onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-10 23:22:33 +02:00
Code Issues Releases Wiki Activity

* import/PIXImporter.cpp (addLogging): see #2279 Support for import

Browse Source 
of ASA access-list lines with log levels and intervals
This commit is contained in:
Vadim Kurland
2011-03-27 19:10:34 -07:00
parent f61cc9d8bf
commit 3f8323a755
9 changed files with 290 additions and 288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/ChangeLog
+3
View File
@@ -1,5 +1,8 @@
2011-03-27 vadim <vadim@netcitadel.com>
* import/PIXImporter.cpp (addLogging): see #2279 Support for import
of ASA access-list lines with log levels and intervals
* parsers/pix.g (tcp_udp_port_spec): see #2284 fixed import of
tcp/udp port ranges using mix of port numbers and port names
src/import/Importer.cpp
+12 -1
View File
@@ -181,6 +181,9 @@ void Importer::clear()
tmp_range_2 = "";
logging = false;
log_level = "";
log_interval = "";
established = false;
fragments = false;
@@ -534,7 +537,7 @@ void Importer::pushRule()
addDst();
addSrv();
rule->setLogging(logging);
addLogging();
// then add it to the current ruleset
current_ruleset->ruleset->add(current_rule);
@@ -696,6 +699,14 @@ void Importer::addOSrv()
if (s) srv->addRef( s );
}
void Importer::addLogging()
{
PolicyRule *rule = PolicyRule::cast(current_rule);
rule->setLogging(logging);
// log_level
// log_interval
}
Firewall* Importer::finalize()
{
return fw;
src/import/Importer.h
+5
View File
@@ -189,6 +189,8 @@ protected:
virtual void addODst();
virtual void addOSrv();
virtual void addLogging();
public:
// making logger public so I can access it from the code in the grammar
@@ -231,6 +233,9 @@ public:
QList<int> tcp_flags_comp;
bool logging;
std::string log_level;
std::string log_interval;
bool established;
bool fragments;
src/import/PIXImporter.cpp
+64
View File
@@ -49,6 +49,8 @@
#include "fwbuilder/RuleElement.h"
#include "fwbuilder/Library.h"
#include "../libgui/platforms.h"
#include <QString>
#include <QtDebug>
@@ -191,6 +193,68 @@ void PIXImporter::setInterfaceAndDirectionForRuleSet(
*logger << err.arg(QString::fromUtf8(ruleset_name.c_str())).toStdString();
}
void PIXImporter::addLogging()
{
PolicyRule *rule = PolicyRule::cast(current_rule);
FWOptions *ropt = rule->getOptionsObject();
/*
alerts Immediate action needed (severity=1)
critical Critical conditions (severity=2)
debugging Debugging messages (severity=7)
disable Disable log option on this ACL element, (no log at all)
emergencies System is unusable (severity=0)
errors Error conditions (severity=3)
inactive Keyword for disabling an ACL element
informational Informational messages (severity=6)
interval Configure log interval, default value is 300 sec
notifications Normal but significant conditions (severity=5)
warnings Warning conditions (severity=4)
*/
QMap<QString, QString> logging_levels;
logging_levels["alerts"] = "alert";
logging_levels["critical"] = "crit";
logging_levels["debugging"] = "debug";
logging_levels["emergencies"] = "";
logging_levels["errors"] = "error";
logging_levels["informational"] = "info";
logging_levels["notifications"] = "notice";
logging_levels["warnings"] = "warning";
logging_levels["0"] = "";
logging_levels["1"] = "alert";
logging_levels["2"] = "crit";
logging_levels["3"] = "error";
logging_levels["4"] = "warning";
logging_levels["5"] = "notice";
logging_levels["6"] = "info";
logging_levels["7"] = "debug";
// QStringList log_levels = getLogLevels("pix");
rule->setLogging(logging);
QString log_level_qs = log_level.c_str();
if ( ! log_level_qs.isEmpty())
{
if (logging_levels.count(log_level_qs) != 0)
ropt->setStr("log_level", logging_levels[log_level_qs].toStdString());
else
ropt->setStr("log_level", log_level);
if (log_level_qs == "disable" || log_level_qs == "inactive")
