onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-03-21 10:47:16 +01:00
Code Issues Releases Wiki Activity
fwbuilder/src/ipt/ipt.cpp
Vadim Kurland 9a1d02f1ee 2009-05-09 vadim <vadim@vk.crocodile.org> 
* ipt.cpp (main): Now that we use the same platform name for
iptables on linux, ipcop, endian, oneshield and secuwall, there is
no need in policy/nat/routing compiler classes for ipcop.
2009-05-09 23:56:12 +00:00

1338 lines
43 KiB
C++
Raw Blame History

/*
Firewall Builder
Copyright (C) 2002 NetCitadel, LLC
Author: Vadim Kurland vadim@vk.crocodile.org
$Id$
This program is free software which we release under the GNU General Public
License. You may redistribute and/or modify this program under the terms
of that license as published by the Free Software Foundation; either
version 2 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
To get a copy of the GNU General Public License, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include "../../config.h"
#include "../../build_num"
#ifdef HAVE_LOCALE_H
#include <locale.h>
#endif
#include <fstream>
#include <iostream>
#include <algorithm>
#include <functional>
#include <stdexcept>
#ifndef _WIN32
# include <unistd.h>
# include <pwd.h>
#else
# include <direct.h>
# include <stdlib.h>
# include <io.h>
#endif
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <ctype.h>
#include <assert.h>
#include <cstring>
#include <iomanip>
#include "PolicyCompiler_ipt.h"
#include "MangleTableCompiler_ipt.h"
#include "NATCompiler_ipt.h"
#include "RoutingCompiler_ipt.h"
#include "OSConfigurator_linux24.h"
#include "OSConfigurator_ipcop.h"
#include "fwcompiler/Preprocessor.h"
#include "fwbuilder/Resources.h"
#include "fwbuilder/FWObjectDatabase.h"
#include "fwbuilder/XMLTools.h"
#include "fwbuilder/FWException.h"
#include "fwbuilder/Firewall.h"
#include "fwbuilder/Interface.h"
#include "fwbuilder/Policy.h"
#include "fwbuilder/NAT.h"
#include "fwbuilder/IPv4.h"
#include "fwbuilder/IPv6.h"
#include <QApplication>
#include <QStringList>
#include <QFileInfo>
#include <QFile>
#include <QTextStream>
#include <QTextCodec>
#ifdef HAVE_GETOPT_H
#include <getopt.h>
#else
#ifdef _WIN32
#include <getopt.h>
#else
#include <stdlib.h>
#endif
#endif
#include "../common/init.cpp"
using namespace std;
using namespace libfwbuilder;
using namespace fwcompiler;
int fwbdebug = 0;
static string filename;
static string wdir;
static QString fwobjectname;
static QString fw_file_name;
static int dl = 0;
static int drp = -1;
static bool omit_timestamp = false;
static int drn = -1;
static int verbose = 0;
static bool have_dynamic_interfaces = false;
static bool test_mode = false;
static bool ipv4_run = true;
static bool ipv6_run = true;
static bool fw_by_id = false;
FWObjectDatabase *objdb = NULL;
bool prolog_done = false;
bool epilog_done = false;
static map<string,RuleSet*> branches;
QTextStream& operator<< (QTextStream &text_stream, const string &str)
{
text_stream << str.c_str();
return text_stream;
}
#ifdef _WIN32
string fs_separator = "\\";
#else
string fs_separator = "/";
#endif
class UpgradePredicate: public XMLTools::UpgradePredicate
{
public:
virtual bool operator()(const string&) const
{
cout << "Data file has been created in the old version of Firewall Builder. Use fwbuilder GUI to convert it." << std::endl;
return false;
}
};
/*
* Add indentation to each line in txt
*/
string indent(int n_spaces, const string &txt)
{
ostringstream output;
istringstream str(txt);
char line[4096];
while (!str.eof())
{
str.getline(line, sizeof(line));
output << std::setw(n_spaces) << std::setfill(' ') << " " << line << endl;
}
return output.str();
}
void assignRuleSetChain(RuleSet *ruleset)
{
string branch_name = ruleset->getName();
for (FWObject::iterator r=ruleset->begin(); r!=ruleset->end(); r++)
{
Rule *rule = Rule::cast(*r);
if (rule->isDisabled()) continue;
//rule->setStr("parent_rule_num", parentRuleNum);
if (!ruleset->isTop())
rule->setStr("ipt_chain", branch_name);
rule->setUniqueId( FWObjectDatabase::getStringId(rule->getId()) );
}
}
void findBranchesInMangleTable(Firewall*, list<FWObject*> &all_policies)
{
// special but common case: if we only have one policy, there is
// no need to check if we have to do branching in mangle table
// since we do not have any branching rules in that case.
