void CreateObjectGroupsForTSrc::packObjects(RuleElement *re,
BaseObjectGroup *obj_group)
{
if (libfwbuilder::XMLTools::version_compare(
compiler->fw->getStr("version"), "8.3")>=0)
{
// put all objects inside of the group, except for the interface
// if it belongs to the firewall
FWObject *re_interface = NULL;
for (FWObject::iterator i1=re->begin(); i1!=re->end(); ++i1)
{
FWObject *o = *i1;
FWObject *obj = o;
if (FWReference::cast(o)!=NULL)
obj = FWReference::cast(o)->getPointer();
if (Interface::isA(obj) && obj->isChildOf(compiler->fw))
{
re_interface = obj;
continue;
}
obj_group->addRef(obj);
}
re->clearChildren(false); //do not want to destroy children objects
if (re_interface)
{
// add interface back.
re->addRef(re_interface);
}
re->addRef(obj_group);
} else
{
CreateObjectGroups::packObjects(re, obj_group);
}
}
QString CompilerDriver_pix::run(const std::string &cluster_id,
const std::string &firewall_id,
const std::string &single_rule_id)
{
Cluster *cluster = NULL;
Firewall *fw = NULL;
getFirewallAndClusterObjects(cluster_id, firewall_id, &cluster, &fw);
// Copy rules from the cluster object
populateClusterElements(cluster, fw);
if (cluster)
{
// PIX failover is dfferent from VRRP and other failover protocols
// in that it does not create new virtual address. Instead, each
// unit is configured with two ip addresses, one for the active
// unit and another for standby one. When active unit fails, the
// other one assumes its address.
//
// This matters because when we use cluster object or one of its
// interfaces in rules, compiler should expand it to the set of
// addresses that includes addresses of the corresponding
// interface of both member firewalls. Method
// CompilerDriver::copyFailoverInterface adds a copy of firewall
// interface to the cluster object. This works for all firewalls,
// but for PIX we need to add copies of interfaces from both
// members.
//
FWObjectTypedChildIterator cl_iface = cluster->findByType(Interface::TYPENAME);
for (; cl_iface != cl_iface.end(); ++cl_iface)
{
FailoverClusterGroup *failover_group =
FailoverClusterGroup::cast(
(*cl_iface)->getFirstByType(FailoverClusterGroup::TYPENAME));
if (failover_group)
{
//FWObject *this_member_interface = NULL; //UNUSED
list<FWObject*> other_member_interfaces;
for (FWObjectTypedChildIterator it =
failover_group->findByType(FWObjectReference::TYPENAME);
it != it.end(); ++it)
{
FWObject *intf = FWObjectReference::getObject(*it);
assert(intf);
//if (intf->isChildOf(fw)) this_member_interface = intf; //UNUSED
//else other_member_interfaces.push_back(intf);
if (!intf->isChildOf(fw)) other_member_interfaces.push_back(intf);
}
if (!other_member_interfaces.empty())
{
for (list<FWObject*>::iterator it=other_member_interfaces.begin();
it!=other_member_interfaces.end(); ++it)
{
cluster->addCopyOf(*it, true);
}
}
}
}
}
#if 0
FWObjectTypedChildIterator iface = fw->findByType(Interface::TYPENAME);
for (; iface != iface.end(); ++iface)
{
(*iface)->dump(true, true);
}
#endif
determineOutputFileNames(cluster, fw, !cluster_id.empty(),
QStringList(""), QStringList("fw"),
QStringList(""));
FWOptions* options = fw->getOptionsObject();
QString script_buffer;
std::auto_ptr<NATCompiler_pix> n;
std::auto_ptr<PolicyCompiler_pix> c;
std::auto_ptr<RoutingCompiler_pix> r;
try
{
clearReadOnly(fw);
commonChecks2(cluster, fw);
pixClusterConfigurationChecks(cluster, fw);
