diff --git a/build_num b/build_num index 26ce6b95d..34b8acc99 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 2897 +#define BUILD_NUM 2898 diff --git a/doc/ChangeLog b/doc/ChangeLog index a2892bfff..e88ac3e11 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,5 +1,8 @@ 2010-05-12 vadim + * procurveaclAdvancedDialog.cpp (procurveaclAdvancedDialog::procurveaclAdvancedDialog): + fixed #1449 options for ACL remarks and comments for ProCurve + * PolicyCompiler_procurve_acl_writers.cpp (PolicyCompiler_procurve_acl::printAccessGroupCmd): generated commands that attach acl to a regular inetrface needed newline after "exit". diff --git a/src/cisco_lib/PolicyCompiler_iosacl.cpp b/src/cisco_lib/PolicyCompiler_iosacl.cpp index a4aaa02ba..a15376958 100644 --- a/src/cisco_lib/PolicyCompiler_iosacl.cpp +++ b/src/cisco_lib/PolicyCompiler_iosacl.cpp @@ -81,6 +81,10 @@ int PolicyCompiler_iosacl::prolog() if (platform!="iosacl") abort("Unsupported platform " + platform ); + fw->getOptionsObject()->setBool( + "use_acl_remarks", + fw->getOptionsObject()->getBool("iosacl_use_acl_remarks")); + object_groups = new Group(); dbcopy->add( object_groups ); diff --git a/src/cisco_lib/PolicyCompiler_iosacl_writers.cpp b/src/cisco_lib/PolicyCompiler_iosacl_writers.cpp index cc0578033..4e96b12cf 100644 --- a/src/cisco_lib/PolicyCompiler_iosacl_writers.cpp +++ b/src/cisco_lib/PolicyCompiler_iosacl_writers.cpp @@ -349,7 +349,10 @@ string PolicyCompiler_iosacl::PrintRule::_printRule(PolicyRule *rule) // "fragments" should be the last option in the access-list command aclstr << _printIPServiceOptions(rule); - if (compiler->fw->getOptionsObject()->getBool("iosacl_use_acl_remarks")) + // Note that option "use_acl_remarks" is set in prolog() because + // we use different options for this function in GUI dialogs for + // iosacl and procurve. This is historical. + if (compiler->fw->getOptionsObject()->getBool("use_acl_remarks")) { ruleout << acl->addRemark(rule->getLabel(), rule->getComment()); } diff --git a/src/cisco_lib/PolicyCompiler_procurve_acl.cpp b/src/cisco_lib/PolicyCompiler_procurve_acl.cpp index 1ca92abd9..bf29ca4dc 100644 --- a/src/cisco_lib/PolicyCompiler_procurve_acl.cpp +++ b/src/cisco_lib/PolicyCompiler_procurve_acl.cpp @@ -68,6 +68,10 @@ int PolicyCompiler_procurve_acl::prolog() */ fw->getOptionsObject()->setBool("generate_out_acl", true); + fw->getOptionsObject()->setBool( + "use_acl_remarks", + fw->getOptionsObject()->getBool("procurve_acl_use_acl_remarks")); + return PolicyCompiler::prolog(); } diff --git a/src/gui/iosacladvanceddialog_q.ui b/src/gui/iosacladvanceddialog_q.ui index c72381664..a04b5c804 100644 --- a/src/gui/iosacladvanceddialog_q.ui +++ b/src/gui/iosacladvanceddialog_q.ui @@ -1,10 +1,11 @@ - + + iosaclAdvancedDialog_q - - + + true - + 0 0 @@ -12,51 +13,51 @@ 733 - + IOS ACL Firewall Settings - + false - - - - + + + + 0 - - + + Compiler Options - - - - - + + + + + 0 0 - - Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") + + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - + Qt::AlignVCenter - + true - - - + + + 300 0 - + 32767 22 @@ -64,43 +65,43 @@ - - - + + + false - + - - + + 20 - - - + + + Compiler creates multiple access lists from the same policy, two for each interface: one for inbound and another for outbound. If the policy is written in a such way that no rule can possibly be associated with an interface, this interface gets no access list at all. Also, interfaces marked as -"unprotected" never get access list regardless of how the policy +"unprotected" never get access list regardless of how the policy rules are designed. - + Generate separate access list for each interface - - - + + + Compiler creates one access list and assigns it to all interfaces. - + Create one access list and attach it to all interfaces @@ -108,47 +109,47 @@ interfaces. - - - - + + + + 0 0 - + Policy Compiler Options - + false - + false - - - - + + + + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules - - - + + + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in the policy - - - + + + Use object-group statements (requires IOS v12.4(20)T and later) @@ -156,34 +157,34 @@ interfaces. - - - + + + Always permit ssh access from the management workstation with this address: - + true - + false - - - - + + + + 0 0 - + 300 0 - + 32767 22 @@ -191,12 +192,12 @@ interfaces. - - - + + + Qt::Horizontal - + 328 20 @@ -204,15 +205,15 @@ interfaces. - + - + Qt::Vertical - + QSizePolicy::Expanding - + 20 170 @@ -222,130 +223,146 @@ interfaces. - - + + Script Options - - + + 20 - + 12 - + 20 - + 20 - - - - + + + + 0 0 - + - - - - + + + 20 + + + + Insert comments into generated IOSACL configuration file - + Comment the code - - - + + + Insert comments into generated IOSACL configuration file - + Use ACL remarks - - - + + + Group IOSACL commands in the script so that similar commands appear next to each other, just like IOSACL does it when you use 'show config' - + Group similar commands together + + + + Qt::Vertical + + + + 20 + 70 + + + + - - - - + + + + 0 0 - + - - + + 12 - + -1 - - - + + + Clear all access lists then install new ones. This method may interrupt access to the firewall if you manage it remotely via IPSEC tunnel. This is the way access lists were generated in older versions of Firewall Builder for IOSACL. - + Qt::AlignVCenter - + true - + iosacl_acl_basic - - - + + + Qt::ClickFocus - + Do not clear access lists and object group, just generate IOSACL commands for the new ones. Use this option if you have your own policy installation scripts. - + Qt::AlignVCenter - + true - + iosacl_acl_no_clear - + - + Qt::Vertical - + QSizePolicy::Expanding - + 20 20 @@ -353,58 +370,58 @@ interfaces. - - - - "Safety net" method: + + + + "Safety net" method: First, create temporary access list to permit connections from the management subnet specified below to the firewall and assign it to outside interface. This temporary ACL helps maintain session between management station and the firewall while access lists are reloaded in case connection comes over IPSEC tunnel. Then clear permanent lists, recreate them and assign to interfaces. This method ensures that remote access to the firewall is maintained without interruption at a cost of slightly larger configuration. - + Qt::AlignVCenter - + true - + iosacl_acl_substitution - - - + + + QFrame::StyledPanel - + QFrame::Sunken - - + + 11 - - - + + + Temporary access list should permit access from this address or subnet (use prefix notation to specify subnet, e.g. 192.0.2.0/24): - + Qt::AlignVCenter - + true - + - + Qt::Horizontal - + QSizePolicy::Expanding - + 120 20 @@ -412,21 +429,21 @@ First, create temporary access list to permit connections from the management su - - - - + + + + 0 0 - + 200 0 - + 120 32767 @@ -434,15 +451,15 @@ First, create temporary access list to permit connections from the management su - + - + Qt::Horizontal - + QSizePolicy::Expanding - + 110 20 @@ -453,41 +470,41 @@ First, create temporary access list to permit connections from the management su - - - - + + + + 0 0 - + - - - - + + + + 0 0 - + - - - - + + + + 0 0 - + @@ -497,84 +514,84 @@ First, create temporary access list to permit connections from the management su - - + + Installer - - - - + + + + Built-in installer - - - - + + + + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Qt::AlignLeading|Qt::AlignLeft|Qt::AlignVCenter - + true - - - - + + + + 0 0 - - - + + + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + Qt::AlignLeading|Qt::AlignLeft|Qt::AlignTop - + true - - - - + + + + 0 0 - - + + - - + + Additional command line parameters for ssh - + false - - - + + + 0 0 - + 300 0 @@ -584,27 +601,27 @@ First, create temporary access list to permit connections from the management su - - + + - - + + Additional command line parameters for scp - + false - - - + + + 