if (all_policies.size() > 1)
{
for (list<FWObject*>::iterator i=all_policies.begin();
i!=all_policies.end(); ++i)
{
for (list<FWObject*>::iterator r=(*i)->begin();
r!=(*i)->end(); ++r)
{
PolicyRule *rule = PolicyRule::cast(*r);
FWOptions *ruleopt = rule->getOptionsObject();
if (rule->getAction() == PolicyRule::Branch &&
ruleopt->getBool("ipt_branch_in_mangle"))
{
RuleSet *ruleset = rule->getBranch();
for (list<FWObject*>::iterator br=ruleset->begin();
br!=ruleset->end(); ++br)
{
Rule *b_rule = Rule::cast(*br);
ruleopt = b_rule->getOptionsObject();
ruleopt->setBool("put_in_mangle_table", true);
}
}
}
}
}
}
/* Find rulesets that belong to other firewall objects but are
* referenced by rules of this firewall using action Branch.
*
* Important: rulesets that belong to other firewalls may be marked as
* "top rulesets", which means they should be translated into the
* built-in chains INPUT/OUTPUT/FORWARD rather then into named chain
* with the name the same as the name of the ruleset. However this
* does not make sense if we want to jump to that ruleset from a rule
* from a ruleset that belongs to the firewall we are compiling. If we
* compile such "foreighn" ruleset as "top ruleset", then we do not
* create chain we would jump to. To avoid this will reset "top
* ruleset" flag of rulesets of other firewalls referenced by
* branching rules of the firewall being compiled.
*/
void findImportedRuleSets(Firewall *fw, list<FWObject*> &all_policies)
{
list<FWObject*> imported_policies;
for (list<FWObject*>::iterator i=all_policies.begin();
i!=all_policies.end(); ++i)
{
for (list<FWObject*>::iterator r=(*i)->begin(); r!=(*i)->end(); ++r)
{
PolicyRule *rule = PolicyRule::cast(*r);
RuleSet *ruleset = NULL;
if (rule->getAction() == PolicyRule::Branch &&
(ruleset = rule->getBranch())!=NULL &&
!ruleset->isChildOf(fw))
{
ruleset->setTop(false);
imported_policies.push_back(ruleset);
}
}
}
if (imported_policies.size() > 0)
all_policies.insert(all_policies.end(),
imported_policies.begin(), imported_policies.end());
}
string dumpScript(bool nocomm, Firewall *fw,
const string& reset_script,
const string& nat_script,
const string& mangle_script,
const string& filter_script,
bool ipv6_policy)
{
ostringstream res;
ostringstream script;
string prolog_place = fw->getOptionsObject()->getStr("prolog_place");
if (fw->getOptionsObject()->getBool("use_iptables_restore"))
{
if (!reset_script.empty() && !filter_script.empty())
{
script << "echo '*filter'\n";
script << reset_script;
script << filter_script;
script << "echo COMMIT\n";
script << "\n";
}
if (!mangle_script.empty())
{
script << "echo '*mangle'\n";
script << mangle_script;
script << "echo COMMIT\n";
script << "\n";
}
if (!nat_script.empty())
{
script << "echo '*nat'\n";
script << nat_script;
script << "echo COMMIT\n";
script << "\n";
}
if (script.tellp() > 0)
{
res << "(" << "\n";
res << script.str();
res << "#" << "\n";
if (ipv6_policy)
{
res << ") | $IP6TABLES_RESTORE; IPTABLES_RESTORE_RES=$?\n";
res << "test $IPTABLES_RESTORE_RES != 0 && ";
res << "run_epilog_and_exit $IPTABLES_RESTORE_RES\n";
} else
{
res << ") | $IPTABLES_RESTORE; IPTABLES_RESTORE_RES=$?\n";
res << "test $IPTABLES_RESTORE_RES != 0 && ";
res << "run_epilog_and_exit $IPTABLES_RESTORE_RES\n";
}
}
return res.str();
} else
{
res << reset_script;
if (!nat_script.empty()) res << nat_script;
if (!mangle_script.empty()) res << mangle_script;
if (!filter_script.empty()) res << filter_script;
}
return res.str();
}
bool processPolicyRuleSet(
Firewall *fw,
FWObject *ruleset,
ostringstream &filter_table_stream,
ostringstream &mangle_table_stream,
ostringstream &automatic_rules_stream,
OSConfigurator_linux24 *oscnf,
int policy_af,
std::map<const std::string, bool> &minus_n_commands_filter,
std::map<const std::string, bool> &minus_n_commands_mangle)
{
const QString &fwobjectname = fw->getName().c_str();
int policy_rules_count = 0;
int mangle_rules_count = 0;
bool have_connmark = false;
bool have_connmark_in_output = false;
bool empty_output = true;
string prolog_place = fw->getOptionsObject()->getStr("prolog_place");
string platform = fw->getStr("platform");
string host_os = fw->getStr("host_OS");
bool flush_and_set_default_policy = Resources::getTargetOptionBool(
host_os, "default/flush_and_set_default_policy");
