diff --git a/doc/ChangeLog b/doc/ChangeLog index 3393f5c54..b19e2d3a8 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,5 +1,11 @@ 2011-04-05 vadim + * PIXImporterNat.cpp (buildDNATRule): see #2313 "NAT with + access-list destination address and original service not set". + "Nat" and "static" commands that use access-list should import all + components of the access-list command (source, destination and + service/protocol). + * PIXImporterNat.cpp (buildSNATRule): see #2310 "Imported global / nat rule has wrong interface defined". Importer mixed up inbound and outbound interfaces in NAT commands created from combination diff --git a/src/import/PIXImporter.h b/src/import/PIXImporter.h index 130d46708..3112eae09 100644 --- a/src/import/PIXImporter.h +++ b/src/import/PIXImporter.h @@ -70,7 +70,7 @@ class PIXImporter : public IOSImporter { libfwbuilder::FWObject* getMirroredServiceObject(libfwbuilder::FWObject *obj); libfwbuilder::FWObject* mirrorServiceObjectRecursively(libfwbuilder::FWObject *obj); - + public: QString named_object_name; diff --git a/src/import/PIXImporterNat.cpp b/src/import/PIXImporterNat.cpp index 1a96c5b45..630a95a21 100644 --- a/src/import/PIXImporterNat.cpp +++ b/src/import/PIXImporterNat.cpp @@ -167,20 +167,34 @@ void PIXImporter::buildDNATRule() UnidirectionalRuleSet *rs = all_rulesets[real_addr_acl]; if (rs) { - RuleElement* tdst = rule->getTDst(); - assert(tdst!=NULL); - PolicyRule *policy_rule = PolicyRule::cast( rs->ruleset->getFirstByType(PolicyRule::TYPENAME)); if (policy_rule) { - RuleElement *src = policy_rule->getSrc(); - for (FWObject::iterator it=src->begin(); it!=src->end(); ++it) - { - FWObject *o = FWReference::getObject(*it); - tdst->addRef(o); - } + + RuleElement* osrc = rule->getOSrc(); + RuleElement* osrv = rule->getOSrv(); + RuleElement* tdst = rule->getTDst(); + + /* copy objects from a policy rule into + * rule elements of a nat rule + * + * Src --> TDst + * Dst --> OSrc + * Srv --> OSrv + */ + RuleElement *re = policy_rule->getSrc(); + for (FWObject::iterator it=re->begin(); it!=re->end(); ++it) + tdst->addRef(FWReference::getObject(*it)); + + re = policy_rule->getDst(); + for (FWObject::iterator it=re->begin(); it!=re->end(); ++it) + osrc->addRef(FWReference::getObject(*it)); + + re = policy_rule->getSrv(); + for (FWObject::iterator it=re->begin(); it!=re->end(); ++it) + osrv->addRef(FWReference::getObject(*it)); } rs->to_be_deleted = true; @@ -280,20 +294,33 @@ void PIXImporter::buildSNATRule() UnidirectionalRuleSet *rs = all_rulesets[nat_acl]; if (rs) { - RuleElement* osrc = rule->getOSrc(); - assert(osrc!=NULL); - PolicyRule *policy_rule = PolicyRule::cast( rs->ruleset->getFirstByType(PolicyRule::TYPENAME)); if (policy_rule) { - RuleElement *src = policy_rule->getSrc(); - for (FWObject::iterator it=src->begin(); it!=src->end(); ++it) - { - FWObject *o = FWReference::getObject(*it); - osrc->addRef(o); - } + RuleElement* osrc = rule->getOSrc(); + RuleElement* odst = rule->getODst(); + RuleElement* osrv = rule->getOSrv(); + + /* copy objects from a policy rule into "original" + * rule elements of a nat rule + * + * Src --> OSrc + * Dst --> ODst + * Srv --> OSrv + */ + RuleElement *re = policy_rule->getSrc(); + for (FWObject::iterator it=re->begin(); it!=re->end(); ++it) + osrc->addRef(FWReference::getObject(*it)); + + re = policy_rule->getDst(); + for (FWObject::iterator it=re->begin(); it!=re->end(); ++it) + odst->addRef(FWReference::getObject(*it)); + + re = policy_rule->getSrv(); + for (FWObject::iterator it=re->begin(); it!=re->end(); ++it) + osrv->addRef(FWReference::getObject(*it)); } rs->to_be_deleted = true; diff --git a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.fwb b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.fwb index fea7bb7e9..4e99aa7f6 100644 --- a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.fwb +++ b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.fwb @@ -1,6 +1,6 @@ - + @@ -441,198 +441,93 @@ - - - - - - - - - + + + + + + + + + + + + - - - - + + + + - + - + - - + + - - + + - - - - - - - - - - + + + + + + + + + + - - + + - - - - - + + + + + - - - - - - + + + + + + - - + + - - - + + + - - - - + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + @@ -641,154 +536,262 @@ - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + - + - + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + @@ -803,76 +806,49 @@ - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - + - + - + - + - + - + - + @@ -881,79 +857,135 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -965,28 +997,55 @@ - + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - + - + - + - + @@ -995,18 +1054,18 @@ - + - + - + - + - + @@ -1015,18 +1074,18 @@ - + - + - + - + - + @@ -1035,28 +1094,7 @@ - - - - - - - - - - - - - - - - - - - - - - + @@ -1064,10 +1102,10 @@ - + - + @@ -1077,18 +1115,18 @@ - + - + - + - + @@ -1098,18 +1136,39 @@ - + - + + + + + + + + + + + + + + + + + + + + + + - + - + @@ -1118,7 +1177,7 @@ - + @@ -1126,10 +1185,10 @@ - + - + @@ -1139,39 +1198,18 @@ - - - - - - - - - - - - - - - - - - - - - - + - + - + - + @@ -1181,18 +1219,18 @@ - + - + - + - + - + @@ -1202,18 +1240,39 @@ - + - + + + + + + + + + + + + + + + + + + + + + + - + - + @@ -1222,7 +1281,7 @@ - + @@ -1230,10 +1289,10 @@ - + - + @@ -1243,28 +1302,7 @@ - - - - - - - - - - - - - - - - - - - - - - + @@ -1272,10 +1310,10 @@ - + - + @@ -1285,18 +1323,18 @@ - + - + - + - + @@ -1306,18 +1344,39 @@ - + - + - + - + + + + + + + + + + + + + + + + + + + + + + @@ -1329,28 +1388,28 @@ - + - + - - + + - - + + - - + + @@ -1371,7 +1430,7 @@ - - + + diff --git a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.output b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.output index 7e826e123..7d844de94 100644 --- a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.output +++ b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.output @@ -49,28 +49,32 @@ Warning: interface Ethernet6 was not imported because it is in "shutdown" mode 102: access list rule, action deny 104: access list rule, action permit 106: access list rule, action permit -133: Global address pool: number 1, interface outside, address range interface-interface, netmask 255.255.255.255 -134: Source translation rule ("nat" command) -136: Global address pool: number 2, interface outside, address range 192.0.2.10-192.0.2.10, netmask 255.255.255.255 -137: Global address pool: number 2, interface outside, address range 192.0.2.11-192.0.2.15, netmask 255.255.255.255 -138: Global address pool: number 2, interface outside, address range 192.0.2.128-192.0.2.128, netmask 255.255.255.240 -139: Global address pool: number 2, interface dmz20, address range 10.0.0.128-10.0.0.128, netmask 255.255.255.240 -141: Source translation rule ("nat" command) -142: Source translation rule ("nat" command) -145: Destination translation rule ("static" command) -146: Destination translation rule ("static" command) -147: Destination translation rule ("static" command) -148: Destination translation rule ("static" command) -149: Destination translation rule ("static" command) +109: access list rule, action permit +111: access list rule, action permit +138: Global address pool: number 1, interface outside, address range interface-interface, netmask 255.255.255.255 +139: Source translation rule ("nat" command) +141: Global address pool: number 2, interface outside, address range 192.0.2.10-192.0.2.10, netmask 255.255.255.255 +142: Global address pool: number 2, interface outside, address range 192.0.2.11-192.0.2.15, netmask 255.255.255.255 +143: Global address pool: number 2, interface outside, address range 192.0.2.128-192.0.2.128, netmask 255.255.255.240 +144: Global address pool: number 2, interface dmz20, address range 10.0.0.128-10.0.0.128, netmask 255.255.255.240 +146: Source translation rule ("nat" command) +147: Source translation rule ("nat" command) +149: Source translation rule ("nat" command) 151: Destination translation rule ("static" command) 152: Destination translation rule ("static" command) 153: Destination translation rule ("static" command) -157: Interface Ethernet0.101 ruleset outside_in direction 'in' -158: Interface Ethernet1 ruleset inside_in direction 'in' -159: Interface Ethernet1 ruleset inside_out direction 'out' -200: Interface Ethernet1 ruleset ssh_commands_inside direction 'in' -200: access list rule, action permit -201: Interface Ethernet1 ruleset ssh_commands_inside direction 'in' -201: access list rule, action permit -202: Interface Ethernet0.101 ruleset ssh_commands_outside direction 'in' -202: access list rule, action permit +154: Destination translation rule ("static" command) +155: Destination translation rule ("static" command) +157: Destination translation rule ("static" command) +158: Destination translation rule ("static" command) +159: Destination translation rule ("static" command) +161: Destination translation rule ("static" command) +164: Interface Ethernet0.101 ruleset outside_in direction 'in' +165: Interface Ethernet1 ruleset inside_in direction 'in' +166: Interface Ethernet1 ruleset inside_out direction 'out' +207: Interface Ethernet1 ruleset ssh_commands_inside direction 'in' +207: access list rule, action permit +208: Interface Ethernet1 ruleset ssh_commands_inside direction 'in' +208: access list rule, action permit +209: Interface Ethernet0.101 ruleset ssh_commands_outside direction 'in' +209: access list rule, action permit diff --git a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.test b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.test index ad03dd28a..08ed468cd 100644 --- a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.test +++ b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.test @@ -105,6 +105,11 @@ access-list id12251X6282.0 extended permit ip 10.1.1.0 255.255.255.0 any access-list id12594X2458.0 permit tcp host 10.1.1.43 eq www any +! example from cisco docs, see also nat command below +access-list WEB permit tcp 10.1.1.0 255.255.255.0 4.2.2.1 255.255.255.255 eq 80 + +access-list NET1 permit ip host 10.1.1.20 host 4.2.2.1 + pager lines 24 logging enable logging emblem @@ -141,6 +146,7 @@ global (dmz20) 2 10.0.0.128 netmask 255.255.255.240 nat (inside) 2 10.1.1.1 255.255.255.255 nat (inside) 2 10.1.1.32 255.255.255.240 +nat (inside) 1 access-list WEB static (inside,dmz20) 10.0.0.16 10.1.1.16 netmask 255.255.255.240 static (inside,dmz20) 10.0.0.100 10.1.1.100 netmask 255.255.255.255 @@ -152,6 +158,7 @@ static (inside,outside) tcp interface www access-list id12594X2458.0 0 0 static (inside,outside) tcp interface 80 access-list id12594X2458.0 0 0 static (inside,outside) interface access-list id12594X2458.0 0 0 +static (inside,outside) 192.0.2.15 access-list NET1 access-group outside_in in interface outside