onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-11 07:31:25 +02:00
Code Issues Releases Wiki Activity

ipv6 support in compiler for iptables

Browse Source
This commit is contained in:
Vadim Kurland
2008-05-22 18:12:16 +00:00
parent f68d472b0b
commit 79551708e2
44 changed files with 10010 additions and 6659 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/ChangeLog
+9
View File
@@ -1,3 +1,12 @@
2008-05-22 Vadim Kurland <vadim@vk.crocodile.org>
* ipt.cpp (main): Poliucy compiler for iptables supports
IPv6. Added command line switches "-4" and "-6" which force
compiler to generate script for only one specified address
family (by default it does both). Compiler can generate simple
ipv6 iptables script. Generated script still can be improved but
seems to be formally correct at this time.
2008-05-18 Vadim Kurland <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp: compiler for iptables converted to
doc/fwb_ipt.1
+14
View File
@@ -24,6 +24,20 @@ The data file and the name of the firewall objects must be specified
on the command line. Other command line parameters are optional.
.SH OPTIONS
.IP "-4"
Generate iptables script for IPv4 part of the policy. If any rules of
the firewall refer to IPv6 addresses, compiler will skip these rules.
Options "-4" and "-6" are exclusive. If neither option is used, compiler
tries to generate both parts of the script, although generation of
the IPv6 part is controlled by the option "Enable IPv6 support"
in the "IPv6" tab of the firewall object advanced settings dialog.
This option is off by default.
.IP "-6"
Generate iptables script for IPv6 part of the policy. If any rules of
the firewall refer to IPv6 addresses, compiler will skip these rules.
.IP "-f FILE"
Specify the name of the data file to be processed.
src/cisco_lib/PolicyCompiler_cisco.cpp
+2 -1
View File
@@ -62,8 +62,9 @@ string PolicyCompiler_cisco::myPlatformName() { return ""; }
PolicyCompiler_cisco::PolicyCompiler_cisco(FWObjectDatabase *_db,
const std::string &fwname,
bool ipv6_policy,
OSConfigurator *_oscnf) :
PolicyCompiler(_db,fwname,_oscnf) , helper(this)
PolicyCompiler(_db, fwname, ipv6_policy, _oscnf) , helper(this)
{
}
src/cisco_lib/PolicyCompiler_cisco.h
+3 -2
View File
@@ -434,8 +434,9 @@ protected:
public:
PolicyCompiler_cisco(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
fwcompiler::OSConfigurator *_oscnf);
const std::string &fwname,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf);
virtual ~PolicyCompiler_cisco() {}
virtual std::string createRuleLabel(const std::string &txt,
src/gui/ProjectPanel.cpp
+8 -12
View File
@@ -1958,11 +1958,6 @@ void ProjectPanel::load(QWidget *dialogs_parent)
if (fwbdebug) qDebug("ProjectPanel::load(): create RCS");
createRCS("");
/*
* TODO: we should create new FWObjectDatabase object and assign db
* instead of using singleton
*/
// objdb = FWObjectDatabase::db;
setWindowTitle( "Firewall Builder" );
@@ -1992,7 +1987,7 @@ void ProjectPanel::load(QWidget *dialogs_parent)
}
void ProjectPanel::load(QWidget *dialogs_parent,RCS *_rcs)
void ProjectPanel::load(QWidget *dialogs_parent, RCS *_rcs)
{
QStatusBar *sb = mainW->statusBar();
@@ -2039,17 +2034,18 @@ void ProjectPanel::load(QWidget *dialogs_parent,RCS *_rcs)
sb->showMessage( tr("Reading and parsing data file...") );
QCoreApplication::processEvents(QEventLoop::ExcludeUserInputEvents);
//QApplication::eventLoop()->processEvents(QEventLoop::ExcludeUserInput,100);
FWObjectDatabase *ndb = new FWObjectDatabase();
ndb->load(rcs->getFileName().toLatin1().constData(), &upgrade_predicate,librespath);
time_t oldtimestamp = ndb->getTimeLastModified();
ndb->load(rcs->getFileName().toLatin1().constData(),
&upgrade_predicate,librespath);
time_t oldtimestamp = ndb->getTimeLastModified();
sb->clearMessage();
QCoreApplication::processEvents(QEventLoop::ExcludeUserInputEvents);
/* loadingLib is true if user wants to open a library or master library file */
bool loadingLib = editingLibrary();
bool loadingLib = editingLibrary();
if (fwbdebug)
{
@@ -2109,8 +2105,8 @@ void ProjectPanel::load(QWidget *dialogs_parent,RCS *_rcs)
}
sb->showMessage( tr("Merging with system objects...") );
QCoreApplication::processEvents(QEventLoop::ExcludeUserInputEvents, 100);
//QApplication::eventLoop()->processEvents(QEventLoop::ExcludeUserInput,100);
QCoreApplication::processEvents(QEventLoop::ExcludeUserInputEvents,
100);
MergeConflictRes mcr(dlgp);
objdb->merge(ndb, &mcr);
src/iosacl/OSConfigurator_ios.h
+4 -2
View File
@@ -44,8 +44,10 @@ namespace fwcompiler {
public:
virtual ~OSConfigurator_ios() {};
OSConfigurator_ios(libfwbuilder::FWObjectDatabase *_db,const std::string &fwname) :
OSConfigurator(_db,fwname) {}
OSConfigurator_ios(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
bool ipv6_policy) :
OSConfigurator(_db, fwname, ipv6_policy) {}
virtual int prolog();
src/iosacl/PolicyCompiler_iosacl.cpp
+2 -1
View File
@@ -62,8 +62,9 @@ string PolicyCompiler_iosacl::myPlatformName() { return "iosacl"; }
PolicyCompiler_iosacl::PolicyCompiler_iosacl(FWObjectDatabase *_db,
const std::string &fwname,
bool ipv6_policy,
OSConfigurator *_oscnf) :
PolicyCompiler_cisco(_db,fwname,_oscnf)
PolicyCompiler_cisco(_db, fwname, ipv6_policy, _oscnf)
{
resetinbound=false;
fragguard=false;
src/iosacl/PolicyCompiler_iosacl.h
+2 -1
View File
@@ -251,7 +251,8 @@ namespace fwcompiler {
public:
PolicyCompiler_iosacl(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
const std::string &fwname,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf);
virtual ~PolicyCompiler_iosacl() {}
src/iosacl/iosacl.cpp
+3 -2
View File
@@ -318,14 +318,14 @@ int main(int argc, char * const * argv)
if (user_name==NULL)
throw FWException("Can't figure out your user name, aborting");
Preprocessor* prep=new Preprocessor(objdb , fwobjectname);
Preprocessor* prep=new Preprocessor(objdb , fwobjectname, false);
prep->compile();
/*
* Process firewall options, build OS network configuration script
*/
OSConfigurator *oscnf=NULL;
oscnf=new OSConfigurator_ios(objdb , fwobjectname);
oscnf=new OSConfigurator_ios(objdb , fwobjectname, false);
oscnf->prolog();
oscnf->processFirewallOptions();
@@ -334,6 +334,7 @@ int main(int argc, char * const * argv)
PolicyCompiler_iosacl *c = new PolicyCompiler_iosacl(objdb,
fwobjectname,
false,
oscnf);
if (test_mode) c->setTestMode();
src/ipf/ipf.cpp
+6 -6
View File
@@ -344,7 +344,7 @@ int main(int argc, char * const *argv)
string shell_dbg=(debug)?"-x":"" ;
string ipf_dbg=(debug)?"-v":"";
Preprocessor* prep=new Preprocessor(objdb , fwobjectname);
Preprocessor* prep=new Preprocessor(objdb , fwobjectname, false);
prep->compile();
/*
@@ -353,13 +353,13 @@ int main(int argc, char * const *argv)
OSConfigurator *oscnf=NULL;
string family=Resources::os_res[fw->getStr("host_OS")]->Resources::getResourceStr("/FWBuilderResources/Target/family");
