From 926db9b942c94b9774133b1362d67172ebb63dab Mon Sep 17 00:00:00 2001 From: Vadim Kurland Date: Sun, 20 Feb 2011 16:11:29 -0800 Subject: [PATCH] see #153 deprecating getInterfaceStr: eliminated use of this function in policy compiler for PIX and IOS ACL --- VERSION | 2 +- VERSION.h | 2 +- packaging/fwbuilder-static-qt.spec | 2 +- packaging/fwbuilder.control | 2 +- packaging/fwbuilder.spec | 2 +- .../NamedObjectsAndGroupsSupport.cpp | 4 - src/cisco_lib/PolicyCompiler_cisco.cpp | 51 ++- src/cisco_lib/PolicyCompiler_cisco_acls.cpp | 78 +++- ...olicyCompiler_pix_replace_translations.cpp | 21 +- src/cisco_lib/PolicyCompiler_pix_v6_acls.cpp | 88 ++-- src/cisco_lib/PolicyCompiler_pix_writers.cpp | 23 +- .../objects-for-regression-tests.fwb | 410 +++++++++--------- 12 files changed, 389 insertions(+), 296 deletions(-) diff --git a/VERSION b/VERSION index 09c385d3c..7e3377ed5 100644 --- a/VERSION +++ b/VERSION @@ -7,7 +7,7 @@ FWB_MICRO_VERSION=0 # build number is like "nano" version number. I am incrementing build # number during development cycle # -BUILD_NUM="3482" +BUILD_NUM="3483" VERSION="$FWB_MAJOR_VERSION.$FWB_MINOR_VERSION.$FWB_MICRO_VERSION.$BUILD_NUM" diff --git a/VERSION.h b/VERSION.h index fdb07871c..b02513eb0 100644 --- a/VERSION.h +++ b/VERSION.h @@ -1,2 +1,2 @@ -#define VERSION "4.2.0.3482" +#define VERSION "4.2.0.3483" #define GENERATION "4.2" diff --git a/packaging/fwbuilder-static-qt.spec b/packaging/fwbuilder-static-qt.spec index 250c6d12c..87b343665 100644 --- a/packaging/fwbuilder-static-qt.spec +++ b/packaging/fwbuilder-static-qt.spec @@ -3,7 +3,7 @@ %define name fwbuilder -%define version 4.2.0.3482 +%define version 4.2.0.3483 %define release 1 %if "%_vendor" == "MandrakeSoft" diff --git a/packaging/fwbuilder.control b/packaging/fwbuilder.control index edabe6024..56f9cdbf3 100644 --- a/packaging/fwbuilder.control +++ b/packaging/fwbuilder.control @@ -4,6 +4,6 @@ Replaces: fwbuilder (<=4.1.1-1), fwbuilder-common, fwbuilder-bsd, fwbuilder-linu Priority: extra Section: checkinstall Maintainer: vadim@fwbuilder.org -Version: 4.2.0.3482-1 +Version: 4.2.0.3483-1 Depends: libqt4-gui (>= 4.3.0), libxml2, libxslt1.1, libsnmp | libsnmp15 Description: Firewall Builder GUI and policy compilers diff --git a/packaging/fwbuilder.spec b/packaging/fwbuilder.spec index e9ac21b4d..289676041 100644 --- a/packaging/fwbuilder.spec +++ b/packaging/fwbuilder.spec @@ -1,6 +1,6 @@ %define name fwbuilder -%define version 4.2.0.3482 +%define version 4.2.0.3483 %define release 1 %if "%_vendor" == "MandrakeSoft" diff --git a/src/cisco_lib/NamedObjectsAndGroupsSupport.cpp b/src/cisco_lib/NamedObjectsAndGroupsSupport.cpp index 5a8edb521..adc82f1c8 100644 --- a/src/cisco_lib/NamedObjectsAndGroupsSupport.cpp +++ b/src/cisco_lib/NamedObjectsAndGroupsSupport.cpp @@ -106,10 +106,6 @@ bool CreateObjectGroups::processNext() string version = compiler->fw->getStr("version"); string platform = compiler->fw->getStr("platform"); - // Interface *rule_iface = Interface::cast(compiler->dbcopy->findInIndex( - // rule->getInterfaceId())); - //assert(rule_iface); - RuleElement *re = RuleElement::cast(rule->getFirstByType(re_type)); if (re->size()==1) diff --git a/src/cisco_lib/PolicyCompiler_cisco.cpp b/src/cisco_lib/PolicyCompiler_cisco.cpp index bcd46e1eb..42c81e78e 100644 --- a/src/cisco_lib/PolicyCompiler_cisco.cpp +++ b/src/cisco_lib/PolicyCompiler_cisco.cpp @@ -131,15 +131,18 @@ string PolicyCompiler_cisco::debugPrintRule(Rule *r) { ostringstream str; PolicyRule *rule = PolicyRule::cast(r); - FWObject *rule_iface = dbcopy->findInIndex(rule->getInterfaceId()); - string iname = (rule_iface!