string platform_family = Resources::platform_res[platform]->
getResourceStr("/FWBuilderResources/Target/family");
string os_family = Resources::os_res[host_os]->
getResourceStr("/FWBuilderResources/Target/family");
Policy *policy = Policy::cast(ruleset);
assignRuleSetChain(policy);
string branch_name = policy->getName();
if (!policy->matchingAddressFamily(policy_af)) return true;
bool ipv6_policy = (policy_af == AF_INET6);
MangleTableCompiler_ipt *mangle_compiler;
mangle_compiler = new MangleTableCompiler_ipt(
objdb , fwobjectname.toUtf8().constData(),
ipv6_policy , oscnf,
&minus_n_commands_mangle );
if (!policy->isTop())
mangle_compiler->registerRuleSetChain(branch_name);
mangle_compiler->setSourceRuleSet( policy );
mangle_compiler->setRuleSetName(branch_name);
mangle_compiler->setDebugLevel( dl );
mangle_compiler->setDebugRule( drp );
mangle_compiler->setVerbose( (bool)(verbose) );
mangle_compiler->setHaveDynamicInterfaces(have_dynamic_interfaces);
if (test_mode) mangle_compiler->setTestMode();
if ( (mangle_rules_count = mangle_compiler->prolog()) > 0 )
{
mangle_compiler->compile();
mangle_compiler->epilog();
// We need to generate automatic rules in mangle
// table (-j CONNMARK --restore-mark) if CONNMARK
// target is present in any ruleset, not only in
// the top-level ruleset. So we keep global
// boolean flags for this condition which will
// become true if any ruleset has such
// rules. We'll call
// MangleTableCompiler_ipt::flushAndSetDefaultPolicy
// later if either of these flags is true after
// all rulesets have been processed.
have_connmark |= mangle_compiler->haveConnMarkRules();
have_connmark_in_output |= mangle_compiler->haveConnMarkRulesInOutput();
long m_str_pos = mangle_table_stream.tellp();
if (policy->isTop())
{
ostringstream tmp;
if (flush_and_set_default_policy)
tmp << mangle_compiler->flushAndSetDefaultPolicy();
tmp << mangle_compiler->printAutomaticRules();
if (tmp.tellp() > 0)
{
mangle_table_stream << "# ================ Table 'mangle', ";
mangle_table_stream << "automatic rules";
mangle_table_stream << "\n";
mangle_table_stream << tmp.str();
}
}
if (mangle_compiler->getCompiledScriptLength() > 0)
{
ostringstream tmp;
if (mangle_compiler->haveErrorsAndWarnings())
{
tmp << "# Policy compiler errors and warnings:" << "\n";
tmp << mangle_compiler->getErrors("# ");
}
tmp << mangle_compiler->getCompiledScript();
if (tmp.tellp() > 0)
{
mangle_table_stream << "# ================ Table 'mangle', ";
mangle_table_stream << "rule set " << branch_name << "\n";
mangle_table_stream << tmp.str();
}
}
if (m_str_pos!=mangle_table_stream.tellp())
{
mangle_table_stream << "\n";
empty_output = false;
}
}
PolicyCompiler_ipt *policy_compiler;
policy_compiler = new PolicyCompiler_ipt(
objdb,fwobjectname.toUtf8().constData(), ipv6_policy, oscnf,
&minus_n_commands_filter);
if (!policy->isTop())
policy_compiler->registerRuleSetChain(branch_name);
policy_compiler->setSourceRuleSet( policy );
policy_compiler->setRuleSetName(branch_name);
policy_compiler->setDebugLevel( dl );
policy_compiler->setDebugRule( drp );
policy_compiler->setVerbose( (bool)(verbose) );
policy_compiler->setHaveDynamicInterfaces(have_dynamic_interfaces);
if (test_mode) policy_compiler->setTestMode();
if ( (policy_rules_count=policy_compiler->prolog()) > 0 )
{
policy_compiler->compile();
policy_compiler->epilog();
if (policy_compiler->getCompiledScriptLength() > 0)
{
ostringstream tmp;
if (policy_compiler->haveErrorsAndWarnings())
{
tmp << "# Policy compiler errors and warnings:" << "\n";
tmp << policy_compiler->getErrors("# ");
}
tmp << policy_compiler->getCompiledScript();
if (tmp.tellp() > 0)
{
empty_output = false;
filter_table_stream << "# ================ Table 'filter', ";
filter_table_stream << "rule set " << branch_name << "\n";
filter_table_stream << tmp.str();
}
}
}
/* bug #2550074: "Automatic rules for filter table included twice
* in iptables". If user had two policy ruleset objects marked as
* "top" rule set, then automaitc rules were added twice. Since we
* add rules to automatic_rules_stream only in this one place, it
* is sufficient to check if the stream is empty to avoid
* duplication. Note that on windows tellp() seems to return -1
* if no data has ever been written to the stream.
