onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-03-18 17:27:20 +01:00
Code Issues Releases Wiki Activity

see #2551 "PF Import - source routing rules are not imported with rule

Browse Source 
options set". Importer should import "route-to" rule parameters.
This commit is contained in:
Vadim Kurland 2011-07-06 14:36:47 -07:00
parent aea0e07d28
commit fd63078a5e
16 changed files with 1565 additions and 958 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/ChangeLog
View File

@ -1,5 +1,9 @@
2011-07-06 Vadim Kurland <vadim@netcitadel.com>
* PFImporter.cpp (pushPolicyRule): see #2551 "PF Import - source
routing rules are not imported with rule options set". Importer
should import "route-to" rule parameters.
* PFImporter.cpp (newAddressTableObject): see #2546 "PF import -
negation inside of inline tables is ignored". We can not import
PF table definition that has some addresses negated.

44
src/import/PFImporter.cpp
View File

@ -828,6 +828,50 @@ void PFImporter::pushPolicyRule()
*/
if (! queue.empty()) ropt->setStr("pf_classify_str", queue);
/*
* route-to options
*
*/
if (route_type != UNKNOWN && route_group.size() != 0)
{
switch (route_type)
{
case ROUTE_TO:
ropt->setStr("pf_route_option", "route_through"); break;
case REPLY_TO:
ropt->setStr("pf_route_option", "route_reply_through"); break;
case DUP_TO:
ropt->setStr("pf_route_option", "route_copy_through"); break;
default: ;
}
QStringList route_opt_addr;
list<RouteSpec>::iterator it;
for (it=route_group.begin(); it!=route_group.end(); ++it)
{
RouteSpec &rs = *it;
Interface *intf = getInterfaceByName(rs.iface);
if (intf == NULL)
{
// this interface was never used in "on <intf>" clause before
newInterface(rs.iface);
}
ropt->setStr("pf_route_opt_if", rs.iface);
if (rs.netmask.empty())
route_opt_addr << rs.address.c_str();
else
route_opt_addr << QString("%1/%2")
.arg(rs.address.c_str()).arg(rs.netmask.c_str());
}
ropt->setStr("pf_route_opt_addr", route_opt_addr.join(",").toStdString());
}
/*
* Protocols are in proto_list
* Source addresses are in src_group