if ( family=="solaris" )
oscnf=new OSConfigurator_solaris(objdb , fwobjectname);
oscnf=new OSConfigurator_solaris(objdb , fwobjectname, false);
if ( family=="openbsd")
oscnf=new OSConfigurator_openbsd(objdb , fwobjectname);
oscnf=new OSConfigurator_openbsd(objdb , fwobjectname, false);
if ( family=="freebsd")
oscnf=new OSConfigurator_freebsd(objdb , fwobjectname);
oscnf=new OSConfigurator_freebsd(objdb , fwobjectname, false);
if (oscnf==NULL)
throw FWException(_("Unrecognized host OS ")+fw->getStr("host_OS")+" (family "+family+")");
@@ -369,7 +369,7 @@ int main(int argc, char * const *argv)
/*
* create compilers and run the whole thing
*/
PolicyCompiler_ipf c( objdb , fwobjectname , oscnf );
PolicyCompiler_ipf c( objdb , fwobjectname, false , oscnf );
c.setDebugLevel( dl );
c.setDebugRule( drp );
@@ -384,7 +384,7 @@ int main(int argc, char * const *argv)
}
NATCompiler_ipf n( objdb , fwobjectname , oscnf );
NATCompiler_ipf n( objdb , fwobjectname, false , oscnf );
n.setDebugLevel( dl );
n.setDebugRule( drn );
src/ipfw/ipfw.cpp
+4 -4
View File
@@ -309,7 +309,7 @@ int main(int argc, char * const *argv)
bool debug=options->getBool("debug");
string shell_dbg=(debug)?"-x":"" ;
Preprocessor* prep=new Preprocessor(objdb , fwobjectname);
Preprocessor* prep=new Preprocessor(objdb , fwobjectname, false);
prep->compile();
/*
@@ -318,10 +318,10 @@ int main(int argc, char * const *argv)
OSConfigurator *oscnf=NULL;
string family=Resources::os_res[fw->getStr("host_OS")]->Resources::getResourceStr("/FWBuilderResources/Target/family");
if ( family=="macosx")
oscnf=new OSConfigurator_macosx(objdb , fwobjectname);
oscnf=new OSConfigurator_macosx(objdb , fwobjectname, false);
if ( family=="freebsd")
oscnf=new OSConfigurator_freebsd(objdb , fwobjectname);
oscnf=new OSConfigurator_freebsd(objdb , fwobjectname, false);
if (oscnf==NULL)
throw FWException(_("Unrecognized host OS ")+fw->getStr("host_OS")+" (family "+family+")");
@@ -330,7 +330,7 @@ int main(int argc, char * const *argv)
/*
* create compilers and run the whole thing
*/
PolicyCompiler_ipfw c( objdb , fwobjectname , oscnf );
PolicyCompiler_ipfw c( objdb , fwobjectname, false , oscnf );
c.setDebugLevel( dl );
c.setDebugRule( drp );
src/ipt/MangleTableCompiler_ipt.h
+4 -2
View File
@@ -45,8 +45,10 @@ namespace fwcompiler {
public:
MangleTableCompiler_ipt(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
fwcompiler::OSConfigurator *_oscnf) : PolicyCompiler_ipt(_db,fwname,_oscnf)
const std::string &fwname,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf) :
PolicyCompiler_ipt(_db, fwname, ipv6_policy, _oscnf)
{
my_table = "mangle";
}
src/ipt/NATCompiler_ipt.cpp
+10 -3
View File
@@ -2101,7 +2101,9 @@ void NATCompiler_ipt::compile()
{
// FWOptions* options=fw->getOptionsObject();
cout << _(" Compiling rules for 'nat' table ...") << endl << flush;
cout << " Compiling rules for 'nat' table";
if (ipv6) cout << ", IPv6";
cout << endl << flush;
try {
@@ -2183,6 +2185,13 @@ void NATCompiler_ipt::compile()
add( new splitOnDynamicInterfaceInTSrc("split rule if TSrc is dynamic interface" ) );
add( new ExpandMultipleAddresses("expand multiple addresses") );
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
if (ipv6)
add( new DropIPv4Rules("drop ipv4 rules"));
else
add( new DropIPv6Rules("drop ipv6 rules"));
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
add( new specialCaseWithUnnumberedInterface("check for special cases with dynamic and unnumbered interfaces" ) );
add( new checkForDynamicInterfacesOfOtherObjects( "check for dynamic interfaces of other hosts and firewalls" ) );
@@ -2209,8 +2218,6 @@ void NATCompiler_ipt::compile()
add( new dynamicInterfaceInTSrc("set target if dynamic interface in TSrc" ) );
add( new convertInterfaceIdToStr("prepare interface assignments") );
add( new CheckIfIPv6Rule("find ipv6 rules"));
if (fwopt->getBool("use_iptables_restore"))
{
// bug #1812295: we should use PrintRuleIptRstEcho not only
src/ipt/NATCompiler_ipt.h
+8 -3
View File
@@ -511,9 +511,14 @@ namespace fwcompiler {
public:
NATCompiler_ipt(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
fwcompiler::OSConfigurator *_oscnf) : NATCompiler(_db,fwname,_oscnf)
{have_dynamic_interfaces=false; printRule=NULL;}
const std::string &fwname,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf) :
NATCompiler(_db, fwname, ipv6_policy, _oscnf)
{
have_dynamic_interfaces=false;
printRule=NULL;
}
virtual int prolog();
src/ipt/OSConfigurator_linux24.cpp
+8 -3
View File
@@ -61,8 +61,9 @@ using namespace std;
string OSConfigurator_linux24::myPlatformName() { return "Linux24"; }
OSConfigurator_linux24::OSConfigurator_linux24(FWObjectDatabase *_db,
const string &fwname) :
OSConfigurator(_db,fwname) , os_data(fw->getStr("host_OS"))
const string &fwname,
bool ipv6_policy) :
OSConfigurator(_db, fwname, ipv6_policy) , os_data(fw->getStr("host_OS"))
{
}
@@ -587,7 +588,7 @@ string OSConfigurator_linux24::printPathForAllTools(const string &os)
FWOptions* options=fw->getOptionsObject();
string s, path_lsmod, path_modprobe, path_iptables, path_ip6tables;
string path_iptables_restore, path_ip, path_logger;
string path_iptables_restore, path_ip6tables_restore, path_ip, path_logger;
s=options->getStr("linux24_path_lsmod");
if (!s.empty()) path_lsmod=s;
@@ -609,6 +610,10 @@ string OSConfigurator_linux24::printPathForAllTools(const string &os)
if (!s.empty()) path_iptables_restore=s;
else path_iptables_restore=os_data.getPathForTool(os,OSData::IPTABLES_RESTORE);
s=options->getStr("linux24_path_ip6tables_restore");
if (!s.empty()) path_ip6tables_restore=s;
else path_ip6tables_restore=os_data.getPathForTool(os,OSData::IP6TABLES_RESTORE);
s=options->getStr("linux24_path_ip");
if (!s.empty()) path_ip=s;
else path_ip=os_data.getPathForTool(os,OSData::IP);
src/ipt/OSConfigurator_linux24.h
+1 -1
View File
@@ -52,7 +52,7 @@ namespace fwcompiler {
virtual ~OSConfigurator_linux24() {};
OSConfigurator_linux24(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname);
const std::string &fwname, bool ipv6_policy);
virtual std::string myPlatformName();
src/ipt/OSData.cpp
+8 -7
View File
@@ -38,13 +38,14 @@ string OSData::getPathForTool(const string &distro,tools t)
switch (t)
{
case LSMOD: r+="path_lsmod"; break;
case MODPROBE: r+="path_modprobe"; break;
case IPTABLES: r+="path_iptables"; break;
case IP6TABLES: r+="path_ip6tables"; break;
case IPTABLES_RESTORE: r+="path_iptables_restore"; break;
case IP: r+="path_ip"; break;
case LOGGER: r+="path_logger"; break;
case LSMOD: r+="path_lsmod"; break;
case MODPROBE: r+="path_modprobe"; break;
case IPTABLES: r+="path_iptables"; break;
case IP6TABLES: r+="path_ip6tables"; break;
case IPTABLES_RESTORE: r+="path_iptables_restore"; break;
