From 95c6c6381824a3a78edc0409f05c02fb79c433d9 Mon Sep 17 00:00:00 2001 From: Vadim Kurland Date: Thu, 7 Apr 2011 16:03:52 -0700 Subject: [PATCH] see #2167 making sure names are replaced with addresses only as standalone words and not substrings --- VERSION | 2 +- VERSION.h | 2 +- packaging/fwbuilder-static-qt.spec | 2 +- packaging/fwbuilder.control | 2 +- packaging/fwbuilder.spec | 2 +- src/cisco_lib/CompilerDriver_pix_run.cpp | 29 +- src/import/PIXImporterRun.cpp | 4 +- .../test_data/asa8.0-names.fwb | 272 +++++++++--------- .../test_data/asa8.0-names.output | 104 +++---- .../test_data/asa8.0-names.test | 13 + 10 files changed, 240 insertions(+), 192 deletions(-) diff --git a/VERSION b/VERSION index aa8046b12..38daffdc9 100644 --- a/VERSION +++ b/VERSION @@ -7,7 +7,7 @@ FWB_MICRO_VERSION=0 # build number is like "nano" version number. I am incrementing build # number during development cycle # -BUILD_NUM="3520" +BUILD_NUM="3521" VERSION="$FWB_MAJOR_VERSION.$FWB_MINOR_VERSION.$FWB_MICRO_VERSION.$BUILD_NUM" diff --git a/VERSION.h b/VERSION.h index deabaafa8..c1108136c 100644 --- a/VERSION.h +++ b/VERSION.h @@ -1,2 +1,2 @@ -#define VERSION "4.2.0.3520" +#define VERSION "4.2.0.3521" #define GENERATION "4.2" diff --git a/packaging/fwbuilder-static-qt.spec b/packaging/fwbuilder-static-qt.spec index 2eaaed1ff..d9476c1e8 100644 --- a/packaging/fwbuilder-static-qt.spec +++ b/packaging/fwbuilder-static-qt.spec @@ -3,7 +3,7 @@ %define name fwbuilder -%define version 4.2.0.3520 +%define version 4.2.0.3521 %define release 1 %if "%_vendor" == "MandrakeSoft" diff --git a/packaging/fwbuilder.control b/packaging/fwbuilder.control index 124ba5546..02e28f181 100644 --- a/packaging/fwbuilder.control +++ b/packaging/fwbuilder.control @@ -4,6 +4,6 @@ Replaces: fwbuilder (<=4.1.1-1), fwbuilder-common, fwbuilder-bsd, fwbuilder-linu Priority: extra Section: checkinstall Maintainer: vadim@fwbuilder.org -Version: 4.2.0.3520-1 +Version: 4.2.0.3521-1 Depends: libqt4-gui (>= 4.3.0), libxml2, libxslt1.1, libsnmp | libsnmp15 Description: Firewall Builder GUI and policy compilers diff --git a/packaging/fwbuilder.spec b/packaging/fwbuilder.spec index 1c7c9da39..74952b146 100644 --- a/packaging/fwbuilder.spec +++ b/packaging/fwbuilder.spec @@ -1,6 +1,6 @@ %define name fwbuilder -%define version 4.2.0.3520 +%define version 4.2.0.3521 %define release 1 %if "%_vendor" == "MandrakeSoft" diff --git a/src/cisco_lib/CompilerDriver_pix_run.cpp b/src/cisco_lib/CompilerDriver_pix_run.cpp index a6a2b2eca..c1a691fb2 100644 --- a/src/cisco_lib/CompilerDriver_pix_run.cpp +++ b/src/cisco_lib/CompilerDriver_pix_run.cpp @@ -131,21 +131,33 @@ QString CompilerDriver_pix::assembleFwScript(Cluster *cluster, string vers = fw->getStr("version"); string platform = fw->getStr("platform"); - bool outbound_acl_supported = Resources::platform_res[platform]->getResourceBool( - string("/FWBuilderResources/Target/options/")+ - "version_"+vers+ - "/pix_outbound_acl_supported"); + + bool outbound_acl_supported = + Resources::platform_res[platform]->getResourceBool( + string("/FWBuilderResources/Target/options/")+ + "version_"+vers+ + "/pix_outbound_acl_supported"); + bool afpa = options->getBool("pix_assume_fw_part_of_any"); bool emulate_outb_acls = options->getBool("pix_emulate_out_acl"); bool generate_outb_acls = options->getBool("pix_generate_out_acl"); - top_comment.setVariable("outbound_acl_supported", QString((outbound_acl_supported)?"supported":"not supported")); - top_comment.setVariable("emulate_outb_acls", QString((emulate_outb_acls)?"yes":"no")); - top_comment.setVariable("generate_outb_acls", QString((generate_outb_acls)?"yes":"no")); + top_comment.setVariable( + "outbound_acl_supported", + QString((outbound_acl_supported) ? "supported" : "not supported")); + + top_comment.setVariable("emulate_outb_acls", + QString((emulate_outb_acls)?"yes":"no")); + + top_comment.setVariable("generate_outb_acls", + QString((generate_outb_acls)?"yes":"no")); + top_comment.setVariable("afpa", QString((afpa)?"yes":"no")); script_skeleton.setVariable("short_script", options->getBool("short_script")); - script_skeleton.setVariable("not_short_script", ! options->getBool("short_script")); + + script_skeleton.setVariable("not_short_script", + ! options->getBool("short_script")); script_skeleton.setVariable("system_configuration_script", QString::fromUtf8( @@ -164,6 +176,7 @@ QString CompilerDriver_pix::assembleFwScript(Cluster *cluster, assembleFwScriptInternal(cluster, fw, cluster_member, oscnf, &script_skeleton, &top_comment, "!", true); + return script_skeleton.expand(); } diff --git a/src/import/PIXImporterRun.cpp b/src/import/PIXImporterRun.cpp index b5baeee5c..cf693d564 100644 --- a/src/import/PIXImporterRun.cpp +++ b/src/import/PIXImporterRun.cpp @@ -29,6 +29,7 @@ #include #include +#include #include #include @@ -95,7 +96,8 @@ void PIXImporter::run() QMap::iterator it; for (it=named_addresses.begin(); it!