onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-11 15:41:41 +02:00
Code Issues Releases Wiki Activity

added version "1.4.0" for iptables

Browse Source
This commit is contained in:
Vadim Kurland
2008-06-02 20:16:36 +00:00
parent bbd285057b
commit cbd3ec6e67
5 changed files with 46 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/ChangeLog
+6
View File
@@ -1,3 +1,9 @@
2008-06-02 Vadim Kurland <vadim@vk.crocodile.org>
* platforms.cpp (list): Added iptables version 1.4.0 to the list.
Will use it for the "new" time module support. Bug #1914371:
"iptables 1.4.0"
2008-05-30 Vadim Kurland <vadim@vk.crocodile.org>
* pf.cpp (main): Like compiler for iptables, compiler for PF now
src/gui/platforms.cpp
+2 -1
View File
@@ -395,7 +395,8 @@ list<QStringPair> getVersionsForPlatform(const QString &platform)
res.push_back(QStringPair("lt_1.2.6", QObject::tr("1.2.5 or earlier")));
res.push_back(QStringPair("ge_1.2.6", QObject::tr("1.2.6 to 1.2.8")));
res.push_back(QStringPair("1.2.9", QObject::tr("1.2.9 to 1.2.11")));
res.push_back(QStringPair("1.3.0", QObject::tr("1.3.0 or later")));
res.push_back(QStringPair("1.3.0", QObject::tr("1.3.x")));
res.push_back(QStringPair("1.4.0", QObject::tr("1.4.0 or later")));
} else
{
if (platform=="pix" || platform=="fwsm" || platform=="iosacl")
src/ipt/PolicyCompiler_PrintRule.cpp
+26 -15
View File
@@ -355,7 +355,8 @@ string PolicyCompiler_ipt::PrintRule::_printDirectionAndInterface(PolicyRule *ru
Interface *rule_iface =
compiler->getCachedFwInterface(rule->getInterfaceId());
if (rule_iface && rule_iface->isBridgePort() && version == "1.3.0")
if (rule_iface && rule_iface->isBridgePort() &&
(version == "1.3.0" || version == "1.4.0"))
{
if (rule->getDirection()==PolicyRule::Inbound)
ostr << " -m physdev --physdev-in " << iface_name;
@@ -392,23 +393,31 @@ string PolicyCompiler_ipt::PrintRule::_printActionOnReject(libfwbuilder::PolicyR
string s=ipt_comp->getActionOnReject(rule);
if (!s.empty())
{
if (ipt_comp->isActionOnRejectTCPRST(rule)) str << " --reject-with tcp-reset";
if (ipt_comp->isActionOnRejectTCPRST(rule))
str << " --reject-with tcp-reset";
if (s.find("ICMP")!=string::npos)
{
if (s.find("unreachable")!=string::npos)
{
if (s.find("net")!=string::npos) str << " --reject-with icmp-net-unreachable";
if (s.find("host")!=string::npos) str << " --reject-with icmp-host-unreachable";
if (s.find("port")!=string::npos) str << " --reject-with icmp-port-unreachable";
if (s.find("proto")!=string::npos) str << " --reject-with icmp-proto-unreachable";
if (s.find("net")!=string::npos)
str << " --reject-with icmp-net-unreachable";
if (s.find("host")!=string::npos)
str << " --reject-with icmp-host-unreachable";
if (s.find("port")!=string::npos)
str << " --reject-with icmp-port-unreachable";
if (s.find("proto")!=string::npos)
str << " --reject-with icmp-proto-unreachable";
}
if (s.find("prohibited")!=string::npos)
{
if (s.find("net")!=string::npos) str << " --reject-with icmp-net-prohibited";
if (s.find("host")!=string::npos) str << " --reject-with icmp-host-prohibited";
if ((version=="1.2.9" || version=="1.3.0") &&
s.find("admin")!=string::npos) str << " --reject-with icmp-admin-prohibited";
if (s.find("net")!=string::npos)
str << " --reject-with icmp-net-prohibited";
if (s.find("host")!=string::npos)
str << " --reject-with icmp-host-prohibited";
if (ipt_comp->newIptables(version) &&
s.find("admin")!=string::npos)
str << " --reject-with icmp-admin-prohibited";
}
}
}
@@ -580,6 +589,7 @@ string PolicyCompiler_ipt::PrintRule::_printLimit(libfwbuilder::PolicyRule *rule
string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv)
{
PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
string version=compiler->fw->getStr("version");
string s;
if (! srv->isAny() && !CustomService::isA(srv) && !TagService::isA(srv))
@@ -591,7 +601,7 @@ string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv)
if (pn == "icmp")
{
if (version.empty() || version=="1.2.9" || version=="1.3.0")
if (ipt_comp->newIptables(version))
{
s += " -m icmp ";
}
@@ -733,6 +743,7 @@ string PolicyCompiler_ipt::PrintRule::_printTCPFlags(libfwbuilder::TCPService *s
*/
string PolicyCompiler_ipt::PrintRule::_printSrcService(RuleElementSrv *rel)
{
PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
std::ostringstream ostr;
/* I do not want to use rel->getFirst because it traverses the tree to
* find the object. I'd rather use a cached copy in the compiler
@@ -773,7 +784,7 @@ string PolicyCompiler_ipt::PrintRule::_printSrcService(RuleElementSrv *rel)
if ( !str.empty() )
{
string v=compiler->fw->getStr("version");
if (v.empty() || v=="ge_1.2.6" || v=="1.2.9" || v=="1.3.0")
if (ipt_comp->newIptables(v))
ostr << " --sports ";
else
ostr << " --source-port ";
@@ -786,6 +797,7 @@ string PolicyCompiler_ipt::PrintRule::_printSrcService(RuleElementSrv *rel)
string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel)
{
PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
std::ostringstream ostr;
FWObject *o=rel->front();
string version=compiler->fw->getStr("version");
@@ -818,7 +830,7 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel)
string str=_printICMP( ICMPService::cast(srv) );
if (str.empty() )
{
if (version.empty() || version=="1.2.9" || version=="1.3.0")
if (ipt_comp->newIptables(version))
ostr << " --icmp-type any ";
} else
{
@@ -868,7 +880,7 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv *rel)
if ( !str.empty() )
{
string v=compiler->fw->getStr("version");
if (v.empty() || v=="ge_1.2.6" || v=="1.2.9" || v=="1.3.0")
if (ipt_comp->newIptables(v))
ostr << " --dports ";
else
ostr << " --destination-port ";
@@ -1050,7 +1062,6 @@ string PolicyCompiler_ipt::PrintRule::_printTimeInterval(PolicyRule *r)
PolicyCompiler_ipt::PrintRule::PrintRule(const std::string &name) : PolicyRuleProcessor(name)
{
PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
init=true;
print_once_on_top=true;
src/ipt/PolicyCompiler_ipt.cpp
+9
View File
@@ -4149,4 +4149,13 @@ string PolicyCompiler_ipt::commit()
return createPrintRuleProcessor()->_commit();
}
bool PolicyCompiler_ipt::newIptables(const string &version)
{
return (version.empty() ||
version == "ge_1.2.6" ||
version == "1.2.9" ||
version == "1.3.0" ||
version == "1.4.0");
}
src/ipt/PolicyCompiler_ipt.h
+2
View File
@@ -76,6 +76,8 @@ namespace fwcompiler {
std::string getInterfaceVarName(libfwbuilder::FWObject *iface);
std::string getAddressTableVarName(libfwbuilder::FWObject *iface);
bool newIptables(const std::string &version);
/**
* Add some predefined rules controlled by checkboxes in
* firewall settings dialog