433
src/parsers/PFCfgLexer.cpp
View File

@ -1,4 +1,4 @@
/* $ANTLR 2.7.7 (20090306): "pf.g" -> "PFCfgLexer.cpp"$ */
/* $ANTLR 2.7.7 (20100319): "pf.g" -> "PFCfgLexer.cpp"$ */
#line 43 "pf.g"
// gets inserted before the antlr generated includes in the cpp
@ -44,14 +44,14 @@ PFCfgLexer::PFCfgLexer(const ANTLR_USE_NAMESPACE(antlr)LexerSharedInputState& st
void PFCfgLexer::initLiterals()
{
literals["badhead"] = 199;
literals["notifications"] = 233;
literals["badhead"] = 200;
literals["notifications"] = 234;
literals["state-policy"] = 26;
literals["floating"] = 28;
literals["no"] = 84;
literals["counters"] = 72;
literals["esp"] = 126;
literals["routersol"] = 158;
literals["routersol"] = 159;
literals["frags"] = 60;
literals["reply-to"] = 139;
literals["icmp.first"] = 49;
@ -59,77 +59,77 @@ void PFCfgLexer::initLiterals()
literals["gre"] = 125;
literals["pass"] = 86;
literals["scrub"] = 65;
literals["warnings"] = 234;
literals["warnings"] = 235;
literals["include"] = 6;
literals["skip"] = 32;
literals["timeout"] = 13;
literals["eigrp"] = 128;
literals["icmp-type"] = 149;
literals["transit"] = 197;
literals["icmp-type"] = 150;
literals["transit"] = 198;
literals["inet"] = 115;
literals["no-df"] = 144;
literals["no-df"] = 145;
literals["network"] = 77;
literals["photuris"] = 174;
literals["photuris"] = 175;
literals["igmp"] = 120;
literals["unreach"] = 152;
literals["range"] = 226;
literals["unreach"] = 153;
literals["range"] = 227;
literals["rsvp"] = 124;
literals["debugging"] = 229;
literals["host-tos"] = 187;
literals["paramprob"] = 160;
literals["debugging"] = 230;
literals["host-tos"] = 188;
literals["paramprob"] = 161;
literals["user"] = 113;
literals["interface"] = 215;
literals["interface"] = 216;
literals["adaptive.end"] = 58;
literals["limit"] = 21;
literals["state-defaults"] = 29;
literals["hex-key"] = 98;
literals["net-unk"] = 181;
literals["net-unk"] = 182;
literals["antispoof"] = 9;
literals["udp.single"] = 47;
literals["inforeq"] = 163;
literals["ipv6-here"] = 171;
literals["redir"] = 154;
literals["inforeq"] = 164;
literals["ipv6-here"] = 172;
literals["redir"] = 155;
literals["static-port"] = 88;
literals["common-adv"] = 196;
literals["common-adv"] = 197;
literals["loginterface"] = 22;
literals["ip"] = 118;
literals["mobregreq"] = 172;
literals["mobregreq"] = 173;
literals["conservative"] = 17;
literals["ospf"] = 129;
literals["proto-unr"] = 177;
literals["proto-unr"] = 178;
literals["peer"] = 79;
literals["inforep"] = 164;
literals["errors"] = 231;
literals["inforep"] = 165;
literals["errors"] = 232;
literals["tables-entries"] = 64;
literals["any"] = 136;
literals["mobregrep"] = 173;
literals["label"] = 212;
literals["pptp"] = 222;
literals["synproxy"] = 210;
literals["mobregrep"] = 174;
literals["label"] = 213;
literals["pptp"] = 223;
literals["synproxy"] = 211;
literals["debug"] = 37;
literals["alerts"] = 227;
literals["alerts"] = 228;
literals["all"] = 112;
literals["state"] = 211;
literals["tag"] = 207;
literals["state"] = 212;
literals["tag"] = 208;
literals["in"] = 108;
literals["tables"] = 63;
literals["file"] = 73;
literals["nos"] = 219;
literals["nos"] = 220;
literals["src-nodes"] = 62;
literals["ipv6-where"] = 170;
literals["ipv6-where"] = 171;
literals["require-order"] = 30;
literals["udp"] = 122;
literals["states"] = 61;
literals["sticky-address"] = 101;
literals["return-icmp"] = 106;
literals["redir-tos-net"] = 193;
literals["pim"] = 221;
literals["emergencies"] = 230;
literals["squench"] = 153;
literals["disable"] = 235;
literals["flags"] = 148;
literals["redir-tos-net"] = 194;
literals["pim"] = 222;
literals["emergencies"] = 231;
literals["squench"] = 154;
literals["disable"] = 236;
literals["flags"] = 149;
literals["tcp"] = 121;
literals["net-tos"] = 186;
literals["net-tos"] = 187;
literals["reassemble"] = 38;
literals["adaptive.start"] = 57;
literals["frag"] = 54;
@ -137,58 +137,59 @@ void PFCfgLexer::initLiterals()
literals["icmp"] = 119;
literals["to"] = 114;
literals["return-rst"] = 104;
literals["normal-adv"] = 195;
literals["normal-adv"] = 196;
literals["optimization"] = 15;
literals["log"] = 110;
literals["fragment"] = 141;
literals["snp"] = 224;
literals["fragment"] = 142;
literals["snp"] = 225;
literals["broadcast"] = 78;
literals["icmp6-type"] = 205;
literals["icmp6-type"] = 206;
literals["normal"] = 19;
literals["code"] = 150;
literals["code"] = 151;
literals["if-bound"] = 27;
literals["src.track"] = 56;
literals["drop-ovl"] = 143;
literals["routeradv"] = 157;
literals["drop-ovl"] = 144;
literals["routeradv"] = 158;
literals["other.single"] = 52;
literals["dup-to"] = 140;
literals["bitmask"] = 95;
literals["maskreq"] = 165;
literals["maskreq"] = 166;
literals["ipip"] = 130;
literals["tcp.closed"] = 45;
literals["block"] = 103;
literals["high-latency"] = 18;
literals["udp.first"] = 46;
literals["badlen"] = 201;
literals["badlen"] = 202;
literals["tcp.first"] = 40;
literals["host-unr"] = 176;
literals["host-unr"] = 177;
literals["ah"] = 127;
literals["random-id"] = 147;
literals["modulate"] = 209;
literals["random-id"] = 148;
literals["modulate"] = 210;
literals["interval"] = 55;
literals["maskrep"] = 166;
literals["maskrep"] = 167;
literals["ruleset-optimization"] = 14;
literals["trace"] = 167;
literals["rip"] = 223;
literals["trace"] = 168;
literals["rip"] = 224;
literals["urpf-failed"] = 135;
literals["set"] = 12;
literals["source-hash"] = 97;
literals["critical"] = 228;
literals["quit"] = 214;
literals["critical"] = 229;
literals["quit"] = 215;
literals["icmp.error"] = 50;
literals["const"] = 71;
literals["altq"] = 10;
literals["tcp.closing"] = 43;
literals["port-unr"] = 178;
literals["port-unr"] = 179;
literals["table"] = 67;
literals["redir-tos-host"] = 194;
literals["redir-tos-host"] = 195;
literals["fingerprints"] = 31;
literals["return"] = 25;
literals["optmiss"] = 200;
literals["optmiss"] = 201;
literals["match"] = 66;
literals["keep"] = 208;
literals["net-prohib"] = 184;
literals["keep"] = 209;
literals["net-prohib"] = 185;
literals["inet6"] = 116;
literals["group"] = 140;
literals["group"] = 141;
literals["from"] = 134;
literals["tcp.finwait"] = 44;
literals["hostid"] = 39;
@ -196,64 +197,64 @@ void PFCfgLexer::initLiterals()
literals["vrrp"] = 131;
literals["drop"] = 24;
literals["l2tp"] = 132;
literals["max-mss"] = 146;
literals["isolate"] = 183;
literals["timereq"] = 161;
literals["max-mss"] = 147;
literals["isolate"] = 184;
literals["timereq"] = 162;
literals["aggressive"] = 16;
literals["icmp6"] = 216;
literals["echoreq"] = 156;
literals["icmp6"] = 217;
literals["echoreq"] = 157;
literals["tcp.established"] = 42;
literals["decrypt-fail"] = 204;
literals["mobredir"] = 169;
literals["decrypt-fail"] = 205;
literals["mobredir"] = 170;
literals["other.first"] = 51;
literals["ipsec"] = 218;
literals["ipsec"] = 219;
literals["no-route"] = 137;
literals["random"] = 96;
literals["binat"] = 102;
literals["srcfail"] = 180;
literals["srcfail"] = 181;
literals["self"] = 80;
literals["timerep"] = 162;
literals["crop"] = 142;
literals["host-preced"] = 189;
literals["host"] = 225;
literals["echorep"] = 151;
literals["timerep"] = 163;
literals["crop"] = 143;
literals["host-preced"] = 190;
literals["host"] = 226;
literals["echorep"] = 152;
literals["other.multiple"] = 53;
literals["althost"] = 155;
literals["althost"] = 156;
literals["udp.multiple"] = 48;
literals["cutoff-preced"] = 190;
literals["redir-host"] = 192;
literals["cutoff-preced"] = 191;
literals["redir-host"] = 193;
literals["rdr"] = 89;
literals["tagged"] = 206;
literals["tagged"] = 207;
literals["on"] = 33;
literals["round-robin"] = 100;
literals["pcp"] = 220;
literals["pcp"] = 221;
literals["block-policy"] = 23;
literals["persist"] = 70;
literals["unknown-ind"] = 202;
literals["redir-net"] = 191;
literals["filter-prohib"] = 188;
literals["unknown-ind"] = 203;
literals["redir-net"] = 192;
literals["filter-prohib"] = 189;
literals["nat"] = 85;
literals["satellite"] = 20;
literals["informational"] = 232;
literals["needfrag"] = 179;
literals["informational"] = 233;
literals["needfrag"] = 180;
literals["tcp.opening"] = 41;
literals["igrp"] = 217;
literals["igrp"] = 218;
literals["quick"] = 111;
literals["timex"] = 159;
literals["host-unk"] = 182;
literals["timex"] = 160;
literals["host-unk"] = 183;
literals["route-to"] = 138;
literals["dataconv"] = 168;
literals["dataconv"] = 169;
literals["rdp"] = 123;
literals["net-unr"] = 175;
literals["net-unr"] = 176;
literals["queue"] = 11;
literals["isis"] = 133;
literals["reassemb"] = 198;
literals["inactive"] = 236;
literals["reassemb"] = 199;
literals["inactive"] = 237;
literals["out"] = 109;
literals["min-ttl"] = 145;
literals["auth-fail"] = 203;
literals["exit"] = 213;
literals["host-prohib"] = 185;
literals["min-ttl"] = 146;
literals["auth-fail"] = 204;
literals["exit"] = 214;
literals["host-prohib"] = 186;
}
ANTLR_USE_NAMESPACE(antlr)RefToken PFCfgLexer::nextToken()
@ -561,11 +562,11 @@ void PFCfgLexer::mLINE_COMMENT(bool _createToken) {
}
}
else {
goto _loop275;
goto _loop277;
}
}
_loop275:;
_loop277:;
} // ( ... )*
mNEWLINE(false);
if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@ -597,9 +598,9 @@ void PFCfgLexer::mNEWLINE(bool _createToken) {
}
if ( inputState->guessing==0 ) {
#line 1982 "pf.g"
#line 1990 "pf.g"
newline();
#line 603 "PFCfgLexer.cpp"
#line 604 "PFCfgLexer.cpp"
}
if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
_token = makeToken(_ttype);
@ -678,9 +679,9 @@ void PFCfgLexer::mWhitespace(bool _createToken) {
}
}
if ( inputState->guessing==0 ) {
#line 1977 "pf.g"
#line 1985 "pf.g"
_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
#line 684 "PFCfgLexer.cpp"
#line 685 "PFCfgLexer.cpp"
}
if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
_token = makeToken(_ttype);
@ -905,10 +906,10 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
_ttype = NUMBER_ADDRESS_OR_WORD;
ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
bool synPredMatched328 = false;
bool synPredMatched330 = false;
if ((((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_3.member(LA(2))) && (_tokenSet_3.member(LA(3))))) {
int _m328 = mark();
synPredMatched328 = true;
int _m330 = mark();
synPredMatched330 = true;
inputState->guessing++;
try {
{
@ -919,12 +920,12 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched328 = false;
synPredMatched330 = false;
}
rewind(_m328);
rewind(_m330);
inputState->guessing--;
}
if ( synPredMatched328 ) {
if ( synPredMatched330 ) {
{
mNUM_3DIGIT(false);
match('.' /* charlit */ );
@ -935,35 +936,20 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
mNUM_3DIGIT(false);
}
if ( inputState->guessing==0 ) {
#line 2037 "pf.g"
#line 2045 "pf.g"
_ttype = IPV4;
#line 941 "PFCfgLexer.cpp"
#line 942 "PFCfgLexer.cpp"
}
}
else {
bool synPredMatched335 = false;
bool synPredMatched337 = false;
if ((((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_3.member(LA(2))) && (_tokenSet_3.member(LA(3))))) {
int _m335 = mark();
synPredMatched335 = true;
int _m337 = mark();
synPredMatched337 = true;
inputState->guessing++;
try {
{
{ // ( ... )+
int _cnt332=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt332>=1 ) { goto _loop332; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt332++;
}
_loop332:;
} // ( ... )+
match('.' /* charlit */ );
{ // ( ... )+
int _cnt334=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
@ -977,32 +963,32 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
_loop334:;
} // ( ... )+
match('.' /* charlit */ );
{ // ( ... )+
int _cnt336=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt336>=1 ) { goto _loop336; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt336++;
}
_loop336:;
} // ( ... )+
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched335 = false;
synPredMatched337 = false;
}
rewind(_m335);
rewind(_m337);
inputState->guessing--;
}
if ( synPredMatched335 ) {
if ( synPredMatched337 ) {
{
{ // ( ... )+
int _cnt338=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt338>=1 ) { goto _loop338; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt338++;
}
_loop338:;
} // ( ... )+
match('.' /* charlit */ );
{ // ( ... )+
int _cnt340=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
@ -1016,63 +1002,78 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
_loop340:;
} // ( ... )+
match('.' /* charlit */ );
{ // ( ... )+
int _cnt342=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt342>=1 ) { goto _loop342; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt342++;
}
_loop342:;
} // ( ... )+
}
if ( inputState->guessing==0 ) {
#line 2040 "pf.g"
#line 2048 "pf.g"
_ttype = NUMBER;
#line 1024 "PFCfgLexer.cpp"
#line 1025 "PFCfgLexer.cpp"
}
}
else {
bool synPredMatched303 = false;
bool synPredMatched305 = false;
if (((_tokenSet_2.member(LA(1))) && (_tokenSet_4.member(LA(2))) && (true))) {
int _m303 = mark();
synPredMatched303 = true;
int _m305 = mark();
synPredMatched305 = true;
inputState->guessing++;
try {
{
{ // ( ... )+
int _cnt302=0;
int _cnt304=0;
for (;;) {
if ((_tokenSet_2.member(LA(1)))) {
mHEX_DIGIT(false);
}
else {
if ( _cnt302>=1 ) { goto _loop302; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt304>=1 ) { goto _loop304; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt302++;
_cnt304++;
}
_loop302:;
_loop304:;
} // ( ... )+
match(':' /* charlit */ );
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched303 = false;
synPredMatched305 = false;
}
rewind(_m303);
rewind(_m305);
inputState->guessing--;
}
if ( synPredMatched303 ) {
if ( synPredMatched305 ) {
{
{
{ // ( ... )+
int _cnt307=0;
int _cnt309=0;
for (;;) {
if ((_tokenSet_2.member(LA(1)))) {
mHEX_DIGIT(false);
}
else {
if ( _cnt307>=1 ) { goto _loop307; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt309>=1 ) { goto _loop309; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt307++;
_cnt309++;
}
_loop307:;
_loop309:;
} // ( ... )+
{ // ( ... )+
int _cnt311=0;
int _cnt313=0;
for (;;) {
if ((LA(1) == 0x3a /* ':' */ )) {
match(':' /* charlit */ );
@ -1082,34 +1083,34 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
mHEX_DIGIT(false);
}
else {
goto _loop310;
goto _loop312;
}
}
_loop310:;
_loop312:;
} // ( ... )*
}
else {
if ( _cnt311>=1 ) { goto _loop311; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt313>=1 ) { goto _loop313; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt311++;
_cnt313++;
}
_loop311:;
_loop313:;
} // ( ... )+
}
if ( inputState->guessing==0 ) {
#line 2022 "pf.g"
#line 2030 "pf.g"
_ttype = IPV6;
#line 1105 "PFCfgLexer.cpp"
#line 1106 "PFCfgLexer.cpp"
}
}
}
else {
bool synPredMatched313 = false;
bool synPredMatched315 = false;
if (((LA(1) == 0x3a /* ':' */ ))) {
int _m313 = mark();
synPredMatched313 = true;
int _m315 = mark();
synPredMatched315 = true;
inputState->guessing++;
try {
{
@ -1117,93 +1118,93 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched313 = false;
synPredMatched315 = false;
}
rewind(_m313);
rewind(_m315);
inputState->guessing--;
}
if ( synPredMatched313 ) {
if ( synPredMatched315 ) {
{
bool synPredMatched318 = false;
bool synPredMatched320 = false;
if (((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (_tokenSet_2.member(LA(3))))) {
int _m318 = mark();
synPredMatched318 = true;
int _m320 = mark();
synPredMatched320 = true;
inputState->guessing++;
try {
{
match(':' /* charlit */ );
match(':' /* charlit */ );
{ // ( ... )+
int _cnt317=0;
int _cnt319=0;
for (;;) {
if ((_tokenSet_2.member(LA(1)))) {
mHEX_DIGIT(false);
}
else {
if ( _cnt317>=1 ) { goto _loop317; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt319>=1 ) { goto _loop319; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt317++;
_cnt319++;
}
_loop317:;
_loop319:;
} // ( ... )+
}
}
catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
synPredMatched318 = false;
synPredMatched320 = false;
}
rewind(_m318);
rewind(_m320);
inputState->guessing--;
}
if ( synPredMatched318 ) {
if ( synPredMatched320 ) {
{
match(':' /* charlit */ );
match(':' /* charlit */ );
{ // ( ... )+
int _cnt321=0;
int _cnt323=0;
for (;;) {
if ((_tokenSet_2.member(LA(1)))) {
mHEX_DIGIT(false);
}
else {
if ( _cnt321>=1 ) { goto _loop321; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt323>=1 ) { goto _loop323; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt321++;
_cnt323++;
}
_loop321:;
_loop323:;
} // ( ... )+
{ // ( ... )*
for (;;) {
if ((LA(1) == 0x3a /* ':' */ )) {
match(':' /* charlit */ );
{ // ( ... )+
int _cnt324=0;
int _cnt326=0;
for (;;) {
if ((_tokenSet_2.member(LA(1)))) {
mHEX_DIGIT(false);
}
else {
if ( _cnt324>=1 ) { goto _loop324; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt326>=1 ) { goto _loop326; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt324++;
_cnt326++;
}
_loop324:;
_loop326:;
} // ( ... )+
}
else {
goto _loop325;
goto _loop327;
}
}
_loop325:;
_loop327:;
} // ( ... )*
}
if ( inputState->guessing==0 ) {
#line 2028 "pf.g"
#line 2036 "pf.g"
_ttype = IPV6;
#line 1207 "PFCfgLexer.cpp"
#line 1208 "PFCfgLexer.cpp"
}
}
else if ((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (true)) {
@ -1212,17 +1213,17 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
match(':' /* charlit */ );
}
if ( inputState->guessing==0 ) {
#line 2030 "pf.g"
#line 2038 "pf.g"
_ttype = IPV6;
#line 1218 "PFCfgLexer.cpp"
#line 1219 "PFCfgLexer.cpp"
}
}
else if ((LA(1) == 0x3a /* ':' */ ) && (true)) {
match(':' /* charlit */ );
if ( inputState->guessing==0 ) {
#line 2032 "pf.g"
#line 2040 "pf.g"
_ttype = COLON;
#line 1226 "PFCfgLexer.cpp"
#line 1227 "PFCfgLexer.cpp"
}
}
else {
@ -1233,23 +1234,23 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
else if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
{ // ( ... )+
int _cnt342=0;
int _cnt344=0;
for (;;) {
if (((LA(1) >= 0x30 /* '0' */ && LA(1) <= 0x39 /* '9' */ ))) {
mDIGIT(false);
}
else {
if ( _cnt342>=1 ) { goto _loop342; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
if ( _cnt344>=1 ) { goto _loop344; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
}
_cnt342++;
_cnt344++;
}
_loop342:;
_loop344:;
} // ( ... )+
if ( inputState->guessing==0 ) {
#line 2042 "pf.g"
#line 2050 "pf.g"
_ttype = INT_CONST;
#line 1253 "PFCfgLexer.cpp"
#line 1254 "PFCfgLexer.cpp"
}
}
else if ((_tokenSet_5.member(LA(1))) && (true) && (true)) {
@ -1465,16 +1466,16 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
}
default:
{
goto _loop345;
goto _loop347;
}
}
}
_loop345:;
_loop347:;
} // ( ... )*
if ( inputState->guessing==0 ) {
#line 2053 "pf.g"
#line 2061 "pf.g"
_ttype = WORD;
#line 1478 "PFCfgLexer.cpp"
#line 1479 "PFCfgLexer.cpp"
}
}
else {
@ -1502,11 +1503,11 @@ void PFCfgLexer::mSTRING(bool _createToken) {
matchNot('\"' /* charlit */ );
}
else {
goto _loop348;
goto _loop350;
}
}
_loop348:;
_loop350:;
} // ( ... )*
match('\"' /* charlit */ );
if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {

2
src/parsers/PFCfgLexer.hpp
View File

@ -9,7 +9,7 @@
#line 11 "PFCfgLexer.hpp"
#include <antlr/config.hpp>
/* $ANTLR 2.7.7 (20090306): "pf.g" -> "PFCfgLexer.hpp"$ */
/* $ANTLR 2.7.7 (20100319): "pf.g" -> "PFCfgLexer.hpp"$ */
#include <antlr/CommonToken.hpp>
#include <antlr/InputBuffer.hpp>
#include <antlr/BitSet.hpp>

922
src/parsers/PFCfgParser.cpp
View File

File diff suppressed because it is too large Load Diff

7
src/parsers/PFCfgParser.hpp
View File

@ -9,7 +9,7 @@
#line 11 "PFCfgParser.hpp"
#include <antlr/config.hpp>
/* $ANTLR 2.7.7 (20090306): "pf.g" -> "PFCfgParser.hpp"$ */
/* $ANTLR 2.7.7 (20100319): "pf.g" -> "PFCfgParser.hpp"$ */
#include <antlr/TokenStream.hpp>
#include <antlr/TokenBuffer.hpp>
#include "PFCfgParserTokenTypes.hpp"
@ -165,6 +165,7 @@ public:
public: void host_list();
public: void route_to();
public: void reply_to();
public: void dup_to();
public: void routehost();
public: void routehost_list();
public: void filteropt();
@ -200,10 +201,10 @@ protected:
private:
static const char* tokenNames[];
#ifndef NO_STATIC_CONSTS
static const int NUM_TOKENS = 261;
static const int NUM_TOKENS = 262;
#else
enum {
NUM_TOKENS = 261
NUM_TOKENS = 262
};
#endif

245
src/parsers/PFCfgParserTokenTypes.hpp
View File

@ -1,7 +1,7 @@
#ifndef INC_PFCfgParserTokenTypes_hpp_
#define INC_PFCfgParserTokenTypes_hpp_
/* $ANTLR 2.7.7 (20090306): "pf.g" -> "PFCfgParserTokenTypes.hpp"$ */
/* $ANTLR 2.7.7 (20100319): "pf.g" -> "PFCfgParserTokenTypes.hpp"$ */
#ifndef CUSTOM_API
# define CUSTOM_API
@ -148,127 +148,128 @@ struct CUSTOM_API PFCfgParserTokenTypes {
NO_ROUTE = 137,
ROUTE_TO = 138,
REPLY_TO = 139,
GROUP = 140,
LITERAL_fragment = 141,
LITERAL_crop = 142,
// "drop-ovl" = 143
// "no-df" = 144
// "min-ttl" = 145
// "max-mss" = 146
// "random-id" = 147
FLAGS = 148,
ICMP_TYPE = 149,
ICMP_CODE = 150,
LITERAL_echorep = 151,
LITERAL_unreach = 152,
LITERAL_squench = 153,
LITERAL_redir = 154,
LITERAL_althost = 155,
LITERAL_echoreq = 156,
LITERAL_routeradv = 157,
LITERAL_routersol = 158,
LITERAL_timex = 159,
LITERAL_paramprob = 160,
LITERAL_timereq = 161,
LITERAL_timerep = 162,
LITERAL_inforeq = 163,
LITERAL_inforep = 164,
LITERAL_maskreq = 165,
LITERAL_maskrep = 166,
LITERAL_trace = 167,
LITERAL_dataconv = 168,
LITERAL_mobredir = 169,
// "ipv6-where" = 170
// "ipv6-here" = 171
LITERAL_mobregreq = 172,
LITERAL_mobregrep = 173,
LITERAL_photuris = 174,
// "net-unr" = 175
// "host-unr" = 176
// "proto-unr" = 177
// "port-unr" = 178
LITERAL_needfrag = 179,
LITERAL_srcfail = 180,
// "net-unk" = 181
// "host-unk" = 182
LITERAL_isolate = 183,
// "net-prohib" = 184
// "host-prohib" = 185
// "net-tos" = 186
// "host-tos" = 187
// "filter-prohib" = 188
// "host-preced" = 189
// "cutoff-preced" = 190
// "redir-net" = 191
// "redir-host" = 192
// "redir-tos-net" = 193
// "redir-tos-host" = 194
// "normal-adv" = 195
// "common-adv" = 196
LITERAL_transit = 197,
LITERAL_reassemb = 198,
LITERAL_badhead = 199,
LITERAL_optmiss = 200,
LITERAL_badlen = 201,
// "unknown-ind" = 202
// "auth-fail" = 203
// "decrypt-fail" = 204
ICMP6_TYPE = 205,
TAGGED = 206,
TAG = 207,
KEEP = 208,
MODULATE = 209,
SYNPROXY = 210,
STATE = 211,
LABEL = 212,
EXIT = 213,
QUIT = 214,
INTRFACE = 215,
ICMP6 = 216,
IGRP = 217,
IPSEC = 218,
NOS = 219,
PCP = 220,
PIM = 221,
PPTP = 222,
RIP = 223,
SNP = 224,
HOST = 225,
RANGE = 226,
LOG_LEVEL_ALERTS = 227,
LOG_LEVEL_CRITICAL = 228,
LOG_LEVEL_DEBUGGING = 229,
LOG_LEVEL_EMERGENCIES = 230,
LOG_LEVEL_ERRORS = 231,
LOG_LEVEL_INFORMATIONAL = 232,
LOG_LEVEL_NOTIFICATIONS = 233,
LOG_LEVEL_WARNINGS = 234,
LOG_LEVEL_DISABLE = 235,
LOG_LEVEL_INACTIVE = 236,
Whitespace = 237,
HEX_CONST = 238,
NEG_INT_CONST = 239,
HEX_DIGIT = 240,
DIGIT = 241,
NUM_3DIGIT = 242,
NUM_HEX_4DIGIT = 243,
NUMBER_ADDRESS_OR_WORD = 244,
PIPE_CHAR = 245,
NUMBER_SIGN = 246,
PERCENT = 247,
AMPERSAND = 248,
APOSTROPHE = 249,
PLUS = 250,
DOT = 251,
SEMICOLON = 252,
QUESTION = 253,
COMMERCIAL_AT = 254,
OPENING_SQUARE = 255,
CLOSING_SQUARE = 256,
CARET = 257,
UNDERLINE = 258,
TILDE = 259,
DOUBLE_QUOTE = 260,
DUP_TO = 140,
GROUP = 141,
LITERAL_fragment = 142,
LITERAL_crop = 143,
// "drop-ovl" = 144
// "no-df" = 145
// "min-ttl" = 146
// "max-mss" = 147
// "random-id" = 148
FLAGS = 149,
ICMP_TYPE = 150,
ICMP_CODE = 151,
LITERAL_echorep = 152,
LITERAL_unreach = 153,
LITERAL_squench = 154,
LITERAL_redir = 155,
LITERAL_althost = 156,
LITERAL_echoreq = 157,
LITERAL_routeradv = 158,
LITERAL_routersol = 159,
LITERAL_timex = 160,
LITERAL_paramprob = 161,
LITERAL_timereq = 162,
LITERAL_timerep = 163,
LITERAL_inforeq = 164,
LITERAL_inforep = 165,
LITERAL_maskreq = 166,
LITERAL_maskrep = 167,
LITERAL_trace = 168,
LITERAL_dataconv = 169,
LITERAL_mobredir = 170,
// "ipv6-where" = 171
// "ipv6-here" = 172
LITERAL_mobregreq = 173,
LITERAL_mobregrep = 174,
LITERAL_photuris = 175,
// "net-unr" = 176
// "host-unr" = 177
// "proto-unr" = 178
// "port-unr" = 179
LITERAL_needfrag = 180,
LITERAL_srcfail = 181,
// "net-unk" = 182
// "host-unk" = 183
LITERAL_isolate = 184,
// "net-prohib" = 185
// "host-prohib" = 186
// "net-tos" = 187
// "host-tos" = 188
// "filter-prohib" = 189
// "host-preced" = 190
// "cutoff-preced" = 191
// "redir-net" = 192
// "redir-host" = 193
// "redir-tos-net" = 194
// "redir-tos-host" = 195
// "normal-adv" = 196
// "common-adv" = 197
LITERAL_transit = 198,
LITERAL_reassemb = 199,
LITERAL_badhead = 200,
LITERAL_optmiss = 201,
LITERAL_badlen = 202,
// "unknown-ind" = 203
// "auth-fail" = 204
// "decrypt-fail" = 205
ICMP6_TYPE = 206,
TAGGED = 207,
TAG = 208,
KEEP = 209,
MODULATE = 210,
SYNPROXY = 211,
STATE = 212,
LABEL = 213,
EXIT = 214,
QUIT = 215,
INTRFACE = 216,
ICMP6 = 217,
IGRP = 218,
IPSEC = 219,
NOS = 220,
PCP = 221,
PIM = 222,
PPTP = 223,
RIP = 224,
SNP = 225,
HOST = 226,
RANGE = 227,
LOG_LEVEL_ALERTS = 228,
LOG_LEVEL_CRITICAL = 229,
LOG_LEVEL_DEBUGGING = 230,
LOG_LEVEL_EMERGENCIES = 231,
LOG_LEVEL_ERRORS = 232,
LOG_LEVEL_INFORMATIONAL = 233,
LOG_LEVEL_NOTIFICATIONS = 234,
LOG_LEVEL_WARNINGS = 235,
LOG_LEVEL_DISABLE = 236,
LOG_LEVEL_INACTIVE = 237,
Whitespace = 238,
HEX_CONST = 239,
NEG_INT_CONST = 240,
HEX_DIGIT = 241,
DIGIT = 242,
NUM_3DIGIT = 243,
NUM_HEX_4DIGIT = 244,
NUMBER_ADDRESS_OR_WORD = 245,
PIPE_CHAR = 246,
NUMBER_SIGN = 247,
PERCENT = 248,
AMPERSAND = 249,
APOSTROPHE = 250,
PLUS = 251,
DOT = 252,
SEMICOLON = 253,
QUESTION = 254,
COMMERCIAL_AT = 255,
OPENING_SQUARE = 256,
CLOSING_SQUARE = 257,
CARET = 258,
UNDERLINE = 259,
TILDE = 260,
DOUBLE_QUOTE = 261,
NULL_TREE_LOOKAHEAD = 3
};
#ifdef __cplusplus