=named_addresses.end(); ++it) { - str.replace(it.key(), it.value()); + QString re("\\b%1\\b"); + str.replace(QRegExp(re.arg(it.key())), it.value()); } } diff --git a/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.fwb b/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.fwb index 59a9566bf..85e7647d3 100644 --- a/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.fwb +++ b/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.fwb @@ -1,6 +1,6 @@ - + @@ -432,69 +432,85 @@ - + + - - - - - + + + + + + - - - - + + + + + + + + + + + + + + + + + - - - - - - + + + + + + + - + - - - - - - - - - + + + + + + + + + - - + + - - - + + + - - - - + + + + - - - + + + - - + + - + - + - + - + @@ -503,18 +519,18 @@ - + - + - + - + - + @@ -523,18 +539,18 @@ - + - + - + - + @@ -543,18 +559,18 @@ - + - + - + - + @@ -563,18 +579,18 @@ - + - + - + - + @@ -583,18 +599,18 @@ - + - + - + - + @@ -603,18 +619,18 @@ - + - + - + - + @@ -623,18 +639,18 @@ - + - + - + - + @@ -643,18 +659,18 @@ - + - + - + - + - + @@ -663,18 +679,18 @@ - + - + - + - + - + @@ -683,18 +699,18 @@ - + - + - + - + - + @@ -703,18 +719,18 @@ - + - + - + - + @@ -723,18 +739,18 @@ - + - + - + - + @@ -743,18 +759,18 @@ - + - + - + - + @@ -763,18 +779,18 @@ - + - + - + - + @@ -783,18 +799,18 @@ - + - + - + - + @@ -803,18 +819,18 @@ - + - + - + - + - + @@ -823,18 +839,18 @@ - + - + - + - + @@ -843,7 +859,7 @@ - + @@ -851,10 +867,10 @@ - + - + @@ -866,15 +882,15 @@ - + - - + + - - + + @@ -895,7 +911,7 @@ - - + + diff --git a/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.output b/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.output index 27ec15dea..dabcc2df0 100644 --- a/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.output +++ b/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.output @@ -1,55 +1,59 @@ 3: Version: 8.0 5: Host name: pixfirewall -11: New interface: Ethernet0 -11: Interface parameters: inside -11: Interface label: inside -13: Interface address: 192.168.2.221/255.255.255.0 -16: New interface: Ethernet1 -16: Interface parameters: outside -16: Interface label: outside -18: Interface address: 192.0.2.221/255.255.255.0 -21: New interface: Ethernet2 +12: New interface: Ethernet0 +12: Interface parameters: inside +12: Interface label: inside +14: Interface address: 192.168.2.221/255.255.255.0 +17: New interface: Ethernet1 +17: Interface parameters: outside +17: Interface label: outside +19: Interface address: 192.0.2.221/255.255.255.0 +22: New interface: Ethernet2 Warning: interface Ethernet2 was not imported because it is in "shutdown" mode -27: New interface: Ethernet3 +28: New interface: Ethernet3 Warning: interface Ethernet3 was not imported because it is in "shutdown" mode -33: New interface: Ethernet4 +34: New interface: Ethernet4 Warning: interface Ethernet4 was not imported because it is in "shutdown" mode -41: Object Group (network) net-1 -44: Object Group (network) net-2 -50: filtering rule: access list inside_in, action permit -51: filtering rule: access list inside_in, action deny -53: Interface Ethernet0 ruleset inside_in direction 'in' -59: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' -59: filtering rule: access list icmp_commands_outside, action permit -60: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' -60: filtering rule: access list icmp_commands_outside, action permit -61: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' -61: filtering rule: access list icmp_commands_outside, action permit -62: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' -62: filtering rule: access list icmp_commands_outside, action permit -63: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' -63: filtering rule: access list icmp_commands_outside, action permit -64: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' -64: filtering rule: access list icmp_commands_outside, action permit -65: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' -65: filtering rule: access list icmp_commands_inside, action permit -66: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' -66: filtering rule: access list icmp_commands_inside, action permit -67: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' -67: filtering rule: access list icmp_commands_inside, action permit -68: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' -68: filtering rule: access list