroups("expand groups" ) );
|
||||
add( new dropRuleWithEmptyRE(
|
||||
"drop rules with empty rule elements"));
|
||||
add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC") );
|
||||
add( new eliminateDuplicatesInDST("eliminate duplicates in DST") );
|
||||
add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV") );
|
||||
add( new ExpandGroups("expand groups" ) );
|
||||
add( new dropRuleWithEmptyRE(
|
||||
"drop rules with empty rule elements"));
|
||||
add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC") );
|
||||
add( new eliminateDuplicatesInDST("eliminate duplicates in DST") );
|
||||
add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV") );
|
||||
|
||||
add( new swapMultiAddressObjectsInSrc(
|
||||
" swap MultiAddress -> MultiAddressRunTime in Src") );
|
||||
add( new swapMultiAddressObjectsInDst(
|
||||
" swap MultiAddress -> MultiAddressRunTime in Dst") );
|
||||
add( new swapMultiAddressObjectsInSrc(
|
||||
" swap MultiAddress -> MultiAddressRunTime in Src") );
|
||||
add( new swapMultiAddressObjectsInDst(
|
||||
" swap MultiAddress -> MultiAddressRunTime in Dst") );
|
||||
|
||||
/* behavior of processors ExpandMultiple... has been changed in
|
||||
* virtual method _expandInterface */
|
||||
add( new ExpandMultipleAddressesInSRC(
|
||||
"expand objects with multiple addresses in SRC" ) );
|
||||
add( new ExpandMultipleAddressesInDST(
|
||||
"expand objects with multiple addresses in DST" ) );
|
||||
add( new dropRuleWithEmptyRE(
|
||||
"drop rules with empty rule elements"));
|
||||
add( new ExpandMultipleAddressesInSRC(
|
||||
"expand objects with multiple addresses in SRC" ) );
|
||||
add( new ExpandMultipleAddressesInDST(
|
||||
"expand objects with multiple addresses in DST" ) );
|
||||
add( new dropRuleWithEmptyRE(
|
||||
"drop rules with empty rule elements"));
|
||||
|
||||
add( new ConvertToAtomic("convert to atomic rules" ) );
|
||||
add( new ConvertToAtomic("convert to atomic rules" ) );
|
||||
|
||||
/*
|
||||
* This assumes that all rules that go into the mangle table are
|
||||
@@ -3716,64 +3736,64 @@ void PolicyCompiler_ipt::compile()
|
||||
* MARK) are indeed non-terminating.
|
||||
*/
|
||||
|
||||
add( new SkipActionContinueWithNoLogging(
|
||||
"drop rules with action Continue") );
|
||||
add( new SkipActionContinueWithNoLogging(
|
||||
"drop rules with action Continue") );
|
||||
|
||||
if (my_table=="mangle" &&
|
||||
!fw->getOptionsObject()->getBool("classify_mark_terminating")
|
||||
)
|
||||
{
|
||||
add( new dropTerminatingTargets(
|
||||
"Drop rules with terminating targets") );
|
||||
add( new DetectShadowingForNonTerminatingRules(
|
||||
"Detect shadowing for non-terminating rules" ) );
|
||||
} else
|
||||
add( new DetectShadowing("Detect shadowing" ) );
|
||||
if (my_table=="mangle" &&
|
||||
!fw->getOptionsObject()->getBool("classify_mark_terminating")
|
||||
)
|
||||
{
|
||||
add( new dropTerminatingTargets(
|
||||
"Drop rules with terminating targets") );
|
||||
add( new DetectShadowingForNonTerminatingRules(
|
||||
"Detect shadowing for non-terminating rules" ) );
|
||||
} else
|
||||
add( new DetectShadowing("Detect shadowing" ) );
|
||||
|
||||
add( new simplePrintProgress() );
|
||||
add( new simplePrintProgress() );
|
||||
|
||||
runRuleProcessors();
|
||||
deleteRuleProcessors();
|
||||
}
|
||||
runRuleProcessors();
|
||||
deleteRuleProcessors();
|
||||
}
|
||||
|
||||
|
||||
add( new PolicyCompiler::Begin() );
|
||||
add( new addPredefinedRules("Add some predefined rules" ) );
|
||||
add( new PolicyCompiler::Begin() );
|
||||
add( new addPredefinedRules("Add some predefined rules" ) );
|
||||
|
||||
addRuleFilter();
|
||||
addRuleFilter();
|
||||
|
||||
add( new printTotalNumberOfRules( ) );
|
||||
add( new printTotalNumberOfRules( ) );
|
||||
|
||||
add( new Route("process route rules" ) );
|
||||
add( new storeAction("store original action of this rule" ) );
|
||||
add( new Route("process route rules" ) );
|
||||
add( new storeAction("store original action of this rule" ) );
|
||||
|
||||
add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
|
||||
//add( new setChainForMangle("set chain for other rules in mangle"));
|
||||
add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
|
||||
//add( new setChainForMangle("set chain for other rules in mangle"));
|
||||
|
||||
add( new Logging1("check global logging override option" ) );
|
||||
add( new ItfNegation("process negation in Itf" ) );
|
||||
add( new Logging1("check global logging override option" ) );
|
||||
add( new ItfNegation("process negation in Itf" ) );
|
||||
|
||||
// add( new InterfacePolicyRulesWithOptimization("process interface policy rules and store interface ids") );
|
||||
|
||||
add( new decideOnChainForClassify("set chain for action is Classify") );
|
||||
add( new decideOnChainForClassify("set chain for action is Classify") );
|
||||
|
||||
add( new InterfaceAndDirection("fill in interface and direction" ) );
|
||||
add( new InterfaceAndDirection("fill in interface and direction" ) );
|
||||
|
||||
// if an action requires chain POSTROUTING (e.g. Classify), set chain
|
||||
// BEFORE calling splitIfIfaceAndDirectionBoth
|
||||
add( new splitIfIfaceAndDirectionBoth(
|
||||
"split interface rule with direction 'both'"));
|
||||
add( new splitIfIfaceAndDirectionBoth(
|
||||
"split interface rule with direction 'both'"));
|
||||
|
||||
if (check_for_recursive_groups)
|
||||
{
|
||||
add( new recursiveGroupsInSrc("check for recursive groups in SRC"));
|
||||
add( new recursiveGroupsInDst("check for recursive groups in DST"));
|
||||
add( new recursiveGroupsInSrv("check for recursive groups in SRV"));
|
||||
}
|
||||
if (check_for_recursive_groups)
|
||||
{
|
||||
add( new recursiveGroupsInSrc("check for recursive groups in SRC"));
|
||||
add( new recursiveGroupsInDst("check for recursive groups in DST"));
|
||||
add( new recursiveGroupsInSrv("check for recursive groups in SRV"));
|
||||
}
|
||||
|
||||
add( new emptyGroupsInSrc("check for empty groups in SRC" ) );
|
||||
add( new emptyGroupsInDst("check for empty groups in DST" ) );
|
||||
add( new emptyGroupsInSrv("check for empty groups in SRV" ) );
|
||||
add( new emptyGroupsInSrc("check for empty groups in SRC" ) );
|
||||
add( new emptyGroupsInDst("check for empty groups in DST" ) );
|
||||
add( new emptyGroupsInSrv("check for empty groups in SRV" ) );
|
||||
/*
|
||||
* commented out to fix bug #727324. "-p tcp --destination-port ! 25"
|
||||
* means "all TCP with port != 25", which is not the same as "all
|
||||
@@ -3782,38 +3802,38 @@ void PolicyCompiler_ipt::compile()
|
||||
* element.
|
||||
*/
|
||||
// add( new singleSrvNegation("negation in Srv if it holds 1 object"));
|
||||
add( new splitRuleIfSrvAnyActionReject(
|
||||
"split rule if action is reject and srv is any" ) );
|
||||
add( new SrvNegation( false, "process negation in Srv" ) );
|
||||
add( new expandGroupsInSrv("expand groups in Srv" ));
|
||||
add( new splitRuleIfSrvAnyActionReject(
|
||||
"split rule if action is reject and srv is any" ) );
|
||||
add( new SrvNegation( false, "process negation in Srv" ) );
|
||||
add( new expandGroupsInSrv("expand groups in Srv" ));
|
||||
|
||||
add( new CheckForTCPEstablished("TCPService with \"established\"") );
|
||||
add( new CheckForTCPEstablished("TCPService with \"established\"") );
|
||||
|
||||
// add( new splitRuleIfSrvAnyActionReject(
|
||||
// "split rule if action is reject and srv is any" ) );
|
||||
add( new fillActionOnReject("fill in action_on_reject" ) );
|
||||
add( new splitServicesIfRejectWithTCPReset(
|
||||
"check and split if action on reject is TCP reset"));
|
||||
add( new fillActionOnReject("fill in action_on_reject 2" ) );
|
||||
add( new splitServicesIfRejectWithTCPReset(
|
||||
"check and split if action on reject is TCP reset 2"));
|
||||
add( new singleSrcNegation(
|
||||
"process negation in Src if it holds single object" ) );
|
||||
add( new singleDstNegation(
|
||||
"process negation in Dst if it holds single object" ) );
|
||||
add( new fillActionOnReject("fill in action_on_reject" ) );
|
||||
add( new splitServicesIfRejectWithTCPReset(
|
||||
"check and split if action on reject is TCP reset"));
|
||||
add( new fillActionOnReject("fill in action_on_reject 2" ) );
|
||||
add( new splitServicesIfRejectWithTCPReset(
|
||||
"check and split if action on reject is TCP reset 2"));
|
||||
add( new singleSrcNegation(
|
||||
"process negation in Src if it holds single object" ) );
|
||||
add( new singleDstNegation(
|
||||
"process negation in Dst if it holds single object" ) );
|
||||
|
||||
/*
|
||||
* phased out these processors, they are not needed anymore because we use variable
|
||||
* for dynamic interfaces.
