onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-14 00:49:09 +02:00
Code Issues Releases Wiki Activity

* OSConfigurator_pix_os.cpp (_printSysopt): see #2345 More fixes for

Browse Source 
FWSM 4.x: "service resetoutbound", "timeout xlate", "timeout sunrpc"
This commit is contained in:
Vadim Kurland
2011-04-13 17:10:16 -07:00
parent 0e303fe444
commit c93421f0e3
4 changed files with 65 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/ChangeLog
+3
View File
@@ -1,5 +1,8 @@
2011-04-13 Vadim Kurland <vadim@netcitadel.com>
* OSConfigurator_pix_os.cpp (_printSysopt): see #2345 More fixes for
FWSM 4.x: "service resetoutbound", "timeout xlate", "timeout sunrpc"
* OSConfigurator_pix_os.cpp (_printInterfaceConfiguration): see #2343
"Interface nameif error when installing generated config for FWSM".
Use correct "nameif" command sytax in FWSM 2.x and 4.x.
src/cisco_lib/OSConfigurator_pix_os.cpp
+48 -29
View File
@@ -658,23 +658,25 @@ string OSConfigurator_pix_os::_printSysopt()
FWOptions *options=fw->getOptionsObject();
assert(options!=NULL);
bool tcpmss= fw->getOptionsObject()->getBool("pix_tcpmss");
int tcpmss_val=fw->getOptionsObject()->getInt("pix_tcpmss_value");
bool tcpmss = fw->getOptionsObject()->getBool("pix_tcpmss");
int tcpmss_val = fw->getOptionsObject()->getInt("pix_tcpmss_value");
res << endl;
if (fw->getOptionsObject()->getBool("pix_resetinbound"))
res << "service resetinbound" << endl;
else
res << "no service resetinbound" << endl;
if (fw->getOptionsObject()->getBool("pix_resetoutside"))
res << "service resetoutside" << endl;
else
res << "no service resetoutside" << endl;
if (Resources::platform_res[platform]->getResourceBool(
"/FWBuilderResources/Target/options/version_" + version +
"/pix_resetoutside_supported"))
{
if (fw->getOptionsObject()->getBool("pix_resetoutside"))
res << "service resetoutside" << endl;
else
res << "no service resetoutside" << endl;
}
if (tcpmss)
res << "sysopt connection tcpmss " << tcpmss_val << endl;
@@ -688,7 +690,7 @@ string OSConfigurator_pix_os::_printSysopt()
}
if (Resources::platform_res[platform]->getResourceBool(
"/FWBuilderResources/Target/options/version_"+version+
"/FWBuilderResources/Target/options/version_" + version +
"/pix_security_fragguard_supported") )
{
if ( fw->getOptionsObject()->getBool("pix_fragguard") )
@@ -732,40 +734,57 @@ string OSConfigurator_pix_os::_printSysopt()
return res.str();
}
string OSConfigurator_pix_os::_printServiceTimeout(
const std::string &pix_service)
string OSConfigurator_pix_os::_printServiceTimeout(const string &pix_service)
{
ostringstream res;
string hh,mm,ss;
QStringList res;
QString hh, mm, ss;
string version = fw->getStr("version");
string platform = fw->getStr("platform");
bool use_sunrpc = Resources::platform_res[platform]->getResourceBool(
"/FWBuilderResources/Target/options/version_"+version+
"/FWBuilderResources/Target/options/version_" + version +
"/pix_timeout_rpc_is_sunrpc");
hh=fw->getOptionsObject()->getStr(pix_service+"_hh");
mm=fw->getOptionsObject()->getStr(pix_service+"_mm");
ss=fw->getOptionsObject()->getStr(pix_service+"_ss");
hh = fw->getOptionsObject()->getStr(pix_service+"_hh").c_str();
mm = fw->getOptionsObject()->getStr(pix_service+"_mm").c_str();
ss = fw->getOptionsObject()->getStr(pix_service+"_ss").c_str();
