onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-15 01:19:29 +02:00
Code Issues Releases Wiki Activity

see #2458, #2459 import of "rdr", "no nat", "no rdr" rules

Browse Source
This commit is contained in:
Vadim Kurland
2011-05-31 12:55:55 -07:00
parent fd7c3601ba
commit 564500768e
18 changed files with 2188 additions and 923 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/import/PFImporter.cpp
+61 -29
View File
@@ -222,37 +222,49 @@ void PFImporter::addServiceObjectsToRE(RuleElement *re)
FWObject *s = service_maker->createObject(sig);
if (s) re->addRef(s);
}
}
if (protocol == "tcp" || protocol == "udp")
} else
{
// TODO: deal with cases where both source and destination
// ports are matched.
// See PIXImporter::fixServiceObjectUsedForBothSrcAndDstPorts()
if (src_port_group.size() == 0 && dst_port_group.size() == 0)
if (protocol == "tcp" || protocol == "udp")
{
// protocol has been defined but not ports to match
// TODO: deal with cases where both source and destination
// ports are matched.
// See PIXImporter::fixServiceObjectUsedForBothSrcAndDstPorts()
ObjectSignature sig(error_tracker);
if (src_port_group.size() == 0 && dst_port_group.size() == 0)
{
// protocol has been defined but not ports to match
buildTCPUDPObjectSingature(
&sig,
"",
"",
false, // dest.
protocol.c_str(),
flags_check.c_str(),
flags_mask.c_str());
ObjectSignature sig(error_tracker);
re->addRef(commitObject(service_maker->createObject(sig)));
buildTCPUDPObjectSingature(
&sig,
"",
"",
false, // dest.
protocol.c_str(),
flags_check.c_str(),
flags_mask.c_str());
re->addRef(commitObject(service_maker->createObject(sig)));
} else
{
addTCPUDPServiceObjectsToRE(re, protocol, src_port_group,
true, false);
addTCPUDPServiceObjectsToRE(re, protocol, dst_port_group,
false, false);
}
} else
{
addTCPUDPServiceObjectsToRE(re, protocol, src_port_group, true, false);
addTCPUDPServiceObjectsToRE(re, protocol, dst_port_group, false, false);
// protocol is not icmp, udp or tcp
ObjectSignature sig(error_tracker);
sig.type_name = IPService::TYPENAME;
sig.setProtocol(protocol.c_str());
sig.fragments = fragments;
re->addRef(commitObject(service_maker->createObject(sig)));
}
}
}
if (! tagged.empty())
@@ -358,10 +370,20 @@ void PFImporter::addTDst()
}
}
void PFImporter::addTSrv()
void PFImporter::addTSrvSNAT()
{
NATRule *rule = NATRule::cast(current_rule);
addTCPUDPServiceObjectsToRE(rule->getTSrv(), protocol, nat_port_group, true, true);
addTCPUDPServiceObjectsToRE(rule->getTSrv(), protocol, nat_port_group,
true, // source
true); // for_nat_rhs
}
void PFImporter::addTSrvDNAT()
{
NATRule *rule = NATRule::cast(current_rule);
addTCPUDPServiceObjectsToRE(rule->getTSrv(), protocol, nat_port_group,
false, // source
true); // for_nat_rhs
}
@@ -796,9 +818,9 @@ void PFImporter::pushNATRule()
FWOptions *ropt = current_rule->getOptionsObject();
assert(ropt!=NULL);
if (action=="nat") rule->setRuleType(NATRule::SNAT);
if (action=="rdr") rule->setRuleType(NATRule::DNAT);
if (action=="nat") rule->setRuleType(NATRule::SNAT);
if (action=="rdr") rule->setRuleType(NATRule::DNAT);
if (action=="nonat") rule->setRuleType(NATRule::NONAT);
// remember that even though NATRule has two interface rule elements
// ("in" and "out"), compiler for PF only uses one, the "outbound" one.
@@ -820,15 +842,25 @@ void PFImporter::pushNATRule()
switch (rule->getRuleType())
{
case NATRule::SNAT: addTSrc(); break;
case NATRule::DNAT: addTDst(); break;
case NATRule::SNAT:
addTSrc();
addTSrvSNAT();
break;
case NATRule::DNAT:
addTDst();
addTSrvDNAT();
break;
case NATRule::NONAT:
break;
default:
error_tracker->registerError(
QObject::tr("NAT rules \"%1\" "
"are not supported yet.").arg(action.c_str()));
}
addTSrv();
if (nat_rule_opt_1 == "bitmask") ropt->setBool("pf_bitmask", true);
if (nat_rule_opt_1 == "random") ropt->setBool("pf_random", true);
src/import/PFImporter.h
+4 -2
View File
@@ -212,7 +212,7 @@ public:
bool src_neg;
bool dst_neg;
bool tmp_neg;
std::map<std::string, std::string> icmp_codes_to_reject_parameters;
std::list<std::string> block_action_params;
@@ -286,7 +286,9 @@ public:
virtual void addTSrc();
virtual void addTDst();
virtual void addTSrv();
void addTSrvSNAT();
void addTSrvDNAT();
virtual void addLogging();
src/parsers/PFCfgLexer.cpp
+143 -143
View File
@@ -44,55 +44,55 @@ PFCfgLexer::PFCfgLexer(const ANTLR_USE_NAMESPACE(antlr)LexerSharedInputState& st
void PFCfgLexer::initLiterals()
{
literals["vrrp"] = 82;
literals["vrrp"] = 83;
literals["critical"] = 119;
literals["ospf"] = 80;
literals["rdp"] = 74;
literals["ospf"] = 81;
literals["rdp"] = 75;
literals["disable"] = 126;
literals["return-rst"] = 54;
literals["return-rst"] = 55;
literals["scrub"] = 12;
literals["source-hash"] = 43;
literals["bitmask"] = 41;
literals["source-hash"] = 45;
literals["bitmask"] = 43;
literals["ipsec"] = 109;
literals["inet"] = 66;
literals["inet"] = 67;
literals["pcp"] = 111;
literals["emergencies"] = 121;
literals["debugging"] = 120;
literals["hex-key"] = 44;
literals["hex-key"] = 46;
literals["persist"] = 16;
literals["snp"] = 115;
literals["timeout"] = 50;
literals["to"] = 63;
literals["flags"] = 92;
literals["isis"] = 84;
literals["icmp6-type"] = 95;
literals["timeout"] = 51;
literals["to"] = 64;
literals["flags"] = 93;
literals["isis"] = 85;
literals["icmp6-type"] = 96;
literals["const"] = 17;
literals["return"] = 53;
literals["return"] = 54;
literals["pptp"] = 113;
literals["pass"] = 34;
literals["no"] = 98;
literals["static-port"] = 36;
literals["from"] = 85;
literals["pass"] = 35;
literals["no"] = 33;
literals["static-port"] = 37;
literals["from"] = 86;
literals["igrp"] = 108;
literals["pim"] = 112;
literals["tagged"] = 96;
literals["rsvp"] = 75;
literals["route-to"] = 90;
literals["tagged"] = 97;
literals["rsvp"] = 76;
literals["route-to"] = 91;
literals["nos"] = 110;
literals["quit"] = 105;
literals["peer"] = 28;
literals["icmp-type"] = 93;
literals["icmp-type"] = 94;
literals["exit"] = 104;
literals["modulate"] = 100;
literals["nat"] = 33;
literals["nat"] = 34;
literals["range"] = 117;
literals["urpf-failed"] = 86;
literals["out"] = 59;
literals["urpf-failed"] = 87;
literals["out"] = 60;
literals["queue"] = 10;
literals["gre"] = 76;
literals["gre"] = 77;
literals["set"] = 11;
literals["warnings"] = 125;
literals["ah"] = 78;
literals["ah"] = 79;
literals["host"] = 116;
literals["interface"] = 106;
literals["rip"] = 114;
@@ -102,49 +102,49 @@ void PFCfgLexer::initLiterals()
literals["file"] = 19;
literals["network"] = 26;
literals["synproxy"] = 101;
literals["round-robin"] = 46;
literals["round-robin"] = 48;
literals["altq"] = 9;
literals["any"] = 87;
literals["esp"] = 77;
literals["any"] = 88;
literals["esp"] = 78;
literals["alerts"] = 118;
literals["all"] = 61;
literals["drop"] = 52;
literals["return-icmp"] = 56;
literals["inet6"] = 67;
literals["all"] = 62;
literals["drop"] = 53;
literals["return-icmp"] = 57;
literals["inet6"] = 68;
literals["inactive"] = 127;
literals["label"] = 103;
literals["no-route"] = 88;
literals["udp"] = 73;
literals["reply-to"] = 91;
literals["tag"] = 97;
literals["port"] = 39;
literals["code"] = 94;
literals["ip"] = 69;
literals["no-route"] = 89;
literals["udp"] = 74;
literals["reply-to"] = 92;
literals["tag"] = 98;
literals["port"] = 41;
literals["code"] = 95;
literals["ip"] = 70;
literals["table"] = 13;
literals["eigrp"] = 79;
literals["eigrp"] = 80;
literals["errors"] = 122;
literals["sticky-address"] = 47;
literals["ipip"] = 81;
literals["sticky-address"] = 49;
literals["ipip"] = 82;
literals["antispoof"] = 8;
literals["random"] = 42;
literals["binat"] = 48;
literals["igmp"] = 71;
literals["on"] = 65;
literals["random"] = 44;
literals["binat"] = 50;
literals["igmp"] = 72;
literals["on"] = 66;
literals["state"] = 102;
literals["string-key"] = 45;
literals["log"] = 60;
literals["proto"] = 68;
literals["rdr"] = 49;
literals["string-key"] = 47;
literals["log"] = 61;
literals["proto"] = 69;
literals["rdr"] = 38;
literals["informational"] = 123;
literals["self"] = 30;
literals["in"] = 58;
literals["in"] = 59;
literals["keep"] = 99;
literals["block"] = 51;
literals["l2tp"] = 83;
literals["quick"] = 64;
literals["user"] = 62;
literals["icmp"] = 70;
literals["tcp"] = 72;