case IP6TABLES_RESTORE: r+="path_ip6tables_restore"; break;
case IP: r+="path_ip"; break;
case LOGGER: r+="path_logger"; break;
}
return Resources::os_res[host_os]->getResourceStr(r);
}
src/ipt/OSData.h
+8 -1
View File
@@ -40,7 +40,14 @@ class OSData {
OSData(const std::string &ho) { host_os=ho; }
typedef enum { LSMOD, MODPROBE, IPTABLES, IP6TABLES, IPTABLES_RESTORE, IP, LOGGER } tools;
typedef enum { LSMOD,
MODPROBE,
IPTABLES,
IP6TABLES,
IPTABLES_RESTORE,
IP6TABLES_RESTORE,
IP,
LOGGER } tools;
std::string getPathForTool(const std::string &distro,tools t);
};
src/ipt/PolicyCompiler_PrintRule.cpp
+56 -47
View File
@@ -79,15 +79,15 @@ using namespace std;
/*
* check and create new chain if needed
*/
string PolicyCompiler_ipt::PrintRule::_createChain(const string &chain,
bool ipv6)
string PolicyCompiler_ipt::PrintRule::_createChain(const string &chain)
{
string res;
PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
if ( ! chains[chain] )
{
res = string((ipv6) ? "$IP6TABLES -N " : "$IPTABLES -N ") + chain;
res = string((ipt_comp->ipv6) ? "$IP6TABLES -N " : "$IPTABLES -N ") +
chain;
if (ipt_comp->my_table != "filter") res += " -t " + ipt_comp->my_table;
res += "\n";
chains[chain]=true;
@@ -95,10 +95,10 @@ string PolicyCompiler_ipt::PrintRule::_createChain(const string &chain,
return res;
}
string PolicyCompiler_ipt::PrintRule::_startRuleLine(bool ipv6)
string PolicyCompiler_ipt::PrintRule::_startRuleLine()
{
string res = (ipv6) ? "$IP6TABLES " : "$IPTABLES ";
PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
string res = (ipt_comp->ipv6) ? "$IP6TABLES " : "$IPTABLES ";
if (ipt_comp->my_table != "filter") res += "-t " + ipt_comp->my_table + " ";
@@ -914,6 +914,14 @@ string PolicyCompiler_ipt::PrintRule::_printAddr(Address *o)
const InetAddr *addr = o->getAddressPtr();
const InetAddr *mask = o->getNetmaskPtr();
if (addr==NULL)
{
compiler->warning(
string("Empty inet address in object ") +
o->getId());
return ostr.str();
}
if (addr->isAny() && mask->isAny())
{
ostr << "0/0 ";
@@ -1064,6 +1072,7 @@ PolicyCompiler_ipt::PrintRule::PrintRule(const std::string &name) : PolicyRulePr
bool PolicyCompiler_ipt::PrintRule::processNext()
{
PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
PolicyRule *rule =getNext();
if (rule==NULL) return false;
@@ -1080,11 +1089,11 @@ bool PolicyCompiler_ipt::PrintRule::processNext()
string PolicyCompiler_ipt::PrintRule::PolicyRuleToString(PolicyRule *rule)
{
PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
FWOptions *ruleopt = rule->getOptionsObject();
FWObject *ref;
bool isIPv6 = rule->getBool("ipv6_rule");
RuleElementSrc *srcrel=rule->getSrc();
ref=srcrel->front();
Address *src=Address::cast(FWReference::cast(ref)->getPointer());
@@ -1106,7 +1115,7 @@ string PolicyCompiler_ipt::PrintRule::PolicyRuleToString(PolicyRule *rule)
std::ostringstream command_line;
command_line << _startRuleLine(isIPv6);
command_line << _startRuleLine();
command_line << _printChain(rule);
command_line << _printDirectionAndInterface(rule);
@@ -1212,12 +1221,12 @@ string PolicyCompiler_ipt::PrintRule::_declareTable()
string PolicyCompiler_ipt::PrintRule::_flushAndSetDefaultPolicy()
{
// PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
FWOptions *fwopt = compiler->getCachedFwOpt();
ostringstream res;
// if (ipt_comp->my_table=="filter")
// {
if (!ipt_comp->ipv6)
{
res << "$IPTABLES -P OUTPUT DROP" << endl;
res << "$IPTABLES -P INPUT DROP" << endl;
res << "$IPTABLES -P FORWARD DROP" << endl;
@@ -1237,32 +1246,31 @@ done\n";
res << endl;
res << endl;
}
if (ipt_comp->ipv6)
{
/*
* test if ip6tables is installed and if it works. It may be installed
* on the system but fail because ipv6 is not compiled into the
* kernel.
*/
res << "$IP6TABLES -L -n > /dev/null 2>&1 && {" << endl;
res << " $IP6TABLES -P OUTPUT DROP" << endl;
res << " $IP6TABLES -P INPUT DROP" << endl;
res << " $IP6TABLES -P FORWARD DROP" << endl;
res << "$IP6TABLES -P OUTPUT DROP" << endl;
res << "$IP6TABLES -P INPUT DROP" << endl;
res << "$IP6TABLES -P FORWARD DROP" << endl;
res << "\n\
cat /proc/net/ip6_tables_names | while read table; do\n\
$IP6TABLES -t $table -L -n | while read c chain rest; do\n\
if test \"X$c\" = \"XChain\" ; then\n\
$IP6TABLES -t $table -F $chain\n\
fi\n\
done\n\
$IP6TABLES -t $table -X\n\
cat /proc/net/ip6_tables_names | while read table; do\n\
$IP6TABLES -t $table -L -n | while read c chain rest; do\n\
if test \"X$c\" = \"XChain\" ; then\n\
$IP6TABLES -t $table -F $chain\n\
fi\n\
done\n\
\n\
\n";
res << "}";
$IP6TABLES -t $table -X\n\
done\n";
res << endl;
res << endl;
// }
}
return res.str();
}
@@ -1271,10 +1279,11 @@ string PolicyCompiler_ipt::PrintRule::_commit()
return "";
}
string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules(bool isIPv6)
string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules()
{
PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
ostringstream res;
bool isIPv6 = ipt_comp->ipv6;
/*
* bug #1092141: "irritating FORWARD rule for established connections"
@@ -1287,7 +1296,7 @@ string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules(bool isIPv6)
if ( compiler->getCachedFwOpt()->getBool("clamp_mss_to_mtu") && ipforward)
{
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu"
<< _endRuleLine();
@@ -1297,16 +1306,16 @@ string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules(bool isIPv6)
if ( compiler->getCachedFwOpt()->getBool("accept_established") &&
ipt_comp->my_table=="filter")
{
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT"
<< _endRuleLine();
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT"
<< _endRuleLine();
if (ipforward)
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT"
<< _endRuleLine();
@@ -1358,12 +1367,12 @@ string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules(bool isIPv6)
* Need to add rules with ESTABLISHED and RELATED to make sure backup ssh access
* works even when global rule that accepts ESTABLISHED and RELATED is disabled
*/
res << _startRuleLine(isIPv6) << "INPUT -p tcp -m tcp -s "
res << _startRuleLine() << "INPUT -p tcp -m tcp -s "
<< inet_addr->toString()
<< " --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT"
<< _endRuleLine();
res << _startRuleLine(isIPv6) << "OUTPUT -p tcp -m tcp -d "
res << _startRuleLine() << "OUTPUT -p tcp -m tcp -d "
<< inet_addr->toString()
<< " --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT"
<< _endRuleLine();
@@ -1379,16 +1388,16 @@ string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules(bool isIPv6)
res << "#" << endl;
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP"
<< _endRuleLine();
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "OUTPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP"
<< _endRuleLine();
if (ipforward)
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "FORWARD -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP"