*/
long auto_rules_stream_position = automatic_rules_stream.tellp();
if (policy->isTop() && auto_rules_stream_position <= 0)
{
ostringstream tmp;
if (flush_and_set_default_policy)
tmp << policy_compiler->flushAndSetDefaultPolicy();
if (!prolog_done && prolog_place == "after_flush" &&
!fw->getOptionsObject()->getBool("use_iptables_restore"))
{
tmp << "prolog_commands" << endl;
prolog_done = true;
}
tmp << policy_compiler->printAutomaticRules();
if (tmp.tellp() > 0)
{
empty_output = false;
automatic_rules_stream
<< "# ================ Table 'filter', automatic rules"
<< "\n";
automatic_rules_stream << tmp.str();
}
}
return empty_output;
}
void usage(const char *name)
{
cout << "Firewall Builder: policy compiler for "
"Linux 2.4.x and 2.6.x iptables" << endl;
cout << _("Version ") << VERSION << "-" << RELEASE_NUM << endl;
cout << _("Usage: ") << name
<< " [-x level] [-v] [-V] [-q] [-f filename.xml] [-d destdir] "
"[-m] [-4|-6] firewall_object_name" << endl;
}
int main(int argc, char **argv)
{
QApplication app(argc, argv, false);
// compilers always write file names into manifest in Utf8
QTextCodec::setCodecForCStrings(QTextCodec::codecForName("Utf8"));
QTextCodec::setCodecForLocale(QTextCodec::codecForName("Utf8"));
QStringList args = app.arguments();
if (args.size()<=1)
{
usage(argv[0]);
exit(1);
}
QString last_arg;
for (int idx=0; idx < args.size(); idx++)
{
QString arg = args.at(idx);
last_arg = arg;
if (arg == "-i")
{
fw_by_id = true;
continue;
}
if (arg == "-v")
{
verbose++;
continue;
}
if (arg == "-V")
{
usage(argv[0]);
exit(1);
}
if (arg == "-q")
{
omit_timestamp = true;
continue;
}
if (arg == "-4")
{
ipv4_run = true;
ipv6_run = false;
continue;
}
if (arg == "-6")
{
ipv4_run = false;
ipv6_run = true;
continue;
}
if (arg == "-d")
{
idx++;
wdir = string(args.at(idx).toLatin1().constData());
continue;
}
if (arg == "-f")
{
idx++;
filename = string(args.at(idx).toLatin1().constData());
continue;
}
if (arg == "-r")
{
idx++;
respath = string(args.at(idx).toLatin1().constData());
continue;
}
if (arg == "-o")
{
idx++;
fw_file_name = args.at(idx);
continue;
}
if (arg == "-xt")
{
test_mode = true;
continue;
}
if (arg == "-xp")
{
idx++;
bool ok = false;
drp = args.at(idx).toInt(&ok);
if (!ok)
{
usage(argv[0]);
exit(1);
}
continue;
}
if (arg == "-xn")
{
idx++;
bool ok = false;
drn = args.at(idx).toInt(&ok);
if (!ok)
{
usage(argv[0]);
exit(1);
}
continue;
}
}
fwobjectname = last_arg;
if (wdir.empty()) wdir="./";
if (
#ifdef _WIN32
_chdir(wdir.c_str())
#else
chdir(wdir.c_str())
#endif
) {
cerr << _("Can't change to: ") << wdir << endl;
exit(1);
}
init(argv);
try
{
new Resources(respath+FS_SEPARATOR+"resources.xml");
/* create database */
objdb = new FWObjectDatabase();
/* load the data file */
UpgradePredicate upgrade_predicate;
if (verbose) cout << _(" *** Loading data ...");
objdb->setReadOnly( false );
objdb->load( sysfname, &upgrade_predicate, librespath);
objdb->setFileName("");
FWObjectDatabase *ndb = new FWObjectDatabase();
ndb->load(filename, &upgrade_predicate, librespath);
objdb->merge(ndb, NULL);
delete ndb;
objdb->setFileName(filename);
objdb->reIndex();
if (verbose) cout << _(" done\n");
//objdb->dump(true,true);
FWObject *slib = objdb->findInIndex(FWObjectDatabase::STANDARD_LIB_ID);
if (slib && slib->isReadOnly()) slib->setReadOnly(false);
/* Review firewall and OS options and generate commands */
Firewall* fw;
if (fw_by_id)
{
// fwobjectname is actually object id
fw = Firewall::cast(
objdb->findInIndex(
objdb->getIntId(fwobjectname.toAscii().constData())));
fwobjectname = fw->getName().c_str();
}
else
fw = objdb->findFirewallByName(fwobjectname.toUtf8().constData());
FWOptions* options = fw->getOptionsObject();
string s;
if (fw_file_name.isEmpty())
fw_file_name = fwobjectname + ".fw";
/* some initial sanity checks */
list<FWObject*> l2 = fw->getByType(Interface::TYPENAME);
for (list<FWObject*>::iterator i=l2.begin(); i!=l2.end(); ++i)
{
Interface *iface=dynamic_cast<Interface*>(*i);
assert(iface);
string::size_type n;
if ( (n=iface->getName().find("*"))!=string::npos)
{
/* this is a special 'wildcard' interface. Its name must end with '*',
* it must be dynamic and should not have a child IPv4 or
* physAddress object
*/
if (n!=iface->getName().length()-1)
{
char errstr[256];
sprintf(errstr,
_("'*' must be the last character in the wildcard's interface name: '%s'."),
iface->getName().c_str() );
throw FWException(errstr);
}
/*