literals["block"] = 52;
literals["l2tp"] = 84;
literals["quick"] = 65;
literals["user"] = 63;
literals["icmp"] = 71;
literals["tcp"] = 73;
}
ANTLR_USE_NAMESPACE(antlr)RefToken PFCfgLexer::nextToken()
@@ -452,11 +452,11 @@ void PFCfgLexer::mLINE_COMMENT(bool _createToken) {
}
}
else {
goto _loop188;
goto _loop202;
}
}
_loop188:;
_loop202:;
} // ( ... )*
mNEWLINE(false);
if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@@ -488,7 +488,7 @@ void PFCfgLexer::mNEWLINE(bool _createToken) {
}
if ( inputState->guessing==0 ) {
#line 1297 "pf.g"
#line 1370 "pf.g"
newline();
#line 494 "PFCfgLexer.cpp"
}
@@ -569,7 +569,7 @@ void PFCfgLexer::mWhitespace(bool _createToken) {
}
}
if ( inputState->guessing==0 ) {
#line 1292 "pf.g"
#line 1365 "pf.g"
_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
#line 575 "PFCfgLexer.cpp"
}
@@ -756,10 +756,10 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
_ttype = NUMBER_ADDRESS_OR_WORD;
ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
bool synPredMatched213 = false;
bool synPredMatched227 = false;
if ((((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_2.member(LA(2))) && (_tokenSet_2.member(LA(3))))) {
int _m213 = mark();
synPredMatched213 = true;
int _m227 = mark();
synPredMatched227 = true;
inputState->guessing++;
try {
{
@@ -770,12 +770,12 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched213 = false;
synPredMatched227 = false;
}
rewind(_m213);
rewind(_m227);
inputState->guessing--;
}
if ( synPredMatched213 ) {
if ( synPredMatched227 ) {
{
mNUM_3DIGIT(false);
match('.' /* charlit */ );
@@ -786,99 +786,99 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
mNUM_3DIGIT(false);
}
if ( inputState->guessing==0 ) {
#line 1334 "pf.g"
#line 1407 "pf.g"
_ttype = IPV4;
#line 792 "PFCfgLexer.cpp"
}
}
else {
bool synPredMatched220 = false;
bool synPredMatched234 = false;
if ((((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_2.member(LA(2))) && (_tokenSet_2.member(LA(3))))) {
int _m220 = mark();
synPredMatched220 = true;
int _m234 = mark();
synPredMatched234 = true;
inputState->guessing++;
try {
{
{ // ( ... )+
int _cnt217=0;
int _cnt231=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt217>=1 ) { goto _loop217; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt231>=1 ) { goto _loop231; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt217++;
_cnt231++;
}
_loop217:;
_loop231:;
} // ( ... )+
match('.' /* charlit */ );
{ // ( ... )+
int _cnt219=0;
int _cnt233=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt219>=1 ) { goto _loop219; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt233>=1 ) { goto _loop233; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt219++;
_cnt233++;
}
_loop219:;
_loop233:;
} // ( ... )+
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched220 = false;
synPredMatched234 = false;
}
rewind(_m220);
rewind(_m234);
inputState->guessing--;
}
if ( synPredMatched220 ) {
if ( synPredMatched234 ) {
{
{ // ( ... )+
int _cnt223=0;
int _cnt237=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt223>=1 ) { goto _loop223; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt237>=1 ) { goto _loop237; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt223++;
_cnt237++;
}
_loop223:;
_loop237:;
} // ( ... )+
match('.' /* charlit */ );
{ // ( ... )+
int _cnt225=0;
int _cnt239=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt225>=1 ) { goto _loop225; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt239>=1 ) { goto _loop239; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt225++;
_cnt239++;
}
_loop225:;
_loop239:;
} // ( ... )+
}
if ( inputState->guessing==0 ) {
#line 1337 "pf.g"
#line 1410 "pf.g"
_ttype = NUMBER;
#line 875 "PFCfgLexer.cpp"
}
}
else {
bool synPredMatched244 = false;
bool synPredMatched258 = false;
if (((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && ((LA(3) >= 0x30 /* '0' */ && LA(3) <= 0x39 /* '9' */ )))) {
int _m244 = mark();
synPredMatched244 = true;
int _m258 = mark();
synPredMatched258 = true;
inputState->guessing++;
try {
{
@@ -888,12 +888,12 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched244 = false;
synPredMatched258 = false;
}
rewind(_m244);
rewind(_m258);
inputState->guessing--;
}
if ( synPredMatched244 ) {
if ( synPredMatched258 ) {
match(':' /* charlit */ );
match(':' /* charlit */ );
mNUM_HEX_4DIGIT(false);
@@ -904,23 +904,23 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
mNUM_HEX_4DIGIT(false);
}
else {
goto _loop246;
goto _loop260;
}
}
_loop246:;
_loop260:;
} // ( ... )*
if ( inputState->guessing==0 ) {
#line 1360 "pf.g"
#line 1433 "pf.g"
_ttype = IPV6;
#line 917 "PFCfgLexer.cpp"
}
}
else {
bool synPredMatched229 = false;
bool synPredMatched243 = false;
if ((((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && ((LA(2) >= 0x61 /* 'a' */ && LA(2) <= 0x66 /* 'f' */ )))) {
int _m229 = mark();
synPredMatched229 = true;
int _m243 = mark();
synPredMatched243 = true;
inputState->guessing++;
try {
{
@@ -929,60 +929,60 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched229 = false;
synPredMatched243 = false;
}
rewind(_m229);
rewind(_m243);
inputState->guessing--;
}
if ( synPredMatched229 ) {
if ( synPredMatched243 ) {
{
bool synPredMatched234 = false;
bool synPredMatched248 = false;
if ((((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && ((LA(2) >= 0x61 /* 'a' */ && LA(2) <= 0x66 /* 'f' */ )) && ((LA(3) >= 0x30 /* '0' */ && LA(3) <= 0x3a /* ':' */ )))) {
int _m234 = mark();
synPredMatched234 = true;
int _m248 = mark();
synPredMatched248 = true;
inputState->guessing++;
try {
{
{ // ( ... )+
int _cnt233=0;
int _cnt247=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mNUM_HEX_4DIGIT(false);
match(':' /* charlit */ );
}
else {
if ( _cnt233>=1 ) { goto _loop233; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt247>=1 ) { goto _loop247; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt233++;
_cnt247++;
}
_loop233:;
_loop247:;
} // ( ... )+
match(':' /* charlit */ );
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched234 = false;
synPredMatched248 = false;
}
rewind(_m234);
rewind(_m248);
inputState->guessing--;
}
if ( synPredMatched234 ) {
if ( synPredMatched248 ) {
{
{ // ( ... )+
int _cnt237=0;
int _cnt251=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mNUM_HEX_4DIGIT(false);
match(':' /* charlit */ );
}
else {
if ( _cnt237>=1 ) { goto _loop237; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt251>=1 ) { goto _loop251; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt237++;
_cnt251++;
}
_loop237:;
_loop251:;
} // ( ... )+
match(':' /* charlit */ );
{
@@ -995,11 +995,11 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
mNUM_HEX_4DIGIT(false);
}
else {
goto _loop240;
goto _loop254;
}
}
_loop240:;
_loop254:;
} // ( ... )*
}
else {
@@ -1008,7 +1008,7 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
}
if ( inputState->guessing==0 ) {
#line 1351 "pf.g"
#line 1424 "pf.g"
_ttype = IPV6;
#line 1014 "PFCfgLexer.cpp"
}
@@ -1016,22 +1016,22 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
else if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && ((LA(2) >= 0x61 /* 'a' */ && LA(2) <= 0x66 /* 'f' */ )) && ((LA(3) >= 0x30 /* '0' */ && LA(3) <= 0x3a /* ':' */ ))) {
mNUM_HEX_4DIGIT(false);
{ // ( ... )+
int _cnt242=0;
int _cnt256=0;
for (;;) {
if ((LA(1) == 0x3a /* ':' */ )) {
match(':' /* charlit */ );
mNUM_HEX_4DIGIT(false);
}
else {
if ( _cnt242>=1 ) { goto _loop242; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt256>=1 ) { goto _loop256; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt242++;
_cnt256++;
}
_loop242:;
_loop256:;
} // ( ... )+
if ( inputState->guessing==0 ) {
#line 1354 "pf.g"
#line 1427 "pf.g"
_ttype = IPV6;
#line 1037 "PFCfgLexer.cpp"
}
@@ -1042,7 +1042,7 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
if ( inputState->guessing==0 ) {
#line 1356 "pf.g"
#line 1429 "pf.g"
_ttype = IPV6;
#line 1048 "PFCfgLexer.cpp"
}
@@ -1051,28 +1051,28 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
match(':' /* charlit */ );
match(':' /* charlit */ );
if ( inputState->guessing==0 ) {
#line 1363 "pf.g"
#line 1436 "pf.g"
_ttype = IPV6;
#line 1057 "PFCfgLexer.cpp"
}
}