|
||||
*/
|
||||
add( new splitIfSrcNegAndFw("split rule if src has negation and fw"));
|
||||
add( new splitIfDstNegAndFw("split rule if dst has negation and fw"));
|
||||
add( new splitIfSrcNegAndFw("split rule if src has negation and fw"));
|
||||
add( new splitIfDstNegAndFw("split rule if dst has negation and fw"));
|
||||
|
||||
add( new SrcNegation( false, "process negation in Src" ));
|
||||
add( new DstNegation( false, "process negation in Dst" ));
|
||||
add( new TimeNegation( false, "process negation in Time" ));
|
||||
add( new SrcNegation( false, "process negation in Src" ));
|
||||
add( new DstNegation( false, "process negation in Dst" ));
|
||||
add( new TimeNegation( false, "process negation in Time" ));
|
||||
|
||||
add( new Logging2( "process logging" ));
|
||||
add( new Logging2( "process logging" ));
|
||||
|
||||
/* this is just a patch for those who do not understand how does
|
||||
* "assume firewall is part of any" work. It also eliminates redundant
|
||||
@@ -3822,172 +3842,170 @@ void PolicyCompiler_ipt::compile()
|
||||
*/
|
||||
// add( new decideOnChainIfLoopback("any-any rule on loopback" ) );
|
||||
|
||||
add( new splitIfSrcAny("split rule if src is any") );
|
||||
add( new splitIfSrcAny("split rule if src is any") );
|
||||
|
||||
add( new setChainForMangle("set chain for other rules in mangle"));
|
||||
add( new setChainForMangle("set chain for other rules in mangle"));
|
||||
|
||||
// call setChainPreroutingForTag before splitIfDstAny
|
||||
add( new setChainPreroutingForTag("chain PREROUTING for Tag"));
|
||||
// call setChainPreroutingForTag before splitIfDstAny
|
||||
add( new setChainPreroutingForTag("chain PREROUTING for Tag"));
|
||||
|
||||
add( new splitIfDstAny("split rule if dst is any") );
|
||||
add( new splitIfDstAny("split rule if dst is any") );
|
||||
|
||||
add( new setChainPostroutingForTag("chain POSTROUTING for Tag"));
|
||||
add( new setChainPostroutingForTag("chain POSTROUTING for Tag"));
|
||||
|
||||
add( new ExpandGroups( "expand all groups" ));
|
||||
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
|
||||
add( new ExpandGroups( "expand all groups" ));
|
||||
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
|
||||
|
||||
add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC" ));
|
||||
add( new eliminateDuplicatesInDST("eliminate duplicates in DST" ));
|
||||
add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV" ));
|
||||
add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC" ));
|
||||
add( new eliminateDuplicatesInDST("eliminate duplicates in DST" ));
|
||||
add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV" ));
|
||||
|
||||
add( new swapMultiAddressObjectsInSrc(
|
||||
" swap MultiAddress -> MultiAddressRunTime in Src"));
|
||||
add( new swapMultiAddressObjectsInDst(
|
||||
" swap MultiAddress -> MultiAddressRunTime in Dst"));
|
||||
add( new swapMultiAddressObjectsInSrc(
|
||||
" swap MultiAddress -> MultiAddressRunTime in Src"));
|
||||
add( new swapMultiAddressObjectsInDst(
|
||||
" swap MultiAddress -> MultiAddressRunTime in Dst"));
|
||||
|
||||
add( new processMultiAddressObjectsInSrc(
|
||||
"process MultiAddress objects in Src"));
|
||||
add( new processMultiAddressObjectsInDst(
|
||||
"process MultiAddress objects in Dst"));
|
||||
add( new processMultiAddressObjectsInSrc(
|
||||
"process MultiAddress objects in Src"));
|
||||
add( new processMultiAddressObjectsInDst(
|
||||
"process MultiAddress objects in Dst"));
|
||||
|
||||
/*
|
||||
* should expand address range before splitIfSrcMatchesFw because some
|
||||
* addresses in the range may match firewall
|
||||
*/
|
||||
add( new addressRanges( "process address ranges" ) );
|
||||
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
|
||||
add( new addressRanges( "process address ranges" ) );
|
||||
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
|
||||
|
||||