=NULL)?rule_iface->getName():""; + +// FWObject *rule_iface = dbcopy->findInIndex(rule->getInterfaceId()); +// string iname = (rule_iface!=NULL)?rule_iface->getName():""; string dir = rule->getDirectionAsString(); str << PolicyCompiler::debugPrintRule(rule) << - " " << dir << " " << iname << " " << rule->getStr("acl") << - " intfId=" << rule->getInterfaceId() << - " intfstr=" << rule->getInterfaceStr(); + " " << dir +// << " " << iname + << " " << rule->getStr("acl"); +// " intfId=" << rule->getInterfaceId() << +// " intfstr=" << rule->getInterfaceStr(); return str.str(); } @@ -449,15 +452,16 @@ bool PolicyCompiler_cisco::specialCaseWithDynInterface::dropDynamicInterface( PolicyRule *rule, PolicyRule::Direction cmp_dir, RuleElement *re) { PolicyRule::Direction dir=rule->getDirection(); - FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); +// FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); + + RuleElementItf *intf_re = rule->getItf(); + FWObject *rule_iface = FWObjectReference::getObject(intf_re->front()); list cl; for (list::iterator i1=re->begin(); i1!=re->end(); ++i1) { - FWObject *o = *i1; - FWObject *obj = o; - if (FWReference::cast(o)!=NULL) obj=FWReference::cast(o)->getPointer(); - Interface *ifs =Interface::cast( obj ); + FWObject *obj = FWObjectReference::getObject(*i1); + Interface *ifs = Interface::cast( obj ); if (ifs!=NULL && ifs->isDyn()) { @@ -585,11 +589,14 @@ bool PolicyCompiler_cisco::tcpServiceToFW::processNext() bool PolicyCompiler_cisco::replaceFWinSRCInterfacePolicy::processNext() { PolicyRule *rule=getNext(); if (rule==NULL) return false; - FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); +// FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); + RuleElementItf *intf_re = rule->getItf(); + Interface *rule_iface = Interface::cast( + FWObjectReference::getObject(intf_re->front())); - if (rule_iface!=NULL && rule->getDirection()==PolicyRule::Outbound) + if ( rule_iface!=NULL && rule->getDirection()==PolicyRule::Outbound) { - RuleElementSrc *src=rule->getSrc(); + RuleElementSrc *src = rule->getSrc(); if (compiler->getFirstSrc(rule)->getId()==compiler->fw->getId()) { @@ -605,11 +612,14 @@ bool PolicyCompiler_cisco::replaceFWinSRCInterfacePolicy::processNext() bool PolicyCompiler_cisco::replaceFWinDSTInterfacePolicy::processNext() { PolicyRule *rule=getNext(); if (rule==NULL) return false; - FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); +// FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); + RuleElementItf *intf_re = rule->getItf(); + Interface *rule_iface = Interface::cast( + FWObjectReference::getObject(intf_re->front())); - if (rule_iface!=NULL && rule->getDirection()==PolicyRule::Inbound) + if ( rule_iface!