<< _endRuleLine();
@@ -1403,37 +1412,37 @@ string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules(bool isIPv6)
if ( !compiler->getCachedFwOpt()->getBool("log_invalid"))
{
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "OUTPUT -m state --state INVALID -j DROP"
<< _endRuleLine();
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "INPUT -m state --state INVALID -j DROP"
<< _endRuleLine();
if (ipforward)
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "FORWARD -m state --state INVALID -j DROP"
<< _endRuleLine();
} else
{
res << _createChain("drop_invalid", isIPv6);
res << _createChain("drop_invalid");
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "OUTPUT -m state --state INVALID -j drop_invalid"
<< _endRuleLine();
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "INPUT -m state --state INVALID -j drop_invalid"
<< _endRuleLine();
if (ipforward)
res << _startRuleLine(isIPv6)
res << _startRuleLine()
<< "FORWARD -m state --state INVALID -j drop_invalid"
<< _endRuleLine();
res << _startRuleLine(isIPv6);
res << _startRuleLine();
if (compiler->getCachedFwOpt()->getBool("use_ULOG"))
@@ -1465,7 +1474,7 @@ string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules(bool isIPv6)
res << _printLogPrefix("-1", "DENY","global","drop_invalid","BLOCK INVALID",s)
<< _endRuleLine()
<< _startRuleLine(isIPv6) << "drop_invalid -j DROP" << _endRuleLine();
<< _startRuleLine() << "drop_invalid -j DROP" << _endRuleLine();
}
res << endl;
src/ipt/PolicyCompiler_PrintRuleIptRst.cpp
+2 -3
View File
@@ -57,8 +57,7 @@ using namespace std;
/*
* check and create new chain if needed
*/
string PolicyCompiler_ipt::PrintRuleIptRst::_createChain(const string &chain,
bool)
string PolicyCompiler_ipt::PrintRuleIptRst::_createChain(const string &chain)
{
string res;
if ( ! chains[chain] )
@@ -69,7 +68,7 @@ string PolicyCompiler_ipt::PrintRuleIptRst::_createChain(const string &chain,
return res;
}
string PolicyCompiler_ipt::PrintRuleIptRst::_startRuleLine(bool)
string PolicyCompiler_ipt::PrintRuleIptRst::_startRuleLine()
{
return string("-A ");
}
src/ipt/PolicyCompiler_PrintRuleIptRstEcho.cpp
+2 -3
View File
@@ -57,8 +57,7 @@ using namespace std;
/*
* check and create new chain if needed
*/
string PolicyCompiler_ipt::PrintRuleIptRstEcho::_createChain(
const string &chain, bool)
string PolicyCompiler_ipt::PrintRuleIptRstEcho::_createChain(const string &chain)
{
string res;
if ( ! chains[chain] )
@@ -69,7 +68,7 @@ string PolicyCompiler_ipt::PrintRuleIptRstEcho::_createChain(
return res;
}
string PolicyCompiler_ipt::PrintRuleIptRstEcho::_startRuleLine(bool)
string PolicyCompiler_ipt::PrintRuleIptRstEcho::_startRuleLine()
{
return string("echo \"-A ");
}
src/ipt/PolicyCompiler_ipt.cpp
+40 -22
View File
@@ -2535,28 +2535,20 @@ bool PolicyCompiler_ipt::checkForDynamicInterfacesOfOtherObjects::processNext()
bool PolicyCompiler_ipt::expandMultipleAddressesIfNotFWinSrc::processNext()
{
PolicyRule *rule=getNext(); if (rule==NULL) return false;
RuleElementSrc *srcrel=rule->getSrc();
Address *src =compiler->getFirstSrc(rule); assert(src);
if (Firewall::cast(src)==NULL) compiler->_expandAddr(rule,srcrel);
if (Firewall::cast(src)==NULL) compiler->_expandAddr(rule, srcrel);
tmp_queue.push_back(rule);
return true;
}
bool PolicyCompiler_ipt::expandMultipleAddressesIfNotFWinDst::processNext()
{
PolicyRule *rule=getNext(); if (rule==NULL) return false;
RuleElementDst *dstrel=rule->getDst();
Address *dst =compiler->getFirstDst(rule); assert(dst);
if (Firewall::cast(dst)==NULL) compiler->_expandAddr(rule,dstrel);
if (Firewall::cast(dst)==NULL) compiler->_expandAddr(rule, dstrel);
tmp_queue.push_back(rule);
return true;
}
@@ -2860,9 +2852,16 @@ bool PolicyCompiler_ipt::finalizeChain::processNext()
{
// RuleElementSrc *srcrel=rule->getSrc();
Address *src =compiler->getFirstSrc(rule); assert(src);
Address *src =compiler->getFirstSrc(rule);
if (src==NULL)
compiler->abort(string("finalizeChain: Empty Source rule element in rule ") +
rule->getLabel());
// RuleElementDst *dstrel=rule->getDst();
Address *dst =compiler->getFirstDst(rule); assert(dst);
Address *dst =compiler->getFirstDst(rule);
if (dst==NULL)
compiler->abort(string("finalizeChain: Empty Destination rule element in rule ") +
rule->getLabel());
bool b,m;
/*
@@ -2975,9 +2974,15 @@ bool PolicyCompiler_ipt::removeFW::processNext()
! rule->getBool("upstream_rule_neg") )
{
RuleElementSrc *srcrel=rule->getSrc();
Address *src =compiler->getFirstSrc(rule); assert(src);
Address *src =compiler->getFirstSrc(rule);
if (src==NULL)
compiler->abort(string("removeFW: Empty Source rule element in rule ") +
rule->getLabel());
RuleElementDst *dstrel=rule->getDst();
Address *dst =compiler->getFirstDst(rule); assert(dst);
Address *dst =compiler->getFirstDst(rule);
if (dst==NULL)
compiler->abort(string("removeFW: Empty Destination rule element in rule ") +
rule->getLabel());
if (( rule->getStr("ipt_chain")=="INPUT" ||
rule->getStr("upstream_rule_chain")=="INPUT") && dst->getId()==compiler->getFwId() )
@@ -3623,8 +3628,9 @@ void PolicyCompiler_ipt::compile()
{
printRule=NULL;
cout << _(" Compiling rules for '") << my_table
<< _("' table ...") << endl << flush;
cout << " Compiling rules for '" << my_table << "' table";
if (ipv6) cout << ", IPv6";
cout << endl << flush;
try {
@@ -3659,6 +3665,8 @@ void PolicyCompiler_ipt::compile()
check_for_recursive_groups=false;
add( new ExpandGroups("expand groups" ) );
add( new dropRuleWithEmptyRE(
"drop rules with empty rule elements"));
add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC") );
add( new eliminateDuplicatesInDST("eliminate duplicates in DST") );
add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV") );
@@ -3674,6 +3682,9 @@ void PolicyCompiler_ipt::compile()
"expand objects with multiple addresses in SRC" ) );
add( new ExpandMultipleAddressesInDST(
"expand objects with multiple addresses in DST" ) );
add( new dropRuleWithEmptyRE(
"drop rules with empty rule elements"));
add( new ConvertToAtomic("convert to atomic rules" ) );
/*
@@ -3801,6 +3812,8 @@ void PolicyCompiler_ipt::compile()
add( new setChainPostroutingForTag("chain POSTROUTING for Tag"));
add( new ExpandGroups( "expand all groups" ));
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC" ));
add( new eliminateDuplicatesInDST("eliminate duplicates in DST" ));
add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV" ));
@@ -3852,6 +3865,17 @@ void PolicyCompiler_ipt::compile()
add( new expandLoopbackInterfaceAddress(
"check for loopback interface in the rule objects") );
// processors that expand objects with multiple addresses
// check addresses against current address family using member
// ipv6. If all addresses do not match, we may end up with
// empty rule element.