add( new splitIfSrcMatchesFw( "split rule if src matches FW" ) );
|
||||
add( new splitIfDstMatchesFw( "split rule if dst matches FW" ) );
|
||||
add( new splitIfSrcMatchesFw( "split rule if src matches FW" ) );
|
||||
add( new splitIfDstMatchesFw( "split rule if dst matches FW" ) );
|
||||
|
||||
/* at this point in all rules where firewall is in either src or dst,
|
||||
* firewall is a single object in that rule element. Other rule
|
||||
* elements may contain multiple objects yet
|
||||
*/
|
||||
|
||||
add( new specialCaseWithFW1( "special case with firewall" ) );
|
||||
add( new specialCaseWithFW1( "special case with firewall" ) );
|
||||
|
||||
add( new decideOnChainIfDstFW( "decide on chain if Dst has fw" ) );
|
||||
add( new splitIfSrcFWNetwork(
|
||||
"split rule if src has a net fw has interface on" ) );
|
||||
add( new decideOnChainIfDstFW( "decide on chain if Dst has fw" ) );
|
||||
add( new splitIfSrcFWNetwork(
|
||||
"split rule if src has a net fw has interface on" ) );
|
||||
|
||||
add( new decideOnChainIfSrcFW( "decide on chain if Src has fw" ) );
|
||||
add( new splitIfDstFWNetwork(
|
||||
"split rule if dst has a net fw has interface on" ) );
|
||||
add( new decideOnChainIfSrcFW( "decide on chain if Src has fw" ) );
|
||||
add( new splitIfDstFWNetwork(
|
||||
"split rule if dst has a net fw has interface on" ) );
|
||||
|
||||
add( new specialCaseWithFW2(
|
||||
"replace fw with its interfaces if src==dst==fw" ) );
|
||||
add( new specialCaseWithFW2(
|
||||
"replace fw with its interfaces if src==dst==fw" ) );
|
||||
|
||||
/* behavior of processors ExpandMultiple... has been changed in the
|
||||
* virtual method expandInterface
|
||||
*/
|
||||
add( new expandMultipleAddressesIfNotFWinSrc(
|
||||
"expand multiple addresses if not FW in Src") );
|
||||
add( new expandMultipleAddressesIfNotFWinDst(
|
||||
"expand multiple addresses if not FW in Dst") );
|
||||
add( new expandLoopbackInterfaceAddress(
|
||||
"check for loopback interface in the rule objects") );
|
||||
add( new expandMultipleAddressesIfNotFWinSrc(
|
||||
"expand multiple addresses if not FW in Src") );
|
||||
add( new expandMultipleAddressesIfNotFWinDst(
|
||||
"expand multiple addresses if not FW in Dst") );
|
||||
add( new expandLoopbackInterfaceAddress(
|
||||
"check for loopback interface in the rule objects") );
|
||||
|
||||
// processors that expand objects with multiple addresses
|
||||
// check addresses against current address family using member
|
||||
// ipv6. If all addresses do not match, we may end up with
|
||||
// empty rule element.
|
||||
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
|
||||
// processors that expand objects with multiple addresses
|
||||
// check addresses against current address family using member
|
||||
// ipv6. If all addresses do not match, we may end up with
|
||||
// empty rule element.
|
||||
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
|
||||
|
||||
if (ipv6)
|
||||
add( new DropIPv4Rules("drop ipv4 rules"));
|
||||
else
|
||||
add( new DropIPv6Rules("drop ipv6 rules"));
|
||||
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
|
||||
if (ipv6)
|
||||
add( new DropIPv4Rules("drop ipv4 rules"));
|
||||
else
|
||||
add( new DropIPv6Rules("drop ipv6 rules"));
|
||||
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
|
||||
|
||||
// trying process rules with multiple interfaces as late as possible
|
||||
add( new InterfacePolicyRulesWithOptimization(
|
||||
"process interface policy rules and store interface ids") );
|
||||
add( new InterfacePolicyRulesWithOptimization(
|
||||
"process interface policy rules and store interface ids") );
|
||||
|
||||
/* this is just a patch for those who do not understand how does
|
||||
* "assume firewall is part of any" work. It also eliminates redundant
|
||||
* and useless rules in the FORWARD chain for rules assigned to a
|
||||
* loopback interface.
