onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-16 01:49:23 +02:00
Code Issues Releases Wiki Activity
3,996 Commits 3 Branches 3 Tags
41a2ad2dcc02f6482fa4ca8f117b9438db0ad568
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Vadim Kurland 41a2ad2dcc * PIXImporter.cpp (fixServiceObjectUsedForBothSrcAndDstPorts): 
see #2265 "ASA 8.3 acl import: access-list commands using two
named objects or object-groups", see #2290 "Access lists that
include mix of service objects and inline service definitions are
not properly imported". To import access-list command that matches
both source and destination tcp/udp ports and uses object-group in
either match I should create a new service group with a collection
of TCP or UDP service objects matching all combinations of source
and destination port ranges defined by the rule. This should work
when one or both matches use object-group in combination with
inline port match.
 2011-04-07 18:06:18 -07:00
Vadim Kurland 95c6c63818 see #2167 making sure names are replaced with addresses only as standalone words and not substrings 2011-04-07 16:03:52 -07:00
Vadim Kurland bf753da2de bugfix: setting configlet variable firewall_name right; also small patch to remove warnings that appear when uint128.h is compiled on 64 bit systems 2011-04-07 14:48:55 -07:00
Vadim Kurland 60ba676fcc always include named objects and object groups in the generated PIX/FWSM config even when checkbox "generate only access-lists" (option "short_sctipt") is turned on 2011-04-07 14:42:42 -07:00
Vadim Kurland 10400f4737 * PIXImporter.cpp (pushPolicyRule): see #2297 Added warning when 
importer enounters access-list command that matches tcp or udp
ports with "neq" port operators in both source and
destination. This configuration is not supported by import at this
time.
 2011-04-07 14:05:02 -07:00
Vadim Kurland 30ee6d2f12 * PIXImporterNat.cpp (buildSNATRule): see #2319 "Imported nat 
rules with multi-line access-lists have only the first entry"
 2011-04-07 13:50:01 -07:00
Vadim Kurland 3af17b4404 * PIXImporterRun.cpp (run): see #2167 Implemented import of 
"names" and "name" commands in PIX/ASA configs.
 2011-04-07 12:53:31 -07:00
Vadim Kurland 3cb9ee856c using path "disk:" on FWSM to place generated config 2011-04-07 12:09:09 -07:00
Vadim Kurland 4d6302a4cc * CompilerDriver_pix_run.cpp (pixNetworkZoneChecks): see SF bug 
3213019 "FWSM Network zone and IPv6". Currently we do not support
ipv6 with PIX/ASA and FWSM. If user creates a group to be used as
network zone object and places ipv6 address in it, this address
should be ignored while compiling the policy but this should not
be an error.
 2011-04-07 11:05:46 -07:00
Vadim Kurland c32da04d51 * FirewallInstaller.cpp (executeExternalInstallScript): see SF bug 
3212988 "external script makes getopt difficult". User-defined
parameters for the external script moved to the end of the command
line.
 2011-04-07 10:41:06 -07:00
Vadim Kurland e541d4b1a1 updated activation path for FWSM; build 3519 2011-04-07 10:20:20 -07:00
Vadim Kurland fdd5db5ded fixes #2317 fixed linking of PIXImport unit test 2011-04-05 21:23:01 -07:00
Vadim Kurland b1ad1cbec1 fixes #2299 improvements in the log format of iptables and iosacl importers 2011-04-05 21:11:37 -07:00
Vadim Kurland 6f79c1d644 * pix.g (static_command_common_last_parameters): see #2314 "Import 
of static NAT statements drops netmask value and uses host
instead".  "Netmask" parameter of a "static" command applies to
the real address.
 2011-04-05 20:15:02 -07:00
Vadim Kurland d5f95e0f2a * PIXImporterNat.cpp (buildDNATRule): see #2313 "NAT with 
access-list destination address and original service not set".
