onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-13 00:19:55 +02:00
Code Issues Releases Wiki Activity

merge from v3

Browse Source
This commit is contained in:
Vadim Kurland
2009-06-05 17:15:59 +00:00
parent 532209d501 0815275873
commit 8ed50dc028
13 changed files with 179 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build_num
+1 -1
View File
@@ -1 +1 @@
#define BUILD_NUM 991
#define BUILD_NUM 1036
doc/ChangeLog
+42
View File
@@ -1,3 +1,45 @@
2009-06-05 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printIP): fixed bug
#2801548 "fwb_ipt should issue error for ipsrv with options for
ipv6". Since IP options lsrr, ssrr, rr do not exist in ipv6,
compiler should refuse to compile rules that request matching
these options.
* PolicyCompiler_iosacl_writers.cpp (PrintRule::_printIPServiceOptions):
fixed bug #2801547 "fwb_iosacl should issue an error for ipservice
with options". IOS access lists can not match source routing
options set in IPService object, compiler should issue an error
and abort processing when an object like this is encountered in a
rule.
* IPServiceDialog.cpp (IPServiceDialog::loadFWObject): fixed bug
#2801545 "IP Service object: lsrr, ssrr, rr options not saved".
* PolicyCompiler_pf_writers.cpp (PrintRule::_printDstService):
fixed bug #2801544 "missing space after tos option in pf config"
2009-06-04 vadim <vadim@vk.crocodile.org>
* IPTImporter.cpp (IPTImporter::pushPolicyRule): fixed bug
#2801362 "Iptables policy import does not handle rules with
ESTABLISED". Policy importer for iptables should properly
handle rules that use combination of a "-p protocol" and
match state "RELATED,ESTABLISHED". Example:
-A INBOUND -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
This rule should translate into fwbuilder rule using CustomService
object with code "-m state --state RELATED,ESTABLISHED"
and protocol spec "tcp".
2009-06-03 vadim <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (ObjectManipulator::findWhereUsedRecursively):
fixed bug #2800625 "recursive groups cause infinite loop and crash
in compiler". When a group included itself, compiler used to go
into infinite loop and crash. The fix in this function also takes
care of the situation when group A referenced group B, which in
turn referenced group A again.
2009-06-01 vadim <vadim@vk.crocodile.org>
* newHostDialog.cpp (newHostDialog::selectedInterface): fixed the
src/gui/IPServiceDialog.cpp
+3 -3
View File
@@ -91,9 +91,9 @@ void IPServiceDialog::loadFWObject(FWObject *o)
m_dialog->obj_name->setText( QString::fromUtf8(s->getName().c_str()) );
m_dialog->protocolNum->setValue( s->getProtocolNumber() );
m_dialog->lsrr->setChecked( s->getBool("m_dialog->lsrr") );
m_dialog->ssrr->setChecked( s->getBool("m_dialog->ssrr") );
m_dialog->rr->setChecked( s->getBool("m_dialog->rr") );
m_dialog->lsrr->setChecked( s->getBool("lsrr") );
m_dialog->ssrr->setChecked( s->getBool("ssrr") );
m_dialog->rr->setChecked( s->getBool("rr") );
m_dialog->timestamp->setChecked( s->getBool("ts") );
m_dialog->all_fragments->setChecked( s->getBool("fragm") );
m_dialog->short_fragments->setChecked( s->getBool("short_fragm") );
src/gui/IPTImporter.cpp
+29 -11
View File
@@ -56,6 +56,8 @@
#include "fwbuilder/Policy.h"
#include "fwbuilder/NAT.h"
#include "fwbuilder/RuleElement.h"
#include "fwbuilder/FWServiceReference.h"
#include "fwbuilder/CustomService.h"
using namespace libfwbuilder;
@@ -565,18 +567,34 @@ void IPTImporter::pushPolicyRule()
rule->getSrv()->setNeg(srv_neg);
rule->getItf()->setNeg(intf_neg);
if (rule->getSrc()->isAny() &&
rule->getDst()->isAny() &&
rule->getSrv()->isAny() &&
current_state == "RELATED,ESTABLISHED")
if (current_state == "RELATED,ESTABLISHED")
{
fwopt->setBool("accept_established", true);