=NULL && rule->getDirection()==PolicyRule::Inbound) { - RuleElementDst *dst=rule->getDst(); + RuleElementDst *dst = rule->getDst(); if (compiler->getFirstDst(rule)->getId()==compiler->fw->getId()) { @@ -630,12 +640,13 @@ bool PolicyCompiler_cisco::replaceFWinDSTPolicy::processNext() { Helper helper(compiler); PolicyRule *rule=getNext(); if (rule==NULL) return false; - FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); +// FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); + RuleElementItf *intf_re = rule->getItf(); - if (rule_iface==NULL) + if (intf_re->isAny()) { - RuleElementSrc *src=rule->getSrc(); - RuleElementDst *dst=rule->getDst(); + RuleElementSrc *src = rule->getSrc(); + RuleElementDst *dst = rule->getDst(); if (!src->isAny() && compiler->getFirstDst(rule)->getId()==compiler->fw->getId()) { diff --git a/src/cisco_lib/PolicyCompiler_cisco_acls.cpp b/src/cisco_lib/PolicyCompiler_cisco_acls.cpp index 2a2f6dbed..a1dc61a56 100644 --- a/src/cisco_lib/PolicyCompiler_cisco_acls.cpp +++ b/src/cisco_lib/PolicyCompiler_cisco_acls.cpp @@ -75,13 +75,18 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionBySrc::processNext() list intf_id_list; - if (rule->getInterfaceId() == -1) + RuleElementItf *intf_re = rule->getItf(); + + if (intf_re->isAny()) { - bool cluster_member = compiler->fw->getOptionsObject()->getBool("cluster_member"); + bool cluster_member = + compiler->fw->getOptionsObject()->getBool("cluster_member"); + Cluster *cluster = NULL; if (cluster_member) cluster = Cluster::cast( - compiler->dbcopy->findInIndex(compiler->fw->getInt("parent_cluster_id"))); + compiler->dbcopy->findInIndex( + compiler->fw->getInt("parent_cluster_id"))); RuleElementSrc *srcre = rule->getSrc(); RuleElementDst *dstre = rule->getDst(); @@ -108,7 +113,12 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionBySrc::processNext() PolicyRule *new_rule = compiler->dbcopy->createPolicyRule(); compiler->temp_ruleset->add(new_rule); new_rule->duplicate(rule); - new_rule->setInterfaceId(intf_id); +// new_rule->setInterfaceId(intf_id); + + RuleElementItf *itf_re = new_rule->getItf(); assert(itf_re!=NULL); + itf_re->reset(); + itf_re->addRef(ifs); + new_rule->setDirection(PolicyRule::Inbound); new_rule->setBool("interface_and_direction_set_from_src",true); tmp_queue.push_back(new_rule); @@ -144,15 +154,20 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionByDst::processNext() return true; } + RuleElementItf *intf_re = rule->getItf(); + list intf_id_list; - if (rule->getInterfaceId() == -1) + if (intf_re->isAny()) { - bool cluster_member = compiler->fw->getOptionsObject()->getBool("cluster_member"); + bool cluster_member = + compiler->fw->getOptionsObject()->getBool("cluster_member"); + Cluster *cluster = NULL; if (cluster_member) cluster = Cluster::cast( - compiler->dbcopy->findInIndex(compiler->fw->getInt("parent_cluster_id"))); + compiler->dbcopy->findInIndex( + compiler->fw->getInt("parent_cluster_id"))); RuleElementDst *dstre = rule->getDst(); Address *dstobj = compiler->getFirstDst(rule); @@ -178,7 +193,13 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionByDst::processNext() PolicyRule *new_rule = compiler->dbcopy->createPolicyRule(); compiler->temp_ruleset->add(new_rule); new_rule->duplicate(rule); - new_rule->setInterfaceId(intf_id); + +// new_rule->setInterfaceId(intf_id); + + RuleElementItf *itf_re = new_rule->getItf(); assert(itf_re!