* parsers/pix.g (tcp_udp_rule_extended): see #2273 Improvements in

the parser for PIX/ASA configs to make it recognize object-group
and named object names used to define source port, destination
address or destination port in "access-list ... tcp|udp" rules,
including ambiguous situation when an object-group appears after
source address specification because this group can define either
source port or destination address.

VERSION

@@ -7,7 +7,7 @@ FWB_MICRO_VERSION=0
 # build number is like "nano" version number. I am incrementing build
 # number during development cycle
 #
-BUILD_NUM="3508"
+BUILD_NUM="3509"
 
 VERSION="$FWB_MAJOR_VERSION.$FWB_MINOR_VERSION.$FWB_MICRO_VERSION.$BUILD_NUM"
 

VERSION.h

@@ -1,2 +1,2 @@
-#define VERSION      "4.2.0.3508"
+#define VERSION      "4.2.0.3509"
 #define GENERATION   "4.2"

doc/ChangeLog

@@ -1,3 +1,13 @@
+2011-03-25  vadim  <vadim@netcitadel.com>
+
+	* parsers/pix.g (tcp_udp_rule_extended): see #2273 Improvements in
+	the parser for PIX/ASA configs to make it recognize object-group
+	and named object names used to define source port, destination
+	address or destination port in "access-list ... tcp|udp" rules,
+	including ambiguous situation when an object-group appears after
+	source address specification because this group can define either
+	source port or destination address.
+
 2011-03-24  vadim  <vadim@netcitadel.com>
 
 	* ASA8ObjectGroup.cpp: see #2263 looks like "object-group service"

packaging/fwbuilder-static-qt.spec

@@ -3,7 +3,7 @@
 
 
 %define name    fwbuilder
-%define version 4.2.0.3508
+%define version 4.2.0.3509
 %define release 1
 
 %if "%_vendor" == "MandrakeSoft"

packaging/fwbuilder.control

@@ -4,6 +4,6 @@ Replaces: fwbuilder (<=4.1.1-1), fwbuilder-common, fwbuilder-bsd, fwbuilder-linu
 Priority: extra
 Section: checkinstall
 Maintainer: vadim@fwbuilder.org
-Version: 4.2.0.3508-1
+Version: 4.2.0.3509-1
 Depends: libqt4-gui (>= 4.3.0), libxml2, libxslt1.1, libsnmp | libsnmp15
 Description: Firewall Builder GUI and policy compilers

packaging/fwbuilder.spec

@@ -1,6 +1,6 @@
 
 %define name    fwbuilder
-%define version 4.2.0.3508
+%define version 4.2.0.3509
 %define release 1
 
 %if "%_vendor" == "MandrakeSoft"

src/import/PIXImporter.cpp

@@ -579,6 +579,19 @@ void PIXImporter::newObjectGroupService(const string &name)
     *logger << "Object Group (service) " + name;
 }
 
+bool PIXImporter::isKnownServiceGroupName(const string &object_group_name)
+{
+    QString qs_object_group_name = QString::fromUtf8(object_group_name.c_str());
+    qDebug() << "isKnownServiceGroupName:" << qs_object_group_name;
+
+    if (named_objects_registry.count(qs_object_group_name) > 0)
+    {
+        FWObject *grp = named_objects_registry[qs_object_group_name];
+        return ServiceGroup::isA(grp);
+    }
+    return false;
+}
+
 void PIXImporter::newObjectGroupProtocol(const string &name)
 {
     object_group_name = QString::fromUtf8(name.c_str());

src/import/PIXImporter.h

@@ -110,6 +110,8 @@ class PIXImporter : public IOSImporter
     void newObjectGroupProtocol(const std::string &group_name);
     void newObjectGroupICMP(const std::string &group_name);
 
+    bool isKnownServiceGroupName(const std::string &object_group_name);
+    
     void setObjectGroupServiceProtocol(const std::string &proto)
     { object_group_service_protocol = proto.c_str(); }
     

src/parsers/PIXCfgLexer.cpp

@@ -53,7 +53,6 @@ void PIXCfgLexer::initLiterals()
 	literals["subnet"] = 33;
 	literals["ipsec"] = 20;
 	literals["controller"] = 78;
-	literals["object"] = 27;
 	literals["pcp"] = 23;
 	literals["remark"] = 107;
 	literals["access-list"] = 61;
@@ -82,7 +81,6 @@ void PIXCfgLexer::initLiterals()
 	literals["icmp-object"] = 47;
 	literals["exit"] = 80;
 	literals["nat"] = 29;
-	literals["object-group"] = 42;
 	literals["range"] = 32;
 	literals["service-object"] = 50;
 	literals["gre"] = 16;
@@ -224,7 +222,7 @@ ANTLR_USE_NAMESPACE(antlr)RefToken PIXCfgLexer::nextToken()
 			case 0x79 /* 'y' */ :
 			case 0x7a /* 'z' */ :
 			{
-				mNUMBER(true);
+				mNUMBER_ADDRESS_OR_WORD(true);
 				theRetToken=_returnToken;
 				break;
 			}
@@ -455,11 +453,11 @@ void PIXCfgLexer::mLINE_COMMENT(bool _createToken) {
 			}
 		}
 		else {
-			goto _loop206;
+			goto _loop222;
 		}
 		
 	}
-	_loop206:;
+	_loop222:;
 	} // ( ... )*
 	mNEWLINE(false);
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@@ -491,9 +489,9 @@ void PIXCfgLexer::mNEWLINE(bool _createToken) {
 	
 	}
 	if ( inputState->guessing==0 ) {
-#line 1652 "pix.g"
+#line 1746 "pix.g"
 		newline();
-#line 497 "PIXCfgLexer.cpp"
+#line 495 "PIXCfgLexer.cpp"
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -517,11 +515,11 @@ void PIXCfgLexer::mCOLON_COMMENT(bool _createToken) {
 			}
 		}
 		else {
-			goto _loop210;
+			goto _loop226;
 		}
 		
 	}
-	_loop210:;
+	_loop226:;
 	} // ( ... )*
 	mNEWLINE(false);
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@@ -615,9 +613,9 @@ void PIXCfgLexer::mWhitespace(bool _createToken) {
 	}
 	}
 	if ( inputState->guessing==0 ) {
-#line 1647 "pix.g"
+#line 1741 "pix.g"
 		_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
-#line 621 "PIXCfgLexer.cpp"
+#line 619 "PIXCfgLexer.cpp"
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -653,6 +651,19 @@ void PIXCfgLexer::mHEX_CONST(bool _createToken) {
 	_saveIndex=0;
 }
 
+void PIXCfgLexer::mNUMBER(bool _createToken) {
+	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
+	_ttype = NUMBER;
+	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
+	
+	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
+	   _token = makeToken(_ttype);
+	   _token->setText(text.substr(_begin, text.length()-_begin));
+	}
+	_returnToken = _token;
+	_saveIndex=0;
+}
+
 void PIXCfgLexer::mNEG_INT_CONST(bool _createToken) {
 	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
 	_ttype = NEG_INT_CONST;
@@ -694,111 +705,92 @@ void PIXCfgLexer::mHEXDIGIT(bool _createToken) {
 	_saveIndex=0;
 }
 
-void PIXCfgLexer::mNUMBER(bool _createToken) {
+void PIXCfgLexer::mOBJECT(bool _createToken) {
 	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
-	_ttype = NUMBER;
+	_ttype = OBJECT;
+	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
+	
+	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
+	   _token = makeToken(_ttype);
+	   _token->setText(text.substr(_begin, text.length()-_begin));
+	}
+	_returnToken = _token;
+	_saveIndex=0;
+}
+
+void PIXCfgLexer::mOBJECT_GROUP(bool _createToken) {
+	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
+	_ttype = OBJECT_GROUP;
+	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
+	
+	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
+	   _token = makeToken(_ttype);
+	   _token->setText(text.substr(_begin, text.length()-_begin));
+	}
+	_returnToken = _token;
+	_saveIndex=0;
+}
+
+void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
+	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
+	_ttype = NUMBER_ADDRESS_OR_WORD;
 	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
 	
