Vadim Kurland
3f8323a755
* import/PIXImporter.cpp (addLogging): see #2279 Support for import
...
of ASA access-list lines with log levels and intervals
2011-03-27 19:10:34 -07:00
Vadim Kurland
1e0958384a
* parsers/pix.g (tcp_udp_port_spec): see #2284 fixed import of
...
tcp/udp port ranges using mix of port numbers and port names
2011-03-27 18:03:43 -07:00
Vadim Kurland
99c845d0a8
* getServByName.cpp (getPortByName): see #2268 Making sure all tcp
...
and udp port names are recognized on import; also since PIX/ASA
converts udp port numbersin "show run" output to the same names
as if they were tcp, using the same name mapping table.
2011-03-27 17:44:57 -07:00
Vadim Kurland
60d0c4e308
* parsers/pix.g (icmp_top_level_command): see #2164 Implemented
...
import of "ssh", "telnet" and "icmp" PIX/ASA commands. These
commands are imported as regular rules in the main Policy ruleset.
2011-03-25 19:31:06 -07:00
Vadim Kurland
b89afcc87a
* parsers/pix.g (tcp_udp_rule_extended): see #2273 Improvements in
...
the parser for PIX/ASA configs to make it recognize object-group
and named object names used to define source port, destination
address or destination port in "access-list ... tcp|udp" rules,
including ambiguous situation when an object-group appears after
source address specification because this group can define either
source port or destination address.
2011-03-25 15:34:29 -07:00
Vadim Kurland
704be1f951
clean-up in pix grammar for fewer nondeterminism warnings
2011-03-24 21:07:58 -07:00
Vadim Kurland
1673e3f213
pix parser recognizes "interface <label>" in access lists
2011-03-24 20:11:12 -07:00
Vadim Kurland
410b895796
parsing access-list "extended" and "standard"
2011-03-24 19:19:58 -07:00
Vadim Kurland
e3fa57054a
import of acl works, but there could be some missing parts
2011-03-24 19:07:41 -07:00
Vadim Kurland
3f0f6a2aa4
* IOSImporter.cpp (createTCPUDPServicePair): see #2267 added
...
support for import of object-group and service-object statements
of type "tcp-udp" (these get imported as service group object with
two tcp and udp service objects).
2011-03-24 17:04:16 -07:00
Vadim Kurland
909470a0bf
see #1548 working on deduplication of network objects
2011-03-23 22:16:18 -07:00
Vadim Kurland
48179df4d4
first attempt at access-list import for pix/asa. not done yet
2011-03-22 20:31:16 -07:00
Vadim Kurland
2ebad6b511
* parsers/pix.g (port_object): see #2234 added support for import
...
of "obejct-group service name tcp|udp" constructs in ASA 8.3 with
subsequent "port-object" statements.
2011-03-22 17:41:42 -07:00
Vadim Kurland
5a83ec15ff
overloaded t error reporting functions in all grammars to make errors appear in the importer log
2011-03-21 19:56:34 -07:00
Vadim Kurland
a6b873a313
see #2252 #2258 fixed crash #2258 ; imported port ranges are adjusted to make tcp/udp service objects port-range-inclusive
2011-03-21 14:04:03 -07:00
Vadim Kurland
5b4456a28c
see #2257 in case of a "service" statement with unknown service name, create a placeholder object and add a note to its comment
2011-03-21 12:15:18 -07:00
Vadim Kurland
3f4dfd7ebc
see #2257 parser should detect "service " statements that use service name it does not recognize and issue a warning
2011-03-21 12:00:33 -07:00
Vadim Kurland
f3ce898d6c
see #2257 fixed parsing of emty interface definitions and "no" commands inside interface context
2011-03-20 16:11:47 -07:00
Vadim Kurland
57ba766183
see #2257 fixed parsing of "name <ipv6> name" line; build 3505
2011-03-20 16:00:16 -07:00
Vadim Kurland
1577bca547
see #2248 fixed handling of named service objects with port op "neq"
2011-03-20 12:24:49 -07:00
Vadim Kurland
ccab39bcbd
see #2242 making sure button Next disappears and Finish appears when import fails
2011-03-19 21:28:12 -07:00
Vadim Kurland
33bfd16c82
see #2250 "Object group some protocol-objects are not imported properly"
2011-03-19 19:06:16 -07:00
Vadim Kurland
57063f96b9
see #2251 implemented import of "object-group icmp-object" staements (pre-ASA 8.3)
2011-03-19 18:54:45 -07:00
Vadim Kurland
b3181f18ec
see #2249 better grammar to parse tcp/udp specs for pix < 8.3 where keyword "destination" does not appear in "show run" output
2011-03-18 17:29:28 -07:00
Vadim Kurland
d9e5fd7c0a
see #2247 better grammar to parse ipv6 addresses. Looks like I was able to build lexer rules to tokenize ipv6 addresses, yay!