skip_rule = true;
*Importer::logger
<< "Using automatic rule controlled by option "
<< "'Accept established,related states' to match "
<< "states RELATED,ESTABLISHED"
<< "\n";
if (rule->getSrc()->isAny() &&
rule->getDst()->isAny() &&
rule->getSrv()->isAny())
{
fwopt->setBool("accept_established", true);
skip_rule = true;
*Importer::logger
<< "Using automatic rule controlled by option "
<< "'Accept established,related states' to match "
<< "states RELATED,ESTABLISHED"
<< "\n";
} else
{
RuleElementSrv *srv = rule->getSrv();
std::string protocol = "";
if (!rule->getSrv()->isAny())
{
Service *srv_obj = Service::cast(FWServiceReference::getObject(
srv->front()));
protocol = srv_obj->getProtocolName();
}
FWObject *established = getCustomService(
"iptables", "-m state --state RELATED,ESTABLISHED", protocol);
srv->clearChildren();
srv->addRef(established);
}
}
if (rule->getSrc()->isAny() &&
src/gui/Importer.cpp
+33
View File
@@ -46,6 +46,7 @@
#include "fwbuilder/ICMPService.h"
#include "fwbuilder/TCPService.h"
#include "fwbuilder/UDPService.h"
#include "fwbuilder/CustomService.h"
#include "fwbuilder/TagService.h"
#include "fwbuilder/Resources.h"
#include "fwbuilder/Policy.h"
@@ -125,6 +126,7 @@ Importer::Importer(FWObject *_lib,
current_interface = NULL;
current_ruleset = NULL;
current_rule = NULL;
custom_service_code_tracker = 0;
tcp_flag_names[libfwbuilder::TCPService::URG]="u";
tcp_flag_names[libfwbuilder::TCPService::ACK]="a";
@@ -494,6 +496,37 @@ Firewall* Importer::finalize()
return fw;
}
FWObject* Importer::getCustomService(const std::string &platform,
const std::string &code,
const std::string &protocol)
{
// this assumes protocol is represented by a number
if (custom_service_codes.count(platform + code)==0)
{
custom_service_codes[platform + code] = custom_service_code_tracker;
custom_service_code_tracker++;
}
std::ostringstream nstr, cstr, sstr;
nstr << "cust-" << custom_service_codes[platform + code] << "-" << protocol;
sstr << "cust-" << custom_service_codes[platform + code] << "-" << protocol;
cstr << "Imported from " << getFirewallObject()->getName() << "\n"
<< "code: " << code << "\n"
<< "protocol: " << protocol;
if (all_objects.count(sstr.str())!=0) return all_objects[sstr.str()];
CustomService *s = CustomService::cast(
createObject(CustomService::TYPENAME, nstr.str()));
if (!protocol.empty()) s->setProtocol(protocol);
s->setCodeForPlatform(platform, code);
s->setComment(cstr.str());
all_objects[sstr.str()] = s;
*logger << "Custom Service object: " << nstr.str() << "\n";
return s;
}
FWObject* Importer::getIPService(int proto)
{
// this assumes protocol is represented by a number
src/gui/Importer.h
+7 -1
View File
@@ -105,7 +105,10 @@ protected:
// map : object signature : object
// use this to quickly find objects to avoid creating duplicates
std::map<const std::string,libfwbuilder::FWObject*> all_objects;
int custom_service_code_tracker;
std::map<const std::string, int> custom_service_codes;
UnidirectionalRuleSet* current_ruleset;
libfwbuilder::Rule* current_rule;
@@ -140,6 +143,9 @@ protected:
// exists, it is created
UnidirectionalRuleSet* getUnidirRuleSet(const std::string &rsname);
virtual libfwbuilder::FWObject* getCustomService(const std::string &platform,
const std::string &code,
const std::string &protocol);
virtual libfwbuilder::FWObject* getIPService(int proto);
virtual libfwbuilder::FWObject* getICMPService(int type, int code);
src/gui/ObjectManipulator.cpp
+11 -6
View File
@@ -3211,11 +3211,19 @@ void ObjectManipulator::findWhereUsedRecursively(FWObject *obj,
obj->getName().c_str(), obj->getTypeName().c_str());
set<FWObject*> resset_tmp;
set<FWObject*> resset_tmp2;
/*
* findWhereObjectIsUsed() finds references to object 'obj' in a subtree
* rooted at object 'top'.
