diff --git a/doc/ChangeLog b/doc/ChangeLog index 9d353951e..de0ead8b9 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,3 +1,24 @@ +2011-05-14 vadim + + * AttachedNetworks.cpp (AttachedNetworks): see #1580 New object + type: network object that automatically matches subnets an + interface is attached to. The object can be a child of an + interface. The object is optional and is not created automatically + for all interfaces; user can add it using context menu associated + with an interface. Dialog for this object allows editing of the + name and comment. List of network addresses represented by this + object is always generated automatically. Compiler for PF + translates this object to "en0:network" construct that is + supported by PF. Compiler for iptables expands it to the list of + ipv4 and ipv6 networks defined by the addresses of the parent + interface if interface has static addresses. If interface is + confgiured as "dynamic" and has no address in fwbuilder, then + compiler treats AttachedNetworks object as run-time and uses shell + function to determine network addresses during activation of the + firewall script. Compilers for other firewall platforms always + treat this object as compile-time and abort if it is used with + dynamic interface. + 2011-05-13 vadim * PolicyCompiler_ipt.cpp (processNext): see #2402 "Tag action diff --git a/src/iptlib/CompilerDriver_ipt_run.cpp b/src/iptlib/CompilerDriver_ipt_run.cpp index 086b225bb..d9cd315a4 100644 --- a/src/iptlib/CompilerDriver_ipt_run.cpp +++ b/src/iptlib/CompilerDriver_ipt_run.cpp @@ -44,6 +44,7 @@ #include "PolicyCompiler_ipt.h" #include "NATCompiler_ipt.h" #include "RoutingCompiler_ipt.h" +#include "Preprocessor_ipt.h" #include "OSConfigurator_linux24.h" #include "OSConfigurator_secuwall.h" #include "OSConfigurator_ipcop.h" @@ -52,7 +53,6 @@ #include "Configlet.h" -#include "fwcompiler/Preprocessor.h" #include "fwbuilder/FWObjectDatabase.h" #include "fwbuilder/FWException.h" @@ -309,7 +309,7 @@ QString CompilerDriver_ipt::run(const std::string &cluster_id, if (nat_count || policy_count) { - Preprocessor* prep = new Preprocessor( + Preprocessor_ipt* prep = new Preprocessor_ipt( objdb , fw, ipv6_policy); prep->setSingleRuleCompileMode(single_rule_id); if (inTestMode()) prep->setTestMode(); diff --git a/src/iptlib/OSConfigurator_linux24_interfaces.cpp b/src/iptlib/OSConfigurator_linux24_interfaces.cpp index e90766b94..1b5ae6f2d 100644 --- a/src/iptlib/OSConfigurator_linux24_interfaces.cpp +++ b/src/iptlib/OSConfigurator_linux24_interfaces.cpp @@ -502,15 +502,26 @@ string OSConfigurator_linux24::printDynamicAddressesConfigurationCommands() if (iface->getName().find("*")==string::npos) { out << "getaddr " - << iface->getName() - << " " - << getInterfaceVarName(iface, false) - << endl; + << iface->getName() + << " " + << getInterfaceVarName(iface, false) + << endl; out << "getaddr6 " - << iface->getName() - << " " - << getInterfaceVarName(iface, true) - << endl; + << iface->getName() + << " " + << getInterfaceVarName(iface, true) + << endl; + + out << "getnet " + << iface->getName() + << " " + << getInterfaceVarName(iface, false) << "_network" + << endl; + out << "getnet6 " + << iface->getName() + << " " + << getInterfaceVarName(iface, true) << "_network" + << endl; } } } diff --git a/src/iptlib/PolicyCompiler_PrintRule.cpp b/src/iptlib/PolicyCompiler_PrintRule.cpp index e829c5769..ab565e46f 100644 --- a/src/iptlib/PolicyCompiler_PrintRule.cpp +++ b/src/iptlib/PolicyCompiler_PrintRule.cpp @@ -38,6 +38,7 @@ #include "fwbuilder/Network.h" #include "fwbuilder/DNSName.h" #include "fwbuilder/AddressRange.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/FWObjectDatabase.h" #include "fwbuilder/RuleElement.h" @@ -1246,6 +1247,14 @@ string PolicyCompiler_ipt::PrintRule::_printAddr(Address *o) { return atrt->getSourceName(); } + + if (atrt->getSubstitutionTypeName()==AttachedNetworks::TYPENAME) + { + ostr << "$i_" << atrt->getSourceName() << "_network"; + return ostr.str(); + } + + // at this time we only support two types of MultiAddress // objects: AddressTable and DNSName. Both should be converted // to MultiAddressRunTime at this point. If we get some other diff --git a/src/iptlib/PolicyCompiler_ipt.cpp b/src/iptlib/PolicyCompiler_ipt.cpp index dd2257f26..00ed5bfee 100644 --- a/src/iptlib/PolicyCompiler_ipt.cpp +++ b/src/iptlib/PolicyCompiler_ipt.cpp @@ -4588,6 +4588,8 @@ string PolicyCompiler_ipt::debugPrintRule(Rule *r) src << o->getName(); if (Group::cast(o)!=NULL) src << "[" << o->size() << "]"; + if ( MultiAddress::cast(o)!=NULL) + src << string((MultiAddress::cast(o)->isRunTime()) ? "(r)" : "(c)"); } if (i2!=dstrel->end()) @@ -4596,6 +4598,8 @@ string PolicyCompiler_ipt::debugPrintRule(Rule *r) dst << o->getName(); if (Group::cast(o)!=NULL) dst << "[" << o->size() << "]"; + if ( MultiAddress::cast(o)!=NULL) + dst << string((MultiAddress::cast(o)->isRunTime()) ? "(r)" : "(c)"); } if (i3!