onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-13 08:29:32 +02:00
Code Issues Releases Wiki Activity

fixes #2299 improvements in the log format of iptables and iosacl importers

Browse Source
This commit is contained in:
Vadim Kurland
2011-04-05 21:11:37 -07:00
parent 6f79c1d644
commit b1ad1cbec1
18 changed files with 443 additions and 402 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/import/IOSImporter.cpp
+15
View File
@@ -249,6 +249,21 @@ void IOSImporter::ignoreCurrentInterface()
void IOSImporter::pushRule()
{
assert(current_ruleset!=NULL);
assert(current_rule!=NULL);
// populate all elements of the rule
addMessageToLog(
QString("access list rule: access list %1, action %2")
.arg(QString::fromUtf8(current_ruleset->ruleset->getName().c_str()))
.arg(action.c_str()));
Importer::pushRule();
}
void IOSImporter::MergeRules::move(FWObject* r) void IOSImporter::MergeRules::move(FWObject* r)
{ {
PolicyRule *rule = PolicyRule::cast(r); PolicyRule *rule = PolicyRule::cast(r);
src/import/IOSImporter.h
+2
View File
@@ -71,6 +71,8 @@ public:
virtual void ignoreCurrentInterface(); virtual void ignoreCurrentInterface();
virtual void pushRule();
// this method actually adds interfaces to the firewall object // this method actually adds interfaces to the firewall object
// and does final clean up. // and does final clean up.
virtual libfwbuilder::Firewall* finalize(); virtual libfwbuilder::Firewall* finalize();
src/import/IPTImporter.cpp
+59 -66
View File
@@ -401,9 +401,9 @@ void IPTImporter::processModuleMatches()
{ {
// at this time I create branches only one level deep // at this time I create branches only one level deep
QString err = QObject::tr( QString err = QObject::tr(
"Original rule combines match of tcp/udp/icmp \n" "Original rule combines match of tcp/udp/icmp "
"protocols with two or more module matches, such as \n" "protocols with two or more module matches, such as "
"module 'mark', 'recent' or 'length'. Use additional \n" "module 'mark', 'recent' or 'length'. Use additional "
"branches to implement this complex match."); "branches to implement this complex match.");
reportError(err); reportError(err);
break; break;
@@ -586,8 +586,8 @@ PolicyRule* IPTImporter::createPolicyBranch(
ropt->setBool("stateless", true); ropt->setBool("stateless", true);
} }
QString l("Created branch %1\n"); addMessageToLog(QString("Created branch %1")
*Importer::logger << l.arg(branch_ruleset_name.c_str()).toUtf8().constData(); .arg(QString::fromUtf8(branch_ruleset_name.c_str())));
return new_rule; return new_rule;
} }
@@ -634,8 +634,9 @@ NATRule* IPTImporter::createNATBranch(
re = new_rule->getItfOutb(); re->reset(); re = new_rule->getItfOutb(); re->reset();
} }
QString l("Created branch %1\n"); addMessageToLog(
*Importer::logger << l.arg(branch_ruleset_name.c_str()).toUtf8().constData(); QString("Created branch %1")
.arg(QString::fromUtf8(branch_ruleset_name.c_str())));
return new_rule; return new_rule;
} }
@@ -701,7 +702,7 @@ void IPTImporter::pushPolicyRule()
action_on_reject_code = "ICMP admin prohibited"; action_on_reject_code = "ICMP admin prohibited";
QString err = QObject::tr( QString err = QObject::tr(
"Error: Line %1: Unknown parameter of target REJECT: %2.\n") "Error: Line %1: Unknown parameter of target REJECT: %2.")
.arg(getCurrentLineNumber()) .arg(getCurrentLineNumber())
.arg(iptables_reject_arg); .arg(iptables_reject_arg);
reportError(err); reportError(err);
@@ -818,9 +819,9 @@ void IPTImporter::pushPolicyRule()
{ {
fwopt->setBool("clamp_mss_to_mtu", true); fwopt->setBool("clamp_mss_to_mtu", true);
skip_rule = true; skip_rule = true;
QString err("Warning: Line %1: Using automatic rule controlled by option " addMessageToLog(
"Clamp MSS to MTU\n"); QString("Warning: Using automatic rule controlled by option "
*Importer::logger << err.arg(getCurrentLineNumber()).toStdString(); "Clamp MSS to MTU"));
} }
if (target=="TOS") if (target=="TOS")
@@ -914,15 +915,15 @@ void IPTImporter::pushPolicyRule()
srv->addRef(estab); srv->addRef(estab);
} }
QString err( addMessageToLog(
"Warning: Line %1: Rule matches states 'RELATED,ESTABLISHED'. " QString(
"Consider using " "Warning: Rule matches states 'RELATED,ESTABLISHED'. "
"automatic rule controlled by the checkbox in the firewall " "Consider using "
"settings dialog. Automatic rule matches in all standard chains " "automatic rule controlled by the checkbox in the firewall "
"which may be different from the original imported configuration. " "settings dialog. Automatic rule matches in all standard chains "
"This requires manual checking." "which may be different from the original imported configuration. "
"\n"); "This requires manual checking."
*Importer::logger << err.arg(getCurrentLineNumber()).toStdString(); ));
current_state = ""; current_state = "";
} }
@@ -936,11 +937,11 @@ void IPTImporter::pushPolicyRule()
if (target=="LOG") fwopt->setBool("log_invalid", true); if (target=="LOG") fwopt->setBool("log_invalid", true);
skip_rule = true; skip_rule = true;
QString err("Warning: Line %1: Using automatic rule controlled by option " addMessageToLog(
"'Drop packet that do not match any known connection' to match " QString("Warning: Using automatic rule controlled by option "
"state INVALID" "'Drop packet that do not match any known connection' "
"\n"); "to match state INVALID"
*Importer::logger << err.arg(getCurrentLineNumber()).toStdString(); ));
current_state = ""; current_state = "";
} }
@@ -979,20 +980,18 @@ void IPTImporter::pushPolicyRule()
// --state NEW when service object adds its own state match // --state NEW when service object adds its own state match
// ropt->setBool("stateless", false); // ropt->setBool("stateless", false);
QString err( addMessageToLog(
"Warning: Line %1: Rule matches combination of states '%2'. " QString(
"Iptables rules generated by fwbuilder can be stateless (match " "Warning: Rule matches combination of states '%1'. "
"no state) or stateful (match state NEW). Fwbuilder also adds " "Iptables rules generated by fwbuilder can be stateless (match "
"a rule at the top of the script to match states " "no state) or stateful (match state NEW). Fwbuilder also adds "
"ESTABLISHED,RELATED. Combination of states '%3' does not fit " "a rule at the top of the script to match states "
"these standard cases and to match it, the program created " "ESTABLISHED,RELATED. Combination of states '%2' does not fit "
"new Custom Service object. This may require manual checking." "these standard cases and to match it, the program created "
"\n"); "new Custom Service object. This may require manual checking."
*Importer::logger << err )
.arg(getCurrentLineNumber())
.arg(current_state.c_str()) .arg(current_state.c_str())
.arg(current_state.c_str()) .arg(current_state.c_str()));
.toStdString();
current_state = ""; current_state = "";
} }
@@ -1007,11 +1006,11 @@ void IPTImporter::pushPolicyRule()
assert(lmr_ropt!=NULL); assert(lmr_ropt!=NULL);
lmr_ropt->setBool("ipt_mark_connections", true); lmr_ropt->setBool("ipt_mark_connections", true);
skip_rule = true; skip_rule = true;
QString err("Warning: Line %1: Turned option on in previous rule " addMessageToLog(
QString("Warning: Turned option on in previous rule "
"with action Mark " "with action Mark "
"for '-j CONNMARK --save-mark' " "for '-j CONNMARK --save-mark' "
"\n"); ));
*Importer::logger << err.arg(getCurrentLineNumber()).toStdString();
} }
if (target=="CONNMARK" && if (target=="CONNMARK" &&
@@ -1021,10 +1020,10 @@ void IPTImporter::pushPolicyRule()
// MangleTableCompiler_ipt::flushAndSetDefaultPolicy() // MangleTableCompiler_ipt::flushAndSetDefaultPolicy()
// if we have at least one rule with CONNMARK target in the policy // if we have at least one rule with CONNMARK target in the policy
skip_rule = true; skip_rule = true;
QString err("Warning: Line %1: Skip command with '-j CONNMARK --restore-mark' " addMessageToLog(
QString("Warning: Skipping command with '-j CONNMARK --restore-mark' "
"This rule is generated automatically." "This rule is generated automatically."