else if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
{ // ( ... )+
int _cnt227=0;
int _cnt241=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt227>=1 ) { goto _loop227; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt241>=1 ) { goto _loop241; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt227++;
_cnt241++;
}
_loop227:;
_loop241:;
} // ( ... )+
if ( inputState->guessing==0 ) {
#line 1342 "pf.g"
#line 1415 "pf.g"
_ttype = INT_CONST;
#line 1078 "PFCfgLexer.cpp"
}
@@ -1080,7 +1080,7 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
else if ((LA(1) == 0x3a /* ':' */ ) && (true)) {
match(':' /* charlit */ );
if ( inputState->guessing==0 ) {
#line 1366 "pf.g"
#line 1439 "pf.g"
_ttype = COLON;
#line 1086 "PFCfgLexer.cpp"
}
@@ -1293,14 +1293,14 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
default:
{
goto _loop249;
goto _loop263;
}
}
}
_loop249:;
_loop263:;
} // ( ... )*
if ( inputState->guessing==0 ) {
#line 1378 "pf.g"
#line 1451 "pf.g"
_ttype = WORD;
#line 1306 "PFCfgLexer.cpp"
}
@@ -1330,11 +1330,11 @@ void PFCfgLexer::mSTRING(bool _createToken) {
matchNot('\"' /* charlit */ );
}
else {
goto _loop252;
goto _loop266;
}
}
_loop252:;
_loop266:;
} // ( ... )*
match('\"' /* charlit */ );
if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
src/parsers/PFCfgParser.cpp
+862 -491
View File
File diff suppressed because it is too large Load Diff
src/parsers/PFCfgParser.hpp
+1
View File
@@ -98,6 +98,7 @@ public:
public: void set_rule();
public: void scrub_rule();
public: void table_rule();
public: void no_nat_rule();
public: void nat_rule();
public: void rdr_rule();
public: void binat_rule();
src/parsers/PFCfgParserTokenTypes.hpp
+66 -66
View File
@@ -41,72 +41,72 @@ struct CUSTOM_API PFCfgParserTokenTypes {
SELF = 30,
IPV4 = 31,
SLASH = 32,
NAT = 33,
PASS = 34,
MINUS = 35,
STATIC_PORT = 36,
OPENING_PAREN = 37,
CLOSING_PAREN = 38,
PORT = 39,
STAR = 40,
BITMASK = 41,
RANDOM = 42,
SOURCE_HASH = 43,
HEX_KEY = 44,
STRING_KEY = 45,
ROUND_ROBIN = 46,
STICKY_ADDRESS = 47,
BINAT = 48,
RDR = 49,
TIMEOUT = 50,
BLOCK = 51,
DROP = 52,
RETURN = 53,
RETURN_RST = 54,
TTL = 55,
RETURN_ICMP = 56,
RETURN_ICMP6 = 57,
IN = 58,
OUT = 59,
LOG = 60,
ALL = 61,
USER = 62,
TO = 63,
QUICK = 64,
ON = 65,
INET = 66,
INET6 = 67,
PROTO = 68,
IP = 69,
ICMP = 70,
IGMP = 71,
TCP = 72,
UDP = 73,
RDP = 74,
RSVP = 75,
GRE = 76,
ESP = 77,
AH = 78,
EIGRP = 79,
OSPF = 80,
IPIP = 81,
VRRP = 82,
L2TP = 83,
ISIS = 84,
FROM = 85,
URPF_FAILED = 86,
ANY = 87,
NO_ROUTE = 88,
IPV6 = 89,
ROUTE_TO = 90,
REPLY_TO = 91,
FLAGS = 92,
ICMP_TYPE = 93,
ICMP_CODE = 94,
ICMP6_TYPE = 95,
TAGGED = 96,
TAG = 97,
NO = 98,
NO = 33,
NAT = 34,
PASS = 35,
MINUS = 36,
STATIC_PORT = 37,
RDR = 38,
OPENING_PAREN = 39,
CLOSING_PAREN = 40,
PORT = 41,
STAR = 42,
BITMASK = 43,
RANDOM = 44,
SOURCE_HASH = 45,
HEX_KEY = 46,
STRING_KEY = 47,
ROUND_ROBIN = 48,
STICKY_ADDRESS = 49,
BINAT = 50,
TIMEOUT = 51,
BLOCK = 52,
DROP = 53,
RETURN = 54,
RETURN_RST = 55,
TTL = 56,
RETURN_ICMP = 57,
RETURN_ICMP6 = 58,
IN = 59,
OUT = 60,
LOG = 61,
ALL = 62,
USER = 63,
TO = 64,
QUICK = 65,
ON = 66,
INET = 67,
INET6 = 68,
PROTO = 69,
IP = 70,
ICMP = 71,
IGMP = 72,
TCP = 73,
UDP = 74,
RDP = 75,
RSVP = 76,
GRE = 77,
ESP = 78,
AH = 79,
EIGRP = 80,
OSPF = 81,
IPIP = 82,
VRRP = 83,
L2TP = 84,
ISIS = 85,
FROM = 86,
URPF_FAILED = 87,
ANY = 88,
NO_ROUTE = 89,
IPV6 = 90,
ROUTE_TO = 91,
REPLY_TO = 92,
FLAGS = 93,
ICMP_TYPE = 94,
ICMP_CODE = 95,
ICMP6_TYPE = 96,
TAGGED = 97,
TAG = 98,
KEEP = 99,
MODULATE = 100,
SYNPROXY = 101,
src/parsers/PFCfgParserTokenTypes.txt
+66 -66
View File
@@ -29,72 +29,72 @@ INT_CONST=29
SELF="self"=30
IPV4=31
SLASH=32
NAT="nat"=33
PASS="pass"=34
MINUS=35
STATIC_PORT="static-port"=36
OPENING_PAREN=37
CLOSING_PAREN=38
PORT="port"=39
STAR=40
BITMASK="bitmask"=41
RANDOM="random"=42
SOURCE_HASH="source-hash"=43
HEX_KEY="hex-key"=44
STRING_KEY="string-key"=45
ROUND_ROBIN="round-robin"=46
STICKY_ADDRESS="sticky-address"=47
BINAT="binat"=48
RDR="rdr"=49
TIMEOUT="timeout"=50
BLOCK="block"=51
DROP="drop"=52
RETURN="return"=53
RETURN_RST="return-rst"=54
TTL=55
RETURN_ICMP="return-icmp"=56
RETURN_ICMP6=57
IN="in"=58
OUT="out"=59
LOG="log"=60
ALL="all"=61
USER="user"=62
TO="to"=63
QUICK="quick"=64
ON="on"=65
INET="inet"=66
INET6="inet6"=67
PROTO="proto"=68
IP="ip"=69
ICMP="icmp"=70
IGMP="igmp"=71
TCP="tcp"=72
UDP="udp"=73
RDP="rdp"=74
RSVP="rsvp"=75
GRE="gre"=76
ESP="esp"=77
AH="ah"=78
EIGRP="eigrp"=79
OSPF="ospf"=80
IPIP="ipip"=81
VRRP="vrrp"=82
L2TP="l2tp"=83
ISIS="isis"=84
FROM="from"=85
URPF_FAILED="urpf-failed"=86
ANY="any"=87
NO_ROUTE="no-route"=88
IPV6=89
ROUTE_TO="route-to"=90
REPLY_TO="reply-to"=91
FLAGS="flags"=92
ICMP_TYPE="icmp-type"=93
ICMP_CODE="code"=94
ICMP6_TYPE="icmp6-type"=95
TAGGED="tagged"=96
TAG="tag"=97
NO="no"=98
NO="no"=33
NAT="nat"=34
PASS="pass"=35
MINUS=36
STATIC_PORT="static-port"=37
RDR="rdr"=38
OPENING_PAREN=39
CLOSING_PAREN=40
PORT="port"=41
STAR=42
BITMASK="bitmask"=43
RANDOM="random"=44
SOURCE_HASH="source-hash"=45
HEX_KEY="hex-key"=46
STRING_KEY="string-key"=47
ROUND_ROBIN="round-robin"=48
STICKY_ADDRESS="sticky-address"=49
BINAT="binat"=50
TIMEOUT="timeout"=51
BLOCK="block"=52
DROP="drop"=53
RETURN="return"=54
RETURN_RST="return-rst"=55
TTL=56
RETURN_ICMP="return-icmp"=57
RETURN_ICMP6=58
IN="in"=59
OUT="out"=60
LOG="log"=61
ALL="all"=62
USER="user"=63
TO="to"=64
QUICK="quick"=65
ON="on"=66
INET="inet"=67
INET6="inet6"=68
PROTO="proto"=69
IP="ip"=70
ICMP="icmp"=71
IGMP="igmp"=72
TCP="tcp"=73
UDP="udp"=74
RDP="rdp"=75
RSVP="rsvp"=76
GRE="gre"=77
ESP="esp"=78
AH="ah"=79
EIGRP="eigrp"=80
OSPF="ospf"=81
IPIP="ipip"=82
VRRP="vrrp"=83
L2TP="l2tp"=84
ISIS="isis"=85
FROM="from"=86
URPF_FAILED="urpf-failed"=87
ANY="any"=88
NO_ROUTE="no-route"=89
IPV6=90
ROUTE_TO="route-to"=91
REPLY_TO="reply-to"=92
FLAGS="flags"=93
ICMP_TYPE="icmp-type"=94
ICMP_CODE="code"=95
ICMP6_TYPE="icmp6-type"=96
TAGGED="tagged"=97
TAG="tag"=98
KEEP="keep"=99
MODULATE="modulate"=100
SYNPROXY="synproxy"=101
src/parsers/pf.g
+94 -21
View File
@@ -127,6 +127,8 @@ cfgfile :
scrub_rule
|
table_rule
|
no_nat_rule
|
nat_rule
|
@@ -310,13 +312,34 @@ tableaddr_spec { AddressSpec as; } :
;
//****************************************************************
nat_rule : NAT
no_nat_rule :
NO
{
importer->clear();
importer->setCurrentLineNumber(LT(0)->getLine());
importer->newNATRule();
importer->action = "nat";
*dbg << LT(1)->getLine() << ":" << " nat ";
importer->action = "nonat";
*dbg << LT(1)->getLine() << ":" << " nonat ";
}
(
nat_rule
|
rdr_rule
)
;
//****************************************************************
nat_rule :
NAT
{
if ( importer->action != "nonat" )
{
importer->clear();
importer->setCurrentLineNumber(LT(0)->getLine());
importer->newNATRule();
importer->action = "nat";
*dbg << LT(1)->getLine() << ":" << " nat ";
}
}
(
PASS
@@ -338,20 +361,75 @@ nat_rule : NAT
QString("import of 'nat ... tag' commands is not supported."));
}
)?
MINUS GREATER_THAN
( redirhost | redirhost_list )
(
MINUS GREATER_THAN
( redirhost | redirhost_list )
{
importer->nat_group = importer->tmp_group;
}
(
portspec
{
importer->nat_port_group = importer->tmp_port_group;
}
)?
( pooltype )?
(
STATIC_PORT { importer->nat_rule_opt_2 = "static-port"; }
)?
)?
{
importer->nat_group = importer->tmp_group;
importer->pushRule();
}
NEWLINE
;
//****************************************************************
rdr_rule :
RDR
{
if ( importer->action != "nonat" )
{
importer->clear();
importer->setCurrentLineNumber(LT(0)->getLine());
importer->newNATRule();
importer->action = "rdr";
*dbg << LT(1)->getLine() << ":" << " rdr ";
}
}
(
portspec
PASS
{
importer->nat_port_group = importer->tmp_port_group;
importer->error_tracker->registerError(
QString("import of 'nat pass' commands is not supported."));
}
( logging )?
)?
( intrface )?
( address_family )?
( protospec )?
hosts
( tagged )?
(
tag_clause
{
importer->error_tracker->registerError(
QString("import of 'nat ... tag' commands is not supported."));
}
)?
( pooltype )?
(
STATIC_PORT { importer->nat_rule_opt_2 = "static-port"; }
MINUS GREATER_THAN
( redirhost | redirhost_list )
{
importer->nat_group = importer->tmp_group;
}
(
portspec
{
importer->nat_port_group = importer->tmp_port_group;
}
)?
( pooltype )?
)?