|
||||
*/
|
||||
add( new decideOnChainIfLoopback("any-any rule on loopback" ) );
|
||||
add( new decideOnChainIfLoopback("any-any rule on loopback" ) );
|
||||
|
||||
// add( new decideOnChainForClassify("set chain if action is Classify"));
|
||||
add( new finalizeChain( "decide on chain" ) );
|
||||
add( new decideOnTarget( "decide on target" ) );
|
||||
add( new finalizeChain( "decide on chain" ) );
|
||||
add( new decideOnTarget( "decide on target" ) );
|
||||
|
||||
add( new checkForRestoreMarkInOutput(
|
||||
"check if we need -A OUTPUT -j CONNMARK --restore-mark"));
|
||||
add( new checkForRestoreMarkInOutput(
|
||||
"check if we need -A OUTPUT -j CONNMARK --restore-mark"));
|
||||
|
||||
/*
|
||||
* removed call to processor removeFW to make changes for bug #685947:
|
||||
* "Rules with firewall object allow too much. "
|
||||
*/
|
||||
add( new removeFW( "remove fw" ) );
|
||||
add( new removeFW( "remove fw" ) );
|
||||
|
||||
add( new ExpandMultipleAddresses("expand multiple addresses" ) );
|
||||
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
|
||||
add( new ExpandMultipleAddresses("expand multiple addresses" ) );
|
||||
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
|
||||
|
||||
add( new checkForUnnumbered("check for unnumbered interfaces" ) );
|
||||
add( new checkForDynamicInterfacesOfOtherObjects(
|
||||
"check for dynamic interfaces of other hosts and firewalls"));
|
||||
add( new checkForUnnumbered("check for unnumbered interfaces" ) );
|
||||
add( new checkForDynamicInterfacesOfOtherObjects(
|
||||
"check for dynamic interfaces of other hosts and firewalls"));
|
||||
|
||||
if ( fwopt->getBool("bridging_fw") )
|
||||
add( new bridgingFw("handle bridging firewall cases"));
|
||||
if ( fwopt->getBool("bridging_fw") )
|
||||
add( new bridgingFw("handle bridging firewall cases"));
|
||||
|
||||
add( new specialCaseWithUnnumberedInterface(
|
||||
"check for a special cases with unnumbered interface" ) );
|
||||
add( new specialCaseWithUnnumberedInterface(
|
||||
"check for a special cases with unnumbered interface" ) );
|
||||
|
||||
// add( new splitServices( "split on services" ) );
|
||||
// add( new prepareForMultiport("prepare for multiport" ) );
|
||||
|
||||
add( new optimize1( "optimization 1, pass 1" ) );
|
||||
add( new optimize1( "optimization 1, pass 2" ) );
|
||||
add( new optimize1( "optimization 1, pass 3" ) );
|
||||
add( new optimize1( "optimization 1, pass 1" ) );
|
||||
add( new optimize1( "optimization 1, pass 2" ) );
|
||||
add( new optimize1( "optimization 1, pass 3" ) );
|
||||
|
||||
|
||||
add( new splitServices( "split on services" ));
|
||||
add( new separateTCPWithFlags( "split on TCP services with flags" ));
|
||||
add( new verifyCustomServices( "verify custom services" ));
|
||||
add( new specialCasesWithCustomServices(
|
||||
"scpecial cases with some custom services" ) );
|
||||
add( new separatePortRanges( "separate port ranges" ));
|
||||
add( new separateSrcPort( "split on TCP and UDP with source ports"));
|
||||
add( new splitServices( "split on services" ));
|
||||
add( new separateTCPWithFlags( "split on TCP services with flags" ));
|
||||
add( new verifyCustomServices( "verify custom services" ));
|
||||
add( new specialCasesWithCustomServices(
|
||||
"scpecial cases with some custom services" ) );
|
||||
add( new separatePortRanges( "separate port ranges" ));
|
||||
add( new separateSrcPort( "split on TCP and UDP with source ports"));
|
||||
|
||||
// add( new optimize1( "optimization 1, pass 1" ) );
|
||||
// add( new optimize1( "optimization 1, pass 2" ) );
|
||||
add( new optimize2( "optimization 2" ) );
|
||||
add( new accounting( "Accounting" ) );
|
||||
add( new prepareForMultiport("prepare for multiport" ) );
|
||||
add( new optimize2( "optimization 2" ) );
|
||||
add( new accounting( "Accounting" ) );
|
||||
add( new prepareForMultiport("prepare for multiport" ) );
|
||||
|
||||
add( new splitNonTerminatingTargets(
|
||||
"split rules using non-terminating targets" ) );
|
||||
add( new splitNonTerminatingTargets(
|
||||
"split rules using non-terminating targets" ) );
|
||||
|
||||
add( new ConvertToAtomicForAddresses(
|
||||
"convert to atomic rules by address elements") );
|
||||
add( new ConvertToAtomicForAddresses(
|
||||
"convert to atomic rules by address elements") );
|
||||
|
||||
add( new checkForZeroAddr("check for zero addresses") );
|
||||
add( new checkMACinOUTPUTChain("check for MAC in OUTPUT chain") );
|
||||
add( new checkForZeroAddr("check for zero addresses") );
|
||||
add( new checkMACinOUTPUTChain("check for MAC in OUTPUT chain") );
|
||||
add( new checkUserServiceInWrongChains(
|
||||
"Check for UserSErvice ojects in chains other than OUTPUT"));
|
||||
|
||||
add( new ConvertToAtomicForIntervals(
|
||||
"convert to atomic rules by interval element") );
|
||||
add( new ConvertToAtomicForIntervals(
|
||||
"convert to atomic rules by interval element") );
|
||||
|
||||
add( new SkipActionContinueWithNoLogging(
|
||||
"drop rules with action Continue") );
|
||||
add( new convertInterfaceIdToStr("prepare interface assignments") );
|
||||
add( new optimize3("optimization 3") );
