onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-14 17:09:11 +02:00
Code Issues Releases Wiki Activity
4,242 Commits 3 Branches 3 Tags
cb71c5369762a931ea96814e7f52f5ffdfe3e2f3
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Vadim Kurland cb71c53697 see #2474 whole rule is now highlighted when any cell is selected, using neutral color "silver" to highlight the rule while standard highlighting color is used to highlight selected object in the rule 2011-06-04 19:29:58 -07:00
Vadim Kurland 8d80e04420 FWWindow_editor.cpp (openEditor): this change is a part of the 
GUI usability improvements: when user double clicks on a firewall
object to open it in the editor, rule set view panel switches to
the rule set of that firewall. To decide which rule set to show,
the program scans history of the objects the user opened before in
the same GUI session and shows that firewall's rule set they
opened last. If user never opened any rule sets of this firewall,
then the first Policy object is shown. See #2465.
 2011-06-04 17:04:29 -07:00
Vadim Kurland 5888835db7 see #2454 making "any" open in the editor upon double-click; added ChangeLog record 2011-06-04 16:16:48 -07:00
Vadim Kurland 56c18e3e1e see #2454 now opening object "any" in the editor panel and showing some hand-holding text in existing "Comment" widget 2011-06-04 16:09:59 -07:00
Vadim Kurland fcdfe6dfac see #2451 Using keyboard arrows to navigate rules results in objects being opened in editor panel 2011-06-04 15:14:19 -07:00
Vadim Kurland d42403db00 fixes #2450 Double-clicking on object in rule shifts keyboard focus to object tree 2011-06-04 14:36:21 -07:00
Vadim Kurland e7dbf88530 fixes #2452 rename rule interface column default text to "any" 2011-06-04 14:31:08 -07:00
Vadim Kurland a6fda88a54 see #2473 made text appear vertically aligned across different rule cells even when they dont have any icon, e.g. "any" 2011-06-04 14:25:35 -07:00
Vadim Kurland 99cd831b75 updated unit test files 2011-06-04 13:02:42 -07:00
Vadim Kurland 8cab8f0672 see #2470 added support for set skip with a list of interface names 2011-06-04 12:57:01 -07:00
Vadim Kurland ffee2090a7 see #2471 fixed tcp service object dduplication when they have non-blank tcp flags 2011-06-04 12:31:14 -07:00
Vadim Kurland 55730e6f01 see #2403, #2467 deduplicating AttachedNetwork object 2011-06-03 23:42:47 -07:00
Vadim Kurland 30ec7d1e72 see #2472 fixed import of table definitions without file name and with shortcut network defines 2011-06-03 23:34:25 -07:00
Vadim Kurland 6d6038370c * applied patch to provide configure command line option to specify 
path to ccache. Thanks to user "a. k. huettel " on SourceForge.
 2011-06-03 20:39:38 -07:00
Vadim Kurland f330822c8c fixes #2460 resetting nat rule type in the importer; when rule type setting was left over, it affected the behavior of the compiler and broke it if user tried to single-rule compile some rules 2011-06-03 20:28:05 -07:00
Vadim Kurland 5180b43427 fixes #2469 using right attribute name for host os 2011-06-03 19:28:54 -07:00
Vadim Kurland 33259ebf81 see #2460 added test for the nat rule with multiple objects in TDst; looks like it works 2011-06-03 19:10:40 -07:00
Vadim Kurland 6a9fdbf3af NATCompiler_pf.cpp (_expand_addr): see #2455 NAT Compiler for PF 
should use "(interface)" syntax to the right of "->" in NAT rules.
This now works for all interfaces, including those that have ip
addresses in fwbuilder configuration, when interface object appears in
"Translated Source" in a nat rule. When firewall object appears in
"Translated Source", it gets replaced with a set of its interfaces
which also get translated into "-> (interface)".
 2011-06-03 18:59:44 -07:00
Vadim Kurland 15bab71f49 * NATCompiler_ipt.cpp (compile): see #2456 Added support for 
single object negation in "Inbound Interface" and "Outbound
Interface" columns in compiler for iptables.