{
importer->pushRule();
@@ -490,17 +568,6 @@ binat_rule : BINAT
}
;
//****************************************************************
rdr_rule : RDR
{
importer->clear();
importer->setCurrentLineNumber(LT(0)->getLine());
importer->addMessageToLog(
QString("Warning: import of 'rdr' commands has not been implemented yet."));
consumeUntil(NEWLINE);
}
;
//****************************************************************
timeout_rule : TIMEOUT
{
@@ -843,6 +910,12 @@ host { AddressSpec as; } :
as.at = AddressSpec::TABLE;
as.address = tn->getText();
}
|
OPENING_PAREN in:WORD CLOSING_PAREN
{
as.at = AddressSpec::INTERFACE_NAME;
as.address = in->getText();
}
)
{
importer->tmp_group.push_back(as);
src/unit_tests/PFImporterTest/PFImporterTest.cpp
+21
View File
@@ -372,3 +372,24 @@ void PFImporterTest::natCommands()
"pf-nat-rules.fwb");
}
void PFImporterTest::rdrCommands()
{
platform = "pf";
std::istringstream instream(
openTestFile("test_data/pf-rdr-rules.conf"));
Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
CPPUNIT_ASSERT_NO_THROW( imp->run() );
imp->finalize();
db->setPredictableIds();
db->saveFile("pf-rdr-rules.fwb");
compareResults(logger,
"test_data/pf-rdr-rules.output",
"pf-rdr-rules.output");
compareFwbFiles("test_data/pf-rdr-rules.fwb",
"pf-rdr-rules.fwb");
}
src/unit_tests/PFImporterTest/PFImporterTest.h
+2
View File
@@ -66,6 +66,7 @@ public:
void stateMatchTest();
void tcpFlagsMatchTest();
void natCommands();
void rdrCommands();
CPPUNIT_TEST_SUITE(PFImporterTest);
@@ -77,6 +78,7 @@ public:
CPPUNIT_TEST(stateMatchTest);
CPPUNIT_TEST(tcpFlagsMatchTest);
CPPUNIT_TEST(natCommands);
CPPUNIT_TEST(rdrCommands);
CPPUNIT_TEST_SUITE_END();
src/unit_tests/PFImporterTest/test_data/pf-interface-matches.conf
+2
View File
@@ -6,3 +6,5 @@ pass in quick from pcn0:broadcast to self
pass in quick from pcn0:peer to self
pass in quick from pcn0:0 to self
pass in quick from any to (pcn0)
pass out quick from (pcn0) to any
src/unit_tests/PFImporterTest/test_data/pf-interface-matches.fwb
+50 -10
View File
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1306818101" id="root">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1306871654" id="root">
<Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
<AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
<AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -451,13 +451,13 @@
</ServiceGroup>
<ObjectGroup id="id18" name="Firewalls" comment="" ro="False">
<Firewall id="id19" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of line 4" ro="False">
<NAT id="id71" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<NAT id="id95" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</NAT>
<Policy id="id21" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<PolicyRule id="id23" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="Created during import of line 4">
<Src neg="False">
<ObjectRef ref="id76"/>
<ObjectRef ref="id100"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id19"/>
@@ -498,7 +498,7 @@
</PolicyRule>
<PolicyRule id="id47" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Created during import of line 6&#10;import of 'interface:peer' is not supported.">
<Src neg="False">
<ObjectRef ref="id75"/>
<ObjectRef ref="id99"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id19"/>
@@ -519,7 +519,7 @@
</PolicyRule>
<PolicyRule id="id59" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Created during import of line 7&#10;import of 'interface:0' is not supported.">
<Src neg="False">
<ObjectRef ref="id75"/>
<ObjectRef ref="id99"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id19"/>
@@ -538,14 +538,54 @@
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule id="id71" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Created during import of line 9">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id99"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule id="id83" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="Created during import of line 10">
<Src neg="False">
<ObjectRef ref="id99"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
<RuleSetOptions/>
</Policy>
<Routing id="id73" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<Routing id="id97" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</Routing>
<Interface id="id75" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="pcn0" comment="Created during import of line 4" ro="False">
<Interface id="id99" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="pcn0" comment="Created during import of line 4" ro="False">
<InterfaceOptions/>
<AttachedNetworks id="id76" name="pcn0-net" comment="" ro="False"/>
<AttachedNetworks id="id100" name="pcn0-net" comment="" ro="False"/>
</Interface>
<FirewallOptions>
<Option name="check_shading">true</Option>
@@ -565,7 +605,7 @@
</FirewallOptions>
</Firewall>
</ObjectGroup>
<ObjectGroup id="id78" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="id79" name="Time" comment="" ro="False"/>
<ObjectGroup id="id102" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="id103" name="Time" comment="" ro="False"/>
</Library>
</FWObjectDatabase>
src/unit_tests/PFImporterTest/test_data/pf-interface-matches.output
+2
View File
@@ -6,3 +6,5 @@
6: Error: import of 'interface:peer' is not supported.
7: filtering rule: action pass; interfaces:
7: Error: import of 'interface:0' is not supported.
9: filtering rule: action pass; interfaces:
10: filtering rule: action pass; interfaces:
src/unit_tests/PFImporterTest/test_data/pf-nat-rules.fwb
+153 -95
View File
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1306818182" id="root">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1306871680" id="root">
<Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
<AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
<AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -433,37 +433,41 @@
<ObjectGroup id="id1" name="Objects" comment="" ro="False">
<ObjectGroup id="id2" name="Addresses" comment="" ro="False">
<IPv4 id="id3" name="h-192.0.2.111" comment="Created during import of line 3" ro="False" address="192.0.2.111" netmask="255.255.255.255"/>
<IPv4 id="id4" name="h-192.0.2.100" comment="Created during import of line 27" ro="False" address="192.0.2.100" netmask="255.255.255.255"/>
</ObjectGroup>
<ObjectGroup id="id4" name="DNS Names" comment="" ro="False"/>
<ObjectGroup id="id5" name="Address Tables" comment="" ro="False"/>
<ObjectGroup id="id6" name="Groups" comment="" ro="False"/>
<ObjectGroup id="id7" name="Hosts" comment="" ro="False"/>
<ObjectGroup id="id8" name="Networks" comment="" ro="False">
<Network id="id9" name="net-192.168.168.0/255.255.255.0" comment="Created during import of line 3" ro="False" address="192.168.168.0" netmask="255.255.255.0"/>
<Network id="id10" name="net-192.0.2.16/255.255.255.240" comment="Created during import of line 6" ro="False" address="192.0.2.16" netmask="255.255.255.240"/>
<ObjectGroup id="id5" name="DNS Names" comment="" ro="False"/>
<ObjectGroup id="id6" name="Address Tables" comment="" ro="False"/>
<ObjectGroup id="id7" name="Groups" comment="" ro="False"/>
<ObjectGroup id="id8" name="Hosts" comment="" ro="False"/>
<ObjectGroup id="id9" name="Networks" comment="" ro="False">
<Network id="id10" name="net-192.168.168.0/255.255.255.0" comment="Created during import of line 3" ro="False" address="192.168.168.0" netmask="255.255.255.0"/>
<Network id="id11" name="net-192.0.2.16/255.255.255.240" comment="Created during import of line 6" ro="False" address="192.0.2.16" netmask="255.255.255.240"/>
<Network id="id12" name="net-192.168.1.0/255.255.255.0" comment="Created during import of line 26" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
</ObjectGroup>
<ObjectGroup id="id11" name="Address Ranges" comment="" ro="False"/>
<ObjectGroup id="id13" name="Address Ranges" comment="" ro="False"/>
</ObjectGroup>
<ServiceGroup id="id12" name="Services" comment="" ro="False">
<ServiceGroup id="id13" name="Groups" comment="" ro="False"/>
<ServiceGroup id="id14" name="ICMP" comment="" ro="False"/>
<ServiceGroup id="id15" name="IP" comment="" ro="False"/>
<ServiceGroup id="id16" name="TCP" comment="" ro="False"/>
<ServiceGroup id="id17" name="UDP" comment="" ro="False">
<UDPService id="id18" name="udp 10000:10000 / 0:0" comment="Created during import of line 16" ro="False" src_range_start="10000" src_range_end="10000" dst_range_start="0" dst_range_end="0"/>
<UDPService id="id19" name="udp 10000:10010 / 0:0" comment="Created during import of line 19" ro="False" src_range_start="10000" src_range_end="10010" dst_range_start="0" dst_range_end="0"/>
<UDPService id="id20" name="udp 10000:65535 / 0:0" comment="Created during import of line 20" ro="False" src_range_start="10000" src_range_end="65535" dst_range_start="0" dst_range_end="0"/>
<ServiceGroup id="id14" name="Services" comment="" ro="False">
<ServiceGroup id="id15" name="Groups" comment="" ro="False"/>
<ServiceGroup id="id16" name="ICMP" comment="" ro="False"/>
<ServiceGroup id="id17" name="IP" comment="" ro="False">
<IPService id="id18" any_opt="False" dscp="" fragm="False" lsrr="False" protocol_num="51" rr="False" rtralt="False" rtralt_value="False" short_fragm="False" ssrr="False" tos="" ts="False" name="ip-51" comment="Created during import of line 26" ro="False"/>
</ServiceGroup>
<ServiceGroup id="id21" name="Users" comment="" ro="False"/>
<ServiceGroup id="id22" name="Custom" comment="" ro="False"/>
<ServiceGroup id="id23" name="TagServices" comment="" ro="False"/>
<ServiceGroup id="id19" name="TCP" comment="" ro="False"/>
<ServiceGroup id="id20" name="UDP" comment="" ro="False">
<UDPService id="id21" name="udp 10000:10000 / 0:0" comment="Created during import of line 16" ro="False" src_range_start="10000" src_range_end="10000" dst_range_start="0" dst_range_end="0"/>
<UDPService id="id22" name="udp 10000:10010 / 0:0" comment="Created during import of line 19" ro="False" src_range_start="10000" src_range_end="10010" dst_range_start="0" dst_range_end="0"/>
<UDPService id="id23" name="udp 10000:65535 / 0:0" comment="Created during import of line 20" ro="False" src_range_start="10000" src_range_end="65535" dst_range_start="0" dst_range_end="0"/>
</ServiceGroup>
<ServiceGroup id="id24" name="Users" comment="" ro="False"/>
<ServiceGroup id="id25" name="Custom" comment="" ro="False"/>
<ServiceGroup id="id26" name="TagServices" comment="" ro="False"/>
</ServiceGroup>
<ObjectGroup id="id24" name="Firewalls" comment="" ro="False">
<Firewall id="id25" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of line 3" ro="False">
<NAT id="id29" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<NATRule id="id31" disabled="False" group="" position="0" action="Translate" comment="Created during import of line 3">
<ObjectGroup id="id27" name="Firewalls" comment="" ro="False">
<Firewall id="id28" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of line 3" ro="False">
<NAT id="id32" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<NATRule id="id34" disabled="False" group="" position="0" action="Translate" comment="Created during import of line 3">
<OSrc neg="False">
<ObjectRef ref="id9"/>
<ObjectRef ref="id10"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
@@ -484,13 +488,13 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<NATRule id="id49" disabled="False" group="" position="1" action="Translate" comment="Created during import of line 4">
<NATRule id="id52" disabled="False" group="" position="1" action="Translate" comment="Created during import of line 4">
<OSrc neg="False">
<ObjectRef ref="id9"/>
<ObjectRef ref="id10"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
@@ -511,11 +515,11 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="True">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<NATRule id="id67" disabled="False" group="" position="2" action="Translate" comment="Created during import of line 6">
<NATRule id="id70" disabled="False" group="" position="2" action="Translate" comment="Created during import of line 6">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -526,7 +530,7 @@
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id10"/>
<ObjectRef ref="id11"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
@@ -538,13 +542,13 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions>
<Option name="pf_bitmask">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id85" disabled="False" group="" position="3" action="Translate" comment="Created during import of line 7">
<NATRule id="id88" disabled="False" group="" position="3" action="Translate" comment="Created during import of line 7">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -555,7 +559,7 @@
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id10"/>
<ObjectRef ref="id11"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
@@ -567,13 +571,13 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions>
<Option name="pf_random">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id103" disabled="False" group="" position="4" action="Translate" comment="Created during import of line 8">
<NATRule id="id106" disabled="False" group="" position="4" action="Translate" comment="Created during import of line 8">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -584,7 +588,7 @@
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id10"/>
<ObjectRef ref="id11"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
@@ -596,13 +600,13 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions>
<Option name="pf_random">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id121" disabled="False" group="" position="5" action="Translate" comment="Created during import of line 9">
<NATRule id="id124" disabled="False" group="" position="5" action="Translate" comment="Created during import of line 9">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -613,7 +617,7 @@