"\n"); ));
*Importer::logger << err.arg(getCurrentLineNumber()).toStdString();
} }
if (!skip_rule) if (!skip_rule)
@@ -1117,12 +1116,10 @@ void IPTImporter::pushPolicyRule()
" Both inbound and outbound interfaces " " Both inbound and outbound interfaces "
"in original iptables command: %1").arg(interfaces).toStdString(); "in original iptables command: %1").arg(interfaces).toStdString();
QString log_str("Warning: Line %1: Creating branch ruleset '%2' to " addMessageToLog(
"match inbound and outbound interfaces %3\n"); QString("Warning: Creating branch ruleset '%1' to "
*Importer::logger << log_str "match inbound and outbound interfaces %2")
.arg(getCurrentLineNumber()) .arg(branch_ruleset_name.c_str()).arg(interfaces));
.arg(branch_ruleset_name.c_str()).arg(interfaces)
.toUtf8().constData();
} else } else
{ {
if ( !i_intf.empty()) if ( !i_intf.empty())
@@ -1492,7 +1489,7 @@ Firewall* IPTImporter::finalize()
{ {
QString err = QObject::tr( QString err = QObject::tr(
"Warning: Line %1: Can not reproduce default " "Warning: Line %1: Can not reproduce default "
"action in table 'mangle' chain 'FORWARD'.\n" "action in table 'mangle' chain 'FORWARD'. "
"(Generated rule may not generate equivalent " "(Generated rule may not generate equivalent "
"iptables command when compiled)" "iptables command when compiled)"
); );
@@ -1501,9 +1498,7 @@ Firewall* IPTImporter::finalize()
rule->setComment( rule->setComment(
err.arg( err.arg(
rs->default_action_line_number).toUtf8().constData()); rs->default_action_line_number).toUtf8().constData());
*Importer::logger << err.arg( addMessageToLog(err.arg(rs->default_action_line_number));
rs->default_action_line_number).toUtf8().constData();
} }
} }
@@ -1518,7 +1513,7 @@ Firewall* IPTImporter::finalize()
{ {
QString err = QObject::tr( QString err = QObject::tr(
"Warning: Line %1: Can not reproduce default " "Warning: Line %1: Can not reproduce default "
"action in table 'mangle' chain 'INPUT'.\n" "action in table 'mangle' chain 'INPUT'. "
"(Generated rule may not generate equivalent " "(Generated rule may not generate equivalent "
"iptables command when compiled)" "iptables command when compiled)"
); );
@@ -1527,8 +1522,7 @@ Firewall* IPTImporter::finalize()
rule->setComment( rule->setComment(
err.arg( err.arg(
rs->default_action_line_number).toUtf8().constData()); rs->default_action_line_number).toUtf8().constData());
*Importer::logger << err.arg( addMessageToLog(err.arg(rs->default_action_line_number));
rs->default_action_line_number).toUtf8().constData();
} }
} }
@@ -1553,12 +1547,11 @@ Firewall* IPTImporter::finalize()
rs->ruleset->add(rule); rs->ruleset->add(rule);
QString l("Warning: Line %1: Added rule to reproduce default " addMessageToLog(
"policy ACCEPT in %2\n"); QString("Warning: Line %1: Added rule to reproduce default "
"policy ACCEPT in %2")
*Importer::logger << .arg(rs->default_action_line_number)
l.arg(rs->default_action_line_number) .arg(rs_index.c_str()));
.arg(rs_index.c_str()).toUtf8().constData();
} }
} }
@@ -1682,9 +1675,9 @@ void IPTImporter::newUnidirRuleSet(const string &chain_name,
const string &ruleset_type) const string &ruleset_type)
{ {
current_ruleset = getUnidirRuleSet(chain_name, ruleset_type); // creates if new current_ruleset = getUnidirRuleSet(chain_name, ruleset_type); // creates if new
QString l("Ruleset: %1 / %2\n"); addMessageToLog(
*Importer::logger << l.arg(current_table.c_str()).arg(current_ruleset->name.c_str()) QString("New ruleset: %1 / %2")
.toStdString(); .arg(current_table.c_str()).arg(current_ruleset->name.c_str()));
} }
src/import/Importer.cpp
+1 -2
View File
@@ -803,8 +803,7 @@ void Importer::reportError(const std::string &comment)
void Importer::reportError(const QString &comment) void Importer::reportError(const QString &comment)
{ {
error_counter++; error_counter++;
QString err = QObject::tr("Parser error: Line %1: %2\n") QString err = QObject::tr("Error: %1").arg(comment);
.arg(getCurrentLineNumber()).arg(comment);
addMessageToLog(err); addMessageToLog(err);
error_tracker->registerError(err); error_tracker->registerError(err);
} }
src/import/PIXImporter.cpp
+4 -1
View File
@@ -409,7 +409,10 @@ void PIXImporter::pushPolicyRule()
assert(current_rule!=NULL); assert(current_rule!=NULL);
// populate all elements of the rule // populate all elements of the rule
addMessageToLog(QString("access list rule, action %1").arg(action.c_str())); addMessageToLog(
QString("filtering rule: access list %1, action %2")
.arg(QString::fromUtf8(current_ruleset->ruleset->getName().c_str()))
.arg(action.c_str()));
PolicyRule *rule = PolicyRule::cast(current_rule); PolicyRule *rule = PolicyRule::cast(current_rule);
src/unit_tests/ImporterTest/test_data/ios.result
+79 -47
View File
@@ -1,47 +1,79 @@
Host name: "c3620" 10: Host name: "c3620"
New interface: FastEthernet0/0 104: New interface: FastEthernet0/0
Interface address: 192.168.100.100/255.255.255.0 105: Interface address: 192.168.100.100/255.255.255.0
Interface address: 10.3.14.201/255.255.255.0 106: Interface address: 10.3.14.201/255.255.255.0
Interface FastEthernet0/0 ruleset fe0_0_acl_in direction 'in' 107: Interface FastEthernet0/0 ruleset fe0_0_acl_in direction 'in'
Interface FastEthernet0/0 ruleset fe0_0_acl_out direction 'out' 108: Interface FastEthernet0/0 ruleset fe0_0_acl_out direction 'out'
New interface: Ethernet1/0 113: New interface: Ethernet1/0
Interface comment: Test [ test ] { test } ( and one more test) / weird:characters#$%^&*/ 114: Interface comment: Test [ test ] { test } ( and one more test) / weird:characters#$%^&*/
Interface address: 192.168.171.2/255.255.255.0 115: Interface address: 192.168.171.2/255.255.255.0
Interface Ethernet1/0 ruleset e1_0_acl_in direction 'in' 116: Interface Ethernet1/0 ruleset e1_0_acl_in direction 'in'
Interface Ethernet1/0 ruleset e1_0_acl_out direction 'out' 117: Interface Ethernet1/0 ruleset e1_0_acl_out direction 'out'
New interface: Serial1/0 123: New interface: Serial1/0
New interface: Ethernet1/1 129: New interface: Ethernet1/1
Interface address: 10.10.10.10/255.255.255.0 130: Interface address: 10.10.10.10/255.255.255.0
Interface Ethernet1/1 ruleset acl_133 direction 'in' 134: Interface Ethernet1/1 ruleset acl_133 direction 'in'
Interface Ethernet1/1 ruleset acl_133 direction 'out' 135: Interface Ethernet1/1 ruleset acl_133 direction 'out'
New interface: Ethernet1/2 139: New interface: Ethernet1/2
Interface address: 10.10.20.20/255.255.255.0 140: Interface address: 10.10.20.20/255.255.255.0
Interface Ethernet1/2 ruleset acl_133 direction 'in' 145: Interface Ethernet1/2 ruleset acl_133 direction 'in'
Interface Ethernet1/2 ruleset acl_133 direction 'out' 146: Interface Ethernet1/2 ruleset acl_133 direction 'out'
Ruleset: e1_0_acl_in 175: access list rule: access list e1_0_acl_in, action deny
Ruleset: e1_0_acl_out 176: access list rule: access list e1_0_acl_in, action permit
Ruleset: fe0_0_acl_in 177: access list rule: access list e1_0_acl_in, action permit
Ruleset: fe0_0_acl_out 178: access list rule: access list e1_0_acl_in, action permit
Ruleset: outside 179: access list rule: access list e1_0_acl_in, action deny
Rule comment: / / path1/path2/path3 182: access list rule: access list e1_0_acl_out, action permit
Rule comment: access list comment 183: access list rule: access list e1_0_acl_out, action deny
Ruleset: tmp_acl 186: access list rule: access list fe0_0_acl_in, action permit
Ruleset: acl_133 187: access list rule: access list fe0_0_acl_in, action permit
Ruleset: acl_133 188: access list rule: access list fe0_0_acl_in, action permit
Ruleset: acl_133 189: access list rule: access list fe0_0_acl_in, action deny
Ruleset: acl_144 192: access list rule: access list fe0_0_acl_out, action permit
Ruleset: acl_144 193: access list rule: access list fe0_0_acl_out, action deny
Ruleset: acl_144 196: Rule comment: / / path1/path2/path3
Ruleset: acl_144 197: Rule comment: access list comment
Ruleset: acl_144 199: access list rule: access list outside, action permit
Ruleset: acl_144 201: access list rule: access list outside, action permit
