diff --git a/build_num b/build_num index 90273f92c..fd937be2c 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 1150 +#define BUILD_NUM 1151 diff --git a/doc/ChangeLog b/doc/ChangeLog index f5ab84b51..462f34d91 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,3 +1,10 @@ +2009-07-13 vadim + + * ACL.cpp (ciscoACL::addRemark): fixed bug #1778536 "IOSACL - + remark command". Remarks now include rule comments; if comment + consists of several lines, each line is added using separate + remark statement. This works for both IOS ACL and PIX platforms. + 2009-07-12 vadim * printerStream.cpp (printerStream::printQTable): fix bug diff --git a/src/cisco_lib/ACL.cpp b/src/cisco_lib/ACL.cpp index 637e8838b..96017f3f6 100644 --- a/src/cisco_lib/ACL.cpp +++ b/src/cisco_lib/ACL.cpp @@ -36,18 +36,37 @@ string ciscoACL::addLine(const std::string &s) return printLastLine(); } - /* - * Adds remark to access list. Checks and adds each remark only - * once. We use rule labels for remarks - */ -string ciscoACL::addRemark(const std::string &rl) +/* + * Adds remark to access list. Checks and adds each remark only + * once. We use rule labels for remarks + */ +string ciscoACL::addRemark(const std::string &rl, const std::string &comment) { - if (_last_rule_label!=rl) + string output; + if (_last_rule_label != rl) { - acl.push_back(" remark "+rl); - _last_rule_label=rl; + acl.push_back(" remark " + rl); + output += printLastLine(); nlines++; - return printLastLine(); + + if (!comment.empty()) + { + string::size_type n, c1; + c1 = 0; + while ( (n = comment.find("\n", c1)) != string::npos ) + { + acl.push_back(" remark " + comment.substr(c1, n-c1)); + output += printLastLine(); + nlines++; + c1 = n + 1; + } + acl.push_back(" remark " + comment.substr(c1)); + output += printLastLine(); + nlines++; + } + + _last_rule_label = rl; + return output; } return ""; } diff --git a/src/cisco_lib/ACL.h b/src/cisco_lib/ACL.h index ad5798125..ac30c0163 100644 --- a/src/cisco_lib/ACL.h +++ b/src/cisco_lib/ACL.h @@ -73,9 +73,9 @@ class ciscoACL { /* * Adds remark to access list. Checks and adds each remark only - * once. We use rule labels for remarks + * once. We use rule labels and comments for remarks */ - std::string addRemark(const std::string &rl); + std::string addRemark(const std::string &rl, const std::string &comment); void setName(const std::string &s) { _name=s; } std::string name() { return _name; } diff --git a/src/cisco_lib/PolicyCompiler_cisco.cpp b/src/cisco_lib/PolicyCompiler_cisco.cpp index 935092e5d..caae08f10 100644 --- a/src/cisco_lib/PolicyCompiler_cisco.cpp +++ b/src/cisco_lib/PolicyCompiler_cisco.cpp @@ -126,7 +126,7 @@ void PolicyCompiler_cisco::addDefaultPolicyRule() r->setLogging(false); r->setDirection(PolicyRule::Inbound); r->setPosition(-1); - r->setComment(" backup ssh access rule "); +// r->setComment(" backup ssh access rule "); r->setHidden(true); r->setFallback(false); r->setLabel("backup ssh access rule"); diff --git a/src/iosacl/PolicyCompiler_iosacl_writers.cpp b/src/iosacl/PolicyCompiler_iosacl_writers.cpp index f5dd991a6..543bc8ba1 100644 --- a/src/iosacl/PolicyCompiler_iosacl_writers.cpp +++ b/src/iosacl/PolicyCompiler_iosacl_writers.cpp @@ -60,6 +60,7 @@ #include + using namespace libfwbuilder; using namespace fwcompiler; using namespace std; @@ -280,7 +281,9 @@ string PolicyCompiler_iosacl::PrintRule::_printRule(PolicyRule *rule) // aclstr << endl; if (compiler->fw->getOptionsObject()->getBool("iosacl_use_acl_remarks")) - ruleout << acl->addRemark( rule->getLabel() ); + { + ruleout << acl->addRemark(rule->getLabel(), rule->getComment()); + } ruleout << acl->addLine(aclstr.str()); diff --git a/src/pix/PolicyCompiler_pix_writers.cpp b/src/pix/PolicyCompiler_pix_writers.cpp index 797cdaf93..422c37da4 100644 --- a/src/pix/PolicyCompiler_pix_writers.cpp +++ b/src/pix/PolicyCompiler_pix_writers.cpp @@ -635,7 +635,7 @@ bool PolicyCompiler_pix::PrintRule::processNext() if (compiler->fw->getOptionsObject()->getBool("pix_use_acl_remarks")) { - compiler->output << acl->addRemark( rule->getLabel() ); + compiler->output << acl->addRemark(rule->getLabel(), rule->getComment()); } /* diff --git a/test/pix/objects-for-regression-tests.fwb b/test/pix/objects-for-regression-tests.fwb index 85e968ed9..8e07d4c27 100644 --- a/test/pix/objects-for-regression-tests.fwb +++ b/test/pix/objects-for-regression-tests.fwb @@ -2,20 +2,8 @@ - - - - - - - - - - - - @@ -2508,6 +2496,7 @@ + @@ -3955,7 +3944,7 @@ no sysopt nodnsalias outbound - + @@ -4055,7 +4044,7 @@ no sysopt nodnsalias outbound - +