 	{
-	bool synPredMatched258 = false;
+	bool synPredMatched287 = false;
-	if (((_tokenSet_2.member(LA(1))) && (_tokenSet_3.member(LA(2))) && (true))) {
+	if (((LA(1) == 0x6f /* 'o' */ ) && (LA(2) == 0x62 /* 'b' */ ) && (LA(3) == 0x6a /* 'j' */ ))) {
-		int _m258 = mark();
+		int _m287 = mark();
-		synPredMatched258 = true;
+		synPredMatched287 = true;
 		inputState->guessing++;
 		try {
 			{
-			{ // ( ... )+
+			match("obj");
-			int _cnt257=0;
+			match("ect");
-			for (;;) {
-				switch ( LA(1)) {
-				case 0x61 /* 'a' */ :
-				case 0x62 /* 'b' */ :
-				case 0x63 /* 'c' */ :
-				case 0x64 /* 'd' */ :
-				case 0x65 /* 'e' */ :
-				case 0x66 /* 'f' */ :
-				{
-					matchRange('a','f');
-					break;
-				}
-				case 0x30 /* '0' */ :
-				case 0x31 /* '1' */ :
-				case 0x32 /* '2' */ :
-				case 0x33 /* '3' */ :
-				case 0x34 /* '4' */ :
-				case 0x35 /* '5' */ :
-				case 0x36 /* '6' */ :
-				case 0x37 /* '7' */ :
-				case 0x38 /* '8' */ :
-				case 0x39 /* '9' */ :
-				{
-					matchRange('0','9');
-					break;
-				}
-				default:
-				{
-					if ( _cnt257>=1 ) { goto _loop257; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-				}
-				}
-				_cnt257++;
-			}
-			_loop257:;
-			}  // ( ... )+
-			mCOLON(false);
 			}
 		}
 		catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-			synPredMatched258 = false;
+			synPredMatched287 = false;
 		}
-		rewind(_m258);
+		rewind(_m287);
 		inputState->guessing--;
 	}
-	if ( synPredMatched258 ) {
+	if ( synPredMatched287 ) {
 		{
+		match("object");
 		{
-		{ // ( ... )+
+		if ((LA(1) == 0x2d /* '-' */ )) {
-		int _cnt262=0;
-		for (;;) {
-			switch ( LA(1)) {
-			case 0x61 /* 'a' */ :
-			case 0x62 /* 'b' */ :
-			case 0x63 /* 'c' */ :
-			case 0x64 /* 'd' */ :
-			case 0x65 /* 'e' */ :
-			case 0x66 /* 'f' */ :
 			{
-				matchRange('a','f');
+			match("-gr");
-				break;
+			match("oup");
 			}
-			case 0x30 /* '0' */ :
+			if ( inputState->guessing==0 ) {
-			case 0x31 /* '1' */ :
+#line 1798 "pix.g"
-			case 0x32 /* '2' */ :
+				_ttype = OBJECT_GROUP;
-			case 0x33 /* '3' */ :
+#line 770 "PIXCfgLexer.cpp"
-			case 0x34 /* '4' */ :
-			case 0x35 /* '5' */ :
-			case 0x36 /* '6' */ :
-			case 0x37 /* '7' */ :
-			case 0x38 /* '8' */ :
-			case 0x39 /* '9' */ :
-			{
-				matchRange('0','9');
-				break;
 			}
-			default:
-			{
-				if ( _cnt262>=1 ) { goto _loop262; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-			}
-			}
-			_cnt262++;
 		}
-		_loop262:;
+		else {
-		}  // ( ... )+
+			match("");
-		{ // ( ... )+
+			if ( inputState->guessing==0 ) {
-		int _cnt266=0;
+#line 1800 "pix.g"
-		for (;;) {
+				_ttype = OBJECT;
-			if ((LA(1) == 0x3a /* ':' */ )) {
+#line 778 "PIXCfgLexer.cpp"
-				mCOLON(false);
+			}
-				{ // ( ... )*
+		}
+		
+		}
+		}
+	}
+	else {
+		bool synPredMatched277 = false;
+		if (((_tokenSet_2.member(LA(1))) && (_tokenSet_3.member(LA(2))) && (true))) {
+			int _m277 = mark();
+			synPredMatched277 = true;
+			inputState->guessing++;
+			try {
+				{
+				{ // ( ... )+
+				int _cnt276=0;
 				for (;;) {
 					switch ( LA(1)) {
 					case 0x61 /* 'a' */ :
@@ -827,374 +819,37 @@ void PIXCfgLexer::mNUMBER(bool _createToken) {
 					}
 					default:
 					{
-						goto _loop265;
+						if ( _cnt276>=1 ) { goto _loop276; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 					}
 					}
+					_cnt276++;
 				}
-				_loop265:;
+				_loop276:;
-				} // ( ... )*
+				}  // ( ... )+
-			}
+				mCOLON(false);
-			else {
-				if ( _cnt266>=1 ) { goto _loop266; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-			}
-			
-			_cnt266++;
-		}
-		_loop266:;
-		}  // ( ... )+
-		}
-		if ( inputState->guessing==0 ) {
-#line 1686 "pix.g"
-			_ttype = IPV6;
-#line 850 "PIXCfgLexer.cpp"
-		}
-		}
-	}
-	else {
-		bool synPredMatched223 = false;
-		if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true))) {
-			int _m223 = mark();
-			synPredMatched223 = true;
-			inputState->guessing++;
-			try {
-				{
-				mDIGIT(false);
 				}
 			}
 			catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-				synPredMatched223 = false;
+				synPredMatched277 = false;
 			}
-			rewind(_m223);
+			rewind(_m277);
 			inputState->guessing--;
 		}
-		if ( synPredMatched223 ) {
+		if ( synPredMatched277 ) {
 			{
-			bool synPredMatched232 = false;
-			if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_4.member(LA(2))) && (_tokenSet_4.member(LA(3))))) {
-				int _m232 = mark();
-				synPredMatched232 = true;
-				inputState->guessing++;
-				try {
-					{
-					{ // ( ... )+
-					int _cnt227=0;
-					for (;;) {
-						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-							mDIGIT(false);
-						}
-						else {
-							if ( _cnt227>=1 ) { goto _loop227; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-						}
-						
-						_cnt227++;
-					}
-					_loop227:;
-					}  // ( ... )+
-					mDOT(false);
-					{ // ( ... )+
-					int _cnt229=0;
-					for (;;) {
-						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-							mDIGIT(false);
-						}
-						else {
-							if ( _cnt229>=1 ) { goto _loop229; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-						}
-						
-						_cnt229++;
-					}
-					_loop229:;
-					}  // ( ... )+
-					mDOT(false);
-					{ // ( ... )+
-					int _cnt231=0;
-					for (;;) {
-						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-							mDIGIT(false);
-						}
-						else {
-							if ( _cnt231>=1 ) { goto _loop231; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-						}
-						
-						_cnt231++;
-					}
-					_loop231:;
-					}  // ( ... )+
-					}
-				}
-				catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-					synPredMatched232 = false;
-				}
-				rewind(_m232);
-				inputState->guessing--;
-			}
-			if ( synPredMatched232 ) {
-				{
-				{ // ( ... )+
-				int _cnt235=0;
-				for (;;) {
-					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-						mDIGIT(false);
-					}
-					else {
-						if ( _cnt235>=1 ) { goto _loop235; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-					}
-					
-					_cnt235++;
-				}
-				_loop235:;
-				}  // ( ... )+
-				mDOT(false);
-				{ // ( ... )+
-				int _cnt237=0;
-				for (;;) {
-					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-						mDIGIT(false);
-					}
-					else {
-						if ( _cnt237>=1 ) { goto _loop237; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-					}
-					
-					_cnt237++;
-				}
-				_loop237:;
-				}  // ( ... )+
-				mDOT(false);
-				{ // ( ... )+
-				int _cnt239=0;
-				for (;;) {
-					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-						mDIGIT(false);
-					}
-					else {
-						if ( _cnt239>=1 ) { goto _loop239; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-					}
-					
-					_cnt239++;
-				}
-				_loop239:;
-				}  // ( ... )+
-				mDOT(false);
-				{ // ( ... )+
-				int _cnt241=0;
-				for (;;) {
-					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-						mDIGIT(false);
-					}
-					else {
-						if ( _cnt241>=1 ) { goto _loop241; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-					}
-					
-					_cnt241++;
-				}
-				_loop241:;
-				}  // ( ... )+
-				}
-				if ( inputState->guessing==0 ) {
-#line 1675 "pix.g"
-					_ttype = IPV4;
-#line 997 "PIXCfgLexer.cpp"
-				}
-			}
-			else {
-				bool synPredMatched247 = false;
-				if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_4.member(LA(2))) && (_tokenSet_4.member(LA(3))))) {
-					int _m247 = mark();
-					synPredMatched247 = true;
-					inputState->guessing++;
-					try {
-						{
-						{ // ( ... )+
-						int _cnt244=0;
-						for (;;) {
-							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-								mDIGIT(false);
-							}
-							else {
-								if ( _cnt244>=1 ) { goto _loop244; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-							}
-							
-							_cnt244++;
-						}
-						_loop244:;
-						}  // ( ... )+
-						mDOT(false);
-						{ // ( ... )+
-						int _cnt246=0;
-						for (;;) {
-							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-								mDIGIT(false);
-							}
-							else {
-								if ( _cnt246>=1 ) { goto _loop246; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-							}
-							
-							_cnt246++;
-						}
-						_loop246:;
-						}  // ( ... )+
-						}
-					}
-					catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-						synPredMatched247 = false;
-					}
-					rewind(_m247);
-					inputState->guessing--;
-				}
-				if ( synPredMatched247 ) {
-					{
-					{ // ( ... )+
-					int _cnt250=0;
-					for (;;) {
-						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-							mDIGIT(false);
-						}
-						else {
-							if ( _cnt250>=1 ) { goto _loop250; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-						}
-						
-						_cnt250++;
-					}
-					_loop250:;
-					}  // ( ... )+
-					mDOT(false);
-					{ // ( ... )+
-					int _cnt252=0;
-					for (;;) {
-						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-							mDIGIT(false);
-						}
-						else {
