From f0dc79359e51fc4a78bfcbc5a55a21e8807938c5 Mon Sep 17 00:00:00 2001 From: Vadim Kurland Date: Sat, 14 May 2011 14:44:00 -0700 Subject: [PATCH] * AttachedNetworks.cpp (AttachedNetworks): see #1580 New object type: network object that automatically matches subnets an interface is attached to. The object can be a child of an interface. The object is optional and is not created automatically for all interfaces; user can add it using context menu associated with an interface. Dialog for this object allows editing of the name and comment. List of network addresses represented by this object is always generated automatically. Compiler for PF translates this object to "en0:network" construct that is supported by PF. Compiler for iptables expands it to the list of ipv4 and ipv6 networks defined by the addresses of the parent interface if interface has static addresses. If interface is confgiured as "dynamic" and has no address in fwbuilder, then compiler treats AttachedNetworks object as run-time and uses shell function to determine network addresses during activation of the firewall script. Compilers for other firewall platforms always treat this object as compile-time and abort if it is used with dynamic interface. --- doc/ChangeLog | 21 ++ src/iptlib/CompilerDriver_ipt_run.cpp | 4 +- .../OSConfigurator_linux24_interfaces.cpp | 27 +- src/iptlib/PolicyCompiler_PrintRule.cpp | 9 + src/iptlib/PolicyCompiler_ipt.cpp | 4 + src/iptlib/Preprocessor_ipt.cpp | 50 ++++ src/iptlib/Preprocessor_ipt.h | 54 ++++ src/iptlib/iptlib.pro | 2 + src/libfwbuilder/etc/fwbuilder.dtd | 10 +- src/libfwbuilder/etc/fwbuilder.dtd.in | 10 +- src/libfwbuilder/src/fwbuilder/FWObject.cpp | 4 +- .../src/fwbuilder/FWObjectDatabase.cpp | 1 + .../src/fwbuilder/FWObjectDatabase.h | 3 + .../FWObjectDatabase_create_object.cpp | 5 + .../fwbuilder/FWObjectDatabase_tree_ops.cpp | 6 +- src/libfwbuilder/src/fwbuilder/Firewall.cpp | 53 +--- src/libfwbuilder/src/fwbuilder/Interface.cpp | 32 ++- src/libfwbuilder/src/fwbuilder/Interface.h | 10 +- src/libfwbuilder/src/fwbuilder/MultiAddress.h | 10 +- src/libfwbuilder/src/fwbuilder/fwbuilder.pro | 2 + src/libfwbuilder/src/fwcompiler/Compiler.cpp | 3 +- src/libgui/AttachedNetworksDialog.cpp | 167 ++++++++++++ src/libgui/AttachedNetworksDialog.h | 65 +++++ src/libgui/DialogFactory.cpp | 4 + src/libgui/FWBMainWindow_q.ui | 13 + src/libgui/FWBTree.cpp | 5 +- src/libgui/MainRes.qrc | 6 + src/libgui/ObjectEditor.cpp | 2 + src/libgui/ObjectManipulator.cpp | 21 +- src/libgui/ObjectManipulator.h | 1 + src/libgui/ObjectManipulator_create_new.cpp | 26 ++ src/libgui/ObjectManipulator_tree_ops.cpp | 4 + src/libgui/ProjectPanel_file_ops.cpp | 2 +- src/libgui/attachednetworksdialog_q.ui | 246 ++++++++++++++++++ src/libgui/libgui.pro | 3 + src/pflib/PolicyCompiler_pf_writers.cpp | 11 +- src/pflib/Preprocessor_pf.cpp | 13 +- src/pflib/TableFactory.cpp | 9 +- src/res/configlets/linux24/shell_functions | 31 +++ src/res/resources.xml | 4 + 40 files changed, 865 insertions(+), 88 deletions(-) create mode 100644 src/iptlib/Preprocessor_ipt.cpp create mode 100644 src/iptlib/Preprocessor_ipt.h create mode 100644 src/libgui/AttachedNetworksDialog.cpp create mode 100644 src/libgui/AttachedNetworksDialog.h create mode 100644 src/libgui/attachednetworksdialog_q.ui diff --git a/doc/ChangeLog b/doc/ChangeLog index 9d353951e..de0ead8b9 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,3 +1,24 @@ +2011-05-14 vadim + + * AttachedNetworks.cpp (AttachedNetworks): see #1580 New object + type: network object that automatically matches subnets an + interface is attached to. The object can be a child of an + interface. The object is optional and is not created automatically + for all interfaces; user can add it using context menu associated + with an interface. Dialog for this object allows editing of the + name and comment. List of network addresses represented by this + object is always generated automatically. Compiler for PF + translates this object to "en0:network" construct that is + supported by PF. Compiler for iptables expands it to the list of + ipv4 and ipv6 networks defined by the addresses of the parent + interface if interface has static addresses. If interface is + confgiured as "dynamic" and has no address in fwbuilder, then + compiler treats AttachedNetworks object as run-time and uses shell + function to determine network addresses during activation of the + firewall script. Compilers for other firewall platforms always + treat this object as compile-time and abort if it is used with + dynamic interface. + 2011-05-13 vadim * PolicyCompiler_ipt.cpp (processNext): see #2402 "Tag action diff --git a/src/iptlib/CompilerDriver_ipt_run.cpp b/src/iptlib/CompilerDriver_ipt_run.cpp index 086b225bb..d9cd315a4 100644 --- a/src/iptlib/CompilerDriver_ipt_run.cpp +++ b/src/iptlib/CompilerDriver_ipt_run.cpp @@ -44,6 +44,7 @@ #include "PolicyCompiler_ipt.h" #include "NATCompiler_ipt.h" #include "RoutingCompiler_ipt.h" +#include "Preprocessor_ipt.h" #include "OSConfigurator_linux24.h" #include "OSConfigurator_secuwall.h" #include "OSConfigurator_ipcop.h" @@ -52,7 +53,6 @@ #include "Configlet.h" -#include "fwcompiler/Preprocessor.h" #include "fwbuilder/FWObjectDatabase.h" #include "fwbuilder/FWException.h" @@ -309,7 +309,7 @@ QString CompilerDriver_ipt::run(const std::string &cluster_id, if (nat_count || policy_count) { - Preprocessor* prep = new Preprocessor( + Preprocessor_ipt* prep = new Preprocessor_ipt( objdb , fw, ipv6_policy); prep->setSingleRuleCompileMode(single_rule_id); if (inTestMode()) prep->setTestMode(); diff --git a/src/iptlib/OSConfigurator_linux24_interfaces.cpp b/src/iptlib/OSConfigurator_linux24_interfaces.cpp index e90766b94..1b5ae6f2d 100644 --- a/src/iptlib/OSConfigurator_linux24_interfaces.cpp +++ b/src/iptlib/OSConfigurator_linux24_interfaces.cpp @@ -502,15 +502,26 @@ string OSConfigurator_linux24::printDynamicAddressesConfigurationCommands() if (iface->getName().find("*")==string::npos) { out << "getaddr " - << iface->getName() - << " " - << getInterfaceVarName(iface, false) - << endl; + << iface->getName() + << " " + << getInterfaceVarName(iface, false) + << endl; out << "getaddr6 " - << iface->getName() - << " " - << getInterfaceVarName(iface, true) - << endl; + << iface->getName() + << " " + << getInterfaceVarName(iface, true) + << endl; + + out << "getnet " + << iface->getName() + << " " + << getInterfaceVarName(iface, false) << "_network" + << endl; + out << "getnet6 " + << iface->getName() + << " " + << getInterfaceVarName(iface, true) << "_network" + << endl; } } } diff --git a/src/iptlib/PolicyCompiler_PrintRule.cpp b/src/iptlib/PolicyCompiler_PrintRule.cpp index e829c5769..ab565e46f 100644 --- a/src/iptlib/PolicyCompiler_PrintRule.cpp +++ b/src/iptlib/PolicyCompiler_PrintRule.cpp @@ -38,6 +38,7 @@ #include "fwbuilder/Network.h" #include "fwbuilder/DNSName.h" #include "fwbuilder/AddressRange.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/FWObjectDatabase.h" #include "fwbuilder/RuleElement.h" @@ -1246,6 +1247,14 @@ string PolicyCompiler_ipt::PrintRule::_printAddr(Address *o) { return atrt->getSourceName(); } + + if (atrt->getSubstitutionTypeName()==AttachedNetworks::TYPENAME) + { + ostr << "$i_" << atrt->getSourceName() << "_network"; + return ostr.str(); + } + + // at this time we only support two types of MultiAddress // objects: AddressTable and DNSName. Both should be converted // to MultiAddressRunTime at this point. If we get some other diff --git a/src/iptlib/PolicyCompiler_ipt.cpp b/src/iptlib/PolicyCompiler_ipt.cpp index dd2257f26..00ed5bfee 100644 --- a/src/iptlib/PolicyCompiler_ipt.cpp +++ b/src/iptlib/PolicyCompiler_ipt.cpp @@ -4588,6 +4588,8 @@ string PolicyCompiler_ipt::debugPrintRule(Rule *r) src << o->getName(); if (Group::cast(o)!=NULL) src << "[" << o->size() << "]"; + if ( MultiAddress::cast(o)!=NULL) + src << string((MultiAddress::cast(o)->isRunTime()) ? "(r)" : "(c)"); } if (i2!=dstrel->end()) @@ -4596,6 +4598,8 @@ string PolicyCompiler_ipt::debugPrintRule(Rule *r) dst << o->getName(); if (Group::cast(o)!=NULL) dst << "[" << o->size() << "]"; + if ( MultiAddress::cast(o)!=NULL) + dst << string((MultiAddress::cast(o)->isRunTime()) ? "(r)" : "(c)"); } if (i3!=srvrel->end()) diff --git a/src/iptlib/Preprocessor_ipt.cpp b/src/iptlib/Preprocessor_ipt.cpp new file mode 100644 index 000000000..09135be7f --- /dev/null +++ b/src/iptlib/Preprocessor_ipt.cpp @@ -0,0 +1,50 @@ +/* + + Firewall Builder + + Copyright (C) 2011 NetCitadel, LLC + + Author: Vadim Kurland vadim@fwbuilder.org + + This program is free software which we release under the GNU General Public + License. You may redistribute and/or modify this program under the terms + of that license as published by the Free Software Foundation; either + version 2 of the License, or (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + To get a copy of the GNU General Public License, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +*/ + + +#include "Preprocessor_ipt.h" + +#include "fwbuilder/Interface.h" +#include "fwbuilder/AttachedNetworks.h" + + +using namespace libfwbuilder; +using namespace fwcompiler; +using namespace std; + + +void Preprocessor_ipt::convertObject(FWObject *obj) +{ + if ( AttachedNetworks::isA(obj)) + { + AttachedNetworks *att = AttachedNetworks::cast(obj); + Interface *intf = Interface::cast(att->getParent()); + if (intf->isRegular()) + { + att->setCompileTime(true); + att->loadFromSource(ipv6, inTestMode()); + } else att->setRunTime(true); + } else + Preprocessor::convertObject(obj); +} + diff --git a/src/iptlib/Preprocessor_ipt.h b/src/iptlib/Preprocessor_ipt.h new file mode 100644 index 000000000..7ef64cbd3 --- /dev/null +++ b/src/iptlib/Preprocessor_ipt.h @@ -0,0 +1,54 @@ +/* + + Firewall Builder + + Copyright (C) 2011 NetCitadel, LLC + + Author: Vadim Kurland vadim@fwbuilder.org + + This program is free software which we release under the GNU General Public + License. You may redistribute and/or modify this program under the terms + of that license as published by the Free Software Foundation; either + version 2 of the License, or (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + To get a copy of the GNU General Public License, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +*/ + +#ifndef __PREPROCESSOR_IPT_HH +#define __PREPROCESSOR_IPT_HH + +#include +#include "fwcompiler/Preprocessor.h" + +namespace libfwbuilder { + class FWObjectDatabase; +}; + + +namespace fwcompiler { + + class Preprocessor_ipt : public Preprocessor { + + public: + + Preprocessor_ipt(libfwbuilder::FWObjectDatabase *_db, + libfwbuilder::Firewall *fw, + bool ipv6_policy) : + Preprocessor(_db, fw, ipv6_policy) + { } + + virtual void convertObject(libfwbuilder::FWObject *obj); + + }; + + +} + +#endif diff --git a/src/iptlib/iptlib.pro b/src/iptlib/iptlib.pro index dd5296e5a..255e65195 100644 --- a/src/iptlib/iptlib.pro +++ b/src/iptlib/iptlib.pro @@ -27,6 +27,7 @@ SOURCES = CompilerDriver_ipt.cpp \ PolicyCompiler_secuwall.cpp \ RoutingCompiler_ipt.cpp \ RoutingCompiler_ipt_writers.cpp \ + Preprocessor_ipt.cpp \ combinedAddress.cpp \ AutomaticRules_ipt.cpp \ utils.cpp @@ -42,6 +43,7 @@ HEADERS = ../../config.h \ PolicyCompiler_ipt.h \ PolicyCompiler_secuwall.h \ RoutingCompiler_ipt.h \ + Preprocessor_ipt.h \ combinedAddress.h \ AutomaticRules_ipt.h \ utils.h diff --git a/src/libfwbuilder/etc/fwbuilder.dtd b/src/libfwbuilder/etc/fwbuilder.dtd index c39910788..5a992e6af 100644 --- a/src/libfwbuilder/etc/fwbuilder.dtd +++ b/src/libfwbuilder/etc/fwbuilder.dtd @@ -85,7 +85,7 @@ > +((AnyNetwork|AnyIPService|AnyInterval|ObjectGroup|StateSyncClusterGroup|FailoverClusterGroup|Host|Firewall|Cluster|Network|NetworkIPv6|AttachedNetworks|IPv4|IPv6|DNSName|AddressTable|physAddress|AddressRange|ObjectRef|ServiceGroup|IPService|ICMPService|ICMP6Service|TCPService|UDPService|CustomService|ServiceRef|IntervalGroup|Interval|IntervalRef|Interface|Policy|NAT|PolicyRule|NATRule|Library|TagService|UserService)*)> - + - + + + +((AnyNetwork|AnyIPService|AnyInterval|ObjectGroup|StateSyncClusterGroup|FailoverClusterGroup|Host|Firewall|Cluster|Network|NetworkIPv6|AttachedNetworks|IPv4|IPv6|DNSName|AddressTable|physAddress|AddressRange|ObjectRef|ServiceGroup|IPService|ICMPService|ICMP6Service|TCPService|UDPService|CustomService|ServiceRef|IntervalGroup|Interval|IntervalRef|Interface|Policy|NAT|PolicyRule|NATRule|Library|TagService|UserService)*)> - + - + + + xmlChildrenNode; cur; cur=cur->next) @@ -108,6 +108,7 @@ void FWObject::fromXML(xmlNodePtr root) throw(FWException) { /* Add w/o validation. Trust XML to do that */ add(o, false); + try { o->fromXML(cur); @@ -408,6 +409,7 @@ FWObject* FWObject::addCopyOf(const FWObject *x, bool preserve_id) if(!o1) throw FWException(string("Error creating object with type: ")+ x->getTypeName()); + // This adds with validation add(o1); diff --git a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp index 9b9e18494..94ce9a865 100644 --- a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp +++ b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.cpp @@ -40,6 +40,7 @@ #include #include +#include #include #include #include diff --git a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h index ea8ff63b5..ed630aa3e 100644 --- a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h +++ b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase.h @@ -56,6 +56,7 @@ namespace libfwbuilder // forward declarations for specialized create() methods class AddressRange; class AddressTable; + class AttachedNetworks; class Cluster; class StateSyncClusterGroup; class FailoverClusterGroup; @@ -123,6 +124,7 @@ namespace libfwbuilder DECLARE_CREATE_OBJ_METHOD(AddressRange); DECLARE_CREATE_OBJ_METHOD(AddressTable); + DECLARE_CREATE_OBJ_METHOD(AttachedNetworks); DECLARE_CREATE_OBJ_METHOD(Cluster); DECLARE_CREATE_OBJ_METHOD(StateSyncClusterGroup); DECLARE_CREATE_OBJ_METHOD(FailoverClusterGroup); @@ -474,6 +476,7 @@ public: DECLARE_CREATE_OBJ_CLASS_METHOD(AddressRange); DECLARE_CREATE_OBJ_CLASS_METHOD(AddressTable); + DECLARE_CREATE_OBJ_CLASS_METHOD(AttachedNetworks); DECLARE_CREATE_OBJ_CLASS_METHOD(Cluster); DECLARE_CREATE_OBJ_CLASS_METHOD(StateSyncClusterGroup); DECLARE_CREATE_OBJ_CLASS_METHOD(FailoverClusterGroup); diff --git a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_create_object.cpp b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_create_object.cpp index 1000d8dea..bc3d7bf05 100644 --- a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_create_object.cpp +++ b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_create_object.cpp @@ -54,6 +54,7 @@ #include #include +#include #include #include #include @@ -127,6 +128,8 @@ void FWObjectDatabase::init_create_methods_table() registerObjectType("AddressTable", &create_AddressTable); + registerObjectType("AttachedNetworks", + &create_AttachedNetworks); registerObjectType("Cluster", &create_Cluster); registerObjectType("StateSyncClusterGroup", @@ -302,6 +305,7 @@ FWObject *FWObjectDatabase::create(const string &type_name, int id, bool init) } FWObject *nobj = (*fn)(id); + addToIndex(nobj); if (init) nobj->init(this); return nobj; @@ -331,6 +335,7 @@ FWObject *FWObjectDatabase::createFromXML(xmlNodePtr data) CREATE_OBJ_METHOD(AddressRange); CREATE_OBJ_METHOD(AddressTable); +CREATE_OBJ_METHOD(AttachedNetworks); CREATE_OBJ_METHOD(Cluster); CREATE_OBJ_METHOD(StateSyncClusterGroup); CREATE_OBJ_METHOD(FailoverClusterGroup); diff --git a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp index 112cebed4..3eaa7ff17 100644 --- a/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp +++ b/src/libfwbuilder/src/fwbuilder/FWObjectDatabase_tree_ops.cpp @@ -222,9 +222,10 @@ void FWObjectTreeScanner::scanAndAdd(FWObject *dst,FWObject *source) } } } + } -//#define DEBUG_MERGE 1 +// #define DEBUG_MERGE 1 void FWObjectTreeScanner::merge(FWObject *dst, FWObject *src) { @@ -293,7 +294,7 @@ void FWObjectTreeScanner::merge(FWObject *dst, FWObject *src) if (dobj==NULL) { sobj = *i; - FWObject *o1=treeRoot->create( sobj->getTypeName()); + FWObject *o1 = treeRoot->create( sobj->getTypeName()); FWObject *pdst = dstMap[ src->getId() ]; assert(pdst!=NULL); @@ -313,6 +314,7 @@ void FWObjectTreeScanner::merge(FWObject *dst, FWObject *src) o1->duplicate( sobj, false); // copy IDs as well + #ifdef DEBUG_MERGE cerr << "duplicate #1 done" << endl; #endif diff --git a/src/libfwbuilder/src/fwbuilder/Firewall.cpp b/src/libfwbuilder/src/fwbuilder/Firewall.cpp index 571146ec7..f6cfcedd8 100644 --- a/src/libfwbuilder/src/fwbuilder/Firewall.cpp +++ b/src/libfwbuilder/src/fwbuilder/Firewall.cpp @@ -227,52 +227,16 @@ void Firewall::duplicateInterfaces(FWObject *target, const FWObject *source, for (FWObjectTypedChildIterator m = source->findByType(Interface::TYPENAME); m!=m.end(); ++m ) { - FWObject *src_interface = *m; - FWObject *dst_interface_copy = target->addCopyOf(src_interface, preserve_id); + FWObject *src_interface = *m; + FWObject *dst_interface_copy = + target->addCopyOf(src_interface, preserve_id); id_mapping[src_interface->getId()] = dst_interface_copy->getId(); - dst_interface_copy->destroyChildren(); - for (FWObjectTypedChildIterator k=src_interface->findByType(IPv4::TYPENAME); - k!