0 0 - + 300 0 @@ -617,48 +634,48 @@ First, create temporary access list to permit connections from the management su - - - + + + - - - - - Instead of running generated configuration on the router line by line, installer can use scp to copy the file and then "copy file running-config" command to activate it. Ssh v2 and scp servers should be configured on the router for this to work. This method works for IOS v12.4 or later and is much faster than running configuration line by line. + + + + + Instead of running generated configuration on the router line by line, installer can use scp to copy the file and then "copy file running-config" command to activate it. Ssh v2 and scp servers should be configured on the router for this to work. This method works for IOS v12.4 or later and is much faster than running configuration line by line. - + true - - - + + + Copy generated configuration file to the router using scp - - - - File system on the router where configuration file should be saved if it is copied with scp. Examples: "flash:", "disk0:". Should end with a colon ":". If this input field is left blank, installer uses "nvram:": + + + + File system on the router where configuration file should be saved if it is copied with scp. Examples: "flash:", "disk0:". Should end with a colon ":". If this input field is left blank, installer uses "nvram:": - + true - - + + - - - + + + Qt::Horizontal - + 398 20 @@ -669,45 +686,45 @@ First, create temporary access list to permit connections from the management su - - - + + + External install script - - + + -1 - - + + - - - + + + 0 0 - + Policy install script (using built-in installer if this field is blank): - + Qt::AlignLeading|Qt::AlignLeft|Qt::AlignVCenter - + true - - - + + + 0 0 - + 300 0 @@ -717,36 +734,36 @@ First, create temporary access list to permit connections from the management su - - + + - - - + + + 0 0 - + Command line options for the script: - + Qt::AlignLeading|Qt::AlignLeft|Qt::AlignVCenter - + false - - - + + + 0 0 - + 300 0 @@ -759,15 +776,15 @@ First, create temporary access list to permit connections from the management su - + - + Qt::Vertical - + QSizePolicy::Expanding - + 20 20 @@ -777,41 +794,41 @@ First, create temporary access list to permit connections from the management su - - + + Prolog/Epilog - - + + 20 - + 12 - + 20 - + 20 - - - + + + - - + + 6 - + - + Qt::Horizontal - + QSizePolicy::Expanding - + 40 20 @@ -819,57 +836,57 @@ First, create temporary access list to permit connections from the management su - - - + + + Edit - - - + + + The following commands will be added verbatim on top of generated configuration - + Qt::AlignVCenter - + true - - + + - - - + + + - - + + 6 - - - + + + Edit - + - + Qt::Horizontal - + QSizePolicy::Expanding - + 40 20 @@ -877,24 +894,24 @@ First, create temporary access list to permit connections from the management su - - + + - - - + + + The following commands will be added verbatim after generated configuration - + Qt::RichText - + Qt::AlignVCenter - + true - + 0 @@ -904,117 +921,117 @@ First, create temporary access list to permit connections from the management su - - + + Logging - - - - + + + + Generate logging commands - - - + + + Syslog - - + + 12 - - + + - - - + + + Syslog host (name or IP address): - + Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter - + false - - - + + + syslog facility: - + Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter - + false - - - + + + syslog level ('logging trap'): - + Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter - + false - - + + - - + + - - - + + + QFrame::HLine - + QFrame::Sunken - + Qt::Horizontal - - - + + + QFrame::HLine - + QFrame::Sunken - + Qt::Horizontal - - - + + + The logging timestamp command requires that the clock command be set. - + Qt::AlignVCenter - + true - - - + + + Enable logging timestamps on syslog file @@ -1022,47 +1039,47 @@ First, create temporary access list