onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-11 07:31:25 +02:00
Code Issues Releases Wiki Activity

ipv6 in fwb_pf

Browse Source
This commit is contained in:
Vadim Kurland
2008-05-31 22:32:34 +00:00
parent ef5c0e6327
commit a2049a8c31
4 changed files with 55 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pflib/PolicyCompiler_pf.cpp
+7 -1
View File
@@ -978,7 +978,9 @@ void PolicyCompiler_pf::compile()
add( new recursiveGroupsInSrv("check for recursive groups in SRV")); add( new recursiveGroupsInSrv("check for recursive groups in SRV"));
check_for_recursive_groups=false; check_for_recursive_groups=false;
add( new ExpandGroups ("expand groups" ) ); add( new ExpandGroups("expand groups" ) );
add( new dropRuleWithEmptyRE(
"drop rules with empty rule elements"));
add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC") ); add( new eliminateDuplicatesInSRC("eliminate duplicates in SRC") );
add( new eliminateDuplicatesInDST("eliminate duplicates in DST") ); add( new eliminateDuplicatesInDST("eliminate duplicates in DST") );
add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV") ); add( new eliminateDuplicatesInSRV("eliminate duplicates in SRV") );
@@ -997,6 +999,8 @@ void PolicyCompiler_pf::compile()
"expand objects with multiple addresses in SRC" ) ); "expand objects with multiple addresses in SRC" ) );
add( new ExpandMultipleAddressesInDST( add( new ExpandMultipleAddressesInDST(
"expand objects with multiple addresses in DST" ) ); "expand objects with multiple addresses in DST" ) );
add( new dropRuleWithEmptyRE(
"drop rules with empty rule elements"));
add( new ConvertToAtomic ("convert to atomic rules") ); add( new ConvertToAtomic ("convert to atomic rules") );
add( new DetectShadowing ("Detect shadowing" ) ); add( new DetectShadowing ("Detect shadowing" ) );
add( new simplePrintProgress ( ) ); add( new simplePrintProgress ( ) );
@@ -1026,6 +1030,7 @@ void PolicyCompiler_pf::compile()
// ExpandGroups opens groups, as well as groups in groups etc. // ExpandGroups opens groups, as well as groups in groups etc.
add( new ExpandGroups( "expand groups" )); add( new ExpandGroups( "expand groups" ));
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
add( new CheckForTCPEstablished( add( new CheckForTCPEstablished(
"check for TCPService objects with flag \"established\"") ); "check for TCPService objects with flag \"established\"") );
@@ -1061,6 +1066,7 @@ void PolicyCompiler_pf::compile()
"add loopback to rules that permit redirected services" ) ); "add loopback to rules that permit redirected services" ) );
add( new ExpandMultipleAddresses( add( new ExpandMultipleAddresses(
"expand objects with multiple addresses" ) ); "expand objects with multiple addresses" ) );
add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
add( new checkForDynamicInterfacesOfOtherObjects( add( new checkForDynamicInterfacesOfOtherObjects(
"check for dynamic interfaces of other hosts and firewalls" )); "check for dynamic interfaces of other hosts and firewalls" ));
add( new MACFiltering( "verify for MAC address filtering" )); add( new MACFiltering( "verify for MAC address filtering" ));
src/pflib/PolicyCompiler_pf.h
+2
View File
@@ -421,6 +421,7 @@ namespace fwcompiler {
virtual void _printLogging(libfwbuilder::PolicyRule *r); virtual void _printLogging(libfwbuilder::PolicyRule *r);
virtual void _printDirection(libfwbuilder::PolicyRule *r); virtual void _printDirection(libfwbuilder::PolicyRule *r);
virtual void _printInterface(libfwbuilder::PolicyRule *r); virtual void _printInterface(libfwbuilder::PolicyRule *r);
virtual void _printAF(libfwbuilder::PolicyRule *r);
virtual void _printLabel(libfwbuilder::PolicyRule *r); virtual void _printLabel(libfwbuilder::PolicyRule *r);
virtual void _printQueue(libfwbuilder::PolicyRule *r); virtual void _printQueue(libfwbuilder::PolicyRule *r);
virtual void _printTag(libfwbuilder::PolicyRule *r); virtual void _printTag(libfwbuilder::PolicyRule *r);
@@ -430,6 +431,7 @@ namespace fwcompiler {
PrintRule(const std::string &name); PrintRule(const std::string &name);
virtual bool processNext(); virtual bool processNext();
}; };
friend class PolicyCompiler_pf::PrintRule;
virtual std::string myPlatformName(); virtual std::string myPlatformName();
src/pflib/PolicyCompiler_pf_writers.cpp
+9 -2
View File
@@ -278,8 +278,6 @@ void PolicyCompiler_pf::PrintRule::_printQueue(PolicyRule *rule)
void PolicyCompiler_pf::PrintRule::_printTag(PolicyRule *rule) void PolicyCompiler_pf::PrintRule::_printTag(PolicyRule *rule)
{ {
FWOptions *ruleopt =rule->getOptionsObject();
