added version "1.4.0" for iptables

doc/ChangeLog

@@ -1,3 +1,9 @@
+2008-06-02  Vadim Kurland  <vadim@vk.crocodile.org>
+
+	* platforms.cpp (list): Added iptables version 1.4.0 to the list.
+	Will use it for the "new" time module support. Bug #1914371:
+	"iptables 1.4.0"
+
 2008-05-30  Vadim Kurland  <vadim@vk.crocodile.org>
 
 	* pf.cpp (main): Like compiler for iptables, compiler for PF now

src/gui/platforms.cpp

@@ -395,7 +395,8 @@ list<QStringPair> getVersionsForPlatform(const QString &platform)
         res.push_back(QStringPair("lt_1.2.6", QObject::tr("1.2.5 or earlier")));
         res.push_back(QStringPair("ge_1.2.6", QObject::tr("1.2.6 to 1.2.8")));
         res.push_back(QStringPair("1.2.9", QObject::tr("1.2.9 to 1.2.11")));
-        res.push_back(QStringPair("1.3.0", QObject::tr("1.3.0 or later")));
+        res.push_back(QStringPair("1.3.0", QObject::tr("1.3.x")));
+        res.push_back(QStringPair("1.4.0", QObject::tr("1.4.0 or later")));
     } else
     {
         if (platform=="pix" || platform=="fwsm" || platform=="iosacl")

src/ipt/PolicyCompiler_PrintRule.cpp

@@ -355,7 +355,8 @@ string PolicyCompiler_ipt::PrintRule::_printDirectionAndInterface(PolicyRule *ru
     Interface *rule_iface =
         compiler->getCachedFwInterface(rule->getInterfaceId());
 
-    if (rule_iface && rule_iface->isBridgePort() && version == "1.3.0")
+    if (rule_iface && rule_iface->isBridgePort() &&
+        (version == "1.3.0" || version == "1.4.0"))
     {
         if (rule->getDirection()==PolicyRule::Inbound)   
             ostr << " -m physdev --physdev-in "  << iface_name; 
@@ -392,23 +393,31 @@ string PolicyCompiler_ipt::PrintRule::_printActionOnReject(libfwbuilder::PolicyR
     string s=ipt_comp->getActionOnReject(rule);
     if (!s.empty()) 
     {
-        if (ipt_comp->isActionOnRejectTCPRST(rule)) str << " --reject-with tcp-reset";
+        if (ipt_comp->isActionOnRejectTCPRST(rule))
+            str << " --reject-with tcp-reset";
 
 	if (s.find("ICMP")!=string::npos) 
         {
 	    if (s.find("unreachable")!=string::npos) 
             {
-		if (s.find("net")!=string::npos)   str << " --reject-with icmp-net-unreachable";
+		if (s.find("net")!=string::npos)
-		if (s.find("host")!=string::npos)  str << " --reject-with icmp-host-unreachable";
+                    str << " --reject-with icmp-net-unreachable";
-		if (s.find("port")!=string::npos)  str << " --reject-with icmp-port-unreachable";
+		if (s.find("host")!=string::npos)
-		if (s.find("proto")!=string::npos) str << " --reject-with icmp-proto-unreachable";
+                    str << " --reject-with icmp-host-unreachable";
+		if (s.find("port")!=string::npos)
+                    str << " --reject-with icmp-port-unreachable";
+		if (s.find("proto")!=string::npos)
+                    str << " --reject-with icmp-proto-unreachable";
 	    }
 	    if (s.find("prohibited")!=string::npos) 
             {
-		if (s.find("net")!=string::npos)   str << " --reject-with icmp-net-prohibited";
+		if (s.find("net")!=string::npos)
-		if (s.find("host")!=string::npos)  str << " --reject-with icmp-host-prohibited";
+                    str << " --reject-with icmp-net-prohibited";
-                if ((version=="1.2.9" || version=="1.3.0") && 
+		if (s.find("host")!=string::npos)
-                    s.find("admin")!=string::npos)  str << " --reject-with icmp-admin-prohibited";
+                    str << " --reject-with icmp-host-prohibited";
+                if (ipt_comp->newIptables(version) &&
+                    s.find("admin")!=string::npos)
+                    str << " --reject-with icmp-admin-prohibited";
 	    }
 	}
     }
@@ -580,6 +589,7 @@ string PolicyCompiler_ipt::PrintRule::_printLimit(libfwbuilder::PolicyRule *rule
 