|
||||
add( new SkipActionContinueWithNoLogging(
|
||||
"drop rules with action Continue") );
|
||||
add( new convertInterfaceIdToStr("prepare interface assignments") );
|
||||
add( new optimize3("optimization 3") );
|
||||
|
||||
add( new countChainUsage("Count chain usage"));
|
||||
add( new countChainUsage("Count chain usage"));
|
||||
|
||||
add( createPrintRuleProcessor() );
|
||||
add( createPrintRuleProcessor() );
|
||||
|
||||
add( new simplePrintProgress());
|
||||
add( new simplePrintProgress());
|
||||
|
||||
runRuleProcessors();
|
||||
runRuleProcessors();
|
||||
|
||||
} catch (FWException &ex) {
|
||||
error(ex.toString());
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
string PolicyCompiler_ipt::debugPrintRule(Rule *r)
|
||||
|
||||
@@ -638,6 +638,12 @@ namespace fwcompiler {
|
||||
*/
|
||||
DECLARE_POLICY_RULE_PROCESSOR(checkMACinOUTPUTChain);
|
||||
|
||||
/**
|
||||
* iptables permits using "--m owner --uid-owner" only in
|
||||
* the OUTPUT chain
|
||||
*/
|
||||
DECLARE_POLICY_RULE_PROCESSOR(checkUserServiceInWrongChains);
|
||||
|
||||
|
||||
/**
|
||||
* expand groups in Srv
|
||||
|
||||
+3
-1
@@ -972,13 +972,15 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
|
||||
cerr << "Error while opening or writing to the output file" << endl;
|
||||
return 1;
|
||||
#endif
|
||||
|
||||
} catch (const std::string &s) {
|
||||
cerr << s << endl;
|
||||
return 1;
|
||||
} catch (const std::exception &ex) {
|
||||
cerr << ex.what() << endl;
|
||||
return 1;
|
||||
} catch (...) {
|
||||
}
|
||||
catch (...) {
|
||||
cerr << _("Unsupported exception") << endl;
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
|
||||
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1212696652" id="root">
|
||||
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1212717910" id="root">
|
||||
<Library color="#d2ffd0" comment="User defined objects" id="syslib001" name="User">
|
||||
<ObjectGroup id="stdid01_1" name="Objects">
|
||||
<ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables">
|
||||
<AddressTable comment="" filename="/home/vadim/Projects/fwb2.1/fwb2/fwbuilder2/test/ipt/addr-table-1.tbl" id="id4385C1081434" name="addrtbl 1" run_time="False"/>
|
||||
<AddressTable comment="" filename="addr-table-1.tbl" id="id4385C1081434" name="addrtbl 1" run_time="False"/>
|
||||
<AddressTable comment="" filename="addr-table-1.tbl" id="id4389EE9018346" name="addr-table-1" run_time="False"/>
|
||||
<AddressTable comment="this is run-time table" filename="block-hosts.tbl" id="id4389EE9118346" name="block these" run_time="True"/>
|
||||
<AddressTable comment="the name contains character that is special to shell" filename="/home/vadim/tmp/bug-1544488/addr-table-1.tbl" id="id44F7056328576" name="atbl.1" run_time="True"/>
|
||||
@@ -847,7 +847,10 @@
|
||||
</ObjectGroup>
|
||||
</ObjectGroup>
|
||||
<ServiceGroup id="stdid05_1" name="Services">
|
||||
<ServiceGroup id="stdid05_1_userservices" name="Users"/>
|
||||
<ServiceGroup id="stdid05_1_userservices" name="Users">
|
||||
<UserService comment="" id="id4849253720246" name="user500" userid="500"/>
|
||||
<UserService comment="" id="id4849253820246" name="user2000" userid="2000"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="stdid05_1_og_tag_1" name="TagServices">
|
||||
<TagService comment="" id="id43EC877332486" name="tag16" tagcode="16"/>
|
||||
<TagService comment="" id="id449328D824380" name="Tag1" tagcode="1"/>
|
||||
@@ -16629,7 +16632,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
|
||||
<Option name="verify_interfaces">False</Option>
|
||||
</FirewallOptions>
|
||||
</Firewall>
|
||||
<Firewall comment="testing AddressTable" host_OS="linux24" id="id43868A331434" lastCompiled="1188097112" lastInstalled="1142003872" lastModified="0" name="firewall32" platform="iptables" ro="False" version="">
|
||||
<Firewall comment="testing AddressTable" host_OS="linux24" id="id43868A331434" lastCompiled="1188097112" lastInstalled="1142003872" lastModified="1212717910" name="firewall32" platform="iptables" ro="False" version="">
|
||||
<NAT id="id43868A6D1434" name="NAT">
|
||||
<NATRule disabled="False" id="id43868A6E1434" position="0">
|
||||
<OSrc neg="False">
|
||||
@@ -25669,6 +25672,327 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
|
||||
<Option name="verify_interfaces">False</Option>
|
||||
</FirewallOptions>
|
||||
</Firewall>
|
||||
<Firewall comment="testing rules using UserService object Note that iptables does not allow entering iptables command that tries to match using module 'owner' in any chain other than OUTPUT. This includes user defined chains too (it checks how control passes to user defined chain and blocks command if it appears that user defined chain gets control not from OUTPUT) " host_OS="linux24" id="id4848F19020246" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1212717699" name="firewall62" platform="iptables" ro="False" version="1.4.0">
|
||||
<NAT id="id4848F1D320246" name="NAT"/>
|
||||
<Policy id="id4848F19620246" name="Policy">
|
||||
