onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-11 15:41:41 +02:00
Code Issues Releases Wiki Activity

using "-m frag" and "-m icmp6" for ipv6 for iptables

Browse Source
This commit is contained in:
Vadim Kurland
2008-06-26 21:13:20 +00:00
parent 5eda03ebf0
commit 91dbc67bec
2 changed files with 42 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/ChangeLog
+11
View File
@@ -1,6 +1,17 @@
2008-06-26 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printIP): using
"-m frag --fragmore" for IPService objects that should match ip
fragments.
* PolicyCompiler_PrintRule.cpp (PrintRule::_printDstService):
compiler uses "--icmpv6-type" and "-m icmp6" options while
generating ipv6 script.
2008-06-10 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printTimeInterval):
support for the "new" time module for iptables
2008-06-08 Vadim Kurland <vadim@vk.crocodile.org>
src/ipt/PolicyCompiler_PrintRule.cpp
+20 -6
View File
@@ -608,7 +608,8 @@ string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv)
{
if (ipt_comp->newIptables(version))
{
s += " -m icmp ";
if (ipt_comp->ipv6) s += " -m icmp6";
else s += " -m icmp ";
}
} else
{
@@ -662,7 +663,8 @@ string PolicyCompiler_ipt::PrintRule::_printDstPorts(Service *srv)
string PolicyCompiler_ipt::PrintRule::_printICMP(ICMPService *srv)
{
std::ostringstream str;
if (ICMPService::isA(srv) && srv->getInt("type")!=-1) {
if (ICMPService::isA(srv) && srv->getInt("type")!=-1)
{
str << srv->getStr("type");
if (srv->getInt("code")!=-1)
str << "/" << srv->getStr("code") << " ";
@@ -672,11 +674,18 @@ string PolicyCompiler_ipt::PrintRule::_printICMP(ICMPService *srv)
string PolicyCompiler_ipt::PrintRule::_printIP(IPService *srv)
{
PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
std::ostringstream str;
if (IPService::isA(srv) ) {
if (IPService::isA(srv) )
{
if (srv->getBool("fragm") || srv->getBool("short_fragm"))
str << " -f ";
{
if (ipt_comp->ipv6) str << " -m frag --fragmore";
else str << " -f ";
}
if (!ipt_comp->ipv6)
{
if (srv->getBool("lsrr") ||
srv->getBool("ssrr") ||
srv->getBool("rr") ||
@@ -687,6 +696,7 @@ string PolicyCompiler_ipt::PrintRule::_printIP(IPService *srv)
if (srv->getBool("rr")) str << " --rr";
if (srv->getBool("ts")) str << " --ts";
}
}
return str.str();
}
@@ -832,14 +842,18 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel)
}
if (ICMPService::isA(srv))
{
string icmp_type_str =
(ipt_comp->ipv6) ? " --icmpv6-type" : " --icmp-type";
string str = _printICMP( ICMPService::cast(srv) );
if (str.empty() )
{
if (ipt_comp->newIptables(version))
ostr << " --icmp-type any ";
ostr << icmp_type_str << " any ";
} else
{
ostr << " --icmp-type "
ostr << icmp_type_str
<< " "
<< _printSingleObjectNegation(rel)
<< str << " ";
}