-							if ( _cnt252>=1 ) { goto _loop252; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-						}
-						
-						_cnt252++;
-					}
-					_loop252:;
-					}  // ( ... )+
-					}
-				}
-				else if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
-					{ // ( ... )+
-					int _cnt254=0;
-					for (;;) {
-						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-							mDIGIT(false);
-						}
-						else {
-							if ( _cnt254>=1 ) { goto _loop254; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-						}
-						
-						_cnt254++;
-					}
-					_loop254:;
-					}  // ( ... )+
-					if ( inputState->guessing==0 ) {
-#line 1679 "pix.g"
-						_ttype = INT_CONST;
-#line 1096 "PIXCfgLexer.cpp"
-					}
-				}
-			else {
-				throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());
-			}
-			}
-			}
-		}
-		else if ((_tokenSet_5.member(LA(1))) && (true) && (true)) {
 			{
-			switch ( LA(1)) {
+			{ // ( ... )+
-			case 0x61 /* 'a' */ :
+			int _cnt281=0;
-			case 0x62 /* 'b' */ :
-			case 0x63 /* 'c' */ :
-			case 0x64 /* 'd' */ :
-			case 0x65 /* 'e' */ :
-			case 0x66 /* 'f' */ :
-			case 0x67 /* 'g' */ :
-			case 0x68 /* 'h' */ :
-			case 0x69 /* 'i' */ :
-			case 0x6a /* 'j' */ :
-			case 0x6b /* 'k' */ :
-			case 0x6c /* 'l' */ :
-			case 0x6d /* 'm' */ :
-			case 0x6e /* 'n' */ :
-			case 0x6f /* 'o' */ :
-			case 0x70 /* 'p' */ :
-			case 0x71 /* 'q' */ :
-			case 0x72 /* 'r' */ :
-			case 0x73 /* 's' */ :
-			case 0x74 /* 't' */ :
-			case 0x75 /* 'u' */ :
-			case 0x76 /* 'v' */ :
-			case 0x77 /* 'w' */ :
-			case 0x78 /* 'x' */ :
-			case 0x79 /* 'y' */ :
-			case 0x7a /* 'z' */ :
-			{
-				matchRange('a','z');
-				break;
-			}
-			case 0x41 /* 'A' */ :
-			case 0x42 /* 'B' */ :
-			case 0x43 /* 'C' */ :
-			case 0x44 /* 'D' */ :
-			case 0x45 /* 'E' */ :
-			case 0x46 /* 'F' */ :
-			case 0x47 /* 'G' */ :
-			case 0x48 /* 'H' */ :
-			case 0x49 /* 'I' */ :
-			case 0x4a /* 'J' */ :
-			case 0x4b /* 'K' */ :
-			case 0x4c /* 'L' */ :
-			case 0x4d /* 'M' */ :
-			case 0x4e /* 'N' */ :
-			case 0x4f /* 'O' */ :
-			case 0x50 /* 'P' */ :
-			case 0x51 /* 'Q' */ :
-			case 0x52 /* 'R' */ :
-			case 0x53 /* 'S' */ :
-			case 0x54 /* 'T' */ :
-			case 0x55 /* 'U' */ :
-			case 0x56 /* 'V' */ :
-			case 0x57 /* 'W' */ :
-			case 0x58 /* 'X' */ :
-			case 0x59 /* 'Y' */ :
-			case 0x5a /* 'Z' */ :
-			{
-				matchRange('A','Z');
-				break;
-			}
-			case 0x24 /* '$' */ :
-			{
-				match('$' /* charlit */ );
-				break;
-			}
-			default:
-			{
-				throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());
-			}
-			}
-			}
-			{ // ( ... )*
 			for (;;) {
 				switch ( LA(1)) {
-				case 0x21 /* '!' */ :
+				case 0x61 /* 'a' */ :
-				case 0x22 /* '\"' */ :
+				case 0x62 /* 'b' */ :
-				case 0x23 /* '#' */ :
+				case 0x63 /* 'c' */ :
-				case 0x24 /* '$' */ :
+				case 0x64 /* 'd' */ :
-				case 0x25 /* '%' */ :
+				case 0x65 /* 'e' */ :
-				case 0x26 /* '&' */ :
+				case 0x66 /* 'f' */ :
-				case 0x27 /* '\'' */ :
-				case 0x28 /* '(' */ :
-				case 0x29 /* ')' */ :
-				case 0x2a /* '*' */ :
-				case 0x2b /* '+' */ :
-				case 0x2c /* ',' */ :
-				case 0x2d /* '-' */ :
-				case 0x2e /* '.' */ :
-				case 0x2f /* '/' */ :
 				{
-					matchRange('!','/');
+					matchRange('a','f');
 					break;
 				}
 				case 0x30 /* '0' */ :
@@ -1211,39 +866,359 @@ void PIXCfgLexer::mNUMBER(bool _createToken) {
 					matchRange('0','9');
 					break;
 				}
-				case 0x3a /* ':' */ :
+				default:
 				{
-					match(':' /* charlit */ );
+					if ( _cnt281>=1 ) { goto _loop281; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-					break;
 				}
-				case 0x3b /* ';' */ :
-				{
-					match(';' /* charlit */ );
-					break;
 				}
-				case 0x3c /* '<' */ :
+				_cnt281++;
-				{
+			}
-					match('<' /* charlit */ );
+			_loop281:;
-					break;
+			}  // ( ... )+
+			{ // ( ... )+
+			int _cnt285=0;
+			for (;;) {
+				if ((LA(1) == 0x3a /* ':' */ )) {
+					mCOLON(false);
+					{ // ( ... )*
+					for (;;) {
+						switch ( LA(1)) {
+						case 0x61 /* 'a' */ :
+						case 0x62 /* 'b' */ :
+						case 0x63 /* 'c' */ :
+						case 0x64 /* 'd' */ :
+						case 0x65 /* 'e' */ :
+						case 0x66 /* 'f' */ :
+						{
+							matchRange('a','f');
+							break;
+						}
+						case 0x30 /* '0' */ :
+						case 0x31 /* '1' */ :
+						case 0x32 /* '2' */ :
+						case 0x33 /* '3' */ :
+						case 0x34 /* '4' */ :
+						case 0x35 /* '5' */ :
+						case 0x36 /* '6' */ :
+						case 0x37 /* '7' */ :
+						case 0x38 /* '8' */ :
+						case 0x39 /* '9' */ :
+						{
+							matchRange('0','9');
+							break;
+						}
+						default:
+						{
+							goto _loop284;
+						}
+						}
+					}
+					_loop284:;
+					} // ( ... )*
 				}
-				case 0x3d /* '=' */ :
+				else {
-				{
+					if ( _cnt285>=1 ) { goto _loop285; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-					match('=' /* charlit */ );
-					break;
 				}
-				case 0x3e /* '>' */ :
+				
-				{
+				_cnt285++;
-					match('>' /* charlit */ );
+			}
-					break;
+			_loop285:;
+			}  // ( ... )+
+			}
+			if ( inputState->guessing==0 ) {
+#line 1791 "pix.g"
+				_ttype = IPV6;
+#line 932 "PIXCfgLexer.cpp"
+			}
+			}
+		}
+		else {
+			bool synPredMatched242 = false;
+			if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true))) {
+				int _m242 = mark();
+				synPredMatched242 = true;
+				inputState->guessing++;
+				try {
+					{
+					mDIGIT(false);
+					}
 				}
-				case 0x3f /* '?' */ :
+				catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-				{
+					synPredMatched242 = false;
-					match('?' /* charlit */ );
-					break;
 				}
-				case 0x40 /* '@' */ :
+				rewind(_m242);
+				inputState->guessing--;
+			}
+			if ( synPredMatched242 ) {
 				{
-					match('@' /* charlit */ );
+				bool synPredMatched251 = false;
+				if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_4.member(LA(2))) && (_tokenSet_4.member(LA(3))))) {
+					int _m251 = mark();
+					synPredMatched251 = true;
+					inputState->guessing++;
+					try {
+						{
+						{ // ( ... )+
+						int _cnt246=0;
+						for (;;) {
+							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+								mDIGIT(false);
+							}
+							else {
+								if ( _cnt246>=1 ) { goto _loop246; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							}
+							
+							_cnt246++;
+						}
+						_loop246:;
+						}  // ( ... )+
+						mDOT(false);
+						{ // ( ... )+
+						int _cnt248=0;
+						for (;;) {
+							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+								mDIGIT(false);
+							}
+							else {
+								if ( _cnt248>=1 ) { goto _loop248; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							}
+							
+							_cnt248++;
+						}
+						_loop248:;
+						}  // ( ... )+
+						mDOT(false);
+						{ // ( ... )+
+						int _cnt250=0;
+						for (;;) {
+							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+								mDIGIT(false);
+							}
+							else {
+								if ( _cnt250>=1 ) { goto _loop250; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							}
+							
+							_cnt250++;
+						}
+						_loop250:;
+						}  // ( ... )+
+						}
+					}
+					catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
+						synPredMatched251 = false;
+					}
+					rewind(_m251);
+					inputState->guessing--;
+				}
+				if ( synPredMatched251 ) {
+					{
+					{ // ( ... )+
+					int _cnt254=0;
+					for (;;) {
+						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+							mDIGIT(false);
+						}
+						else {
+							if ( _cnt254>=1 ) { goto _loop254; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						}
+						
+						_cnt254++;
+					}
+					_loop254:;
+					}  // ( ... )+
+					mDOT(false);
+					{ // ( ... )+
+					int _cnt256=0;
+					for (;;) {
+						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+							mDIGIT(false);
+						}
+						else {
+							if ( _cnt256>=1 ) { goto _loop256; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						}
+						
+						_cnt256++;
+					}
+					_loop256:;
+					}  // ( ... )+
+					mDOT(false);
+					{ // ( ... )+
+					int _cnt258=0;
+					for (;;) {
+						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+							mDIGIT(false);
+						}
+						else {
+							if ( _cnt258>=1 ) { goto _loop258; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						}
+						
+						_cnt258++;
+					}
+					_loop258:;
+					}  // ( ... )+
+					mDOT(false);
+					{ // ( ... )+
+					int _cnt260=0;
+					for (;;) {
+						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+							mDIGIT(false);
+						}
+						else {
+							if ( _cnt260>=1 ) { goto _loop260; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						}
+						
+						_cnt260++;
+					}
+					_loop260:;
+					}  // ( ... )+
+					}
+					if ( inputState->guessing==0 ) {
+#line 1779 "pix.g"
+						_ttype = IPV4;
+#line 1079 "PIXCfgLexer.cpp"
+					}
+				}
+				else {
+					bool synPredMatched266 = false;
+					if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_4.member(LA(2))) && (_tokenSet_4.member(LA(3))))) {
+						int _m266 = mark();