=k.end(); ++k ) - { - FWObject *src_obj = *k; - FWObject *dst_obj_copy= dst_interface_copy->addCopyOf(src_obj,preserve_id); - - if (src_obj!=NULL && dst_obj_copy!=NULL) - id_mapping[src_obj->getId()] = dst_obj_copy->getId(); - } - - for (FWObjectTypedChildIterator k=src_interface->findByType(IPv6::TYPENAME); - k!=k.end(); ++k ) - { - FWObject *src_obj = *k; - FWObject *dst_obj_copy= dst_interface_copy->addCopyOf(src_obj,preserve_id); - - if (src_obj!=NULL && dst_obj_copy!=NULL) - id_mapping[src_obj->getId()] = dst_obj_copy->getId(); - } - - for (FWObjectTypedChildIterator k = src_interface->findByType(physAddress::TYPENAME); - k!=k.end(); ++k ) - { - FWObject *src_obj = *k; - FWObject *dst_obj_copy= dst_interface_copy->addCopyOf(src_obj,preserve_id); - - if (src_obj!=NULL && dst_obj_copy!=NULL) - id_mapping[src_obj->getId()] = dst_obj_copy->getId(); - } - - for (FWObjectTypedChildIterator k = src_interface->findByType(InterfaceOptions::TYPENAME); - k!=k.end(); ++k ) - { - FWObject *src_obj = *k; - FWObject *dst_obj_copy= dst_interface_copy->addCopyOf(src_obj,preserve_id); - - if (src_obj!=NULL && dst_obj_copy!=NULL) - id_mapping[src_obj->getId()] = dst_obj_copy->getId(); - } + Interface::cast(dst_interface_copy)->duplicateWithIdMapping( + src_interface, id_mapping, preserve_id); +#if 0 if (Firewall::cast(target)) { /* @@ -288,7 +252,8 @@ void Firewall::duplicateInterfaces(FWObject *target, const FWObject *source, k!=k.end(); ++k ) { FWObject *src_subinterface = *k; - FWObject *dst_subinterface_copy = dst_interface_copy->addCopyOf(src_subinterface, preserve_id); + FWObject *dst_subinterface_copy = + dst_interface_copy->addCopyOf(src_subinterface, preserve_id); if (src_subinterface!=NULL && dst_subinterface_copy!=NULL) id_mapping[src_subinterface->getId()] = dst_subinterface_copy->getId(); @@ -297,6 +262,8 @@ void Firewall::duplicateInterfaces(FWObject *target, const FWObject *source, duplicateInterfaces(dst_interface_copy, src_interface, id_mapping, preserve_id); } +#endif + } } diff --git a/src/libfwbuilder/src/fwbuilder/Interface.cpp b/src/libfwbuilder/src/fwbuilder/Interface.cpp index cfdf62158..1e0ad0cb6 100644 --- a/src/libfwbuilder/src/fwbuilder/Interface.cpp +++ b/src/libfwbuilder/src/fwbuilder/Interface.cpp @@ -6,9 +6,6 @@ Author: Vadim Kurland vadim@fwbuilder.org - $Id$ - - This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms of that license as published by the Free Software Foundation; either @@ -34,6 +31,7 @@ #include #include #include +#include #include #include @@ -118,6 +116,28 @@ FWObject& Interface::duplicate(const FWObject *x, bool preserve_id) return *this; } +void Interface::duplicateWithIdMapping(const FWObject *src, + map &id_mapping, bool preserve_id) +{ + assert(src->getTypeName() == Interface::TYPENAME); + + checkReadOnly(); + + shallowDuplicate(src, preserve_id); + + destroyChildren(); + + for(list::const_iterator m=src->begin(); m!=src->end(); ++m) + { + FWObject *src_obj = *m; + FWObject *dst_obj_copy = addCopyOf(src_obj, preserve_id); + if (src_obj!=NULL && dst_obj_copy!=NULL) + id_mapping[src_obj->getId()] = dst_obj_copy->getId(); + } + + setDirty(true); +} + bool Interface::cmp(const FWObject *obj, bool recursive) throw(FWException) { const Interface *rx = Interface::constcast(obj); @@ -247,6 +267,9 @@ xmlNodePtr Interface::toXML(xmlNodePtr parent) throw(FWException) o = getFirstByType(FailoverClusterGroup::TYPENAME); if (o) o->toXML(me); + o = getFirstByType(AttachedNetworks::TYPENAME); + if (o) o->toXML(me); + return me; } @@ -341,7 +364,8 @@ bool Interface::validateChild(FWObject *o) otype==IPv6::TYPENAME || otype==physAddress::TYPENAME || otype==InterfaceOptions::TYPENAME || - otype==FailoverClusterGroup::TYPENAME); + otype==FailoverClusterGroup::TYPENAME || + otype==AttachedNetworks::TYPENAME); } /* diff --git a/src/libfwbuilder/src/fwbuilder/Interface.h b/src/libfwbuilder/src/fwbuilder/Interface.h index c861ea977..fe028b67f 100644 --- a/src/libfwbuilder/src/fwbuilder/Interface.h +++ b/src/libfwbuilder/src/fwbuilder/Interface.h @@ -195,13 +195,15 @@ public: virtual FWObject& shallowDuplicate(const FWObject *obj, - bool preserve_id = true) - throw(FWException); + bool preserve_id = true) throw(FWException); virtual FWObject& duplicate(const FWObject *obj, - bool preserve_id = true) - throw(FWException); + bool preserve_id = true) throw(FWException); + virtual bool cmp(const FWObject *obj, bool recursive=false) throw(FWException); + void duplicateWithIdMapping(const FWObject *src, + std::map &id_mapping, bool preserve_id); + const std::string &getLabel() const; void setLabel(const std::string& n); diff --git a/src/libfwbuilder/src/fwbuilder/MultiAddress.h b/src/libfwbuilder/src/fwbuilder/MultiAddress.h index d148754c0..a57affaf4 100644 --- a/src/libfwbuilder/src/fwbuilder/MultiAddress.h +++ b/src/libfwbuilder/src/fwbuilder/MultiAddress.h @@ -54,8 +54,14 @@ class MultiAddress : public ObjectGroup virtual void setSourceName(const std::string& source_name); virtual void loadFromSource(bool ipv6, bool test_mode=false) throw(FWException); - bool isCompileTime() const; - bool isRunTime() const; + /* + * functions isCompileTime() and isRunTime() are virtual because + * some multi-address objects allow the user to set these flags, + * while other object types behave as run-time or compile-time + * depending on attributes of other objects (e.g. AttachedNetworks) + */ + virtual bool isCompileTime() const; + virtual bool isRunTime() const; void setCompileTime(const bool b); void setRunTime(const bool b); diff --git a/src/libfwbuilder/src/fwbuilder/fwbuilder.pro b/src/libfwbuilder/src/fwbuilder/fwbuilder.pro index b6f6053f4..d78664ae8 100644 --- a/src/libfwbuilder/src/fwbuilder/fwbuilder.pro +++ b/src/libfwbuilder/src/fwbuilder/fwbuilder.pro @@ -50,6 +50,7 @@ SOURCES = InetAddr.cpp \ NAT.cpp \ Network.cpp \ NetworkIPv6.cpp \ + AttachedNetworks.cpp \ ObjectGroup.cpp \ physAddress.cpp \ DNSName.cpp\ @@ -124,6 +125,7 @@ HEADERS = inet_net.h \ NAT.h \ Network.h \ NetworkIPv6.h \ + AttachedNetworks.h \ ObjectGroup.h \ physAddress.h \ DNSName.h\ diff --git a/src/libfwbuilder/src/fwcompiler/Compiler.cpp b/src/libfwbuilder/src/fwcompiler/Compiler.cpp index fbebfbc3f..79eae9574 100644 --- a/src/libfwbuilder/src/fwcompiler/Compiler.cpp +++ b/src/libfwbuilder/src/fwcompiler/Compiler.cpp @@ -6,8 +6,6 @@ Author: Vadim Kurland vadim@fwbuilder.org - $Id$ - This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms of that license as published by the Free Software Foundation; either @@ -1117,6 +1115,7 @@ bool Compiler::emptyGroupsInRE::processNext() for (FWObject::iterator i=re->begin(); i!=re->end(); i++) { FWObject *o = FWReference::getObject(*i); + if ( MultiAddress::cast(o)!=NULL && MultiAddress::cast(o)->isRunTime()) continue; diff --git a/src/libgui/AttachedNetworksDialog.cpp b/src/libgui/AttachedNetworksDialog.cpp new file mode 100644 index 000000000..078293d20 --- /dev/null +++ b/src/libgui/AttachedNetworksDialog.cpp @@ -0,0 +1,167 @@ +/* + + Firewall Builder + + Copyright (C) 201 NetCitadel, LLC + + Author: Vadim Kurland vadim@fwbuilder.org + + This program is free software which we release under the GNU General Public + License. You may redistribute and/or modify this program under the terms + of that license as published by the Free Software Foundation; either + version 2 of the License, or (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + To get a copy of the GNU General Public License, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +*/ + +#include "../../config.h" +#include "global.h" +#include "utils.h" + +#include "FWBTree.h" +#include "AttachedNetworksDialog.h" +#include "ProjectPanel.h" +#include "FWBSettings.h" +#include "FWCmdChange.h" + +#include "fwbuilder/Library.h" +#include "fwbuilder/AttachedNetworks.h" +#include "fwbuilder/Interface.h" +#include "fwbuilder/IPv4.h" +#include "fwbuilder/IPv6.h" +#include "fwbuilder/FWException.h" +#include "fwbuilder/Inet6AddrMask.h" + +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + + +using namespace std; +using namespace libfwbuilder; + +AttachedNetworksDialog::AttachedNetworksDialog(QWidget *parent) : BaseObjectDialog(parent) +{ + m_dialog = new Ui::AttachedNetworksDialog_q; + m_dialog->setupUi(this); + obj=NULL; +} + +AttachedNetworksDialog::~AttachedNetworksDialog() { delete m_dialog; } + +void AttachedNetworksDialog::getHelpName(QString *str) +{ + *str = "AttachedNetworksDialog"; +} + +void AttachedNetworksDialog::loadFWObject(FWObject *o) +{ + obj=o; + AttachedNetworks *s = dynamic_cast(obj); + assert(s!=NULL); + + init=true; + + m_dialog->obj_name->setText( QString::fromUtf8(s->getName().c_str()) ); + m_dialog->comment->setText( QString::fromUtf8(s->getComment().c_str()) ); + + m_dialog->obj_name->setEnabled(!o->isReadOnly()); + setDisabledPalette(m_dialog->obj_name); + + m_dialog->addresses->setEnabled(false); // always read-only + setDisabledPalette(m_dialog->addresses); + + m_dialog->comment->setReadOnly(o->isReadOnly()); + setDisabledPalette(m_dialog->comment); + + Interface *parent_intf = Interface::cast(obj->getParent()); + assert(parent_intf); + + m_dialog->addresses->clear(); + + FWObjectTypedChildIterator k = parent_intf->findByType(IPv4::TYPENAME); + for ( ; k!=k.end(); ++k) + { + Address *addr = Address::cast(*k); + addAddressToList(addr->getNetworkAddressPtr(), addr->getNetmaskPtr()); + } + + k = parent_intf->findByType(IPv6::TYPENAME); + for ( ; k!=k.end(); ++k) + { + Address *addr = Address::cast(*k); + addAddressToList(addr->getNetworkAddressPtr(), addr->getNetmaskPtr()); + } + + + init=false; +} + +void AttachedNetworksDialog::addAddressToList(const InetAddr *ip_addr, + const InetAddr *ip_netm) +{ + QString name("%1/%2"); + if (ip_addr->isV6()) + { + m_dialog->addresses->addItem( + name.arg(ip_addr->toString().c_str()).arg(ip_netm->getLength())); + } else + { + m_dialog->addresses->addItem( + name.arg(ip_addr->toString().c_str()).arg(ip_netm->toString().c_str())); + } +} + +void AttachedNetworksDialog::validate(bool *result) +{ + if (fwbdebug) qDebug() << "AttachedNetworksDialog::validate"; + + *result = true; + AttachedNetworks *s = dynamic_cast(obj); + assert(s!=NULL); + + if (!validateName(this, obj, m_dialog->obj_name->text())) + { + *result = false; + } +} + + +void AttachedNetworksDialog::applyChanges() +{ + std::auto_ptr cmd( new FWCmdChange(m_project, obj)); + FWObject* new_state = cmd->getNewState(); + + AttachedNetworks *s = dynamic_cast(new_state); + assert(s!=NULL); + + string oldname = obj->getName(); + new_state->setName(string(m_dialog->obj_name->text().toUtf8().constData())); + new_state->setComment(string( + m_dialog->comment->toPlainText().toUtf8().constData())); + + if (!cmd->getOldState()->cmp(new_state, true)) + { + if (fwbdebug) + qDebug() << "Pushing FWCmdChange to undo stack"; + + if (obj->isReadOnly()) return; + m_project->undoStack->push(cmd.release()); + } +} diff --git a/src/libgui/AttachedNetworksDialog.h b/src/libgui/AttachedNetworksDialog.h new file mode 100644 index 000000000..9662fce64 --- /dev/null +++ b/src/libgui/AttachedNetworksDialog.h @@ -0,0 +1,65 @@ +/* + + Firewall Builder + + Copyright (C) 2011 NetCitadel, LLC + + Author: Vadim Kurland vadim@fwbuilder.org + + This program is free software which we release under the GNU General Public + License. You may redistribute and/or modify this program under the terms + of that license as published by the Free Software Foundation; either + version 2 of the