onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-03-19 09:47:20 +01:00
Code Issues Releases Wiki Activity

see #1927 added check to prohibit nat rule that translates destination but has ODst "any"

Browse Source
This commit is contained in:
Vadim Kurland 2011-01-16 15:12:17 -08:00
parent f8904a9c3f
commit f74713b2fa
38 changed files with 186 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
doc/ChangeLog
View File

@ -1,3 +1,10 @@
2011-01-16 vadim <vadim@netcitadel.com>
* NATCompiler_asa8.cpp (processNext): See #1927. Added check for
NAT rules that request translation of destination address but have
ODst "any". This only applies to ASA 8.3; these rules are
prohibited.
2011-01-14 vadim <vadim@netcitadel.com>
* NATCompiler_asa8_writers.cpp (printSDNAT): fixes #1932 "Add

11
src/cisco_lib/NATCompiler_asa8.cpp
View File

@ -250,6 +250,17 @@ bool NATCompiler_asa8::VerifyRules::processNext()
if (rule->getRuleType()==NATRule::SNetnat) rule->setRuleType(NATRule::SNAT);
if (rule->getRuleType()==NATRule::DNetnat) rule->setRuleType(NATRule::DNAT);
if ((rule->getRuleType()==NATRule::DNAT ||
rule->getRuleType()==NATRule::SDNAT) &&
odst->isAny())
{
compiler->abort(
rule,
"Oiginal destination can not be \"any\" in rules that translate "
"destination");
return true;
}
tmp_queue.push_back(rule);
return true;

4
test/pix/cluster1-1_pix1.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:45 2011 PST by vadim
! Generated Sun Jan 16 15:04:40 2011 PST by vadim
!
! Compiled for pix 7.0
! Outbound ACLs: supported

4
test/pix/cluster1-1_pix2.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:45 2011 PST by vadim
! Generated Sun Jan 16 15:04:40 2011 PST by vadim
!
! Compiled for pix 7.0
! Outbound ACLs: supported

4
test/pix/cluster1_pix1.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:44 2011 PST by vadim
! Generated Sun Jan 16 15:04:39 2011 PST by vadim
!
! Compiled for pix 7.0
! Outbound ACLs: supported

4
test/pix/cluster1_pix2.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:45 2011 PST by vadim
! Generated Sun Jan 16 15:04:39 2011 PST by vadim
!
! Compiled for pix 7.0
! Outbound ACLs: supported

4
test/pix/firewall.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:20 2011 PST by vadim
! Generated Sun Jan 16 15:04:15 2011 PST by vadim
!
! Compiled for pix 6.2
! Outbound ACLs: not supported

4
test/pix/firewall1.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:21 2011 PST by vadim
! Generated Sun Jan 16 15:04:15 2011 PST by vadim
!
! Compiled for pix 6.1
! Outbound ACLs: not supported

4
test/pix/firewall10.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:22 2011 PST by vadim
! Generated Sun Jan 16 15:04:16 2011 PST by vadim
!
! Compiled for pix 6.3
! Outbound ACLs: not supported

4
test/pix/firewall11.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:23 2011 PST by vadim
! Generated Sun Jan 16 15:04:17 2011 PST by vadim
!
! Compiled for pix 6.2
! Outbound ACLs: not supported

4
test/pix/firewall12.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:23 2011 PST by vadim
! Generated Sun Jan 16 15:04:17 2011 PST by vadim
!
! Compiled for pix 6.3
! Outbound ACLs: not supported

4
test/pix/firewall13.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:24 2011 PST by vadim
! Generated Sun Jan 16 15:04:18 2011 PST by vadim
!
! Compiled for pix 6.3
! Outbound ACLs: not supported

4
test/pix/firewall14.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:25 2011 PST by vadim
! Generated Sun Jan 16 15:04:19 2011 PST by vadim
!
! Compiled for pix 6.3
! Outbound ACLs: not supported

4
test/pix/firewall2.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:25 2011 PST by vadim
! Generated Sun Jan 16 15:04:19 2011 PST by vadim
!
! Compiled for pix 6.3
! Outbound ACLs: not supported

4
test/pix/firewall20.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:26 2011 PST by vadim
! Generated Sun Jan 16 15:04:20 2011 PST by vadim
!
! Compiled for pix 6.3
! Outbound ACLs: not supported

4
test/pix/firewall21-1.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:27 2011 PST by vadim
! Generated Sun Jan 16 15:04:22 2011 PST by vadim
!
! Compiled for pix 6.3
! Outbound ACLs: not supported

4
test/pix/firewall21.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:27 2011 PST by vadim
! Generated Sun Jan 16 15:04:21 2011 PST by vadim
!
! Compiled for pix 7.0
! Outbound ACLs: supported

4
test/pix/firewall22.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:28 2011 PST by vadim
! Generated Sun Jan 16 15:04:22 2011 PST by vadim
!
! Compiled for pix 7.0
! Outbound ACLs: supported

4
test/pix/firewall3.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:29 2011 PST by vadim
! Generated Sun Jan 16 15:04:23 2011 PST by vadim
!
! Compiled for pix 6.2
! Outbound ACLs: not supported

4
test/pix/firewall33.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:29 2011 PST by vadim
! Generated Sun Jan 16 15:04:24 2011 PST by vadim
!
! Compiled for pix 6.3
! Outbound ACLs: not supported

4
test/pix/firewall34.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:30 2011 PST by vadim
! Generated Sun Jan 16 15:04:25 2011 PST by vadim
!
! Compiled for pix 6.3
! Outbound ACLs: not supported

4
test/pix/firewall4.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:31 2011 PST by vadim
! Generated Sun Jan 16 15:04:26 2011 PST by vadim
!
! Compiled for pix 6.2
! Outbound ACLs: not supported

4
test/pix/firewall50.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:32 2011 PST by vadim
! Generated Sun Jan 16 15:04:27 2011 PST by vadim
!
! Compiled for pix 7.0
! Outbound ACLs: supported

4
test/pix/firewall6.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:33 2011 PST by vadim
! Generated Sun Jan 16 15:04:27 2011 PST by vadim
!
! Compiled for pix 6.2
! Outbound ACLs: not supported

4
test/pix/firewall8.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:34 2011 PST by vadim
! Generated Sun Jan 16 15:04:28 2011 PST by vadim
!
! Compiled for pix 6.2
! Outbound ACLs: not supported

4
test/pix/firewall80.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:34 2011 PST by vadim
! Generated Sun Jan 16 15:04:29 2011 PST by vadim
!
! Compiled for pix 8.2
! Outbound ACLs: supported

4
test/pix/firewall81.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:35 2011 PST by vadim
! Generated Sun Jan 16 15:04:30 2011 PST by vadim
!
! Compiled for pix 8.3
! Outbound ACLs: supported

4
test/pix/firewall82.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:36 2011 PST by vadim
! Generated Sun Jan 16 15:04:30 2011 PST by vadim
!
! Compiled for pix 8.3
! Outbound ACLs: supported

4
test/pix/firewall83.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:36 2011 PST by vadim
! Generated Sun Jan 16 15:04:31 2011 PST by vadim
!
! Compiled for pix 8.3
! Outbound ACLs: supported

4
test/pix/firewall9.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:37 2011 PST by vadim
! Generated Sun Jan 16 15:04:32 2011 PST by vadim
!
! Compiled for pix 6.3
! Outbound ACLs: not supported

4
test/pix/firewall90.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:38 2011 PST by vadim
! Generated Sun Jan 16 15:04:33 2011 PST by vadim
!
! Compiled for pix 8.3
! Outbound ACLs: supported

