diff --git a/src/cisco_lib/NATCompiler_asa8.cpp b/src/cisco_lib/NATCompiler_asa8.cpp index db87ecc8e..55cc88f5e 100644 --- a/src/cisco_lib/NATCompiler_asa8.cpp +++ b/src/cisco_lib/NATCompiler_asa8.cpp @@ -94,13 +94,13 @@ bool NATCompiler_asa8::VerifyRules::processNext() return true; } - if (rule->getRuleType()==NATRule::NONAT && (!osrv->isAny() || !tsrv->isAny())) - { - compiler->abort( - rule, - "'no nat' rules should have no services"); - return true; - } + // if (rule->getRuleType()==NATRule::NONAT && (!osrv->isAny() || !tsrv->isAny())) + // { + // compiler->abort( + // rule, + // "'no nat' rules should have no services"); + // return true; + // } if (osrc->getNeg() || odst->getNeg() || diff --git a/src/cisco_lib/NATCompiler_asa8_writers.cpp b/src/cisco_lib/NATCompiler_asa8_writers.cpp index 79e64253a..42c235335 100644 --- a/src/cisco_lib/NATCompiler_asa8_writers.cpp +++ b/src/cisco_lib/NATCompiler_asa8_writers.cpp @@ -133,6 +133,7 @@ NATCompiler_asa8::PrintRule::PrintRule(const std::string &name) : void NATCompiler_asa8::PrintRule::printNONAT(libfwbuilder::NATRule *rule) { + printSDNAT(rule); } void NATCompiler_asa8::PrintRule::printSNAT(libfwbuilder::NATRule *rule) @@ -171,11 +172,14 @@ void NATCompiler_asa8::PrintRule::printSDNAT(NATRule *rule) cmd << "source"; - if (!tsrc->isAny()) cmd << "dynamic"; - else cmd << "static"; + if (tsrc->isAny()) cmd << "static"; + else cmd << "dynamic"; cmd << pix_comp->getASA8Object(osrc)->getCommandWord(); - cmd << pix_comp->getASA8Object(tsrc)->getCommandWord(); + if (tsrc->isAny()) + cmd << pix_comp->getASA8Object(osrc)->getCommandWord(); + else + cmd << pix_comp->getASA8Object(tsrc)->getCommandWord(); // only need "destination" part if ODst is not any if (!odst->isAny()) @@ -190,7 +194,7 @@ void NATCompiler_asa8::PrintRule::printSDNAT(NATRule *rule) cmd << pix_comp->getASA8Object(tdst)->getCommandWord(); } - if (!osrv->isAny()) + if (!osrv->isAny() && osrv->getId() != tsrv->getId()) { cmd << "service"; cmd << pix_comp->getASA8Object(osrv)->getCommandWord(); diff --git a/test/pix/firewall92.fw.orig b/test/pix/firewall92.fw.orig new file mode 100755 index 000000000..1c8be4e45 --- /dev/null +++ b/test/pix/firewall92.fw.orig @@ -0,0 +1,156 @@ +! +! This is automatically generated file. DO NOT MODIFY ! +! +! Firewall Builder fwb_pix v4.2.0.3425 +! +! Generated Fri Jan 7 16:37:17 2011 PST by vadim +! +! Compiled for pix 8.3 +! Outbound ACLs: supported +! Emulate outbound ACLs: yes +! Generating outbound ACLs: no +! Assume firewall is part of any: yes +! +!# files: * firewall92.fw +! +! testing new style ASA 8.3 nat commands +! no-nat rules ("identity nat") + + + +! +! Prolog script: +! + +! +! End of prolog script: +! + + + + +interface FastEthernet0 + nameif inside + security-level 100 +exit + +interface FastEthernet1 + nameif outside + security-level 0 +exit + + +no logging buffered +no logging console +no logging timestamp +no logging on + + +timeout xlate 3:0:0 +timeout conn 1:0:0 +timeout udp 0:2:0 +timeout sunrpc 0:10:0 +timeout h323 0:5:0 +timeout sip 0:30:0 +timeout sip_media 0:0:0 +timeout half-closed 0:0:0 +timeout uauth 2:0:0 absolute + + +clear config ssh +aaa authentication ssh console LOCAL + +clear config snmp-server +no snmp-server enable traps + +clear config ntp + + +no service resetinbound +no service resetoutside +no sysopt connection timewait +no sysopt nodnsalias inbound +no sysopt nodnsalias outbound + + +class-map inspection_default + match default-inspection-traffic + +policy-map global_policy + class inspection_default + +service-policy global_policy global + +policy-map type inspect ip-options ip-options-map +parameters + eool action allow + router-alert action clear + + +!################ +clear config access-list +clear config object-group +clear config icmp +clear config telnet +! +! Rule 0 (global) +access-list inside_acl_in deny ip any any +access-list outside_acl_in deny ip any any + + +access-group inside_acl_in in interface inside +access-group outside_acl_in in interface outside + +clear xlate +clear config nat +clear config object + +object network Internal_net + subnet 192.168.1.0 255.255.255.0 +quit +object service http + service tcp destination eq 80 +quit +object network hostA:eth0 + host 192.168.1.10 +quit +object service smtp + service tcp destination eq 25 +quit +object network spamhost1 + host 61.150.47.112 +quit +object network internal_subnet_1 + subnet 192.168.1.0 255.255.255.192 +quit +object network internal_subnet_2 + subnet 192.168.1.64 255.255.255.192 +quit +object network test_range_1 + range 192.168.1.11 192.168.1.15 +quit +! +! Rule 0 (NAT) +nat (inside,outside) source static Internal_net Internal_net +! +! Rule 1 (NAT) +nat (inside,outside) source static hostA:eth0 hostA:eth0 +! +! Rule 2 (NAT) +nat (inside,outside) source static hostA:eth0 hostA:eth0 destination static spamhost1 spamhost1 +! +! Rule 3 (NAT) +nat (inside,outside) source static internal_subnet_1 internal_subnet_1 +nat (inside,outside) source static internal_subnet_2 internal_subnet_2 +! +! Rule 4 (NAT) +nat (inside,outside) source static test_range_1 test_range_1 destination static spamhost1 spamhost1 + + + +! +! Epilog script: +! + +! End of epilog script: +! diff --git a/test/pix/objects-for-regression-tests.fwb b/test/pix/objects-for-regression-tests.fwb index 517756fdc..899e389bf 100644 --- a/test/pix/objects-for-regression-tests.fwb +++ b/test/pix/objects-for-regression-tests.fwb @@ -1,6 +1,6 @@ - + @@ -18228,7 +18228,7 @@ no sysopt nodnsalias outbound - + @@ -18336,7 +18336,7 @@ no sysopt nodnsalias outbound - + @@ -18866,6 +18866,315 @@ no sysopt nodnsalias outbound + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +