From c5b9613cddce7971d121f269b9551483ba9070ac Mon Sep 17 00:00:00 2001 From: Vadim Kurland Date: Mon, 14 Feb 2011 11:52:09 -0800 Subject: [PATCH] fixes #1866, 1868, 1869 pf options set state-policy, set block-policy, set debug --- doc/ChangeLog | 6 + src/libgui/pfAdvancedDialog.cpp | 45 +- src/libgui/pfadvanceddialog_q.ui | 777 +++++++++++++++---------------- src/pflib/CompilerDriver_pf.cpp | 12 + 4 files changed, 437 insertions(+), 403 deletions(-) diff --git a/doc/ChangeLog b/doc/ChangeLog index c93934794..228cc3b2b 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,3 +1,9 @@ +2011-02-14 vadim + + * pfAdvancedDialog.cpp (pfAdvancedDialog): fixes #1866 "support + for pf option set state-policy", #1868 "support for pf + option set block-policy", #1869 "support for pf option set debug". + 2011-02-13 vadim * configlets/freebsd/carp_interface: see #2074 On FreeBSD ifconfig diff --git a/src/libgui/pfAdvancedDialog.cpp b/src/libgui/pfAdvancedDialog.cpp index fa3589ec6..09a1c070d 100644 --- a/src/libgui/pfAdvancedDialog.cpp +++ b/src/libgui/pfAdvancedDialog.cpp @@ -178,7 +178,50 @@ pfAdvancedDialog::pfAdvancedDialog(QWidget *parent,FWObject *o) m_dialog->pf_state_policy->addItems(getScreenNames(slm)); data.registerOption( m_dialog->pf_state_policy, fwopt, "pf_state_policy", slm); m_dialog->pf_state_policy->setEnabled( - XMLTools::version_compare(version, "4.3") >= 0); + XMLTools::version_compare(version, "3.5") >= 0); + +// Prepare block_policy combo box + slm.clear(); + slm.push_back(""); + slm.push_back(""); + slm.push_back(QObject::tr("Drop")); + slm.push_back("drop"); + slm.push_back(QObject::tr("Return")); + slm.push_back("return"); + m_dialog->pf_block_policy->clear(); + m_dialog->pf_block_policy->addItems(getScreenNames(slm)); + data.registerOption( m_dialog->pf_block_policy, fwopt, "pf_block_policy", slm); + m_dialog->pf_block_policy->setEnabled( + XMLTools::version_compare(version, "3.5") >= 0); + +// set debug combo box + slm.clear(); + slm.push_back(""); + slm.push_back(""); + slm.push_back("emerg"); + slm.push_back("emerg"); + slm.push_back("alert"); + slm.push_back("alert"); + slm.push_back("crit"); + slm.push_back("crit"); + slm.push_back("err"); + slm.push_back("err"); + slm.push_back("warning"); + slm.push_back("warning"); + slm.push_back("notice"); + slm.push_back("notice"); + slm.push_back("info"); + slm.push_back("info"); + slm.push_back("debug"); + slm.push_back("debug"); + + m_dialog->pf_set_debug->clear(); + m_dialog->pf_set_debug->addItems(getScreenNames(slm)); + data.registerOption( m_dialog->pf_set_debug, fwopt, "pf_set_debug", slm); + m_dialog->pf_set_debug->setEnabled( + XMLTools::version_compare(version, "3.5") >= 0); + + data.registerOption( m_dialog->pf_check_shadowing,fwopt, "check_shading"); data.registerOption( m_dialog->pf_ignore_empty_groups,fwopt, diff --git a/src/libgui/pfadvanceddialog_q.ui b/src/libgui/pfadvanceddialog_q.ui index a6a14bff1..20a803224 100644 --- a/src/libgui/pfadvanceddialog_q.ui +++ b/src/libgui/pfadvanceddialog_q.ui @@ -94,7 +94,7 @@ - 3 + 2 @@ -353,55 +353,6 @@ this option only if you fully understand how it works! - - - - - Optimization: - - - Qt::AlignCenter - - - false - - - - - - - - - - State policy: - - - - - - - States can be bound to interfaces or match packets -on any interface. The latter can be useful in case of -an assymmetric routing. - - - - - - - Qt::Horizontal - - - - 40 - 20 - - - - - - - 9 @@ -442,7 +393,7 @@ with this address: - + Qt::Vertical @@ -462,10 +413,7 @@ with this address: Scrub - - 20 - - + Qt::Vertical @@ -481,7 +429,7 @@ with this address: - + Clears the don't fragment bit from the IP packet header. @@ -491,7 +439,7 @@ with this address: - + Replaces the IP identification field of outgoing packets with random values to compensate for operating systems that use predictable values. @@ -501,23 +449,7 @@ with this address: - - - - Qt::Horizontal - - - QSizePolicy::Fixed - - - - 40 - 100 - - - - - + @@ -557,7 +489,7 @@ with this address: - + @@ -600,7 +532,7 @@ with this address: - + QFrame::HLine @@ -613,14 +545,14 @@ with this address: - + Reassemble fragments - + @@ -696,7 +628,7 @@ with this address: - + Qt::Vertical @@ -716,244 +648,294 @@ with this address: - Limits + Options - - - 20 - - - 12 - - - 20 - - - 20 - - - 20 - - - - - - 0 - 0 - - - - maximum number of entries in the memory pool used for packet reassembly - - - 0 - - - 100000000 - - - 10 - - - 5000 + + + + + Limits + + + + + reassembly pool: + + + + + + + + 0 + 0 + + + + maximum number of entries in the memory pool used for packet reassembly + + + 0 + + + 100000000 + + + 10 + + + 5000 + + + + + + + state table size: + + + + + + + + 0 + 0 + + + + maximum number of entries in the memory pool used for state table entries + + + 0 + + + 100000000 + + + 10 + + + 20000 + + + + + + + src-nodes + + + + + + + + 0 + 0 + + + + maximum number of entries in the memory pool used for tracking source IP addresses + + + 0 + + + 100000000 + + + 10 + + + 2000 + + + + + + + tables + + + + + + + + 0 + 0 + + + + maximum number of tables that can exist in the memory simultaneously + + + 0 + + + 100000000 + + + 10 + + + 1000 + + + + + + + table-entries + + + + + + + + 0 + 0 + + + + maximum number of addresses that canbe stored in tables + + + 0 + + + 100000000 + + + 10 + + + 100000 + + + + - - - - table-entries + + + + Options + + + + + Optimization: + + + Qt::AlignCenter + + + false + + + + + + + Optimize state timeouts. See man pf.conf for more details. + + + + + + + Debug: + + + + + + + Set the debug level, which limits the severity of log messages +printed by pf(4). This should be a keyword from the following +ordered list (highest to lowest): emerg, alert, crit, err, +warning, notice, info, and debug. The last keyword, debug, must +be quoted. These keywords correspond to the similar (LOG_) +values specified to the syslog(3) library routine. + + + + + + + + State policy: + + + + + + + States can be bound to interfaces or match packets +on any interface. The latter can be useful in case of +an assymmetric routing. + + + + + + + Block policy: + + + + + + + The block-policy option sets the default behaviour for the packet block action: + +drop Packet is silently dropped. +return A TCP RST is returned for blocked TCP packets, an ICMP + UNREACHABLE is returned for blocked UDP packets, and + all other packets are silently dropped. + + + + drop + + + + + return + + + + + - - - - - 0 - 0 - - - - maximum number of addresses that canbe stored in tables - - - 0 - - - 100000000 - - - 10 - - - 100000 - - - - - - - - 0 - 0 - - - - maximum number of entries in the memory pool used for state table entries - - - 0 - - - 100000000 - - - 10 - - - 20000 - - - - - - - state table size: - - - - - - - reassembly pool: - - - - - - - Qt::Horizontal - - - QSizePolicy::Expanding - - - - 310 - 20 - - - - - - - - - 0 - 0 - - - - maximum number of entries in the memory pool used for tracking source IP addresses - - - 0 - - - 100000000 - - - 10 - - - 2000 - - - - - - - - 0 - 0 - - - - maximum number of tables that can exist in the memory simultaneously - - - 0 - - - 100000000 - - - 10 - - - 1000 - - - - - - - tables - - - - - - - src-nodes - - - - - - - Qt::Horizontal - - - QSizePolicy::Fixed - - - - 40 - 99 - - - - - + - Qt::Vertical - - - QSizePolicy::Fixed + Qt::Horizontal - 20 + 194 20 - - + + Qt::Vertical - - QSizePolicy::Expanding - 20 - 40 + 308 @@ -2478,8 +2460,6 @@ with this address: pf_modulate_state pf_check_shadowing pf_ignore_empty_groups - pf_optimization - pf_state_policy mgmt_ssh mgmt_addr pf_scrub_no_df @@ -2493,16 +2473,6 @@ with this address: pf_scrub_fragm_crop pf_scrub_fragm_drop_ovl pf_scrub_reassemble_tcp - pf_do_limit_frags - pf_limit_frags - pf_do_limit_states - pf_limit_states - pf_do_limit_src_nodes - pf_limit_src_nodes - pf_do_limit_tables - pf_limit_tables - pf_do_limit_table_entries - pf_limit_table_entries pf_set_tcp_first pf_tcp_first pf_set_tcp_opening @@ -2592,22 +2562,6 @@ with this address: - - pf_do_scrub - toggled(bool) - pfAdvancedDialog_q - doScrubToggled() - - - 20 - 20 - - - 20 - 20 - - - pf_set_tcp_first toggled(bool) @@ -2880,86 +2834,6 @@ with this address: - - pf_do_limit_frags - toggled(bool) - pfAdvancedDialog_q - ltToggled() - - - 20 - 20 - - - 20 - 20 - - - - - pf_do_limit_states - toggled(bool) - pfAdvancedDialog_q - ltToggled() - - - 20 - 20 - - - 20 - 20 - - - - - pf_do_limit_src_nodes - toggled(bool) - pfAdvancedDialog_q - ltToggled() - - - 20 - 20 - - - 20 - 20 - - - - - pf_do_limit_tables - toggled(bool) - pfAdvancedDialog_q - ltToggled() - - - 20 - 20 - - - 20 - 20 - - - - - pf_do_limit_table_entries - toggled(bool) - pfAdvancedDialog_q - ltToggled() - - - 20 - 20 - - - 20 - 20 - - - buttonHelp clicked() @@ -2976,5 +2850,104 @@ with this address: + + pf_do_limit_frags + clicked() + pfAdvancedDialog_q + ltToggled() + + + 156 + 100 + + + 349 + 299 + + + + + pf_do_limit_src_nodes + clicked() + pfAdvancedDialog_q + ltToggled() + + + 156 + 154 + + + 349 + 299 + + + + + pf_do_limit_states + clicked() + pfAdvancedDialog_q + ltToggled() + + + 156 + 127 + + + 349 + 299 + + + + + pf_do_limit_table_entries + clicked() + pfAdvancedDialog_q + ltToggled() + + + 156 + 208 + + + 349 + 299 + + + + + pf_do_limit_tables + clicked() + pfAdvancedDialog_q + ltToggled() + + + 156 + 181 + + + 349 + 299 + + + + + pf_do_scrub + toggled(bool) + pfAdvancedDialog_q + doScrubToggled() + + + 20 + 20 + + + 20 + 20 + + + + + ltToggled() + diff --git a/src/pflib/CompilerDriver_pf.cpp b/src/pflib/CompilerDriver_pf.cpp index 68e5941c4..4738a6769 100644 --- a/src/pflib/CompilerDriver_pf.cpp +++ b/src/pflib/CompilerDriver_pf.cpp @@ -166,12 +166,24 @@ void CompilerDriver_pf::printStaticOptions(QTextStream &file, Firewall* fw) file << endl; + string set_debug = options->getStr("pf_set_debug"); + if (!set_debug.empty()) + { + file << "set debug " << set_debug << endl; + } + string state_policy = options->getStr("pf_state_policy"); if (!state_policy.empty()) { file << "set state-policy " << state_policy << endl; } + string block_policy = options->getStr("pf_block_policy"); + if (!block_policy.empty()) + { + file << "set block-policy " << block_policy << endl; + } + QStringList limits; if (options->getBool("pf_do_limit_frags") && options->getInt("pf_limit_frags")>0 )