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id10"/>
<ObjectRef ref="id11"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
@@ -625,13 +629,13 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions>
<Option name="pf_source_hash">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id139" disabled="False" group="" position="6" action="Translate" comment="Created during import of line 10&#10;import of 'nat' commands with 'source-hash hex-key' option is not supported">
<NATRule id="id142" disabled="False" group="" position="6" action="Translate" comment="Created during import of line 10&#10;import of 'nat' commands with 'source-hash hex-key' option is not supported">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -642,7 +646,7 @@
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id10"/>
<ObjectRef ref="id11"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
@@ -654,14 +658,14 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions>
<Option name="color">#C86E6E</Option>
<Option name="pf_source_hash">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id157" disabled="False" group="" position="7" action="Translate" comment="Created during import of line 11&#10;import of 'nat' commands with 'source-hash string-key' option is not supported">
<NATRule id="id160" disabled="False" group="" position="7" action="Translate" comment="Created during import of line 11&#10;import of 'nat' commands with 'source-hash string-key' option is not supported">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -672,7 +676,7 @@
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id10"/>
<ObjectRef ref="id11"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
@@ -684,14 +688,14 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions>
<Option name="color">#C86E6E</Option>
<Option name="pf_source_hash">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id175" disabled="False" group="" position="8" action="Translate" comment="Created during import of line 12">
<NATRule id="id178" disabled="False" group="" position="8" action="Translate" comment="Created during import of line 12">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -702,7 +706,7 @@
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id10"/>
<ObjectRef ref="id11"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
@@ -714,13 +718,13 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions>
<Option name="pf_round_robin">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id193" disabled="False" group="" position="9" action="Translate" comment="Created during import of line 13">
<NATRule id="id196" disabled="False" group="" position="9" action="Translate" comment="Created during import of line 13">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -731,7 +735,7 @@
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id10"/>
<ObjectRef ref="id11"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
@@ -743,13 +747,13 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions>
<Option name="pf_round_robin">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id211" disabled="False" group="" position="10" action="Translate" comment="Created during import of line 14">
<NATRule id="id214" disabled="False" group="" position="10" action="Translate" comment="Created during import of line 14">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -760,7 +764,7 @@
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id10"/>
<ObjectRef ref="id11"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
@@ -772,13 +776,13 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions>
<Option name="pf_static_port">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id229" disabled="False" group="" position="11" action="Translate" comment="Created during import of line 16">
<NATRule id="id232" disabled="False" group="" position="11" action="Translate" comment="Created during import of line 16">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -786,10 +790,10 @@
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id18"/>
<ServiceRef ref="id21"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
@@ -801,11 +805,11 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<NATRule id="id247" disabled="False" group="" position="12" action="Translate" comment="Created during import of line 17">
<NATRule id="id250" disabled="False" group="" position="12" action="Translate" comment="Created during import of line 17">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -813,10 +817,10 @@
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id18"/>
<ServiceRef ref="id21"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
@@ -828,11 +832,11 @@
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<NATRule id="id265" disabled="False" group="" position="13" action="Translate" comment="Created during import of line 18">
<NATRule id="id268" disabled="False" group="" position="13" action="Translate" comment="Created during import of line 18">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -840,26 +844,26 @@
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id18"/>
<ServiceRef ref="id21"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="id18"/>
<ServiceRef ref="id21"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<NATRule id="id283" disabled="False" group="" position="14" action="Translate" comment="Created during import of line 19">
<NATRule id="id286" disabled="False" group="" position="14" action="Translate" comment="Created during import of line 19">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -867,26 +871,26 @@
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id19"/>
<ServiceRef ref="id22"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="id18"/>
<ServiceRef ref="id21"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<NATRule id="id301" disabled="False" group="" position="15" action="Translate" comment="Created during import of line 20">
<NATRule id="id304" disabled="False" group="" position="15" action="Translate" comment="Created during import of line 20">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -894,26 +898,26 @@
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id19"/>
<ServiceRef ref="id22"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="id20"/>
<ServiceRef ref="id23"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<NATRule id="id319" disabled="False" group="" position="16" action="Translate" comment="Created during import of line 22">
<NATRule id="id322" disabled="False" group="" position="16" action="Translate" comment="Created during import of line 22">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -921,28 +925,28 @@
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id18"/>
<ServiceRef ref="id21"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id10"/>
<ObjectRef ref="id11"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="id18"/>
<ServiceRef ref="id21"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions>
<Option name="pf_bitmask">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id337" disabled="False" group="" position="17" action="Translate" comment="Created during import of line 23">
<NATRule id="id340" disabled="False" group="" position="17" action="Translate" comment="Created during import of line 23">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
@@ -950,36 +954,90 @@
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id19"/>
<ServiceRef ref="id22"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id10"/>
<ObjectRef ref="id11"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="id20"/>
<ServiceRef ref="id23"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id357"/>
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions>
<Option name="pf_bitmask">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id358" disabled="False" group="" position="18" action="Translate" comment="Created during import of line 26">
<OSrc neg="False">
<ObjectRef ref="id12"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id18"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="sysid0"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<NATRule id="id376" disabled="False" group="" position="19" action="Translate" comment="Created during import of line 27">
<OSrc neg="False">
<ObjectRef ref="id12"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id4"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id396"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<RuleSetOptions/>
</NAT>
<Policy id="id27" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<Policy id="id30" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</Policy>
<Routing id="id355" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<Routing id="id394" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</Routing>
<Interface id="id357" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="em0" comment="Created during import of line 3" ro="False">
<Interface id="id396" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="em0" comment="Created during import of line 3" ro="False">
<InterfaceOptions/>
</Interface>
<FirewallOptions>
@@ -1000,7 +1058,7 @@
</FirewallOptions>
</Firewall>
</ObjectGroup>
<ObjectGroup id="id359" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="id360" name="Time" comment="" ro="False"/>
<ObjectGroup id="id398" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="id399" name="Time" comment="" ro="False"/>
</Library>
</FWObjectDatabase>
src/unit_tests/PFImporterTest/test_data/pf-nat-rules.output
+2
View File
@@ -19,3 +19,5 @@
20: nat rule: action nat; interfaces: em0
22: nat rule: action nat; interfaces: em0
23: nat rule: action nat; interfaces: em0
26: nat rule: action nonat; interfaces: em0
27: nat rule: action nat; interfaces: em0
src/unit_tests/PFImporterTest/test_data/pf-rdr-rules.conf
+15
View File
@@ -0,0 +1,15 @@
# rdr rules
rdr on em0 inet proto tcp from any to (em0) port 80 -> 10.0.1.111 port 8080
rdr on em0 inet proto tcp from any to any port 80 -> 127.0.0.1 port 8080
# pool-type comes after portspec
rdr on em0 inet proto tcp from any to (em0) port 80 -> \
{ 10.0.1.111, 10.0.1.112, 10.0.1.113 } port 8080 round-robin
# no rdr rule
no rdr on em0 inet proto tcp from 192.168.1.1 to any port 80
rdr on em0 inet proto tcp from 192.168.1.0/24 to any port 80 -> \
192.0.2.100 port 8080
src/unit_tests/PFImporterTest/test_data/pf-rdr-rules.fwb
+638
View File
@@ -0,0 +1,638 @@
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1306871680" id="root">
<Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
<AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
<AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
<AnyInterval id="sysid2" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1" name="Any" comment="Any Interval" ro="False"/>
<ObjectGroup id="stdid01" name="Objects" comment="" ro="False">
<ObjectGroup id="stdid16" name="Addresses" comment="" ro="False">
<IPv4 id="id2001X88798" name="all-hosts" comment="" ro="False" address="224.0.0.1" netmask="0.0.0.0"/>
<IPv4 id="id2002X88798" name="all-routers" comment="" ro="False" address="224.0.0.2" netmask="0.0.0.0"/>
<IPv4 id="id2003X88798" name="all DVMRP" comment="" ro="False" address="224.0.0.4" netmask="0.0.0.0"/>
<IPv4 id="id2117X88798" name="OSPF (all routers)" comment="RFC2328" ro="False" address="224.0.0.5" netmask="0.0.0.0"/>
<IPv4 id="id2128X88798" name="OSPF (designated routers)" comment="RFC2328" ro="False" address="224.0.0.6" netmask="0.0.0.0"/>
<IPv4 id="id2430X88798" name="RIP" comment="RFC1723" ro="False" address="224.0.0.9" netmask="0.0.0.0"/>
<IPv4 id="id2439X88798" name="EIGRP" comment="" ro="False" address="224.0.0.10" netmask="0.0.0.0"/>
<IPv4 id="id2446X88798" name="DHCP server, relay agent" comment="RFC 1884" ro="False" address="224.0.0.12" netmask="0.0.0.0"/>
<IPv4 id="id2455X88798" name="PIM" comment="" ro="False" address="224.0.0.13" netmask="0.0.0.0"/>
<IPv4 id="id2462X88798" name="RSVP" comment="" ro="False" address="224.0.0.14" netmask="0.0.0.0"/>
<IPv4 id="id2469X88798" name="VRRP" comment="RFC3768" ro="False" address="224.0.0.18" netmask="0.0.0.0"/>
<IPv4 id="id2777X88798" name="IGMP" comment="" ro="False" address="224.0.0.22" netmask="0.0.0.0"/>
<IPv4 id="id2784X88798" name="OSPFIGP-TE" comment="RFC4973" ro="False" address="224.0.0.24" netmask="0.0.0.0"/>
<IPv4 id="id3094X88798" name="HSRP" comment="" ro="False" address="224.0.0.102" netmask="0.0.0.0"/>
<IPv4 id="id3403X88798" name="mDNS" comment="" ro="False" address="224.0.0.251" netmask="0.0.0.0"/>
<IPv4 id="id3410X88798" name="LLMNR" comment="Link-Local Multicast Name Resolution, RFC4795" ro="False" address="224.0.0.252" netmask="0.0.0.0"/>
<IPv4 id="id3411X88798" name="Teredo" comment="" ro="False" address="224.0.0.253" netmask="0.0.0.0"/>
</ObjectGroup>
<ObjectGroup id="stdid17" name="DNS Names" comment="" ro="False"/>
<ObjectGroup id="stdid18" name="Address Tables" comment="" ro="False"/>
<ObjectGroup id="stdid04" name="Groups" comment="" ro="False">
<ObjectGroup id="id3DC75CE8" name="rfc1918-nets" comment="" ro="False">
<ObjectRef ref="id3DC75CE5"/>
<ObjectRef ref="id3DC75CE6"/>
<ObjectRef ref="id3DC75CE7"/>
</ObjectGroup>
<ObjectGroup id="id3292X75851" name="ipv6 private" comment="These are various ipv6 networks that should not be routed on the Internet&#10;" ro="False">
<ObjectRef ref="id2088X75851"/>
<ObjectRef ref="id2986X75851"/>
<ObjectRef ref="id2383X75851"/>
</ObjectGroup>
</ObjectGroup>
<ObjectGroup id="stdid02" name="Hosts" comment="" ro="False">
<Host id="id3D84EECE" name="internal server" comment="This host is used in examples and template objects" ro="False">
<Interface id="id3D84EED2" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
<IPv4 id="id3D84EED3" name="ip" comment="" ro="False" address="192.168.1.10" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="192.168.1.10">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions>