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
if (ipv6)
add( new DropIPv4Rules("drop ipv4 rules"));
else
add( new DropIPv6Rules("drop ipv6 rules"));
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
// trying process rules with multiple interfaces as late as possible
add( new InterfacePolicyRulesWithOptimization(
@@ -3926,7 +3950,6 @@ void PolicyCompiler_ipt::compile()
"drop rules with action Continue") );
add( new convertInterfaceIdToStr("prepare interface assignments") );
add( new optimize3("optimization 3") );
add( new CheckIfIPv6Rule("find ipv6 rules"));
add( createPrintRuleProcessor() );
@@ -4107,11 +4130,6 @@ string PolicyCompiler_ipt::flushAndSetDefaultPolicy()
res += printRule->_declareTable();
res += printRule->_flushAndSetDefaultPolicy();
res += printRule->_printOptionalGlobalRules();
if (haveIPv6Rules())
{
// same rules for ipv6
res += printRule->_printOptionalGlobalRules(true);
}
return res;
}
src/ipt/PolicyCompiler_ipt.h
+11 -12
View File
@@ -795,8 +795,7 @@ namespace fwcompiler {
std::string current_rule_label;
std::map<const std::string,bool> chains;
virtual std::string _createChain(const std::string &chain,
bool ipv6=false);
virtual std::string _createChain(const std::string &chain);
virtual std::string _printRuleLabel(libfwbuilder::PolicyRule *r);
virtual std::string _printSrcService(libfwbuilder::RuleElementSrv *o);
@@ -838,13 +837,13 @@ namespace fwcompiler {
PrintRule(const std::string &name);
virtual std::string _printGlobalLogParameters();
virtual std::string _printOptionalGlobalRules(bool ipv6=false);
virtual std::string _printOptionalGlobalRules();
virtual std::string _declareTable();
virtual std::string _flushAndSetDefaultPolicy();
virtual std::string _commit();
virtual std::string _quote(const std::string &s);
virtual std::string _startRuleLine(bool ipv6=false);
virtual std::string _startRuleLine();
virtual std::string _endRuleLine();
virtual bool processNext();
@@ -856,9 +855,8 @@ namespace fwcompiler {
class PrintRuleIptRst : public PrintRule
{
virtual std::string _createChain(const std::string &chain,
bool ipv6=false);
virtual std::string _startRuleLine(bool ipv6=false);
virtual std::string _createChain(const std::string &chain);
virtual std::string _startRuleLine();
virtual std::string _endRuleLine();
virtual std::string _printRuleLabel(libfwbuilder::PolicyRule *r);
@@ -875,9 +873,8 @@ namespace fwcompiler {
class PrintRuleIptRstEcho : public PrintRuleIptRst
{
virtual std::string _createChain(const std::string &chain,
bool ipv6=false);
virtual std::string _startRuleLine(bool ipv6=false);
virtual std::string _createChain(const std::string &chain);
virtual std::string _startRuleLine();
virtual std::string _endRuleLine();
public:
@@ -906,8 +903,10 @@ namespace fwcompiler {
public:
PolicyCompiler_ipt(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
fwcompiler::OSConfigurator *_oscnf) : PolicyCompiler(_db,fwname,_oscnf)
const std::string &fwname,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf) :
PolicyCompiler(_db, fwname, ipv6_policy, _oscnf)
{
have_dynamic_interfaces = false;
have_connmark = false;
src/ipt/RoutingCompiler_ipt.h
+3 -2
View File
@@ -158,8 +158,9 @@ namespace fwcompiler {
public:
RoutingCompiler_ipt(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
fwcompiler::OSConfigurator *_oscnf) : RoutingCompiler(_db,fwname,_oscnf) {}
const std::string &fwname, bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf) :
RoutingCompiler(_db, fwname, ipv6_policy, _oscnf) {}
virtual int prolog();
src/ipt/ipt.cpp
+184 -114
View File
@@ -96,6 +96,8 @@ static int drn = -1;
static int verbose = 0;
static bool have_dynamic_interfaces = false;
static bool test_mode = false;
static bool ipv4_run = true;
static bool ipv6_run = true;
FWObjectDatabase *objdb = NULL;
@@ -133,11 +135,87 @@ string addPrologScript(bool nocomment,const string &script)
return res;
}
string dumpPolicies(bool nocomm, Firewall *fw,
MangleTableCompiler_ipt &m,
NATCompiler_ipt &n,
PolicyCompiler_ipt &c,
bool ipv6_policy)
{
ostringstream script;
string prolog_place= fw->getOptionsObject()->getStr("prolog_place");
if (fw->getOptionsObject()->getBool("use_iptables_restore"))
{
script << "(" << endl;
script << c.flushAndSetDefaultPolicy();
if (prolog_place == "after_flush")
{
script << addPrologScript(
nocomm, fw->getOptionsObject()->getStr("prolog_script"));
}
script << c.getCompiledScript();
script << c.commit();
if (m.getCompiledScriptLength()>0)
{
script << m.flushAndSetDefaultPolicy();
script << m.getCompiledScript();
script << m.commit();
}
if (n.getCompiledScriptLength()>0)
{
script << n.flushAndSetDefaultPolicy();
script << n.getCompiledScript();
script << n.commit();
}
script << "#" << endl;
if (ipv6_policy)
script << ") | $IP6TABLES_RESTORE; IPTABLES_RESTORE_RES=$?" << endl;
else
script << ") | $IPTABLES_RESTORE; IPTABLES_RESTORE_RES=$?" << endl;
} else
{
script << c.flushAndSetDefaultPolicy();
if (m.getCompiledScriptLength()>0)
script << m.flushAndSetDefaultPolicy();
if (n.getCompiledScriptLength()>0)
script << n.flushAndSetDefaultPolicy();
if (prolog_place == "after_flush")
{
script << addPrologScript(
nocomm, fw->getOptionsObject()->getStr("prolog_script"));
}
if (n.getCompiledScriptLength()>0)
{
script << n.getCompiledScript();
script << n.commit();
}
if (m.getCompiledScriptLength()>0)
{
script << m.getCompiledScript();
script << m.commit();
}
script << c.getCompiledScript();
script << c.commit();
}
return script.str();
}
void usage(const char *name)
{
cout << _("Firewall Builder: policy compiler for Linux 2.4.x and 2.6.x iptables") << endl;
cout << _("Version ") << VERSION << "-" << RELEASE_NUM << endl;
cout << _("Usage: ") << name << _(" [-x level] [-v] [-V] [-q] [-f filename.xml] [-d destdir] [-m] firewall_object_name") << endl;
cout << _("Usage: ") << name << _(" [-x level] [-v] [-V] [-q] [-f filename.xml] [-d destdir] [-m] [-4|-6] firewall_object_name") << endl;
}
int main(int argc, char * const *argv)
@@ -163,10 +241,18 @@ int main(int argc, char * const *argv)
int opt;
while( (opt=getopt(argc,argv,"x:vVqf:d:r:o:")) != EOF )
while( (opt=getopt(argc,argv,"x:vVqf:d:r:o:46")) != EOF )
{
switch(opt)
{
case '4':
ipv4_run = true;
ipv6_run = false;
break;
case '6':
ipv4_run = false;
ipv6_run = true;
break;
case 'd':
wdir = strdup(optarg);
break;
@@ -377,24 +463,27 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
}
}
string firewall_dir=options->getStr("firewall_dir");
string firewall_dir = options->getStr("firewall_dir");
if (firewall_dir=="") firewall_dir="/etc";
bool debug=options->getBool("debug");
string shell_dbg=(debug)?"set -x":"" ;
string pfctl_dbg=(debug)?"-v":"";
Preprocessor* prep=new Preprocessor(objdb , fwobjectname);
prep->compile();
OSConfigurator_linux24 *oscnf=NULL;
string family=Resources::os_res[fw->getStr("host_OS")]->Resources::getResourceStr("/FWBuilderResources/Target/family");
if ( family=="linux24" )
oscnf=new OSConfigurator_linux24(objdb , fwobjectname);
oscnf = new OSConfigurator_linux24(objdb , fwobjectname, false);
if (oscnf==NULL)
throw FWException(_("Unrecognized host OS ")+fw->getStr("host_OS")+" (family "+family+")");
/* do not put comment in the script if it is intended for linksys */
bool nocomm = Resources::os_res[fw->getStr("host_OS")]->
Resources::getResourceBool(
"/FWBuilderResources/Target/options/suppress_comments");
oscnf->prolog();
int policy_rules_count = 0;
@@ -402,54 +491,97 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
int nat_rules_count = 0;
int routing_rules_count = 0;
MangleTableCompiler_ipt m( objdb , fwobjectname , oscnf );
vector<bool> ipv4_6_runs;
string generated_script;
m.setDebugLevel( dl );
m.setDebugRule( drp );
m.setVerbose( (bool)(verbose) );
m.setHaveDynamicInterfaces(have_dynamic_interfaces);
if (test_mode) m.setTestMode();
// command line options -4 and -6 control address family for which
// script will be generated. If "-4" is used, only ipv4 part will
// be generated. If "-6" is used, only ipv6 part will be generated.
// If neither is used, both parts will be done.