if (rule->getAction() == PolicyRule::Tag) if (rule->getAction() == PolicyRule::Tag)
compiler->output << "tag " << rule->getTagValue() << " "; compiler->output << "tag " << rule->getTagValue() << " ";
// compiler->output << "tag " << ruleopt->getStr("tagvalue") << " "; // compiler->output << "tag " << ruleopt->getStr("tagvalue") << " ";
@@ -359,6 +357,13 @@ void PolicyCompiler_pf::PrintRule::_printInterface(PolicyRule *rule)
compiler->output << "on " << iface_name << " "; compiler->output << "on " << iface_name << " ";
} }
// print address family
void PolicyCompiler_pf::PrintRule::_printAF(PolicyRule*)
{
PolicyCompiler_pf *pf_comp=dynamic_cast<PolicyCompiler_pf*>(compiler);
if (pf_comp->ipv6) compiler->output << "inet6 ";
}
void PolicyCompiler_pf::PrintRule::_printProtocol(libfwbuilder::Service *srv) void PolicyCompiler_pf::PrintRule::_printProtocol(libfwbuilder::Service *srv)
{ {
@@ -772,6 +777,8 @@ bool PolicyCompiler_pf::PrintRule::processNext()
_printInterface(rule); _printInterface(rule);
_printAF(rule);
_printRouteOptions(rule); _printRouteOptions(rule);
compiler->output << "inet "; compiler->output << "inet ";
test/pf/objects-for-regression-tests.fwb
+37 -13
View File
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="utf-8"?> <?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd"> <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="7" lastModified="1212118934" id="root"> <FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="7" lastModified="1212272477" id="root">
<Library color="#d2ffd0" comment="User defined objects" id="syslib001" name="User" ro="False"> <Library color="#d2ffd0" comment="User defined objects" id="syslib001" name="User" ro="False">
<ObjectGroup id="stdid01_1" name="Objects"> <ObjectGroup id="stdid01_1" name="Objects">
<ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables"> <ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables">
@@ -10051,11 +10051,31 @@
<Option name="verify_interfaces">true</Option> <Option name="verify_interfaces">true</Option>
</FirewallOptions> </FirewallOptions>
</Firewall> </Firewall>
<Firewall comment="" host_OS="freebsd" id="id4833F62B6131" inactive="False" lastCompiled="1212115999" lastInstalled="0" lastModified="1212118934" name="firewall-ipv6-1" platform="pf" ro="False" version=""> <Firewall comment="" host_OS="freebsd" id="id4833F62B6131" inactive="False" lastCompiled="1212115999" lastInstalled="0" lastModified="1212272477" name="firewall-ipv6-1" platform="pf" ro="False" version="">
<NAT id="id4833F62F6131" name="NAT"/> <NAT id="id4833F62F6131" name="NAT"/>
<Policy id="id483F5B7623190" name="Policy_ipv4"/> <Policy id="id483F5B7623190" name="Policy_ipv4"/>
<Policy id="id4833F62E6131" name="Policy"> <Policy id="id4833F62E6131" name="Policy">
<PolicyRule action="Accept" comment="this rule shadows the next.&#10;Note that we add command line&#10;flag -xt to the compiler" direction="Both" disabled="False" group="" id="id4837BFE628819" log="False" position="0"> <PolicyRule action="Accept" direction="Both" disabled="False" group="" id="id4841FADE30813" log="False" position="0">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="id4841FADB30813"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="stateless">False</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="this rule shadows the next.&#10;Note that we add command line&#10;flag -xt to the compiler" direction="Both" disabled="False" group="" id="id4837BFE628819" log="False" position="1">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="id4834B9206131"/> <ObjectRef ref="id4834B9206131"/>
</Src> </Src>
@@ -10075,7 +10095,7 @@
<Option name="stateless">False</Option> <Option name="stateless">False</Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id4834578B6131" log="False" position="1"> <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id4834578B6131" log="False" position="2">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="id48416A7216880"/> <ObjectRef ref="id48416A7216880"/>
</Src> </Src>
@@ -10095,7 +10115,7 @@
<Option name="stateless">False</Option> <Option name="stateless">False</Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule action="Accept" direction="Both" disabled="False" id="id4834577C6131" log="True" position="2"> <PolicyRule action="Accept" direction="Both" disabled="False" id="id4834577C6131" log="True" position="3">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="id48416A7116880"/> <ObjectRef ref="id48416A7116880"/>
</Src> </Src>
@@ -10115,7 +10135,7 @@