=NULL); + itf_re->reset(); + itf_re->addRef(ifs); + new_rule->setDirection(PolicyRule::Outbound); new_rule->setBool("interface_and_direction_set_from_dst",true); tmp_queue.push_back(new_rule); @@ -195,7 +216,9 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionIfInterfaceSet::processNext() //RuleElementItf *itfre=rule->getItf(); - if (rule->getInterfaceId() == -1 || + RuleElementItf *intf_re = rule->getItf(); + + if (intf_re->isAny() || rule->getBool("interface_and_direction_set_from_src") || rule->getBool("interface_and_direction_set_from_dst")) { @@ -205,16 +228,22 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionIfInterfaceSet::processNext() PolicyRule *new_rule; - if ( rule->getInterfaceId() > -1 ) + if ( ! intf_re->isAny()) { - int rule_iface_id = rule->getInterfaceId(); + FWObject *rule_iface = FWObjectReference::getObject(intf_re->front()); + RuleElementItf *itf_re; if (rule->getDirection()==PolicyRule::Both) { new_rule =compiler->dbcopy->createPolicyRule(); compiler->temp_ruleset->add(new_rule); new_rule->duplicate(rule); - new_rule->setInterfaceId( rule_iface_id ); + +// new_rule->setInterfaceId( rule_iface_id ); + itf_re = new_rule->getItf(); assert(itf_re!=NULL); + itf_re->reset(); + itf_re->addRef(rule_iface); + new_rule->setDirection(PolicyRule::Inbound); new_rule->setBool("interface_and_direction_set",true); tmp_queue.push_back(new_rule); @@ -222,7 +251,12 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionIfInterfaceSet::processNext() new_rule =compiler->dbcopy->createPolicyRule(); compiler->temp_ruleset->add(new_rule); new_rule->duplicate(rule); - new_rule->setInterfaceId( rule_iface_id ); + +// new_rule->setInterfaceId( rule_iface_id ); + itf_re = new_rule->getItf(); assert(itf_re!=NULL); + itf_re->reset(); + itf_re->addRef(rule_iface); + new_rule->setDirection(PolicyRule::Outbound); new_rule->setBool("interface_and_direction_set",true); tmp_queue.push_back(new_rule); @@ -231,7 +265,12 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionIfInterfaceSet::processNext() new_rule =compiler->dbcopy->createPolicyRule(); compiler->temp_ruleset->add(new_rule); new_rule->duplicate(rule); - new_rule->setInterfaceId( rule_iface_id ); + +// new_rule->setInterfaceId( rule_iface_id ); + itf_re = new_rule->getItf(); assert(itf_re!=NULL); + itf_re->reset(); + itf_re->addRef(rule_iface); + // direction is copied from the original rule new_rule->setBool("interface_and_direction_set",true); tmp_queue.push_back(new_rule); @@ -244,10 +283,15 @@ bool PolicyCompiler_cisco::pickACL::processNext() { PolicyCompiler_cisco *cisco_comp = dynamic_cast( compiler); - PolicyRule *rule=getNext(); if (rule==NULL) return false; + PolicyRule *rule = getNext(); if (rule==NULL) return false; - Interface *rule_iface = Interface::cast(compiler->dbcopy->findInIndex( - rule->getInterfaceId())); +// Interface *rule_iface = Interface::cast(compiler->dbcopy->findInIndex( +// rule->getInterfaceId())); + + RuleElementItf *intf_re = rule->getItf(); + Interface *rule_iface = Interface::cast( + FWObjectReference::getObject(intf_re->front())); + if(rule_iface==NULL) { compiler->abort(rule, "Missing interface assignment"); diff --git a/src/cisco_lib/PolicyCompiler_pix_replace_translations.cpp