mirror of
https://github.com/fwbuilder/fwbuilder
synced 2025-10-16 15:38:43 +02:00
PolicyCompiler_pf_writers.cpp (processNext): see #2549 "Update
generated route-to configuration for PF versions 4.7 and later", SF bug 3348931. The "route-to" parameter moved to the end of pass rules in PF 4.7
This commit is contained in:
Vadim Kurland
parent
f6628dcb38
commit
531c5a83fe
@ -1,5 +1,10 @@
|
||||
2011-07-05 vadim <vadim@netcitadel.com>
|
||||
|
||||
* PolicyCompiler_pf_writers.cpp (processNext): see #2549 "Update
|
||||
generated route-to configuration for PF versions 4.7 and later",
|
||||
SF bug 3348931. The "route-to" parameter moved to the end of
|
||||
pass rules in PF 4.7
|
||||
|
||||
* pf.g: fixed bug in PF import: address lists such as "{ addr1,
|
||||
addr2, ... }" defined as macros or inside the rule could not be
|
||||
imported correctly.
|
||||
|
||||
@ -954,7 +954,8 @@ bool PolicyCompiler_pf::PrintRule::processNext()
|
||||
|
||||
_printInterface(rule);
|
||||
|
||||
_printRouteOptions(rule);
|
||||
if (XMLTools::version_compare(version, "4.7")<0)
|
||||
_printRouteOptions(rule);
|
||||
|
||||
_printAF(rule);
|
||||
|
||||
@ -1185,6 +1186,9 @@ bool PolicyCompiler_pf::PrintRule::processNext()
|
||||
_printQueue(rule);
|
||||
_printLabel(rule);
|
||||
|
||||
if (XMLTools::version_compare(version, "4.7")>=0)
|
||||
_printRouteOptions(rule);
|
||||
|
||||
compiler->output << endl;
|
||||
|
||||
return true;
|
||||
|
||||
28
test/pf/firewall40-2.conf
Normal file
28
test/pf/firewall40-2.conf
Normal file
@ -0,0 +1,28 @@
|
||||
|
||||
|
||||
|
||||
#
|
||||
# Rule 0 (NAT)
|
||||
# Translate source address
|
||||
# for outgoing connections
|
||||
match out on le1 from 192.168.1.0/24 to any nat-to (le1)
|
||||
#
|
||||
# Rule 1 (NAT)
|
||||
# Translate source address
|
||||
# for outgoing connections
|
||||
match out on le2 from 192.168.1.0/24 to any nat-to (le2)
|
||||
|
||||
#
|
||||
# Rule 0 (fxp0)
|
||||
pass in quick on fxp0 inet proto tcp from 192.168.1.0/24 to any port { 80, 25 } no state label "RULE 0 -- ACCEPT " route-to { ( le1 192.0.2.10 ) }
|
||||
#
|
||||
# Rule 1 (fxp0)
|
||||
pass in quick on fxp0 inet proto tcp from 192.168.1.0/24 to any port 22 no state label "RULE 1 -- ACCEPT " route-to { ( le2 192.0.3.10 ) }
|
||||
#
|
||||
# Rule 2 (fxp0)
|
||||
pass in quick on fxp0 inet proto tcp from 192.168.1.0/24 to any port 22 flags any label "RULE 2 -- ACCEPT " route-to { ( le2 192.0.3.10 ) }
|
||||
#
|
||||
# Rule fallback rule
|
||||
# fallback rule
|
||||
block quick inet from any to any no state label "RULE 10000 -- DROP "
|
||||
|
||||
183
test/pf/firewall40-2.fw
Executable file
183
test/pf/firewall40-2.fw
Executable file
@ -0,0 +1,183 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v5.0.0.3556
|
||||
#
|
||||
# Generated Tue Jul 5 13:58:41 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall40-2.fw /etc/firewall40-2.fw
|
||||
# files: firewall40-2.conf /etc/firewall40-2.conf
|
||||
#
|
||||
# Compiled for pf 4.7
|
||||
#
|
||||
# testing Route action for PF v4.7 and later
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
FWDIR=`dirname $0`
|
||||
|
||||
IFCONFIG="/sbin/ifconfig"
|
||||
PFCTL="/sbin/pfctl"
|
||||
SYSCTL="/sbin/sysctl"
|
||||
LOGGER="/usr/bin/logger"
|
||||
|
||||
log() {
|
||||
echo "$1"
|
||||
command -v "$LOGGER" >/dev/null 2>&1 && $LOGGER -p info "$1"
|
||||
}
|
||||
|
||||
diff_intf() {
|
||||
func=$1
|
||||
list1=$2
|
||||
list2=$3
|
||||
cmd=$4
|
||||
for intf in $list1
|
||||
do
|
||||
echo $list2 | grep -q $intf || {
|
||||
# $vlan is absent in list 2
|
||||
$func $intf $cmd
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
missing_address() {
|
||||
address=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $address
|
||||
addr=$1
|
||||
interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
if echo "$addr" | grep -q ':'
|
||||
then
|
||||
inet="inet6"
|
||||
addr=$(echo "$addr" | sed 's!/! prefixlen !')
