diff --git a/doc/ChangeLog b/doc/ChangeLog index 6a82046fa..544f2a137 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,11 +1,22 @@ +2008-06-26 Vadim Kurland + + * PolicyCompiler_PrintRule.cpp (PrintRule::_printIP): using + "-m frag --fragmore" for IPService objects that should match ip + fragments. + + * PolicyCompiler_PrintRule.cpp (PrintRule::_printDstService): + compiler uses "--icmpv6-type" and "-m icmp6" options while + generating ipv6 script. + 2008-06-10 Vadim Kurland - * PolicyCompiler_PrintRule.cpp (PrintRule::_printTimeInterval): + * PolicyCompiler_PrintRule.cpp (PrintRule::_printTimeInterval): + support for the "new" time module for iptables 2008-06-08 Vadim Kurland * merged branch "id-experiment" r233:HEAD - + 2008-06-07 Vadim Kurland * main.cpp (main): support for integer object ids diff --git a/src/ipt/PolicyCompiler_PrintRule.cpp b/src/ipt/PolicyCompiler_PrintRule.cpp index d2af523be..a67410118 100644 --- a/src/ipt/PolicyCompiler_PrintRule.cpp +++ b/src/ipt/PolicyCompiler_PrintRule.cpp @@ -608,7 +608,8 @@ string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv) { if (ipt_comp->newIptables(version)) { - s += " -m icmp "; + if (ipt_comp->ipv6) s += " -m icmp6"; + else s += " -m icmp "; } } else { @@ -662,7 +663,8 @@ string PolicyCompiler_ipt::PrintRule::_printDstPorts(Service *srv) string PolicyCompiler_ipt::PrintRule::_printICMP(ICMPService *srv) { std::ostringstream str; - if (ICMPService::isA(srv) && srv->getInt("type")!=-1) { + if (ICMPService::isA(srv) && srv->getInt("type")!=-1) + { str << srv->getStr("type"); if (srv->getInt("code")!=-1) str << "/" << srv->getStr("code") << " "; @@ -672,20 +674,28 @@ string PolicyCompiler_ipt::PrintRule::_printICMP(ICMPService *srv) string PolicyCompiler_ipt::PrintRule::_printIP(IPService *srv) { + PolicyCompiler_ipt *ipt_comp=dynamic_cast(compiler); std::ostringstream str; - if (IPService::isA(srv) ) { + if (IPService::isA(srv) ) + { if (srv->getBool("fragm") || srv->getBool("short_fragm")) - str << " -f "; + { + if (ipt_comp->ipv6) str << " -m frag --fragmore"; + else str << " -f "; + } - if (srv->getBool("lsrr") || - srv->getBool("ssrr") || - srv->getBool("rr") || - srv->getBool("ts") ) str << " -m ipv4options "; + if (!ipt_comp->ipv6) + { + if (srv->getBool("lsrr") || + srv->getBool("ssrr") || + srv->getBool("rr") || + srv->getBool("ts") ) str << " -m ipv4options "; - if (srv->getBool("lsrr")) str << " --lsrr"; - if (srv->getBool("ssrr")) str << " --ssrr"; - if (srv->getBool("rr")) str << " --rr"; - if (srv->getBool("ts")) str << " --ts"; + if (srv->getBool("lsrr")) str << " --lsrr"; + if (srv->getBool("ssrr")) str << " --ssrr"; + if (srv->getBool("rr")) str << " --rr"; + if (srv->getBool("ts")) str << " --ts"; + } } return str.str(); } @@ -832,14 +842,18 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel) } if (ICMPService::isA(srv)) { - string str=_printICMP( ICMPService::cast(srv) ); + string icmp_type_str = + (ipt_comp->ipv6) ? " --icmpv6-type" : " --icmp-type"; + + string str = _printICMP( ICMPService::cast(srv) ); if (str.empty() ) { if (ipt_comp->newIptables(version)) - ostr << " --icmp-type any "; + ostr << icmp_type_str << " any "; } else { - ostr << " --icmp-type " + ostr << icmp_type_str + << " " << _printSingleObjectNegation(rel) << str << " "; }