if (hh!="" && mm!="" && ss!="")
if ( ! hh.isEmpty() && ! mm.isEmpty() && ! ss.isEmpty())
{
string service_name = pix_service;
if (pix_service=="rpc" && use_sunrpc)
service_name = "sunrpc";
QString service_name = pix_service.c_str();
res << "timeout " << service_name
<< " " << hh << ":" << mm << ":" << ss << " ";
if (pix_service == "rpc" && use_sunrpc) service_name = "sunrpc";
if (pix_service=="uauth")
bool ok1, ok2, ok3;
int hh_int = hh.toInt(&ok1); if (!ok1) hh_int = 0;
int mm_int = mm.toInt(&ok2); if (!ok2) mm_int = 0;
int ss_int = ss.toInt(&ok3); if (!ok3) ss_int = 0;
if (!ok1 || !ok2 || !ok3)
qDebug() << QString("Invalid timeout spec '%1:%2:%3'")
.arg(hh).arg(mm).arg(ss);
if (pix_service == "xlate" && hh_int == 0 && mm_int == 0 && ss_int == 0)
{
bool abs=fw->getOptionsObject()->getBool("uauth_abs");
bool inact=fw->getOptionsObject()->getBool("uauth_inact");
ss_int = 30;
}
res << QString("timeout %1 %2:%3:%4")
.arg(service_name).arg(hh_int).arg(mm_int).arg(ss_int);
if (pix_service == "uauth")
{
bool abs = fw->getOptionsObject()->getBool("uauth_abs");
bool inact = fw->getOptionsObject()->getBool("uauth_inact");
if (abs) res << "absolute";
if (inact) res << "inactivity";
}
res << endl;
res << "\n";
}
return res.str();
return res.join(" ").toStdString();
}
string OSConfigurator_pix_os::_printTimeouts()
src/res/platform/fwsm.xml
+6 -4
View File
@@ -48,6 +48,7 @@
<pix_outbound_acl_supported>true</pix_outbound_acl_supported>
<pix_timeout_rpc_is_sunrpc>false</pix_timeout_rpc_is_sunrpc>
<pix_object_groups_supported>true</pix_object_groups_supported>
<pix_resetoutside_supported>true</pix_resetoutside_supported>
<pix_commands>
<clear_acl>clear access-list</clear_acl>
@@ -116,7 +117,7 @@ nameif %in %il security%sl
</timeouts>
<fixups>
<list>dns_fixup,espike_fixup,ftp_fixup,h323_h225_fixup,h323_ras_fixup,http_fixup,icmp_error_fixup,ils_fixup,mgcp_fixup,rsh_fixup,rtsp_fixup,sip_fixup,sip_udp_fixup,skinny_fixup,smtp_fixup,sqlnet_fixup,tftp_fixup</list>
<list>dns_fixup,ftp_fixup,h323_h225_fixup,h323_ras_fixup,http_fixup,icmp_error_fixup,ils_fixup,mgcp_fixup,rsh_fixup,rtsp_fixup,sip_fixup,sip_udp_fixup,skinny_fixup,smtp_fixup,sqlnet_fixup,tftp_fixup</list>
<use_fixup_commands>true</use_fixup_commands>
<use_mpf_policy_map>false</use_mpf_policy_map>
@@ -133,7 +134,7 @@ nameif %in %il security%sl
<pix_use_acl_remarks>true</pix_use_acl_remarks>
<pix_add_clear_statements>true</pix_add_clear_statements>
<pix_assume_fw_part_of_any>true</pix_assume_fw_part_of_any>
<pix_floodguard_supported>true</pix_floodguard_supported>
<pix_floodguard_supported>false</pix_floodguard_supported>
<pix_floodguard>true</pix_floodguard>
<pix_default_loglevel>info</pix_default_loglevel>
<pix_default_logint>300</pix_default_logint>
@@ -143,8 +144,9 @@ nameif %in %il security%sl
<pix_security_fragguard_supported>false</pix_security_fragguard_supported>
<pix_route_dnat_supported>false</pix_route_dnat_supported>
<pix_outbound_acl_supported>true</pix_outbound_acl_supported>
<pix_timeout_rpc_is_sunrpc>false</pix_timeout_rpc_is_sunrpc>
<pix_timeout_rpc_is_sunrpc>true</pix_timeout_rpc_is_sunrpc>
<pix_object_groups_supported>true</pix_object_groups_supported>
<pix_resetoutside_supported>false</pix_resetoutside_supported>
<pix_commands>
<clear_acl>clear config access-list</clear_acl>