+						synPredMatched266 = true;
+						inputState->guessing++;
+						try {
+							{
+							{ // ( ... )+
+							int _cnt263=0;
+							for (;;) {
+								if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+									mDIGIT(false);
+								}
+								else {
+									if ( _cnt263>=1 ) { goto _loop263; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+								}
+								
+								_cnt263++;
+							}
+							_loop263:;
+							}  // ( ... )+
+							mDOT(false);
+							{ // ( ... )+
+							int _cnt265=0;
+							for (;;) {
+								if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+									mDIGIT(false);
+								}
+								else {
+									if ( _cnt265>=1 ) { goto _loop265; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+								}
+								
+								_cnt265++;
+							}
+							_loop265:;
+							}  // ( ... )+
+							}
+						}
+						catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
+							synPredMatched266 = false;
+						}
+						rewind(_m266);
+						inputState->guessing--;
+					}
+					if ( synPredMatched266 ) {
+						{
+						{ // ( ... )+
+						int _cnt269=0;
+						for (;;) {
+							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+								mDIGIT(false);
+							}
+							else {
+								if ( _cnt269>=1 ) { goto _loop269; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							}
+							
+							_cnt269++;
+						}
+						_loop269:;
+						}  // ( ... )+
+						mDOT(false);
+						{ // ( ... )+
+						int _cnt271=0;
+						for (;;) {
+							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+								mDIGIT(false);
+							}
+							else {
+								if ( _cnt271>=1 ) { goto _loop271; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							}
+							
+							_cnt271++;
+						}
+						_loop271:;
+						}  // ( ... )+
+						}
+						if ( inputState->guessing==0 ) {
+#line 1782 "pix.g"
+							_ttype = NUMBER;
+#line 1162 "PIXCfgLexer.cpp"
+						}
+					}
+					else if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
+						{ // ( ... )+
+						int _cnt273=0;
+						for (;;) {
+							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+								mDIGIT(false);
+							}
+							else {
+								if ( _cnt273>=1 ) { goto _loop273; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							}
+							
+							_cnt273++;
+						}
+						_loop273:;
+						}  // ( ... )+
+						if ( inputState->guessing==0 ) {
+#line 1784 "pix.g"
+							_ttype = INT_CONST;
+#line 1183 "PIXCfgLexer.cpp"
+						}
+					}
+				else {
+					throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());
+				}
+				}
+				}
+			}
+			else if ((_tokenSet_5.member(LA(1))) && (true) && (true)) {
+				{
+				switch ( LA(1)) {
+				case 0x61 /* 'a' */ :
+				case 0x62 /* 'b' */ :
+				case 0x63 /* 'c' */ :
+				case 0x64 /* 'd' */ :
+				case 0x65 /* 'e' */ :
+				case 0x66 /* 'f' */ :
+				case 0x67 /* 'g' */ :
+				case 0x68 /* 'h' */ :
+				case 0x69 /* 'i' */ :
+				case 0x6a /* 'j' */ :
+				case 0x6b /* 'k' */ :
+				case 0x6c /* 'l' */ :
+				case 0x6d /* 'm' */ :
+				case 0x6e /* 'n' */ :
+				case 0x6f /* 'o' */ :
+				case 0x70 /* 'p' */ :
+				case 0x71 /* 'q' */ :
+				case 0x72 /* 'r' */ :
+				case 0x73 /* 's' */ :
+				case 0x74 /* 't' */ :
+				case 0x75 /* 'u' */ :
+				case 0x76 /* 'v' */ :
+				case 0x77 /* 'w' */ :
+				case 0x78 /* 'x' */ :
+				case 0x79 /* 'y' */ :
+				case 0x7a /* 'z' */ :
+				{
+					matchRange('a','z');
 					break;
 				}
 				case 0x41 /* 'A' */ :
@@ -1276,74 +1251,186 @@ void PIXCfgLexer::mNUMBER(bool _createToken) {
 					matchRange('A','Z');
 					break;
 				}
-				case 0x5c /* '\\' */ :
+				case 0x24 /* '$' */ :
 				{
-					match('\\' /* charlit */ );
+					match('$' /* charlit */ );
-					break;
-				}
-				case 0x5e /* '^' */ :
-				{
-					match('^' /* charlit */ );
-					break;
-				}
-				case 0x5f /* '_' */ :
-				{
-					match('_' /* charlit */ );
-					break;
-				}
-				case 0x60 /* '`' */ :
-				{
-					match('`' /* charlit */ );
-					break;
-				}
-				case 0x61 /* 'a' */ :
-				case 0x62 /* 'b' */ :
-				case 0x63 /* 'c' */ :
-				case 0x64 /* 'd' */ :
-				case 0x65 /* 'e' */ :
-				case 0x66 /* 'f' */ :
-				case 0x67 /* 'g' */ :
-				case 0x68 /* 'h' */ :
-				case 0x69 /* 'i' */ :
-				case 0x6a /* 'j' */ :
-				case 0x6b /* 'k' */ :
-				case 0x6c /* 'l' */ :
-				case 0x6d /* 'm' */ :
-				case 0x6e /* 'n' */ :
-				case 0x6f /* 'o' */ :
-				case 0x70 /* 'p' */ :
-				case 0x71 /* 'q' */ :
-				case 0x72 /* 'r' */ :
-				case 0x73 /* 's' */ :
-				case 0x74 /* 't' */ :
-				case 0x75 /* 'u' */ :
-				case 0x76 /* 'v' */ :
-				case 0x77 /* 'w' */ :
-				case 0x78 /* 'x' */ :
-				case 0x79 /* 'y' */ :
-				case 0x7a /* 'z' */ :
-				{
-					matchRange('a','z');
 					break;
 				}
 				default:
 				{
-					goto _loop269;
+					throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());
 				}
 				}
+				}
+				{ // ( ... )*
+				for (;;) {
+					switch ( LA(1)) {
+					case 0x21 /* '!' */ :
+					case 0x22 /* '\"' */ :
+					case 0x23 /* '#' */ :
+					case 0x24 /* '$' */ :
+					case 0x25 /* '%' */ :
+					case 0x26 /* '&' */ :
+					case 0x27 /* '\'' */ :
+					case 0x28 /* '(' */ :
+					case 0x29 /* ')' */ :
+					case 0x2a /* '*' */ :
+					case 0x2b /* '+' */ :
+					case 0x2c /* ',' */ :
+					case 0x2d /* '-' */ :
+					case 0x2e /* '.' */ :
+					case 0x2f /* '/' */ :
+					{
+						matchRange('!','/');
+						break;
+					}
+					case 0x30 /* '0' */ :
+					case 0x31 /* '1' */ :
+					case 0x32 /* '2' */ :
+					case 0x33 /* '3' */ :
+					case 0x34 /* '4' */ :
+					case 0x35 /* '5' */ :
+					case 0x36 /* '6' */ :
+					case 0x37 /* '7' */ :
+					case 0x38 /* '8' */ :
+					case 0x39 /* '9' */ :
+					{
+						matchRange('0','9');
+						break;
+					}
+					case 0x3a /* ':' */ :
+					{
+						match(':' /* charlit */ );
+						break;
+					}
+					case 0x3b /* ';' */ :
+					{
+						match(';' /* charlit */ );
+						break;
+					}
+					case 0x3c /* '<' */ :
+					{
+						match('<' /* charlit */ );
+						break;
+					}
+					case 0x3d /* '=' */ :
+					{
+						match('=' /* charlit */ );
+						break;
+					}
+					case 0x3e /* '>' */ :
+					{
+						match('>' /* charlit */ );
+						break;
+					}
+					case 0x3f /* '?' */ :
+					{
+						match('?' /* charlit */ );
+						break;
+					}
+					case 0x40 /* '@' */ :
+					{
+						match('@' /* charlit */ );
+						break;
+					}
+					case 0x41 /* 'A' */ :
+					case 0x42 /* 'B' */ :
+					case 0x43 /* 'C' */ :
+					case 0x44 /* 'D' */ :
+					case 0x45 /* 'E' */ :
+					case 0x46 /* 'F' */ :
+					case 0x47 /* 'G' */ :
+					case 0x48 /* 'H' */ :
+					case 0x49 /* 'I' */ :
+					case 0x4a /* 'J' */ :
+					case 0x4b /* 'K' */ :
+					case 0x4c /* 'L' */ :
+					case 0x4d /* 'M' */ :
+					case 0x4e /* 'N' */ :
+					case 0x4f /* 'O' */ :
+					case 0x50 /* 'P' */ :
+					case 0x51 /* 'Q' */ :
+					case 0x52 /* 'R' */ :
+					case 0x53 /* 'S' */ :
+					case 0x54 /* 'T' */ :
+					case 0x55 /* 'U' */ :
+					case 0x56 /* 'V' */ :
+					case 0x57 /* 'W' */ :
+					case 0x58 /* 'X' */ :
+					case 0x59 /* 'Y' */ :
+					case 0x5a /* 'Z' */ :
+					{
+						matchRange('A','Z');
+						break;
+					}
+					case 0x5c /* '\\' */ :
+					{
+						match('\\' /* charlit */ );
+						break;
+					}
+					case 0x5e /* '^' */ :
+					{
+						match('^' /* charlit */ );
+						break;
+					}
+					case 0x5f /* '_' */ :
+					{
+						match('_' /* charlit */ );
+						break;
+					}
+					case 0x60 /* '`' */ :
+					{
+						match('`' /* charlit */ );
+						break;
+					}
+					case 0x61 /* 'a' */ :
+					case 0x62 /* 'b' */ :
+					case 0x63 /* 'c' */ :
+					case 0x64 /* 'd' */ :
+					case 0x65 /* 'e' */ :
+					case 0x66 /* 'f' */ :
+					case 0x67 /* 'g' */ :
+					case 0x68 /* 'h' */ :
+					case 0x69 /* 'i' */ :
+					case 0x6a /* 'j' */ :
+					case 0x6b /* 'k' */ :
+					case 0x6c /* 'l' */ :
+					case 0x6d /* 'm' */ :
+					case 0x6e /* 'n' */ :
+					case 0x6f /* 'o' */ :
+					case 0x70 /* 'p' */ :
+					case 0x71 /* 'q' */ :
+					case 0x72 /* 'r' */ :
+					case 0x73 /* 's' */ :
+					case 0x74 /* 't' */ :
+					case 0x75 /* 'u' */ :
+					case 0x76 /* 'v' */ :
+					case 0x77 /* 'w' */ :
+					case 0x78 /* 'x' */ :
+					case 0x79 /* 'y' */ :
+					case 0x7a /* 'z' */ :
+					{
+						matchRange('a','z');
+						break;
+					}
+					default:
+					{
+						goto _loop293;
+					}
+					}
+				}
+				_loop293:;
+				} // ( ... )*
+				if ( inputState->guessing==0 ) {
+#line 1807 "pix.g"
+					_ttype = WORD;
+#line 1428 "PIXCfgLexer.cpp"
+				}
 			}
-			_loop269:;
-			} // ( ... )*
-			if ( inputState->guessing==0 ) {
-#line 1692 "pix.g"
-				_ttype = WORD;
-#line 1341 "PIXCfgLexer.cpp"
-			}
-		}
 	else {
 		throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());
 	}
-	}
+	}}
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -1379,11 +1466,11 @@ void PIXCfgLexer::mSTRING(bool _createToken) {
 			matchNot('\"' /* charlit */ );
 		}
 		else {
-			goto _loop272;
+			goto _loop296;
 		}
 		