License, or (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + To get a copy of the GNU General Public License, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +*/ + + +#ifndef __ATTACHEDNETWORKSDIALOG_H_ +#define __ATTACHEDNETWORKSDIALOG_H_ + +#include "../../config.h" +#include +#include "BaseObjectDialog.h" +#include + +#include "fwbuilder/FWObject.h" + + +class ProjectPanel; + +namespace libfwbuilder +{ + class InetAddr; +}; + +class AttachedNetworksDialog : public BaseObjectDialog +{ + Q_OBJECT; + + Ui::AttachedNetworksDialog_q *m_dialog; + + void addAddressToList(const libfwbuilder::InetAddr *ip_addr, + const libfwbuilder::InetAddr *ip_netm); + + public: + AttachedNetworksDialog(QWidget *parent); + ~AttachedNetworksDialog(); + +public slots: + virtual void applyChanges(); + virtual void loadFWObject(libfwbuilder::FWObject *obj); + virtual void validate(bool*); + virtual void getHelpName(QString*); + + +}; + +#endif // ATTACHEDNETWORKSDIALOG_H diff --git a/src/libgui/DialogFactory.cpp b/src/libgui/DialogFactory.cpp index 4dce68f0b..dfb676292 100644 --- a/src/libgui/DialogFactory.cpp +++ b/src/libgui/DialogFactory.cpp @@ -40,6 +40,7 @@ #include "PhysicalAddressDialog.h" #include "DNSNameDialog.h" #include "AddressTableDialog.h" +#include "AttachedNetworksDialog.h" #include "NetworkDialog.h" #include "NetworkDialogIPv6.h" #include "UserDialog.h" @@ -98,6 +99,7 @@ #include "openaisOptionsDialog.h" #include "pfsyncOptionsDialog.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Library.h" #include "fwbuilder/Firewall.h" #include "fwbuilder/Cluster.h" @@ -172,6 +174,8 @@ BaseObjectDialog *DialogFactory::createDialog(QWidget *parent, const QString &ob if (objType==Interface::TYPENAME) return new InterfaceDialog(parent); + if (objType==AttachedNetworks::TYPENAME) return new AttachedNetworksDialog(parent); + if (objType==Network::TYPENAME) return new NetworkDialog(parent); if (objType==NetworkIPv6::TYPENAME) return new NetworkDialogIPv6(parent); diff --git a/src/libgui/FWBMainWindow_q.ui b/src/libgui/FWBMainWindow_q.ui index 622938458..8e05f9d17 100644 --- a/src/libgui/FWBMainWindow_q.ui +++ b/src/libgui/FWBMainWindow_q.ui @@ -683,6 +683,13 @@ + + + + + + + @@ -1591,6 +1598,12 @@
BlankDialog.h
1 + + AttachedNetworksDialog + QWidget +
AttachedNetworksDialog.h
+ 1 + diff --git a/src/libgui/FWBTree.cpp b/src/libgui/FWBTree.cpp index e0feb31eb..bf0c08393 100644 --- a/src/libgui/FWBTree.cpp +++ b/src/libgui/FWBTree.cpp @@ -6,8 +6,6 @@ Author: Vadim Kurland vadim@fwbuilder.org - $Id$ - This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms of that license as published by the Free Software Foundation; either @@ -53,6 +51,7 @@ #include "fwbuilder/IntervalGroup.h" #include "fwbuilder/Library.h" #include "fwbuilder/NAT.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Network.h" #include "fwbuilder/NetworkIPv6.h" #include "fwbuilder/ObjectGroup.h" @@ -606,6 +605,7 @@ QString FWBTree::getTranslatableObjectTypeName(const QString &type_name) if (type_name == Cluster::TYPENAME) return QObject::tr("Cluster"); if (type_name == Host::TYPENAME) return QObject::tr("Host"); if (type_name == Interface::TYPENAME) return QObject::tr("Interface"); + if (type_name == AttachedNetworks::TYPENAME) return QObject::tr("Attached Networks"); if (type_name == Network::TYPENAME) return QObject::tr("Network"); if (type_name == NetworkIPv6::TYPENAME) return QObject::tr("Network IPv6"); if (type_name == IPv4::TYPENAME) return QObject::tr("Address"); @@ -643,6 +643,7 @@ QString FWBTree::getTranslatableNewObjectMenuText(const QString &type_name) if (type_name == Cluster::TYPENAME) return QObject::tr("New Cluster"); if (type_name == Host::TYPENAME) return QObject::tr("New Host"); if (type_name == Interface::TYPENAME) return QObject::tr("New Interface"); + if (type_name == AttachedNetworks::TYPENAME) return QObject::tr("New Attached Networks Object"); if (type_name == Network::TYPENAME) return QObject::tr("New Network"); if (type_name == NetworkIPv6::TYPENAME) return QObject::tr("New Network IPv6"); if (type_name == IPv4::TYPENAME) return QObject::tr("New Address"); diff --git a/src/libgui/MainRes.qrc b/src/libgui/MainRes.qrc index 321b8ab8c..4c95c8dbd 100644 --- a/src/libgui/MainRes.qrc +++ b/src/libgui/MainRes.qrc @@ -28,6 +28,12 @@ Icons/addresstable-neg_16.png Icons/addresstable-ref_25.png Icons/addresstable_16.png + Icons/network_25.png + Icons/network_64.png + Icons/network-neg_25.png + Icons/network-neg_16.png + Icons/network-ref_25.png + Icons/network_16.png Icons/blank.png Icons/blank.png Icons/both_25.png diff --git a/src/libgui/ObjectEditor.cpp b/src/libgui/ObjectEditor.cpp index 215f13b52..a3488ea63 100644 --- a/src/libgui/ObjectEditor.cpp +++ b/src/libgui/ObjectEditor.cpp @@ -63,6 +63,7 @@ #include "fwbuilder/StateSyncClusterGroup.h" #include "fwbuilder/FailoverClusterGroup.h" #include "fwbuilder/Host.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Network.h" #include "fwbuilder/NetworkIPv6.h" #include "fwbuilder/IPv4.h" @@ -140,6 +141,7 @@ ObjectEditor::ObjectEditor( QWidget *parent): registerObjectDialog(editorStack, StateSyncClusterGroup::TYPENAME, "w_StateSyncClusterGroupDialog"); registerObjectDialog(editorStack, Host::TYPENAME, "w_HostDialog"); + registerObjectDialog(editorStack, AttachedNetworks::TYPENAME, "w_AttachedNetworksDialog"); registerObjectDialog(editorStack, Network::TYPENAME, "w_NetworkDialog"); registerObjectDialog(editorStack, NetworkIPv6::TYPENAME, "w_NetworkDialogIPv6"); registerObjectDialog(editorStack, CustomService::TYPENAME, "w_CustomServiceDialog"); diff --git a/src/libgui/ObjectManipulator.cpp b/src/libgui/ObjectManipulator.cpp index 4a34e42fc..01db1b11a 100644 --- a/src/libgui/ObjectManipulator.cpp +++ b/src/libgui/ObjectManipulator.cpp @@ -52,6 +52,7 @@ #include "fwbuilder/AddressRange.h" #include "fwbuilder/AddressTable.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Cluster.h" #include "fwbuilder/CustomService.h" #include "fwbuilder/DNSName.h" @@ -524,6 +525,20 @@ void ObjectManipulator::contextMenuRequested(const QPoint &pos) AddObjectActions.append( addNewObjectMenuItem(popup_menu, physAddress::TYPENAME)); + /* + * Add menu item to let user add AttachedNetworks object + * to an interface, but only if this object does not exist yet. + * + * Actions added to AddObjectActions are + * enabled and disabled all together based on the decision + * made in getMenuState() (argument newMenuItem). But we + * should always allow the user to add AttachedNetworks + * object to an interface. + */ + FWObject *att = currentObj->getFirstByType(AttachedNetworks::TYPENAME); + if (att == NULL) + addNewObjectMenuItem(popup_menu, AttachedNetworks::TYPENAME); + // Check if we should add menu item that creates failover // group. if parent is a cluster, allow one vrrp type @@ -1224,8 +1239,12 @@ void ObjectManipulator::openLibForObject(FWObject *obj) m_objectManipulator->libs->setCurrentIndex( libs_model->getIdxForLib(obj->getLibrary()).row()); else + { + FWObject *parent = obj->getParent(); + FWObject *lib = parent->getLibrary(); m_objectManipulator->libs->setCurrentIndex( - libs_model->getIdxForLib(obj->getParent()->getLibrary()).row()); + libs_model->getIdxForLib(lib).row()); + } } void ObjectManipulator::showObjectInTree(ObjectTreeViewItem *otvi) diff --git a/src/libgui/ObjectManipulator.h b/src/libgui/ObjectManipulator.h index f02b14647..655ee3af0 100644 --- a/src/libgui/ObjectManipulator.h +++ b/src/libgui/ObjectManipulator.h @@ -172,6 +172,7 @@ class ObjectManipulator : public QWidget libfwbuilder::FWObject* newPhysicalAddress(QUndoCommand* macro); libfwbuilder::FWObject* newPolicyRuleSet (QUndoCommand* macro); libfwbuilder::FWObject* newNATRuleSet (QUndoCommand* macro); + libfwbuilder::FWObject* newAttachedNetworks(QUndoCommand* macro); public slots: diff --git a/src/libgui/ObjectManipulator_create_new.cpp b/src/libgui/ObjectManipulator_create_new.cpp index ab10836ab..1f07b0231 100644 --- a/src/libgui/ObjectManipulator_create_new.cpp +++ b/src/libgui/ObjectManipulator_create_new.cpp @@ -45,6 +45,7 @@ #include "fwbuilder/AddressRange.h" #include "fwbuilder/AddressTable.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Cluster.h" #include "fwbuilder/CustomService.h" #include "fwbuilder/DNSName.h" @@ -212,6 +213,7 @@ void ObjectManipulator::createNewObject() if (type_name == Policy::TYPENAME) new_obj = newPolicyRuleSet(macro); if (type_name == NAT::TYPENAME) new_obj = newNATRuleSet(macro); //if (type_name == Routing::TYPENAME) new_obj = newRoutingRuleSet(); + if (type_name == AttachedNetworks::TYPENAME) new_obj = newAttachedNetworks(macro); if (new_obj == NULL) new_obj = createObject(type_name, descr, NULL, macro); @@ -652,6 +654,30 @@ FWObject* ObjectManipulator::newFailoverClusterGroup(QUndoCommand* macro) return o; } +/* + * Creates new AttachedNetworks object; this method is called by + * context menu item associated with Interface object + */ +FWObject* ObjectManipulator::newAttachedNetworks(QUndoCommand* macro) +{ + FWObject *currentObj = getSelectedObject(); + if ( currentObj->isReadOnly() ) return NULL; + + if (Interface::isA(currentObj)) + { + FWObject *no = createObject(currentObj, AttachedNetworks::TYPENAME, + tr("Attached Networks"), NULL, macro); + string name = Interface::cast(currentObj)->getParentHost()->getName() + + ":" + currentObj->getName() + ":attached"; + no->setName(name); + return no; + } else + { + qWarning("newAttachedNetworks: invalid currentObj"); + return NULL; + } +} + FWObject* ObjectManipulator::newHost(QUndoCommand* macro) { FWObject *parent = diff --git a/src/libgui/ObjectManipulator_tree_ops.cpp b/src/libgui/ObjectManipulator_tree_ops.cpp index 6590d6124..d88f0392c 100644 --- a/src/libgui/ObjectManipulator_tree_ops.cpp +++ b/src/libgui/ObjectManipulator_tree_ops.cpp @@ -99,6 +99,7 @@ #include "fwbuilder/StateSyncClusterGroup.h" #include "fwbuilder/FailoverClusterGroup.h" #include "fwbuilder/Host.h" +#include "fwbuilder/AttachedNetworks.h" #include "fwbuilder/Network.h" #include "fwbuilder/NetworkIPv6.h" #include "fwbuilder/IPv4.h" @@ -306,6 +307,9 @@ void ObjectManipulator::insertSubtree(ObjectTreeViewItem *itm, FWObject *obj) for (FWObjectTypedChildIterator it = obj->findByType(FailoverClusterGroup::TYPENAME); it != it.end(); ++it) insertSubtree( nitm, *it ); + for (FWObjectTypedChildIterator it = obj->findByType(AttachedNetworks::TYPENAME); + it != it.end(); ++it) insertSubtree( nitm, *it ); + return; } diff --git a/src/libgui/ProjectPanel_file_ops.cpp b/src/libgui/ProjectPanel_file_ops.cpp index c2587b843..7f01d41eb 100644 --- a/src/libgui/ProjectPanel_file_ops.cpp +++ b/src/libgui/ProjectPanel_file_ops.cpp @@ -1062,7 +1062,7 @@ bool ProjectPanel::loadFromRCS(RCS *_rcs) } mw->showStatusBarMessage(tr("Merging with system objects...") ); - + MergeConflictRes mcr(mainW); objdb->merge(ndb, &mcr); diff --git a/src/libgui/attachednetworksdialog_q.ui b/src/libgui/attachednetworksdialog_q.ui new file mode 100644 index 000000000..644434942 --- /dev/null +++ b/src/libgui/attachednetworksdialog_q.ui @@ -0,0 +1,246 @@ + + + AttachedNetworksDialog_q + + + true + + + + 0 + 0 + 949 + 258 + + + + + 0 + 0 + + + + Network + + + + + + + 0 + 0 + + + + QFrame::Box + + + QFrame::Sunken + + + + + + + 0 + 0 + + + + + 350 + 0 + + + + + 350 + 16777215 + + + + QFrame::Box + + + QFrame::Sunken + + + + + + Name: + + + false + + + + + + + + 200 + 0 + + + + + 0 + 0 + + + + + + + + Qt::Vertical + + + QSizePolicy::Expanding + + + + 20 + 5 + + + + + + + + The list of addresses in this object is updated automatically and represents subnets attached to the parent interface. + + + true + + + + + + + Qt::Vertical + + + + 20 + 48 + + + + + + + + + + + QFrame::StyledPanel + + + QFrame::Raised + + + + + + QFrame::NoFrame + + + QFrame::Plain + + + + + + + + + + Comment: + + + false + + + + + + + + 0 + 0 + + + + + 200 + 0 + + + + + 16777215 + 180 + + + + true + + + + + + + + + + + TextEditWidget + QTextEdit +
