bug with --dports = for iptables 1.4.0

doc/ChangeLog

@@ -1,5 +1,12 @@
 2008-08-19  Vadim Kurland  <vadim@vk.crocodile.org>
 
+	* NATCompiler_PrintRule.cpp (PrintRule::_printSrcService): fixed
+	bug (no #): policy compielr for iptables used multiport module
+	option "--destination-port" instead of "--dports" when version was
+	set to 1.4.0. Option "--destination-port" is only for very old
+	versions of iptables (<1.2.6). This change makes compiler properly
+	compare version numbers rather than compare them as strings.
+
 	* RuleSetView.cpp (RuleSetView::pasteRuleAbove): Permit copy/paste
 	of individual rules between two data files. When a rule is copied
 	this way, all objects used in this rule are copied as well.

src/ipt/NATCompiler_PrintRule.cpp

@@ -41,6 +41,7 @@
 #include "fwbuilder/Resources.h"
 #include "fwbuilder/DNSName.h"
 #include "fwbuilder/AddressTable.h"
+#include "fwbuilder/XMLTools.h"
 
 #include "combinedAddress.h"
 
@@ -367,7 +368,8 @@ string NATCompiler_ipt::PrintRule::_printSrcService(RuleElementOSrv  *rel)
 	if ( !str.empty() )
         {
             string v = compiler->fw->getStr("version");
-            if (v.empty() || v=="ge_1.2.6" || v=="1.2.9" || v=="1.3.0")
+            if (v.empty() || v=="ge_1.2.6" ||
+                XMLTools::version_compare(v, "1.2.6")>=0)
                 ostr << "--sports ";
             else
                 ostr << "--source-port ";
@@ -436,7 +438,9 @@ string NATCompiler_ipt::PrintRule::_printDstService(RuleElementOSrv  *rel)
 	if ( !str.empty() )
         {
             string v = compiler->fw->getStr("version");
-            if (v.empty() || v=="ge_1.2.6" || v=="1.2.9" || v=="1.3.0")
+//            if (v.empty() || v=="ge_1.2.6" || v=="1.2.9" || v=="1.3.0")
+            if (v.empty() || v=="ge_1.2.6" ||
+                XMLTools::version_compare(v, "1.2.6")>=0)
                 ostr << "--dports ";
             else
                 ostr << "--destination-port ";

src/ipt/PolicyCompiler_PrintRule.cpp

@@ -405,7 +405,7 @@ string PolicyCompiler_ipt::PrintRule::_printDirectionAndInterface(PolicyRule *ru
         compiler->getCachedFwInterface(rule->getInterfaceId());
 
     if (rule_iface && rule_iface->isBridgePort() &&
-        (version == "1.3.0" || version == "1.4.0"))
+        XMLTools::version_compare(version, "1.3.0")>=0)
     {
         if (rule->getDirection()==PolicyRule::Inbound)   
             ostr << " -m physdev --physdev-in "  << iface_name; 
@@ -1135,7 +1135,9 @@ string PolicyCompiler_ipt::PrintRule::_printTimeInterval(PolicyRule *r)
 
 
     string version=compiler->fw->getStr("version");
-    if (version == "1.4.0")
+
+//    if (version == "1.4.0")
+    if (XMLTools::version_compare(version, "1.4.0")>=0)
     {
         // in 1.4.0 date format has changed, it is now ISO 8601
         // http://www.w3.org/TR/NOTE-datetime

src/ipt/PolicyCompiler_ipt.cpp

@@ -47,6 +47,7 @@
 #include "fwbuilder/AddressTable.h"
 #include "fwbuilder/DNSName.h"
 #include "fwbuilder/UserService.h"
+#include "fwbuilder/XMLTools.h"
 
 #include "combinedAddress.h"
 
@@ -4211,7 +4212,8 @@ string PolicyCompiler_ipt::flushAndSetDefaultPolicy()
     res += printRule->_flushAndSetDefaultPolicy();
 
     string version = fw->getStr("version");
-    if (version != "1.3.0" && version != "1.4.0")
+//  if (version != "1.3.0" && version != "1.4.0")
+    if (XMLTools::version_compare(version, "1.3.0")<0)
         res += printRule->_clampTcpToMssRule();
 
     res += printRule->_printOptionalGlobalRules();
@@ -4226,11 +4228,8 @@ string PolicyCompiler_ipt::commit()
 
 bool PolicyCompiler_ipt::newIptables(const string &version)
 {
-    return (version.empty() || 
-            version == "ge_1.2.6" ||
-            version == "1.2.9" ||
-            version == "1.3.0" ||
-            version == "1.4.0");
+    return (version.empty() || version=="ge_1.2.6" ||
+            XMLTools::version_compare(version, "1.2.6")>=0);
 }