 	}
-	_loop272:;
+	_loop296:;
 	} // ( ... )*
 	match('\"' /* charlit */ );
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@@ -1763,7 +1850,7 @@ const unsigned long PIXCfgLexer::_tokenSet_0_data_[] = { 4294958072UL, 1UL, 0UL,
 // 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xb 0xc 0xe 0xf 0x10 0x11 0x12 0x13 0x14 
 // 0x15 0x16 0x17 0x18 0x19 0x1a 0x1b 0x1c 0x1d 0x1e 0x1f   0x7f 0x80 0x81 
 // 0x82 0x83 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 0x8c 0x8d 0x8e 0x8f 
-// 0x90 
+// 0x90 0x91 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgLexer::_tokenSet_0(_tokenSet_0_data_,16);
 const unsigned long PIXCfgLexer::_tokenSet_1_data_[] = { 4294958072UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xb 0xc 0xe 0xf 0x10 0x11 0x12 0x13 0x14 
@@ -1771,7 +1858,7 @@ const unsigned long PIXCfgLexer::_tokenSet_1_data_[] = { 4294958072UL, 429496729
 // & \' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G 
 // H I J K L M N O P Q R S T U V W X Y Z [ 0x5c ] ^ _ ` a b c d e f g h 
 // i j k l m n o p q r s t u v w x y z { | } ~ 0x7f 0x80 0x81 0x82 0x83 
-// 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 0x8c 0x8d 0x8e 0x8f 0x90 
+// 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 0x8c 0x8d 0x8e 0x8f 0x90 0x91 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgLexer::_tokenSet_1(_tokenSet_1_data_,16);
 const unsigned long PIXCfgLexer::_tokenSet_2_data_[] = { 0UL, 67043328UL, 0UL, 126UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // 0 1 2 3 4 5 6 7 8 9 a b c d e f 
@@ -1792,6 +1879,6 @@ const unsigned long PIXCfgLexer::_tokenSet_6_data_[] = { 4294967288UL, 429496729
 // % & \' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F 
 // G H I J K L M N O P Q R S T U V W X Y Z [ 0x5c ] ^ _ ` a b c d e f g 
 // h i j k l m n o p q r s t u v w x y z { | } ~ 0x7f 0x80 0x81 0x82 0x83 
-// 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 0x8c 0x8d 0x8e 0x8f 0x90 
+// 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 0x8c 0x8d 0x8e 0x8f 0x90 0x91 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgLexer::_tokenSet_6(_tokenSet_6_data_,16);
 