=srvrel->end()) diff --git a/src/iptlib/Preprocessor_ipt.cpp b/src/iptlib/Preprocessor_ipt.cpp new file mode 100644 index 000000000..09135be7f --- /dev/null +++ b/src/iptlib/Preprocessor_ipt.cpp @@ -0,0 +1,50 @@ +/* + + Firewall Builder + + Copyright (C) 2011 NetCitadel, LLC + + Author: Vadim Kurland vadim@fwbuilder.org + + This program is free software which we release under the GNU General Public + License. You may redistribute and/or modify this program under the terms + of that license as published by the Free Software Foundation; either + version 2 of the License, or (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + To get a copy of the GNU General Public License, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +*/ + + +#include "Preprocessor_ipt.h" + +#include "fwbuilder/Interface.h" +#include "fwbuilder/AttachedNetworks.h" + + +using namespace libfwbuilder; +using namespace fwcompiler; +using namespace std; + + +void Preprocessor_ipt::convertObject(FWObject *obj) +{ + if ( AttachedNetworks::isA(obj)) + { + AttachedNetworks *att = AttachedNetworks::cast(obj); + Interface *intf = Interface::cast(att->getParent()); + if (intf->isRegular()) + { + att->setCompileTime(true); + att->loadFromSource(ipv6, inTestMode()); + } else att->setRunTime(true); + } else + Preprocessor::convertObject(obj); +} + diff --git a/src/iptlib/Preprocessor_ipt.h b/src/iptlib/Preprocessor_ipt.h new file mode 100644 index 000000000..7ef64cbd3 --- /dev/null +++ b/src/iptlib/Preprocessor_ipt.h @@ -0,0 +1,54 @@ +/* + + Firewall Builder + + Copyright (C) 2011 NetCitadel, LLC + + Author: Vadim Kurland vadim@fwbuilder.org + + This program is free software which we release under the GNU General Public + License. You may redistribute and/or modify this program under the terms + of that license as published by the Free Software Foundation; either + version 2 of the License, or (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + To get a copy of the GNU General Public License, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +*/ + +#ifndef __PREPROCESSOR_IPT_HH +#define __PREPROCESSOR_IPT_HH + +#include +#include "fwcompiler/Preprocessor.h" + +namespace libfwbuilder { + class FWObjectDatabase; +}; + + +namespace fwcompiler { + + class Preprocessor_ipt : public Preprocessor { + + public: + + Preprocessor_ipt(libfwbuilder::FWObjectDatabase *_db, + libfwbuilder::Firewall *fw, + bool ipv6_policy) : + Preprocessor(_db, fw, ipv6_policy) + { } + + virtual void convertObject(libfwbuilder::FWObject *obj); + + }; + + +} + +#endif diff --git a/src/iptlib/iptlib.pro b/src/iptlib/iptlib.pro index dd5296e5a..255e65195 100644 --- a/src/iptlib/iptlib.pro +++ b/src/iptlib/iptlib.pro @@ -27,6 +27,7 @@ SOURCES = CompilerDriver_ipt.cpp \ PolicyCompiler_secuwall.cpp \ RoutingCompiler_ipt.cpp \ RoutingCompiler_ipt_writers.cpp \ + Preprocessor_ipt.cpp \ combinedAddress.cpp \ AutomaticRules_ipt.cpp \ utils.cpp @@ -42,6 +43,7 @@ HEADERS = ../../config.h \ PolicyCompiler_ipt.h \ PolicyCompiler_secuwall.h \ RoutingCompiler_ipt.h \ + Preprocessor_ipt.h \ combinedAddress.h \ AutomaticRules_ipt.h \ utils.h diff --git a/src/libfwbuilder/etc/fwbuilder.dtd b/src/libfwbuilder/etc/fwbuilder.dtd index c39910788..5a992e6af 100644 --- a/src/libfwbuilder/etc/fwbuilder.dtd +++ b/src/libfwbuilder/etc/fwbuilder.dtd @@ -85,7 +85,7 @@ > +((AnyNetwork|AnyIPService|AnyInterval|ObjectGroup|StateSyncClusterGroup|FailoverClusterGroup|Host|Firewall|Cluster|Network|NetworkIPv6|AttachedNetworks|IPv4|IPv6|DNSName|AddressTable|physAddress|AddressRange|ObjectRef|ServiceGroup|IPService|ICMPService|ICMP6Service|TCPService|UDPService|CustomService|ServiceRef|IntervalGroup|Interval|IntervalRef|Interface|Policy|NAT|PolicyRule|NATRule|Library|TagService|UserService)*)> - + - + + + +((AnyNetwork|AnyIPService|AnyInterval|ObjectGroup|StateSyncClusterGroup|FailoverClusterGroup|Host|Firewall|Cluster|Network|NetworkIPv6|AttachedNetworks|IPv4|IPv6|DNSName|AddressTable|physAddress|AddressRange|ObjectRef|ServiceGroup|IPService|ICMPService|ICMP6Service|TCPService|UDPService|CustomService|ServiceRef|IntervalGroup|Interval|IntervalRef|Interface|Policy|NAT|PolicyRule|NATRule|Library|TagService|UserService)*)> - + - + + + xmlChildrenNode; cur; cur=cur->next) @@ -108,6 +108,7 @@ void FWObject::fromXML(xmlNodePtr root) throw(FWException) { /* Add w/o validation. Trust XML to do that */ add(o, false); + try { o->fromXML(cur); @@ -408,6 +409,7 @@ FWObject* FWObject::addCopyOf(const FWObject *x, bool preserve_id) if(!o1) throw FWException(string("Error creating object with type: ")+ x->getTypeName()); + // This adds with validation add(o1); diff --git a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp index 9b9e18494..94ce9a865 100644 --- a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp +++ b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp @@ -40,6 +40,7 @@ #include #include +#include #include #include #include diff --git a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h index ea8ff63b5..ed630aa3e 100644 --- a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h +++ b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h @@ -56,6 +56,7 @@ namespace libfwbuilder // forward declarations for specialized create() methods class AddressRange; class AddressTable; + class AttachedNetworks; class Cluster; class StateSyncClusterGroup; class FailoverClusterGroup; @@ -123,6 +124,7 @@ namespace libfwbuilder DECLARE_CREATE_OBJ_METHOD(AddressRange); DECLARE_CREATE_OBJ_METHOD(AddressTable); + DECLARE_CREATE_OBJ_METHOD(AttachedNetworks); DECLARE_CREATE_OBJ_METHOD(Cluster); DECLARE_CREATE_OBJ_METHOD(StateSyncClusterGroup); DECLARE_CREATE_OBJ_METHOD(FailoverClusterGroup); @@ -474,6 +476,7 @@ public: DECLARE_CREATE_OBJ_CLASS_METHOD(AddressRange); DECLARE_CREATE_OBJ_CLASS_METHOD(AddressTable); + DECLARE_CREATE_OBJ_CLASS_METHOD(AttachedNetworks); DECLARE_CREATE_OBJ_CLASS_METHOD(Cluster); DECLARE_CREATE_OBJ_CLASS_METHOD(StateSyncClusterGroup); DECLARE_CREATE_OBJ_CLASS_METHOD(FailoverClusterGroup); diff --git a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_create_object.cpp b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_create_object.cpp index 1000d8dea..bc3d7bf05 100644 --- a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_create_object.cpp +++ b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_create_object.cpp @@ -54,6 +54,7 @@ #include #include +#include #include #include #include @@ -127,6 +128,8 @@ void FWObjectDatabase::init_create_methods_table() registerObjectType("AddressTable", &create_AddressTable); + registerObjectType("AttachedNetworks", + &create_AttachedNetworks); registerObjectType("Cluster", &create_Cluster); registerObjectType("StateSyncClusterGroup", @@ -302,6 +305,7 @@ FWObject *FWObjectDatabase::create(const string &type_name, int id, bool init) } FWObject *nobj = (*fn)(id); + addToIndex(nobj); if (init) nobj->init(this); return nobj; @@ -331,6 +335,7 @@ FWObject *FWObjectDatabase::createFromXML(xmlNodePtr data) CREATE_OBJ_METHOD(AddressRange); CREATE_OBJ_METHOD(AddressTable); +CREATE_OBJ_METHOD(AttachedNetworks); CREATE_OBJ_METHOD(Cluster); CREATE_OBJ_METHOD(StateSyncClusterGroup); CREATE_OBJ_METHOD(FailoverClusterGroup); diff --git a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp index 112cebed4..3eaa7ff17 100644 --- a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp +++ b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp @@ -222,9 +222,10 @@ void FWObjectTreeScanner::scanAndAdd(FWObject *dst,FWObject *source) } } } + } -//#define DEBUG_MERGE 1 +// #define DEBUG_MERGE 1 void FWObjectTreeScanner::merge(FWObject *dst, FWObject *src) { @@ -293,7 +294,7 @@ void FWObjectTreeScanner::merge(FWObject *dst, FWObject *src) if (dobj==NULL) { sobj = *i; - FWObject *o1=treeRoot->create( sobj->getTypeName()); + FWObject *o1 = treeRoot->create( sobj->getTypeName()); FWObject *pdst = dstMap[ src->getId() ]; assert(pdst!=NULL); @@ -313,6 +314,7 @@ void FWObjectTreeScanner::merge(FWObject *dst, FWObject *src) o1->duplicate( sobj, false); // copy IDs as well + #ifdef DEBUG_MERGE cerr << "duplicate #1 done" << endl; #endif diff --git a/src/libfwbuilder/src/fwbuilder/Firewall.cpp b/src/libfwbuilder/src/fwbuilder/Firewall.cpp index 571146ec7..f6cfcedd8 100644 --- a/src/libfwbuilder/src/fwbuilder/Firewall.cpp +++ b/src/libfwbuilder/src/fwbuilder/Firewall.cpp @@ -227,52 +227,16 @@ void Firewall::duplicateInterfaces(FWObject *target, const FWObject *source, for (FWObjectTypedChildIterator m = source->findByType(Interface::TYPENAME); m!=m.end(); ++m ) { - FWObject *src_interface = *m; - FWObject *dst_interface_copy = target->addCopyOf(src_interface, preserve_id); + FWObject *src_interface = *m; + FWObject *dst_interface_copy = + target->addCopyOf(src_interface, preserve_id); id_mapping[src_interface->getId()] = dst_interface_copy->getId(); - dst_interface_copy->destroyChildren(); - for (FWObjectTypedChildIterator k=src_interface->findByType(IPv4::TYPENAME); - k!=k.end(); ++k ) - { - FWObject *src_obj = *k; - FWObject *dst_obj_copy= dst_interface_copy->addCopyOf(src_obj,preserve_id); - - if (src_obj!=NULL && dst_obj_copy!=NULL) - id_mapping[src_obj->getId()] = dst_obj_copy->getId(); - } - - for (FWObjectTypedChildIterator k=src_interface->findByType(IPv6::TYPENAME); - k!=k.end(); ++k ) - { - FWObject *src_obj = *k; - FWObject *dst_obj_copy= dst_interface_copy->addCopyOf(src_obj,preserve_id); - - if (src_obj!=NULL && dst_obj_copy!=NULL) - id_mapping[src_obj->getId()] = dst_obj_copy->getId(); - } - - for (FWObjectTypedChildIterator k = src_interface->findByType(physAddress::TYPENAME); - k!=k.end(); ++k ) - { - FWObject *src_obj = *k; - FWObject *dst_obj_copy= dst_interface_copy->addCopyOf(src_obj,preserve_id); - - if (src_obj!=NULL && dst_obj_copy!=NULL) - id_mapping[src_obj->getId()] = dst_obj_copy->getId(); - } - - for (FWObjectTypedChildIterator k = src_interface->findByType(InterfaceOptions::TYPENAME); - k!=k.end(); ++k ) - { - FWObject *src_obj = *k; - FWObject *dst_obj_copy= dst_interface_copy->addCopyOf(src_obj,preserve_id); - - if (src_obj!=NULL && dst_obj_copy!=NULL) - id_mapping[src_obj->getId()] = dst_obj_copy->getId(); - } + Interface::cast(dst_interface_copy)->duplicateWithIdMapping( + src_interface, id_mapping, preserve_id); +#if 0 if (Firewall::cast(target)) { /* @@ -288,7 +252,8 @@ void Firewall::duplicateInterfaces(FWObject *target, const FWObject *source, k!=k.end(); ++k ) { FWObject *src_subinterface = *k; - FWObject *dst_subinterface_copy = dst_interface_copy->addCopyOf(src_subinterface, preserve_id); + FWObject *dst_subinterface_copy = + dst_interface_copy->addCopyOf(src_subinterface, preserve_id); if (src_subinterface!=NULL && dst_subinterface_copy!