to permit connections from the management su - - - + + + Other logging destinations and levels: - - + + 12 - - - + + + Internal buffer - - - + + + Console - - + + - - + + - + - + Qt::Vertical - + QSizePolicy::Expanding - + 675 121 @@ -1072,24 +1089,24 @@ First, create temporary access list to permit connections from the management su - - + + IPv6 - - - - + + + + The order in which ipv4 and ipv6 rules should be generated: - + - + Qt::Horizontal - + 40 20 @@ -1097,26 +1114,26 @@ First, create temporary access list to permit connections from the management su - - + + - + IPv4 before IPv6 - + IPv6 before IPv4 - + - + Qt::Vertical - + 20 40 @@ -1128,17 +1145,17 @@ First, create temporary access list to permit connections from the management su - - + + - + Qt::Horizontal - + QSizePolicy::Expanding - + 20 20 @@ -1147,27 +1164,27 @@ First, create temporary access list to permit connections from the management su - + - - + + OK - - + + Qt::AlignCenter - + false - - + + Cancel @@ -1228,11 +1245,11 @@ First, create temporary access list to permit connections from the management su iosaclAdvancedDialog_q accept() - + 20 20 - + 20 20 @@ -1244,11 +1261,11 @@ First, create temporary access list to permit connections from the management su iosaclAdvancedDialog_q reject() - + 20 20 - + 20 20 @@ -1260,11 +1277,11 @@ First, create temporary access list to permit connections from the management su iosaclAdvancedDialog_q editProlog() - + 20 20 - + 20 20 @@ -1276,11 +1293,11 @@ First, create temporary access list to permit connections from the management su iosaclAdvancedDialog_q editEpilog() - + 20 20 - + 20 20 @@ -1292,11 +1309,11 @@ First, create temporary access list to permit connections from the management su iosaclAdvancedDialog_q scriptACLModeChanged() - + 20 20 - + 20 20 @@ -1308,11 +1325,11 @@ First, create temporary access list to permit connections from the management su iosaclAdvancedDialog_q scriptACLModeChanged() - + 20 20 - + 20 20 @@ -1324,11 +1341,11 @@ First, create temporary access list to permit connections from the management su iosaclAdvancedDialog_q toggleGenerateLogging() - + 359 55 - + 359 359 diff --git a/src/gui/procurveaclAdvancedDialog.cpp b/src/gui/procurveaclAdvancedDialog.cpp index d7daec512..425b2559d 100644 --- a/src/gui/procurveaclAdvancedDialog.cpp +++ b/src/gui/procurveaclAdvancedDialog.cpp @@ -238,6 +238,12 @@ procurveaclAdvancedDialog::procurveaclAdvancedDialog(QWidget *parent,FWObject *o data.registerOption( m_dialog->procurve_acl_acl_temp_addr, fwoptions, "procurve_acl_acl_temp_addr" ); + data.registerOption( m_dialog->procurve_acl_include_comments, fwoptions, + "procurve_acl_include_comments" ); + + data.registerOption( m_dialog->procurve_acl_use_acl_remarks, fwoptions, + "procurve_acl_use_acl_remarks" ); + /* Page Installer */ diff --git a/src/gui/procurveacladvanceddialog_q.ui b/src/gui/procurveacladvanceddialog_q.ui index 0cba715a2..0f0781814 100644 --- a/src/gui/procurveacladvanceddialog_q.ui +++ b/src/gui/procurveacladvanceddialog_q.ui @@ -10,7 +10,7 @@ 0 0 743 - 733 + 717 @@ -223,19 +223,7 @@ interfaces. Script Options - - - 20 - - - 12 - - - 20 - - - 20 - + @@ -248,6 +236,9 @@ interfaces. + + 20 + @@ -431,15 +422,53 @@ First, create temporary access list to permit connections from the management su - + + + + + + + + 0 + 0 + + + + + + + + 20 + + + + + Insert comments into generated IOSACL configuration file + + + Comment the code + + + + + + + Insert comments into generated IOSACL configuration file + + + Use ACL remarks + + + + Qt::Vertical - 600 - 239 + 20 + 137 diff --git a/test/procurve_acl/objects-for-regression-tests.fwb b/test/procurve_acl/objects-for-regression-tests.fwb index dbc55be6c..15c6cd003 100644 --- a/test/procurve_acl/objects-for-regression-tests.fwb +++ b/test/procurve_acl/objects-for-regression-tests.fwb @@ -3199,7 +3199,7 @@ - + @@ -3807,7 +3807,7 @@ - + @@ -4401,16 +4401,17 @@ - + - + - + - + +