src/parsers/PIXCfgLexer.hpp

@@ -54,10 +54,13 @@ public:
 	public: void mWhitespace(bool _createToken);
 	protected: void mINT_CONST(bool _createToken);
 	protected: void mHEX_CONST(bool _createToken);
+	protected: void mNUMBER(bool _createToken);
 	protected: void mNEG_INT_CONST(bool _createToken);
 	protected: void mDIGIT(bool _createToken);
 	protected: void mHEXDIGIT(bool _createToken);
-	public: void mNUMBER(bool _createToken);
+	protected: void mOBJECT(bool _createToken);
+	protected: void mOBJECT_GROUP(bool _createToken);
+	public: void mNUMBER_ADDRESS_OR_WORD(bool _createToken);
 	public: void mDOT(bool _createToken);
 	public: void mSTRING(bool _createToken);
 	public: void mPIPE_CHAR(bool _createToken);

src/parsers/PIXCfgParser.hpp

@@ -46,18 +46,21 @@ class CUSTOM_API PIXCfgParser : public ANTLR_USE_NAMESPACE(antlr)LLkParser, publ
     virtual void reportError(const ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex)
     {
         importer->addMessageToLog("Parser error: " + ex.toString());
+        std::cerr << ex.toString() << std::endl;
     }
 
     /// Parser error-reporting function can be overridden in subclass
     virtual void reportError(const ANTLR_USE_NAMESPACE(std)string& s)
     {
         importer->addMessageToLog("Parser error: " + s);
+        std::cerr << s << std::endl;
     }
 
     /// Parser warning-reporting function can be overridden in subclass
     virtual void reportWarning(const ANTLR_USE_NAMESPACE(std)string& s)
     {
         importer->addMessageToLog("Parser warning: " + s);
+        std::cerr << s << std::endl;
     }
 
 #line 38 "PIXCfgParser.hpp"
@@ -145,15 +148,19 @@ public:
 	public: void remark();
 	public: void rule_extended();
 	public: void rule_standard();
-	public: void ip_protocols();
 	public: void hostaddr_expr();
+	public: void ip_protocols();
 	public: void time_range();
 	public: void fragments();
 	public: void log();
 	public: void icmp_spec();
-	public: void acl_xoperator_src();
+	public: void tcp_udp_rule_extended();
+	public: void hostaddr_expr_1();
+	public: void acl_tcp_udp_dst_port_spec();
+	public: void hostaddr_expr_2();
 	public: void acl_xoperator_dst();
 	public: void established();
+	public: void hostaddr_expr_3();
 	public: void single_port_op();
 	public: void port_range();
 	public: void port_spec();
@@ -188,10 +195,10 @@ protected:
 private:
 	static const char* tokenNames[];
 #ifndef NO_STATIC_CONSTS
-	static const int NUM_TOKENS = 145;
+	static const int NUM_TOKENS = 146;
 #else
 	enum {
-		NUM_TOKENS = 145
+		NUM_TOKENS = 146
 	};
 #endif
 	
@@ -233,6 +240,18 @@ private:
 	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_17;
 	static const unsigned long _tokenSet_18_data_[];
 	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_18;
+	static const unsigned long _tokenSet_19_data_[];
+	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_19;
+	static const unsigned long _tokenSet_20_data_[];
+	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_20;
+	static const unsigned long _tokenSet_21_data_[];
+	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_21;
+	static const unsigned long _tokenSet_22_data_[];
+	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_22;
+	static const unsigned long _tokenSet_23_data_[];
+	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_23;
+	static const unsigned long _tokenSet_24_data_[];
+	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_24;
 };
 
 #endif /*INC_PIXCfgParser_hpp_*/

src/parsers/PIXCfgParserTokenTypes.hpp

@@ -125,34 +125,35 @@ struct CUSTOM_API PIXCfgParserTokenTypes {
 		NEG_INT_CONST = 114,
 		DIGIT = 115,
 		HEXDIGIT = 116,
-		PIPE_CHAR = 117,
+		NUMBER_ADDRESS_OR_WORD = 117,
-		NUMBER_SIGN = 118,
+		PIPE_CHAR = 118,
-		PERCENT = 119,
+		NUMBER_SIGN = 119,
-		AMPERSAND = 120,
+		PERCENT = 120,
-		APOSTROPHE = 121,
+		AMPERSAND = 121,
-		OPENING_PAREN = 122,
+		APOSTROPHE = 122,
-		CLOSING_PAREN = 123,
+		OPENING_PAREN = 123,
-		STAR = 124,
+		CLOSING_PAREN = 124,
-		PLUS = 125,
+		STAR = 125,
-		COMMA = 126,
+		PLUS = 126,
-		MINUS = 127,
+		COMMA = 127,
-		DOT = 128,
+		MINUS = 128,
-		SLASH = 129,
+		DOT = 129,
-		COLON = 130,
+		SLASH = 130,
-		SEMICOLON = 131,
+		COLON = 131,
-		LESS_THAN = 132,
+		SEMICOLON = 132,
-		EQUALS = 133,
+		LESS_THAN = 133,
-		GREATER_THAN = 134,
+		EQUALS = 134,
-		QUESTION = 135,
+		GREATER_THAN = 135,
-		COMMERCIAL_AT = 136,
+		QUESTION = 136,
-		OPENING_SQUARE = 137,
+		COMMERCIAL_AT = 137,
-		CLOSING_SQUARE = 138,
+		OPENING_SQUARE = 138,
-		CARET = 139,
+		CLOSING_SQUARE = 139,
-		UNDERLINE = 140,
+		CARET = 140,
-		OPENING_BRACE = 141,
+		UNDERLINE = 141,
-		CLOSING_BRACE = 142,
+		OPENING_BRACE = 142,
-		TILDE = 143,
+		CLOSING_BRACE = 143,
-		EXLAMATION = 144,
+		TILDE = 144,
+		EXLAMATION = 145,
 		NULL_TREE_LOOKAHEAD = 3
 	};
 #ifdef __cplusplus

src/parsers/PIXCfgParserTokenTypes.txt

@@ -23,7 +23,7 @@ PCP="pcp"=23
 PIM="pim"=24
 PPTP="pptp"=25
 SNP="snp"=26
-OBJECT="object"=27
+OBJECT=27
 NETWORK="network"=28
 NAT="nat"=29
 DESCRIPTION="description"=30
@@ -38,7 +38,7 @@ TCP="tcp"=38
 UDP="udp"=39
 SOURCE="source"=40
 DESTINATION="destination"=41
-OBJECT_GROUP="object-group"=42
+OBJECT_GROUP=42
 GROUP_OBJECT="group-object"=43
 NETWORK_OBJECT="network-object"=44
 PROTOCOL="protocol"=45
@@ -113,31 +113,32 @@ HEX_CONST=113
 NEG_INT_CONST=114
 DIGIT=115
 HEXDIGIT=116
-PIPE_CHAR=117
+NUMBER_ADDRESS_OR_WORD=117
-NUMBER_SIGN=118
+PIPE_CHAR=118
-PERCENT=119
+NUMBER_SIGN=119
-AMPERSAND=120
+PERCENT=120
-APOSTROPHE=121
+AMPERSAND=121
-OPENING_PAREN=122
+APOSTROPHE=122
-CLOSING_PAREN=123
+OPENING_PAREN=123
-STAR=124
+CLOSING_PAREN=124
-PLUS=125
+STAR=125
-COMMA=126
+PLUS=126
-MINUS=127
+COMMA=127
-DOT=128
+MINUS=128
-SLASH=129
+DOT=129
-COLON=130
+SLASH=130
-SEMICOLON=131
+COLON=131
-LESS_THAN=132
+SEMICOLON=132
-EQUALS=133
+LESS_THAN=133
-GREATER_THAN=134
+EQUALS=134
-QUESTION=135
+GREATER_THAN=135
-COMMERCIAL_AT=136
+QUESTION=136
-OPENING_SQUARE=137
+COMMERCIAL_AT=137
-CLOSING_SQUARE=138
+OPENING_SQUARE=138
-CARET=139
+CLOSING_SQUARE=139
-UNDERLINE=140
+CARET=140
-OPENING_BRACE=141
+UNDERLINE=141
-CLOSING_BRACE=142
+OPENING_BRACE=142
-TILDE=143
+CLOSING_BRACE=143
-EXLAMATION=144
+TILDE=144
+EXLAMATION=145