|
||||
else
|
||||
inet="inet"
|
||||
addr=$(echo "$addr" | sed 's!/! netmask !')
|
||||
fi
|
||||
|
||||
parameter=""
|
||||
test "$cmd" = "add" && {
|
||||
echo "# Adding ip address: $interface $addr"
|
||||
parameter="alias"
|
||||
}
|
||||
test "$cmd" = "del" && {
|
||||
echo "# Removing ip address: $interface $addr"
|
||||
parameter="delete"
|
||||
}
|
||||
|
||||
$FWBDEBUG $IFCONFIG $interface $inet $addr $parameter || exit 1
|
||||
$FWBDEBUG $IFCONFIG $interface up
|
||||
}
|
||||
|
||||
list_addresses_by_scope() {
|
||||
interface=$1
|
||||
scope=$2
|
||||
ignore_list=$3
|
||||
|
||||
scope_regex="1"
|
||||
if test -n "$scope"; then scope_regex=" \$0 !~ \"$scope\" "; fi
|
||||
|
||||
$IFCONFIG $interface | sed "s/%$interface//" | \
|
||||
awk -v IGNORED="$ignore_list" \
|
||||
"BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
(/inet |inet6 / && $scope_regex && !(\$2 in ignored_dict)) {printf \"%s/%s\n\",\$2,\$4;}" | \
|
||||
while read addr; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
|
||||
}
|
||||
|
||||
update_addresses_of_interface() {
|
||||
ignore_list=$2
|
||||
set $1
|
||||
interface=$1
|
||||
shift
|
||||
|
||||
FWB_ADDRS=$(
|
||||
for addr in $*; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
CURRENT_ADDRS_ALL_SCOPES=""
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=""
|
||||
|
||||
$IFCONFIG $interface >/dev/null 2>&1 && {
|
||||
CURRENT_ADDRS_ALL_SCOPES=$(list_addresses_by_scope $interface '' "$ignore_list")
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=$(list_addresses_by_scope $interface 'scopeid .*' "$ignore_list")
|
||||
} || {
|
||||
echo "# Interface $interface does not exist"
|
||||
# Stop the script if we are not in test mode
|
||||
test -z "$FWBDEBUG" && exit 1
|
||||
}
|
||||
|
||||
|
||||
echo "$interface" | grep -q carp && {
|
||||
diff_intf missing_address "$CURRENT_ADDRS_GLOBAL_SCOPE" "$FWB_ADDRS" del
|
||||
diff_intf missing_address "$FWB_ADDRS" "$CURRENT_ADDRS_ALL_SCOPES" add
|
||||
} || {
|
||||
diff_intf missing_address "$FWB_ADDRS" "$CURRENT_ADDRS_ALL_SCOPES" add
|
||||
diff_intf missing_address "$CURRENT_ADDRS_GLOBAL_SCOPE" "$FWB_ADDRS" del
|
||||
}
|
||||
}
|
||||
|
||||
verify_interfaces() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
set_kernel_vars() {
|
||||
:
|
||||
$SYSCTL -w net.inet.ip.forwarding=1
|
||||
}
|
||||
|
||||
prolog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
epilog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
run_epilog_and_exit() {
|
||||
epilog_commands
|
||||
exit $1
|
||||
}
|
||||
|
||||
configure_interfaces() {
|
||||
:
|
||||
update_addresses_of_interface "fxp0 192.168.1.1/0xffffff00" ""
|
||||
update_addresses_of_interface "le1 192.0.2.1/0xffffff00" ""
|
||||
update_addresses_of_interface "le2 192.0.3.1/0xffffff00" ""
|
||||
update_addresses_of_interface "lo0 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jul 5 13:58:41 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
prolog_commands
|
||||
|
||||
$PFCTL -f /etc/firewall40-2.conf || exit 1
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
epilog_commands
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,9 +1,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v5.0.0.3551
|
||||
# Firewall Builder fwb_pf v5.0.0.3556
|
||||
#
|
||||
# Generated Wed Jun 22 10:50:27 2011 PDT by vadim
|
||||
# Generated Tue Jul 5 13:58:50 2011 PDT by vadim
|
||||
#
|
||||
# files: * pf_cluster_4_rc.conf.local /etc/pf_cluster_4_rc.conf.local
|
||||
# files: pf_cluster_4_pf.conf /etc/pf_cluster_4_pf.conf
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user