Ruleset: acl_144 203: access list rule: access list outside, action permit
Ruleset: acl_144 205: access list rule: access list outside, action permit
Ruleset: acl_199 206: access list rule: access list outside, action deny
Ruleset: acl_199 208: access list rule: access list outside, action permit
Ruleset: acl_1300 210: access list rule: access list outside, action permit
Rule comment: Standard access lists are 1 to 99 and 1300 to 1999 211: access list rule: access list outside, action permit
Ruleset: acl_1300 214: access list rule: access list outside, action deny
Ruleset: acl_1300 215: access list rule: access list outside, action deny
Ruleset: acl_1300 216: access list rule: access list outside, action deny
Ruleset: acl_1300 217: access list rule: access list outside, action deny
219: access list rule: access list outside, action permit
220: access list rule: access list outside, action permit
222: access list rule: access list outside, action permit
224: access list rule: access list outside, action permit
226: access list rule: access list outside, action permit
227: access list rule: access list outside, action permit
228: access list rule: access list outside, action permit
232: access list rule: access list outside, action permit
233: access list rule: access list outside, action permit
234: access list rule: access list outside, action permit
236: access list rule: access list outside, action permit
237: access list rule: access list outside, action deny
240: access list rule: access list tmp_acl, action permit
241: access list rule: access list tmp_acl, action deny
243: access list rule: access list acl_133, action permit
244: access list rule: access list acl_133, action permit
245: access list rule: access list acl_133, action deny
246: access list rule: access list acl_144, action permit
247: access list rule: access list acl_144, action permit
248: access list rule: access list acl_144, action permit
249: access list rule: access list acl_144, action permit
250: access list rule: access list acl_144, action permit
251: access list rule: access list acl_144, action permit
252: access list rule: access list acl_144, action permit
253: access list rule: access list acl_144, action permit
254: access list rule: access list acl_199, action permit
255: access list rule: access list acl_199, action permit
257: Rule comment: Standard access lists are 1 to 99 and 1300 to 1999
258: access list rule: access list acl_1300, action permit
259: access list rule: access list acl_1300, action permit
260: access list rule: access list acl_1300, action permit
261: access list rule: access list acl_1300, action permit
src/unit_tests/ImporterTest/test_data/ipt.fwb
+5 -5
View File
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="utf-8"?> <?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd"> <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="18" lastModified="1300949604" id="root"> <FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="18" lastModified="1302063030" id="root">
<Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True"> <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
<AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/> <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
<AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/> <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -3051,7 +3051,7 @@
<Option name="tagobject_id"></Option> <Option name="tagobject_id"></Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule id="id1612" disabled="False" group="" log="False" position="48" action="Branch" direction="Both" comment="Chain user_chain. &#10;Original rule combines match of tcp/udp/icmp &#10;protocols with two or more module matches, such as &#10;module 'mark', 'recent' or 'length'. Use additional &#10;branches to implement this complex match.&#10;Created during import of line 206"> <PolicyRule id="id1612" disabled="False" group="" log="False" position="48" action="Branch" direction="Both" comment="Chain user_chain. &#10;Created during import of line 206&#10;Error: Original rule combines match of tcp/udp/icmp protocols with two or more module matches, such as module 'mark', 'recent' or 'length'. Use additional branches to implement this complex match.">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="sysid0"/> <ObjectRef ref="sysid0"/>
</Src> </Src>
@@ -3074,7 +3074,7 @@
<Option name="tagobject_id"></Option> <Option name="tagobject_id"></Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule id="id1624" disabled="False" group="" log="False" position="49" action="Branch" direction="Both" comment="Chain user_chain. &#10;Original rule combines match of tcp/udp/icmp &#10;protocols with two or more module matches, such as &#10;module 'mark', 'recent' or 'length'. Use additional &#10;branches to implement this complex match.&#10;Created during import of line 207"> <PolicyRule id="id1624" disabled="False" group="" log="False" position="49" action="Branch" direction="Both" comment="Chain user_chain. &#10;Created during import of line 207&#10;Error: Original rule combines match of tcp/udp/icmp protocols with two or more module matches, such as module 'mark', 'recent' or 'length'. Use additional branches to implement this complex match.">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="sysid0"/> <ObjectRef ref="sysid0"/>
</Src> </Src>
@@ -3755,7 +3755,7 @@
<RuleSetOptions/> <RuleSetOptions/>
</Policy> </Policy>
<Policy id="id2003" name="Mangle" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True"> <Policy id="id2003" name="Mangle" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<PolicyRule id="id2005" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Warning: Line 220: Can not reproduce default action in table 'mangle' chain 'FORWARD'.&#10;(Generated rule may not generate equivalent iptables command when compiled)"> <PolicyRule id="id2005" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Warning: Line 220: Can not reproduce default action in table 'mangle' chain 'FORWARD'. (Generated rule may not generate equivalent iptables command when compiled)">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="sysid0"/> <ObjectRef ref="sysid0"/>
</Src> </Src>
@@ -3776,7 +3776,7 @@
<Option name="stateless">True</Option> <Option name="stateless">True</Option>
</PolicyRuleOptions> </PolicyRuleOptions>
</PolicyRule> </PolicyRule>
<PolicyRule id="id2017" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Warning: Line 219: Can not reproduce default action in table 'mangle' chain 'INPUT'.&#10;(Generated rule may not generate equivalent iptables command when compiled)"> <PolicyRule id="id2017" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Warning: Line 219: Can not reproduce default action in table 'mangle' chain 'INPUT'. (Generated rule may not generate equivalent iptables command when compiled)">
<Src neg="False"> <Src neg="False">
<ObjectRef ref="sysid0"/> <ObjectRef ref="sysid0"/>
</Src> </Src>
src/unit_tests/ImporterTest/test_data/ipt.result
+66 -70
View File
@@ -1,70 +1,66 @@
Ruleset: filter / INPUT 3: New ruleset: filter / INPUT
Default action: Deny 3: Default action: Deny
Ruleset: filter / FORWARD 4: New ruleset: filter / FORWARD
Default action: Deny 4: Default action: Deny
Ruleset: filter / OUTPUT 5: New ruleset: filter / OUTPUT
Default action: Accept 5: Default action: Accept
Ruleset: filter / user_chain 6: New ruleset: filter / user_chain
Default action: Deny 6: Default action: Deny
Warning: Line 9: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking. 9: Warning: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking.
Warning: Line 12: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking. 12: Warning: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking.
Warning: Line 13: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking. 13: Warning: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking.
Warning: Line 14: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking. 14: Warning: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking.
