diff --git a/build_num b/build_num index a62a32961..795c75df9 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 2398 +#define BUILD_NUM 2399 diff --git a/doc/ChangeLog b/doc/ChangeLog index d0eb2017c..fcac2791f 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,5 +1,10 @@ 2010-01-20 vadim + * CompilerDriver.cpp (CompilerDriver::validateClusterGroups): + fixes #1119 "add test for the integrity of failover cluster + groups". Compilers require all failover group objects to be + configured with interfaces of member firewalls. + * PolicyCompiler_cisco_acls.cpp (setInterfaceAndDirectionBySrc::processNext): fixes #1120 "redundant commands generated for ssh access". Compiler for PIX generated two "ssh address netmask diff --git a/src/compiler_lib/CompilerDriver.cpp b/src/compiler_lib/CompilerDriver.cpp index fd7e153e8..fbe28104a 100644 --- a/src/compiler_lib/CompilerDriver.cpp +++ b/src/compiler_lib/CompilerDriver.cpp @@ -673,8 +673,9 @@ void CompilerDriver::validateClusterGroups(Cluster *cluster) string state_sync_type = (*it)->getStr("type"); if (!isSupported(&state_sync_protocols, state_sync_type)) { - QString err("State sync group type %1 is not supported"); - throw FWException(err.arg(state_sync_type.c_str()).toStdString()); + QString err("State sync group type '%1' is not supported"); + abort(cluster, NULL, NULL, err.arg(state_sync_type.c_str()).toStdString()); + throw FatalErrorInSingleRuleCompileMode(); } } @@ -686,11 +687,23 @@ void CompilerDriver::validateClusterGroups(Cluster *cluster) list failover_groups = cluster->getByTypeDeep(FailoverClusterGroup::TYPENAME); for (list::iterator it = failover_groups.begin(); it != failover_groups.end(); ++it) { - string failover_type = (*it)->getStr("type"); + FWObject *failover_group = *it; + FWObject *parent = failover_group->getParent(); + string failover_type = failover_group->getStr("type"); if (!isSupported(&failover_protocols, failover_type)) { - QString err("Failover group type %1 is not supported"); - throw FWException(err.arg(failover_type.c_str()).toStdString()); + QString err("Failover group type '%1' is not supported"); + abort(cluster, NULL, NULL, err.arg(failover_type.c_str()).toStdString()); + throw FatalErrorInSingleRuleCompileMode(); + } + + list l2 = failover_group->getByTypeDeep(FWObjectReference::TYPENAME); + if (l2.size() == 0) + { + QString err("Failover group of cluster interface '%1' is empty"); + abort(cluster, NULL, NULL, + err.arg(parent->getName().c_str()).toStdString()); + throw FatalErrorInSingleRuleCompileMode(); } } } diff --git a/test/ipt/cluster-tests.fwb b/test/ipt/cluster-tests.fwb index 58fb9a4a5..806144831 100644 --- a/test/ipt/cluster-tests.fwb +++ b/test/ipt/cluster-tests.fwb @@ -1195,7 +1195,7 @@ - + @@ -1624,7 +1624,7 @@ - + @@ -2286,7 +2286,7 @@ - + @@ -2454,7 +2454,7 @@ - + @@ -2999,7 +2999,7 @@ - + diff --git a/test/pix/cluster-tests.fwb b/test/pix/cluster-tests.fwb index 900b77b49..d95b25570 100644 --- a/test/pix/cluster-tests.fwb +++ b/test/pix/cluster-tests.fwb @@ -1,6 +1,6 @@ - + @@ -698,6 +698,230 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +