diff --git a/build_num b/build_num index 446bb845c..85d7841e3 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 2970 +#define BUILD_NUM 2971 diff --git a/doc/ChangeLog b/doc/ChangeLog index 7e5083046..b61576ba7 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,9 +1,14 @@ +2010-06-11 vadim + + * IPTImporter.cpp (IPTImporter::finalize): see #1513 iptables + importer should check default policy in standard chains. + 2010-06-08 Vadim Kurland * applied patch from slif@bellsouth.net to fix compiler warnings. Patch applied partially since not all fixes were appropriate. fixes #1510 - + * IPTImporter.cpp (IPTImporter::pushPolicyRule): fixed #1512 SF bug 3012953: iptables importer sometimes does not recognize rule with " ESTABLISHED,RELATED ". Parser properly processed iptables diff --git a/src/gui/IPTImporter.cpp b/src/gui/IPTImporter.cpp index a2f8f3ce5..00e726199 100644 --- a/src/gui/IPTImporter.cpp +++ b/src/gui/IPTImporter.cpp @@ -1166,6 +1166,46 @@ Firewall* IPTImporter::finalize() fwopt->setBool("firewall_is_part_of_any_and_networks", false); + // scan all UnidirectionalRuleSet objects and take care of + // their default action + std::map::iterator it; + for (it=all_rulesets.begin(); it!=all_rulesets.end(); ++it) + { + UnidirectionalRuleSet* rs = it->second; + if (Policy::isA(rs->ruleset) && rs->default_action == PolicyRule::Accept) + { + + FWObjectDatabase *dbroot = getFirewallObject()->getRoot(); + PolicyRule *rule = PolicyRule::cast( + dbroot->create(PolicyRule::TYPENAME)); + + // check if all child objects were populated properly + FWOptions *ropt = current_rule->getOptionsObject(); + assert(ropt!=NULL); + ropt->setBool("stateless",true); + + rule->setAction(PolicyRule::Accept); + + if (rs->name == "INPUT") + { + RuleElementSrc* src = rule->getSrc(); + assert(src!=NULL); + src->addRef(fw); + rule->setDirection(PolicyRule::Inbound); + } + if (rs->name == "OUTPUT") + { + RuleElementDst* dst = rule->getDst(); + assert(dst!=NULL); + dst->addRef(fw); + rule->setDirection(PolicyRule::Outbound); + } + + rs->ruleset->add(rule); + + } + } + list l2 = fw->getByType(Policy::TYPENAME); for (list::iterator i=l2.begin(); i!=l2.end(); ++i) { diff --git a/src/gui/Importer.cpp b/src/gui/Importer.cpp index 07c0e3720..8422ce3f4 100644 --- a/src/gui/Importer.cpp +++ b/src/gui/Importer.cpp @@ -372,6 +372,23 @@ void Importer::newUnidirRuleSet(const std::string &ruleset_name) *logger << "Ruleset: " << ruleset_name << "\n"; } +/* + * Grammar must ensure the call to setDefaultAction() happens + * after the call to newUnidirRuleSet() + * + */ +void Importer::setDefaultAction(const std::string &iptables_action_name) +{ + string default_action_str = "Deny"; + if (iptables_action_name == "ACCEPT") + { + current_ruleset->default_action = PolicyRule::Accept; + default_action_str = "Accept"; + } else current_ruleset->default_action = PolicyRule::Deny; + + *logger << "Default action: " << default_action_str << "\n"; +} + void Importer::newPolicyRule() { diff --git a/src/gui/Importer.h b/src/gui/Importer.h index 8881c0d4e..b914ff6f7 100644 --- a/src/gui/Importer.h +++ b/src/gui/Importer.h @@ -57,6 +57,7 @@ public: std::string name; // interface names and directions std::map intf_dir; + libfwbuilder::PolicyRule::Action default_action; }; class ImporterException : public std::exception @@ -109,7 +110,7 @@ protected: std::map custom_service_codes; UnidirectionalRuleSet* current_ruleset; - + libfwbuilder::Rule* current_rule; libfwbuilder::FWObject* createObject(const std::string &objType, @@ -271,6 +272,11 @@ public: */ virtual void newUnidirRuleSet(const std::string &name); + /** + * Sets default action for the current rule set. + */ + virtual void setDefaultAction(const std::string &iptables_action_name); + /** * add interface and direction setting to a ruleset. Note that the * same ruleset may be associated with multiple interfaces and diff --git a/src/parsers/iptables.g b/src/parsers/iptables.g index c824bc445..a4e00491d 100644 --- a/src/parsers/iptables.g +++ b/src/parsers/iptables.g @@ -162,6 +162,10 @@ create_chain : COLON chain_def *dbg << "NEW CHAIN " << LT(0)->getText() << std::endl; } (WORD | MINUS) + { + importer->setDefaultAction(LT(0)->getText()); + *dbg << "DEFAULT ACTION " << LT(0)->getText() << std::endl; + } (OPENING_SQUARE INT_CONST COLON INT_CONST CLOSING_SQUARE)? ; diff --git a/test/ipt/objects-for-regression-tests.fwb b/test/ipt/objects-for-regression-tests.fwb index 91388964f..c851906b0 100644 --- a/test/ipt/objects-for-regression-tests.fwb +++ b/test/ipt/objects-for-regression-tests.fwb @@ -1,6 +1,6 @@ - + @@ -101,29 +101,19 @@ - established - established -m state --state ESTABLISHED,RELATED - - established - - established - established -m state --state ESTABLISHED,RELATED - - established - @@ -3574,6 +3564,7 @@ + @@ -23549,7 +23540,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -23696,7 +23687,74 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -23716,7 +23774,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -23737,7 +23795,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -23756,7 +23814,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -23775,7 +23833,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -23793,7 +23851,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -23811,7 +23869,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -23833,6 +23891,31 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% + + + + + + + + + + + + + + + + + + + + + + + + +