TextEditWidget.h
+ + + + obj_name + comment + + + + + + + obj_name + editingFinished() + AttachedNetworksDialog_q + changed() + + + 20 + 20 + + + 20 + 20 + + + + + comment + textChanged() + AttachedNetworksDialog_q + changed() + + + 20 + 20 + + + 20 + 20 + + + + + diff --git a/src/libgui/libgui.pro b/src/libgui/libgui.pro index 2ae2e0091..6495c9a5c 100644 --- a/src/libgui/libgui.pro +++ b/src/libgui/libgui.pro @@ -78,6 +78,7 @@ HEADERS += ../../config.h \ IPv4Dialog.h \ IPv6Dialog.h \ PhysicalAddressDialog.h \ + AttachedNetworksDialog.h \ NetworkDialog.h \ NetworkDialogIPv6.h \ UserDialog.h \ @@ -287,6 +288,7 @@ SOURCES += ProjectPanel.cpp \ IPv4Dialog.cpp \ IPv6Dialog.cpp \ PhysicalAddressDialog.cpp \ + AttachedNetworksDialog.cpp \ NetworkDialog.cpp \ NetworkDialogIPv6.cpp \ UserDialog.cpp \ @@ -450,6 +452,7 @@ FORMS = FWBMainWindow_q.ui \ rulesetdialog_q.ui \ addressrangedialog_q.ui \ addresstabledialog_q.ui \ + attachednetworksdialog_q.ui \ networkdialog_q.ui \ networkdialogipv6_q.ui \ userdialog_q.ui \ diff --git a/src/pflib/PolicyCompiler_pf_writers.cpp b/src/pflib/PolicyCompiler_pf_writers.cpp index 3035b709a..2c0ef5c6a 100644 --- a/src/pflib/PolicyCompiler_pf_writers.cpp +++ b/src/pflib/PolicyCompiler_pf_writers.cpp @@ -4,9 +4,7 @@ Copyright (C) 2002 NetCitadel, LLC - Author: Vadim Kurland vadim@vk.crocodile.org - - $Id$ + Author: Vadim Kurland vadim@fwbuilder.org This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms @@ -45,6 +43,7 @@ #include "fwbuilder/DNSName.h" #include "fwbuilder/AddressTable.h" #include "fwbuilder/XMLTools.h" +#include "fwbuilder/AttachedNetworks.h" #include #include @@ -774,6 +773,12 @@ void PolicyCompiler_pf::PrintRule::_printAddr(Address *o,bool ) compiler->output << "<" << o->getName() << "> "; return; } + if (atrt->getSubstitutionTypeName()==AttachedNetworks::TYPENAME) + { + compiler->output << atrt->getSourceName() << ":network"; + return ; + } + assert(atrt==NULL); } diff --git a/src/pflib/Preprocessor_pf.cpp b/src/pflib/Preprocessor_pf.cpp index 75a5961b6..7548718c7 100644 --- a/src/pflib/Preprocessor_pf.cpp +++ b/src/pflib/Preprocessor_pf.cpp @@ -4,9 +4,7 @@ Copyright (C) 2006 NetCitadel, LLC - Author: Vadim Kurland vadim@vk.crocodile.org - - $Id$ + Author: Vadim Kurland vadim@fwbuilder.org This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms @@ -27,6 +25,8 @@ #include "Preprocessor_pf.h" #include "fwbuilder/AddressTable.h" +#include "fwbuilder/AttachedNetworks.h" + using namespace libfwbuilder; using namespace fwcompiler; @@ -35,6 +35,11 @@ using namespace std; void Preprocessor_pf::convertObject(FWObject *obj) { - Preprocessor::convertObject(obj); + // do not convert attachedNetworks object, compiler for PF always + // treats it as run-time object + if ( AttachedNetworks::isA(obj)) + AttachedNetworks::cast(obj)->setRunTime(true); + else + Preprocessor::convertObject(obj); } diff --git a/src/pflib/TableFactory.cpp b/src/pflib/TableFactory.cpp index a8824c95e..acdab65b0 100644 --- a/src/pflib/TableFactory.cpp +++ b/src/pflib/TableFactory.cpp @@ -4,9 +4,7 @@ Copyright (C) 2002 NetCitadel, LLC - Author: Vadim Kurland vadim@vk.crocodile.org - - $Id$ + Author: Vadim Kurland vadim@fwbuilder.org This program is free software which we release under the GNU General Public License. You may redistribute and/or modify this program under the terms @@ -35,6 +33,7 @@ #include "fwbuilder/Library.h" #include "fwbuilder/Rule.h" #include "fwbuilder/RuleElement.h" +#include "fwbuilder/AttachedNetworks.h" #include #include @@ -203,6 +202,10 @@ string TableFactory::PrintTables() { output << atrt->getSourceName() << " "; } + if (atrt->getSubstitutionTypeName()==AttachedNetworks::TYPENAME) + { + output << atrt->getSourceName() << ":network"; + } } else { if (Interface::cast(o)) diff --git a/src/res/configlets/linux24/shell_functions b/src/res/configlets/linux24/shell_functions index a55fe0006..62d0f9395 100644 --- a/src/res/configlets/linux24/shell_functions +++ b/src/res/configlets/linux24/shell_functions @@ -37,6 +37,19 @@ getaddr_internal() { eval "${name}_list=\"$L\"" } +getnet_internal() { + dev=$1 + name=$2 + af=$3 + L=$($IP route list proto kernel | grep $dev | grep -v default | sed 's! .*$!!') + test -z "$L" && { + eval "$name=''" + return + } + eval "${name}_list=\"$L\"" +} + + ## ## This function reads all ipv4 addresses of interface (arg 1) and ## assignes the list to the variable which name is given as arg 2. @@ -53,6 +66,24 @@ getaddr6() { getaddr_internal $1 $2 "-6" } +## +## This function reads all ipv4 addresses of interface (arg 1) and +## assignes list of addresses of attached networks with their netmasks +## to the variable which name is given as arg 2. +## +getnet() { + getnet_internal $1 $2 "-4" +} + +## +## This function reads all ipv6 addresses of interface (arg 1) and +## assignes list of addresses of attached networks with their netmasks +## to the variable which name is given as arg 2. +## +getnet6() { + getnet_internal $1 $2 "-6" +} + # function getinterfaces is used to process wildcard interfaces getinterfaces() { NAME=$1 diff --git a/src/res/resources.xml b/src/res/resources.xml index f26d8abfd..746e619e6 100644 --- a/src/res/resources.xml +++ b/src/res/resources.xml @@ -17,6 +17,10 @@ Host + + Attached Networks + + Network