=NULL) id_mapping[src_subinterface->getId()] = dst_subinterface_copy->getId(); @@ -297,6 +262,8 @@ void Firewall::duplicateInterfaces(FWObject *target, const FWObject *source, duplicateInterfaces(dst_interface_copy, src_interface, id_mapping, preserve_id); } +#endif + } } diff --git a/src/libfwbuilder/src/fwbuilder/Interface.cpp b/src/libfwbuilder/src/fwbuilder/Interface.cpp index cfdf62158..1e0ad0cb6 100644 --- a/src/libfwbuilder/src/fwbuilder/Interface.cpp +++ b/src/libfwbuilder/src/fwbuilder/Interface.cpp @@ -6,9 +6,6 @@ Author: Vadim Kurland vadim@fwbuilder.org - $Id$ - - This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms of that license as published by the Free Software Foundation; either @@ -34,6 +31,7 @@ #include #include #include +#include #include #include @@ -118,6 +116,28 @@ FWObject& Interface::duplicate(const FWObject *x, bool preserve_id) return *this; } +void Interface::duplicateWithIdMapping(const FWObject *src, + map &id_mapping, bool preserve_id) +{ + assert(src->getTypeName() == Interface::TYPENAME); + + checkReadOnly(); + + shallowDuplicate(src, preserve_id); + + destroyChildren(); + + for(list::const_iterator m=src->begin(); m!=src->end(); ++m) + { + FWObject *src_obj = *m; + FWObject *dst_obj_copy = addCopyOf(src_obj, preserve_id); + if (src_obj!=NULL && dst_obj_copy!=NULL) + id_mapping[src_obj->getId()] = dst_obj_copy->getId(); + } + + setDirty(true); +} + bool Interface::cmp(const FWObject *obj, bool recursive) throw(FWException) { const Interface *rx = Interface::constcast(obj); @@ -247,6 +267,9 @@ xmlNodePtr Interface::toXML(xmlNodePtr parent) throw(FWException) o = getFirstByType(FailoverClusterGroup::TYPENAME); if (o) o->toXML(me); + o = getFirstByType(AttachedNetworks::TYPENAME); + if (o) o->toXML(me); + return me; } @@ -341,7 +364,8 @@ bool Interface::validateChild(FWObject *o) otype==IPv6::TYPENAME || otype==physAddress::TYPENAME || otype==InterfaceOptions::TYPENAME || - otype==FailoverClusterGroup::TYPENAME); + otype==FailoverClusterGroup::TYPENAME || + otype==AttachedNetworks::TYPENAME); } /* diff --git a/src/libfwbuilder/src/fwbuilder/Interface.h b/src/libfwbuilder/src/fwbuilder/Interface.h index c861ea977..fe028b67f 100644 --- a/src/libfwbuilder/src/fwbuilder/Interface.h +++ b/src/libfwbuilder/src/fwbuilder/Interface.h @@ -195,13 +195,15 @@ public: virtual FWObject& shallowDuplicate(const FWObject *obj, - bool preserve_id = true) - throw(FWException); + bool preserve_id = true) throw(FWException); virtual FWObject& duplicate(const FWObject *obj, - bool preserve_id = true) - throw(FWException); + bool preserve_id = true) throw(FWException); + virtual bool cmp(const FWObject *obj, bool recursive=false) throw(FWException); + void duplicateWithIdMapping(const FWObject *src, + std::map &id_mapping, bool preserve_id); + const std::string &getLabel() const; void setLabel(const std::string& n); diff --git a/src/libfwbuilder/src/fwbuilder/MultiAddress.h b/src/libfwbuilder/src/fwbuilder/MultiAddress.h index d148754c0..a57affaf4 100644 --- a/src/libfwbuilder/src/fwbuilder/MultiAddress.h +++ b/src/libfwbuilder/src/fwbuilder/MultiAddress.h @@ -54,8 +54,14 @@ class MultiAddress : public ObjectGroup virtual void setSourceName(const std::string& source_name); virtual void loadFromSource(bool ipv6, bool test_mode=false) throw(FWException); - bool isCompileTime() const; - bool isRunTime() const; + /* + * functions isCompileTime() and isRunTime() are virtual because + * some multi-address objects allow the user to set these flags, + * while other object types behave as run-time or compile-time + * depending on attributes of other objects (e.g. AttachedNetworks) + */ + virtual bool isCompileTime() const; + virtual bool isRunTime() const; void setCompileTime(const bool b); void setRunTime(const bool b); diff --git a/src/libfwbuilder/src/fwbuilder/fwbuilder.pro b/src/libfwbuilder/src/fwbuilder/fwbuilder.pro index b6f6053f4..d78664ae8 100644 --- a/src/libfwbuilder/src/fwbuilder/fwbuilder.pro +++ b/src/libfwbuilder/src/fwbuilder/fwbuilder.pro @@ -50,6 +50,7 @@ SOURCES = InetAddr.cpp \ NAT.cpp \ Network.cpp \ NetworkIPv6.cpp \ + AttachedNetworks.cpp \ ObjectGroup.cpp \ physAddress.cpp \ DNSName.cpp\ @@ -124,6 +125,7 @@ HEADERS = inet_net.h \ NAT.h \ Network.h \ NetworkIPv6.h \ + AttachedNetworks.h \ ObjectGroup.h \ physAddress.h \ DNSName.h\ diff --git a/src/libfwbuilder/src/fwcompiler/Compiler.cpp b/src/libfwbuilder/src/fwcompiler/Compiler.cpp index fbebfbc3f..79eae9574 100644 --- a/src/libfwbuilder/src/fwcompiler/Compiler.cpp +++ b/src/libfwbuilder/src/fwcompiler/Compiler.cpp @@ -6,8 +6,6 @@ Author: Vadim Kurland vadim@fwbuilder.org - $Id$ - This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms of that license as published by the Free Software Foundation; either @@ -1117,6 +1115,7 @@ bool Compiler::emptyGroupsInRE::processNext() for (FWObject::iterator i=re->begin(); i!=re->end(); i++) { FWObject *o = FWReference::getObject(*i); + if ( MultiAddress::cast(o)!