245
src/parsers/PFCfgParserTokenTypes.txt
View File

@ -1,4 +1,4 @@
// $ANTLR 2.7.7 (20090306): pf.g -> PFCfgParserTokenTypes.txt$
// $ANTLR 2.7.7 (20100319): pf.g -> PFCfgParserTokenTypes.txt$
PFCfgParser // output token vocab name
NEWLINE=4
LINE_COMMENT=5
@ -136,124 +136,125 @@ ANY="any"=136
NO_ROUTE="no-route"=137
ROUTE_TO="route-to"=138
REPLY_TO="reply-to"=139
GROUP="group"=140
LITERAL_fragment="fragment"=141
LITERAL_crop="crop"=142
"drop-ovl"=143
"no-df"=144
"min-ttl"=145
"max-mss"=146
"random-id"=147
FLAGS="flags"=148
ICMP_TYPE="icmp-type"=149
ICMP_CODE="code"=150
LITERAL_echorep="echorep"=151
LITERAL_unreach="unreach"=152
LITERAL_squench="squench"=153
LITERAL_redir="redir"=154
LITERAL_althost="althost"=155
LITERAL_echoreq="echoreq"=156
LITERAL_routeradv="routeradv"=157
LITERAL_routersol="routersol"=158
LITERAL_timex="timex"=159
LITERAL_paramprob="paramprob"=160
LITERAL_timereq="timereq"=161
LITERAL_timerep="timerep"=162
LITERAL_inforeq="inforeq"=163
LITERAL_inforep="inforep"=164
LITERAL_maskreq="maskreq"=165
LITERAL_maskrep="maskrep"=166
LITERAL_trace="trace"=167
LITERAL_dataconv="dataconv"=168
LITERAL_mobredir="mobredir"=169
"ipv6-where"=170
"ipv6-here"=171
LITERAL_mobregreq="mobregreq"=172
LITERAL_mobregrep="mobregrep"=173
LITERAL_photuris="photuris"=174
"net-unr"=175
"host-unr"=176
"proto-unr"=177
"port-unr"=178
LITERAL_needfrag="needfrag"=179
LITERAL_srcfail="srcfail"=180
"net-unk"=181
"host-unk"=182
LITERAL_isolate="isolate"=183
"net-prohib"=184
"host-prohib"=185
"net-tos"=186
"host-tos"=187
"filter-prohib"=188
"host-preced"=189
"cutoff-preced"=190
"redir-net"=191
"redir-host"=192
"redir-tos-net"=193
"redir-tos-host"=194
"normal-adv"=195
"common-adv"=196
LITERAL_transit="transit"=197
LITERAL_reassemb="reassemb"=198
LITERAL_badhead="badhead"=199
LITERAL_optmiss="optmiss"=200
LITERAL_badlen="badlen"=201
"unknown-ind"=202
"auth-fail"=203
"decrypt-fail"=204
ICMP6_TYPE="icmp6-type"=205
TAGGED="tagged"=206
TAG="tag"=207
KEEP="keep"=208
MODULATE="modulate"=209
SYNPROXY="synproxy"=210
STATE="state"=211
LABEL="label"=212
EXIT="exit"=213
QUIT="quit"=214
INTRFACE="interface"=215
ICMP6="icmp6"=216
IGRP="igrp"=217
IPSEC="ipsec"=218
NOS="nos"=219
PCP="pcp"=220
PIM="pim"=221
PPTP="pptp"=222
RIP="rip"=223
SNP="snp"=224
HOST="host"=225
RANGE="range"=226
LOG_LEVEL_ALERTS="alerts"=227
LOG_LEVEL_CRITICAL="critical"=228
LOG_LEVEL_DEBUGGING="debugging"=229
LOG_LEVEL_EMERGENCIES="emergencies"=230
LOG_LEVEL_ERRORS="errors"=231
LOG_LEVEL_INFORMATIONAL="informational"=232
LOG_LEVEL_NOTIFICATIONS="notifications"=233
LOG_LEVEL_WARNINGS="warnings"=234
LOG_LEVEL_DISABLE="disable"=235
LOG_LEVEL_INACTIVE="inactive"=236
Whitespace=237
HEX_CONST=238
NEG_INT_CONST=239
HEX_DIGIT=240
DIGIT=241
NUM_3DIGIT=242
NUM_HEX_4DIGIT=243
NUMBER_ADDRESS_OR_WORD=244
PIPE_CHAR=245
NUMBER_SIGN=246
PERCENT=247
AMPERSAND=248
APOSTROPHE=249
PLUS=250
DOT=251
SEMICOLON=252
QUESTION=253
COMMERCIAL_AT=254
OPENING_SQUARE=255
CLOSING_SQUARE=256
CARET=257
UNDERLINE=258
TILDE=259
DOUBLE_QUOTE=260
DUP_TO="dup-to"=140
GROUP="group"=141
LITERAL_fragment="fragment"=142
LITERAL_crop="crop"=143
"drop-ovl"=144
"no-df"=145
"min-ttl"=146
"max-mss"=147
"random-id"=148
FLAGS="flags"=149
ICMP_TYPE="icmp-type"=150
ICMP_CODE="code"=151
LITERAL_echorep="echorep"=152
LITERAL_unreach="unreach"=153
LITERAL_squench="squench"=154
LITERAL_redir="redir"=155
LITERAL_althost="althost"=156
LITERAL_echoreq="echoreq"=157
LITERAL_routeradv="routeradv"=158
LITERAL_routersol="routersol"=159
LITERAL_timex="timex"=160
LITERAL_paramprob="paramprob"=161
LITERAL_timereq="timereq"=162
LITERAL_timerep="timerep"=163
LITERAL_inforeq="inforeq"=164
LITERAL_inforep="inforep"=165
LITERAL_maskreq="maskreq"=166
LITERAL_maskrep="maskrep"=167
LITERAL_trace="trace"=168
LITERAL_dataconv="dataconv"=169
LITERAL_mobredir="mobredir"=170
"ipv6-where"=171
"ipv6-here"=172
LITERAL_mobregreq="mobregreq"=173
LITERAL_mobregrep="mobregrep"=174
LITERAL_photuris="photuris"=175
"net-unr"=176
"host-unr"=177
"proto-unr"=178
"port-unr"=179
LITERAL_needfrag="needfrag"=180
LITERAL_srcfail="srcfail"=181
"net-unk"=182
"host-unk"=183
LITERAL_isolate="isolate"=184
"net-prohib"=185
"host-prohib"=186
"net-tos"=187
"host-tos"=188
"filter-prohib"=189
"host-preced"=190
"cutoff-preced"=191
"redir-net"=192
"redir-host"=193
"redir-tos-net"=194
"redir-tos-host"=195
"normal-adv"=196
"common-adv"=197
LITERAL_transit="transit"=198
LITERAL_reassemb="reassemb"=199
LITERAL_badhead="badhead"=200
LITERAL_optmiss="optmiss"=201
LITERAL_badlen="badlen"=202
"unknown-ind"=203
"auth-fail"=204
"decrypt-fail"=205
ICMP6_TYPE="icmp6-type"=206
TAGGED="tagged"=207
TAG="tag"=208
KEEP="keep"=209
MODULATE="modulate"=210
SYNPROXY="synproxy"=211
STATE="state"=212
LABEL="label"=213
EXIT="exit"=214
QUIT="quit"=215
INTRFACE="interface"=216
ICMP6="icmp6"=217
IGRP="igrp"=218
IPSEC="ipsec"=219
NOS="nos"=220
PCP="pcp"=221
PIM="pim"=222
PPTP="pptp"=223
RIP="rip"=224
SNP="snp"=225
HOST="host"=226
RANGE="range"=227
LOG_LEVEL_ALERTS="alerts"=228
LOG_LEVEL_CRITICAL="critical"=229
LOG_LEVEL_DEBUGGING="debugging"=230
LOG_LEVEL_EMERGENCIES="emergencies"=231
LOG_LEVEL_ERRORS="errors"=232
LOG_LEVEL_INFORMATIONAL="informational"=233
LOG_LEVEL_NOTIFICATIONS="notifications"=234
LOG_LEVEL_WARNINGS="warnings"=235
LOG_LEVEL_DISABLE="disable"=236
LOG_LEVEL_INACTIVE="inactive"=237
Whitespace=238
HEX_CONST=239
NEG_INT_CONST=240
HEX_DIGIT=241
DIGIT=242
NUM_3DIGIT=243
NUM_HEX_4DIGIT=244
NUMBER_ADDRESS_OR_WORD=245
PIPE_CHAR=246
NUMBER_SIGN=247
PERCENT=248
AMPERSAND=249
APOSTROPHE=250
PLUS=251
DOT=252
SEMICOLON=253
QUESTION=254
COMMERCIAL_AT=255
OPENING_SQUARE=256
CLOSING_SQUARE=257
CARET=258
UNDERLINE=259
TILDE=260
DOUBLE_QUOTE=261