"Nat" and "static" commands that use access-list should import all
components of the access-list command (source, destination and
service/protocol).
 2011-04-05 19:59:13 -07:00
Vadim Kurland e3383349b0 see #2312 During nat import extraneous address objects are created 2011-04-05 19:35:45 -07:00
Vadim Kurland 55da233d22 * PIXImporterNat.cpp (buildSNATRule): see #2310 "Imported global / 
nat rule has wrong interface defined". Importer mixed up inbound
and outbound interfaces in NAT commands created from combination
of "global" and "nat" PIX/ASA commands.
 2011-04-05 19:06:35 -07:00
Vadim Kurland 6fdbb3ecce using consistent warning announcement; updated unit test files see #2315 2011-04-05 18:59:56 -07:00
Vadim Kurland e6e8455700 * pix.g (nat_new_top_level_command): since import of ASA8.3 
"new" nat commands is not implemented yet, importer should issue
a warning when such command is encountered. See #2315
 2011-04-05 18:55:53 -07:00
Vadim Kurland 327183c1f2 * FWObject.cpp (insert_before): see #2171 "Undoing delete of rule 
ends up with rules being created with duplicate rule
numbers". Also see #2172 "Crash when deleting rule - related to
#2171". When user deleted the last rule in a rule set, then used
Undo to restore it, the program lost track of rules in the rule
set and became unstable.
 2011-04-01 19:23:16 -07:00
Vadim Kurland f6f28b983c see #2225 the GUI should open first non-standard library when user cereates new file 2011-04-01 18:57:24 -07:00
Vadim Kurland 8284337b2b some minor formatting 2011-04-01 18:39:06 -07:00
Vadim Kurland b21a9b24ab * FWObject.cpp (shallowDuplicate): see #2286 "Crash when closing 
file". The GUI crashed if user imported iptables or pix
configuration, then deleted a rule and tried to close project
window.
 2011-04-01 18:38:48 -07:00
Vadim Kurland 73bf6aaee5 updated unit tests, fixed import of ssh commands, build 3617 2011-04-01 16:49:01 -07:00
Vadim Kurland df7a58eb04 * PIXImporter.cpp (mirrorServiceObjectRecursively): see #2291 The 
same service object-group that matches some tcp or udp ports can
be used to match both source and destination ports in an
access-list command. Importer should recognize when such group
is used to match source ports and create mirrored group with
potentially mirrored service objects. This should work when group
includes other groups.

test cases in asa8.3-acl.test
 2011-04-01 16:24:33 -07:00
Vadim Kurland a9b03dddad see #2306 fixed import of named service object description 2011-04-01 11:48:41 -07:00
Vadim Kurland 2ce8fd4444 fixes #2305 typo 2011-04-01 11:43:25 -07:00
Vadim Kurland 5c50ed0bfc see #2296 updated unit test files 2011-04-01 11:42:10 -07:00
Vadim Kurland b4a8266b64 see #2296 added log records for access-list lines 2011-04-01 11:39:45 -07:00
Vadim Kurland 8a7ef98a4a fixes #2307 "GUI switches 
to another file after editor panel is closed"
 2011-04-01 11:28:30 -07:00
Vadim Kurland 46984edb42 fixing build on windows: "interface" is reserved word 2011-03-31 19:44:01 -07:00
Vadim Kurland ace4ef025c fixing build on Ubuntu with older Qt 2011-03-31 18:19:21 -07:00
Vadim Kurland 3f07b14b02 delete rule sets created for acls used with nat and static commands 2011-03-31 18:13:04 -07:00
Vadim Kurland 0f9d714053 fixing windows build 2011-03-31 18:01:49 -07:00
Vadim Kurland f04dc03fc6 see #2164 added import of http commands, import should not abort on "service" commands 2011-03-31 17:58:59 -07:00
Vadim Kurland c126d30fca updated unit tests files 2011-03-31 15:09:33 -07:00
Vadim Kurland 1e72dc4085 fixes #2303 removed temporary warning saying import of pix rules is not simplemented 2011-03-31 15:08:10 -07:00
Vadim Kurland 6808fb5693 see #2302 logging errors instead of aborting 2011-03-31 15:05:17 -07:00
Vadim Kurland aba4e28e9c see #2301 added test case 2011-03-31 14:00:43 -07:00
Vadim Kurland 83e1804872 see #2300 fix import of access list with both source and destination in-line port matches 2011-03-31 13:57:18 -07:00
Vadim Kurland 46cf58e1ff fixes #2296 added line numbers in front of importer progress log lines 2011-03-31 12:40:29 -07:00
Vadim Kurland 01e45b8915 see #2296 using addMessageToLog() everywhere 2011-03-31 12:34:27 -07:00
Vadim Kurland 05c24a4719 * PIXImporterNat.cpp (buildSNATRule): import of PIX/ASA "global" 
and "nat" commands works.
