From cbd3ec6e678c6974d65cae4a046074264027abc0 Mon Sep 17 00:00:00 2001 From: Vadim Kurland Date: Mon, 2 Jun 2008 20:16:36 +0000 Subject: [PATCH] added version "1.4.0" for iptables --- doc/ChangeLog | 6 ++++ src/gui/platforms.cpp | 3 +- src/ipt/PolicyCompiler_PrintRule.cpp | 41 ++++++++++++++++++---------- src/ipt/PolicyCompiler_ipt.cpp | 9 ++++++ src/ipt/PolicyCompiler_ipt.h | 4 ++- 5 files changed, 46 insertions(+), 17 deletions(-) diff --git a/doc/ChangeLog b/doc/ChangeLog index 86c72b3ff..95c52aa67 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,3 +1,9 @@ +2008-06-02 Vadim Kurland + + * platforms.cpp (list): Added iptables version 1.4.0 to the list. + Will use it for the "new" time module support. Bug #1914371: + "iptables 1.4.0" + 2008-05-30 Vadim Kurland * pf.cpp (main): Like compiler for iptables, compiler for PF now diff --git a/src/gui/platforms.cpp b/src/gui/platforms.cpp index e16303fc8..d4d70a9b8 100644 --- a/src/gui/platforms.cpp +++ b/src/gui/platforms.cpp @@ -395,7 +395,8 @@ list getVersionsForPlatform(const QString &platform) res.push_back(QStringPair("lt_1.2.6", QObject::tr("1.2.5 or earlier"))); res.push_back(QStringPair("ge_1.2.6", QObject::tr("1.2.6 to 1.2.8"))); res.push_back(QStringPair("1.2.9", QObject::tr("1.2.9 to 1.2.11"))); - res.push_back(QStringPair("1.3.0", QObject::tr("1.3.0 or later"))); + res.push_back(QStringPair("1.3.0", QObject::tr("1.3.x"))); + res.push_back(QStringPair("1.4.0", QObject::tr("1.4.0 or later"))); } else { if (platform=="pix" || platform=="fwsm" || platform=="iosacl") diff --git a/src/ipt/PolicyCompiler_PrintRule.cpp b/src/ipt/PolicyCompiler_PrintRule.cpp index c73ced602..02fb66158 100644 --- a/src/ipt/PolicyCompiler_PrintRule.cpp +++ b/src/ipt/PolicyCompiler_PrintRule.cpp @@ -355,7 +355,8 @@ string PolicyCompiler_ipt::PrintRule::_printDirectionAndInterface(PolicyRule *ru Interface *rule_iface = compiler->getCachedFwInterface(rule->getInterfaceId()); - if (rule_iface && rule_iface->isBridgePort() && version == "1.3.0") + if (rule_iface && rule_iface->isBridgePort() && + (version == "1.3.0" || version == "1.4.0")) { if (rule->getDirection()==PolicyRule::Inbound) ostr << " -m physdev --physdev-in " << iface_name; @@ -392,23 +393,31 @@ string PolicyCompiler_ipt::PrintRule::_printActionOnReject(libfwbuilder::PolicyR string s=ipt_comp->getActionOnReject(rule); if (!s.empty()) { - if (ipt_comp->isActionOnRejectTCPRST(rule)) str << " --reject-with tcp-reset"; + if (ipt_comp->isActionOnRejectTCPRST(rule)) + str << " --reject-with tcp-reset"; if (s.find("ICMP")!=string::npos) { if (s.find("unreachable")!=string::npos) { - if (s.find("net")!=string::npos) str << " --reject-with icmp-net-unreachable"; - if (s.find("host")!=string::npos) str << " --reject-with icmp-host-unreachable"; - if (s.find("port")!=string::npos) str << " --reject-with icmp-port-unreachable"; - if (s.find("proto")!=string::npos) str << " --reject-with icmp-proto-unreachable"; + if (s.find("net")!=string::npos) + str << " --reject-with icmp-net-unreachable"; + if (s.find("host")!=string::npos) + str << " --reject-with icmp-host-unreachable"; + if (s.find("port")!=string::npos) + str << " --reject-with icmp-port-unreachable"; + if (s.find("proto")!=string::npos) + str << " --reject-with icmp-proto-unreachable"; } if (s.find("prohibited")!=string::npos) { - if (s.find("net")!=string::npos) str << " --reject-with icmp-net-prohibited"; - if (s.find("host")!=string::npos) str << " --reject-with icmp-host-prohibited"; - if ((version=="1.2.9" || version=="1.3.0") && - s.find("admin")!=string::npos) str << " --reject-with icmp-admin-prohibited"; + if (s.find("net")!=string::npos) + str << " --reject-with icmp-net-prohibited"; + if (s.find("host")!=string::npos) + str << " --reject-with icmp-host-prohibited"; + if (ipt_comp->newIptables(version) && + s.find("admin")!=string::npos) + str << " --reject-with icmp-admin-prohibited"; } } } @@ -580,6 +589,7 @@ string PolicyCompiler_ipt::PrintRule::_printLimit(libfwbuilder::PolicyRule *rule string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv) { + PolicyCompiler_ipt *ipt_comp = dynamic_cast(compiler); string version=compiler->fw->getStr("version"); string s; if (! srv->isAny() && !CustomService::isA(srv) && !TagService::isA(srv)) @@ -591,7 +601,7 @@ string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv) if (pn == "icmp") { - if (version.empty() || version=="1.2.9" || version=="1.3.0") + if (ipt_comp->newIptables(version)) { s += " -m icmp "; } @@ -733,6 +743,7 @@ string PolicyCompiler_ipt::PrintRule::_printTCPFlags(libfwbuilder::TCPService *s */ string PolicyCompiler_ipt::PrintRule::_printSrcService(RuleElementSrv *rel) { + PolicyCompiler_ipt *ipt_comp = dynamic_cast(compiler); std::ostringstream ostr; /* I do not want to use rel->getFirst because it traverses the tree to * find the object. I'd rather use a cached copy in the compiler @@ -773,7 +784,7 @@ string PolicyCompiler_ipt::PrintRule::_printSrcService(RuleElementSrv *rel) if ( !str.empty() ) { string v=compiler->fw->getStr("version"); - if (v.empty() || v=="ge_1.2.6" || v=="1.2.9" || v=="1.3.0") + if (ipt_comp->newIptables(v)) ostr << " --sports "; else ostr << " --source-port "; @@ -786,6 +797,7 @@ string PolicyCompiler_ipt::PrintRule::_printSrcService(RuleElementSrv *rel) string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel) { + PolicyCompiler_ipt *ipt_comp=dynamic_cast(compiler); std::ostringstream ostr; FWObject *o=rel->front(); string version=compiler->fw->getStr("version"); @@ -818,7 +830,7 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel) string str=_printICMP( ICMPService::cast(srv) ); if (str.empty() ) { - if (version.empty() || version=="1.2.9" || version=="1.3.0") + if (ipt_comp->newIptables(version)) ostr << " --icmp-type any "; } else { @@ -868,7 +880,7 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel) if ( !str.empty() ) { string v=compiler->fw->getStr("version"); - if (v.empty() || v=="ge_1.2.6" || v=="1.2.9" || v=="1.3.0") + if (ipt_comp->newIptables(v)) ostr << " --dports "; else ostr << " --destination-port "; @@ -1050,7 +1062,6 @@ string PolicyCompiler_ipt::PrintRule::_printTimeInterval(PolicyRule *r) PolicyCompiler_ipt::PrintRule::PrintRule(const std::string &name) : PolicyRuleProcessor(name) { - PolicyCompiler_ipt *ipt_comp=dynamic_cast(compiler); init=true; print_once_on_top=true; diff --git a/src/ipt/PolicyCompiler_ipt.cpp b/src/ipt/PolicyCompiler_ipt.cpp index 808fa4b0e..f0a9a71f2 100644 --- a/src/ipt/PolicyCompiler_ipt.cpp +++ b/src/ipt/PolicyCompiler_ipt.cpp @@ -4149,4 +4149,13 @@ string PolicyCompiler_ipt::commit() return createPrintRuleProcessor()->_commit(); } +bool PolicyCompiler_ipt::newIptables(const string &version) +{ + return (version.empty() || + version == "ge_1.2.6" || + version == "1.2.9" || + version == "1.3.0" || + version == "1.4.0"); +} + diff --git a/src/ipt/PolicyCompiler_ipt.h b/src/ipt/PolicyCompiler_ipt.h index 9f286ad3a..5dd3d2b92 100644 --- a/src/ipt/PolicyCompiler_ipt.h +++ b/src/ipt/PolicyCompiler_ipt.h @@ -75,7 +75,9 @@ namespace fwcompiler { std::string getInterfaceVarName(libfwbuilder::FWObject *iface); std::string getAddressTableVarName(libfwbuilder::FWObject *iface); - + + bool newIptables(const std::string &version); + /** * Add some predefined rules controlled by checkboxes in * firewall settings dialog