* import/PIXImporter.cpp (addLogging): see #2279 Support for import

of ASA access-list lines with log levels and intervals

doc/ChangeLog

@@ -1,5 +1,8 @@
 2011-03-27  vadim  <vadim@netcitadel.com>
 
+	* import/PIXImporter.cpp (addLogging): see #2279 Support for import
+	of ASA access-list lines with log levels and intervals
+
 	* parsers/pix.g (tcp_udp_port_spec): see #2284 fixed import of
 	tcp/udp port ranges using mix of port numbers and port names
 

src/import/Importer.cpp

@@ -181,6 +181,9 @@ void Importer::clear()
     tmp_range_2 = "";
 
     logging = false;
+    log_level = "";
+    log_interval = "";
+
     established = false;
     fragments = false;
 
@@ -534,7 +537,7 @@ void Importer::pushRule()
     addDst();
     addSrv();
 
-    rule->setLogging(logging);
+    addLogging();
 
     // then add it to the current ruleset
     current_ruleset->ruleset->add(current_rule);
@@ -696,6 +699,14 @@ void Importer::addOSrv()
     if (s) srv->addRef( s );
 }
 
+void Importer::addLogging()
+{
+    PolicyRule *rule = PolicyRule::cast(current_rule);
+    rule->setLogging(logging);
+    // log_level
+    // log_interval
+}
+
 Firewall* Importer::finalize()
 {
     return fw;

src/import/Importer.h

@@ -189,6 +189,8 @@ protected:
     virtual void addODst();
     virtual void addOSrv();
 
+    virtual void addLogging();
+    
 public:
 
     // making logger public so I can access it from the code in the grammar
@@ -231,6 +233,9 @@ public:
     QList<int> tcp_flags_comp;
     
     bool  logging;
+    std::string log_level;
+    std::string log_interval;
+    
     bool  established;
     bool  fragments;
 

src/import/PIXImporter.cpp

@@ -49,6 +49,8 @@
 #include "fwbuilder/RuleElement.h"
 #include "fwbuilder/Library.h"
 
+#include "../libgui/platforms.h"
+
 #include <QString>
 #include <QtDebug>
 
@@ -191,6 +193,68 @@ void PIXImporter::setInterfaceAndDirectionForRuleSet(
     *logger << err.arg(QString::fromUtf8(ruleset_name.c_str())).toStdString();
 }
 
+void PIXImporter::addLogging()
+{
+    PolicyRule *rule = PolicyRule::cast(current_rule);
+    FWOptions *ropt = rule->getOptionsObject();
+
+/*
+  alerts         Immediate action needed           (severity=1)
+  critical       Critical conditions               (severity=2)
+  debugging      Debugging messages                (severity=7)
+  disable        Disable log option on this ACL element, (no log at all)
+  emergencies    System is unusable                (severity=0)
+  errors         Error conditions                  (severity=3)
+  inactive       Keyword for disabling an ACL element
+  informational  Informational messages            (severity=6)
+  interval       Configure log interval, default value is 300 sec
+  notifications  Normal but significant conditions (severity=5)
+  warnings       Warning conditions                (severity=4)
+*/
+    QMap<QString, QString> logging_levels;
+
+    logging_levels["alerts"] = "alert";
+    logging_levels["critical"] = "crit";
+    logging_levels["debugging"] = "debug";
+    logging_levels["emergencies"] = "";
+    logging_levels["errors"] = "error";
+    logging_levels["informational"] = "info";
+    logging_levels["notifications"] = "notice";
+    logging_levels["warnings"] = "warning";
+    logging_levels["0"] = "";
+    logging_levels["1"] = "alert";
+    logging_levels["2"] = "crit";
+    logging_levels["3"] = "error";
+    logging_levels["4"] = "warning";
+    logging_levels["5"] = "notice";
+    logging_levels["6"] = "info";
+    logging_levels["7"] = "debug";
+
+    // QStringList log_levels = getLogLevels("pix");
+
+    rule->setLogging(logging);
+
+    QString log_level_qs = log_level.c_str();
+    if ( ! log_level_qs.isEmpty())
+    {
+        if (logging_levels.count(log_level_qs) != 0)
+            ropt->setStr("log_level", logging_levels[log_level_qs].toStdString());
+        else
+            ropt->setStr("log_level", log_level);
+
+        if (log_level_qs == "disable" || log_level_qs == "inactive")
+            ropt->setBool("disable_logging_for_this_rule", true);
+    }
+
+    if ( ! log_interval.empty())
+    {
+        bool ok = false;
+        int log_interval_int = QString(log_interval.c_str()).toInt(&ok);
+        if (ok)
+            ropt->setInt("log_interval", log_interval_int);
+    }
+}
+
 /*
  * Rearrange vlan interfaces. Importer creates all interfaces as
  * children of the firewall. Vlan interfaces should become

src/import/PIXImporter.h

@@ -74,6 +74,8 @@ class PIXImporter : public IOSImporter
     virtual libfwbuilder::FWObject* makeDstObj();
     virtual libfwbuilder::FWObject* makeSrvObj();
 