src/parsers/pix.g

@@ -90,18 +90,21 @@ options
     virtual void reportError(const ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex)
     {
         importer->addMessageToLog("Parser error: " + ex.toString());
+        std::cerr << ex.toString() << std::endl;
     }
 
     /// Parser error-reporting function can be overridden in subclass
     virtual void reportError(const ANTLR_USE_NAMESPACE(std)string& s)
     {
         importer->addMessageToLog("Parser error: " + s);
+        std::cerr << s << std::endl;
     }
 
     /// Parser warning-reporting function can be overridden in subclass
     virtual void reportWarning(const ANTLR_USE_NAMESPACE(std)string& s)
     {
         importer->addMessageToLog("Parser warning: " + s);
+        std::cerr << s << std::endl;
     }
 
 }
@@ -899,6 +902,21 @@ deny_standard: STANDARD DENY
 
 //****************************************************************
 // the difference between standard and extended acls should be in these rules
+
+// standard acl only matches destination address
+rule_standard : 
+        {
+            importer->tmp_a = "0.0.0.0";
+            importer->tmp_nm = "0.0.0.0";
+            importer->SaveTmpAddrToSrc();
+        }
+        hostaddr_expr
+        {
+            importer->SaveTmpAddrToDst();
+            *dbg << "(dst) " << std::endl;
+        }
+    ;
+
 rule_extended : 
         (
             ip_protocols
@@ -920,40 +938,125 @@ rule_extended :
             (fragments)?
             (log)?
         |
-            (TCP|UDP)
+            tcp_udp_rule_extended
-            {
-                importer->protocol = LT(0)->getText();
-                *dbg << "protocol " << LT(0)->getText() << " ";
-            }
-            hostaddr_expr { importer->SaveTmpAddrToSrc(); *dbg << "(src) "; }
-            (acl_xoperator_src)?
-            hostaddr_expr { importer->SaveTmpAddrToDst(); *dbg << "(dst) "; }
-            (acl_xoperator_dst)?
-            (established)? 
-            (time_range)?
-            (fragments)?
-            (log)?
         )
         {
             *dbg << std::endl;
         }
     ;
 
-// standard acl only matches destination address
+tcp_udp_rule_extended : 
-rule_standard : 
+        ( TCP | UDP )
         {
-            importer->tmp_a = "0.0.0.0";
+            importer->protocol = LT(0)->getText();
-            importer->tmp_nm = "0.0.0.0";
+            *dbg << "protocol " << LT(0)->getText() << " ";
-            importer->SaveTmpAddrToSrc();
-        }
-        hostaddr_expr
-        {
-            importer->SaveTmpAddrToDst();
-            *dbg << "(dst) " << std::endl;
         }
+        hostaddr_expr { importer->SaveTmpAddrToSrc(); *dbg << "(src) "; }
+        (
+            (OBJECT_GROUP) => (
+                // This object-group can be either
+                // source port or destination address
+                //
+                // Using disambiguating predicate; it must be the first element
+                // in the production (i.e. nothing should precede {}?)
+                { importer->isKnownServiceGroupName(LT(2)->getText()) }?
+                OBJECT_GROUP src_grp_name:WORD
+                {
+                    importer->src_port_spec = src_grp_name->getText();
+                    *dbg << "src port spec: "
+                     << src_grp_name->getText() << std::endl;
+                }
+                // destination address spec follows; hostaddr_expr matches
+                // OBJECT | OBJECT_GROUP among pure addresses
+                hostaddr_expr_1
+                {
+                    importer->SaveTmpAddrToDst();
+                    *dbg << "(dst) ";
+                }
+                acl_tcp_udp_dst_port_spec
+            |
+                // still object-group after src address but this group is not
+                // a known service group - must be dest. address group
+                hostaddr_expr_2
+                {
+                    importer->SaveTmpAddrToDst();
+                    *dbg << "(dst) ";
+                }
+                acl_tcp_udp_dst_port_spec
+            )
+        |
+            // not "object-group" keyword after src address spec.
+            OBJECT dst_addr_name:WORD (acl_xoperator_dst)? (established)? 
+            {
+                // looks like "object foo" at this point can only be dest addr.
+                // (judging by cli prompts on 8.3)
+                importer->tmp_a = dst_addr_name->getText();
+                importer->tmp_nm = "";
+                importer->SaveTmpAddrToDst();
+                *dbg << "dst addr object " << dst_addr_name->getText() << " ";
+            }
+            acl_tcp_udp_dst_port_spec
+        |
+            // if not object-group and object, then it can optionally
+            // be regular inline port spec, followed by dest address spec
+            (
+                xoperator
+                {
+                    importer->SaveTmpPortToSrc();
+                }
+            )?
+            hostaddr_expr_3 { importer->SaveTmpAddrToDst(); *dbg << "(dst) "; }
+            acl_tcp_udp_dst_port_spec
+        )
+        (time_range)?
+        (fragments)?
+        (log)?
     ;
 
 //****************************************************************
+
+acl_tcp_udp_dst_port_spec : 
+            (
+                // destination port spec. Can be blank, a named
+                // object, object-group or inline
+
+                (OBJECT_GROUP) => (
+                    // This object-group can be only destination port
+                    OBJECT_GROUP dst_port_group_name:WORD
+                    {
+                        importer->dst_port_spec = dst_port_group_name->getText();
+                        *dbg << "dst port spec: "
+                         << dst_port_group_name->getText() << std::endl;
+                    }
+                    (established)? 
+                )
+            |
+                // not "object-group"
+                OBJECT dst_port_obj_name:WORD
+                {
+                    importer->dst_port_spec = dst_port_obj_name->getText();
+                    *dbg << "dst addr object " << dst_port_obj_name->getText()
+                         << std::endl;
+                }
+                (established)? 
+            |
+                // if not object-group and object, then it can optionally
+                // be regular inline port spec
+                (acl_xoperator_dst)?
+                (established)? 
+            )
+;
+
+acl_xoperator_dst : xoperator
+        {
+            importer->SaveTmpPortToDst();
+        }
+    ;
+
+xoperator : single_port_op | port_range  ;
+
+//****************************************************************
+
 ip_protocols :
         (
             ( ip_protocol_names | ICMP6 )
@@ -989,20 +1092,6 @@ icmp_spec :
         )
     ;
 
-acl_xoperator_src : xoperator
-        {
-            importer->SaveTmpPortToSrc();
-        }
-    ;
-
-acl_xoperator_dst : xoperator
-        {
-            importer->SaveTmpPortToDst();
-        }
-    ;
-
-xoperator : single_port_op | port_range  ;
-
 single_port_op : (P_EQ | P_GT | P_LT | P_NEQ )
         {
             importer->tmp_port_op = LT(0)->getText();
@@ -1037,6 +1126,11 @@ pair_of_ports_spec : (s1:WORD|s2:INT_CONST) (e1:WORD|e2:INT_CONST)
         }
     ;
 
+// using these to help with debugging
+hostaddr_expr_1 : hostaddr_expr ;
+hostaddr_expr_2 : hostaddr_expr ;
+hostaddr_expr_3 : hostaddr_expr ;
+
 hostaddr_expr :
         INTRFACE intf_name:WORD
         {
@@ -1606,8 +1700,9 @@ tokens
     NAMES = "names";
     NAME = "name";
 