 2011-03-31 12:09:35 -07:00
Vadim Kurland 94060ff659 updated unit tests, started work on the grammar for "global" and "nat" commands 2011-03-31 10:37:40 -07:00
Vadim Kurland 5c42a61246 parsing "ssh version 2" 2011-03-30 19:34:41 -07:00
Vadim Kurland 2e7377bbf6 * PIXImporterNat.cpp (buildDNATRule): import of PIX/ASA "static" 
commands works for the most part. Needs more testing.
 2011-03-30 19:30:52 -07:00
Vadim Kurland 4f811091f5 split unit tests to keep all nat tests separate; first crack and pix grammar to import nat 2011-03-29 23:07:50 -07:00
Vadim Kurland 141e80f7c1 see #87 added unit tests for PIX import 2011-03-29 19:53:52 -07:00
Vadim Kurland b4e4678c81 testing import with large real ASA config 2011-03-28 18:46:31 -07:00
Vadim Kurland 86e06e9071 pix grammar fixes to minimize nondeterminism warnings 2011-03-28 18:23:30 -07:00
Vadim Kurland 760400254c see #2225 never show deleted objects lib when user starts the GUI 2011-03-28 17:55:48 -07:00
Vadim Kurland 568e9c9912 * ObjectManipulator.cpp (getDeleteMenuState): see #2226 fixed GUI 
crash that happened when user tried to delete or cut an object
from locked library.
 2011-03-28 17:47:13 -07:00
Vadim Kurland e4b711d178 * RuleOptionsDialog.cpp (loadFWObject): see #2230 the GUI should 
allow limit-burst values of up to 10000
 2011-03-28 17:39:35 -07:00
Vadim Kurland a29ce3f54d see #2281 fixed import of log with or without log level, with or wiithout interval 2011-03-28 17:35:36 -07:00
Vadim Kurland 9da3ca447a see #2164 fixes import of ssh and telnet commands (source address or network should be recreated) 2011-03-27 23:17:00 -07:00
Vadim Kurland 6c7cb5ff00 updated unit test file, build number 3513 2011-03-27 22:06:17 -07:00
Vadim Kurland 3f8323a755 * import/PIXImporter.cpp (addLogging): see #2279 Support for import 
of ASA access-list lines with log levels and intervals
 2011-03-27 19:10:34 -07:00
Vadim Kurland f61cc9d8bf see #2283 fixes GUI crash when importer could not create firewall object 2011-03-27 18:17:14 -07:00
Vadim Kurland 1e0958384a * parsers/pix.g (tcp_udp_port_spec): see #2284 fixed import of 
tcp/udp port ranges using mix of port numbers and port names
 2011-03-27 18:03:43 -07:00
Vadim Kurland 99c845d0a8 * getServByName.cpp (getPortByName): see #2268 Making sure all tcp 
and udp port names are recognized on import; also since PIX/ASA
converts udp port numbersin "show run" output to the same names
as if they were tcp, using the same name mapping table.