+    virtual void addLogging();
+    
     /*
      * the difference is that in PIX, we get interface label instead
      * of its name in "access-group" command

src/parsers/PIXCfgLexer.cpp

@@ -511,7 +511,7 @@ void PIXCfgLexer::mNEWLINE(bool _createToken) {
 	
 	}
 	if ( inputState->guessing==0 ) {
-#line 1942 "pix.g"
+#line 1950 "pix.g"
 		newline();
 #line 517 "PIXCfgLexer.cpp"
 	}
@@ -635,7 +635,7 @@ void PIXCfgLexer::mWhitespace(bool _createToken) {
 	}
 	}
 	if ( inputState->guessing==0 ) {
-#line 1937 "pix.g"
+#line 1945 "pix.g"
 		_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
 #line 641 "PIXCfgLexer.cpp"
 	}
@@ -786,7 +786,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 			match("oup");
 			}
 			if ( inputState->guessing==0 ) {
-#line 1994 "pix.g"
+#line 2002 "pix.g"
 				_ttype = OBJECT_GROUP;
 #line 792 "PIXCfgLexer.cpp"
 			}
@@ -794,7 +794,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 		else {
 			match("");
 			if ( inputState->guessing==0 ) {
-#line 1996 "pix.g"
+#line 2004 "pix.g"
 				_ttype = OBJECT;
 #line 800 "PIXCfgLexer.cpp"
 			}
@@ -948,7 +948,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 			}  // ( ... )+
 			}
 			if ( inputState->guessing==0 ) {
-#line 1987 "pix.g"
+#line 1995 "pix.g"
 				_ttype = IPV6;
 #line 954 "PIXCfgLexer.cpp"
 			}
@@ -1095,7 +1095,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 					}  // ( ... )+
 					}
 					if ( inputState->guessing==0 ) {
-#line 1975 "pix.g"
+#line 1983 "pix.g"
 						_ttype = IPV4;
 #line 1101 "PIXCfgLexer.cpp"
 					}
@@ -1178,7 +1178,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}  // ( ... )+
 						}
 						if ( inputState->guessing==0 ) {
-#line 1978 "pix.g"
+#line 1986 "pix.g"
 							_ttype = NUMBER;
 #line 1184 "PIXCfgLexer.cpp"
 						}
@@ -1199,7 +1199,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						_loop293:;
 						}  // ( ... )+
 						if ( inputState->guessing==0 ) {
-#line 1980 "pix.g"
+#line 1988 "pix.g"
 							_ttype = INT_CONST;
 #line 1205 "PIXCfgLexer.cpp"
 						}
@@ -1444,7 +1444,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 				_loop313:;
 				} // ( ... )*
 				if ( inputState->guessing==0 ) {
-#line 2003 "pix.g"
+#line 2011 "pix.g"
 					_ttype = WORD;
 #line 1450 "PIXCfgLexer.cpp"
 				}

src/parsers/pix.g

@@ -1242,10 +1242,18 @@ hostaddr_expr :
 //****************************************************************
 
 
-log : (LOG | LOG_INPUT) ( (INT_CONST (INTERVAL INT_CONST)? )? | WORD )
+log : (LOG | LOG_INPUT)
+      (
+        (level_int:INT_CONST (INTERVAL log_interval:INT_CONST)? )? | level_word:WORD 
+      )
         {
             importer->logging = true;
-            *dbg << "logging ";
+            if (level_int) importer->log_level = level_int->getText();
+            if (level_word) importer->log_level = level_word->getText();
+            if (log_interval) importer->log_interval = log_interval->getText();
+
+            *dbg << "logging " << importer->log_level
+                 << " " << importer->log_interval;
         }
     ;
 

src/unit_tests/ImporterTest/test_data/asa8.3-acl.test

@@ -152,6 +152,8 @@ access-list inside_in  remark 3 (global)
 
 ! logging
 access-list inside_in extended deny   ip any any log 0 interval 300
+access-list inside_in extended deny   ip any any log alerts
+access-list inside_in extended deny   ip any any log disable
 
 
 ! more complex tests: named objects, object groups, inline address and