 string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv)
 {
+    PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
     string version=compiler->fw->getStr("version");
     string s;
     if (! srv->isAny() && !CustomService::isA(srv)  && !TagService::isA(srv))
@@ -591,7 +601,7 @@ string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv)
 
         if (pn == "icmp")
         {
-            if (version.empty() || version=="1.2.9" || version=="1.3.0")
+            if (ipt_comp->newIptables(version))
             {
                 s += " -m icmp ";
             }
@@ -733,6 +743,7 @@ string PolicyCompiler_ipt::PrintRule::_printTCPFlags(libfwbuilder::TCPService *s
  */
 string PolicyCompiler_ipt::PrintRule::_printSrcService(RuleElementSrv  *rel)
 {
+    PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
     std::ostringstream  ostr;
 /* I do not want to use rel->getFirst because it traverses the tree to
  * find the object. I'd rather use a cached copy in the compiler
@@ -773,7 +784,7 @@ string PolicyCompiler_ipt::PrintRule::_printSrcService(RuleElementSrv  *rel)
 	if ( !str.empty() ) 
         {
             string v=compiler->fw->getStr("version");
-            if (v.empty() || v=="ge_1.2.6" || v=="1.2.9" || v=="1.3.0")
+            if (ipt_comp->newIptables(v))
                 ostr << " --sports ";
             else
                 ostr << " --source-port ";
@@ -786,6 +797,7 @@ string PolicyCompiler_ipt::PrintRule::_printSrcService(RuleElementSrv  *rel)
 
 string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv  *rel)
 {
+    PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
     std::ostringstream  ostr;
     FWObject *o=rel->front();
     string version=compiler->fw->getStr("version");
@@ -818,7 +830,7 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv  *rel)
 	    string str=_printICMP( ICMPService::cast(srv) );
 	    if (str.empty() ) 
             {
-                if (version.empty() || version=="1.2.9" || version=="1.3.0")
+                if (ipt_comp->newIptables(version))
                     ostr << " --icmp-type any ";
             } else
             {
@@ -868,7 +880,7 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv  *rel)
 	if ( !str.empty() ) 
         {
             string v=compiler->fw->getStr("version");
-            if (v.empty() || v=="ge_1.2.6" || v=="1.2.9" || v=="1.3.0")
+            if (ipt_comp->newIptables(v))
                 ostr << " --dports ";
             else
                 ostr << " --destination-port ";
@@ -1050,7 +1062,6 @@ string PolicyCompiler_ipt::PrintRule::_printTimeInterval(PolicyRule *r)
 
 PolicyCompiler_ipt::PrintRule::PrintRule(const std::string &name) : PolicyRuleProcessor(name) 
 { 
-    PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
     init=true; 
     print_once_on_top=true;
 

src/ipt/PolicyCompiler_ipt.cpp

@@ -4149,4 +4149,13 @@ string PolicyCompiler_ipt::commit()
     return createPrintRuleProcessor()->_commit();
 }
 
+bool PolicyCompiler_ipt::newIptables(const string &version)
+{
+    return (version.empty() || 
+            version == "ge_1.2.6" ||
+            version == "1.2.9" ||
+            version == "1.3.0" ||
+            version == "1.4.0");
+}
+
 

src/ipt/PolicyCompiler_ipt.h

@@ -76,6 +76,8 @@ namespace fwcompiler {
         std::string getInterfaceVarName(libfwbuilder::FWObject *iface);
         std::string getAddressTableVarName(libfwbuilder::FWObject *iface);
 
+        bool newIptables(const std::string &version);
+
 	/**
 	 * Add some predefined rules controlled by checkboxes in
 	 * firewall settings dialog