<Option name="snmp_contact"></Option>
<Option name="snmp_description"></Option>
<Option name="snmp_location"></Option>
<Option name="use_mac_addr">false</Option>
<Option name="use_mac_addr_filter">False</Option>
</HostOptions>
</Host>
<Host id="id3D84EECF" name="server on dmz" comment="This host is used in examples and template objects" ro="False">
<Interface id="id3D84EEE3" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
<IPv4 id="id3D84EEE4" name="ip" comment="" ro="False" address="192.168.2.10" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="192.168.2.10">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions>
<Option name="snmp_contact"></Option>
<Option name="snmp_description"></Option>
<Option name="snmp_location"></Option>
<Option name="use_mac_addr">false</Option>
<Option name="use_mac_addr_filter">False</Option>
</HostOptions>
</Host>
</ObjectGroup>
<ObjectGroup id="stdid03" name="Networks" comment="" ro="False">
<Network id="id3DC75CEC" name="all multicasts" comment="224.0.0.0/4 - This block, formerly known as the Class D address&#10;space, is allocated for use in IPv4 multicast address assignments.&#10;The IANA guidelines for assignments from this space are described in&#10;[RFC3171].&#10;" ro="False" address="224.0.0.0" netmask="240.0.0.0"/>
<Network id="id3F4ECE3E" name="link-local" comment="169.254.0.0/16 - This is the &quot;link local&quot; block. It is allocated for&#10;communication between hosts on a single link. Hosts obtain these&#10;addresses by auto-configuration, such as when a DHCP server may not&#10;be found.&#10;" ro="False" address="169.254.0.0" netmask="255.255.0.0"/>
<Network id="id3F4ECE3D" name="loopback-net" comment="127.0.0.0/8 - This block is assigned for use as the Internet host&#10;loopback address. A datagram sent by a higher level protocol to an&#10;address anywhere within this block should loop back inside the host.&#10;This is ordinarily implemented using only 127.0.0.1/32 for loopback,&#10;but no addresses within this block should ever appear on any network&#10;anywhere [RFC1700, page 5].&#10;" ro="False" address="127.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE5" name="net-10.0.0.0" comment="10.0.0.0/8 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet." ro="False" address="10.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE7" name="net-172.16.0.0" comment="172.16.0.0/12 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet.&#10;" ro="False" address="172.16.0.0" netmask="255.240.0.0"/>
<Network id="id3DC75CE6" name="net-192.168.0.0" comment="192.168.0.0/16 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet.&#10;" ro="False" address="192.168.0.0" netmask="255.255.0.0"/>
<Network id="id3F4ECE3F" name="test-net" comment="192.0.2.0/24 - This block is assigned as &quot;TEST-NET&quot; for use in&#10;documentation and example code. It is often used in conjunction with&#10;domain names example.com or example.net in vendor and protocol&#10;documentation. Addresses within this block should not appear on the&#10;public Internet.&#10;" ro="False" address="192.0.2.0" netmask="255.255.255.0"/>
<Network id="id3F4ECE40" name="this-net" comment="0.0.0.0/8 - Addresses in this block refer to source hosts on &quot;this&quot;&#10;network. Address 0.0.0.0/32 may be used as a source address for this&#10;host on this network; other addresses within 0.0.0.0/8 may be used to&#10;refer to specified hosts on this network [RFC1700, page 4]." ro="False" address="0.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE7-1" name="net-192.168.1.0" comment="192.168.1.0/24 - Address often used for home and small office networks.&#10;" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
<Network id="id3DC75CE7-2" name="net-192.168.2.0" comment="192.168.2.0/24 - Address often used for home and small office networks.&#10;" ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
<NetworkIPv6 id="id2088X75851" name="documentation net" comment="RFC3849" ro="False" address="2001:db8::" netmask="32"/>
<NetworkIPv6 id="id2383X75851" name="link-local ipv6" comment="RFC4291 Link-local unicast net" ro="False" address="fe80::" netmask="10"/>
<NetworkIPv6 id="id2685X75851" name="multicast ipv6" comment="RFC4291 ipv6 multicast addresses" ro="False" address="ff00::" netmask="8"/>
<NetworkIPv6 id="id2986X75851" name="experimental ipv6" comment="RFC2928, RFC4773 &#10;&#10;&quot;The block of Sub-TLA IDs assigned to the IANA&#10;(i.e., 2001:0000::/29 - 2001:01F8::/29) is for&#10;assignment for testing and experimental usage to&#10;support activities such as the 6bone, and&#10;for new approaches like exchanges.&quot; [RFC2928]&#10;&#10;" ro="False" address="2001::" netmask="23"/>
</ObjectGroup>
<ObjectGroup id="stdid15" name="Address Ranges" comment="" ro="False">
<AddressRange id="id3F6D115C" name="broadcast" comment="" ro="False" start_address="255.255.255.255" end_address="255.255.255.255"/>
<AddressRange id="id3F6D115D" name="old-broadcast" comment="" ro="False" start_address="0.0.0.0" end_address="0.0.0.0"/>
</ObjectGroup>
</ObjectGroup>
<ServiceGroup id="stdid05" name="Services" comment="" ro="False">
<CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
<CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
</CustomService>
<CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
<CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
</CustomService>
<ServiceGroup id="stdid10" name="Groups" comment="" ro="False">
<ServiceGroup id="sg-DHCP" name="DHCP" comment="" ro="False">
<ServiceRef ref="udp-bootpc"/>
<ServiceRef ref="udp-bootps"/>
</ServiceGroup>
<ServiceGroup id="id3F530CC8" name="DNS" comment="" ro="False">
<ServiceRef ref="udp-DNS"/>
<ServiceRef ref="tcp-DNS"/>
</ServiceGroup>
<ServiceGroup id="id3CB1279B" name="IPSEC" comment="" ro="False">
<ServiceRef ref="id3CB12797"/>
<ServiceRef ref="ip-IPSEC"/>
</ServiceGroup>
<ServiceGroup id="sg-NETBIOS" name="NETBIOS" comment="" ro="False">
<ServiceRef ref="udp-netbios-dgm"/>
<ServiceRef ref="udp-netbios-ns"/>
<ServiceRef ref="id3E755609"/>
</ServiceGroup>
<ServiceGroup id="id3CB131CC" name="PCAnywhere" comment="" ro="False">
<ServiceRef ref="id3CB131CA"/>
<ServiceRef ref="id3CB131C8"/>
</ServiceGroup>
<ServiceGroup id="sg-Useful_ICMP" name="Useful_ICMP" comment="" ro="False">
<ServiceRef ref="icmp-Time_exceeded"/>
<ServiceRef ref="icmp-Time_exceeded_in_transit"/>
<ServiceRef ref="icmp-ping_reply"/>
<ServiceRef ref="icmp-Unreachables"/>
</ServiceGroup>
<ServiceGroup id="id1569X4889" name="Ipv6 unreachable messages" comment="" ro="False">
<ServiceRef ref="idE0D27650"/>
<ServiceRef ref="idCFE27650"/>
<ServiceRef ref="idE0B27650"/>
<ServiceRef ref="id1519Z388"/>
</ServiceGroup>
<ServiceGroup id="id3B4FEDD9" name="kerberos" comment="" ro="False">
<ServiceRef ref="id3B4FEDA5"/>
<ServiceRef ref="id3B4FEDA9"/>
<ServiceRef ref="id3B4FEDA7"/>
<ServiceRef ref="id3B4FEDAB"/>
<ServiceRef ref="id3B4FEDA3"/>
<ServiceRef ref="id3B4FEE21"/>
<ServiceRef ref="id3B4FEE23"/>
<ServiceRef ref="id3E7E3EA2"/>
</ServiceGroup>
<ServiceGroup id="id3B4FF35E" name="nfs" comment="" ro="False">
<ServiceRef ref="id3B4FEE7A"/>
<ServiceRef ref="id3B4FEE78"/>
</ServiceGroup>
<ServiceGroup id="id3B4FEFFA" name="quake" comment="" ro="False">
<ServiceRef ref="id3B4FEF7C"/>
<ServiceRef ref="id3B4FEF7E"/>
</ServiceGroup>
<ServiceGroup id="id3D703C9A" name="Real Player" comment="" ro="False">
<ServiceRef ref="id3D703C99"/>
<ServiceRef ref="id3D703C8B"/>
</ServiceGroup>
<ServiceGroup id="id3E7E3E95" name="WinNT" comment="" ro="False">
<ServiceRef ref="sg-NETBIOS"/>
<ServiceRef ref="id3DC8C8BB"/>
<ServiceRef ref="id3E7E3D58"/>
</ServiceGroup>
<ServiceGroup id="id3E7E3E9A" name="Win2000" comment="" ro="False">
<ServiceRef ref="id3E7E3E95"/>
<ServiceRef ref="udp-DNS"/>
<ServiceRef ref="id3DC8C8BC"/>
<ServiceRef ref="id3E7E3EA2"/>
<ServiceRef ref="id3AECF778"/>
<ServiceRef ref="id3D703C90"/>
<ServiceRef ref="id3E7E4039"/>
<ServiceRef ref="id3E7E403A"/>
<ServiceRef ref="id3B4FEDA5"/>
<ServiceRef ref="tcp-DNS"/>
</ServiceGroup>
<ServiceGroup id="id41291786" name="UPnP" comment="" ro="False">
<ServiceRef ref="id41291784"/>
<ServiceRef ref="id41291785"/>
<ServiceRef ref="id41291783"/>
<ServiceRef ref="id412Z18A9"/>
</ServiceGroup>
</ServiceGroup>
<ServiceGroup id="stdid07" name="ICMP" comment="" ro="False">
<ICMPService id="icmp-Unreachables" code="-1" type="3" name="all ICMP unreachables" comment="" ro="False"/>
<ICMPService id="id3C20EEB5" code="-1" type="-1" name="any ICMP" comment="" ro="False"/>
<ICMPService id="icmp-Host_unreach" code="1" type="3" name="host_unreach" comment="" ro="False"/>
<ICMPService id="icmp-ping_reply" code="0" type="0" name="ping reply" comment="" ro="False"/>
<ICMPService id="icmp-ping_request" code="0" type="8" name="ping request" comment="" ro="False"/>
<ICMPService id="icmp-Port_unreach" code="3" type="3" name="port unreach" comment="Port unreachable" ro="False"/>
<ICMPService id="icmp-Time_exceeded" code="0" type="11" name="time exceeded" comment="ICMP messages of this type are needed for traceroute" ro="False"/>
<ICMPService id="icmp-Time_exceeded_in_transit" code="1" type="11" name="time exceeded in transit" comment="" ro="False"/>
<ICMP6Service id="ipv6-icmp-ping_request" code="0" type="128" name="ipv6 ping request" comment="IPv6 ping request" ro="False"/>
<ICMP6Service id="ipv6-icmp-ping_reply" code="0" type="129" name="ipv6 ping reply" comment="IPv6 ping reply" ro="False"/>
<ICMP6Service id="ipv6-icmp-routersol" code="0" type="133" name="ipv6 routersol" comment="IPv6 router solicitation" ro="False"/>
<ICMP6Service id="ipv6-icmp-routeradv" code="0" type="134" name="ipv6 routeradv" comment="IPv6 router advertisement" ro="False"/>
<ICMP6Service id="ipv6-icmp-neighbrsol" code="0" type="135" name="ipv6 neighbrsol" comment="IPv6 neighbor solicitation" ro="False"/>
<ICMP6Service id="ipv6-icmp-neighbradv" code="0" type="136" name="ipv6 neighbradv" comment="IPv6 neighbor advertisement" ro="False"/>
<ICMP6Service id="ipv6-icmp-redir" code="0" type="137" name="ipv6 redir" comment="IPv6 redirect: shorter route exists" ro="False"/>
<ICMP6Service id="id1519Z388" code="-1" type="4" name="ipv6 parameter problem" comment="IPv6 Parameter Problem: RFC4443" ro="False"/>
<ICMP6Service id="idCFE27650" code="0" type="3" name="ipv6 time exceeded" comment="Time exceeded in transit" ro="False"/>
<ICMP6Service id="idCFF27650" code="1" type="3" name="ipv6 time exceeded in reassembly" comment="Time exceeded in reassembly" ro="False"/>
<ICMP6Service id="idE0B27650" code="-1" type="2" name="ipv6 packet too big" comment="" ro="False"/>
<ICMP6Service id="idE0D27650" code="-1" type="1" name="ipv6 all dest unreachable" comment="All icmpv6 codes for type &quot;destination unreachable&quot;&#10;" ro="False"/>
<ICMP6Service id="idCFE27660" code="-1" type="-1" name="ipv6 any ICMP6" comment="any ICMPv6" ro="False"/>
</ServiceGroup>
<ServiceGroup id="stdid06" name="IP" comment="" ro="False">
<IPService id="id3CB12797" fragm="False" lsrr="False" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False" name="AH" comment="IPSEC Authentication Header Protocol" ro="False"/>
<IPService id="ip-IPSEC" fragm="False" lsrr="False" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False" name="ESP" comment="IPSEC Encapsulating Security Payload Protocol" ro="False"/>
<IPService id="ip-RR" fragm="False" lsrr="False" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False" name="RR" comment="Route recording packets" ro="False"/>
<IPService id="ip-SRR" fragm="False" lsrr="True" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False" name="SRR" comment="All sorts of Source Routing Packets" ro="False"/>
<IPService id="ip-IP_Fragments" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False" name="ip_fragments" comment="'Short' fragments" ro="False"/>
<IPService id="id3D703C8E" fragm="False" lsrr="False" protocol_num="57" rr="False" short_fragm="False" ssrr="False" ts="False" name="SKIP" comment="IPSEC Simple Key Management for Internet Protocols" ro="False"/>
<IPService id="id3D703C8F" fragm="False" lsrr="False" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False" name="GRE" comment="Generic Routing Encapsulation&#10;" ro="False"/>
<IPService id="id3D703C95" fragm="False" lsrr="False" protocol_num="112" rr="False" short_fragm="False" ssrr="False" ts="False" name="vrrp" comment="Virtual Router Redundancy Protocol" ro="False"/>
<IPService id="ip-IGMP" fragm="False" lsrr="False" protocol_num="2" rr="False" rtralt="True" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="IGMP" comment="Internet Group Management Protocol, Version 3, RFC 3376" ro="False"/>
<IPService id="ip-PIM" fragm="False" lsrr="False" protocol_num="103" rr="False" rtralt="False" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="PIM" comment="Protocol Independent Multicast - Dense Mode (PIM-DM), RFC 3973, or Protocol Independent Multicast-Sparse Mode (PIM-SM) RFC 2362" ro="False"/>
</ServiceGroup>
<ServiceGroup id="stdid09" name="TCP" comment="" ro="False">
<TCPService id="tcp-ALL_TCP_Masqueraded" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ALL TCP Masqueraded" comment="ipchains used to use this range of port numbers for masquerading. " ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id3D703C94" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="AOL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5190" dst_range_end="5190"/>
<TCPService id="tcp-All_TCP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id3CB131C4" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Citrix-ICA" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1494" dst_range_end="1494"/>
<TCPService id="id3D703C91" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-Admin" comment="Entrust CA Administration Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="709" dst_range_end="709"/>