removed test to implement RFE #837238: "unnummbered wildcard interfaces"
if (!iface->isDyn())
{
char errstr[256];
sprintf(errstr,
_("Wildcard interface '%s' must be dynamic."),
iface->getName().c_str() );
throw FWException(errstr);
}
*/
list<FWObject*> l3=iface->getByType(physAddress::TYPENAME);
if (l3.size()>0)
{
char errstr[256];
sprintf(errstr,
_("Wildcard interface '%s' should not have a physcal address object attached to it. The physical address object will be ignored.\n"),
iface->getName().c_str() );
cerr << errstr;
for (list<FWObject*>::iterator j=l3.begin(); j!=l3.end(); ++j)
iface->remove(*j);
}
}
if ( iface->isDyn())
{
have_dynamic_interfaces=true;
iface->setBool("use_var_address",true);
list<FWObject*> l3=iface->getByType(IPv4::TYPENAME);
if (l3.size()>0)
{
char errstr[256];
for (list<FWObject*>::iterator j=l3.begin(); j!=l3.end(); ++j)
if ( objdb->findAllReferences(*j).size()!=0 )
{
sprintf(errstr,
_("Dynamic interface %s has an IP address that is used in the firewall policy rule.\n"),
iface->getName().c_str() );
throw FWException(errstr);
}
sprintf(errstr,
_("Dynamic interface %s should not have an IP address object attached to it. This IP address object will be ignored.\n"),
iface->getName().c_str() );
cerr << errstr;
for (list<FWObject*>::iterator j=l3.begin(); j!=l3.end(); ++j)
iface->remove(*j);
}
} else
{
list<FWObject*> all_addr = iface->getByType(IPv4::TYPENAME);
list<FWObject*> all_ipv6 = iface->getByType(IPv6::TYPENAME);
all_addr.insert(all_addr.begin(),
all_ipv6.begin(), all_ipv6.end());
if (iface->isRegular() && all_addr.empty() && all_ipv6.empty())
{
char errstr[256];
sprintf(errstr,_("Missing IP address for interface %s\n"),
iface->getName().c_str() );
throw FWException(errstr);
}
for (list<FWObject*>::iterator j = all_addr.begin();
j != all_addr.end(); ++j)
{
const InetAddr *ip_addr = Address::cast(*j)->getAddressPtr();
if (ip_addr && ip_addr->isAny())
{
char errstr[256];
sprintf(errstr,
"Interface %s (id=%s) has IP address %s.\n",
iface->getName().c_str(),
FWObjectDatabase::getStringId(
iface->getId()).c_str(),
ip_addr->toString().c_str());
throw FWException(errstr);
}
}
}
}
string firewall_dir = options->getStr("firewall_dir");
if (firewall_dir=="") firewall_dir="/etc";
bool debug=options->getBool("debug");
string shell_dbg=(debug)?"set -x":"" ;
string pfctl_dbg=(debug)?"-v":"";
OSConfigurator_linux24 *oscnf = NULL;
string fw_version = fw->getStr("version");
if (fw_version.empty()) fw_version = "(any version)";
string platform = fw->getStr("platform");
string host_os = fw->getStr("host_OS");
string platform_family = Resources::platform_res[platform]->
getResourceStr("/FWBuilderResources/Target/family");
string os_family = Resources::os_res[host_os]->
getResourceStr("/FWBuilderResources/Target/family");
bool supports_prolog_epilog = Resources::getTargetCapabilityBool(
platform, "supports_prolog_epilog");
if (!supports_prolog_epilog)
{
prolog_done = true;
epilog_done = true;
}
string os_variant = DISTRO;
bool flush_and_set_default_policy = Resources::getTargetOptionBool(
host_os, "default/flush_and_set_default_policy");
/* minimal sanity checking */
if (os_family == "ipcop")
{
os_variant = "ipcop";
// can't use iptables-restore with ipcop
fw->getOptionsObject()->setBool("use_iptables_restore", false);
// ipcop has its own iptables commands that accept packets
// in states ESTABLISHED,RELATED
fw->getOptionsObject()->setBool("accept_established", false);
}
if (os_family == "ipcop")
oscnf = new OSConfigurator_ipcop(
objdb , fwobjectname.toUtf8().constData(), false);
if (os_family == "linux24")
oscnf = new OSConfigurator_linux24(
objdb , fwobjectname.toUtf8().constData(), false);
if (oscnf==NULL)
throw FWException("Unrecognized host OS " +
fw->getStr("host_OS") +
" (family " + os_family+")");
/* do not put comment in the script if it is intended for linksys */
bool nocomm = Resources::os_res[fw->getStr("host_OS")]->
Resources::getResourceBool(
"/FWBuilderResources/Target/options/suppress_comments");
oscnf->prolog();
list<FWObject*> all_policies = fw->getByType(Policy::TYPENAME);
list<FWObject*> all_nat = fw->getByType(NAT::TYPENAME);
int nat_rules_count = 0;
int routing_rules_count = 0;
bool have_nat = false;
bool have_ipv6 = false;
// track chains in each table separately. Can we have the same
// chain in filter and mangle tables ? Would it be the same
// chain, i.e. do we need to create it only once or do we create
// it twice, in each table separately ?