=NULL && MultiAddress::cast(o)->isRunTime()) continue; diff --git a/src/libgui/AttachedNetworksDialog.cpp b/src/libgui/AttachedNetworksDialog.cpp new file mode 100644 index 000000000..078293d20 --- /dev/null +++ b/src/libgui/AttachedNetworksDialog.cpp @@ -0,0 +1,167 @@ +/* + + Firewall Builder + + Copyright (C) 201 NetCitadel, LLC + + Author: Vadim Kurland vadim@fwbuilder.org + + This program is free software which we release under the GNU General Public + License. You may redistribute and/or modify this program under the terms + of that license as published by the Free Software Foundation; either + version 2 of the License, or (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + To get a copy of the GNU General Public License, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +*/ + +#include "../../config.h" +#include "global.h" +#include "utils.h" + +#include "FWBTree.h" +#include "AttachedNetworksDialog.h" +#include "ProjectPanel.h" +#include "FWBSettings.h" +#include "FWCmdChange.h" + +#include "fwbuilder/Library.h" +#include "fwbuilder/AttachedNetworks.h" +#include "fwbuilder/Interface.h" +#include "fwbuilder/IPv4.h" +#include "fwbuilder/IPv6.h" +#include "fwbuilder/FWException.h" +#include "fwbuilder/Inet6AddrMask.h" + +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + + +using namespace std; +using namespace libfwbuilder; + +AttachedNetworksDialog::AttachedNetworksDialog(QWidget *parent) : BaseObjectDialog(parent) +{ + m_dialog = new Ui::AttachedNetworksDialog_q; + m_dialog->setupUi(this); + obj=NULL; +} + +AttachedNetworksDialog::~AttachedNetworksDialog() { delete m_dialog; } + +void AttachedNetworksDialog::getHelpName(QString *str) +{ + *str = "AttachedNetworksDialog"; +} + +void AttachedNetworksDialog::loadFWObject(FWObject *o) +{ + obj=o; + AttachedNetworks *s = dynamic_cast(obj); + assert(s!=NULL); + + init=true; + + m_dialog->obj_name->setText( QString::fromUtf8(s->getName().c_str()) ); + m_dialog->comment->setText( QString::fromUtf8(s->getComment().c_str()) ); + + m_dialog->obj_name->setEnabled(!o->isReadOnly()); + setDisabledPalette(m_dialog->obj_name); + + m_dialog->addresses->setEnabled(false); // always read-only + setDisabledPalette(m_dialog->addresses); + + m_dialog->comment->setReadOnly(o->isReadOnly()); + setDisabledPalette(m_dialog->comment); + + Interface *parent_intf = Interface::cast(obj->getParent()); + assert(parent_intf); + + m_dialog->addresses->clear(); + + FWObjectTypedChildIterator k = parent_intf->findByType(IPv4::TYPENAME); + for ( ; k!=k.end(); ++k) + { + Address *addr = Address::cast(*k); + addAddressToList(addr->getNetworkAddressPtr(), addr->getNetmaskPtr()); + } + + k = parent_intf->findByType(IPv6::TYPENAME); + for ( ; k!=k.end(); ++k) + { + Address *addr = Address::cast(*k); + addAddressToList(addr->getNetworkAddressPtr(), addr->getNetmaskPtr()); + } + + + init=false; +} + +void AttachedNetworksDialog::addAddressToList(const InetAddr *ip_addr, + const InetAddr *ip_netm) +{ + QString name("%1/%2"); + if (ip_addr->isV6()) + { + m_dialog->addresses->addItem( + name.arg(ip_addr->toString().c_str()).arg(ip_netm->getLength())); + } else + { + m_dialog->addresses->addItem( + name.arg(ip_addr->toString().c_str()).arg(ip_netm->toString().c_str())); + } +} + +void AttachedNetworksDialog::validate(bool *result) +{ + if (fwbdebug) qDebug() << "AttachedNetworksDialog::validate"; + + *result = true; + AttachedNetworks *s = dynamic_cast(obj); + assert(s!=NULL); + + if (!validateName(this, obj, m_dialog->obj_name->text())) + { + *result = false; + } +} + + +void AttachedNetworksDialog::applyChanges() +{ + std::auto_ptr cmd( new FWCmdChange(m_project, obj)); + FWObject* new_state = cmd->getNewState(); + + AttachedNetworks *s = dynamic_cast(new_state); + assert(s!=NULL); + + string oldname = obj->getName(); + new_state->setName(string(m_dialog->obj_name->text().toUtf8().constData())); + new_state->setComment(string( + m_dialog->comment->toPlainText().toUtf8().constData())); + + if (!cmd->getOldState()->cmp(new_state, true)) + { + if (fwbdebug) + qDebug() << "Pushing FWCmdChange to undo stack"; + + if (obj->isReadOnly()) return; + m_project->undoStack->push(cmd.release()); + } +} diff --git a/src/libgui/AttachedNetworksDialog.h b/src/libgui/AttachedNetworksDialog.h new file mode 100644 index 000000000..9662fce64 --- /dev/null +++ b/src/libgui/AttachedNetworksDialog.h @@ -0,0 +1,65 @@ +/* + + Firewall Builder + + Copyright (C) 2011 NetCitadel, LLC + + Author: Vadim Kurland vadim@fwbuilder.org + + This program is free software which we release under the GNU General Public + License. You may redistribute and/or modify this program under the terms + of that license as published by the Free Software Foundation; either + version 2 of the License, or (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + To get a copy of the GNU General Public License, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +*/ + + +#ifndef __ATTACHEDNETWORKSDIALOG_H_ +#define __ATTACHEDNETWORKSDIALOG_H_ + +#include "../../config.h" +#include +#include "BaseObjectDialog.h" +#include + +#include "fwbuilder/FWObject.h" + + +class ProjectPanel; + +namespace libfwbuilder +{ + class InetAddr; +}; + +class AttachedNetworksDialog : public BaseObjectDialog +{ + Q_OBJECT; + + Ui::AttachedNetworksDialog_q *m_dialog; + + void addAddressToList(const libfwbuilder::InetAddr *ip_addr, + const libfwbuilder::InetAddr *ip_netm); + + public: + AttachedNetworksDialog(QWidget *parent); + ~AttachedNetworksDialog(); + +public slots: + virtual void applyChanges(); + virtual void loadFWObject(libfwbuilder::FWObject *obj); + virtual void validate(bool*); + virtual void getHelpName(QString*); + + +}; + +#endif // ATTACHEDNETWORKSDIALOG_H diff --git a/src/libgui/DialogFactory.cpp b/src/libgui/DialogFactory.cpp index 4dce68f0b..dfb676292 100644 --- a/src/libgui/DialogFactory.cpp +++ b/src/libgui/DialogFactory.cpp @@ -40,6 +40,7 @@ #include "PhysicalAddressDialog.h" #include "DNSNameDialog.h" #include "AddressTableDialog.h" +#include "AttachedNetworksDialog.h" #include "NetworkDialog.h" #include "NetworkDialogIPv6.h" #include "UserDialog.h" @@ -98,6 +99,7 @@ #include "openaisOptionsDialog.h" #include "pfsyncOptionsDialog.