b/src/cisco_lib/PolicyCompiler_pix_replace_translations.cpp index c5e5e3a04..18b8fbf24 100644 --- a/src/cisco_lib/PolicyCompiler_pix_replace_translations.cpp +++ b/src/cisco_lib/PolicyCompiler_pix_replace_translations.cpp @@ -48,11 +48,6 @@ bool PolicyCompiler_pix::matchTranslatedAddresses::processNext() transformed_rules.clear(); -// string rule_iface_id=rule->getInterfaceId(); - -// Address *src=compiler->getFirstSrc(rule); -// Service *srv=compiler->getFirstSrv(rule); - RuleElementSrc *srcrel = rule->getSrc(); RuleElementDst *dstrel = rule->getDst(); RuleElementSrv *srvrel = rule->getSrv(); @@ -132,8 +127,12 @@ void PolicyCompiler_pix::replaceTranslatedAddresses::action( PolicyRule* policy_rule, NATRule* nat_rule, Address *src, Address*, Service *srv) { - FWObject *rule_iface = compiler->dbcopy->findInIndex( - policy_rule->getInterfaceId()); + +// FWObject *rule_iface = compiler->dbcopy->findInIndex( +// policy_rule->getInterfaceId()); + + RuleElementItf *intf_re = policy_rule->getItf(); + FWObject *rule_iface = FWObjectReference::getObject(intf_re->front()); RuleElement *re = nat_rule->getOSrc(); FWObject *o = FWReference::getObject(re->front()); @@ -204,8 +203,12 @@ void PolicyCompiler_pix::warnWhenTranslatedAddressesAreUsed::action( PolicyRule* policy_rule, NATRule* nat_rule, Address*, Address *dst, Service*) { - FWObject *rule_iface = compiler->dbcopy->findInIndex( - policy_rule->getInterfaceId()); +// FWObject *rule_iface = compiler->dbcopy->findInIndex( +// policy_rule->getInterfaceId()); + + RuleElementItf *intf_re = policy_rule->getItf(); + FWObject *rule_iface = FWObjectReference::getObject(intf_re->front()); + string version = compiler->fw->getStr("version"); RuleElement *re; diff --git a/src/cisco_lib/PolicyCompiler_pix_v6_acls.cpp b/src/cisco_lib/PolicyCompiler_pix_v6_acls.cpp index 13c8af9c6..a30d30862 100644 --- a/src/cisco_lib/PolicyCompiler_pix_v6_acls.cpp +++ b/src/cisco_lib/PolicyCompiler_pix_v6_acls.cpp @@ -67,24 +67,26 @@ using namespace libfwbuilder; using namespace fwcompiler; using namespace std; + bool PolicyCompiler_pix::InterfaceAndDirection_v6::processNext() { - PolicyRule *rule=getNext(); if (rule==NULL) return false; + PolicyRule *rule = getNext(); if (rule==NULL) return false; tmp_queue.push_back(rule); bool icmp_cmd = rule->getBool("icmp_cmd"); bool ssh_telnet_cmd = rule->getBool("ssh_telnet_cmd"); - int interface_id = rule->getInterfaceId(); +// int interface_id = rule->getInterfaceId(); + RuleElementItf *intf_re = rule->getItf(); if (rule->getDirection()==PolicyRule::Undefined) rule->setDirection( PolicyRule::Both ); - if (interface_id==-1 && rule->getDirection()==PolicyRule::Both) + if (intf_re->isAny() && rule->getDirection()==PolicyRule::Both) return true; - if (interface_id==-1 && !icmp_cmd && !ssh_telnet_cmd && ( + if (intf_re->isAny() && !icmp_cmd && !ssh_telnet_cmd && ( rule->getDirection()==PolicyRule::Inbound || rule->getDirection()==PolicyRule::Outbound) ) compiler->abort(rule, "Direction set without interface"); @@ -106,12 +108,13 @@ bool PolicyCompiler_pix::InterfaceAndDirection_v6::processNext() */ bool PolicyCompiler_pix::SplitDirection_v6::processNext() { - PolicyRule *rule=getNext(); if (rule==NULL) return false; - FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); + PolicyRule *rule = getNext(); if (rule==NULL) return false; +// FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); + RuleElementItf *intf_re = rule->getItf(); if (rule->getDirection()==PolicyRule::Both) { - if (rule_iface!