10
src/parsers/pf.g
View File

@ -1274,7 +1274,7 @@ host_list :
// ************************************************************************
route :
route_to | reply_to
route_to | reply_to | dup_to
;
route_to :
@ -1291,6 +1291,13 @@ reply_to :
}
;
dup_to :
DUP_TO ( routehost | routehost_list )
{
importer->route_type = PFImporter::DUP_TO;
}
;
routehost { RouteSpec rs; } :
OPENING_PAREN
WORD { rs.iface = LT(0)->getText(); }
@ -1942,6 +1949,7 @@ tokens
ROUTE_TO = "route-to";
REPLY_TO = "reply-to";
DUP_TO = "dup-to";
DROP = "drop";
RETURN = "return";

18
src/unit_tests/PFImporterTest/PFImporterTest.cpp
View File

@ -523,6 +523,24 @@ void PFImporterTest::userGroupMatches()
"pf-user-group-matches.fwb");
}
void PFImporterTest::routeToTest()
{
platform = "pf";
std::istringstream instream(
openTestFile("test_data/pf-route-to.conf"));
Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
CPPUNIT_ASSERT_NO_THROW( imp->run() );
imp->finalize();
db->setPredictableIds();
db->saveFile("pf-route-to.fwb");
compareResults(logger, "test_data/pf-route-to.output", "pf-route-to.output");
compareFwbFiles("test_data/pf-route-to.fwb", "pf-route-to.fwb");
}

2
src/unit_tests/PFImporterTest/PFImporterTest.h
View File

@ -74,6 +74,7 @@ public:
void scrubCommandsNew();
void tableDefinitions();
void userGroupMatches();
void routeToTest();
CPPUNIT_TEST_SUITE(PFImporterTest);
@ -93,6 +94,7 @@ public:
CPPUNIT_TEST(scrubCommandsNew);
CPPUNIT_TEST(tableDefinitions);
CPPUNIT_TEST(userGroupMatches);
CPPUNIT_TEST(routeToTest);
CPPUNIT_TEST_SUITE_END();

8
src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.output
View File

@ -1,8 +1,8 @@
5: Address Table: <dst_addresses_1>: 192.168.1.1/, 192.168.1.2/, 192.168.2.0/24
5: Address Table: <dst_addresses_1>: 192.168.1.1, 192.168.1.2, 192.168.2.0/24
6: Address Table: <dst_addresses_2>: pcn0, pcn0
6: New interface: pcn0
6: Address Table: <dst_addresses_2>: pcn0/, pcn0/
7: Address Table: <dst_addresses_3>: pcn0/, pcn0/
8: Address Table: <dst_addresses_4>: www.fwbuilder.org/, www.netcitadel.com/
7: Address Table: <dst_addresses_3>: pcn0, pcn0
8: Address Table: <dst_addresses_4>: www.fwbuilder.org, www.netcitadel.com
11: filtering rule: action pass; interfaces:
12: filtering rule: action pass; interfaces:
12: Error: import of 'interface:broadcast' is not supported.

7
src/unit_tests/PFImporterTest/test_data/pf-route-to.conf Normal file
View File

@ -0,0 +1,7 @@
pass in log quick route-to { ( em0 10.1.2.3 ) } inet from 192.168.1.0/24 to any
pass in quick on bce0 reply-to ( bce0 10.3.4.5 ) inet from 192.168.1.0/24 to any
pass out quick on bce0 dup-to (em0 10.1.2.3) proto tcp from any port 80 to any

563
src/unit_tests/PFImporterTest/test_data/pf-route-to.fwb Normal file
View File