<Option name="stateless">False</Option> <Option name="stateless">False</Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule action="Accept" direction="Both" disabled="False" group="" id="id4834D3038571" log="True" position="3"> <PolicyRule action="Accept" direction="Both" disabled="False" group="" id="id4834D3038571" log="True" position="4">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="id4834A2238571"/> <ObjectRef ref="id4834A2238571"/>
</Src> </Src>
@@ -10135,7 +10155,7 @@
<Option name="stateless">False</Option> <Option name="stateless">False</Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule action="Accept" direction="Both" disabled="False" group="" id="id4834D3108571" log="True" position="4"> <PolicyRule action="Accept" direction="Both" disabled="False" group="" id="id4834D3108571" log="True" position="5">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="id4834A2278571"/> <ObjectRef ref="id4834A2278571"/>
</Src> </Src>
@@ -10155,7 +10175,7 @@
<Option name="stateless">False</Option> <Option name="stateless">False</Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id4835040E8571" log="True" position="5"> <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id4835040E8571" log="True" position="6">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="id4834A2238571"/> <ObjectRef ref="id4834A2238571"/>
</Src> </Src>
@@ -10175,7 +10195,7 @@
<Option name="stateless">False</Option> <Option name="stateless">False</Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id4835041F8571" log="True" position="6"> <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id4835041F8571" log="True" position="7">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="id4834A2278571"/> <ObjectRef ref="id4834A2278571"/>
</Src> </Src>
@@ -10195,7 +10215,7 @@
<Option name="stateless">False</Option> <Option name="stateless">False</Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule action="Accept" direction="Inbound" disabled="False" id="id4834576F6131" log="True" position="7"> <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id4834576F6131" log="True" position="8">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="sysid0"/> <ObjectRef ref="sysid0"/>
</Src> </Src>
@@ -10215,7 +10235,7 @@
<Option name="stateless">False</Option> <Option name="stateless">False</Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule action="Accept" direction="Both" disabled="False" id="id4834B9216131" log="True" position="8"> <PolicyRule action="Accept" direction="Both" disabled="False" id="id4834B9216131" log="True" position="9">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="id4834B9206131"/> <ObjectRef ref="id4834B9206131"/>
</Src> </Src>
@@ -10235,7 +10255,7 @@
<Option name="stateless">False</Option> <Option name="stateless">False</Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule action="Accept" direction="Both" disabled="False" id="id483566468571" log="True" position="9"> <PolicyRule action="Accept" direction="Both" disabled="False" id="id483566468571" log="True" position="10">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="id4834A2238571"/> <ObjectRef ref="id4834A2238571"/>
</Src> </Src>
@@ -10255,7 +10275,7 @@
<Option name="stateless">False</Option> <Option name="stateless">False</Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule action="Accept" direction="Both" disabled="False" id="id483566548571" log="True" position="10"> <PolicyRule action="Accept" direction="Both" disabled="False" id="id483566548571" log="True" position="11">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="id4834A2278571"/> <ObjectRef ref="id4834A2278571"/>
</Src> </Src>
@@ -10281,6 +10301,10 @@
<IPv4 id="id4833F6326131" name="firewall-ipv6-1:eth0:ip" address="1.1.1.1" netmask="255.255.255.0"/> <IPv4 id="id4833F6326131" name="firewall-ipv6-1:eth0:ip" address="1.1.1.1" netmask="255.255.255.0"/>
<IPv6 comment="" id="id4833F6346131" name="firewall-ipv6-1:eth0:ipv6" address="fe80::21d:9ff:fe8b:8e94" netmask="64"/> <IPv6 comment="" id="id4833F6346131" name="firewall-ipv6-1:eth0:ipv6" address="fe80::21d:9ff:fe8b:8e94" netmask="64"/>
</Interface> </Interface>
<Interface bridgeport="False" comment="" dyn="False" id="id4841FADB30813" label="" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
<IPv4 comment="" id="id4841FADC30813" name="firewall-ipv6-1:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
<IPv6 comment="" id="id4841FADD30813" name="firewall-ipv6-1:lo:ipv6" address="::1" netmask="128"/>
</Interface>
<Management address="1.1.1.1"> <Management address="1.1.1.1">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/> <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/> <FWBDManagement enabled="False" identity="" port="-1"/>