-    OBJECT = "object";
+//    OBJECT = "object";
-    OBJECT_GROUP = "object-group";
+//    OBJECT_GROUP = "object-group";
+
     GROUP_OBJECT = "group-object";
     NETWORK_OBJECT = "network-object";
     SERVICE_OBJECT = "service-object";
@@ -1634,7 +1729,6 @@ tokens
 
 }
 
-
 LINE_COMMENT : "!" (~('\r' | '\n'))* NEWLINE ;
 
 // This is for lines like these that appear at the top of "show run"
@@ -1657,6 +1751,9 @@ INT_CONST:;
 protected
 HEX_CONST:;
 
+protected
+NUMBER:;
+
 protected
 NEG_INT_CONST:;
 
@@ -1666,7 +1763,14 @@ DIGIT : '0'..'9'  ;
 protected
 HEXDIGIT : 'a'..'f' ;
 
-NUMBER : 
+protected
+OBJECT :;
+
+protected
+OBJECT_GROUP :;
+
+
+NUMBER_ADDRESS_OR_WORD : 
 		(
             ( DIGIT ) =>
                 (
@@ -1675,6 +1779,7 @@ NUMBER :
                         { _ttype = IPV4; }
                 |
                     ( (DIGIT)+ DOT (DIGIT)+ )=> ( (DIGIT)+ DOT (DIGIT)+ )
+                    { _ttype = NUMBER; }
                 |
                     ( DIGIT )+ { _ttype = INT_CONST; }
                 )
@@ -1685,6 +1790,16 @@ NUMBER :
                     ( COLON ( 'a'..'f' | '0'..'9' )* )+ )
                     { _ttype = IPV6; }
                 )
+        |
+            ("obj" "ect") =>
+            (
+                "object" 
+                (
+                    ("-gr" "oup") { _ttype = OBJECT_GROUP; }
+                    |
+                    "" { _ttype = OBJECT; }
+                )
+            )
         |
             ( 'a'..'z' | 'A'..'Z' | '$' )
             ( '!'..'/' | '0'..'9' | ':' | ';' | '<' | '=' | '>' |

src/unit_tests/ImporterTest/test_data/asa8.3-acl-object-groups.test

@@ -0,0 +1,199 @@
+: Saved
+:
+ASA Version 8.3(2) 
+!
+hostname asa5505
+
+
+interface Vlan1
+  nameif inside
+  security-level 100
+  ip address 192.168.1.1 255.255.255.0 
+exit
+
+interface Vlan2
+  nameif outside
+  security-level 0
+  ip address dhcp setroute 
+exit
+
+interface Ethernet0/0
+  description Switch port 0/0
+exit
+
+
+no logging buffered
+no logging console
+no logging timestamp
+no logging on
+
+
+timeout xlate 0:0:0 
+timeout conn 0:0:0 
+timeout udp 0:0:0 
+timeout sunrpc 0:0:0 
+timeout h323 0:0:0 
+timeout sip 0:0:0 
+timeout sip_media 0:0:0 
+timeout half-closed 0:0:0 
+timeout uauth 0:0:0 
+
+
+clear config ssh
+aaa authentication ssh console LOCAL
+
+clear config snmp-server
+no snmp-server enable traps
+
+clear config ntp
+
+
+no service resetinbound
+no service resetoutside
+no sysopt connection timewait
+no sysopt nodnsalias inbound
+no sysopt nodnsalias outbound
+
+
+class-map inspection_default
+  match default-inspection-traffic
+
+policy-map global_policy
+  class inspection_default
+
+service-policy global_policy global
+
+
+
+clear xlate
+clear config nat
+clear config access-list
+clear config icmp
+clear config telnet
+clear config object-group
+clear config object
+
+
+object service http.0
+  service tcp destination eq 80
+exit
+
+object service https.0
+  service tcp destination eq 443
+exit
+
+object network server-1.0
+  host 192.168.1.100
+exit
+
+object network Internal_net.0
+  subnet 192.168.1.0 255.255.255.0
+exit
+
+object network external_net.0
+  subnet 192.0.2.0 255.255.255.0
+
+object-group service srv-group-1 tcp
+  port-object eq 80
+  port-object eq 443
+exit
+
+object service ip2 
+ service eigrp 
+
+object-group protocol pg1
+ protocol-object 111
+ protocol-object ah
+ protocol-object ip
+ protocol-object eigrp
+
+object-group network src-network-group-1
+ network-object 192.168.1.0 255.255.255.0
+ network-object 192.168.2.0 255.255.255.0
+
+object-group network dst-network-group-1
+ network-object object external_net.0
+
+
+
+!################
+! 
+
+access-list inside_in  extended permit object-group pg1 192.168.1.0 255.255.255.0 any
+
+
+access-list inside_in extended permit tcp object server-1.0 any
+
+access-list inside_in extended permit tcp object server-1.0 host 192.0.2.1
+
+access-list inside_in extended permit tcp object server-1.0 192.0.2.0 255.255.255.0
+
+access-list inside_in extended permit tcp object server-1.0 object external_net.0
+
+access-list inside_in extended permit tcp object server-1.0 object-group dst-network-group-1
+
+
+! named object in both source and destination
+!
+access-list inside_in extended permit tcp object server-1.0 object external_net.0
+
+
+! src port definitions
+!
+access-list inside_in extended permit tcp object server-1.0 eq 80 any
+
+access-list inside_in extended permit tcp object server-1.0 lt 1024 any
+
+access-list inside_in extended permit tcp object server-1.0 gt 1024 any
+
+access-list inside_in extended permit tcp object server-1.0 range 1000 1100 any
+
+
+! ASA 8.3 does not take this acl definition (assumes object http.0 is dest address)
+! access-list inside_in extended permit tcp object server-1.0 object http.0 any
+
+access-list inside_in extended permit tcp object server-1.0 object-group srv-group-1 any
+
+
+
+
+! dest port is defined using in-line port operators
+!
+access-list inside_in extended permit tcp object server-1.0 any eq 80
+
+access-list inside_in extended permit tcp object server-1.0 host 192.0.2.1 eq 80
+
+access-list inside_in extended permit tcp object server-1.0 192.0.2.0 255.255.255.0 eq 80
+
+access-list inside_in extended permit tcp object server-1.0 object external_net.0 eq 80
+
+access-list inside_in extended permit tcp object server-1.0 object-group dst-network-group-1 eq 80
+
+
+! object-group service is used to define destination ports
+!
+access-list inside_in extended permit tcp object server-1.0 any object-group srv-group-1
+
+access-list inside_in extended permit tcp object server-1.0 host 192.0.2.1 object-group srv-group-1
+
+access-list inside_in extended permit tcp object server-1.0 192.0.2.0 255.255.255.0 object-group srv-group-1
+
+access-list inside_in extended permit tcp object server-1.0 object external_net.0 object-group srv-group-1
+
+
+
+
+! object-group service is used to define source ports
+!
+access-list inside_in extended permit tcp object server-1.0 object-group srv-group-1 any
+
+access-list inside_in extended permit tcp object server-1.0 object-group srv-group-1 host 192.0.2.1
+
+access-list inside_in extended permit tcp object server-1.0 object-group srv-group-1 192.0.2.0 255.255.255.0
+
+access-list inside_in extended permit tcp object server-1.0 object-group srv-group-1 object external_net.0
+
+access-list inside_in extended permit tcp object server-1.0 object-group srv-group-1 object-group dst-network-group-1
+
+
+access-group inside_in in interface inside

src/unit_tests/ImporterTest/test_data/asa8.3-acl.test

@@ -158,7 +158,10 @@ access-list inside_in extended deny   ip any any log 0 interval 300
 ! port definitions in both source and destination
 
 ! the following is unsupported at this time , see #2273
-! access-list inside_in extended permit tcp object server-1.0 object-group id5102X14531.srv.tcp.0 any
+access-list inside_in extended permit tcp object server-1.0 object-group id5102X14531.srv.tcp.0 any
+
+access-list inside_in extended permit tcp object server-1.0 object-group dst-network-group-1
+
 access-list inside_in extended permit tcp object server-1.0 eq 80 any
 access-list inside_in extended permit tcp object server-1.0 gt 1010 any
 access-list inside_in extended permit tcp object server-1.0 lt 1024 any
@@ -202,6 +205,11 @@ access-list outside_out standard permit 192.0.2.0 255.255.255.0
 access-list outside_out standard permit host 192.0.2.1
 access-list outside_out standard permit any
 
+! tests for access lists using object groups for both source service and destination address
+
+
+
+
 
 ! access-group statements