Created branch INPUT_state_match_0 18: Created branch INPUT_state_match_0
Warning: Line 18: Rule matches combination of states 'NEW,ESTABLISHED'. Iptables rules generated by fwbuilder can be stateless (match no state) or stateful (match state NEW). Fwbuilder also adds a rule at the top of the script to match states ESTABLISHED,RELATED. Combination of states 'NEW,ESTABLISHED' does not fit these standard cases and to match it, the program created new Custom Service object. This may require manual checking. 18: Warning: Rule matches combination of states 'NEW,ESTABLISHED'. Iptables rules generated by fwbuilder can be stateless (match no state) or stateful (match state NEW). Fwbuilder also adds a rule at the top of the script to match states ESTABLISHED,RELATED. Combination of states 'NEW,ESTABLISHED' does not fit these standard cases and to match it, the program created new Custom Service object. This may require manual checking.
Created branch OUTPUT_established_1 23: Created branch OUTPUT_established_1
Warning: Line 23: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking. 23: Warning: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking.
Created branch OUTPUT_established_2 28: Created branch OUTPUT_established_2
Warning: Line 28: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking. 28: Warning: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking.
Warning: Line 31: Using automatic rule controlled by option 'Drop packet that do not match any known connection' to match state INVALID 31: Warning: Using automatic rule controlled by option 'Drop packet that do not match any known connection' to match state INVALID
Warning: Line 34: Using automatic rule controlled by option 'Drop packet that do not match any known connection' to match state INVALID 34: Warning: Using automatic rule controlled by option 'Drop packet that do not match any known connection' to match state INVALID
New interface: lo 37: New interface: lo
Created branch Policy_eth1 42: Created branch Policy_eth1
New interface: eth1 42: New interface: eth1
New interface: eth0 42: New interface: eth0
Warning: Line 42: Creating branch ruleset 'Policy_eth1' to match inbound and outbound interfaces -i eth0 -o eth1 42: Warning: Creating branch ruleset 'Policy_eth1' to match inbound and outbound interfaces -i eth0 -o eth1
Warning: Line 103: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking. 103: Warning: Rule matches states 'RELATED,ESTABLISHED'. Consider using automatic rule controlled by the checkbox in the firewall settings dialog. Automatic rule matches in all standard chains which may be different from the original imported configuration. This requires manual checking.
Created branch user_chain_42_mod_match 191: Created branch user_chain_42_mod_match
Created branch user_chain_43_mod_match 195: Created branch user_chain_43_mod_match
Created branch user_chain_44_mod_match 196: Created branch user_chain_44_mod_match
Created branch user_chain_45_mod_match 197: Created branch user_chain_45_mod_match
Created branch user_chain_46_mod_match 200: Created branch user_chain_46_mod_match
Created branch user_chain_47_mod_match 203: Created branch user_chain_47_mod_match
Created branch user_chain_48_mod_match 206: Created branch user_chain_48_mod_match
Parser error: Line 206: Original rule combines match of tcp/udp/icmp 206: Error: Original rule combines match of tcp/udp/icmp protocols with two or more module matches, such as module 'mark', 'recent' or 'length'. Use additional branches to implement this complex match.
protocols with two or more module matches, such as 206: Error: Error: Original rule combines match of tcp/udp/icmp protocols with two or more module matches, such as module 'mark', 'recent' or 'length'. Use additional branches to implement this complex match.
module 'mark', 'recent' or 'length'. Use additional 207: Created branch user_chain_49_mod_match
branches to implement this complex match. 207: Error: Original rule combines match of tcp/udp/icmp protocols with two or more module matches, such as module 'mark', 'recent' or 'length'. Use additional branches to implement this complex match.
Created branch user_chain_49_mod_match 207: Error: Error: Original rule combines match of tcp/udp/icmp protocols with two or more module matches, such as module 'mark', 'recent' or 'length'. Use additional branches to implement this complex match.
Parser error: Line 207: Original rule combines match of tcp/udp/icmp 218: New ruleset: mangle / PREROUTING
protocols with two or more module matches, such as 218: Default action: Accept
module 'mark', 'recent' or 'length'. Use additional 219: New ruleset: mangle / INPUT
branches to implement this complex match. 219: Default action: Accept
Ruleset: mangle / PREROUTING 220: New ruleset: mangle / FORWARD
Default action: Accept 220: Default action: Accept
Ruleset: mangle / INPUT 221: New ruleset: mangle / OUTPUT
Default action: Accept 221: Default action: Accept
Ruleset: mangle / FORWARD 222: New ruleset: mangle / POSTROUTING
Default action: Accept 222: Default action: Accept
Ruleset: mangle / OUTPUT 235: Warning: Skipping command with '-j CONNMARK --restore-mark' This rule is generated automatically.
Default action: Accept 239: Warning: Turned option on in previous rule with action Mark for '-j CONNMARK --save-mark'
Ruleset: mangle / POSTROUTING 243: New interface: eth2
Default action: Accept 253: New ruleset: nat / PREROUTING
Warning: Line 235: Skip command with '-j CONNMARK --restore-mark' This rule is generated automatically. 253: Default action: Accept
Warning: Line 239: Turned option on in previous rule with action Mark for '-j CONNMARK --save-mark' 254: New ruleset: nat / POSTROUTING
New interface: eth2 254: Default action: Accept
Ruleset: nat / PREROUTING 255: New ruleset: nat / OUTPUT
Default action: Accept 255: Default action: Accept
Ruleset: nat / POSTROUTING 259: New interface: eth+
Default action: Accept 286: Warning: Line 5: Added rule to reproduce default policy ACCEPT in filter/OUTPUT
Ruleset: nat / OUTPUT 286: Warning: Line 220: Can not reproduce default action in table 'mangle' chain 'FORWARD'. (Generated rule may not generate equivalent iptables command when compiled)
Default action: Accept 286: Warning: Line 220: Added rule to reproduce default policy ACCEPT in mangle/FORWARD
New interface: eth+ 286: Warning: Line 219: Can not reproduce default action in table 'mangle' chain 'INPUT'. (Generated rule may not generate equivalent iptables command when compiled)
Warning: Line 5: Added rule to reproduce default policy ACCEPT in filter/OUTPUT 286: Warning: Line 219: Added rule to reproduce default policy ACCEPT in mangle/INPUT
Warning: Line 220: Can not reproduce default action in table 'mangle' chain 'FORWARD'. 286: Warning: Line 221: Added rule to reproduce default policy ACCEPT in mangle/OUTPUT
(Generated rule may not generate equivalent iptables command when compiled)Warning: Line 220: Added rule to reproduce default policy ACCEPT in mangle/FORWARD 286: Warning: Line 222: Added rule to reproduce default policy ACCEPT in mangle/POSTROUTING
Warning: Line 219: Can not reproduce default action in table 'mangle' chain 'INPUT'. 286: Warning: Line 218: Added rule to reproduce default policy ACCEPT in mangle/PREROUTING
(Generated rule may not generate equivalent iptables command when compiled)Warning: Line 219: Added rule to reproduce default policy ACCEPT in mangle/INPUT
Warning: Line 221: Added rule to reproduce default policy ACCEPT in mangle/OUTPUT
Warning: Line 222: Added rule to reproduce default policy ACCEPT in mangle/POSTROUTING
Warning: Line 218: Added rule to reproduce default policy ACCEPT in mangle/PREROUTING
src/unit_tests/PIXImporterTest/PIXImporterTest.pro
+1
View File
@@ -5,3 +5,4 @@ HEADERS += PIXImporterTest.h
SOURCES += main_PIXImporterTest.cpp \ SOURCES += main_PIXImporterTest.cpp \
PIXImporterTest.cpp PIXImporterTest.cpp
STATIC_LIBS += ../../libgui/libgui.a
src/unit_tests/PIXImporterTest/test_data/asa8.0.output
+17 -17
View File
@@ -37,36 +37,36 @@ Warning: interface Ethernet4 was not imported because it is in "shutdown" mode
99: Object Group (protocol) proto-tcp 99: Object Group (protocol) proto-tcp
101: Object Group (protocol) proto-udp 101: Object Group (protocol) proto-udp
108: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 108: Interface Ethernet1 ruleset icmp_commands_outside direction 'in'
108: access list rule, action permit 108: filtering rule: access list icmp_commands_outside, action permit
109: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 109: Interface Ethernet1 ruleset icmp_commands_outside direction 'in'
109: access list rule, action permit 109: filtering rule: access list icmp_commands_outside, action permit