<TCPService id="id3D703C92" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-KeyMgmt" comment="Entrust CA Key Management Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="710" dst_range_end="710"/>
<TCPService id="id3AEDBEAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="H323" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1720" dst_range_end="1720"/>
<TCPService id="id412Z18A9" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="icslap" comment="Sometimes this protocol is called icslap, but Microsoft does not call it that and just says that DSPP uses port 2869 in Windows XP SP2" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2869" dst_range_end="2869"/>
<TCPService id="id3E7E4039" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3268" dst_range_end="3268"/>
<TCPService id="id3E7E403A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC SSL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3269" dst_range_end="3269"/>
<TCPService id="id3D703C83" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="OpenWindows" comment="Open Windows" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2000" dst_range_end="2000"/>
<TCPService id="id3CB131C8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="PCAnywhere-data" comment="data channel for PCAnywhere v7.52 and later " ro="False" src_range_start="0" src_range_end="0" dst_range_start="5631" dst_range_end="5631"/>
<TCPService id="id3D703C8B" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Real-Audio" comment="RealNetworks PNA Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7070" dst_range_end="7070"/>
<TCPService id="id3D703C93" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="RealSecure" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2998" dst_range_end="2998"/>
<TCPService id="id3DC8C8BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="SMB" comment="SMB over TCP (without NETBIOS)&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="445" dst_range_end="445"/>
<TCPService id="id3D703C8D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TACACSplus" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="49" dst_range_end="49"/>
<TCPService id="id3D703C84" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TCP high ports" comment="TCP high ports" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
<TCPService id="id3E7E3D58" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="WINS replication" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="42" dst_range_end="42"/>
<TCPService id="id3D703C82" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="X11" comment="X Window System" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6000" dst_range_end="6063"/>
<TCPService id="tcp-Auth" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="auth" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="113" dst_range_end="113"/>
<TCPService id="id3AEDBE6E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
<TCPService id="tcp-DNS" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
<TCPService id="id3B4FEDA3" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="eklogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2105" dst_range_end="2105"/>
<TCPService id="id3AECF774" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="finger" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="79" dst_range_end="79"/>
<TCPService id="tcp-FTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="21" dst_range_end="21"/>
<TCPService id="tcp-FTP_data" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data" comment="FTP data channel.&#10; Note: FTP protocol does not really require server to use source port 20 for the data channel, &#10; but many ftp server implementations do so." ro="False" src_range_start="20" src_range_end="20" dst_range_start="1024" dst_range_end="65535"/>
<TCPService id="id3E7553BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data passive" comment="FTP data channel for passive mode transfers&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="20" dst_range_end="20"/>
<TCPService id="tcp-HTTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="http" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
<TCPService id="id3B4FED69" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="https" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="443" dst_range_end="443"/>
<TCPService id="id3AECF776" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="143" dst_range_end="143"/>
<TCPService id="id3B4FED9F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imaps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="993" dst_range_end="993"/>
<TCPService id="id3B4FF13C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="irc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
<TCPService id="id3E7E3EA2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
<TCPService id="id3B4FEE21" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="klogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="543" dst_range_end="543"/>
<TCPService id="id3B4FEE23" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ksh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="544" dst_range_end="544"/>
<TCPService id="id3AECF778" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="389" dst_range_end="389"/>
<TCPService id="id3D703C90" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldaps" comment="Lightweight Directory Access Protocol over TLS/SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="636" dst_range_end="636"/>
<TCPService id="id3B4FF000" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="linuxconf" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="98" dst_range_end="98"/>
<TCPService id="id3D703C97" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="lpr" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
<TCPService id="id3DC8C8BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
<TCPService id="id3D703C98" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ms-sql" comment="Microsoft SQL Server" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1433" dst_range_end="1433"/>
<TCPService id="id3B4FEEEE" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="mysql" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3306" dst_range_end="3306"/>
<TCPService id="id3E755609" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
<TCPService id="id3B4FEE7A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
<TCPService id="tcp-NNTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="119" dst_range_end="119"/>
<TCPService id="id3E7553BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntps" comment="NNTP over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="563" dst_range_end="563"/>
<TCPService id="id3B4FEE1D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="110" dst_range_end="110"/>
<TCPService id="id3E7553BA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3s" comment="POP-3 over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="995" dst_range_end="995"/>
<TCPService id="id3B4FF0EA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="postgres" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5432" dst_range_end="5432"/>
<TCPService id="id3AECF782" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="printer" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
<TCPService id="id3B4FEF7C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
<TCPService id="id3AECF77A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rexec" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="512" dst_range_end="512"/>
<TCPService id="id3AECF77C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rlogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
<TCPService id="id3AECF77E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rshell" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
<TCPService id="id3D703C99" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtsp" comment="Real Time Streaming Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="554" dst_range_end="554"/>
<TCPService id="id3B4FEF34" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rwhois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4321" dst_range_end="4321"/>
<TCPService id="id3D703C89" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="securidprop" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5510" dst_range_end="5510"/>
<TCPService id="tcp-SMTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
<TCPService id="id3B4FF04C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="465" dst_range_end="465"/>
<TCPService id="id3B4FEE76" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="socks" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
<TCPService id="id3D703C87" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sqlnet1" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1521" dst_range_end="1521"/>
<TCPService id="id3B4FF09A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="squid" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
<TCPService id="tcp-SSH" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ssh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
<TCPService id="id3AEDBE00" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
<TCPService id="tcp-TCP-SYN" ack_flag="False" ack_flag_mask="True" fin_flag="False" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" name="tcp-syn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="tcp-Telnet" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="telnet" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="23" dst_range_end="23"/>
<TCPService id="tcp-uucp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="uucp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="540" dst_range_end="540"/>
<TCPService id="id3CB131C6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="winterm" comment="Windows Terminal Services" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3389" dst_range_end="3389"/>
<TCPService id="id3B4FF1B8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7100" dst_range_end="7100"/>
<TCPService id="id3C685B2B" ack_flag="True" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan - full" comment="This service object matches TCP packet with all six flags set." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id4127E949" ack_flag="False" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="False" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan" comment="This service object matches TCP packet with flags FIN, PSH and URG set and other flags cleared. This is a &quot;christmas scan&quot; as defined in snort rules. Nmap can generate this scan, too." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id4127EA72" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
<TCPService id="id4127EBAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="distcc" comment="distributed compiler" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3632" dst_range_end="3632"/>
<TCPService id="id4127ECF1" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvspserver" comment="CVS client/server operations" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2401" dst_range_end="2401"/>
<TCPService id="id4127ECF2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvsup" comment="CVSup file transfer/John Polstra/FreeBSD" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5999" dst_range_end="5999"/>
<TCPService id="id4127ED5E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="afp" comment="AFP (Apple file sharing) over TCP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="548" dst_range_end="548"/>
<TCPService id="id4127EDF6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="whois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="43" dst_range_end="43"/>
<TCPService id="id4127F04F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="bgp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="179" dst_range_end="179"/>
<TCPService id="id4127F146" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius" comment="Radius protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1812" dst_range_end="1812"/>
<TCPService id="id4127F147" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius acct" comment="Radius Accounting" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1813" dst_range_end="1813"/>
<TCPService id="id41291784" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5000" dst_range_end="5000"/>
<TCPService id="id41291785" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp-5431" comment="Although UPnP specification say it should use TCP port 5000, Linksys running Sveasoft firmware listens on port 5431" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5431" dst_range_end="5431"/>
<TCPService id="id41291787" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-0" comment="Java VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5800" dst_range_end="5800"/>
<TCPService id="id41291788" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-0" comment="Regular VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5900" dst_range_end="5900"/>
<TCPService id="id41291887" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-1" comment="Java VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5801" dst_range_end="5801"/>
<TCPService id="id41291888" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-1" comment="Regular VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5901" dst_range_end="5901"/>