icmp_commands_inside, action permit -69: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' -69: filtering rule: access list icmp_commands_inside, action permit -70: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' -70: filtering rule: access list icmp_commands_inside, action permit -71: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' -71: filtering rule: access list icmp_commands_inside, action permit -72: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' -72: filtering rule: access list icmp_commands_inside, action permit -73: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' -73: filtering rule: access list icmp_commands_inside, action permit -86: Interface Ethernet0 ruleset telnet_commands_inside direction 'in' -86: filtering rule: access list telnet_commands_inside, action permit -88: Interface Ethernet0 ruleset ssh_commands_inside direction 'in' -88: filtering rule: access list ssh_commands_inside, action permit +42: Object Group (network) net_1_group +45: Object Group (network) another_group_net_1 +48: Object Group (network) host_net_1 +51: Object Group (network) host_net_2 +54: Object Group (network) net-1 +57: Object Group (network) net-2 +63: filtering rule: access list inside_in, action permit +64: filtering rule: access list inside_in, action deny +66: Interface Ethernet0 ruleset inside_in direction 'in' +72: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' +72: filtering rule: access list icmp_commands_outside, action permit +73: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' +73: filtering rule: access list icmp_commands_outside, action permit +74: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' +74: filtering rule: access list icmp_commands_outside, action permit +75: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' +75: filtering rule: access list icmp_commands_outside, action permit +76: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' +76: filtering rule: access list icmp_commands_outside, action permit +77: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' +77: filtering rule: access list icmp_commands_outside, action permit +78: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' +78: filtering rule: access list icmp_commands_inside, action permit +79: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' +79: filtering rule: access list icmp_commands_inside, action permit +80: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' +80: filtering rule: access list icmp_commands_inside, action permit +81: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' +81: filtering rule: access list icmp_commands_inside, action permit +82: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' +82: filtering rule: access list icmp_commands_inside, action permit +83: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' +83: filtering rule: access list icmp_commands_inside, action permit +84: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' +84: filtering rule: access list icmp_commands_inside, action permit +85: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' +85: filtering rule: access list icmp_commands_inside, action permit +86: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' +86: filtering rule: access list icmp_commands_inside, action permit +99: Interface Ethernet0 ruleset telnet_commands_inside direction 'in' +99: filtering rule: access list telnet_commands_inside, action permit +101: Interface Ethernet0 ruleset ssh_commands_inside direction 'in' +101: filtering rule: access list ssh_commands_inside, action permit diff --git a/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.test b/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.test index b08801b3c..4d8656698 100644 --- a/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.test +++ b/src/unit_tests/PIXImporterTest/test_data/asa8.0-names.test @@ -7,6 +7,7 @@ enable password XXXXXXXXXXXXXXXX encrypted names name 192.168.2.0 inside_network name 192.168.2.221 inside_ip +name 192.168.2.240 net_1 ! interface Ethernet0 nameif inside @@ -38,6 +39,18 @@ interface Ethernet4 ! passwd YYYYYYYYYYYYYYYY encrypted ftp mode passive +object-group network net_1_group + network-object net_1 255.255.255.240 + network-object 192.168.2.0 255.255.255.0 +object-group network another_group_net_1 + network-object net_1 255.255.255.240 + network-object 192.168.3.0 255.255.255.0 +object-group network host_net_1 + network-object host net_1 +! whitespace after net_1 +object-group network host_net_2 + network-object host net_1 + object-group network net-1 description single network object-group network-object inside_network 255.255.255.0