*/
m_project->db()->findWhereObjectIsUsed(obj, top, resset_tmp);
set<FWObject *>::iterator i = resset.begin();
for ( ; i!=resset.end(); ++i)
if (resset_tmp.count(*i)) resset_tmp.erase(*i);
set<FWObject *>::iterator i = resset_tmp.begin();
resset.insert(resset_tmp.begin(), resset_tmp.end());
i = resset_tmp.begin();
for ( ; i!=resset_tmp.end(); ++i)
{
FWObject *parent_obj = *i;
@@ -3226,11 +3234,8 @@ void ObjectManipulator::findWhereUsedRecursively(FWObject *obj,
// add new results to a separate set to avoid modifying the resset_tmp
// in the middle of iteration
if (Group::cast(parent_obj) && !RuleElement::cast(parent_obj))
findWhereUsedRecursively(parent_obj, top, resset_tmp2);
findWhereUsedRecursively(parent_obj, top, resset);
}
resset.insert(resset_tmp.begin(), resset_tmp.end());
resset.insert(resset_tmp2.begin(), resset_tmp2.end());
}
list<Firewall *> ObjectManipulator::findFirewallsForObject(FWObject *o)
src/iosacl/PolicyCompiler_iosacl.h
+1 -2
View File
@@ -195,8 +195,7 @@ namespace fwcompiler {
std::string _printAction(libfwbuilder::PolicyRule *r);
std::string _printACL(libfwbuilder::PolicyRule *r);
std::string _printLog(libfwbuilder::PolicyRule *r);
std::string _printFragm(libfwbuilder::Service *srv);
std::string _printTOS(libfwbuilder::Service *srv);
std::string _printIPServiceOptions(libfwbuilder::PolicyRule *r);
std::string _printRule(libfwbuilder::PolicyRule *rule);
src/iosacl/PolicyCompiler_iosacl_writers.cpp
+11 -12
View File
@@ -275,8 +275,7 @@ string PolicyCompiler_iosacl::PrintRule::_printRule(PolicyRule *rule)
aclstr << _printDstService( compiler->getFirstSrv(rule) );
aclstr << _printLog( rule );
// "fragments" should be the last option in the access-list command
aclstr << _printFragm( compiler->getFirstSrv(rule) );
aclstr << _printTOS( compiler->getFirstSrv(rule) );
aclstr << _printIPServiceOptions(rule);
// aclstr << endl;
@@ -345,20 +344,20 @@ string PolicyCompiler_iosacl::PrintRule::_printSrcService(Service *srv)
return str.str();
}
string PolicyCompiler_iosacl::PrintRule::_printFragm(Service *srv)
{
if (IPService::isA(srv) && (
srv->getBool("fragm") || srv->getBool("short_fragm")))
return "fragments ";
return "";
}
string PolicyCompiler_iosacl::PrintRule::_printTOS(Service *srv)
string PolicyCompiler_iosacl::PrintRule::_printIPServiceOptions(PolicyRule *r)
{
Service *srv = compiler->getFirstSrv(r);
const IPService *ip;
if ((ip=IPService::constcast(srv))!=NULL)
{
if (ip->getBool("lsrr") || ip->getBool("ssrr") || ip->getBool("rr"))
compiler->abort(
string("Source routing options match is not supported. Rule ") +
r->getLabel());
if (srv->getBool("fragm") || srv->getBool("short_fragm"))
return "fragments ";
string tos = ip->getTOSCode();
string dscp = ip->getDSCPCode();
if (!dscp.empty()) return string("dscp ") + dscp;
src/ipt/PolicyCompiler_PrintRule.cpp
+37 -39
View File
@@ -805,49 +805,47 @@ string PolicyCompiler_ipt::PrintRule::_printICMP(ICMPService *srv)
return str.str();
}
string PolicyCompiler_ipt::PrintRule::_printIP(IPService *srv)
string PolicyCompiler_ipt::PrintRule::_printIP(IPService *srv, PolicyRule *rule)
{
PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
std::ostringstream str;
IPService *ip;
if ((ip=IPService::cast(srv))!=NULL)
if (srv->getBool("fragm") || srv->getBool("short_fragm"))
{
if (srv->getBool("fragm") || srv->getBool("short_fragm"))
{
if (ipt_comp->ipv6) str << " -m frag --fragmore";
else str << " -f ";
}
string tos = ip->getTOSCode();
string dscp = ip->getDSCPCode();
if (!tos.empty())
str << " -m tos --tos " << tos;
else
if (!dscp.empty())
{
if (dscp.find("BE")==0 ||
dscp.find("EF")==0 ||
dscp.find("AF")==0 ||
dscp.find("CS")==0)
str << " -m dscp --dscp-class " << dscp;
else
str << " -m dscp --dscp " << dscp;
}
if (!ipt_comp->ipv6)