=NULL) + if ( ! intf_re->isAny()) { PolicyRule *r= compiler->dbcopy->createPolicyRule(); compiler->temp_ruleset->add(r); @@ -176,9 +179,11 @@ bool PolicyCompiler_pix::EmulateOutboundACL_v6::processNext() { Helper helper(compiler); PolicyRule *rule = getNext(); if (rule==NULL) return false; - FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); +// FWObject *rule_iface = compiler->dbcopy->findInIndex(rule->getInterfaceId()); + RuleElementItf *intf_re = rule->getItf(); + FWObject *rule_iface = FWObjectReference::getObject(intf_re->front()); - if (rule->getDirection()==PolicyRule::Outbound && rule_iface!=NULL) + if (rule->getDirection()==PolicyRule::Outbound && ! intf_re->isAny()) { if ( compiler->fw->getOptionsObject()->getBool("pix_emulate_out_acl") ) { @@ -196,7 +201,7 @@ bool PolicyCompiler_pix::EmulateOutboundACL_v6::processNext() * network zone is the same as the one this rule is assigned to, but * direction is Outbound - drop this rule */ - if (iface1_id==rule->getInterfaceId()) + if (iface1_id == rule_iface->getId()) { compiler->warning(rule, "Rule with direction 'Outbound' was suppressed " @@ -206,7 +211,10 @@ bool PolicyCompiler_pix::EmulateOutboundACL_v6::processNext() return true; } - rule->setInterfaceId(iface1_id); +// rule->setInterfaceId(iface1_id); + intf_re->reset(); + intf_re->addRef(compiler->dbcopy->findInIndex(iface1_id)); + rule->setDirection(PolicyRule::Inbound); tmp_queue.push_back(rule); } else @@ -215,16 +223,21 @@ bool PolicyCompiler_pix::EmulateOutboundACL_v6::processNext() iface2_id = helper.findInterfaceByNetzone( compiler->getFirstDst(rule) ); - list l2=compiler->fw->getByType(Interface::TYPENAME); + list l2 = compiler->fw->getByTypeDeep( + Interface::TYPENAME); for (list::iterator i=l2.begin(); i!=l2.end(); ++i) { if ( (*i)->getId()==iface2_id ) continue; - PolicyRule *r= compiler->dbcopy->createPolicyRule(); + PolicyRule *r = compiler->dbcopy->createPolicyRule(); compiler->temp_ruleset->add(r); r->duplicate(rule); - r->setInterfaceId((*i)->getId()); +// r->setInterfaceId((*i)->getId()); + RuleElementItf *itf_re = r->getItf(); assert(itf_re!=NULL); + itf_re->reset(); + itf_re->addRef(*i); + rule->setDirection(PolicyRule::Inbound); tmp_queue.push_back(r); @@ -283,21 +296,27 @@ bool PolicyCompiler_pix::EmulateOutboundACL_v6::processNext() */ bool PolicyCompiler_pix::assignRuleToInterface_v6::processNext() { - PolicyRule *rule=getNext(); if (rule==NULL) return false; + PolicyRule *rule = getNext(); if (rule==NULL) return false; Helper helper(compiler); - RuleElementSrc *src=rule->getSrc(); assert(src); - RuleElementDst *dst=rule->getDst(); assert(dst); + RuleElementSrc *src = rule->getSrc(); assert(src); + RuleElementDst *dst = rule->getDst(); assert(dst); - if (rule->getInterfaceId()==-1) + RuleElementItf *intf_re = rule->getItf(); +// FWObject *rule_iface = FWObjectReference::getObject(intf_re->front()); + + if (intf_re->isAny()) { try { if (! src->isAny() ) { - Address *a=compiler->getFirstSrc(rule); + Address *a = compiler->getFirstSrc(rule); int iface1_id = helper.findInterfaceByNetzone(a); - rule->setInterfaceId(iface1_id); +// rule->setInterfaceId(iface1_id); + intf_re->reset(); + intf_re->addRef(compiler->dbcopy->findInIndex(iface1_id)); + tmp_queue.push_back(rule); } else { @@ -305,7 +324,10 @@ bool PolicyCompiler_pix::assignRuleToInterface_v6::processNext() if ( ! dst->isAny() && compiler->complexMatch(a,compiler->fw)) { int iface2_id = helper.findInterfaceByNetzone( a ); - rule->setInterfaceId(iface2_id); +// rule->setInterfaceId(iface2_id); + intf_re->reset(); + intf_re->addRef(compiler->dbcopy->findInIndex(iface2_id)); + rule->setStr("direction","Inbound"); tmp_queue.push_back(rule); return true; @@ -316,13 +338,18 @@ bool PolicyCompiler_pix::assignRuleToInterface_v6::processNext() { Interface *intf = Interface::cast(*i); if (intf->isUnprotected()) continue; - if (intf->getOptionsObject()->getBool("cluster_interface")) continue; + if (intf->getOptionsObject()->getBool("cluster_interface")) + continue; PolicyRule *r = compiler->dbcopy->createPolicyRule(); compiler->temp_ruleset->add(r); r->duplicate(rule); - r->setInterfaceId(intf->getId()); +// r->setInterfaceId(intf->getId()); + RuleElementItf *itf_re = r->getItf(); assert(itf_re!=NULL); + itf_re->reset(); + itf_re->addRef(intf); + r->setStr("direction","Inbound"); tmp_queue.push_back(r); @@ -351,13 +378,18 @@ bool PolicyCompiler_pix::assignRuleToInterface_v6::processNext() */ bool PolicyCompiler_pix::pickACL_v6::processNext() { - PolicyCompiler_pix *pix_comp=dynamic_cast(compiler); - PolicyRule *rule=getNext(); if (rule==NULL) return false; - Interface *rule_iface = Interface::cast(compiler->dbcopy->findInIndex(rule->getInterfaceId())); - if(rule_iface==NULL) + PolicyCompiler_pix *pix_comp = dynamic_cast(compiler); + PolicyRule *rule = getNext(); if (rule==NULL) return false; +// Interface *rule_iface = Interface::cast(compiler->dbcopy->findInIndex(rule->getInterfaceId())); + + RuleElementItf *intf_re = rule->getItf(); + Interface *rule_iface = Interface::cast( + FWObjectReference::getObject(intf_re->front())); + + if (intf_re->isAny() || rule_iface==NULL) compiler->abort(rule, "Missing interface assignment"); - string acl_name= rule_iface->getLabel() + "_acl_in"; + string acl_name = rule_iface->getLabel() + "_acl_in"; rule->setStr("acl", acl_name); ciscoACL *acl = new ciscoACL(acl_name, rule_iface, "in"); diff --git a/src/cisco_lib/PolicyCompiler_pix_writers.cpp b/src/cisco_lib/PolicyCompiler_pix_writers.cpp index 7e4d90a7d..02c84058d 100644 --- a/src/cisco_lib/PolicyCompiler_pix_writers.cpp +++ b/src/cisco_lib/PolicyCompiler_pix_writers.cpp @@ -272,8 +272,13 @@ string PolicyCompiler_pix::PrintRule::_printICMPCommand(PolicyRule *rule) FWObject *srv = srvrel->front(); if (FWReference::cast(srv)!=NULL) srv = FWReference::cast(srv)->getPointer(); - Interface *rule_iface = - Interface::cast(compiler->dbcopy->findInIndex(rule->getInterfaceId())); + // Interface *rule_iface = + // Interface::cast(compiler->dbcopy->findInIndex(rule->getInterfaceId())); + + RuleElementItf *intf_re = rule->getItf(); + Interface *rule_iface = Interface::cast( + FWObjectReference::getObject(intf_re->front())); + assert(rule_iface); if (PIXObjectGroup::cast(srv)!