// Using separate trackers we track and create chain in each
// table separately.
std::map<const std::string, bool> minus_n_commands_filter;
std::map<const std::string, bool> minus_n_commands_mangle;
std::map<const std::string, bool> minus_n_commands_nat;
vector<int> ipv4_6_runs;
string generated_script;
findImportedRuleSets(fw, all_policies);
findBranchesInMangleTable(fw, all_policies);
// command line options -4 and -6 control address family for which
// script will be generated. If "-4" is used, only ipv4 part will
// be generated. If "-6" is used, only ipv6 part will be generated.
// If neither is used, both parts will be done.
if (options->getStr("ipv4_6_order").empty() ||
options->getStr("ipv4_6_order") == "ipv4_first")
{
if (ipv4_run) ipv4_6_runs.push_back(AF_INET);
if (ipv6_run) ipv4_6_runs.push_back(AF_INET6);
}
if (options->getStr("ipv4_6_order") == "ipv6_first")
{
if (ipv6_run) ipv4_6_runs.push_back(AF_INET6);
if (ipv4_run) ipv4_6_runs.push_back(AF_INET);
}
for (vector<int>::iterator i=ipv4_6_runs.begin(); i!=ipv4_6_runs.end(); ++i)
{
int policy_af = *i;
bool ipv6_policy = (policy_af == AF_INET6);
/*
clear chain tracker map only between ipv4/ipv6 runs
Don't clear it between compiler runs for different
policy or nat objects for the same address family.
*/
minus_n_commands_filter.clear();
minus_n_commands_mangle.clear();
minus_n_commands_nat.clear();
/*
We need to create and run preprocessor for this address
family before nat and policy compilers, but if there are
no nat / policy rules for this address family, we do not
need preprocessor either.
*/
// Count rules for each address family
int nat_count = 0;
int policy_count = 0;
for (list<FWObject*>::iterator p=all_nat.begin();
p!=all_nat.end(); ++p)
{
NAT *nat = NAT::cast(*p);
if (nat->matchingAddressFamily(policy_af)) nat_count++;
}
for (list<FWObject*>::iterator p=all_policies.begin();
p!=all_policies.end(); ++p)
{
Policy *policy = Policy::cast(*p);
if (policy->matchingAddressFamily(policy_af)) policy_count++;
}
if (nat_count || policy_count)
{
Preprocessor* prep = new Preprocessor(
objdb , fwobjectname.toUtf8().constData(), ipv6_policy);
if (test_mode) prep->setTestMode();
prep->compile();
}
ostringstream automaitc_rules_stream;
ostringstream filter_rules_stream;
ostringstream mangle_rules_stream;
ostringstream nat_rules_stream;
bool empty_output = true;
//MangleTableCompiler_ipt *top_level_mangle_compiler = NULL;
for (list<FWObject*>::iterator p=all_nat.begin();
p!=all_nat.end(); ++p )
{
NAT *nat = NAT::cast(*p);
assignRuleSetChain(nat);
string branch_name = nat->getName();
if (!nat->matchingAddressFamily(policy_af)) continue;
// compile NAT rules before policy rules because policy
// compiler needs to know the number of virtual addresses
// being created for NAT
NATCompiler_ipt *nat_compiler;
nat_compiler = new NATCompiler_ipt(
objdb, fwobjectname.toUtf8().constData(), ipv6_policy,
oscnf, &minus_n_commands_nat);
nat_compiler->setSourceRuleSet( nat );
nat_compiler->setRuleSetName(branch_name);
nat_compiler->setDebugLevel( dl );
nat_compiler->setDebugRule( drn );
nat_compiler->setVerbose( (bool)(verbose) );
nat_compiler->setHaveDynamicInterfaces(have_dynamic_interfaces);
if (test_mode) nat_compiler->setTestMode();
if ( (nat_rules_count=nat_compiler->prolog()) > 0 )
{
nat_compiler->compile();
nat_compiler->epilog();
}
have_nat = (have_nat || (nat_rules_count > 0));
if (nat_compiler->getCompiledScriptLength() > 0)
{
nat_rules_stream << "# ================ Table 'nat', "
<< " rule set "
<< branch_name << "\n";
if (nat_compiler->haveErrorsAndWarnings())
{
nat_rules_stream << "# NAT compiler errors and "
<< "warnings:\n";
nat_rules_stream << nat_compiler->getErrors("# ");
}