* NATCompiler_pf.cpp (compile): see #2456 Added support for single
object negation in "Interface" rule element of PF NAT rules. Now
compiler can produce PF commands such as "nat on ! em0 ... " (for
PF <4.7) or "match on ! em0 ..." (for PF >= 4.7)

* Compiler.cpp (singleObjectNegation::processNext): moved rule
processor that processes single object negation in any rule
element to the base class Compiler.
 2011-06-03 17:54:14 -07:00
Vadim Kurland 22b812fd4a see #2438 fixed grammar to match 1024:65535 2011-06-03 08:57:21 -07:00
Vadim Kurland 3b130a090a realistic test file for scrub commands for PF v4.6 and newer 2011-06-02 22:15:29 -07:00
Vadim Kurland 02b51d5dae set version to 5.0.0 build 3547 2011-06-02 21:31:57 -07:00
Vadim Kurland b86900cc54 see #2464 implemented import of "set timeout" commands 2011-06-02 11:38:13 -07:00
Vadim Kurland d825133481 removing failed attempt to parse ifconfig output 2011-06-02 10:33:40 -07:00
Vadim Kurland 58eb1a865e see #2394 using InterfaceProperties class to guess where WORD is an interface name or host name; Lexer generates IPV6 token for "1000:1010" port range configuration, could not find a way to fix this in the lexer so using this token to parse port ranges in the parser; added unit test for host "from" and "to" matches, including interface name and host name matches 2011-06-01 23:44:53 -07:00
Vadim Kurland d1f83311f1 see #2461 parser and importer for ifconfig output. Linux ifconfig import works, BSD ifconfig import does not 2011-05-31 23:04:57 -07:00
Vadim Kurland 52ea731f92 refactored useful classes AddressSpec, PortSpec, InterfaceSpec, IcmpSpec and RouteSpec to separate modules so they can be used with other installers 2011-05-31 16:31:05 -07:00
Vadim Kurland 564500768e see #2458, #2459 import of "rdr", "no nat", "no rdr" rules 2011-05-31 12:55:55 -07:00
Vadim Kurland fd7c3601ba see #2449 unit test for nat rules 2011-05-30 22:03:35 -07:00
Vadim Kurland f9f78fe7bd using "port 1000:*" in PF nat commands 2011-05-30 21:59:40 -07:00
Vadim Kurland 2f3f509dfe see #2449 better error message for "source-hash" with options 2011-05-30 21:58:06 -07:00
Vadim Kurland 1ed2581dd1 see #2449 import of "nat" rules. First implementation. Restrictions are listed in ChangeLog 2011-05-30 21:49:46 -07:00
Vadim Kurland 3a6c3dfa09 fixed unit tests ; fixed import of port ranges 2011-05-29 23:41:02 -07:00
Vadim Kurland ee6723a05d fixes #2429 fixed common error message shown when importer could not create firewall object 2011-05-29 21:49:18 -07:00
Vadim Kurland 2f075efd81 added unit test files 2011-05-29 21:48:51 -07:00
Vadim Kurland 5da32dfb2c added unit tests skeleton for PF import; fixed warning that appeared at the end of import, saying no rules have been created 2011-05-29 21:39:44 -07:00
Vadim Kurland 77560a735b see #2446 fixed deduplication of address table objects 2011-05-29 14:33:21 -07:00
Vadim Kurland ba53d7b8f5 see #2447 implemented import of parameters for action "block" 2011-05-29 13:38:36 -07:00
Vadim Kurland 3a88a0cbc5 user-specified parameter for action Reject takes precedence over automatically determined action based on the protocol. If user chooses one of the icmp responses, it should be used even with tcp (we used to force return-rst in that case) 2011-05-29 13:36:55 -07:00
Vadim Kurland aac598f1cc see #2445 fixed import of tcp/udp ports defined by names; still need to test all possible names to make sure mappings work 2011-05-28 09:27:27 -07:00
Vadim Kurland a3a07b4b42 see #2394 documenting import limitations in ChangeLog 2011-05-27 14:50:28 -07:00
Vadim Kurland ef3102aa6a added .gitignore for PF import tests 2011-05-27 14:45:08 -07:00
Vadim Kurland 83fc99f076 see #2435 tcp flags parsing 2011-05-27 14:35:37 -07:00
