diff --git a/build_num b/build_num index 49c5eb04c..3f07def5d 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 2196 +#define BUILD_NUM 2197 diff --git a/src/compiler_lib/CompilerDriver.h b/src/compiler_lib/CompilerDriver.h index e2c51fc9e..d7822cb75 100644 --- a/src/compiler_lib/CompilerDriver.h +++ b/src/compiler_lib/CompilerDriver.h @@ -32,6 +32,7 @@ #include #include +#include #include #include @@ -133,7 +134,7 @@ protected: Configlet *script_skeleton, Configlet *top_comment, const QString &comment_char); - + public: CompilerDriver(libfwbuilder::FWObjectDatabase *db); diff --git a/src/iptlib/CompilerDriver_ipt.cpp b/src/iptlib/CompilerDriver_ipt.cpp index aae317036..fca4f9855 100644 --- a/src/iptlib/CompilerDriver_ipt.cpp +++ b/src/iptlib/CompilerDriver_ipt.cpp @@ -27,6 +27,8 @@ #include "Configlet.h" #include "CompilerDriver_ipt.h" +#include "PolicyCompiler_ipt.h" +#include "PolicyCompiler_secuwall.h" #include "fwbuilder/Resources.h" #include "fwbuilder/FWObjectDatabase.h" @@ -177,4 +179,34 @@ string CompilerDriver_ipt::dumpScript(Firewall *fw, return res.str(); } +std::auto_ptr CompilerDriver_ipt::createPolicyCompiler( + Firewall *fw, + bool ipv6_policy, + OSConfigurator *oscnf, + std::map *minus_n_commands_filter) +{ + string platform = fw->getStr("platform"); + string platform_family = Resources::platform_res[platform]-> + getResourceStr("/FWBuilderResources/Target/family"); + + std::auto_ptr policy_compiler; + + if (fw->getStr("host_OS") == "secuwall") { + policy_compiler = std::auto_ptr( + new PolicyCompiler_secuwall(objdb,fw, ipv6_policy, oscnf, + minus_n_commands_filter)); + } else { + policy_compiler = std::auto_ptr( + new PolicyCompiler_ipt(objdb,fw, ipv6_policy, oscnf, + minus_n_commands_filter)); + } + + if (policy_compiler.get()==NULL) + abort("Unrecognized firewall platform " + + fw->getStr("platform") + + " (family " + platform_family+")"); + + return policy_compiler; +} + diff --git a/src/iptlib/CompilerDriver_ipt.h b/src/iptlib/CompilerDriver_ipt.h index 227767a35..0a1f5ad98 100644 --- a/src/iptlib/CompilerDriver_ipt.h +++ b/src/iptlib/CompilerDriver_ipt.h @@ -28,6 +28,7 @@ #include "../compiler_lib/CompilerDriver.h" +#include "PolicyCompiler_ipt.h" #include "OSConfigurator_linux24.h" #include @@ -65,6 +66,12 @@ namespace fwcompiler { // or "POSTROUTING" std::map > branch_ruleset_to_chain_mapping; + std::auto_ptr createPolicyCompiler( + libfwbuilder::Firewall *fw, + bool ipv6_policy, + fwcompiler::OSConfigurator *_oscnf, + std::map *m_n_commands_map); + public: CompilerDriver_ipt(libfwbuilder::FWObjectDatabase *db); diff --git a/src/iptlib/CompilerDriver_ipt_policy.cpp b/src/iptlib/CompilerDriver_ipt_policy.cpp index db9bb9774..376bc8494 100644 --- a/src/iptlib/CompilerDriver_ipt_policy.cpp +++ b/src/iptlib/CompilerDriver_ipt_policy.cpp @@ -177,28 +177,8 @@ bool CompilerDriver_ipt::processPolicyRuleSet( } } - std::auto_ptr policy_compiler; - - if (fw->getStr("host_OS") == "secuwall") { - policy_compiler = std::auto_ptr( - new PolicyCompiler_secuwall(objdb,fw, ipv6_policy, oscnf, - &minus_n_commands_filter)); - } else { - policy_compiler = std::auto_ptr( - new PolicyCompiler_ipt(objdb,fw, ipv6_policy, oscnf, - &minus_n_commands_filter)); - } - - if (policy_compiler.get()==NULL) - abort("Unrecognized firewall platform " + - fw->getStr("platform") + - " (family " + platform_family+")"); - - if (!policy->isTop()) - policy_compiler->registerRuleSetChain(branch_name); - - policy_compiler->setSourceRuleSet( policy ); - policy_compiler->setRuleSetName(branch_name); + std::auto_ptr policy_compiler = createPolicyCompiler( + fw, ipv6_policy, oscnf, &minus_n_commands_filter); policy_compiler->setSingleRuleCompileMode(single_rule_id); policy_compiler->setDebugLevel( dl ); @@ -207,7 +187,11 @@ bool CompilerDriver_ipt::processPolicyRuleSet( policy_compiler->setHaveDynamicInterfaces(have_dynamic_interfaces); if (inTestMode()) policy_compiler->setTestMode(); if (inEmbeddedMode()) policy_compiler->setEmbeddedMode(); - + if (!policy->isTop()) policy_compiler->registerRuleSetChain(branch_name); + + policy_compiler->setSourceRuleSet( policy ); + policy_compiler->setRuleSetName(branch_name); + if ( (policy_rules_count=policy_compiler->prolog()) > 0 ) { policy_compiler->compile(); diff --git a/src/iptlib/CompilerDriver_ipt_run.cpp b/src/iptlib/CompilerDriver_ipt_run.cpp index 12c8f2704..dad15da6e 100644 --- a/src/iptlib/CompilerDriver_ipt_run.cpp +++ b/src/iptlib/CompilerDriver_ipt_run.cpp @@ -603,6 +603,16 @@ string CompilerDriver_ipt::run(const std::string &cluster_id, script_buffer = ""; Configlet stop_action(fw, "linux24", "stop_action"); + stop_action.collapseEmptyStrings(true); + + std::auto_ptr policy_compiler = createPolicyCompiler( + fw, false, NULL, NULL); + PolicyCompiler_ipt::PrintRule* print_rule = + policy_compiler->createPrintRuleProcessor(); + + print_rule->setContext(policy_compiler.get()); + print_rule->_printBackupSSHAccessRules(&stop_action); + script_skeleton.setVariable("stop_action", stop_action.expand()); Configlet top_comment(fw, "linux24", "top_comment"); diff --git a/src/iptlib/PolicyCompiler_PrintRule.cpp b/src/iptlib/PolicyCompiler_PrintRule.cpp index 78171dd00..8bdf58506 100644 --- a/src/iptlib/PolicyCompiler_PrintRule.cpp +++ b/src/iptlib/PolicyCompiler_PrintRule.cpp @@ -1605,47 +1605,7 @@ string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules() compiler->getCachedFwOpt()->getBool("accept_established") && ipt_comp->my_table=="filter"); - if ( compiler->getCachedFwOpt()->getBool("mgmt_ssh") && - ! compiler->getCachedFwOpt()->getStr("mgmt_addr").empty() ) - { - string addr_str = compiler->getCachedFwOpt()->getStr("mgmt_addr"); - InetAddrMask *inet_addr = NULL; - bool addr_is_good = true; - if (isIPv6) - { - // check if given address is ipv6 - try - { - inet_addr = new Inet6AddrMask(addr_str); - } catch(const FWException &ex) { - // address does not parse as ipv6, skip this rule. - addr_is_good = false; - QString err("Backup ssh access rule could not be added " - "to IPv6 policy because specified address " - "'%1' is invalid"); - compiler->warning(err.arg(addr_str.c_str()).toStdString()); - } - } else - { - // check if given address parses as ipv4 - try - { - inet_addr = new InetAddrMask(addr_str); - } catch(const FWException &ex) { - // address does not parse - addr_is_good = false; - QString err("Backup ssh access rule could not be added " - "to IPv4 policy because specified address " - "'%1' is invalid"); - compiler->warning(err.arg(addr_str.c_str()).toStdString()); - } - } - if (addr_is_good) - { - configlet.setVariable("mgmt_access", 1); - configlet.setVariable("management_address", inet_addr->toString().c_str()); - } - } + _printBackupSSHAccessRules(&configlet); configlet.setVariable( "drop_new_tcp_with_no_syn", @@ -1702,6 +1662,55 @@ string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules() return configlet.expand().toStdString(); } +void PolicyCompiler_ipt::PrintRule::_printBackupSSHAccessRules(Configlet *conf) +{ + PolicyCompiler_ipt *ipt_comp = dynamic_cast(compiler); + bool isIPv6 = ipt_comp->ipv6; + if ( compiler->getCachedFwOpt()->getBool("mgmt_ssh") && + ! compiler->getCachedFwOpt()->getStr("mgmt_addr").empty() ) + { + string addr_str = compiler->getCachedFwOpt()->getStr("mgmt_addr"); + InetAddrMask *inet_addr = NULL; + bool addr_is_good = true; + if (isIPv6) + { + // check if given address is ipv6 + try + { + inet_addr = new Inet6AddrMask(addr_str); + } catch(const FWException &ex) { + // address does not parse as ipv6, skip this rule. + addr_is_good = false; + QString err("Backup ssh access rule could not be added " + "to IPv6 policy because specified address " + "'%1' is invalid"); + compiler->warning(err.arg(addr_str.c_str()).toStdString()); + } + } else + { + // check if given address parses as ipv4 + try + { + inet_addr = new