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Library.h" #include "fwbuilder/Firewall.h" #include "fwbuilder/Cluster.h" @@ -172,6 +174,8 @@ BaseObjectDialog *DialogFactory::createDialog(QWidget *parent, const QString &ob if (objType==Interface::TYPENAME) return new InterfaceDialog(parent); + if (objType==AttachedNetworks::TYPENAME) return new AttachedNetworksDialog(parent); + if (objType==Network::TYPENAME) return new NetworkDialog(parent); if (objType==NetworkIPv6::TYPENAME) return new NetworkDialogIPv6(parent); diff --git a/src/libgui/FWBMainWindow_q.ui b/src/libgui/FWBMainWindow_q.ui index 622938458..8e05f9d17 100644 --- a/src/libgui/FWBMainWindow_q.ui +++ b/src/libgui/FWBMainWindow_q.ui @@ -683,6 +683,13 @@ + + + + + + + @@ -1591,6 +1598,12 @@
BlankDialog.h
1 + + AttachedNetworksDialog + QWidget +
AttachedNetworksDialog.h
+ 1 + diff --git a/src/libgui/FWBTree.cpp b/src/libgui/FWBTree.cpp index e0feb31eb..bf0c08393 100644 --- a/src/libgui/FWBTree.cpp +++ b/src/libgui/FWBTree.cpp @@ -6,8 +6,6 @@ Author: Vadim Kurland vadim@fwbuilder.org - $Id$ - This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms of that license as published by the Free Software Foundation; either @@ -53,6 +51,7 @@ #include "fwbuilder/IntervalGroup.h" #include "fwbuilder/Library.h" #include "fwbuilder/NAT.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Network.h" #include "fwbuilder/NetworkIPv6.h" #include "fwbuilder/ObjectGroup.h" @@ -606,6 +605,7 @@ QString FWBTree::getTranslatableObjectTypeName(const QString &type_name) if (type_name == Cluster::TYPENAME) return QObject::tr("Cluster"); if (type_name == Host::TYPENAME) return QObject::tr("Host"); if (type_name == Interface::TYPENAME) return QObject::tr("Interface"); + if (type_name == AttachedNetworks::TYPENAME) return QObject::tr("Attached Networks"); if (type_name == Network::TYPENAME) return QObject::tr("Network"); if (type_name == NetworkIPv6::TYPENAME) return QObject::tr("Network IPv6"); if (type_name == IPv4::TYPENAME) return QObject::tr("Address"); @@ -643,6 +643,7 @@ QString FWBTree::getTranslatableNewObjectMenuText(const QString &type_name) if (type_name == Cluster::TYPENAME) return QObject::tr("New Cluster"); if (type_name == Host::TYPENAME) return QObject::tr("New Host"); if (type_name == Interface::TYPENAME) return QObject::tr("New Interface"); + if (type_name == AttachedNetworks::TYPENAME) return QObject::tr("New Attached Networks Object"); if (type_name == Network::TYPENAME) return QObject::tr("New Network"); if (type_name == NetworkIPv6::TYPENAME) return QObject::tr("New Network IPv6"); if (type_name == IPv4::TYPENAME) return QObject::tr("New Address"); diff --git a/src/libgui/MainRes.qrc b/src/libgui/MainRes.qrc index 321b8ab8c..4c95c8dbd 100644 --- a/src/libgui/MainRes.qrc +++ b/src/libgui/MainRes.qrc @@ -28,6 +28,12 @@ Icons/addresstable-neg_16.png Icons/addresstable-ref_25.png Icons/addresstable_16.png + Icons/network_25.png + Icons/network_64.png + Icons/network-neg_25.png + Icons/network-neg_16.png + Icons/network-ref_25.png + Icons/network_16.png Icons/blank.png Icons/blank.png Icons/both_25.png diff --git a/src/libgui/ObjectEditor.cpp b/src/libgui/ObjectEditor.cpp index 215f13b52..a3488ea63 100644 --- a/src/libgui/ObjectEditor.cpp +++ b/src/libgui/ObjectEditor.cpp @@ -63,6 +63,7 @@ #include "fwbuilder/StateSyncClusterGroup.h" #include "fwbuilder/FailoverClusterGroup.h" #include "fwbuilder/Host.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Network.h" #include "fwbuilder/NetworkIPv6.h" #include "fwbuilder/IPv4.h" @@ -140,6 +141,7 @@ ObjectEditor::ObjectEditor( QWidget *parent): registerObjectDialog(editorStack, StateSyncClusterGroup::TYPENAME, "w_StateSyncClusterGroupDialog"); registerObjectDialog(editorStack, Host::TYPENAME, "w_HostDialog"); + registerObjectDialog(editorStack, AttachedNetworks::TYPENAME, "w_AttachedNetworksDialog"); registerObjectDialog(editorStack, Network::TYPENAME, "w_NetworkDialog"); registerObjectDialog(editorStack, NetworkIPv6::TYPENAME, "w_NetworkDialogIPv6"); registerObjectDialog(editorStack, CustomService::TYPENAME, "w_CustomServiceDialog"); diff --git a/src/libgui/ObjectManipulator.cpp b/src/libgui/ObjectManipulator.cpp index 4a34e42fc..01db1b11a 100644 --- a/src/libgui/ObjectManipulator.cpp +++ b/src/libgui/ObjectManipulator.cpp @@ -52,6 +52,7 @@ #include "fwbuilder/AddressRange.h" #include "fwbuilder/AddressTable.