 2011-03-27 17:44:57 -07:00
Vadim Kurland 59aaf53fbf see #2276 avoid resotring state when project panel gets visibilityChanged signal 2011-03-27 12:42:24 -07:00
Vadim Kurland 78f52e8689 see #2268 cifs port number is apparently 3020 2011-03-25 23:32:22 -07:00
Vadim Kurland efb6398190 * Importer.cpp (pushRule): fixes #2280 Rules created from PIX 
config import showed an icon that indicated non-default
combination of rule options, yet all rule options looked normal
when opened in the editor.
 2011-03-25 23:29:27 -07:00
Vadim Kurland 8023a23dfb * parsers/pix.g (icmp_top_level_command): see #2164 policy rules created from import of ssh, telnet and icmp commands should be on top; build 3510 2011-03-25 19:41:01 -07:00
Vadim Kurland 60d0c4e308 * parsers/pix.g (icmp_top_level_command): see #2164 Implemented 
import of "ssh", "telnet" and "icmp" PIX/ASA commands. These
commands are imported as regular rules in the main Policy ruleset.
 2011-03-25 19:31:06 -07:00
Vadim Kurland 5bfcc226cb * PIXImporter.cpp (finalize): see #2277 "Create policy objects for 
ASA access-lists that are not applied in an access-group". Policy
rule set will be created and populated with rules found in the
corresponding access-list even if this access-list is not applied
to an interface with access-group command.
 2011-03-25 16:02:15 -07:00
Vadim Kurland b89afcc87a * parsers/pix.g (tcp_udp_rule_extended): see #2273 Improvements in 
the parser for PIX/ASA configs to make it recognize object-group
and named object names used to define source port, destination
address or destination port in "access-list ... tcp|udp" rules,
including ambiguous situation when an object-group appears after
source address specification because this group can define either
source port or destination address.
 2011-03-25 15:34:29 -07:00
Vadim Kurland 704be1f951 clean-up in pix grammar for fewer nondeterminism warnings 2011-03-24 21:07:58 -07:00
Vadim Kurland 1673e3f213 pix parser recognizes "interface <label>" in access lists 2011-03-24 20:11:12 -07:00
Vadim Kurland 410b895796 parsing access-list "extended" and "standard" 2011-03-24 19:19:58 -07:00
Vadim Kurland e3fa57054a import of acl works, but there could be some missing parts 2011-03-24 19:07:41 -07:00
Vadim Kurland f2864f061c see #2263 do not generate object-group service statements with references to named objects 2011-03-24 18:03:13 -07:00
Vadim Kurland 3f0f6a2aa4 * IOSImporter.cpp (createTCPUDPServicePair): see #2267 added 
support for import of object-group and service-object statements
of type "tcp-udp" (these get imported as service group object with
two tcp and udp service objects).
 2011-03-24 17:04:16 -07:00
Vadim Kurland c533b74e8e * getServByName.cpp (getPortByName): see #2268 updated list of 
named tcp and udp ports recognized by the importer for Cisco ASA.
It is still unclear what port does the name "cifs" correspond to.
 2011-03-24 12:48:04 -07:00
Vadim Kurland 72370646a6 checking in updated unit tests after changes in handling port ranges for IOS and changes for better deduplication of networks and address ranges in importer 2011-03-23 23:54:55 -07:00
Vadim Kurland 1612ad88cd adding test file with some acl tests 2011-03-22 20:31:43 -07:00
Vadim Kurland 48179df4d4 first attempt at access-list import for pix/asa. not done yet 2011-03-22 20:31:16 -07:00
Vadim Kurland 2ebad6b511 * parsers/pix.g (port_object): see #2234 added support for import 
of "obejct-group service name tcp|udp" constructs in ASA 8.3 with
subsequent "port-object" statements.