Vadim Kurland 8082f602b3 see #2436 fixed handling of the synproxy state option, minor tweaks to the grammar 2011-05-27 12:37:44 -07:00
Vadim Kurland afdc3707de fixes #2442 pre-processor removed the very last "\n" from the input stream which broke parser 2011-05-27 12:35:33 -07:00
Vadim Kurland adde1d534c see #2436 setting stateless/stateful rule option depending on combination of the "state" keyword and user-chosen version 2011-05-27 12:20:30 -07:00
Vadim Kurland 3b229be520 see #2436, #2435 added GUI controls to let user choose host OS and version as part of the PF import process. Using this information to configure firewall object 2011-05-27 11:38:29 -07:00
Vadim Kurland 765060c29c see #2403 added test case file; fixed import of icmp services, added test case file; other fixes 2011-05-26 22:30:07 -07:00
Vadim Kurland e89cc24466 see #2403 added ability to import clause en0:network; stubbed import of en0:broadcast 2011-05-26 21:29:12 -07:00
Vadim Kurland e10ab65393 see #2394 creating policy rules with src and dst populated; parsing and creating address tables and groups of addresses 2011-05-25 23:57:27 -07:00
Vadim Kurland 439f8240ba see #2394 checking pf.conf file before import to determine if it is designed in the style not using keyword "quick". We can not import config like that 2011-05-24 23:01:41 -07:00
Vadim Kurland 12abcf9533 minimal grammar to match "from" and "to", both addresses and ports 2011-05-22 23:17:05 -07:00
Vadim Kurland 9be69950eb preprocessor for the pf.conf file: unfolging long lines and macro substitutions 2011-05-21 20:12:39 -07:00
Vadim Kurland 64661383cc Merge branch 'development' into pf_import 2011-05-20 16:22:19 -07:00
Vadim Kurland bf41a75454 build 3544 2011-05-20 10:33:22 -07:00
Vadim Kurland ad73a04eae fixes #2421 windows build failure 2011-05-17 13:56:25 -07:00
Vadim Kurland 24314576f4 see #2420 fixed the function (forgot to return value) 2011-05-17 12:45:48 -07:00
Vadim Kurland c91740d366 build 3543 2011-05-17 12:00:43 -07:00
Vadim Kurland ea7f28e1ef * FWObjectDatabase_tree_ops.cpp (merge): see #2420 "Crash when 
selecting New Firewall and existing firewall has interface that is
locked". Fixed GUI crash that happened on some operations if an
object in the tree was locked. For example, if the user locked an
interface of one of the firewall objects that then proceeded to
create new firewall object, the GUI would crash. The problem was
not limited to locking specifically interface objects.
 2011-05-17 11:56:21 -07:00
Vadim Kurland 6dcf4026c6 see #2408 catching exceptions in FWBApplication::notify() 2011-05-17 10:56:16 -07:00
Vadim Kurland 2e11bc22da pf import: first draft of the grammar (still does nothing useful), importer class skeleton 2011-05-17 10:05:33 -07:00
Vadim Kurland 25bf50d6a0 fixes #2401 fixed typo 2011-05-15 23:04:01 -07:00
Vadim Kurland 4eb655a9ea see #2415 call notify() from undo/redo methods of FWCmdRuleNegateRE command 2011-05-15 23:01:59 -07:00
Vadim Kurland ac4e1bfb62 see #2411 implemented import of iptables rules with target CLASSIFY 2011-05-15 22:47:55 -07:00
Vadim Kurland b13e56d7d3 see #2414 permit menu item delete for the AttachedNetworks object 2011-05-15 22:26:46 -07:00
Vadim Kurland edd7f352d0 see #2413, #2414 do not allow user to copy/paste or duplicate AttachedNetworks object 2011-05-15 19:25:31 -07:00
Vadim Kurland d2e74f445d minor tweak for the test - added "catch all" rule in ipv6 branch to make sure it compiles for ipv6 2011-05-15 12:04:24 -07:00
Vadim Kurland 7739ebbcd2 adding missing files 2011-05-15 10:48:58 -07:00
Vadim Kurland 04545f9818 applied patch per SF bug 3302219 
"unit tests are badly portable"
 2011-05-14 22:47:37 -07:00
Vadim Kurland e149666e51 updated unit test data files 2011-05-14 22:16:46 -07:00
Vadim Kurland 1199fd926a see #2405 "Tag and classify actions dont work properly with branches". 