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Cluster.h" #include "fwbuilder/CustomService.h" #include "fwbuilder/DNSName.h" @@ -524,6 +525,20 @@ void ObjectManipulator::contextMenuRequested(const QPoint &pos) AddObjectActions.append( addNewObjectMenuItem(popup_menu, physAddress::TYPENAME)); + /* + * Add menu item to let user add AttachedNetworks object + * to an interface, but only if this object does not exist yet. + * + * Actions added to AddObjectActions are + * enabled and disabled all together based on the decision + * made in getMenuState() (argument newMenuItem). But we + * should always allow the user to add AttachedNetworks + * object to an interface. + */ + FWObject *att = currentObj->getFirstByType(AttachedNetworks::TYPENAME); + if (att == NULL) + addNewObjectMenuItem(popup_menu, AttachedNetworks::TYPENAME); + // Check if we should add menu item that creates failover // group. if parent is a cluster, allow one vrrp type @@ -1224,8 +1239,12 @@ void ObjectManipulator::openLibForObject(FWObject *obj) m_objectManipulator->libs->setCurrentIndex( libs_model->getIdxForLib(obj->getLibrary()).row()); else + { + FWObject *parent = obj->getParent(); + FWObject *lib = parent->getLibrary(); m_objectManipulator->libs->setCurrentIndex( - libs_model->getIdxForLib(obj->getParent()->getLibrary()).row()); + libs_model->getIdxForLib(lib).row()); + } } void ObjectManipulator::showObjectInTree(ObjectTreeViewItem *otvi) diff --git a/src/libgui/ObjectManipulator.h b/src/libgui/ObjectManipulator.h index f02b14647..655ee3af0 100644 --- a/src/libgui/ObjectManipulator.h +++ b/src/libgui/ObjectManipulator.h @@ -172,6 +172,7 @@ class ObjectManipulator : public QWidget libfwbuilder::FWObject* newPhysicalAddress(QUndoCommand* macro); libfwbuilder::FWObject* newPolicyRuleSet (QUndoCommand* macro); libfwbuilder::FWObject* newNATRuleSet (QUndoCommand* macro); + libfwbuilder::FWObject* newAttachedNetworks(QUndoCommand* macro); public slots: diff --git a/src/libgui/ObjectManipulator_create_new.cpp b/src/libgui/ObjectManipulator_create_new.cpp index ab10836ab..1f07b0231 100644 --- a/src/libgui/ObjectManipulator_create_new.cpp +++ b/src/libgui/ObjectManipulator_create_new.cpp @@ -45,6 +45,7 @@ #include "fwbuilder/AddressRange.h" #include "fwbuilder/AddressTable.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Cluster.h" #include "fwbuilder/CustomService.h" #include "fwbuilder/DNSName.h" @@ -212,6 +213,7 @@ void ObjectManipulator::createNewObject() if (type_name == Policy::TYPENAME) new_obj = newPolicyRuleSet(macro); if (type_name == NAT::TYPENAME) new_obj = newNATRuleSet(macro); //if (type_name == Routing::TYPENAME) new_obj = newRoutingRuleSet(); + if (type_name == AttachedNetworks::TYPENAME) new_obj = newAttachedNetworks(macro); if (new_obj == NULL) new_obj = createObject(type_name, descr, NULL, macro); @@ -652,6 +654,30 @@ FWObject* ObjectManipulator::newFailoverClusterGroup(QUndoCommand* macro) return o; } +/* + * Creates new AttachedNetworks object; this method is called by + * context menu item associated with Interface object + */ +FWObject* ObjectManipulator::newAttachedNetworks(QUndoCommand* macro) +{ + FWObject *currentObj = getSelectedObject(); + if ( currentObj->isReadOnly() ) return NULL; + + if (Interface::isA(currentObj)) + { + FWObject *no = createObject(currentObj, AttachedNetworks::TYPENAME, + tr("Attached Networks"), NULL, macro); + string name = Interface::cast(currentObj)->getParentHost()->getName() + + ":" + currentObj->getName() + ":attached"; + no->setName(name); + return no; + } else + { + qWarning("newAttachedNetworks: invalid currentObj"); + return NULL; + } +} + FWObject* ObjectManipulator::newHost(QUndoCommand* macro) { FWObject *parent = diff --git a/src/libgui/ObjectManipulator_tree_ops.cpp b/src/libgui/ObjectManipulator_tree_ops.cpp index 6590d6124..d88f0392c 100644 --- a/src/libgui/ObjectManipulator_tree_ops.cpp +++ b/src/libgui/ObjectManipulator_tree_ops.cpp @@ -99,6 +99,7 @@ #include "fwbuilder/StateSyncClusterGroup.h" #include "fwbuilder/FailoverClusterGroup.h" #include "fwbuilder/Host.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Network.h" #include "fwbuilder/NetworkIPv6.h" #include "fwbuilder/IPv4.h" @@ -306,6 +307,9 @@ void ObjectManipulator::insertSubtree(ObjectTreeViewItem *itm, FWObject *obj) for (FWObjectTypedChildIterator it = obj->findByType(FailoverClusterGroup::TYPENAME); it != it.end(); ++it) insertSubtree( nitm, *it ); + for (FWObjectTypedChildIterator it = obj->findByType(AttachedNetworks::TYPENAME); + it != it.end(); ++it) insertSubtree( nitm, *it ); + return; } diff --git a/src/libgui/ProjectPanel_file_ops.cpp b/src/libgui/ProjectPanel_file_ops.cpp index c2587b843..7f01d41eb 100644 --- a/src/libgui/ProjectPanel_file_ops.cpp +++ b/src/libgui/ProjectPanel_file_ops.cpp @@ -1062,7 +1062,7 @@ bool ProjectPanel::loadFromRCS(RCS *_rcs) } mw->showStatusBarMessage(tr("Merging with system objects...") ); - + MergeConflictRes mcr(mainW); objdb->merge(ndb, &mcr); diff --git a/src/libgui/attachednetworksdialog_q.ui b/src/libgui/attachednetworksdialog_q.ui new file mode 100644 index 000000000..644434942 --- /dev/null +++ b/src/libgui/attachednetworksdialog_q.ui @@ -0,0 +1,246 @@ + + + AttachedNetworksDialog_q + + + true + + + + 0 + 0 + 949 + 258 + + + + + 0 + 0 + + + + Network + + + + + + + 0 + 0 + + + + QFrame::Box + + + QFrame::Sunken + + + + + + + 0 + 0 + + + + + 350 + 0 + + + + + 350 + 16777215 + + + + QFrame::Box + + + QFrame::Sunken + + + + + + Name: + + + false + + + + + + + + 200 + 0 + + + + + 0 + 0 + + + + + + + + Qt::Vertical + + + QSizePolicy::Expanding + + + + 20 + 5 + + + + + + + + The list of addresses in this object is updated automatically and represents subnets attached to the parent interface. + + + true + + + + + + + Qt::Vertical + + + + 20 + 48 + + + + + + + + + + + QFrame::StyledPanel + + + QFrame::Raised + + + + + + QFrame::NoFrame + + + QFrame::Plain + + + + + + + + + + Comment: + + + false + + + + + + + + 0 + 0 + + + + + 200 + 0 + + + + + 16777215 + 180 + + + + true + + + + + + + + + + + TextEditWidget + QTextEdit +