{
if (srv->getBool("lsrr") ||
srv->getBool("ssrr") ||
srv->getBool("rr") ||
srv->getBool("ts") ) str << " -m ipv4options ";
if (srv->getBool("lsrr")) str << " --lsrr";
if (srv->getBool("ssrr")) str << " --ssrr";
if (srv->getBool("rr")) str << " --rr";
if (srv->getBool("ts")) str << " --ts";
}
if (ipt_comp->ipv6) str << " -m frag --fragmore";
else str << " -f ";
}
string tos = srv->getTOSCode();
string dscp = srv->getDSCPCode();
if (!tos.empty())
str << " -m tos --tos " << tos;
else
if (!dscp.empty())
{
if (dscp.find("BE")==0 ||
dscp.find("EF")==0 ||
dscp.find("AF")==0 ||
dscp.find("CS")==0)
str << " -m dscp --dscp-class " << dscp;
else
str << " -m dscp --dscp " << dscp;
}
if (!ipt_comp->ipv6)
{
if (srv->getBool("lsrr") ||
srv->getBool("ssrr") ||
srv->getBool("rr") ||
srv->getBool("ts") ) str << " -m ipv4options ";
if (srv->getBool("lsrr")) str << " --lsrr";
if (srv->getBool("ssrr")) str << " --ssrr";
if (srv->getBool("rr")) str << " --rr";
if (srv->getBool("ts")) str << " --ts";
} else
compiler->abort(
string("IP options match is not supported for IPv6. Rule ") +
rule->getLabel());
return str.str();
}
@@ -1018,7 +1016,7 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel)
}
if (IPService::isA(srv))
{
string str=_printIP( IPService::cast(srv) );
string str = _printIP(IPService::cast(srv), PolicyRule::cast(rel->getParent()));
if (! str.empty() )
{
ostr << _printSingleObjectNegation(rel)
src/ipt/PolicyCompiler_ipt.h
+2 -1
View File
@@ -890,7 +890,8 @@ namespace fwcompiler {
virtual std::string _printSrcPorts(libfwbuilder::Service *srv);
virtual std::string _printDstPorts(libfwbuilder::Service *srv);
virtual std::string _printICMP(libfwbuilder::ICMPService *srv);
virtual std::string _printIP(libfwbuilder::IPService *srv);
virtual std::string _printIP(libfwbuilder::IPService *srv,
libfwbuilder::PolicyRule *rule);
virtual std::string _printTCPFlags(libfwbuilder::TCPService *srv);
virtual std::string _printSrcAddr(libfwbuilder::RuleElement *rel,
libfwbuilder::Address *o);
src/pflib/PolicyCompiler_pf_writers.cpp
+1 -1
View File
@@ -580,7 +580,7 @@ void PolicyCompiler_pf::PrintRule::_printDstService(RuleElementSrv *rel)
const IPService *ip = IPService::constcast(srv);
string tos = ip->getTOSCode();
string dscp = ip->getDSCPCode();
if (!tos.empty()) compiler->output << " tos " << tos;
if (!tos.empty()) compiler->output << " tos " << tos << " ";
if (!dscp.empty())
compiler->abort("PF does not support DSCP matching");
}
test/pf/objects-for-regression-tests.fwb
+1 -10
View File
@@ -406,15 +406,6 @@
<ObjectRef ref="host-hostB"/>
<ObjectRef ref="id3B022266"/>
<ObjectRef ref="id3B4572AF"/>
<ObjectRef ref="sysid0"/>
<ServiceRef ref="sysid1"/>
<ObjectRef ref="sysid0"/>
<ObjectRef ref="sysid0"/>
<ServiceRef ref="sysid1"/>
<ObjectRef ref="sysid0"/>
<ObjectRef ref="id3B0C63E1"/>
<ObjectRef ref="host-hostA"/>
<ObjectRef ref="sysid0"/>
</Library>
<Library id="syslib001" color="#d2ffd0" name="User" comment="User defined objects" ro="False">
<ObjectGroup id="stdid01_1" name="Objects" comment="" ro="False">
@@ -5302,7 +5293,7 @@
<Option name="use_tables">True</Option>
</FirewallOptions>
</Firewall>
<Firewall id="id3E853CBE" host_OS="freebsd" inactive="False" lastCompiled="1157930825" lastInstalled="0" lastModified="1200415214" platform="pf" version="" name="firewall9" comment="testing rules with broadcasts" ro="False">
<Firewall id="id3E853CBE" host_OS="freebsd" inactive="False" lastCompiled="1244147946" lastInstalled="0" lastModified="1200415214" platform="pf" version="" name="firewall9" comment="testing rules with broadcasts" ro="False">
<NAT id="id3E853CBF" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<NATRule id="id3E853EF8" disabled="True" position="0" comment="">
<OSrc neg="False">