@ -0,0 +1,563 @@
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1309988144" id="root">
<Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
<AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
<AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
<AnyInterval id="sysid2" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1" name="Any" comment="Any Interval" ro="False"/>
<ObjectGroup id="stdid01" name="Objects" comment="" ro="False">
<ObjectGroup id="stdid16" name="Addresses" comment="" ro="False">
<IPv4 id="id2001X88798" name="all-hosts" comment="" ro="False" address="224.0.0.1" netmask="0.0.0.0"/>
<IPv4 id="id2002X88798" name="all-routers" comment="" ro="False" address="224.0.0.2" netmask="0.0.0.0"/>
<IPv4 id="id2003X88798" name="all DVMRP" comment="" ro="False" address="224.0.0.4" netmask="0.0.0.0"/>
<IPv4 id="id2117X88798" name="OSPF (all routers)" comment="RFC2328" ro="False" address="224.0.0.5" netmask="0.0.0.0"/>
<IPv4 id="id2128X88798" name="OSPF (designated routers)" comment="RFC2328" ro="False" address="224.0.0.6" netmask="0.0.0.0"/>
<IPv4 id="id2430X88798" name="RIP" comment="RFC1723" ro="False" address="224.0.0.9" netmask="0.0.0.0"/>
<IPv4 id="id2439X88798" name="EIGRP" comment="" ro="False" address="224.0.0.10" netmask="0.0.0.0"/>
<IPv4 id="id2446X88798" name="DHCP server, relay agent" comment="RFC 1884" ro="False" address="224.0.0.12" netmask="0.0.0.0"/>
<IPv4 id="id2455X88798" name="PIM" comment="" ro="False" address="224.0.0.13" netmask="0.0.0.0"/>
<IPv4 id="id2462X88798" name="RSVP" comment="" ro="False" address="224.0.0.14" netmask="0.0.0.0"/>
<IPv4 id="id2469X88798" name="VRRP" comment="RFC3768" ro="False" address="224.0.0.18" netmask="0.0.0.0"/>
<IPv4 id="id2777X88798" name="IGMP" comment="" ro="False" address="224.0.0.22" netmask="0.0.0.0"/>
<IPv4 id="id2784X88798" name="OSPFIGP-TE" comment="RFC4973" ro="False" address="224.0.0.24" netmask="0.0.0.0"/>
<IPv4 id="id3094X88798" name="HSRP" comment="" ro="False" address="224.0.0.102" netmask="0.0.0.0"/>
<IPv4 id="id3403X88798" name="mDNS" comment="" ro="False" address="224.0.0.251" netmask="0.0.0.0"/>
<IPv4 id="id3410X88798" name="LLMNR" comment="Link-Local Multicast Name Resolution, RFC4795" ro="False" address="224.0.0.252" netmask="0.0.0.0"/>
<IPv4 id="id3411X88798" name="Teredo" comment="" ro="False" address="224.0.0.253" netmask="0.0.0.0"/>
</ObjectGroup>
<ObjectGroup id="stdid17" name="DNS Names" comment="" ro="False"/>
<ObjectGroup id="stdid18" name="Address Tables" comment="" ro="False"/>
<ObjectGroup id="stdid04" name="Groups" comment="" ro="False">
<ObjectGroup id="id3DC75CE8" name="rfc1918-nets" comment="" ro="False">
<ObjectRef ref="id3DC75CE5"/>
<ObjectRef ref="id3DC75CE6"/>
<ObjectRef ref="id3DC75CE7"/>
</ObjectGroup>
<ObjectGroup id="id3292X75851" name="ipv6 private" comment="These are various ipv6 networks that should not be routed on the Internet&#10;" ro="False">
<ObjectRef ref="id2088X75851"/>
<ObjectRef ref="id2986X75851"/>
<ObjectRef ref="id2383X75851"/>
</ObjectGroup>
</ObjectGroup>
<ObjectGroup id="stdid02" name="Hosts" comment="" ro="False">
<Host id="id3D84EECE" name="internal server" comment="This host is used in examples and template objects" ro="False">
<Interface id="id3D84EED2" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
<IPv4 id="id3D84EED3" name="ip" comment="" ro="False" address="192.168.1.10" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="192.168.1.10">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions>
<Option name="snmp_contact"></Option>
<Option name="snmp_description"></Option>
<Option name="snmp_location"></Option>
<Option name="use_mac_addr">false</Option>
<Option name="use_mac_addr_filter">False</Option>
</HostOptions>
</Host>
<Host id="id3D84EECF" name="server on dmz" comment="This host is used in examples and template objects" ro="False">
<Interface id="id3D84EEE3" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
<IPv4 id="id3D84EEE4" name="ip" comment="" ro="False" address="192.168.2.10" netmask="255.255.255.0"/>
<InterfaceOptions/>
</Interface>
<Management address="192.168.2.10">
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
<FWBDManagement enabled="False" identity="" port="-1"/>
<PolicyInstallScript arguments="" command="" enabled="False"/>
</Management>
<HostOptions>
<Option name="snmp_contact"></Option>
<Option name="snmp_description"></Option>
<Option name="snmp_location"></Option>
<Option name="use_mac_addr">false</Option>
<Option name="use_mac_addr_filter">False</Option>
</HostOptions>
</Host>
</ObjectGroup>
<ObjectGroup id="stdid03" name="Networks" comment="" ro="False">
<Network id="id3DC75CEC" name="all multicasts" comment="224.0.0.0/4 - This block, formerly known as the Class D address&#10;space, is allocated for use in IPv4 multicast address assignments.&#10;The IANA guidelines for assignments from this space are described in&#10;[RFC3171].&#10;" ro="False" address="224.0.0.0" netmask="240.0.0.0"/>
<Network id="id3F4ECE3E" name="link-local" comment="169.254.0.0/16 - This is the &quot;link local&quot; block. It is allocated for&#10;communication between hosts on a single link. Hosts obtain these&#10;addresses by auto-configuration, such as when a DHCP server may not&#10;be found.&#10;" ro="False" address="169.254.0.0" netmask="255.255.0.0"/>
<Network id="id3F4ECE3D" name="loopback-net" comment="127.0.0.0/8 - This block is assigned for use as the Internet host&#10;loopback address. A datagram sent by a higher level protocol to an&#10;address anywhere within this block should loop back inside the host.&#10;This is ordinarily implemented using only 127.0.0.1/32 for loopback,&#10;but no addresses within this block should ever appear on any network&#10;anywhere [RFC1700, page 5].&#10;" ro="False" address="127.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE5" name="net-10.0.0.0" comment="10.0.0.0/8 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet." ro="False" address="10.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE7" name="net-172.16.0.0" comment="172.16.0.0/12 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet.&#10;" ro="False" address="172.16.0.0" netmask="255.240.0.0"/>
<Network id="id3DC75CE6" name="net-192.168.0.0" comment="192.168.0.0/16 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918]. Addresses within this&#10;block should not appear on the public Internet.&#10;" ro="False" address="192.168.0.0" netmask="255.255.0.0"/>
<Network id="id3F4ECE3F" name="test-net" comment="192.0.2.0/24 - This block is assigned as &quot;TEST-NET&quot; for use in&#10;documentation and example code. It is often used in conjunction with&#10;domain names example.com or example.net in vendor and protocol&#10;documentation. Addresses within this block should not appear on the&#10;public Internet.&#10;" ro="False" address="192.0.2.0" netmask="255.255.255.0"/>
<Network id="id3F4ECE40" name="this-net" comment="0.0.0.0/8 - Addresses in this block refer to source hosts on &quot;this&quot;&#10;network. Address 0.0.0.0/32 may be used as a source address for this&#10;host on this network; other addresses within 0.0.0.0/8 may be used to&#10;refer to specified hosts on this network [RFC1700, page 4]." ro="False" address="0.0.0.0" netmask="255.0.0.0"/>
<Network id="id3DC75CE7-1" name="net-192.168.1.0" comment="192.168.1.0/24 - Address often used for home and small office networks.&#10;" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
<Network id="id3DC75CE7-2" name="net-192.168.2.0" comment="192.168.2.0/24 - Address often used for home and small office networks.&#10;" ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
<NetworkIPv6 id="id2088X75851" name="documentation net" comment="RFC3849" ro="False" address="2001:db8::" netmask="32"/>
<NetworkIPv6 id="id2383X75851" name="link-local ipv6" comment="RFC4291 Link-local unicast net" ro="False" address="fe80::" netmask="10"/>
<NetworkIPv6 id="id2685X75851" name="multicast ipv6" comment="RFC4291 ipv6 multicast addresses" ro="False" address="ff00::" netmask="8"/>
<NetworkIPv6 id="id2986X75851" name="experimental ipv6" comment="RFC2928, RFC4773 &#10;&#10;&quot;The block of Sub-TLA IDs assigned to the IANA&#10;(i.e., 2001:0000::/29 - 2001:01F8::/29) is for&#10;assignment for testing and experimental usage to&#10;support activities such as the 6bone, and&#10;for new approaches like exchanges.&quot; [RFC2928]&#10;&#10;" ro="False" address="2001::" netmask="23"/>
</ObjectGroup>
<ObjectGroup id="stdid15" name="Address Ranges" comment="" ro="False">
<AddressRange id="id3F6D115C" name="broadcast" comment="" ro="False" start_address="255.255.255.255" end_address="255.255.255.255"/>
<AddressRange id="id3F6D115D" name="old-broadcast" comment="" ro="False" start_address="0.0.0.0" end_address="0.0.0.0"/>
</ObjectGroup>
</ObjectGroup>
<ServiceGroup id="stdid05" name="Services" comment="" ro="False">
<CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
<CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
</CustomService>
<CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
<CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
</CustomService>
<ServiceGroup id="stdid10" name="Groups" comment="" ro="False">
<ServiceGroup id="sg-DHCP" name="DHCP" comment="" ro="False">
<ServiceRef ref="udp-bootpc"/>
<ServiceRef ref="udp-bootps"/>
</ServiceGroup>
<ServiceGroup id="id3F530CC8" name="DNS" comment="" ro="False">
<ServiceRef ref="udp-DNS"/>
<ServiceRef ref="tcp-DNS"/>
</ServiceGroup>
<ServiceGroup id="id3CB1279B" name="IPSEC" comment="" ro="False">
<ServiceRef ref="id3CB12797"/>
<ServiceRef ref="ip-IPSEC"/>
</ServiceGroup>
<ServiceGroup id="sg-NETBIOS" name="NETBIOS" comment="" ro="False">
<ServiceRef ref="udp-netbios-dgm"/>
<ServiceRef ref="udp-netbios-ns"/>
<ServiceRef ref="id3E755609"/>
</ServiceGroup>
<ServiceGroup id="id3CB131CC" name="PCAnywhere" comment="" ro="False">
<ServiceRef ref="id3CB131CA"/>
<ServiceRef ref="id3CB131C8"/>
</ServiceGroup>
<ServiceGroup id="sg-Useful_ICMP" name="Useful_ICMP" comment="" ro="False">
<ServiceRef ref="icmp-Time_exceeded"/>
<ServiceRef ref="icmp-Time_exceeded_in_transit"/>
<ServiceRef ref="icmp-ping_reply"/>
<ServiceRef ref="icmp-Unreachables"/>
</ServiceGroup>
<ServiceGroup id="id1569X4889" name="Ipv6 unreachable messages" comment="" ro="False">
<ServiceRef ref="idE0D27650"/>
<ServiceRef ref="idCFE27650"/>
<ServiceRef ref="idE0B27650"/>
<ServiceRef ref="id1519Z388"/>
</ServiceGroup>
<ServiceGroup id="id3B4FEDD9" name="kerberos" comment="" ro="False">
<ServiceRef ref="id3B4FEDA5"/>
<ServiceRef ref="id3B4FEDA9"/>
<ServiceRef ref="id3B4FEDA7"/>
<ServiceRef ref="id3B4FEDAB"/>
<ServiceRef ref="id3B4FEDA3"/>
<ServiceRef ref="id3B4FEE21"/>
<ServiceRef ref="id3B4FEE23"/>
<ServiceRef ref="id3E7E3EA2"/>
</ServiceGroup>
<ServiceGroup id="id3B4FF35E" name="nfs" comment="" ro="False">
<ServiceRef ref="id3B4FEE7A"/>
<ServiceRef ref="id3B4FEE78"/>
</ServiceGroup>
<ServiceGroup id="id3B4FEFFA" name="quake" comment="" ro="False">
<ServiceRef ref="id3B4FEF7C"/>
<ServiceRef ref="id3B4FEF7E"/>
</ServiceGroup>
<ServiceGroup id="id3D703C9A" name="Real Player" comment="" ro="False">
<ServiceRef ref="id3D703C99"/>
<ServiceRef ref="id3D703C8B"/>
</ServiceGroup>
<ServiceGroup id="id3E7E3E95" name="WinNT" comment="" ro="False">
<ServiceRef ref="sg-NETBIOS"/>
<ServiceRef ref="id3DC8C8BB"/>
<ServiceRef ref="id3E7E3D58"/>
</ServiceGroup>
<ServiceGroup id="id3E7E3E9A" name="Win2000" comment="" ro="False">
<ServiceRef ref="id3E7E3E95"/>
<ServiceRef ref="udp-DNS"/>
<ServiceRef ref="id3DC8C8BC"/>
<ServiceRef ref="id3E7E3EA2"/>
<ServiceRef ref="id3AECF778"/>
<ServiceRef ref="id3D703C90"/>
<ServiceRef ref="id3E7E4039"/>
<ServiceRef ref="id3E7E403A"/>
<ServiceRef ref="id3B4FEDA5"/>
<ServiceRef ref="tcp-DNS"/>
</ServiceGroup>
<ServiceGroup id="id41291786" name="UPnP" comment="" ro="False">
<ServiceRef ref="id41291784"/>
<ServiceRef ref="id41291785"/>
<ServiceRef ref="id41291783"/>
<ServiceRef ref="id412Z18A9"/>
</ServiceGroup>
</ServiceGroup>
<ServiceGroup id="stdid07" name="ICMP" comment="" ro="False">
<ICMPService id="icmp-Unreachables" code="-1" type="3" name="all ICMP unreachables" comment="" ro="False"/>
<ICMPService id="id3C20EEB5" code="-1" type="-1" name="any ICMP" comment="" ro="False"/>
<ICMPService id="icmp-Host_unreach" code="1" type="3" name="host_unreach" comment="" ro="False"/>
<ICMPService id="icmp-ping_reply" code="0" type="0" name="ping reply" comment="" ro="False"/>
<ICMPService id="icmp-ping_request" code="0" type="8" name="ping request" comment="" ro="False"/>
<ICMPService id="icmp-Port_unreach" code="3" type="3" name="port unreach" comment="Port unreachable" ro="False"/>
<ICMPService id="icmp-Time_exceeded" code="0" type="11" name="time exceeded" comment="ICMP messages of this type are needed for traceroute" ro="False"/>
<ICMPService id="icmp-Time_exceeded_in_transit" code="1" type="11" name="time exceeded in transit" comment="" ro="False"/>
<ICMP6Service id="ipv6-icmp-ping_request" code="0" type="128" name="ipv6 ping request" comment="IPv6 ping request" ro="False"/>
<ICMP6Service id="ipv6-icmp-ping_reply" code="0" type="129" name="ipv6 ping reply" comment="IPv6 ping reply" ro="False"/>
<ICMP6Service id="ipv6-icmp-routersol" code="0" type="133" name="ipv6 routersol" comment="IPv6 router solicitation" ro="False"/>
<ICMP6Service id="ipv6-icmp-routeradv" code="0" type="134" name="ipv6 routeradv" comment="IPv6 router advertisement" ro="False"/>
<ICMP6Service id="ipv6-icmp-neighbrsol" code="0" type="135" name="ipv6 neighbrsol" comment="IPv6 neighbor solicitation" ro="False"/>
<ICMP6Service id="ipv6-icmp-neighbradv" code="0" type="136" name="ipv6 neighbradv" comment="IPv6 neighbor advertisement" ro="False"/>
<ICMP6Service id="ipv6-icmp-redir" code="0" type="137" name="ipv6 redir" comment="IPv6 redirect: shorter route exists" ro="False"/>
<ICMP6Service id="id1519Z388" code="-1" type="4" name="ipv6 parameter problem" comment="IPv6 Parameter Problem: RFC4443" ro="False"/>
<ICMP6Service id="idCFE27650" code="0" type="3" name="ipv6 time exceeded" comment="Time exceeded in transit" ro="False"/>
<ICMP6Service id="idCFF27650" code="1" type="3" name="ipv6 time exceeded in reassembly" comment="Time exceeded in reassembly" ro="False"/>
<ICMP6Service id="idE0B27650" code="-1" type="2" name="ipv6 packet too big" comment="" ro="False"/>
<ICMP6Service id="idE0D27650" code="-1" type="1" name="ipv6 all dest unreachable" comment="All icmpv6 codes for type &quot;destination unreachable&quot;&#10;" ro="False"/>
<ICMP6Service id="idCFE27660" code="-1" type="-1" name="ipv6 any ICMP6" comment="any ICMPv6" ro="False"/>
</ServiceGroup>
<ServiceGroup id="stdid06" name="IP" comment="" ro="False">
<IPService id="id3CB12797" fragm="False" lsrr="False" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False" name="AH" comment="IPSEC Authentication Header Protocol" ro="False"/>
<IPService id="ip-IPSEC" fragm="False" lsrr="False" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False" name="ESP" comment="IPSEC Encapsulating Security Payload Protocol" ro="False"/>
<IPService id="ip-RR" fragm="False" lsrr="False" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False" name="RR" comment="Route recording packets" ro="False"/>
<IPService id="ip-SRR" fragm="False" lsrr="True" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False" name="SRR" comment="All sorts of Source Routing Packets" ro="False"/>
<IPService id="ip-IP_Fragments" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False" name="ip_fragments" comment="'Short' fragments" ro="False"/>
<IPService id="id3D703C8E" fragm="False" lsrr="False" protocol_num="57" rr="False" short_fragm="False" ssrr="False" ts="False" name="SKIP" comment="IPSEC Simple Key Management for Internet Protocols" ro="False"/>
<IPService id="id3D703C8F" fragm="False" lsrr="False" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False" name="GRE" comment="Generic Routing Encapsulation&#10;" ro="False"/>
<IPService id="id3D703C95" fragm="False" lsrr="False" protocol_num="112" rr="False" short_fragm="False" ssrr="False" ts="False" name="vrrp" comment="Virtual Router Redundancy Protocol" ro="False"/>
<IPService id="ip-IGMP" fragm="False" lsrr="False" protocol_num="2" rr="False" rtralt="True" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="IGMP" comment="Internet Group Management Protocol, Version 3, RFC 3376" ro="False"/>
<IPService id="ip-PIM" fragm="False" lsrr="False" protocol_num="103" rr="False" rtralt="False" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="PIM" comment="Protocol Independent Multicast - Dense Mode (PIM-DM), RFC 3973, or Protocol Independent Multicast-Sparse Mode (PIM-SM) RFC 2362" ro="False"/>
</ServiceGroup>
<ServiceGroup id="stdid09" name="TCP" comment="" ro="False">
<TCPService id="tcp-ALL_TCP_Masqueraded" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ALL TCP Masqueraded" comment="ipchains used to use this range of port numbers for masquerading. " ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id3D703C94" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="AOL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5190" dst_range_end="5190"/>
<TCPService id="tcp-All_TCP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id3CB131C4" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Citrix-ICA" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1494" dst_range_end="1494"/>
<TCPService id="id3D703C91" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-Admin" comment="Entrust CA Administration Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="709" dst_range_end="709"/>
<TCPService id="id3D703C92" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-KeyMgmt" comment="Entrust CA Key Management Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="710" dst_range_end="710"/>
<TCPService id="id3AEDBEAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="H323" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1720" dst_range_end="1720"/>
<TCPService id="id412Z18A9" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="icslap" comment="Sometimes this protocol is called icslap, but Microsoft does not call it that and just says that DSPP uses port 2869 in Windows XP SP2" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2869" dst_range_end="2869"/>
<TCPService id="id3E7E4039" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3268" dst_range_end="3268"/>
<TCPService id="id3E7E403A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC SSL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3269" dst_range_end="3269"/>
<TCPService id="id3D703C83" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="OpenWindows" comment="Open Windows" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2000" dst_range_end="2000"/>
<TCPService id="id3CB131C8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="PCAnywhere-data" comment="data channel for PCAnywhere v7.52 and later " ro="False" src_range_start="0" src_range_end="0" dst_range_start="5631" dst_range_end="5631"/>
<TCPService id="id3D703C8B" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Real-Audio" comment="RealNetworks PNA Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7070" dst_range_end="7070"/>
<TCPService id="id3D703C93" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="RealSecure" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2998" dst_range_end="2998"/>
<TCPService id="id3DC8C8BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="SMB" comment="SMB over TCP (without NETBIOS)&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="445" dst_range_end="445"/>
<TCPService id="id3D703C8D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TACACSplus" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="49" dst_range_end="49"/>
<TCPService id="id3D703C84" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TCP high ports" comment="TCP high ports" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
<TCPService id="id3E7E3D58" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="WINS replication" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="42" dst_range_end="42"/>
<TCPService id="id3D703C82" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="X11" comment="X Window System" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6000" dst_range_end="6063"/>
<TCPService id="tcp-Auth" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="auth" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="113" dst_range_end="113"/>
<TCPService id="id3AEDBE6E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
<TCPService id="tcp-DNS" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
<TCPService id="id3B4FEDA3" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="eklogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2105" dst_range_end="2105"/>
<TCPService id="id3AECF774" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="finger" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="79" dst_range_end="79"/>
<TCPService id="tcp-FTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="21" dst_range_end="21"/>
<TCPService id="tcp-FTP_data" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data" comment="FTP data channel.&#10; Note: FTP protocol does not really require server to use source port 20 for the data channel, &#10; but many ftp server implementations do so." ro="False" src_range_start="20" src_range_end="20" dst_range_start="1024" dst_range_end="65535"/>
<TCPService id="id3E7553BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data passive" comment="FTP data channel for passive mode transfers&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="20" dst_range_end="20"/>