<PolicyRule action="Accept" comment="OUTPUT and INPUT chains" direction="Both" disabled="False" id="id4848F19720246" log="False" position="0">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id4848F19020246"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="id4849253820246"/>
|
||||
</Srv>
|
||||
<Itf neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Itf>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="stateless">False</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="OUTPUT chain" direction="Outbound" disabled="False" group="" id="id484A8D2620246" log="False" position="1">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id4848F19020246"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="id4849253820246"/>
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<Itf neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Itf>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="stateless">False</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="OUTPUT and INPUT chains" direction="Both" disabled="False" group="" id="id484A599620246" log="False" position="2">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id4848F19020246"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="id4849253820246"/>
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<Itf neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Itf>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="stateless">False</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="OUTPUT chain" direction="Outbound" disabled="False" group="" id="id484A8D3820246" log="False" position="3">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id4848F19020246"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="id4849253820246"/>
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<Itf neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Itf>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="stateless">False</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="OUTPUT and INPUT chains (b/c direction is Both)" direction="Both" disabled="False" group="" id="id4848F1A320246" log="False" position="4">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id4848F1D520246"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="id4849253820246"/>
|
||||
</Srv>
|
||||
<Itf neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Itf>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="stateless">False</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="INPUT, OUTPUT and FORWARD chain UserService can be used only in OUTPUT" direction="Both" disabled="False" group="" id="id4848F1AF20246" log="False" position="5">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3CEBFDFC"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="id4849253820246"/>
|
||||
</Srv>
|
||||
<Itf neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Itf>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="stateless">False</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="INPUT and OUTPUT chain User Service can be used in OUTPUT" direction="Both" disabled="False" group="" id="id4848F1BB20246" log="False" position="6">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id4848F19020246"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="id4849253820246"/>
|
||||
</Srv>
|
||||
<Itf neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Itf>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="stateless">False</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="INPUT chain, UserService can not be used" direction="Inbound" disabled="False" group="" id="id484AF47A20246" log="False" position="7">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id4848F19020246"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="id4849253820246"/>
|
||||
</Srv>
|
||||
<Itf neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Itf>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="stateless">False</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A261420246" log="False" position="8">
|
||||
<Src neg="True">
|
||||
<ObjectRef ref="id3CEBFDFC"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="id4849253820246"/>
|
||||
</Srv>
|
||||
<Itf neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Itf>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="stateless">False</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A260320246" log="False" position="9">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="True">
|
||||
<ObjectRef ref="id4848F19020246"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="id4849253820246"/>
|
||||
</Srv>
|
||||
<Itf neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Itf>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="stateless">False</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Deny" direction="Both" disabled="False" id="id4848F1C720246" log="False" position="10">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<Itf neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Itf>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="stateless">True</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
</Policy>
|
||||
<Routing id="id4848F1D420246" name="Routing"/>
|
||||
<Interface bridgeport="False" comment="" dyn="False" id="id4848F1D520246" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