if ( (mangle_rules_count=m.prolog()) > 0 )
if (options->getStr("ipv4_6_order").empty() ||
options->getStr("ipv4_6_order") == "ipv4_first")
{
m.compile();
m.epilog();
}
if (ipv4_run) ipv4_6_runs.push_back(false);
if (ipv6_run && options->getBool("enable_ipv6"))
ipv4_6_runs.push_back(true);
}
// compile NAT rules before policy rules because policy compiler
// needs to know the number of virtual addresses being created for NAT
NATCompiler_ipt n( objdb , fwobjectname , oscnf );
n.setDebugLevel( dl );
n.setDebugRule( drn );
n.setVerbose( (bool)(verbose) );
n.setHaveDynamicInterfaces(have_dynamic_interfaces);
if (test_mode) n.setTestMode();
if ( (nat_rules_count=n.prolog()) > 0 )
if (options->getStr("ipv4_6_order") == "ipv6_first")
{
oscnf->generateCodeForProtocolHandlers(true);
n.compile();
n.epilog();
} else
oscnf->generateCodeForProtocolHandlers(false);
if (ipv6_run && options->getBool("enable_ipv6"))
ipv4_6_runs.push_back(true);
if (ipv4_run) ipv4_6_runs.push_back(false);
}
PolicyCompiler_ipt c( objdb , fwobjectname , oscnf );
c.setDebugLevel( dl );
c.setDebugRule( drp );
c.setVerbose( (bool)(verbose) );
c.setHaveDynamicInterfaces(have_dynamic_interfaces);
if (test_mode) c.setTestMode();
if ( (policy_rules_count=c.prolog()) > 0 )
for (vector<bool>::iterator i=ipv4_6_runs.begin();
i!=ipv4_6_runs.end(); ++i)
{
c.compile();
c.epilog();
}
bool ipv6_policy = *i;
RoutingCompiler_ipt r( objdb , fwobjectname , oscnf );
if (ipv6_policy)
{
generated_script += "\n\n";
generated_script += "#================ IPv6 ================\n";
generated_script += "\n\n";
}
Preprocessor* prep = new Preprocessor(
objdb , fwobjectname, ipv6_policy);
prep->compile();
MangleTableCompiler_ipt m(
objdb , fwobjectname, ipv6_policy , oscnf );
m.setDebugLevel( dl );
m.setDebugRule( drp );
m.setVerbose( (bool)(verbose) );
m.setHaveDynamicInterfaces(have_dynamic_interfaces);
if (test_mode) m.setTestMode();
if ( (mangle_rules_count=m.prolog()) > 0 )
{
m.compile();
m.epilog();
}
// compile NAT rules before policy rules because policy
// compiler needs to know the number of virtual addresses
// being created for NAT
NATCompiler_ipt n(objdb, fwobjectname, ipv6_policy, oscnf);
n.setDebugLevel( dl );
n.setDebugRule( drn );
n.setVerbose( (bool)(verbose) );
n.setHaveDynamicInterfaces(have_dynamic_interfaces);
if (test_mode) n.setTestMode();
if ( (nat_rules_count=n.prolog()) > 0 )
{
oscnf->generateCodeForProtocolHandlers(true);
n.compile();
n.epilog();
} else
oscnf->generateCodeForProtocolHandlers(false);
PolicyCompiler_ipt c(objdb, fwobjectname, ipv6_policy, oscnf);
c.setDebugLevel( dl );
c.setDebugRule( drp );
c.setVerbose( (bool)(verbose) );
c.setHaveDynamicInterfaces(have_dynamic_interfaces);
if (test_mode) c.setTestMode();
if ( (policy_rules_count=c.prolog()) > 0 )
{
c.compile();
c.epilog();
}
generated_script += dumpPolicies(nocomm, fw, m, n, c, ipv6_policy);
}
RoutingCompiler_ipt r( objdb , fwobjectname , false, oscnf );
r.setDebugLevel( dl );
r.setDebugRule( drp );
@@ -522,8 +654,6 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
script << "#" << endl;
script << "#" << endl;
/* do not put comment in the script if it is intended for linksys */
bool nocomm=Resources::os_res[fw->getStr("host_OS")]->Resources::getResourceBool("/FWBuilderResources/Target/options/suppress_comments");
if ( !nocomm )
{
string fwcomment=fw->getComment();
@@ -559,8 +689,8 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
if (prolog_place == "top")
{
script <<
addPrologScript(nocomm,
fw->getOptionsObject()->getStr("prolog_script"));
addPrologScript(
nocomm, fw->getOptionsObject()->getStr("prolog_script"));
}
script << oscnf->getCompiledScript();
@@ -570,8 +700,8 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
if (prolog_place == "after_interfaces")
{
script <<
addPrologScript(nocomm,
fw->getOptionsObject()->getStr("prolog_script"));
addPrologScript(
nocomm, fw->getOptionsObject()->getStr("prolog_script"));
}
script << "log '";
@@ -596,70 +726,10 @@ _("Dynamic interface %s should not have an IP address object attached to it. Thi
script << endl;
if (options->getBool("use_iptables_restore"))
{
script << "(" << endl;
script << generated_script;
script << c.flushAndSetDefaultPolicy();
if (prolog_place == "after_flush")
{
script << addPrologScript(nocomm,
fw->getOptionsObject()->getStr("prolog_script"));
}
script << c.getCompiledScript();
script << c.commit();
if (m.getCompiledScriptLength()>0)
{
script << m.flushAndSetDefaultPolicy();
script << m.getCompiledScript();
script << m.commit();
}
if (n.getCompiledScriptLength()>0)
{
script << n.flushAndSetDefaultPolicy();
script << n.getCompiledScript();
script << n.commit();
}
script << "#" << endl;
script << ") | $IPTABLES_RESTORE; IPTABLES_RESTORE_RES=$?" << endl;
} else
{
script << c.flushAndSetDefaultPolicy();
if (m.getCompiledScriptLength()>0)
script << m.flushAndSetDefaultPolicy();
if (n.getCompiledScriptLength()>0)
script << n.flushAndSetDefaultPolicy();
if (prolog_place == "after_flush")
{
script << addPrologScript(nocomm,
fw->getOptionsObject()->getStr("prolog_script"));
}
if (n.getCompiledScriptLength()>0)
{
script << n.getCompiledScript();
script << n.commit();
}
if (m.getCompiledScriptLength()>0)
{
script << m.getCompiledScript();
script << m.commit();
}
script << c.getCompiledScript();
script << c.commit();
}
script << r.getCompiledScript();
oscnf->epilog();
script << oscnf->getCompiledScript();
src/pf/pf.cpp
+180 -126
View File
@@ -99,6 +99,8 @@ static int drp = -1;
static int drn = -1;
static int verbose = 0;
static bool test_mode = false;
static bool ipv4_run = true;
static bool ipv6_run = true;
static map<string,RuleSet*> branches;
static map<string,string> anchor_files;
@@ -136,7 +138,7 @@ void usage(const char *name)
{
cout << _("Firewall Builder: policy compiler for OpenBSD PF") << endl;
cout << _("Version ") << VERSION << RELEASE_NUM << endl;
cout << _("Usage: ") << name << " [-x] [-v] [-V] [-f filename.xml] [-o output.fw] [-d destdir] [-m] firewall_object_name" << endl;
cout << _("Usage: ") << name << " [-x] [-v] [-V] [-f filename.xml] [-o output.fw] [-d destdir] [-m] [-4|-6] firewall_object_name" << endl;
}
@@ -189,10 +191,18 @@ int main(int argc, char * const *argv)
int opt;
while( (opt=getopt(argc,argv,"x:vVf:d:r:o:")) != EOF )
while( (opt=getopt(argc,argv,"x:vVf:d:r:o:46")) != EOF )
{
switch(opt)
{
case '4':
ipv4_run = true;
ipv6_run = false;
break;
case '6':
ipv4_run = false;
ipv6_run = true;
break;
case 'd':
wdir = strdup(optarg);
break;
@@ -381,9 +391,6 @@ int main(int argc, char * const *argv)
// if (fw->getStr("version")=="obsd_3.2") pfctl_f_option="-f ";
if (fw->getStr("version")=="obsd_lt_3.2") pfctl_f_option="-R ";
Preprocessor_pf* prep = new Preprocessor_pf(objdb , fwobjectname);
prep->compile();
/*
* Process firewall options, build OS network configuration script
*/
@@ -392,16 +399,16 @@ int main(int argc, char * const *argv)
]->Resources::getResourceStr("/FWBuilderResources/Target/family");
if (family=="solaris")
oscnf=new OSConfigurator_solaris(objdb , fwobjectname);
oscnf=new OSConfigurator_solaris(objdb , fwobjectname, false);
if (family=="openbsd")
{
cerr << "Calling OSConfigurator_openbsd" << endl;
oscnf=new OSConfigurator_openbsd(objdb , fwobjectname);
oscnf=new OSConfigurator_openbsd(objdb , fwobjectname, false);
}
if (family=="freebsd")
oscnf=new OSConfigurator_freebsd(objdb , fwobjectname);
oscnf=new OSConfigurator_freebsd(objdb , fwobjectname, false);
if (oscnf==NULL)
throw FWException(_("Unrecognized host OS ") +
@@ -409,70 +416,176 @@ int main(int argc, char * const *argv)
oscnf->prolog();
// find branching rules and store names of the branches and
// pointers to corresponding rule sets
//
FWObject *policy = fw->getFirstByType(Policy::TYPENAME);
for (FWObject::iterator i=policy->begin(); i!=policy->end(); i++)
vector<bool> ipv4_6_runs;
string generated_script;
// command line options -4 and -6 control address family for which
// script will be generated. If "-4" is used, only ipv4 part will
// be generated. If "-6" is used, only ipv6 part will be generated.