<TCPService id="tcp-HTTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="http" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
<TCPService id="id3B4FED69" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="https" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="443" dst_range_end="443"/>
<TCPService id="id3AECF776" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="143" dst_range_end="143"/>
<TCPService id="id3B4FED9F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imaps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="993" dst_range_end="993"/>
<TCPService id="id3B4FF13C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="irc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
<TCPService id="id3E7E3EA2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
<TCPService id="id3B4FEE21" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="klogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="543" dst_range_end="543"/>
<TCPService id="id3B4FEE23" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ksh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="544" dst_range_end="544"/>
<TCPService id="id3AECF778" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="389" dst_range_end="389"/>
<TCPService id="id3D703C90" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldaps" comment="Lightweight Directory Access Protocol over TLS/SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="636" dst_range_end="636"/>
<TCPService id="id3B4FF000" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="linuxconf" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="98" dst_range_end="98"/>
<TCPService id="id3D703C97" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="lpr" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
<TCPService id="id3DC8C8BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
<TCPService id="id3D703C98" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ms-sql" comment="Microsoft SQL Server" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1433" dst_range_end="1433"/>
<TCPService id="id3B4FEEEE" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="mysql" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3306" dst_range_end="3306"/>
<TCPService id="id3E755609" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
<TCPService id="id3B4FEE7A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
<TCPService id="tcp-NNTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="119" dst_range_end="119"/>
<TCPService id="id3E7553BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntps" comment="NNTP over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="563" dst_range_end="563"/>
<TCPService id="id3B4FEE1D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="110" dst_range_end="110"/>
<TCPService id="id3E7553BA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3s" comment="POP-3 over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="995" dst_range_end="995"/>
<TCPService id="id3B4FF0EA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="postgres" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5432" dst_range_end="5432"/>
<TCPService id="id3AECF782" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="printer" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
<TCPService id="id3B4FEF7C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
<TCPService id="id3AECF77A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rexec" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="512" dst_range_end="512"/>
<TCPService id="id3AECF77C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rlogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
<TCPService id="id3AECF77E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rshell" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
<TCPService id="id3D703C99" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtsp" comment="Real Time Streaming Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="554" dst_range_end="554"/>
<TCPService id="id3B4FEF34" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rwhois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4321" dst_range_end="4321"/>
<TCPService id="id3D703C89" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="securidprop" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5510" dst_range_end="5510"/>
<TCPService id="tcp-SMTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
<TCPService id="id3B4FF04C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="465" dst_range_end="465"/>
<TCPService id="id3B4FEE76" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="socks" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
<TCPService id="id3D703C87" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sqlnet1" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1521" dst_range_end="1521"/>
<TCPService id="id3B4FF09A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="squid" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
<TCPService id="tcp-SSH" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ssh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
<TCPService id="id3AEDBE00" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
<TCPService id="tcp-TCP-SYN" ack_flag="False" ack_flag_mask="True" fin_flag="False" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" name="tcp-syn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="tcp-Telnet" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="telnet" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="23" dst_range_end="23"/>
<TCPService id="tcp-uucp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="uucp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="540" dst_range_end="540"/>
<TCPService id="id3CB131C6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="winterm" comment="Windows Terminal Services" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3389" dst_range_end="3389"/>
<TCPService id="id3B4FF1B8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7100" dst_range_end="7100"/>
<TCPService id="id3C685B2B" ack_flag="True" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan - full" comment="This service object matches TCP packet with all six flags set." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id4127E949" ack_flag="False" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="False" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan" comment="This service object matches TCP packet with flags FIN, PSH and URG set and other flags cleared. This is a &quot;christmas scan&quot; as defined in snort rules. Nmap can generate this scan, too." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id4127EA72" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
<TCPService id="id4127EBAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="distcc" comment="distributed compiler" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3632" dst_range_end="3632"/>
<TCPService id="id4127ECF1" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvspserver" comment="CVS client/server operations" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2401" dst_range_end="2401"/>
<TCPService id="id4127ECF2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvsup" comment="CVSup file transfer/John Polstra/FreeBSD" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5999" dst_range_end="5999"/>
<TCPService id="id4127ED5E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="afp" comment="AFP (Apple file sharing) over TCP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="548" dst_range_end="548"/>
<TCPService id="id4127EDF6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="whois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="43" dst_range_end="43"/>
<TCPService id="id4127F04F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="bgp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="179" dst_range_end="179"/>
<TCPService id="id4127F146" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius" comment="Radius protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1812" dst_range_end="1812"/>
<TCPService id="id4127F147" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius acct" comment="Radius Accounting" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1813" dst_range_end="1813"/>
<TCPService id="id41291784" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5000" dst_range_end="5000"/>
<TCPService id="id41291785" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp-5431" comment="Although UPnP specification say it should use TCP port 5000, Linksys running Sveasoft firmware listens on port 5431" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5431" dst_range_end="5431"/>
<TCPService id="id41291787" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-0" comment="Java VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5800" dst_range_end="5800"/>
<TCPService id="id41291788" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-0" comment="Regular VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5900" dst_range_end="5900"/>
<TCPService id="id41291887" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-1" comment="Java VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5801" dst_range_end="5801"/>
<TCPService id="id41291888" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-1" comment="Regular VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5901" dst_range_end="5901"/>
<TCPService id="id463FE5FE11008" ack_flag="False" ack_flag_mask="False" established="True" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP established" comment="Some firewall platforms can match TCP packets with flags ACK or RST set; the option is usually called &quot;established&quot;.&#10;&#10;Note that you can use this object only in the policy rules of the firewall that supports this option.&#10;&#10;If you need to match reply packets for a specific TCP service and wish to use option &quot;established&quot;, make a copy of this object and set source port range to match the service.&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<TCPService id="id1577X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtmp" comment="Real Time Messaging Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1935" dst_range_end="1935"/>
<TCPService id="id1590X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5222" dst_range_end="5222"/>
<TCPService id="id1609X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5269" dst_range_end="5269"/>
<TCPService id="id1622X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client-ssl" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5223" dst_range_end="5223"/>
<TCPService id="id1631X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server-ssl" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5270" dst_range_end="5270"/>
<TCPService id="id1644X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nrpe" comment="NRPE add-on for Nagios http://www.nagios.org/&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5666" dst_range_end="5666"/>
</ServiceGroup>
<ServiceGroup id="stdid08" name="UDP" comment="" ro="False">
<UDPService id="udp-ALL_UDP_Masqueraded" name="ALL UDP Masqueraded" comment="ipchains used to use this port range for masqueraded packets" ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
<UDPService id="udp-All_UDP" name="All UDP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
<UDPService id="id3D703C96" name="ICQ" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4000" dst_range_end="4000"/>
<UDPService id="id3CB129D2" name="IKE" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="500" dst_range_end="500"/>
<UDPService id="id3CB131CA" name="PCAnywhere-status" comment="status channel for PCAnywhere v7.52 and later" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5632" dst_range_end="5632"/>
<UDPService id="id3AED0D6B" name="RIP" comment="routing protocol RIP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="520" dst_range_end="520"/>
<UDPService id="id3D703C8C" name="Radius" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1645" dst_range_end="1645"/>
<UDPService id="id3D703C85" name="UDP high ports" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
<UDPService id="id3D703C86" name="Who" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
<UDPService id="id3B4FEDA1" name="afs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7000" dst_range_end="7009"/>
<UDPService id="udp-bootpc" name="bootpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="68" dst_range_end="68"/>
<UDPService id="udp-bootps" name="bootps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="67" dst_range_end="67"/>
<UDPService id="id3AEDBE70" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
<UDPService id="udp-DNS" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
<UDPService id="id3D703C8A" name="interphone" comment="VocalTec Internet Phone" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22555" dst_range_end="22555"/>
<UDPService id="id3B4FEDA5" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
<UDPService id="id3B4FEDA9" name="kerberos-adm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="749" dst_range_end="750"/>
<UDPService id="id3B4FEDA7" name="kpasswd" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="464" dst_range_end="464"/>
<UDPService id="id3B4FEDAB" name="krb524" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4444" dst_range_end="4444"/>
<UDPService id="id3F865B0D" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
<UDPService id="udp-netbios-dgm" name="netbios-dgm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="138" dst_range_end="138"/>
<UDPService id="udp-netbios-ns" name="netbios-ns" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="137" dst_range_end="137"/>
<UDPService id="udp-netbios-ssn" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
<UDPService id="id3B4FEE78" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
<UDPService id="udp-ntp" name="ntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="123" dst_range_end="123"/>
<UDPService id="id3B4FEF7E" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
<UDPService id="id3D703C88" name="secureid-udp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="1024"/>
<UDPService id="udp-SNMP" name="snmp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="161" dst_range_end="161"/>
<UDPService id="id3AED0D69" name="snmp-trap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="162" dst_range_end="162"/>
<UDPService id="id3AEDBE19" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
<UDPService id="id3AECF780" name="syslog" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
<UDPService id="id3AED0D67" name="tftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="69" dst_range_end="69"/>
<UDPService id="id3AED0D8C" name="traceroute" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="33434" dst_range_end="33524"/>
<UDPService id="id4127EA73" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
<UDPService id="id41291783" name="SSDP" comment="Simple Service Discovery Protocol (used for UPnP)" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1900" dst_range_end="1900"/>
<UDPService id="id41291883" name="OpenVPN" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1194" dst_range_end="1194"/>
</ServiceGroup>
<ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
<CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
<CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
<CustomServiceCommand platform="pf"></CustomServiceCommand>
<CustomServiceCommand platform="pix"></CustomServiceCommand>
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
</CustomService>
</ServiceGroup>
<ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
<ServiceGroup id="stdid20" name="UserServices" comment="" ro="False"/>
</ServiceGroup>
<ObjectGroup id="stdid12" name="Firewalls" comment="" ro="False"/>
<ObjectGroup id="stdid21" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="stdid11" name="Time" comment="" ro="False">
<Interval id="int-workhours" days_of_week="1,2,3,4,5" from_day="-1" from_hour="9" from_minute="0" from_month="-1" from_weekday="1" from_year="-1" to_day="-1" to_hour="17" to_minute="0" to_month="-1" to_weekday="5" to_year="-1" name="workhours" comment="any day, 9:00am through 5:00pm" ro="False"/>
<Interval id="int-weekends" days_of_week="6,0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="weekends" comment="weekends: Saturday 0:00 through Sunday 23:59 " ro="False"/>
<Interval id="int-afterhours" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1" name="afterhours" comment="any day 6:00pm - 12:00am" ro="False"/>
<Interval id="id3C63479C" days_of_week="6" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1" name="Sat" comment="" ro="False"/>
<Interval id="id3C63479E" days_of_week="0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="Sun" comment="" ro="False"/>
</IntervalGroup>
</Library>
<Library id="sysid99" name="Deleted Objects" comment="" ro="False"/>
<Library id="id0" name="User" comment="" ro="False">
<ObjectGroup id="id1" name="Objects" comment="" ro="False">
<ObjectGroup id="id2" name="Addresses" comment="" ro="False"/>
<ObjectGroup id="id3" name="DNS Names" comment="" ro="False"/>
<ObjectGroup id="id4" name="Address Tables" comment="" ro="False"/>
<ObjectGroup id="id5" name="Groups" comment="" ro="False"/>
<ObjectGroup id="id6" name="Hosts" comment="" ro="False"/>
<ObjectGroup id="id7" name="Networks" comment="" ro="False">
<Network id="id8" name="net-192.168.1.0/255.255.255.0" comment="Created during import of line 2" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
</ObjectGroup>
<ObjectGroup id="id9" name="Address Ranges" comment="" ro="False"/>
</ObjectGroup>
<ServiceGroup id="id10" name="Services" comment="" ro="False">
<ServiceGroup id="id11" name="Groups" comment="" ro="False"/>
<ServiceGroup id="id12" name="ICMP" comment="" ro="False"/>
<ServiceGroup id="id13" name="IP" comment="" ro="False"/>
<ServiceGroup id="id14" name="TCP" comment="" ro="False">
<TCPService id="id15" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 80:80 / 0:0" comment="Created during import of line 6" ro="False" src_range_start="80" src_range_end="80" dst_range_start="0" dst_range_end="0"/>
</ServiceGroup>
<ServiceGroup id="id16" name="UDP" comment="" ro="False"/>
<ServiceGroup id="id17" name="Users" comment="" ro="False"/>
<ServiceGroup id="id18" name="Custom" comment="" ro="False"/>
<ServiceGroup id="id19" name="TagServices" comment="" ro="False"/>
</ServiceGroup>
<ObjectGroup id="id20" name="Firewalls" comment="" ro="False">
<Firewall id="id21" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of line 2" ro="False">
<NAT id="id61" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</NAT>
<Policy id="id23" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<PolicyRule id="id25" disabled="False" group="" log="True" position="0" action="Accept" direction="Inbound" comment="Created during import of line 2">
<Src neg="False">
<ObjectRef ref="id8"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="sysid0"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="pf_route_opt_addr">10.1.2.3</Option>
<Option name="pf_route_opt_if">em0</Option>
<Option name="pf_route_option">route_through</Option>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule id="id37" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Created during import of line 4">
<Src neg="False">
<ObjectRef ref="id8"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="id67"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="pf_route_opt_addr">10.3.4.5</Option>
<Option name="pf_route_opt_if">bce0</Option>
<Option name="pf_route_option">route_reply_through</Option>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule id="id49" disabled="False" group="" log="False" position="2" action="Accept" direction="Outbound" comment="Created during import of line 6">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id15"/>
</Srv>
<Itf neg="False">
<ObjectRef ref="id67"/>
</Itf>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="pf_route_opt_addr">10.1.2.3</Option>
<Option name="pf_route_opt_if">em0</Option>
<Option name="pf_route_option">route_copy_through</Option>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
<RuleSetOptions/>
</Policy>
<Routing id="id63" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<RuleSetOptions/>
</Routing>
<Interface id="id65" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="em0" comment="Created during import of line 2" ro="False">
<InterfaceOptions/>
</Interface>
<Interface id="id67" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="bce0" comment="Created during import of line 4" ro="False">
<InterfaceOptions/>
</Interface>
<FirewallOptions>
<Option name="check_shading">true</Option>
<Option name="configure_interfaces">true</Option>
<Option name="firewall_dir">/etc</Option>
<Option name="freebsd_ip_forward">1</Option>
<Option name="in_out_code">true</Option>
<Option name="log_prefix">RULE %N -- %A </Option>
<Option name="loopback_interface">lo0</Option>
<Option name="manage_virtual_addr">true</Option>
<Option name="pass_all_out">false</Option>
<Option name="pf_limit_frags">5000</Option>
<Option name="pf_limit_states">10000</Option>
<Option name="pf_scrub_maxmss">1460</Option>
<Option name="pf_timeout_frag">30</Option>
<Option name="pf_timeout_interval">10</Option>
</FirewallOptions>
</Firewall>
</ObjectGroup>
<ObjectGroup id="id69" name="Clusters" comment="" ro="False"/>
<IntervalGroup id="id70" name="Time" comment="" ro="False"/>
</Library>
</FWObjectDatabase>