|
||||
<IPv4 comment="" id="id4848F1D720246" name="firewall62:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
|
||||
</Interface>
|
||||
<Interface bridgeport="False" comment="" dyn="False" id="id4848F1D820246" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
|
||||
<IPv4 comment="" id="id4848F1DA20246" name="firewall62:eth1:ip" address="222.222.222.222" netmask="255.255.255.0"/>
|
||||
</Interface>
|
||||
<Management address="192.168.1.1">
|
||||
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="False" identity="" port="-1"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<FirewallOptions>
|
||||
<Option name="accept_established">True</Option>
|
||||
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
||||
<Option name="action_on_reject"></Option>
|
||||
<Option name="activationCmd"></Option>
|
||||
<Option name="add_check_state_rule">true</Option>
|
||||
<Option name="admUser"></Option>
|
||||
<Option name="altAddress"></Option>
|
||||
<Option name="bridging_fw">False</Option>
|
||||
<Option name="check_shading">True</Option>
|
||||
<Option name="clamp_mss_to_mtu">False</Option>
|
||||
<Option name="classify_mark_terminating">False</Option>
|
||||
<Option name="cmdline"></Option>
|
||||
<Option name="compiler"></Option>
|
||||
<Option name="configure_interfaces">True</Option>
|
||||
<Option name="debug">False</Option>
|
||||
<Option name="drop_invalid">False</Option>
|
||||
<Option name="eliminate_duplicates">true</Option>
|
||||
<Option name="enable_ipv6">False</Option>
|
||||
<Option name="epilog_script"></Option>
|
||||
<Option name="firewall_dir">/etc</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
||||
<Option name="freebsd_ip_forward">1</Option>
|
||||
<Option name="ignore_empty_groups">False</Option>
|
||||
<Option name="in_out_code">true</Option>
|
||||
<Option name="iosacl_add_clear_statements">true</Option>
|
||||
<Option name="iosacl_assume_fw_part_of_any">true</Option>
|
||||
<Option name="iosacl_include_comments">true</Option>
|
||||
<Option name="ipv4_6_order">ipv4_first</Option>
|
||||
<Option name="limit_suffix"></Option>
|
||||
<Option name="limit_value">0</Option>
|
||||
<Option name="linux24_ip_forward">1</Option>
|
||||
<Option name="load_modules">True</Option>
|
||||
<Option name="local_nat">False</Option>
|
||||
<Option name="log_all">False</Option>
|
||||
<Option name="log_invalid">False</Option>
|
||||
<Option name="log_ip_opt">False</Option>
|
||||
<Option name="log_level">info</Option>
|
||||
<Option name="log_prefix">RULE %N -- %A </Option>
|
||||
<Option name="log_tcp_opt">False</Option>
|
||||
<Option name="log_tcp_seq">False</Option>
|
||||
<Option name="loopback_interface">lo0</Option>
|
||||
<Option name="macosx_ip_forward">1</Option>
|
||||
<Option name="manage_virtual_addr">True</Option>
|
||||
<Option name="mgmt_addr"></Option>
|
||||
<Option name="mgmt_ssh">False</Option>
|
||||
<Option name="no_ipv6_default_policy">False</Option>
|
||||
<Option name="openbsd_ip_forward">1</Option>
|
||||
<Option name="output_file"></Option>
|
||||
<Option name="pass_all_out">false</Option>
|
||||
<Option name="pf_limit_frags">5000</Option>
|
||||
<Option name="pf_limit_states">10000</Option>
|
||||
<Option name="pf_scrub_maxmss">1460</Option>
|
||||
<Option name="pf_timeout_frag">30</Option>
|
||||
<Option name="pf_timeout_interval">10</Option>
|
||||
<Option name="pix_add_clear_statements">true</Option>
|
||||
<Option name="pix_assume_fw_part_of_any">true</Option>
|
||||
<Option name="pix_default_logint">300</Option>
|
||||
<Option name="pix_emblem_log_format">false</Option>
|
||||
<Option name="pix_emulate_out_acl">true</Option>
|
||||
<Option name="pix_floodguard">true</Option>
|
||||
<Option name="pix_include_comments">true</Option>
|
||||
<Option name="pix_route_dnat_supported">true</Option>
|
||||
<Option name="pix_rule_syslog_settings">false</Option>
|
||||
<Option name="pix_security_fragguard_supported">true</Option>
|
||||
<Option name="pix_syslog_device_id_supported">false</Option>
|
||||
<Option name="pix_use_acl_remarks">true</Option>
|
||||
<Option name="prolog_place">top</Option>
|
||||
<Option name="prolog_script"></Option>
|
||||
<Option name="prompt1">$ </Option>
|
||||
<Option name="prompt2"> # </Option>
|
||||
<Option name="solaris_ip_forward">1</Option>
|
||||
<Option name="sshArgs"></Option>
|
||||
<Option name="ulog_cprange">0</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
<Option name="ulog_qthreshold">1</Option>
|
||||
<Option name="use_ULOG">False</Option>
|
||||
<Option name="use_iptables_restore">False</Option>
|
||||
<Option name="use_numeric_log_levels">False</Option>
|
||||
<Option name="verify_interfaces">True</Option>
|
||||
</FirewallOptions>
|
||||
</Firewall>
|
||||
</ObjectGroup>
|
||||
<IntervalGroup id="stdid11_1" name="Time">
|
||||
<Interval comment="" days_of_week="0,1" from_day="-1" from_hour="1" from_minute="1" from_month="-1" from_weekday="0" from_year="-1" id="id3D6864D0" name="test time 1" to_day="-1" to_hour="2" to_minute="2" to_month="-1" to_weekday="1" to_year="-1"/>
|
||||
|
||||
Reference in New Issue
Block a user