110: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 110: Interface Ethernet1 ruleset icmp_commands_outside direction 'in'
110: access list rule, action permit 110: filtering rule: access list icmp_commands_outside, action permit
111: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 111: Interface Ethernet1 ruleset icmp_commands_outside direction 'in'
111: access list rule, action permit 111: filtering rule: access list icmp_commands_outside, action permit
112: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 112: Interface Ethernet1 ruleset icmp_commands_outside direction 'in'
112: access list rule, action permit 112: filtering rule: access list icmp_commands_outside, action permit
113: Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 113: Interface Ethernet1 ruleset icmp_commands_outside direction 'in'
113: access list rule, action permit 113: filtering rule: access list icmp_commands_outside, action permit
114: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 114: Interface Ethernet0 ruleset icmp_commands_inside direction 'in'
114: access list rule, action permit 114: filtering rule: access list icmp_commands_inside, action permit
115: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 115: Interface Ethernet0 ruleset icmp_commands_inside direction 'in'
115: access list rule, action permit 115: filtering rule: access list icmp_commands_inside, action permit
116: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 116: Interface Ethernet0 ruleset icmp_commands_inside direction 'in'
116: access list rule, action permit 116: filtering rule: access list icmp_commands_inside, action permit
117: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 117: Interface Ethernet0 ruleset icmp_commands_inside direction 'in'
117: access list rule, action permit 117: filtering rule: access list icmp_commands_inside, action permit
118: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 118: Interface Ethernet0 ruleset icmp_commands_inside direction 'in'
118: access list rule, action permit 118: filtering rule: access list icmp_commands_inside, action permit
119: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 119: Interface Ethernet0 ruleset icmp_commands_inside direction 'in'
119: access list rule, action permit 119: filtering rule: access list icmp_commands_inside, action permit
120: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 120: Interface Ethernet0 ruleset icmp_commands_inside direction 'in'
120: access list rule, action permit 120: filtering rule: access list icmp_commands_inside, action permit
121: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 121: Interface Ethernet0 ruleset icmp_commands_inside direction 'in'
121: access list rule, action permit 121: filtering rule: access list icmp_commands_inside, action permit
122: Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 122: Interface Ethernet0 ruleset icmp_commands_inside direction 'in'
122: access list rule, action permit 122: filtering rule: access list icmp_commands_inside, action permit
135: Interface Ethernet0 ruleset telnet_commands_inside direction 'in' 135: Interface Ethernet0 ruleset telnet_commands_inside direction 'in'
135: access list rule, action permit 135: filtering rule: access list telnet_commands_inside, action permit
137: Interface Ethernet0 ruleset ssh_commands_inside direction 'in' 137: Interface Ethernet0 ruleset ssh_commands_inside direction 'in'
137: access list rule, action permit 137: filtering rule: access list ssh_commands_inside, action permit
src/unit_tests/PIXImporterTest/test_data/asa8.3-acl-object-groups.output
+26 -26
View File
@@ -20,36 +20,36 @@
104: Object Group (protocol) pg1 104: Object Group (protocol) pg1
110: Object Group (network) src-network-group-1 110: Object Group (network) src-network-group-1
114: Object Group (network) dst-network-group-1 114: Object Group (network) dst-network-group-1
122: access list rule, action permit 122: filtering rule: access list inside_in, action permit
125: access list rule, action permit 125: filtering rule: access list inside_in, action permit
127: access list rule, action permit 127: filtering rule: access list inside_in, action permit
129: access list rule, action permit 129: filtering rule: access list inside_in, action permit
131: access list rule, action permit 131: filtering rule: access list inside_in, action permit
133: access list rule, action permit 133: filtering rule: access list inside_in, action permit
138: access list rule, action permit 138: filtering rule: access list inside_in, action permit
143: access list rule, action permit 143: filtering rule: access list inside_in, action permit
145: access list rule, action permit 145: filtering rule: access list inside_in, action permit
147: access list rule, action permit 147: filtering rule: access list inside_in, action permit
149: access list rule, action permit 149: filtering rule: access list inside_in, action permit
155: access list rule, action permit 155: filtering rule: access list inside_in, action permit
155: Object Group (service) srv-group-1-mirror 155: Object Group (service) srv-group-1-mirror
162: access list rule, action permit 162: filtering rule: access list inside_in, action permit
164: access list rule, action permit 164: filtering rule: access list inside_in, action permit
166: access list rule, action permit 166: filtering rule: access list inside_in, action permit
168: access list rule, action permit 168: filtering rule: access list inside_in, action permit
170: access list rule, action permit 170: filtering rule: access list inside_in, action permit
175: access list rule, action permit 175: filtering rule: access list inside_in, action permit
177: access list rule, action permit 177: filtering rule: access list inside_in, action permit
179: access list rule, action permit 179: filtering rule: access list inside_in, action permit
181: access list rule, action permit 181: filtering rule: access list inside_in, action permit
188: access list rule, action permit 188: filtering rule: access list inside_in, action permit
188: Object Group (service) srv-group-1-mirror 188: Object Group (service) srv-group-1-mirror
190: access list rule, action permit 190: filtering rule: access list inside_in, action permit
190: Object Group (service) srv-group-1-mirror 190: Object Group (service) srv-group-1-mirror
192: access list rule, action permit 192: filtering rule: access list inside_in, action permit
192: Object Group (service) srv-group-1-mirror 192: Object Group (service) srv-group-1-mirror
194: access list rule, action permit 194: filtering rule: access list inside_in, action permit
194: Object Group (service) srv-group-1-mirror 194: Object Group (service) srv-group-1-mirror
196: access list rule, action permit 196: filtering rule: access list inside_in, action permit
196: Object Group (service) srv-group-1-mirror 196: Object Group (service) srv-group-1-mirror
199: Interface Vlan1 ruleset inside_in direction 'in' 199: Interface Vlan1 ruleset inside_in direction 'in'
src/unit_tests/PIXImporterTest/test_data/asa8.3-acl.output
+70 -70
View File
@@ -27,86 +27,86 @@
129: Object Group (service) test-service-3 129: Object Group (service) test-service-3
133: Object Group (service) test-service-4 133: Object Group (service) test-service-4
144: Rule comment: 0 ( global ) 144: Rule comment: 0 ( global )
148: access list rule, action permit 148: filtering rule: access list inside_in, action permit
149: access list rule, action permit 149: filtering rule: access list inside_in, action permit
150: access list rule, action permit 150: filtering rule: access list inside_in, action permit
151: access list rule, action permit 151: filtering rule: access list inside_in, action permit
152: access list rule, action permit 152: filtering rule: access list inside_in, action permit
154: access list rule, action permit 154: filtering rule: access list inside_in, action permit
155: access list rule, action permit 155: filtering rule: access list inside_in, action permit
156: access list rule, action permit 156: filtering rule: access list inside_in, action permit
157: access list rule, action permit 157: filtering rule: access list inside_in, action permit
158: access list rule, action permit 158: filtering rule: access list inside_in, action permit
159: access list rule, action permit 159: filtering rule: access list inside_in, action permit
160: access list rule, action permit 160: filtering rule: access list inside_in, action permit
161: access list rule, action permit 161: filtering rule: access list inside_in, action permit
162: access list rule, action permit 162: filtering rule: access list inside_in, action permit
163: access list rule, action permit 163: filtering rule: access list inside_in, action permit
164: access list rule, action permit 164: filtering rule: access list inside_in, action permit
165: access list rule, action permit 165: filtering rule: access list inside_in, action permit
166: access list rule, action permit 166: filtering rule: access list inside_in, action permit
167: access list rule, action permit 167: filtering rule: access list inside_in, action permit
168: access list rule, action permit 168: filtering rule: access list inside_in, action permit
171: access list rule, action permit 171: filtering rule: access list inside_in, action permit
172: Rule comment: 3 ( global ) 172: Rule comment: 3 ( global )
175: access list rule, action deny 175: filtering rule: access list inside_in, action deny
177: access list rule, action deny 177: filtering rule: access list inside_in, action deny
179: access list rule, action deny 179: filtering rule: access list inside_in, action deny
180: access list rule, action deny 180: filtering rule: access list inside_in, action deny
181: access list rule, action deny 181: filtering rule: access list inside_in, action deny
183: access list rule, action deny 183: filtering rule: access list inside_in, action deny
189: access list rule, action permit 189: filtering rule: access list inside_in, action permit
189: Object Group (service) id5102X14531.srv.tcp.0-mirror 189: Object Group (service) id5102X14531.srv.tcp.0-mirror
191: access list rule, action permit 191: filtering rule: access list inside_in, action permit
193: access list rule, action permit 193: filtering rule: access list inside_in, action permit
194: access list rule, action permit 194: filtering rule: access list inside_in, action permit
195: access list rule, action permit 195: filtering rule: access list inside_in, action permit
196: access list rule, action permit 196: filtering rule: access list inside_in, action permit
197: access list rule, action permit 197: filtering rule: access list inside_in, action permit
199: access list rule, action permit 199: filtering rule: access list inside_in, action permit
199: Object Group (service) id5102X14531.srv.tcp.0-mirror 199: Object Group (service) id5102X14531.srv.tcp.0-mirror
200: access list rule, action permit 200: filtering rule: access list inside_in, action permit
201: access list rule, action permit 201: filtering rule: access list inside_in, action permit
202: access list rule, action permit 202: filtering rule: access list inside_in, action permit
203: access list rule, action permit 203: filtering rule: access list inside_in, action permit
204: access list rule, action permit 204: filtering rule: access list inside_in, action permit
206: access list rule, action permit 206: filtering rule: access list inside_out, action permit
207: access list rule, action permit 207: filtering rule: access list inside_out, action permit
208: access list rule, action permit 208: filtering rule: access list inside_out, action permit
209: access list rule, action permit 209: filtering rule: access list inside_out, action permit
210: access list rule, action permit 210: filtering rule: access list inside_out, action permit
211: access list rule, action permit 211: filtering rule: access list inside_out, action permit
213: access list rule, action permit 213: filtering rule: access list inside_out, action permit
214: access list rule, action permit 214: filtering rule: access list inside_out, action permit
215: access list rule, action permit 215: filtering rule: access list inside_out, action permit
216: access list rule, action permit 216: filtering rule: access list inside_out, action permit
217: access list rule, action permit 217: filtering rule: access list inside_out, action permit
218: access list rule, action permit 218: filtering rule: access list inside_out, action permit
221: access list rule, action permit 221: filtering rule: access list inside_out, action permit
221: Error: tcp port name 'foo' is unknown 221: Error: tcp port name 'foo' is unknown
223: access list rule, action permit 223: filtering rule: access list inside_out, action permit
225: access list rule, action permit 225: filtering rule: access list inside_out, action permit
227: access list rule, action permit 227: filtering rule: access list inside_out, action permit
229: access list rule, action permit 229: filtering rule: access list inside_out, action permit
231: access list rule, action permit 231: filtering rule: access list inside_out, action permit
232: access list rule, action permit 232: filtering rule: access list inside_out, action permit
234: access list rule, action permit 234: filtering rule: access list outside_out, action permit
235: access list rule, action permit 235: filtering rule: access list outside_out, action permit
236: access list rule, action permit 236: filtering rule: access list outside_out, action permit
240: access list rule, action permit 240: filtering rule: access list outside_in, action permit
240: Object Group (service) test-service-1-mirror 240: Object Group (service) test-service-1-mirror
241: access list rule, action permit 241: filtering rule: access list outside_in, action permit
241: Object Group (service) test-service-2-mirror 241: Object Group (service) test-service-2-mirror
242: access list rule, action permit 242: filtering rule: access list outside_in, action permit
242: Object Group (service) test-service-3-mirror 242: Object Group (service) test-service-3-mirror
242: Object Group (service) test-service-1-mirror 242: Object Group (service) test-service-1-mirror
243: access list rule, action permit 243: filtering rule: access list outside_in, action permit
243: Object Group (service) test-service-4-mirror 243: Object Group (service) test-service-4-mirror
243: Object Group (service) test-service-1-mirror 243: Object Group (service) test-service-1-mirror
247: access list rule, action permit 247: filtering rule: access list outside_in, action permit
248: access list rule, action permit 248: filtering rule: access list outside_in, action permit
249: access list rule, action permit 249: filtering rule: access list outside_in, action permit
250: access list rule, action permit 250: filtering rule: access list outside_in, action permit
268: Interface Vlan1 ruleset inside_in direction 'in' 268: Interface Vlan1 ruleset inside_in direction 'in'
269: Interface Vlan1 ruleset inside_out direction 'out' 269: Interface Vlan1 ruleset inside_out direction 'out'
270: Interface Vlan2 ruleset outside_in direction 'in' 270: Interface Vlan2 ruleset outside_in direction 'in'
src/unit_tests/PIXImporterTest/test_data/asa8.3-objects-and-groups.output
+1 -1
View File
@@ -107,5 +107,5 @@
290: Object Group (icmp) ig3 290: Object Group (icmp) ig3
296: Object Group (service) id5102X14531.srv.tcp.0 296: Object Group (service) id5102X14531.srv.tcp.0
301: Object Group (service) tcp-udp-1 301: Object Group (service) tcp-udp-1
304: access list rule, action permit 304: filtering rule: access list inside_in, action permit
305: Interface Vlan1 ruleset inside_in direction 'in' 305: Interface Vlan1 ruleset inside_in direction 'in'
src/unit_tests/PIXImporterTest/test_data/asa8.3.output
+6 -6
View File
@@ -37,14 +37,14 @@ Warning: interface Ethernet0/7 was not imported because it is in "shutdown" mode
56: Named object (address) internal_subnet_2 56: Named object (address) internal_subnet_2
59: Named object (address) Internal_net 59: Named object (address) Internal_net
61: Named object (address) hostA:eth0 61: Named object (address) hostA:eth0
65: access list rule, action deny 65: filtering rule: access list outside_acl_in, action deny
84: Interface Vlan1 ruleset http_commands_inside direction 'in' 84: Interface Vlan1 ruleset http_commands_inside direction 'in'
84: access list rule, action permit 84: filtering rule: access list http_commands_inside, action permit
85: Interface Vlan1 ruleset http_commands_inside direction 'in' 85: Interface Vlan1 ruleset http_commands_inside direction 'in'
85: access list rule, action permit 85: filtering rule: access list http_commands_inside, action permit
86: Interface Vlan1 ruleset http_commands_inside direction 'in' 86: Interface Vlan1 ruleset http_commands_inside direction 'in'
86: access list rule, action permit 86: filtering rule: access list http_commands_inside, action permit
95: Interface Vlan1 ruleset ssh_commands_inside direction 'in' 95: Interface Vlan1 ruleset ssh_commands_inside direction 'in'
95: access list rule, action permit 95: filtering rule: access list ssh_commands_inside, action permit
96: Interface Vlan1 ruleset ssh_commands_inside direction 'in' 96: Interface Vlan1 ruleset ssh_commands_inside direction 'in'