When branching rule points to a rule set that has rules with Tag and
Classify options, branching should occur in mangle table even when
checkbox "create branch in mangle table" is not checked. The fix in
this change is tentative as it creates branch in chains PREROUTING,
POSTROUTING and OUTPUT. Since target CLASSIFY is only allowed in
POSTROUTING, this may create conflict. Need to test more.
 2011-05-14 15:46:23 -07:00
Vadim Kurland c8cc37a6f1 see #1580 re-ran tests 2011-05-14 15:45:10 -07:00
Vadim Kurland f0dc79359e * AttachedNetworks.cpp (AttachedNetworks): see #1580 New object 
type: network object that automatically matches subnets an
interface is attached to. The object can be a child of an
interface. The object is optional and is not created automatically
for all interfaces; user can add it using context menu associated
with an interface. Dialog for this object allows editing of the
name and comment. List of network addresses represented by this
object is always generated automatically. Compiler for PF
translates this object to "en0:network" construct that is
supported by PF. Compiler for iptables expands it to the list of
ipv4 and ipv6 networks defined by the addresses of the parent
interface if interface has static addresses. If interface is
confgiured as "dynamic" and has no address in fwbuilder, then
compiler treats AttachedNetworks object as run-time and uses shell
function to determine network addresses during activation of the
firewall script. Compilers for other firewall platforms always
treat this object as compile-time and abort if it is used with
dynamic interface.
 2011-05-14 14:44:00 -07:00
Vadim Kurland 6f9add86c3 * PolicyCompiler_ipt.cpp (processNext): see #2402 "Tag action 
should be done in PREROUTING so it can be acted on later". If a
rule has both tagging and classification options, the rule should
be split so that iptables command doing tagging goes in PREROUTING
and rule doing classification goes into POSTROUTING chain.
;
 2011-05-13 18:21:56 -07:00
Vadim Kurland a787f35fd0 see #2401 "Deprecating 
Route option for iptables"
 2011-05-13 16:14:34 -07:00
Vadim Kurland 2b67a0a491 see #2399, #2340 rules that require tagging, classification or routing are now split so that regular actions such as Accept are implemented using normal rules in the table "filter" and rules in table "mangle" only implement tagging, classification and routing. See ChangeLog for longer description 2011-05-13 13:06:42 -07:00
Vadim Kurland dd061e548f version 4.3.0.3542 bumped up build number since 3541 was released as 4.2.2 2011-05-11 22:48:10 -07:00
Vadim Kurland 83cc8b4b3f merge from the latest changes in release-4.2.1 2011-05-11 22:43:01 -07:00
Vadim Kurland a2d64c733a set version to 4.2.2 
see #2395, #2396  need to call fixTree() to fix pointers to the root of the tree after merge()
 2011-05-11 09:53:11 -07:00
Vadim Kurland e706c96473 v 4.3.0.3541; merged from multiple_actions 2011-05-10 16:33:34 -07:00
Vadim Kurland 7ef3e583e5 see #2367 added test cases for options tag, classify and route and combinations - test object firewall111 2011-05-10 14:57:12 -07:00
Vadim Kurland ada42c100a see #2367 removed debugging in xslt script, set version to 4.3.0 2011-05-10 14:03:47 -07:00
Vadim Kurland c3bcd6a9ef see #2367 using correct path to the "platform" attribute of the firewall object; tested upgrade path 4.1.3 -> 4.2.1 -> 4.3.0 to make sure all rules get converted correctly 2011-05-10 13:57:21 -07:00
Vadim Kurland 880cfb13fc * PolicyCompiler_pf_writers.cpp (_printQueue): see #2390 Classify 
does not generate "queue" string for rules created in V4.2.1.3538
This completes the fix for the bug #2385.