<TCPService id="id463FE5FE11008" ack_flag="False" ack_flag_mask="False" established="True" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP established" comment="Some firewall platforms can match TCP packets with flags ACK or RST set; the option is usually called &quot;established&quot;.&#10;&#10;Note that you can use this object only in the policy rules of the firewall that supports this option.&#10;&#10;If you need to match reply packets for a specific TCP service and wish to use option &quot;established&quot;, make a copy of this object and set source port range to match the service.&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id1577X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtmp" comment="Real Time Messaging Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1935" dst_range_end="1935"/>
<TCPService id="id1590X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5222" dst_range_end="5222"/>
<TCPService id="id1609X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5269" dst_range_end="5269"/>
<TCPService id="id1622X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client-ssl" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5223" dst_range_end="5223"/>
<TCPService id="id1631X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server-ssl" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5270" dst_range_end="5270"/>
<TCPService id="id1644X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nrpe" comment="NRPE add-on for Nagios http://www.nagios.org/&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5666" dst_range_end="5666"/>
</ServiceGroup>
<ServiceGroup id="stdid08" name="UDP" comment="" ro="False">
<UDPService id="udp-ALL_UDP_Masqueraded" name="ALL UDP Masqueraded" comment="ipchains used to use this port range for masqueraded packets" ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
<UDPService id="udp-All_UDP" name="All UDP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<UDPService id="id3D703C96" name="ICQ" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4000" dst_range_end="4000"/>
<UDPService id="id3CB129D2" name="IKE" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="500" dst_range_end="500"/>
<UDPService id="id3CB131CA" name="PCAnywhere-status" comment="status channel for PCAnywhere v7.52 and later" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5632" dst_range_end="5632"/>
<UDPService id="id3AED0D6B" name="RIP" comment="routing protocol RIP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="520" dst_range_end="520"/>
<UDPService id="id3D703C8C" name="Radius" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1645" dst_range_end="1645"/>
<UDPService id="id3D703C85" name="UDP high ports" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
<UDPService id="id3D703C86" name="Who" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
<UDPService id="id3B4FEDA1" name="afs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7000" dst_range_end="7009"/>
<UDPService id="udp-bootpc" name="bootpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="68" dst_range_end="68"/>
<UDPService id="udp-bootps" name="bootps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="67" dst_range_end="67"/>
<UDPService id="id3AEDBE70" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
<UDPService id="udp-DNS" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
<UDPService id="id3D703C8A" name="interphone" comment="VocalTec Internet Phone" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22555" dst_range_end="22555"/>
<UDPService id="id3B4FEDA5" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
<UDPService id="id3B4FEDA9" name="kerberos-adm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="749" dst_range_end="750"/>
<UDPService id="id3B4FEDA7" name="kpasswd" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="464" dst_range_end="464"/>
<UDPService id="id3B4FEDAB" name="krb524" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4444" dst_range_end="4444"/>
<UDPService id="id3F865B0D" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
<UDPService id="udp-netbios-dgm" name="netbios-dgm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="138" dst_range_end="138"/>
<UDPService id="udp-netbios-ns" name="netbios-ns" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="137" dst_range_end="137"/>
<UDPService id="udp-netbios-ssn" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
<UDPService id="id3B4FEE78" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
<UDPService id="udp-ntp" name="ntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="123" dst_range_end="123"/>
<UDPService id="id3B4FEF7E" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
<UDPService id="id3D703C88" name="secureid-udp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="1024"/>
<UDPService id="udp-SNMP" name="snmp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="161" dst_range_end="161"/>
<UDPService id="id3AED0D69" name="snmp-trap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="162" dst_range_end="162"/>
<UDPService id="id3AEDBE19" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
<UDPService id="id3AECF780" name="syslog" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
<UDPService id="id3AED0D67" name="tftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="69" dst_range_end="69"/>
<UDPService id="id3AED0D8C" name="traceroute" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="33434" dst_range_end="33524"/>
<UDPService id="id4127EA73" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
<UDPService id="id41291783" name="SSDP" comment="Simple Service Discovery Protocol (used for UPnP)" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1900" dst_range_end="1900"/>
<UDPService id="id41291883" name="OpenVPN" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1194" dst_range_end="1194"/>
</ServiceGroup>
<ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
<CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
</ServiceGroup>
<ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
<ServiceGroup id="stdid20" name="UserServices" comment="" ro="False"/>
</ServiceGroup>
<ObjectGroup id="stdid12" name="Firewalls" comment="" ro="False"/>
<ObjectGroup id="stdid21" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="stdid11" name="Time" comment="" ro="False">
<Interval id="int-workhours" days_of_week="1,2,3,4,5" from_day="-1" from_hour="9" from_minute="0" from_month="-1" from_weekday="1" from_year="-1" to_day="-1" to_hour="17" to_minute="0" to_month="-1" to_weekday="5" to_year="-1" name="workhours" comment="any day, 9:00am through 5:00pm" ro="False"/>
<Interval id="int-weekends" days_of_week="6,0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="weekends" comment="weekends: Saturday 0:00 through Sunday 23:59 " ro="False"/>
<Interval id="int-afterhours" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1" name="afterhours" comment="any day 6:00pm - 12:00am" ro="False"/>
<Interval id="id3C63479C" days_of_week="6" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1" name="Sat" comment="" ro="False"/>
<Interval id="id3C63479E" days_of_week="0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="Sun" comment="" ro="False"/>
</IntervalGroup>
</Library>
<Library id="sysid99" name="Deleted Objects" comment="" ro="False"/>
<Library id="id0" name="User" comment="" ro="False">
<ObjectGroup id="id1" name="Objects" comment="" ro="False">
<ObjectGroup id="id2" name="Addresses" comment="" ro="False">
<IPv4 id="id3" name="h-10.0.1.111" comment="Created during import of line 3" ro="False" address="10.0.1.111" netmask="255.255.255.255"/>
<IPv4 id="id4" name="h-127.0.0.1" comment="Created during import of line 5" ro="False" address="127.0.0.1" netmask="255.255.255.255"/>
<IPv4 id="id5" name="h-10.0.1.112" comment="Created during import of line 8" ro="False" address="10.0.1.112" netmask="255.255.255.255"/>
<IPv4 id="id6" name="h-10.0.1.113" comment="Created during import of line 8" ro="False" address="10.0.1.113" netmask="255.255.255.255"/>
<IPv4 id="id7" name="h-192.168.1.1" comment="Created during import of line 11" ro="False" address="192.168.1.1" netmask="255.255.255.255"/>
<IPv4 id="id8" name="h-192.0.2.100" comment="Created during import of line 12" ro="False" address="192.0.2.100" netmask="255.255.255.255"/>
</ObjectGroup>
<ObjectGroup id="id9" name="DNS Names" comment="" ro="False"/>
<ObjectGroup id="id10" name="Address Tables" comment="" ro="False"/>
<ObjectGroup id="id11" name="Groups" comment="" ro="False"/>
<ObjectGroup id="id12" name="Hosts" comment="" ro="False"/>
<ObjectGroup id="id13" name="Networks" comment="" ro="False">
<Network id="id14" name="net-192.168.1.0/255.255.255.0" comment="Created during import of line 12" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
</ObjectGroup>
<ObjectGroup id="id15" name="Address Ranges" comment="" ro="False"/>
</ObjectGroup>
<ServiceGroup id="id16" name="Services" comment="" ro="False">
<ServiceGroup id="id17" name="Groups" comment="" ro="False"/>
<ServiceGroup id="id18" name="ICMP" comment="" ro="False"/>
<ServiceGroup id="id19" name="IP" comment="" ro="False"/>
<ServiceGroup id="id20" name="TCP" comment="" ro="False">
<TCPService id="id21" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 80:80" comment="Created during import of line 3" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
<TCPService id="id22" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 8080:8080" comment="Created during import of line 3" ro="False" src_range_start="0" src_range_end="0" dst_range_start="8080" dst_range_end="8080"/>
</ServiceGroup>
<ServiceGroup id="id23" name="UDP" comment="" ro="False"/>
<ServiceGroup id="id24" name="Users" comment="" ro="False"/>
<ServiceGroup id="id25" name="Custom" comment="" ro="False"/>
<ServiceGroup id="id26" name="TagServices" comment="" ro="False"/>
</ServiceGroup>
<ObjectGroup id="id27" name="Firewalls" comment="" ro="False">
<Firewall id="id28" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of line 3" ro="False">
<NAT id="id32" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<NATRule id="id34" disabled="False" group="" position="0" action="Translate" comment="Created during import of line 3">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="id128"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id21"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="sysid0"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="id3"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="id22"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id128"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<NATRule id="id52" disabled="False" group="" position="1" action="Translate" comment="Created during import of line 5">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id21"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="sysid0"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="id4"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="id22"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id128"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<NATRule id="id70" disabled="False" group="" position="2" action="Translate" comment="Created during import of line 8">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="id128"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id21"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="sysid0"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="id3"/>
<ObjectRef ref="id5"/>
<ObjectRef ref="id6"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="id22"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id128"/>
</ItfOutb>
<NATRuleOptions>
<Option name="pf_round_robin">True</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id90" disabled="False" group="" position="3" action="Translate" comment="Created during import of line 11">
<OSrc neg="False">
<ObjectRef ref="id7"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id21"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="sysid0"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id128"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<NATRule id="id108" disabled="False" group="" position="4" action="Translate" comment="Created during import of line 12">
<OSrc neg="False">
<ObjectRef ref="id14"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="id21"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="sysid0"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="id8"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="id22"/>
</TSrv>
<ItfInb neg="False">
<ObjectRef ref="sysid0"/>
</ItfInb>
<ItfOutb neg="False">
<ObjectRef ref="id128"/>
</ItfOutb>
<NATRuleOptions/>
</NATRule>
<RuleSetOptions/>
</NAT>
<Policy id="id30" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</Policy>
<Routing id="id126" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</Routing>
<Interface id="id128" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="em0" comment="Created during import of line 3" ro="False">
<InterfaceOptions/>
</Interface>
<FirewallOptions>
<Option name="check_shading">true</Option>
<Option name="configure_interfaces">true</Option>
<Option name="firewall_dir">/etc</Option>
<Option name="freebsd_ip_forward">1</Option>
<Option name="in_out_code">true</Option>
<Option name="log_prefix">RULE %N -- %A </Option>
<Option name="loopback_interface">lo0</Option>
<Option name="manage_virtual_addr">true</Option>
<Option name="pass_all_out">false</Option>
<Option name="pf_limit_frags">5000</Option>
<Option name="pf_limit_states">10000</Option>
<Option name="pf_scrub_maxmss">1460</Option>
<Option name="pf_timeout_frag">30</Option>
<Option name="pf_timeout_interval">10</Option>
</FirewallOptions>
</Firewall>
</ObjectGroup>
<ObjectGroup id="id130" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="id131" name="Time" comment="" ro="False"/>
</Library>
</FWObjectDatabase>
src/unit_tests/PFImporterTest/test_data/pf-rdr-rules.output
+6
View File
@@ -0,0 +1,6 @@
3: New interface: em0
3: nat rule: action rdr; interfaces: em0
5: nat rule: action rdr; interfaces: em0
8: nat rule: action rdr; interfaces: em0
11: nat rule: action nonat; interfaces: em0
12: nat rule: action rdr; interfaces: em0