// If neither is used, both parts will be done.
if (options->getStr("ipv4_6_order").empty() ||
options->getStr("ipv4_6_order") == "ipv4_first")
{
PolicyRule *rule = PolicyRule::cast(*i);
if (rule->getAction()==PolicyRule::Branch)
{
int parentRuleNum = rule->getPosition();
RuleSet *subset = rule->getBranch();
if (subset==NULL)
{
throw FWException(
_("Action 'Branch' but no branch policy in policy rule ")
+rule->getLabel());
}
subset->setInt("parent_rule_num",parentRuleNum);
FWOptions *ropt = rule->getOptionsObject();
string branchName = ropt->getStr("branch_name");
branches[branchName] = subset;
subset->ref();
rule->remove(subset);
}
if (ipv4_run) ipv4_6_runs.push_back(false);
if (ipv6_run && options->getBool("enable_ipv6"))
ipv4_6_runs.push_back(true);
}
TableFactory *table_factory = new TableFactory();
NATCompiler_pf n( objdb, fwobjectname, oscnf, table_factory );
n.setDebugLevel( dl );
n.setDebugRule( drn );
n.setVerbose( verbose );
if (test_mode) n.setTestMode();
bool have_nat=false;
if ( n.prolog() > 0 )
if (options->getStr("ipv4_6_order") == "ipv6_first")
{
have_nat=true;
if (ipv6_run && options->getBool("enable_ipv6"))
ipv4_6_runs.push_back(true);
if (ipv4_run) ipv4_6_runs.push_back(false);
}
n.compile();
n.epilog();
}
PolicyCompiler_pf c( objdb, fwobjectname, oscnf, &n, table_factory );
c.setDebugLevel( dl );
c.setDebugRule( drp );
c.setVerbose( verbose );
if (test_mode) c.setTestMode();
bool have_pf=false;
if ( c.prolog() > 0 )
for (vector<bool>::iterator i=ipv4_6_runs.begin();
i!=ipv4_6_runs.end(); ++i)
{
have_pf=true;
bool ipv6_policy = *i;
cout << " Compiling policy rules for "
<< fwobjectname
<< " ..." << endl << flush;
if (ipv6_policy)
{
generated_script += "\n\n";
generated_script += "#================ IPv6 ================\n";
generated_script += "\n\n";
}
c.compile();
c.epilog();
}
TableFactory *table_factory = new TableFactory();
Preprocessor_pf* prep = new Preprocessor_pf(
objdb , fwobjectname, ipv6_policy);
prep->compile();
// find branching rules and store names of the branches and
// pointers to corresponding rule sets
//
FWObject *policy = fw->getFirstByType(Policy::TYPENAME);
for (FWObject::iterator i=policy->begin(); i!=policy->end(); i++)
{
PolicyRule *rule = PolicyRule::cast(*i);
if (rule->getAction()==PolicyRule::Branch)
{
int parentRuleNum = rule->getPosition();
RuleSet *subset = rule->getBranch();
if (subset==NULL)
{
throw FWException(
_("Action 'Branch' but no branch policy in policy rule ")
+rule->getLabel());
}
subset->setInt("parent_rule_num",parentRuleNum);
FWOptions *ropt = rule->getOptionsObject();
string branchName = ropt->getStr("branch_name");
branches[branchName] = subset;
subset->ref();
rule->remove(subset);
}
}
NATCompiler_pf n( objdb, fwobjectname, ipv6_policy, oscnf,
table_factory );
n.setDebugLevel( dl );
n.setDebugRule( drn );
n.setVerbose( verbose );
if (test_mode) n.setTestMode();
bool have_nat=false;
if ( n.prolog() > 0 )
{
have_nat=true;
n.compile();
n.epilog();
}
PolicyCompiler_pf c( objdb, fwobjectname, ipv6_policy, oscnf,
&n, table_factory );
c.setDebugLevel( dl );
c.setDebugRule( drp );
c.setVerbose( verbose );
if (test_mode) c.setTestMode();
bool have_pf=false;
if ( c.prolog() > 0 )
{
have_pf=true;
cout << " Compiling policy rules for "
<< fwobjectname
<< " ..." << endl << flush;
c.compile();
c.epilog();
}
generated_script += table_factory->PrintTables();
generated_script += "\n";
if (have_nat) generated_script += n.getCompiledScript();
if (have_pf) generated_script += c.getCompiledScript();
// run policy compiler for each branch we have found in the
// ruleset and store the result in a separate .conf file
//
map<string,RuleSet*>::iterator bi;
for (bi=branches.begin(); bi!=branches.end(); ++bi)
{
table_factory = new TableFactory();
string branchName = bi->first;
RuleSet *subset = bi->second;
PolicyCompiler_pf c( objdb , fwobjectname, ipv6_policy,
oscnf, &n, table_factory );
c.setSourceRuleSet( subset );
c.setRuleSetName(branchName);
c.setDebugLevel( dl );
c.setDebugRule( drp );
c.setVerbose( verbose );
if (test_mode) c.setTestMode();
if ( c.prolog() > 0 )
{
cout << " Compiling rules for anchor "
<< branchName
<< " ..." << endl << flush;
c.compile();
c.epilog();
string anchor_file_name;
if (fw_file_name.empty())
{
anchor_file_name=string(fwobjectname) + "-" + branchName + ".conf";
} else
{
string::size_type n = fw_file_name.rfind(".");
anchor_file_name = fw_file_name;
anchor_file_name.erase(n);
anchor_file_name.append("-" + branchName + ".conf");
}
anchor_files[branchName] = anchor_file_name;
ofstream pf_file;
pf_file.exceptions(ofstream::eofbit|ofstream::failbit|ofstream::badbit);
#ifdef _WIN32
pf_file.open(anchor_file_name.c_str(), ios::out|ios::binary);
#else
pf_file.open(anchor_file_name.c_str());
#endif
pf_file << endl;
pf_file << table_factory->PrintTables();
pf_file << endl;
pf_file << c.getCompiledScript();
pf_file.close();
}
}
}
/*
* now write generated scripts to files
@@ -594,7 +707,7 @@ int main(int argc, char * const *argv)
// and generate 'set skip on <ifspec>' commands
if (fw->getStr("version")=="ge_3.7" ||
fw->getStr("version")=="4.x")
fw->getStr("version")=="4.x")
{
for (list<FWObject*>::iterator i=all_interfaces.begin();
i!=all_interfaces.end(); ++i)
@@ -653,75 +766,16 @@ int main(int argc, char * const *argv)
if (prolog_place == "pf_file_after_scrub")
printProlog(pf_file, pre_hook);
pf_file << table_factory->PrintTables();
pf_file << endl;
//pf_file << table_factory->PrintTables();
//pf_file << endl;
if (prolog_place == "pf_file_after_tables")
printProlog(pf_file, pre_hook);
if (have_nat) pf_file << n.getCompiledScript();
if (have_pf) pf_file << c.getCompiledScript();
pf_file << generated_script;
pf_file.close();
// run policy compiler for each branch we have found in the
// ruleset and store the result in a separate .conf file
//
map<string,RuleSet*>::iterator bi;
for (bi=branches.begin(); bi!=branches.end(); ++bi)
{
table_factory = new TableFactory();
string branchName = bi->first;
RuleSet *subset = bi->second;
PolicyCompiler_pf c( objdb , fwobjectname , oscnf , &n, table_factory );
c.setSourceRuleSet( subset );
c.setRuleSetName(branchName);
c.setDebugLevel( dl );
c.setDebugRule( drp );
c.setVerbose( verbose );
if (test_mode) c.setTestMode();
if ( c.prolog() > 0 )
{
cout << " Compiling rules for anchor "
<< branchName
<< " ..." << endl << flush;
c.compile();
c.epilog();
string anchor_file_name;
if (fw_file_name.empty())
{
anchor_file_name=string(fwobjectname) + "-" + branchName + ".conf";
} else
{
string::size_type n = fw_file_name.rfind(".");
anchor_file_name = fw_file_name;
anchor_file_name.erase(n);
anchor_file_name.append("-" + branchName + ".conf");
}
anchor_files[branchName] = anchor_file_name;
ofstream pf_file;
pf_file.exceptions(ofstream::eofbit|ofstream::failbit|ofstream::badbit);
#ifdef _WIN32
pf_file.open(anchor_file_name.c_str(), ios::out|ios::binary);
#else
pf_file.open(anchor_file_name.c_str());
#endif
pf_file << endl;
pf_file << table_factory->PrintTables();
pf_file << endl;
pf_file << c.getCompiledScript();
pf_file.close();
}
}
char *timestr;
time_t tm;
struct tm *stm;
src/pflib/NATCompiler_ipf.h
+3 -1
View File
@@ -186,7 +186,9 @@ namespace fwcompiler {