ropt->setBool("disable_logging_for_this_rule", true);
}
if ( ! log_interval.empty())
{
bool ok = false;
int log_interval_int = QString(log_interval.c_str()).toInt(&ok);
if (ok)
ropt->setInt("log_interval", log_interval_int);
}
}
/*
* Rearrange vlan interfaces. Importer creates all interfaces as
* children of the firewall. Vlan interfaces should become
src/import/PIXImporter.h
+2
View File
@@ -74,6 +74,8 @@ class PIXImporter : public IOSImporter
virtual libfwbuilder::FWObject* makeDstObj();
virtual libfwbuilder::FWObject* makeSrvObj();
virtual void addLogging();
/*
* the difference is that in PIX, we get interface label instead
* of its name in "access-group" command
src/parsers/PIXCfgLexer.cpp
+9 -9
View File
@@ -511,7 +511,7 @@ void PIXCfgLexer::mNEWLINE(bool _createToken) {
}
if ( inputState->guessing==0 ) {
#line 1942 "pix.g"
#line 1950 "pix.g"
newline();
#line 517 "PIXCfgLexer.cpp"
}
@@ -635,7 +635,7 @@ void PIXCfgLexer::mWhitespace(bool _createToken) {
}
}
if ( inputState->guessing==0 ) {
#line 1937 "pix.g"
#line 1945 "pix.g"
_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
#line 641 "PIXCfgLexer.cpp"
}
@@ -786,7 +786,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
match("oup");
}
if ( inputState->guessing==0 ) {
#line 1994 "pix.g"
#line 2002 "pix.g"
_ttype = OBJECT_GROUP;
#line 792 "PIXCfgLexer.cpp"
}
@@ -794,7 +794,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
else {
match("");
if ( inputState->guessing==0 ) {
#line 1996 "pix.g"
#line 2004 "pix.g"
_ttype = OBJECT;
#line 800 "PIXCfgLexer.cpp"
}
@@ -948,7 +948,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
} // ( ... )+
}
if ( inputState->guessing==0 ) {
#line 1987 "pix.g"
#line 1995 "pix.g"
_ttype = IPV6;
#line 954 "PIXCfgLexer.cpp"
}
@@ -1095,7 +1095,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
} // ( ... )+
}
if ( inputState->guessing==0 ) {
#line 1975 "pix.g"
#line 1983 "pix.g"
_ttype = IPV4;
#line 1101 "PIXCfgLexer.cpp"
}
@@ -1178,7 +1178,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
} // ( ... )+
}
if ( inputState->guessing==0 ) {
#line 1978 "pix.g"
#line 1986 "pix.g"
_ttype = NUMBER;
#line 1184 "PIXCfgLexer.cpp"
}
@@ -1199,7 +1199,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
_loop293:;
} // ( ... )+
if ( inputState->guessing==0 ) {
#line 1980 "pix.g"
#line 1988 "pix.g"
_ttype = INT_CONST;
#line 1205 "PIXCfgLexer.cpp"
}
@@ -1444,7 +1444,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
_loop313:;
} // ( ... )*
if ( inputState->guessing==0 ) {
#line 2003 "pix.g"
#line 2011 "pix.g"
_ttype = WORD;
#line 1450 "PIXCfgLexer.cpp"
}
src/parsers/PIXCfgParser.cpp
+183 -276
View File
File diff suppressed because it is too large Load Diff
src/parsers/pix.g
+10 -2
View File
@@ -1242,10 +1242,18 @@ hostaddr_expr :
//****************************************************************
log : (LOG | LOG_INPUT) ( (INT_CONST (INTERVAL INT_CONST)? )? | WORD )
log : (LOG | LOG_INPUT)
(
(level_int:INT_CONST (INTERVAL log_interval:INT_CONST)? )? | level_word:WORD
)
{
importer->logging = true;
*dbg << "logging ";
if (level_int) importer->log_level = level_int->getText();
if (level_word) importer->log_level = level_word->getText();
if (log_interval) importer->log_interval = log_interval->getText();
*dbg << "logging " << importer->log_level
<< " " << importer->log_interval;
}
;
src/unit_tests/ImporterTest/test_data/asa8.3-acl.test
+2
View File
@@ -152,6 +152,8 @@ access-list inside_in remark 3 (global)
! logging
access-list inside_in extended deny ip any any log 0 interval 300
access-list inside_in extended deny ip any any log alerts
access-list inside_in extended deny ip any any log disable
! more complex tests: named objects, object groups, inline address and