if (nat->isTop())
{
if (flush_and_set_default_policy)
nat_rules_stream << nat_compiler->flushAndSetDefaultPolicy();
nat_rules_stream << nat_compiler->printAutomaticRules();
}
nat_rules_stream << nat_compiler->getCompiledScript();
nat_rules_stream << "\n";
empty_output = false;
}
}
for (list<FWObject*>::iterator p=all_policies.begin();
p!=all_policies.end(); ++p )
{
Policy *policy = Policy::cast(*p);
if (!policy->matchingAddressFamily(policy_af)) continue;
if (! processPolicyRuleSet(
fw,
policy,
filter_rules_stream,
mangle_rules_stream,
automaitc_rules_stream,
oscnf,
policy_af,
minus_n_commands_filter,
minus_n_commands_mangle)) empty_output = false;
}
if (!empty_output)
{
if (ipv6_policy)
{
have_ipv6 = true;
generated_script += "\n\n";
generated_script += "# ================ IPv6\n";
generated_script += "\n\n";
} else
{
generated_script += "\n\n";
generated_script += "# ================ IPv4\n";
generated_script += "\n\n";
}
}
generated_script += dumpScript(nocomm, fw,
automaitc_rules_stream.str(),
nat_rules_stream.str(),
mangle_rules_stream.str(),
filter_rules_stream.str(),
ipv6_policy);
}
RoutingCompiler_ipt *routing_compiler;
routing_compiler = new RoutingCompiler_ipt(
objdb , fwobjectname.toUtf8().constData() , false, oscnf );
routing_compiler->setDebugLevel( dl );
routing_compiler->setDebugRule( drp );
routing_compiler->setVerbose( verbose );
if (test_mode) routing_compiler->setTestMode();
if ( (routing_rules_count=routing_compiler->prolog()) > 0 )
{
routing_compiler->compile();
routing_compiler->epilog();
}
oscnf->generateCodeForProtocolHandlers(have_nat);
oscnf->printChecksForRunTimeMultiAddress();
oscnf->processFirewallOptions();
oscnf->configureInterfaces();
oscnf->printCommandsToAddVirtualAddressesForNAT();
/*
* now write generated scripts to files
*/
char *timestr;
time_t tm;
struct tm *stm;
tm=time(NULL);
stm=localtime(&tm);
timestr=strdup(ctime(&tm));
timestr[ strlen(timestr)-1 ]='\0';
#ifdef _WIN32
char* user_name=getenv("USERNAME");
#else
struct passwd *pwd=getpwuid(getuid());
assert(pwd);
char *user_name=pwd->pw_name;
#endif
if (user_name==NULL)
{
user_name=getenv("LOGNAME");
if (user_name==NULL)
{
cerr << _("Can't figure out your user name, aborting") << endl;
exit(1);
}
}
/*
* assemble the script and then perhaps post-process it if it should
* run on Linksys device with sveasoft firmware
*/
QString script_buffer;
QTextStream script(&script_buffer, QIODevice::WriteOnly);
script << "#!/bin/sh " << "\n";
script << _("#\n\
# This is automatically generated file. DO NOT MODIFY !\n\
#\n\
# Firewall Builder fwb_ipt v") << VERSION << "-" << BUILD_NUM << _(" \n");
if (!omit_timestamp)
{
script << _("#\n\
# Generated ") << timestr << " " << tzname[stm->tm_isdst] << _(" by ")
<< user_name << "\n#\n";
}
QFileInfo fw_file_info(fw_file_name);
script << MANIFEST_MARKER << "* "
<< fw_file_info.fileName() << "\n";
script << "#" << "\n";
script << "#" << "\n";
script << "# Compiled for " << platform << " " << fw_version << "\n";
script << "#" << "\n";
if ( !nocomm )
{
string fwcomment=fw->getComment();
string::size_type n1,n2;
n1=n2=0;
while ( (n2=fwcomment.find("\n",n1))!=string::npos )
{
script << "# " << fwcomment.substr(n1,n2-n1) << "\n";
n1=n2+1;
}
script << "# " << fwcomment.substr(n1) << "\n";
script << "#\n#\n#\n";
}
script << shell_dbg << "\n";
script << "\n";
script << "PATH=\"/sbin:/usr/sbin:/bin:/usr/bin:${PATH}\"" << "\n";
script << "export PATH" << "\n";
script << "\n";
/*
* print definitions for variables IPTABLES, IP, LOGGER. Some
* day we may add a choice of os_variant in the GUI. Right now
* paths are either default for a given os_variant, or custom
* strings entered by user in the GUI and stored in firewall
* options.