NATCompiler_ipf(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
fwcompiler::OSConfigurator *_oscnf) : NATCompiler_pf(_db,fwname,_oscnf) {}
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf) :
NATCompiler_pf(_db, fwname, ipv6_policy, _oscnf) {}
virtual int prolog();
src/pflib/NATCompiler_ipfw.h
+3 -1
View File
@@ -50,7 +50,9 @@ namespace fwcompiler {
NATCompiler_ipfw(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
fwcompiler::OSConfigurator *_oscnf) : NATCompiler_pf(_db,fwname,_oscnf) {}
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf) :
NATCompiler_pf(_db, fwname, ipv6_policy, _oscnf) {}
virtual int prolog();
src/pflib/NATCompiler_pf.h
+3 -1
View File
@@ -365,8 +365,10 @@ namespace fwcompiler {
NATCompiler_pf(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf,
TableFactory *tbf = NULL) : NATCompiler(_db,fwname,_oscnf)
TableFactory *tbf = NULL) :
NATCompiler(_db, fwname, ipv6_policy, _oscnf)
{
tables = tbf;
}
src/pflib/OSConfigurator_freebsd.h
+3 -2
View File
@@ -46,8 +46,9 @@ namespace fwcompiler {
virtual ~OSConfigurator_freebsd() {};
OSConfigurator_freebsd(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname) :
OSConfigurator(_db,fwname) , os_data() {}
const std::string &fwname,
bool ipv6_policy) :
OSConfigurator(_db, fwname, ipv6_policy) , os_data() {}
virtual int prolog();
src/pflib/OSConfigurator_macosx.h
+3 -2
View File
@@ -44,8 +44,9 @@ namespace fwcompiler {
virtual ~OSConfigurator_macosx() {};
OSConfigurator_macosx(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname) :
OSConfigurator(_db,fwname) , os_data() {}
const std::string &fwname,
bool ipv6_policy) :
OSConfigurator(_db, fwname, ipv6_policy) , os_data() {}
virtual int prolog();
src/pflib/OSConfigurator_openbsd.h
+3 -2
View File
@@ -44,8 +44,9 @@ namespace fwcompiler {
virtual ~OSConfigurator_openbsd() {};
OSConfigurator_openbsd(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname) :
OSConfigurator(_db,fwname) , os_data() {}
const std::string &fwname,
bool ipv6_policy) :
OSConfigurator(_db, fwname, ipv6_policy) , os_data() {}
virtual int prolog();
src/pflib/OSConfigurator_solaris.h
+3 -2
View File
@@ -47,8 +47,9 @@ namespace fwcompiler {
virtual ~OSConfigurator_solaris() {};
OSConfigurator_solaris(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname) :
OSConfigurator(_db,fwname) , os_data() {}
const std::string &fwname,
bool ipv6_policy) :
OSConfigurator(_db, fwname, ipv6_policy) , os_data() {}
virtual int prolog();
src/pflib/PolicyCompiler_ipf.h
+3 -1
View File
@@ -247,7 +247,9 @@ namespace fwcompiler {
PolicyCompiler_ipf(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
fwcompiler::OSConfigurator *_oscnf) : PolicyCompiler_pf(_db,fwname,_oscnf,NULL) {}
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf) :
PolicyCompiler_pf(_db, fwname, ipv6_policy, _oscnf, NULL) {}
virtual int prolog();
src/pflib/PolicyCompiler_ipfw.h
+3 -1
View File
@@ -234,7 +234,9 @@ namespace fwcompiler {
PolicyCompiler_ipfw(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
fwcompiler::OSConfigurator *_oscnf) : PolicyCompiler_pf(_db,fwname,_oscnf,NULL) {}
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf) :
PolicyCompiler_pf(_db, fwname, ipv6_policy, _oscnf, NULL) {}
virtual int prolog();
src/pflib/PolicyCompiler_pf.h
+3 -1
View File
@@ -440,9 +440,11 @@ namespace fwcompiler {
PolicyCompiler_pf(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf,
NATCompiler_pf *_natcmp,
TableFactory *tbf = NULL) : PolicyCompiler(_db,fwname,_oscnf)
TableFactory *tbf = NULL) :
PolicyCompiler(_db, fwname, ipv6_policy, _oscnf)
{
natcmp=_natcmp;
tables = tbf;
src/pflib/Preprocessor_pf.h
+3 -1
View File
@@ -41,7 +41,9 @@ namespace fwcompiler {
public:
Preprocessor_pf(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname) : Preprocessor(_db,fwname)
const std::string &fwname,
bool ipv6_policy) :
Preprocessor(_db, fwname, ipv6_policy)
{ }
virtual void convertObject(libfwbuilder::FWObject *obj);
src/pix/NATCompiler_pix.cpp
+2 -1
View File
@@ -54,8 +54,9 @@ string NATCompiler_pix::myPlatformName() { return "pix"; }
NATCompiler_pix::NATCompiler_pix(FWObjectDatabase *_db,
const std::string &fwname,
bool ipv6_policy,
OSConfigurator *_oscnf) :
NATCompiler(_db,fwname,_oscnf) , helper(this)
NATCompiler(_db, fwname, ipv6_policy, _oscnf) , helper(this)
{
}
src/pix/NATCompiler_pix.h
+1
View File
@@ -461,6 +461,7 @@ namespace fwcompiler {
NATCompiler_pix(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf);
virtual int prolog();
src/pix/OSConfigurator_pix_os.h
+3 -2
View File
@@ -60,8 +60,9 @@ namespace fwcompiler {
virtual ~OSConfigurator_pix_os() {};
OSConfigurator_pix_os(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname) :
OSConfigurator(_db,fwname) {}
const std::string &fwname,
bool ipv6_policy) :
OSConfigurator(_db, fwname, ipv6_policy) {}
virtual int prolog();
src/pix/PolicyCompiler_pix.cpp
+2 -1
View File
@@ -66,9 +66,10 @@ string PolicyCompiler_pix::myPlatformName() { return "pix"; }
PolicyCompiler_pix::PolicyCompiler_pix(FWObjectDatabase *_db,
const std::string &fwname,
bool ipv6_policy,
OSConfigurator *_oscnf,
NATCompiler_pix *_natcmp) :
PolicyCompiler_cisco(_db,fwname,_oscnf)
PolicyCompiler_cisco(_db, fwname, ipv6_policy, _oscnf)
{
natcmp=_natcmp;
resetinbound=false;
src/pix/PolicyCompiler_pix.h
+1
View File
@@ -311,6 +311,7 @@ namespace fwcompiler {
PolicyCompiler_pix(libfwbuilder::FWObjectDatabase *_db,
const std::string &fwname,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf,
NATCompiler_pix *_natcmp);
virtual ~PolicyCompiler_pix() {}
src/pix/pix.cpp
+9 -8
View File
@@ -291,7 +291,7 @@ int main(int argc, char * const * argv)
if (only_print_inspection_code)
{
OSConfigurator_pix_os *oscnf=NULL;
oscnf=new OSConfigurator_pix_os(objdb , fwobjectname);
oscnf = new OSConfigurator_pix_os(objdb , fwobjectname, false);
oscnf->prolog();
cout << oscnf->getProtocolInspectionCommands();
@@ -490,14 +490,14 @@ int main(int argc, char * const * argv)
if (user_name==NULL)
throw FWException("Can't figure out your user name, aborting");
Preprocessor* prep=new Preprocessor(objdb , fwobjectname);
Preprocessor* prep=new Preprocessor(objdb , fwobjectname, false);
prep->compile();
/*
* Process firewall options, build OS network configuration script
*/
OSConfigurator *oscnf=NULL;
oscnf=new OSConfigurator_pix_os(objdb , fwobjectname);
oscnf = new OSConfigurator_pix_os(objdb , fwobjectname, false);
oscnf->prolog();
oscnf->processFirewallOptions();
@@ -505,8 +505,8 @@ int main(int argc, char * const * argv)
/* create compilers and run the whole thing */
NATCompiler_pix *n=new NATCompiler_pix( objdb ,
fwobjectname, oscnf );
NATCompiler_pix *n = new NATCompiler_pix( objdb ,
fwobjectname, false, oscnf );
if (test_mode) n->setTestMode();
n->setDebugLevel( dl );
@@ -520,9 +520,10 @@ int main(int argc, char * const * argv)
cout << " Nothing to compile in NAT \n" << flush;
PolicyCompiler_pix *c=new PolicyCompiler_pix( objdb ,
fwobjectname ,
oscnf , n);
PolicyCompiler_pix *c = new PolicyCompiler_pix( objdb ,
fwobjectname ,
false,
oscnf , n);
if (test_mode) c->setTestMode();
c->setDebugLevel( dl );
test/ipt/objects-for-regression-tests.fwb
+9377 -6252
View File
File diff suppressed because it is too large Load Diff