96: access list rule, action permit 96: filtering rule: access list ssh_commands_inside, action permit
src/unit_tests/PIXImporterTest/test_data/pix6.output
+51 -51
View File
@@ -11,97 +11,97 @@
46: Object Group (service) outside.id12438X2458.srv.tcp.0 46: Object Group (service) outside.id12438X2458.srv.tcp.0
49: Object Group (service) outside.id12466X2458.srv.tcp.0 49: Object Group (service) outside.id12466X2458.srv.tcp.0
52: Rule comment: 0 ( ethernet0 ) 52: Rule comment: 0 ( ethernet0 )
53: access list rule, action deny 53: filtering rule: access list outside_acl_in, action deny
54: access list rule, action deny 54: filtering rule: access list outside_acl_in, action deny
55: Rule comment: 3 ( global ) 55: Rule comment: 3 ( global )
56: access list rule, action permit 56: filtering rule: access list outside_acl_in, action permit
58: Rule comment: 4 ( global ) 58: Rule comment: 4 ( global )
59: Rule comment: fw uses DHCP 59: Rule comment: fw uses DHCP
60: Rule comment: plus many DHCP requests 60: Rule comment: plus many DHCP requests
61: Rule comment: from cable modem 61: Rule comment: from cable modem
64: Rule comment: 6 ( global ) 64: Rule comment: 6 ( global )
65: access list rule, action deny 65: filtering rule: access list outside_acl_in, action deny
66: Rule comment: 7 ( global ) 66: Rule comment: 7 ( global )
67: access list rule, action permit 67: filtering rule: access list outside_acl_in, action permit
68: Rule comment: 10 ( global ) 68: Rule comment: 10 ( global )
69: Rule comment: using swatch to automatically 69: Rule comment: using swatch to automatically
70: Rule comment: block probing ssh connections , so no 70: Rule comment: block probing ssh connections , so no
71: Rule comment: need to limit 71: Rule comment: need to limit
72: access list rule, action permit 72: filtering rule: access list outside_acl_in, action permit
73: access list rule, action permit 73: filtering rule: access list outside_acl_in, action permit
75: Rule comment: 11 ( global ) 75: Rule comment: 11 ( global )
76: access list rule, action permit 76: filtering rule: access list outside_acl_in, action permit
77: access list rule, action permit 77: filtering rule: access list outside_acl_in, action permit
79: Rule comment: 17 ( global ) 79: Rule comment: 17 ( global )
80: access list rule, action permit 80: filtering rule: access list outside_acl_in, action permit
81: access list rule, action permit 81: filtering rule: access list outside_acl_in, action permit
82: Rule comment: 19 ( global ) 82: Rule comment: 19 ( global )
83: Rule comment: ' catch all' rule 83: Rule comment: ' catch all' rule
84: access list rule, action deny 84: filtering rule: access list outside_acl_in, action deny
85: Rule comment: 1 ( global ) 85: Rule comment: 1 ( global )
86: access list rule, action permit 86: filtering rule: access list inside_acl_in, action permit
87: access list rule, action permit 87: filtering rule: access list inside_acl_in, action permit
93: Rule comment: 5 ( global ) 93: Rule comment: 5 ( global )
94: access list rule, action permit 94: filtering rule: access list inside_acl_in, action permit
95: Rule comment: 6 ( global ) 95: Rule comment: 6 ( global )
96: access list rule, action deny 96: filtering rule: access list inside_acl_in, action deny
97: Rule comment: 7 ( global ) 97: Rule comment: 7 ( global )
98: access list rule, action permit 98: filtering rule: access list inside_acl_in, action permit
106: Rule comment: 17 ( global ) 106: Rule comment: 17 ( global )
107: access list rule, action permit 107: filtering rule: access list inside_acl_in, action permit
108: access list rule, action permit 108: filtering rule: access list inside_acl_in, action permit
109: Rule comment: 18 ( global ) 109: Rule comment: 18 ( global )
110: access list rule, action permit 110: filtering rule: access list inside_acl_in, action permit
111: Rule comment: 19 ( global ) 111: Rule comment: 19 ( global )
112: Rule comment: ' catch all' rule 112: Rule comment: ' catch all' rule
113: access list rule, action deny 113: filtering rule: access list inside_acl_in, action deny
114: access list rule, action permit 114: filtering rule: access list id12594X2458.0, action permit
115: access list rule, action permit 115: filtering rule: access list id12594X2458.1, action permit
116: access list rule, action permit 116: filtering rule: access list id12594X2458.2, action permit
117: access list rule, action permit 117: filtering rule: access list id12594X2458.3, action permit
118: access list rule, action permit 118: filtering rule: access list id12626X2458.0, action permit
119: access list rule, action permit 119: filtering rule: access list id12626X2458.1, action permit
120: access list rule, action permit 120: filtering rule: access list id12626X2458.2, action permit
121: access list rule, action permit 121: filtering rule: access list id12642X2458.0, action permit
122: access list rule, action permit 122: filtering rule: access list id12656X2458.0, action permit
123: access list rule, action permit 123: filtering rule: access list id12670X2458.0, action permit
124: access list rule, action permit 124: filtering rule: access list id12684X2458.0, action permit
125: access list rule, action permit 125: filtering rule: access list id12743X2458.0, action permit
127: Interface ethernet0 ruleset outside_acl_in direction 'in' 127: Interface ethernet0 ruleset outside_acl_in direction 'in'
128: Interface ethernet1 ruleset inside_acl_in direction 'in' 128: Interface ethernet1 ruleset inside_acl_in direction 'in'
140: Interface ethernet0 ruleset icmp_commands_outside direction 'in' 140: Interface ethernet0 ruleset icmp_commands_outside direction 'in'
140: access list rule, action permit 140: filtering rule: access list icmp_commands_outside, action permit
141: Interface ethernet0 ruleset icmp_commands_outside direction 'in' 141: Interface ethernet0 ruleset icmp_commands_outside direction 'in'
141: access list rule, action permit 141: filtering rule: access list icmp_commands_outside, action permit
142: Interface ethernet0 ruleset icmp_commands_outside direction 'in' 142: Interface ethernet0 ruleset icmp_commands_outside direction 'in'
142: access list rule, action permit 142: filtering rule: access list icmp_commands_outside, action permit
143: Interface ethernet0 ruleset icmp_commands_outside direction 'in' 143: Interface ethernet0 ruleset icmp_commands_outside direction 'in'
143: access list rule, action permit 143: filtering rule: access list icmp_commands_outside, action permit
144: Interface ethernet0 ruleset icmp_commands_outside direction 'in' 144: Interface ethernet0 ruleset icmp_commands_outside direction 'in'
144: access list rule, action permit 144: filtering rule: access list icmp_commands_outside, action permit
145: Interface ethernet0 ruleset icmp_commands_outside direction 'in' 145: Interface ethernet0 ruleset icmp_commands_outside direction 'in'
145: access list rule, action permit 145: filtering rule: access list icmp_commands_outside, action permit
146: Interface ethernet1 ruleset icmp_commands_inside direction 'in' 146: Interface ethernet1 ruleset icmp_commands_inside direction 'in'
146: access list rule, action permit 146: filtering rule: access list icmp_commands_inside, action permit
147: Interface ethernet1 ruleset icmp_commands_inside direction 'in' 147: Interface ethernet1 ruleset icmp_commands_inside direction 'in'
147: access list rule, action permit 147: filtering rule: access list icmp_commands_inside, action permit
148: Interface ethernet1 ruleset icmp_commands_inside direction 'in' 148: Interface ethernet1 ruleset icmp_commands_inside direction 'in'
148: access list rule, action permit 148: filtering rule: access list icmp_commands_inside, action permit
149: Interface ethernet1 ruleset icmp_commands_inside direction 'in' 149: Interface ethernet1 ruleset icmp_commands_inside direction 'in'
149: access list rule, action permit 149: filtering rule: access list icmp_commands_inside, action permit
150: Interface ethernet1 ruleset icmp_commands_inside direction 'in' 150: Interface ethernet1 ruleset icmp_commands_inside direction 'in'
150: access list rule, action permit 150: filtering rule: access list icmp_commands_inside, action permit
151: Interface ethernet1 ruleset icmp_commands_inside direction 'in' 151: Interface ethernet1 ruleset icmp_commands_inside direction 'in'
151: access list rule, action permit 151: filtering rule: access list icmp_commands_inside, action permit
152: Interface ethernet1 ruleset icmp_commands_inside direction 'in' 152: Interface ethernet1 ruleset icmp_commands_inside direction 'in'