 2011-03-22 17:41:42 -07:00
Vadim Kurland 90f6689886 fixes pix compiler crash when dynamic interface is used in ODst of a nat rule 2011-03-22 16:03:31 -07:00
Vadim Kurland da317dd151 fixes #2261 Crash when expanding Standard Library 2011-03-22 15:36:49 -07:00
Vadim Kurland 5a83ec15ff overloaded t error reporting functions in all grammars to make errors appear in the importer log 2011-03-21 19:56:34 -07:00
Vadim Kurland d4b79a1d35 see #2260 tested neq 2011-03-21 14:21:51 -07:00
Vadim Kurland a6b873a313 see #2252 #2258 fixed crash #2258; imported port ranges are adjusted to make tcp/udp service objects port-range-inclusive 2011-03-21 14:04:03 -07:00
Vadim Kurland 0e3bf10cb9 see #2252 compilers for iosacl and pix automatically increment/decrement port range boundaries to make tcp/udp port ranges defined in tcp/udp service objects inclusive 2011-03-21 12:56:37 -07:00
Vadim Kurland 63391fefda see #2257 added comment in the grammar 2011-03-21 12:16:54 -07:00
Vadim Kurland 5b4456a28c see #2257 in case of a "service" statement with unknown service name, create a placeholder object and add a note to its comment 2011-03-21 12:15:18 -07:00
Vadim Kurland 3f4dfd7ebc see #2257 parser should detect "service " statements that use service name it does not recognize and issue a warning 2011-03-21 12:00:33 -07:00
Vadim Kurland f3ce898d6c see #2257 fixed parsing of emty interface definitions and "no" commands inside interface context 2011-03-20 16:11:47 -07:00
Vadim Kurland 57ba766183 see #2257 fixed parsing of "name <ipv6> name" line; build 3505 2011-03-20 16:00:16 -07:00
Vadim Kurland d35e9f201f a fix to fix windows build 2011-03-20 13:15:53 -07:00
Vadim Kurland da2deee052 * ImportFirewallConfigurationWizard.cpp (accept): see #2253 
"importer should not creates objects while still in the middle of
the wizard". Importer wizard creates new objects in the object
tree only when user clicks Finish and abandons results if they
click Cancel.
 2011-03-20 13:11:26 -07:00
Vadim Kurland eca0a93cc7 see #2255 menu item and shortcut icon for firewall import should be disabled when current library is "Deleted objects" or is read-only 2011-03-20 12:40:06 -07:00
Vadim Kurland 1577bca547 see #2248 fixed handling of named service objects with port op "neq" 2011-03-20 12:24:49 -07:00
Vadim Kurland ccab39bcbd see #2242 making sure button Next disappears and Finish appears when import fails 2011-03-19 21:28:12 -07:00
Vadim Kurland 8fee475805 * IOSImporter.cpp (createTCPUDPNeqObject): see #2248 implemented 
import of Cisco IOS and PIX/ASA service configurations using port
operation "neq". Since object model in fwbuilder does not provide
direct support for "port not equal to" expression, this
configuration is conveted into two tcp or udp service objects with
port range extending below and above specified port and these two
service objects are then placed in a group.
 2011-03-19 20:54:08 -07:00
Vadim Kurland 07fb9a3bfc see #2242 fix crash when ASA import was attempted into locked library 2011-03-19 19:15:39 -07:00
Vadim Kurland 33bfd16c82 see #2250 "Object group some protocol-objects are not imported properly" 2011-03-19 19:06:16 -07:00
Vadim Kurland 57063f96b9 see #2251 implemented import of "object-group icmp-object" staements (pre-ASA 8.3) 2011-03-19 18:54:45 -07:00
Vadim Kurland aeb652b0be see #2251 additional icmp type names for ASA, asa 8.0 test cases for object-group icmp-object 2011-03-19 18:42:50 -07:00
Vadim Kurland b158752a99 see #2240 changelog record 2011-03-19 18:26:59 -07:00