fix in fwb_ipt for ipv6

src/fwblookup/fwblookup.cpp

@@ -90,7 +90,7 @@ int fwbdebug = 0;
 class UpgradePredicate: public XMLTools::UpgradePredicate
 {
     public:
-    virtual bool operator()(const string &msg) const 
+    virtual bool operator()(const string&) const 
     { 
 	cout << _("Data file has been created in the old version of Firewall Builder. Use fwbuilder GUI to convert it.") << endl;
 	return false;
@@ -317,10 +317,10 @@ int main(int argc, char * const *argv)
             {
                 if (Host::isA(obj) || Firewall::isA(obj))
                 {
-                    InetAddr ma = Host::cast(obj)->getManagementAddress();
+                    const InetAddr *ma = Host::cast(obj)->getManagementAddress();
-                    if (ma != InetAddr::getAny())
+                    if (ma && (*ma) != InetAddr::getAny())
                     {
-                        cout << ma.toString() << endl;
+                        cout << ma->toString() << endl;
                     } else
                     {
                         SNPRINTF(errstr,sizeof(errstr),

src/ipt/NATCompiler_PrintRule.cpp

@@ -501,7 +501,6 @@ string NATCompiler_ipt::PrintRule::_printAddr(Address  *o,
 NATCompiler_ipt::PrintRule::PrintRule(const std::string &name) : 
     NATRuleProcessor(name)
 {
-    NATCompiler_ipt *ipt_comp = dynamic_cast<NATCompiler_ipt*>(compiler);
     init=true; 
     print_once_on_top=true;
 
@@ -515,9 +514,14 @@ NATCompiler_ipt::PrintRule::PrintRule(const std::string &name) :
 
 bool NATCompiler_ipt::PrintRule::processNext()
 {
+    NATCompiler_ipt *ipt_comp = dynamic_cast<NATCompiler_ipt*>(compiler);
     NATRule *rule=getNext(); 
     if (rule==NULL) return false;
 
+    string chain = rule->getStr("ipt_chain");
+    if (ipt_comp->chain_usage_counter[chain] == 0)
+        return true;
+
     tmp_queue.push_back(rule);
 
     compiler->output << _printRuleLabel(rule);

src/ipt/NATCompiler_ipt.cpp

@@ -163,6 +163,14 @@ string NATCompiler_ipt::debugPrintRule(Rule *r)
 
 int NATCompiler_ipt::prolog()
 {
+    // initialize counters for the standard chains
+    for (list<string>::const_iterator i =
+             NATCompiler_ipt::getStandardChains().begin();
+         i != NATCompiler_ipt::getStandardChains().end(); ++i)
+    {
+        chain_usage_counter[*i] = 1;
+    }
+
     int n=NATCompiler::prolog();
 
     if ( n>0 ) 
@@ -2120,6 +2128,23 @@ bool NATCompiler_ipt::processMultiAddressObjectsInRE::processNext()
     return true;
 }
 
+bool NATCompiler_ipt::countChainUsage::processNext()
+{
+    NATCompiler_ipt *ipt_comp = dynamic_cast<NATCompiler_ipt*>(compiler);
+
+    slurp();
+    if (tmp_queue.size()==0) return false;
+
+    for (deque<Rule*>::iterator k=tmp_queue.begin(); k!=tmp_queue.end(); ++k) 
+    {
+        NATRule *rule = NATRule::cast( *k );
+        ipt_comp->chain_usage_counter[rule->getStr("ipt_target")] += 1;
+    }
+
+    return true;
+}
+
+
 
 void NATCompiler_ipt::compile()
 {
@@ -2268,6 +2293,8 @@ void NATCompiler_ipt::compile()
                  "set target if dynamic interface in TSrc" ) );
         add( new convertInterfaceIdToStr("prepare interface assignments") );
 
+        add( new countChainUsage("Count chain usage"));
+
         if (fwopt->getBool("use_iptables_restore"))
         {
             // bug #1812295: we should use PrintRuleIptRstEcho not only

src/ipt/NATCompiler_ipt.h

@@ -58,6 +58,7 @@ namespace fwcompiler {
 
         NATCompiler_ipt::PrintRule *printRule;
         bool   have_dynamic_interfaces;
+        std::map<std::string, int> chain_usage_counter;
 
         static const std::list<std::string>& getStandardChains();
         std::string getInterfaceVarName(libfwbuilder::FWObject *iface);
@@ -422,6 +423,12 @@ namespace fwcompiler {
         };
 
 
+	/**
+	 * count how many times each user-defined chain we've created is
+         * used. We should be able to drop unused chains.
+	 */
+        DECLARE_NAT_RULE_PROCESSOR(countChainUsage);
+
 	/**
 	 *   prints single policy rule, assuming all * groups have
 	 *   been expanded, so source, destination and * service hold

src/ipt/PolicyCompiler_ipt.cpp

@@ -1805,8 +1805,7 @@ bool PolicyCompiler_ipt::bridgingFw::processNext()
     PolicyRule *rule=getNext(); if (rule==NULL) return false;
 
 //    Address        *src=compiler->getFirstSrc(rule);
-    Address        *dst=compiler->getFirstDst(rule);
+    Address *dst = compiler->getFirstDst(rule);
-
 
     if ( rule->getStr("ipt_chain")=="INPUT" )
     {
@@ -3659,6 +3658,15 @@ bool PolicyCompiler_ipt::countChainUsage::processNext()
         ipt_comp->chain_usage_counter[rule->getStr("ipt_target")] += 1;
     }
 
+    // second pass: if chain the rule belongs to has never been used as a target
+    // then the target chain of the rule will never be used as well
+    for (deque<Rule*>::iterator k=tmp_queue.begin(); k!=tmp_queue.end(); ++k) 
+    {
+        PolicyRule *rule = PolicyRule::cast( *k );
+        if (ipt_comp->chain_usage_counter[rule->getStr("ipt_chain")] == 0)
+            ipt_comp->chain_usage_counter[rule->getStr("ipt_target")] = 0;
+    }
+
     return true;
 }
 
@@ -3959,12 +3967,14 @@ void PolicyCompiler_ipt::compile()
         add( new removeFW(                   "remove fw"              ) );
 
         add( new ExpandMultipleAddresses("expand multiple addresses"  ) );
+        add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
+
         add( new checkForUnnumbered("check for unnumbered interfaces" ) );
         add( new checkForDynamicInterfacesOfOtherObjects(
                  "check for dynamic interfaces of other hosts and firewalls"));
 
 	if ( fwopt->getBool("bridging_fw") ) 
-            add( new bridgingFw(  "handle bridging firewall cases"    ) );
+            add( new bridgingFw("handle bridging firewall cases"));
 
         add( new specialCaseWithUnnumberedInterface(
                  "check for a special cases with unnumbered interface" ) );