152: access list rule, action permit 152: filtering rule: access list icmp_commands_inside, action permit
153: Interface ethernet1 ruleset icmp_commands_inside direction 'in' 153: Interface ethernet1 ruleset icmp_commands_inside direction 'in'
153: access list rule, action permit 153: filtering rule: access list icmp_commands_inside, action permit
154: Interface ethernet1 ruleset icmp_commands_inside direction 'in' 154: Interface ethernet1 ruleset icmp_commands_inside direction 'in'
154: access list rule, action permit 154: filtering rule: access list icmp_commands_inside, action permit
156: Interface ethernet1 ruleset telnet_commands_inside direction 'in' 156: Interface ethernet1 ruleset telnet_commands_inside direction 'in'
156: access list rule, action permit 156: filtering rule: access list telnet_commands_inside, action permit
158: Interface ethernet1 ruleset ssh_commands_inside direction 'in' 158: Interface ethernet1 ruleset ssh_commands_inside direction 'in'
158: access list rule, action permit 158: filtering rule: access list ssh_commands_inside, action permit
159: Interface ethernet1 ruleset ssh_commands_inside direction 'in' 159: Interface ethernet1 ruleset ssh_commands_inside direction 'in'
159: access list rule, action permit 159: filtering rule: access list ssh_commands_inside, action permit
src/unit_tests/PIXImporterTest/test_data/pix7-nat.output
+21 -21
View File
@@ -33,24 +33,24 @@ Warning: interface Ethernet6 was not imported because it is in "shutdown" mode
79: Object Group (network) outside.id12051X6282.src.net.2 79: Object Group (network) outside.id12051X6282.src.net.2
83: Object Group (network) network-zone-inside 83: Object Group (network) network-zone-inside
85: Object Group (network) network-zone-dmz20 85: Object Group (network) network-zone-dmz20
89: access list rule, action deny 89: filtering rule: access list outside_in, action deny
90: access list rule, action deny 90: filtering rule: access list outside_in, action deny
91: access list rule, action deny 91: filtering rule: access list outside_in, action deny
92: access list rule, action deny 92: filtering rule: access list outside_in, action deny
93: access list rule, action permit 93: filtering rule: access list inside_out, action permit
94: access list rule, action permit 94: filtering rule: access list inside_out, action permit
95: access list rule, action permit 95: filtering rule: access list inside_out, action permit
96: access list rule, action permit 96: filtering rule: access list inside_out, action permit
97: access list rule, action deny 97: filtering rule: access list inside_out, action deny
98: access list rule, action deny 98: filtering rule: access list inside_in, action deny
99: access list rule, action deny 99: filtering rule: access list inside_in, action deny
100: access list rule, action deny 100: filtering rule: access list inside_in, action deny
101: access list rule, action permit 101: filtering rule: access list inside_in, action permit
102: access list rule, action deny 102: filtering rule: access list inside_in, action deny
104: access list rule, action permit 104: filtering rule: access list id12251X6282.0, action permit
106: access list rule, action permit 106: filtering rule: access list id12594X2458.0, action permit
109: access list rule, action permit 109: filtering rule: access list WEB, action permit
111: access list rule, action permit 111: filtering rule: access list NET1, action permit
138: Global address pool: number 1, interface outside, address range interface-interface, netmask 255.255.255.255 138: Global address pool: number 1, interface outside, address range interface-interface, netmask 255.255.255.255
139: Source translation rule ("nat" command) 139: Source translation rule ("nat" command)
141: Global address pool: number 2, interface outside, address range 192.0.2.10-192.0.2.10, netmask 255.255.255.255 141: Global address pool: number 2, interface outside, address range 192.0.2.10-192.0.2.10, netmask 255.255.255.255
@@ -73,8 +73,8 @@ Warning: interface Ethernet6 was not imported because it is in "shutdown" mode
165: Interface Ethernet1 ruleset inside_in direction 'in' 165: Interface Ethernet1 ruleset inside_in direction 'in'
166: Interface Ethernet1 ruleset inside_out direction 'out' 166: Interface Ethernet1 ruleset inside_out direction 'out'
207: Interface Ethernet1 ruleset ssh_commands_inside direction 'in' 207: Interface Ethernet1 ruleset ssh_commands_inside direction 'in'
207: access list rule, action permit 207: filtering rule: access list ssh_commands_inside, action permit
208: Interface Ethernet1 ruleset ssh_commands_inside direction 'in' 208: Interface Ethernet1 ruleset ssh_commands_inside direction 'in'
208: access list rule, action permit 208: filtering rule: access list ssh_commands_inside, action permit
209: Interface Ethernet0.101 ruleset ssh_commands_outside direction 'in' 209: Interface Ethernet0.101 ruleset ssh_commands_outside direction 'in'
209: access list rule, action permit 209: filtering rule: access list ssh_commands_outside, action permit
src/unit_tests/PIXImporterTest/test_data/pix7.output
+18 -18
View File
@@ -31,29 +31,29 @@ Warning: interface Ethernet6 was not imported because it is in "shutdown" mode
70: Object Group (network) outside.id12051X6282.src.net.0 70: Object Group (network) outside.id12051X6282.src.net.0
73: Object Group (network) outside.id12051X6282.src.net.1 73: Object Group (network) outside.id12051X6282.src.net.1
78: Object Group (network) outside.id12051X6282.src.net.2 78: Object Group (network) outside.id12051X6282.src.net.2
81: access list rule, action deny 81: filtering rule: access list outside_in, action deny
82: access list rule, action deny 82: filtering rule: access list outside_in, action deny
83: access list rule, action deny 83: filtering rule: access list outside_in, action deny
84: access list rule, action deny 84: filtering rule: access list outside_in, action deny
85: access list rule, action permit 85: filtering rule: access list inside_out, action permit
86: access list rule, action permit 86: filtering rule: access list inside_out, action permit
87: access list rule, action permit 87: filtering rule: access list inside_out, action permit
88: access list rule, action permit 88: filtering rule: access list inside_out, action permit
89: access list rule, action deny 89: filtering rule: access list inside_out, action deny
90: access list rule, action deny 90: filtering rule: access list inside_in, action deny
91: access list rule, action deny 91: filtering rule: access list inside_in, action deny
92: access list rule, action deny 92: filtering rule: access list inside_in, action deny
93: access list rule, action permit 93: filtering rule: access list inside_in, action permit
94: access list rule, action deny 94: filtering rule: access list inside_in, action deny
95: access list rule, action permit 95: filtering rule: access list id12251X6282.0, action permit
97: Interface Ethernet1 ruleset inside_in direction 'in' 97: Interface Ethernet1 ruleset inside_in direction 'in'
98: Interface Ethernet0.101 ruleset outside_in direction 'in' 98: Interface Ethernet0.101 ruleset outside_in direction 'in'
123: Interface Ethernet0.101 ruleset outside_in direction 'in' 123: Interface Ethernet0.101 ruleset outside_in direction 'in'
124: Interface Ethernet1 ruleset inside_in direction 'in' 124: Interface Ethernet1 ruleset inside_in direction 'in'
125: Interface Ethernet1 ruleset inside_out direction 'out' 125: Interface Ethernet1 ruleset inside_out direction 'out'
164: Interface Ethernet1 ruleset ssh_commands_inside direction 'in' 164: Interface Ethernet1 ruleset ssh_commands_inside direction 'in'
164: access list rule, action permit 164: filtering rule: access list ssh_commands_inside, action permit
165: Interface Ethernet1 ruleset ssh_commands_inside direction 'in' 165: Interface Ethernet1 ruleset ssh_commands_inside direction 'in'
165: access list rule, action permit 165: filtering rule: access list ssh_commands_inside, action permit
166: Interface Ethernet0.101 ruleset ssh_commands_outside direction 'in' 166: Interface Ethernet0.101 ruleset ssh_commands_outside direction 'in'
166: access list rule, action permit 166: filtering rule: access list ssh_commands_outside, action permit
src/unit_tests/tests_common.pri
+1 -1
View File
@@ -55,8 +55,8 @@ DEPENDPATH = ../../common \
STATIC_LIBS += \ STATIC_LIBS += \
../main/libtest_main.a \ ../main/libtest_main.a \
../../import/libimport.a \
../../libgui/libgui.a \ ../../libgui/libgui.a \
../../import/libimport.a \
../../common/libcommon.a \ ../../common/libcommon.a \
../../iptlib/libiptlib.a \ ../../iptlib/libiptlib.a \
../../pflib/libfwbpf.a \ ../../pflib/libfwbpf.a \