diff --git a/src/fwblookup/fwblookup.cpp b/src/fwblookup/fwblookup.cpp index 7b574fd0e..29f9a9f6d 100644 --- a/src/fwblookup/fwblookup.cpp +++ b/src/fwblookup/fwblookup.cpp @@ -90,7 +90,7 @@ int fwbdebug = 0; class UpgradePredicate: public XMLTools::UpgradePredicate { public: - virtual bool operator()(const string &msg) const + virtual bool operator()(const string&) const { cout << _("Data file has been created in the old version of Firewall Builder. Use fwbuilder GUI to convert it.") << endl; return false; @@ -317,10 +317,10 @@ int main(int argc, char * const *argv) { if (Host::isA(obj) || Firewall::isA(obj)) { - InetAddr ma = Host::cast(obj)->getManagementAddress(); - if (ma != InetAddr::getAny()) + const InetAddr *ma = Host::cast(obj)->getManagementAddress(); + if (ma && (*ma) != InetAddr::getAny()) { - cout << ma.toString() << endl; + cout << ma->toString() << endl; } else { SNPRINTF(errstr,sizeof(errstr), diff --git a/src/ipt/NATCompiler_PrintRule.cpp b/src/ipt/NATCompiler_PrintRule.cpp index a29e4dc8e..8065835db 100644 --- a/src/ipt/NATCompiler_PrintRule.cpp +++ b/src/ipt/NATCompiler_PrintRule.cpp @@ -501,7 +501,6 @@ string NATCompiler_ipt::PrintRule::_printAddr(Address *o, NATCompiler_ipt::PrintRule::PrintRule(const std::string &name) : NATRuleProcessor(name) { - NATCompiler_ipt *ipt_comp = dynamic_cast(compiler); init=true; print_once_on_top=true; @@ -515,9 +514,14 @@ NATCompiler_ipt::PrintRule::PrintRule(const std::string &name) : bool NATCompiler_ipt::PrintRule::processNext() { + NATCompiler_ipt *ipt_comp = dynamic_cast(compiler); NATRule *rule=getNext(); if (rule==NULL) return false; + string chain = rule->getStr("ipt_chain"); + if (ipt_comp->chain_usage_counter[chain] == 0) + return true; + tmp_queue.push_back(rule); compiler->output << _printRuleLabel(rule); diff --git a/src/ipt/NATCompiler_ipt.cpp b/src/ipt/NATCompiler_ipt.cpp index 29039ef9d..bb5c00c19 100644 --- a/src/ipt/NATCompiler_ipt.cpp +++ b/src/ipt/NATCompiler_ipt.cpp @@ -163,6 +163,14 @@ string NATCompiler_ipt::debugPrintRule(Rule *r) int NATCompiler_ipt::prolog() { + // initialize counters for the standard chains + for (list::const_iterator i = + NATCompiler_ipt::getStandardChains().begin(); + i != NATCompiler_ipt::getStandardChains().end(); ++i) + { + chain_usage_counter[*i] = 1; + } + int n=NATCompiler::prolog(); if ( n>0 ) @@ -2120,6 +2128,23 @@ bool NATCompiler_ipt::processMultiAddressObjectsInRE::processNext() return true; } +bool NATCompiler_ipt::countChainUsage::processNext() +{ + NATCompiler_ipt *ipt_comp = dynamic_cast(compiler); + + slurp(); + if (tmp_queue.size()==0) return false; + + for (deque::iterator k=tmp_queue.begin(); k!=tmp_queue.end(); ++k) + { + NATRule *rule = NATRule::cast( *k ); + ipt_comp->chain_usage_counter[rule->getStr("ipt_target")] += 1; + } + + return true; +} + + void NATCompiler_ipt::compile() { @@ -2268,6 +2293,8 @@ void NATCompiler_ipt::compile() "set target if dynamic interface in TSrc" ) ); add( new convertInterfaceIdToStr("prepare interface assignments") ); + add( new countChainUsage("Count chain usage")); + if (fwopt->getBool("use_iptables_restore")) { // bug #1812295: we should use PrintRuleIptRstEcho not only diff --git a/src/ipt/NATCompiler_ipt.h b/src/ipt/NATCompiler_ipt.h index 2cd828e22..12813c733 100644 --- a/src/ipt/NATCompiler_ipt.h +++ b/src/ipt/NATCompiler_ipt.h @@ -58,6 +58,7 @@ namespace fwcompiler { NATCompiler_ipt::PrintRule *printRule; bool have_dynamic_interfaces; + std::map chain_usage_counter; static const std::list& getStandardChains(); std::string getInterfaceVarName(libfwbuilder::FWObject *iface); @@ -422,6 +423,12 @@ namespace fwcompiler { }; + /** + * count how many times each user-defined chain we've created is + * used. We should be able to drop unused chains. + */ + DECLARE_NAT_RULE_PROCESSOR(countChainUsage); + /** * prints single policy rule, assuming all * groups have * been expanded, so source, destination and * service hold diff --git a/src/ipt/PolicyCompiler_ipt.cpp b/src/ipt/PolicyCompiler_ipt.cpp index b6226e67c..07da0326b 100644 --- a/src/ipt/PolicyCompiler_ipt.cpp +++ b/src/ipt/PolicyCompiler_ipt.cpp @@ -1805,8 +1805,7 @@ bool PolicyCompiler_ipt::bridgingFw::processNext() PolicyRule *rule=getNext(); if (rule==NULL) return false; // Address *src=compiler->getFirstSrc(rule); - Address *dst=compiler->getFirstDst(rule); - + Address *dst = compiler->getFirstDst(rule); if ( rule->getStr("ipt_chain")=="INPUT" ) { @@ -3659,6 +3658,15 @@ bool PolicyCompiler_ipt::countChainUsage::processNext() ipt_comp->chain_usage_counter[rule->getStr("ipt_target")] += 1; } + // second pass: if chain the rule belongs to has never been used as a target + // then the target chain of the rule will never be used as well + for (deque::iterator k=tmp_queue.begin(); k!=tmp_queue.end(); ++k) + { + PolicyRule *rule = PolicyRule::cast( *k ); + if (ipt_comp->chain_usage_counter[rule->getStr("ipt_chain")] == 0) + ipt_comp->chain_usage_counter[rule->getStr("ipt_target")] = 0; + } + return true; } @@ -3959,12 +3967,14 @@ void PolicyCompiler_ipt::compile() add( new removeFW( "remove fw" ) ); add( new ExpandMultipleAddresses("expand multiple addresses" ) ); + add( new dropRuleWithEmptyRE("drop rules with empty rule elements")); + add( new checkForUnnumbered("check for unnumbered interfaces" ) ); add( new checkForDynamicInterfacesOfOtherObjects( "check for dynamic interfaces of other hosts and firewalls")); if ( fwopt->getBool("bridging_fw") ) - add( new bridgingFw( "handle bridging firewall cases" ) ); + add( new bridgingFw("handle bridging firewall cases")); add( new specialCaseWithUnnumberedInterface( "check for a special cases with unnumbered interface" ) );