*/
script << oscnf->printPathForAllTools(os_variant);
script << oscnf->printShellFunctions(nocomm);
if (supports_prolog_epilog)
script << oscnf->printPrologEpilogFunctions(nocomm);
/*
* All functions have been defined.
* Actual script begins here
*/
script << "# See how we were called." << endl;
script << "# For backwards compatibility missing argument is equivalent to 'start'" << endl;
script << endl;
script << "test -z \"$1\" && {" << endl;
script << " $0 start" << endl;
script << " exit $?" << endl;
script << "}" << endl;
script << endl;
script << "case \"$1\" in" << endl;
script << " start)" << endl;
script << endl;
script << " " << "check_tools" << endl;
string prolog_place = fw->getOptionsObject()->getStr("prolog_place");
if (prolog_place == "") prolog_place="top";
/* there is no way to stick prolog commands between iptables
* reset and iptables rules if we use iptables-restore to
* activate policy. Therefore, if prolog needs to be ran after
* iptables flush and we use iptables-restore, we run prolog
* on top of the script.
*/
if (!prolog_done &&
(prolog_place == "top" ||
(prolog_place == "after_flush" &&
fw->getOptionsObject()->getBool("use_iptables_restore"))))
{
script << " prolog_commands" << endl;
prolog_done = true;
}
script << indent(2, oscnf->getCompiledScript());
script << "\n";
if (!prolog_done && prolog_place == "after_interfaces")
{
script << " prolog_commands" << endl;
prolog_done = true;
}
if (os_family != "ipcop")
{
script << " log '";
if (omit_timestamp)
{
script << _("Activating firewall script");
} else
{
script << _("Activating firewall script generated ")
<< timestr << " " << _(" by ")
/* timezone removed because of bug #1205665 - sometimes timezone name
* has "'" in it which confuses shell and causes an error (for
* instance French daylight savings time is "Paris, Madrid (heure
* d'ete)" where 'e' are actually accented 'e')
*
* << timestr << " " << tzname[stm->tm_isdst] << _(" by ")
*/
<< user_name;
}
script << "'" << endl;
script << endl;
}
script << indent(2, generated_script);
script << indent(2, routing_compiler->getCompiledScript());
script << indent(2, oscnf->getCompiledScript());
script << endl;
if (!epilog_done) script << " epilog_commands" << endl;
script << indent(2, oscnf->printIPForwardingCommands(nocomm));
script << endl;
// no need to do this because we now abort the script if
// iptables-restore returned an error and exit with the same
// error code. This means we can only get to this point in
// the script if iptables-restore returned "0"
//
// if (options->getBool("use_iptables_restore"))
// script << "exit $IPTABLES_RESTORE_RES";
script << endl;
script << " ;;" << endl;
script << endl;
script << "stop)" << endl;
script << " reset_iptables_v4" << endl;
if (have_ipv6) script << " reset_iptables_v6" << endl;
script << " ;;" << endl;
script << "esac" << endl;
script << endl;
QFile fw_file(fw_file_name);
if (fw_file.open(QIODevice::WriteOnly))
{
QTextStream fw_str(&fw_file);
fw_str << script_buffer;
fw_file.close();
fw_file.setPermissions(QFile::ReadOwner | QFile::WriteOwner |
QFile::ReadGroup | QFile::ReadOther |
QFile::ExeOwner |
QFile::ExeGroup |
QFile::ExeOther );
}
cout << " Compiled successfully" << std::endl << flush;
return 0;
} catch(const FWException &ex) {
cerr << "Error: " << ex.toString() << std::endl;
return 1;
#if __GNUC__ >= 3
/* need to check version because std::ios::failure does not seem to be
* supported in gcc 2.9.5 on FreeBSD 4.10 */
} catch (const std::ios::failure &e) {
cerr << "Error while opening or writing to the output file"
<< std::endl;
return 1;
#endif
} catch (const std::string &s) {
cerr << s << std::endl;
return 1;
} catch (const std::exception &ex) {
cerr << ex.what() << std::endl;
return 1;
}
catch (...) {
cerr << _("Unsupported exception") << std::endl;
return 1;
}
}
Reference in New Issue View Git Blame Copy Permalink