@@ -214,7 +216,7 @@ nameif %in %il security%sl
</timeouts>
<fixups>
<list>dns_fixup,espike_fixup,ftp_fixup,h323_h225_fixup,h323_ras_fixup,http_fixup,icmp_error_fixup,ils_fixup,mgcp_fixup,rsh_fixup,rtsp_fixup,sip_fixup,sip_udp_fixup,skinny_fixup,smtp_fixup,sqlnet_fixup,tftp_fixup</list>
<list>dns_fixup,ftp_fixup,h323_h225_fixup,h323_ras_fixup,http_fixup,icmp_error_fixup,ils_fixup,mgcp_fixup,rsh_fixup,rtsp_fixup,sip_fixup,sip_udp_fixup,skinny_fixup,smtp_fixup,sqlnet_fixup,tftp_fixup</list>
<use_fixup_commands>false</use_fixup_commands>
<use_mpf_policy_map>true</use_mpf_policy_map>
src/res/platform/pix.xml
+8
View File
@@ -28,6 +28,7 @@
<pix_syslog_device_id_supported>false</pix_syslog_device_id_supported>
<pix_security_fragguard_supported>true</pix_security_fragguard_supported>
<pix_route_dnat_supported>true</pix_route_dnat_supported>
<pix_resetoutside_supported>true</pix_resetoutside_supported>
</default>
<version_6.1>
@@ -48,6 +49,7 @@
<pix_outbound_acl_supported>false</pix_outbound_acl_supported>
<pix_timeout_rpc_is_sunrpc>false</pix_timeout_rpc_is_sunrpc>
<pix_object_groups_supported>false</pix_object_groups_supported>
<pix_resetoutside_supported>true</pix_resetoutside_supported>
<supports_mixed_service_groups>False</supports_mixed_service_groups>
@@ -134,6 +136,7 @@
<pix_outbound_acl_supported>false</pix_outbound_acl_supported>
<pix_timeout_rpc_is_sunrpc>false</pix_timeout_rpc_is_sunrpc>
<pix_object_groups_supported>true</pix_object_groups_supported>
<pix_resetoutside_supported>true</pix_resetoutside_supported>
<supports_mixed_service_groups>False</supports_mixed_service_groups>
@@ -220,6 +223,7 @@
<pix_outbound_acl_supported>false</pix_outbound_acl_supported>
<pix_timeout_rpc_is_sunrpc>false</pix_timeout_rpc_is_sunrpc>
<pix_object_groups_supported>true</pix_object_groups_supported>
<pix_resetoutside_supported>true</pix_resetoutside_supported>
<supports_mixed_service_groups>False</supports_mixed_service_groups>
@@ -307,6 +311,7 @@
<pix_outbound_acl_supported>true</pix_outbound_acl_supported>
<pix_timeout_rpc_is_sunrpc>true</pix_timeout_rpc_is_sunrpc>
<pix_object_groups_supported>true</pix_object_groups_supported>
<pix_resetoutside_supported>true</pix_resetoutside_supported>
<supports_mixed_service_groups>False</supports_mixed_service_groups>
@@ -395,6 +400,7 @@
<pix_outbound_acl_supported>true</pix_outbound_acl_supported>
<pix_timeout_rpc_is_sunrpc>true</pix_timeout_rpc_is_sunrpc>
<pix_object_groups_supported>true</pix_object_groups_supported>
<pix_resetoutside_supported>true</pix_resetoutside_supported>
<supports_mixed_service_groups>True</supports_mixed_service_groups>
@@ -483,6 +489,7 @@
<pix_outbound_acl_supported>true</pix_outbound_acl_supported>
<pix_timeout_rpc_is_sunrpc>true</pix_timeout_rpc_is_sunrpc>
<pix_object_groups_supported>true</pix_object_groups_supported>
<pix_resetoutside_supported>true</pix_resetoutside_supported>
<supports_mixed_service_groups>True</supports_mixed_service_groups>
@@ -572,6 +579,7 @@
<pix_outbound_acl_supported>true</pix_outbound_acl_supported>
<pix_timeout_rpc_is_sunrpc>true</pix_timeout_rpc_is_sunrpc>
<pix_object_groups_supported>true</pix_object_groups_supported>
<pix_resetoutside_supported>true</pix_resetoutside_supported>
<supports_mixed_service_groups>True</supports_mixed_service_groups>