TextEditWidget.h
+ + + + obj_name + comment + + + + + + + obj_name + editingFinished() + AttachedNetworksDialog_q + changed() + + + 20 + 20 + + + 20 + 20 + + + + + comment + textChanged() + AttachedNetworksDialog_q + changed() + + + 20 + 20 + + + 20 + 20 + + + + + diff --git a/src/libgui/libgui.pro b/src/libgui/libgui.pro index 2ae2e0091..6495c9a5c 100644 --- a/src/libgui/libgui.pro +++ b/src/libgui/libgui.pro @@ -78,6 +78,7 @@ HEADERS += ../../config.h \ IPv4Dialog.h \ IPv6Dialog.h \ PhysicalAddressDialog.h \ + AttachedNetworksDialog.h \ NetworkDialog.h \ NetworkDialogIPv6.h \ UserDialog.h \ @@ -287,6 +288,7 @@ SOURCES += ProjectPanel.cpp \ IPv4Dialog.cpp \ IPv6Dialog.cpp \ PhysicalAddressDialog.cpp \ + AttachedNetworksDialog.cpp \ NetworkDialog.cpp \ NetworkDialogIPv6.cpp \ UserDialog.cpp \ @@ -450,6 +452,7 @@ FORMS = FWBMainWindow_q.ui \ rulesetdialog_q.ui \ addressrangedialog_q.ui \ addresstabledialog_q.ui \ + attachednetworksdialog_q.ui \ networkdialog_q.ui \ networkdialogipv6_q.ui \ userdialog_q.ui \ diff --git a/src/pflib/PolicyCompiler_pf_writers.cpp b/src/pflib/PolicyCompiler_pf_writers.cpp index 3035b709a..2c0ef5c6a 100644 --- a/src/pflib/PolicyCompiler_pf_writers.cpp +++ b/src/pflib/PolicyCompiler_pf_writers.cpp @@ -4,9 +4,7 @@ Copyright (C) 2002 NetCitadel, LLC - Author: Vadim Kurland vadim@vk.crocodile.org - - $Id$ + Author: Vadim Kurland vadim@fwbuilder.org This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms @@ -45,6 +43,7 @@ #include "fwbuilder/DNSName.h" #include "fwbuilder/AddressTable.h" #include "fwbuilder/XMLTools.h" +#include "fwbuilder/AttachedNetworks.h" #include #include @@ -774,6 +773,12 @@ void PolicyCompiler_pf::PrintRule::_printAddr(Address *o,bool ) compiler->output << "<" << o->getName() << "> "; return; } + if (atrt->getSubstitutionTypeName()==AttachedNetworks::TYPENAME) + { + compiler->output << atrt->getSourceName() << ":network"; + return ; + } + assert(atrt==NULL); } diff --git a/src/pflib/Preprocessor_pf.cpp b/src/pflib/Preprocessor_pf.cpp index 75a5961b6..7548718c7 100644 --- a/src/pflib/Preprocessor_pf.cpp +++ b/src/pflib/Preprocessor_pf.cpp @@ -4,9 +4,7 @@ Copyright (C) 2006 NetCitadel, LLC - Author: Vadim Kurland vadim@vk.crocodile.org - - $Id$ + Author: Vadim Kurland vadim@fwbuilder.org This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms @@ -27,6 +25,8 @@ #include "Preprocessor_pf.h" #include "fwbuilder/AddressTable.h" +#include "fwbuilder/AttachedNetworks.h" + using namespace libfwbuilder; using namespace fwcompiler; @@ -35,6 +35,11 @@ using namespace std; void Preprocessor_pf::convertObject(FWObject *obj) { - Preprocessor::convertObject(obj); + // do not convert attachedNetworks object, compiler for PF always + // treats it as run-time object + if ( AttachedNetworks::isA(obj)) + AttachedNetworks::cast(obj)->setRunTime(true); + else + Preprocessor::convertObject(obj); } diff --git a/src/pflib/TableFactory.cpp b/src/pflib/TableFactory.cpp index a8824c95e..acdab65b0 100644 --- a/src/pflib/TableFactory.cpp +++ b/src/pflib/TableFactory.cpp @@ -4,9 +4,7 @@ Copyright (C) 2002 NetCitadel, LLC - Author: Vadim Kurland vadim@vk.crocodile.org - - $Id$ + Author: Vadim Kurland vadim@fwbuilder.org This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms @@ -35,6 +33,7 @@ #include "fwbuilder/Library.h" #include "fwbuilder/Rule.h" #include "fwbuilder/RuleElement.h" +#include "fwbuilder/AttachedNetworks.h" #include #include @@ -203,6 +202,10 @@ string TableFactory::PrintTables() { output << atrt->getSourceName() << " "; } + if (atrt->getSubstitutionTypeName()==AttachedNetworks::TYPENAME) + { + output << atrt->getSourceName() << ":network"; + } } else { if (Interface::cast(o)) diff --git a/src/res/configlets/linux24/shell_functions b/src/res/configlets/linux24/shell_functions index a55fe0006..62d0f9395 100644 --- a/src/res/configlets/linux24/shell_functions +++ b/src/res/configlets/linux24/shell_functions @@ -37,6 +37,19 @@ getaddr_internal() { eval "${name}_list=\"$L\"" } +getnet_internal() { + dev=$1 + name=$2 + af=$3 + L=$($IP route list proto kernel | grep $dev | grep -v default | sed 's! .*$!!') + test -z "$L" && { + eval "$name=''" + return + } + eval "${name}_list=\"$L\"" +} + + ## ## This function reads all ipv4 addresses of interface (arg 1) and ## assignes the list to the variable which name is given as arg 2. @@ -53,6 +66,24 @@ getaddr6() { getaddr_internal $1 $2 "-6" } +## +## This function reads all ipv4 addresses of interface (arg 1) and +## assignes list of addresses of attached networks with their netmasks +## to the variable which name is given as arg 2. +## +getnet() { + getnet_internal $1 $2 "-4" +} + +## +## This function reads all ipv6 addresses of interface (arg 1) and +## assignes list of addresses of attached networks with their netmasks +## to the variable which name is given as arg 2. +## +getnet6() { + getnet_internal $1 $2 "-6" +} + # function getinterfaces is used to process wildcard interfaces getinterfaces() { NAME=$1 diff --git a/src/res/resources.xml b/src/res/resources.xml index f26d8abfd..746e619e6 100644 --- a/src/res/resources.xml +++ b/src/res/resources.xml @@ -17,6 +17,10 @@ Host + + Attached Networks + + Network