 2011-05-06 18:36:23 -07:00
Vadim Kurland 5a85c2d669 see #2367 ipfw actions queue,pipe and divert are terminating so we do not need to add permit to the generated command 2011-05-06 18:21:41 -07:00
Vadim Kurland 61929176e1 see #2367 no need to split iptables rules with option route because it is terminating by default; checking platform in xslt transformation to dtd21 to correctly set action 2011-05-06 18:11:52 -07:00
Vadim Kurland 7f2dbe58e9 See #2367 upgraded all test files to the latest dtd v21 2011-05-06 16:07:55 -07:00
Vadim Kurland b33cc80ad8 see #2367 rules with action Continue can be shadowed but can not shadow other rules 2011-05-06 16:07:17 -07:00
Vadim Kurland 1c5fbb98a5 fixed xslt script dtd20 -> dtd21 to handle pf_classify_terminating properly 2011-05-06 15:10:48 -07:00
Vadim Kurland 6fd2d6df2c updated unit test files to the latest DTD version 2011-05-05 22:26:44 -07:00
Vadim Kurland 25c887595a updated unit test files to the latest DTD version 2011-05-05 22:10:05 -07:00
Vadim Kurland 51774a5bf5 re-ran tests, checking in updated test files 2011-05-05 20:31:41 -07:00
Vadim Kurland 49e65c2775 see #2367 upgraded unit test files and made sure tests pass. Some chain names have changed after this change but overall script structure has improved. Still need to add more tests for various combinations of Classify, Tag and Route options with different actions 2011-05-03 20:43:38 -07:00
Vadim Kurland 48e32aef5d see #2367 fixed tag and negation combination for iptables; checking for broken tag configuration in rule set view 2011-05-03 16:32:48 -07:00
Vadim Kurland c2d3ac5bc5 see #2367 auto-upgrade transformation for DTD 19 2011-05-03 16:04:36 -07:00
Vadim Kurland 6da4d79543 see #2367 auto-upgrade transformation for DTD 19 2011-05-03 15:58:58 -07:00
Vadim Kurland a694b9a93d merged latest changes from development branch 2011-05-03 11:48:20 -07:00
Vadim Kurland cb09818f44 build 3536 2011-05-03 11:35:06 -07:00
Vadim Kurland 350c40030e * newFirewallDialog.cpp (finishClicked): see #2380 "Firewall 
object is created in the middle of the "new firewall" wizard and
clicking Back creates two firewall objects". If user chose to
create new firewall object from a template and clicked Back after
choosing the template, the program actually created two firewall
objects but only one was visible in the tree.
 2011-05-03 11:28:13 -07:00
Vadim Kurland 13a897452d * PolicyCompiler_ipt.cpp (processNext): see #2367 "Multiple 
actions per policy rule". Options "Tag", "Classify" and "Route"
work with iptables in a combination with any action. This
implementation has one restriction: option Route can not be used
in combination with options Tag or Classify and any action that is
not Continue. This is because option Route can yield rules in
PREROUTING or POSTROUTING chains that are also used by options Tag
and Classify. For this combination we create two user-defined
chains that perform routing and tagging (or classification). In
case of a terminating action both chains end with it. This means
if one matches the packet, the other is never going to see it.
Non-terminating action "Continue" does not create this problem.
This limitation may be removed in future versions of fwbuilder.
 2011-05-03 10:30:55 -07:00