=NULL) @@ -314,18 +319,20 @@ string PolicyCompiler_pix::PrintRule::_printICMPCommand(PolicyRule *rule) string PolicyCompiler_pix::PrintRule::_printSSHTelnetCommand(PolicyRule *rule) { -// Helper helper(this); - ostringstream str; int port; - RuleElementSrc *rel=rule->getSrc(); - Service *srv=compiler->getFirstSrv(rule); + RuleElementSrc *rel = rule->getSrc(); + Service *srv = compiler->getFirstSrv(rule); - Interface *rule_iface = Interface::cast(compiler->dbcopy->findInIndex(rule->getInterfaceId())); +// Interface *rule_iface = Interface::cast(compiler->dbcopy->findInIndex(rule->getInterfaceId())); + + RuleElementItf *intf_re = rule->getItf(); + Interface *rule_iface = Interface::cast( + FWObjectReference::getObject(intf_re->front())); assert(rule_iface); - port=TCPUDPService::cast(srv)->getDstRangeStart(); + port = TCPUDPService::cast(srv)->getDstRangeStart(); for (FWObject::iterator i=rel->begin(); i!=rel->end(); ++i) { diff --git a/test/procurve_acl/objects-for-regression-tests.fwb b/test/procurve_acl/objects-for-regression-tests.fwb index 98aca81f7..449157a27 100644 --- a/test/procurve_acl/objects-for-regression-tests.fwb +++ b/test/procurve_acl/objects-for-regression-tests.fwb @@ -1,6 +1,6 @@ - + @@ -51,9 +51,9 @@ - - - + @@ -69,9 +69,9 @@ - - - + @@ -100,17 +100,17 @@ - + established - + established -m state --state ESTABLISHED,RELATED established - + established - + established -m state --state ESTABLISHED,RELATED established @@ -352,54 +352,54 @@ - - - - + + + + -m record_rpc - - - + + + - - - - + + + + -m irc - - - + + + - - - - + + + + -m psd --psd-weight-threshold 5 --psd-delay-threshold 10000 - - - + + + - - - - + + + + -m string --string test_pattern - - - + + + - - - - + + + + -m talk - - - + + + @@ -566,34 +566,34 @@ - + dscp af11 - - - - - - + + + + + + - + dscp af12 - - - - - - + + + + + + - + dscp af11 - - - - - - + + + + + + @@ -1174,10 +1174,10 @@ - - + - + @@ -1206,8 +1206,8 @@ - - + @@ -1222,7 +1222,7 @@ - + @@ -1244,10 +1244,10 @@ - + - + @@ -1256,14 +1256,14 @@ - - - + - + - + @@ -1621,34 +1621,34 @@ - - + - - + - + - + - - + - - - - + @@ -1657,7 +1657,7 @@ - + @@ -1666,13 +1666,13 @@ - + - - - + - + @@ -1687,18 +1687,18 @@ - + - + - - + - - - + @@ -1717,7 +1717,7 @@ - + @@ -1769,12 +1769,12 @@ - + - + - + @@ -2136,34 +2136,34 @@ - - + - - + - + - + - - + - - - - + @@ -2172,7 +2172,7 @@ - + @@ -2181,13 +2181,13 @@ - + - - - + - + @@ -2206,14 +2206,14 @@ - + - - + - - - + @@ -2232,7 +2232,7 @@ - + @@ -2284,12 +2284,12 @@ - + - + - + @@ -2430,34 +2430,34 @@ - - + - - + - + - + - - + - - - - + @@ -2466,7 +2466,7 @@ - + @@ -2475,13 +2475,13 @@ - + - - - + - + @@ -2496,18 +2496,18 @@ - + - + - - + - - - + @@ -2526,7 +2526,7 @@ - + @@ -2578,12 +2578,12 @@ - + - + - + @@ -3106,10 +3106,10 @@ - - + - + @@ -3138,8 +3138,8 @@ - - + @@ -3154,7 +3154,7 @@ - + @@ -3176,10 +3176,10 @@ - + - + @@ -3188,15 +3188,15 @@ - - - + - + - + @@ -3715,14 +3715,14 @@ - - + - + - - + @@ -3747,8 +3747,8 @@ - - + @@ -3763,7 +3763,7 @@ - + @@ -3788,7 +3788,7 @@ - + @@ -3797,15 +3797,15 @@ - - - + - + - + @@ -4330,10 +4330,10 @@ - - + - + @@ -4362,8 +4362,8 @@ - - + @@ -4378,7 +4378,7 @@ - + @@ -4403,7 +4403,7 @@ - + @@ -4412,15 +4412,15 @@ - - - + - + - +