InetAddrMask(addr_str); + } catch(const FWException &ex) { + // address does not parse + addr_is_good = false; + QString err("Backup ssh access rule could not be added " + "to IPv4 policy because specified address " + "'%1' is invalid"); + compiler->warning(err.arg(addr_str.c_str()).toStdString()); + } + } + if (addr_is_good) + { + conf->setVariable("begin_rule", _startRuleLine().c_str()); + conf->setVariable("end_rule", _endRuleLine().c_str()); + conf->setVariable("mgmt_access", 1); + conf->setVariable("management_address", inet_addr->toString().c_str()); + } + } +} + string PolicyCompiler_ipt::PrintRule::_quote(const string &s) { return "\"" + s + "\""; diff --git a/src/iptlib/PolicyCompiler_ipt.cpp b/src/iptlib/PolicyCompiler_ipt.cpp index 832318af2..4aa0b7358 100644 --- a/src/iptlib/PolicyCompiler_ipt.cpp +++ b/src/iptlib/PolicyCompiler_ipt.cpp @@ -4528,7 +4528,7 @@ void PolicyCompiler_ipt::epilog() PolicyCompiler_ipt::PrintRule* PolicyCompiler_ipt::createPrintRuleProcessor() { PolicyCompiler_ipt::PrintRule* print_rule = NULL; - if (fwopt->getBool("use_iptables_restore")) + if (fw->getOptionsObject()->getBool("use_iptables_restore")) { // bug #1812295: we should use PrintRuleIptRstEcho not only // when we have dynamic interfaces, but also when we have diff --git a/src/iptlib/PolicyCompiler_ipt.h b/src/iptlib/PolicyCompiler_ipt.h index 687220c57..3bdb6686b 100644 --- a/src/iptlib/PolicyCompiler_ipt.h +++ b/src/iptlib/PolicyCompiler_ipt.h @@ -31,6 +31,7 @@ #include "fwcompiler/PolicyCompiler.h" #include "fwbuilder/RuleElement.h" #include "config.h" +#include "Configlet.h" namespace libfwbuilder { @@ -56,10 +57,12 @@ namespace fwcompiler { class PolicyCompiler_ipt : public PolicyCompiler { - protected: - +public: class PrintRule; + +protected: + bool have_dynamic_interfaces; bool have_connmark; bool have_connmark_in_output; @@ -102,8 +105,6 @@ namespace fwcompiler const std::string label, const bool related = false); - PolicyCompiler_ipt::PrintRule* createPrintRuleProcessor(); - std::string getInterfaceVarName(libfwbuilder::FWObject *iface, bool v6=false); std::string getAddressTableVarName(libfwbuilder::FWObject *iface); @@ -869,6 +870,78 @@ namespace fwcompiler DECLARE_POLICY_RULE_PROCESSOR(countChainUsage); + + virtual std::string myPlatformName(); + + /** + * TODO: move these two to class fwcompiler::PolicyCompiler, + * then create enum for all possible actions on reject in that + * class and use it instead of string. + */ + std::string getActionOnReject(libfwbuilder::PolicyRule *rule); + bool isActionOnRejectTCPRST(libfwbuilder::PolicyRule *rule); + void resetActionOnReject(libfwbuilder::PolicyRule *rule); + +public: + + PolicyCompiler_ipt(libfwbuilder::FWObjectDatabase *_db, + libfwbuilder::Firewall *fw, + bool ipv6_policy, + fwcompiler::OSConfigurator *_oscnf, + std::map *m_n_commands_map + ) : + PolicyCompiler(_db, fw, ipv6_policy, _oscnf) + { + have_dynamic_interfaces = false; + have_connmark = false; + have_connmark_in_output = false; + my_table = "filter"; + minus_n_commands = m_n_commands_map; + } + virtual ~PolicyCompiler_ipt(); + + /** + * Add some predefined rules controlled by checkboxes in + * firewall settings dialog + */ + virtual void addPredefinedPolicyRules(); + + virtual void verifyPlatform(); + virtual int prolog(); + virtual void compile(); + virtual void epilog(); + + /** + * addRuleFilter() is a hook where we can add a rule processor to filter + * some of the rules out before we begin actual processing + */ + virtual void addRuleFilter(); + + /** + * this method registers chain used for the ruleset (most + * often branch rule set). Since rules in the same ruleset do + * not use this chain as target, rule processor + * countChainUsage considers it unused. Registering it makes + * sure its usage counter is > 0. + */ + void registerRuleSetChain(const std::string &chain_name); + + void setHaveDynamicInterfaces(bool f) { have_dynamic_interfaces=f; } + + virtual std::string flushAndSetDefaultPolicy(); + virtual std::string printAutomaticRules(); + std::string commit(); + + std::string getNewTmpChainName(libfwbuilder::PolicyRule *rule); + std::string getNewChainName(libfwbuilder::PolicyRule *rule,libfwbuilder::Interface *rule_iface); + + bool haveConnMarkRules() { return have_connmark; } + bool haveConnMarkRulesInOutput() { return have_connmark_in_output; } + + std::list getUsedChains(); + + PolicyCompiler_ipt::PrintRule* createPrintRuleProcessor(); + /** * prints single policy rule, assuming all groups have been * expanded, so source, destination and service hold exactly @@ -963,6 +1036,8 @@ namespace fwcompiler virtual std::string _startRuleLine(); virtual std::string _endRuleLine(); + virtual void _printBackupSSHAccessRules(Configlet *c); + virtual bool processNext(); std::string PolicyRuleToString(libfwbuilder::PolicyRule *r); @@ -1003,76 +1078,6 @@ namespace fwcompiler }; friend class PolicyCompiler_ipt::PrintRuleIptRstEcho; - - virtual std::string myPlatformName(); - - /** - * TODO: move these two to class fwcompiler::PolicyCompiler, - * then create enum for all possible actions on reject in that - * class and use it instead of string. - */ - std::string getActionOnReject(libfwbuilder::PolicyRule *rule); - bool isActionOnRejectTCPRST(libfwbuilder::PolicyRule *rule); - void resetActionOnReject(libfwbuilder::PolicyRule *rule); - - public: - - PolicyCompiler_ipt(libfwbuilder::FWObjectDatabase *_db, - libfwbuilder::Firewall *fw, - bool ipv6_policy, - fwcompiler::OSConfigurator *_oscnf, - std::map *m_n_commands_map - ) : - PolicyCompiler(_db, fw, ipv6_policy, _oscnf) - { - have_dynamic_interfaces = false; - have_connmark = false; - have_connmark_in_output = false; - my_table = "filter"; - minus_n_commands = m_n_commands_map; - } - virtual ~PolicyCompiler_ipt(); - - /** - * Add some predefined rules controlled by checkboxes in - * firewall settings dialog - */ - virtual void addPredefinedPolicyRules(); - - virtual void verifyPlatform(); - virtual int prolog(); - virtual void compile(); - virtual void epilog(); - - /** - * addRuleFilter() is a hook where we can add a rule processor to filter - * some of the rules out before we begin actual processing - */ - virtual void addRuleFilter(); - - /** - * this method registers chain used for the ruleset (most - * often branch rule set). Since rules in the same ruleset do - * not use this chain as target, rule processor - * countChainUsage considers it unused. Registering it makes - * sure its usage counter is > 0. - */ - void registerRuleSetChain(const std::string &chain_name); - - void setHaveDynamicInterfaces(bool f) { have_dynamic_interfaces=f; } - - virtual std::string flushAndSetDefaultPolicy(); - virtual std::string printAutomaticRules(); - std::string commit(); - - std::string getNewTmpChainName(libfwbuilder::PolicyRule *rule); - std::string getNewChainName(libfwbuilder::PolicyRule *rule,libfwbuilder::Interface *rule_iface); - - bool haveConnMarkRules() { return have_connmark; } - bool haveConnMarkRulesInOutput() { return have_connmark_in_output; } - - std::list getUsedChains(); - }; diff --git a/src/res/configlets/linux24/stop_action b/src/res/configlets/linux24/stop_action index 9876f3640..d57130532 100644 --- a/src/res/configlets/linux24/stop_action +++ b/src/res/configlets/linux24/stop_action @@ -29,7 +29,7 @@ reset_all {{if mgmt_access}} # backup ssh access -$IPTABLES INPUT -p tcp -m tcp -s {{$management_address}} --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT -$IPTABLES OUTPUT -p tcp -m tcp -d {{$management_address}} --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT +$IPTABLES -A INPUT -p tcp -m tcp -s {{$management_address}} --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPTABLES -A OUTPUT -p tcp -m tcp -d {{$management_address}} --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT {{endif}}