5
src/unit_tests/PFImporterTest/test_data/pf-route-to.output Normal file
View File

@ -0,0 +1,5 @@
2: New interface: em0
2: filtering rule: action pass; interfaces:
4: New interface: bce0
4: filtering rule: action pass; interfaces: bce0
6: filtering rule: action pass; interfaces: bce0

8
src/unit_tests/PFImporterTest/test_data/pf-tables.output
View File

@ -7,10 +7,10 @@
6: Address Table: <spamd-white> file
7: Warning: attribute "const" will be dropped from table configuration since this attribute is not supported at this time
7: Address Table: <private>: 10/8, 172.16/12, 192.168/16
9: Address Table: <dst_addresses_1>: 192.168.1.1/, 192.168.1.2/, 192.168.2.0/24
9: Address Table: <dst_addresses_1>: 192.168.1.1, 192.168.1.2, 192.168.2.0/24
10: Address Table: <dst_addresses_2>: pcn0, pcn0
10: New interface: pcn0
10: Address Table: <dst_addresses_2>: pcn0/, pcn0/
11: Address Table: <dst_addresses_3>: pcn0/, pcn0/
12: Address Table: <dst_addresses_4>: www.fwbuilder.org/, www.netcitadel.com/
11: Address Table: <dst_addresses_3>: pcn0, pcn0
12: Address Table: <dst_addresses_4>: www.fwbuilder.org, www.netcitadel.com
Could not find enough information in the data file to create any firewall rules.