8
test/pix/firewall91.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:38 2011 PST by vadim
! Generated Sun Jan 16 15:04:33 2011 PST by vadim
!
! Compiled for pix 8.3
! Outbound ACLs: supported
@ -18,6 +18,10 @@
! N firewall91:NAT:8: error: Can not translate multiple services into one service in one rule.
! N firewall91:NAT:9: error: Translated service should be 'Original' or should contain single object.
! N firewall91:NAT:10: error: Oiginal destination can not be "any" in rules that translate destination
! N firewall91:NAT:11: error: Oiginal destination can not be "any" in rules that translate destination
! N firewall91:NAT:12: error: Oiginal destination can not be "any" in rules that translate destination
! N firewall91:NAT:13: error: Oiginal destination can not be "any" in rules that translate destination
!
! Prolog script:

4
test/pix/firewall92.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:39 2011 PST by vadim
! Generated Sun Jan 16 15:04:34 2011 PST by vadim
!
! Compiled for pix 8.3
! Outbound ACLs: supported

4
test/pix/fwsm1.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:40 2011 PST by vadim
! Generated Sun Jan 16 15:04:35 2011 PST by vadim
!
! Compiled for fwsm 2.3
! Outbound ACLs: supported

4
test/pix/fwsm2.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:41 2011 PST by vadim
! Generated Sun Jan 16 15:04:36 2011 PST by vadim
!
! Compiled for fwsm 4.x
! Outbound ACLs: supported

95
test/pix/objects-for-regression-tests.fwb
View File

@ -19084,7 +19084,7 @@ no sysopt nodnsalias outbound
<Option name="xlate_ss">0</Option>
</FirewallOptions>
</Firewall>
<Firewall id="id20098X3981" host_OS="pix_os" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1294767697" platform="pix" version="8.3" name="firewall91" comment="testing new style ASA 8.3 nat commands&#10;DNAT rules&#10;" ro="False">
<Firewall id="id20098X3981" host_OS="pix_os" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1295219041" platform="pix" version="8.3" name="firewall91" comment="testing new style ASA 8.3 nat commands&#10;DNAT rules&#10;" ro="False">
<NAT id="id20132X3981" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<NATRule id="id20285X3981" disabled="False" group="" position="0" action="Translate" comment="">
<OSrc neg="False">
@ -19298,6 +19298,99 @@ no sysopt nodnsalias outbound
</TSrv>
<NATRuleOptions/>
</NATRule>
<NATRule id="id21329X8588" disabled="False" group="" position="10" action="Translate" comment="for #1927">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="sysid0"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="id23261X67574"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<NATRuleOptions>
<Option name="color">#C86E6E</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id21378X8588" disabled="False" group="" position="11" action="Translate" comment="for #1927">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="tcp-HTTP"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="sysid0"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="id23261X67574"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<NATRuleOptions>
<Option name="color">#C86E6E</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id97464X8588" disabled="False" group="" position="12" action="Translate" comment="for #1927">
<OSrc neg="False">
<ObjectRef ref="id178241X29963"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id20111X3981"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="id23261X67574"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<NATRuleOptions>
<Option name="color">#C86E6E</Option>
</NATRuleOptions>
</NATRule>
<NATRule id="id97410X8588" disabled="False" group="" position="13" action="Translate" comment="for #1927">
<OSrc neg="False">
<ObjectRef ref="id178241X29963"/>
<ObjectRef ref="id178250X29963"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="tcp-HTTP"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id20115X3981"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="id23261X67574"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<NATRuleOptions>
<Option name="color">#C86E6E</Option>
</NATRuleOptions>
</NATRule>
<RuleSetOptions/>
</NAT>
<Policy id="id20118X3981" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">

4
test/pix/pix515.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:42 2011 PST by vadim
! Generated Sun Jan 16 15:04:37 2011 PST by vadim
!
! Compiled for pix 7.0
! Outbound ACLs: supported

4
test/pix/real.fw.orig
View File

@ -1,9 +1,9 @@
!
! This is automatically generated file. DO NOT MODIFY !
!
! Firewall Builder fwb_pix v4.2.0.3432
! Firewall Builder fwb_pix v4.2.0.3434
!
! Generated Fri Jan 14 18:48:43 2011 PST by vadim
! Generated Sun Jan 16 15:04:37 2011 PST by vadim
!
! Compiled for pix 6.3
! Outbound ACLs: not supported