2011-03-18 17:20:17 -07:00
Vadim Kurland
bc669bf21e
see #2234 import of "object-group icmp-type" works
2011-03-17 18:58:23 -07:00
Vadim Kurland
c35a322ba8
see #2234 import of "object-group protocol" works
2011-03-17 18:47:04 -07:00
Vadim Kurland
d624d1f82b
see #2234 import of "object-group service" works
2011-03-17 18:24:37 -07:00
Vadim Kurland
7d9455d0ab
see #2234 import of "object-group service" works
2011-03-17 18:05:31 -07:00
Vadim Kurland
88ad545d1d
see #2234 import of object-group network works
2011-03-17 11:18:10 -07:00
Vadim Kurland
25dda91418
removed ambiguity warnings in pix grammar
2011-03-16 22:32:26 -07:00
Vadim Kurland
86b8b5b733
see #2223 improvements in the grammar to parse interface parameters better. Some ambiguity warnigns remain.
2011-03-16 19:51:16 -07:00
Vadim Kurland
0433111877
fixes for named objects descriptions and interface addresses import for pix/asa
2011-03-16 18:27:08 -07:00
Vadim Kurland
35e227fb14
see #2223 fixed support for descriptions of named objects
2011-03-16 18:21:03 -07:00
Vadim Kurland
9585288e9c
refactoring in the importer: all code that creates new objects moved to new classes. This provides good structure to add object deduplication
2011-03-16 13:20:59 -07:00
Vadim Kurland
8485797e41
see #2222 refactored importer into separate module/lib
2011-03-15 17:38:41 -07:00
Vadim Kurland
b7d1170d70
see #2223 support for import of PIX/ASA named objects
2011-03-14 19:43:18 -07:00
Vadim Kurland
e748c72a1f
see #2167 parsing "names" section
2011-03-13 12:26:45 -07:00
Vadim Kurland
a268a91f7b
* IPTImporter.cpp (pushNATRule): see #2196 "iptables nat rules
...
with target REDIRECT not imported". Iptables NAT rules with target
REDIRECT where not imported correctly.
* IPTImporter.cpp (pushNATRule): see #2190 "support for import of
branches in NAT rules for iptables". Implemented import of NAT
rules in user-defined chains for iptables, these translate into
branching NAT rules in fwbuilder.
2011-03-07 18:21:04 -08:00
Vadim Kurland
85291843f5
* Importer.cpp (ignoreCurrentInterface): see #2152 "ASA Import -
...
shutdown interfaces". Importer recognizes and skips ASA interfaces
in "shutdown" mode.
2011-03-06 21:27:28 -08:00
Vadim Kurland
5c25bfb711
* IPTImporter.cpp (pushPolicyRule): see #2189 Policy importer
...
warnings and errors now include line numbers to help find relevant
lines in the original configuration file.
2011-03-06 13:16:11 -08:00
Vadim Kurland
ff53d6bd07
see #2145 Vlan interfaces discovered in the process of PIX configuration
...
import should be created as subinterfaces of the corresponding
parent with correct interface type and vlan id.
2011-02-26 12:17:23 -08:00
Vadim Kurland
1714e27233
see #2146 Issue a warning when
...
parser encounters "standby" parameter in an interface
configuration. We do not support import of PIX failover
configuration at this time.
2011-02-26 11:09:38 -08:00
Vadim Kurland
59562d852c
see #87 tested parser on pix6, pix7 and asa8 configs, making sure it parses different interface configurations correctly
2011-02-25 20:40:04 -08:00
Vadim Kurland
db4d501ece
see #87 import of interfaces for pix6,7 and 8 works. PArsing inetrface name, label, security level, address
2011-02-25 16:43:25 -08:00
Vadim Kurland
e799b24496
see #87 minimal grammar, importer classes
2011-02-25 14:02:32 -08:00
Vadim Kurland
Vadim Kurland