// Note that fwobjectname may be different from the name of the
// firewall fw This happens when we compile a member of a cluster
current_firewall_name = fw->getName().c_str();
bool pix_acl_basic = options->getBool("pix_acl_basic");
bool pix_acl_no_clear = options->getBool("pix_acl_no_clear");
bool pix_acl_substitution = options->getBool("pix_acl_substitution");
bool pix_add_clear_statements = options->getBool("pix_add_clear_statements");
if (!pix_acl_basic && !pix_acl_no_clear && !pix_acl_substitution)
{
if ( pix_add_clear_statements ) options->setBool("pix_acl_basic",true);
else options->setBool("pix_acl_no_clear",true);
}
list<FWObject*> all_interfaces = fw->getByTypeDeep(Interface::TYPENAME);
pixSecurityLevelChecks(fw, all_interfaces);
pixNetworkZoneChecks(fw, all_interfaces);
/* Now that all checks are done, we can drop copies of cluster
* interfaces that were added to the firewall by
* CompilerDriver::populateClusterElements()
*/
list<FWObject*> copies_of_cluster_interfaces;
for (std::list<FWObject*>::iterator i=all_interfaces.begin(); i!=all_interfaces.end(); ++i)
{
Interface *iface = Interface::cast(*i);
assert(iface);
if (iface->getOptionsObject()->getBool("cluster_interface"))
copies_of_cluster_interfaces.push_back(iface);
}
while (copies_of_cluster_interfaces.size())
{
fw->remove(copies_of_cluster_interfaces.front());
copies_of_cluster_interfaces.pop_front();
}
NamedObjectsManagerPIX named_objects_manager(persistent_objects, fw);
all_interfaces = fw->getByTypeDeep(Interface::TYPENAME);
for (std::list<FWObject*>::iterator i=all_interfaces.begin();
i!=all_interfaces.end(); ++i)
{
Interface *iface = Interface::cast(*i);
assert(iface);
/*
* missing labels on interfaces
*
*/
if (iface->getLabel()=="")
{
string lbl;
if (iface->isDedicatedFailover())
{
// dedicated failover interface misses label. This
// interface can be used in failover cluster group
// or state sync group. Assign label depending on
// the function.
FWObjectTypedChildIterator it =
cluster->findByType(StateSyncClusterGroup::TYPENAME);
StateSyncClusterGroup *state_sync_group =
StateSyncClusterGroup::cast(*it);
if (state_sync_group && state_sync_group->hasMember(iface))
lbl = "state";
if (!iface->getOptionsObject()->getStr("failover_group_id").empty())
lbl = "failover";
}
if (lbl.empty())
{
if (iface->getSecurityLevel()==0) lbl="outside";
else
{
if (iface->getSecurityLevel()==100) lbl="inside";
else
{
QString l("dmz%1");
lbl = l.arg(iface->getSecurityLevel()).toStdString();
}
}
}
iface->setLabel(lbl);
}
}
/*
* now sort interfaces by their network zone "width" (that
* is, more narrow network zone should go first, interface
* with network zone "any" should be the last)
*
std::sort(fw->begin(), fw->end(), sort_by_net_zone() );
*/
try
{
AutomaticRules_cisco auto_rules(fw, persistent_objects);
auto_rules.addSshAccessRule();
} catch (FWException &ex)
{
abort(ex.toString());
}
std::auto_ptr<Preprocessor> prep(
new Preprocessor(objdb , fw, false));
if (inTestMode()) prep->setTestMode();
if (inEmbeddedMode()) prep->setEmbeddedMode();
prep->compile();
std::auto_ptr<OSConfigurator> oscnf(
new OSConfigurator_pix_os(objdb , fw, false));
if (inTestMode()) oscnf->setTestMode();
if (inEmbeddedMode()) oscnf->setEmbeddedMode();
oscnf->prolog();
oscnf->processFirewallOptions();
bool have_named_objects = false;
bool have_object_groups = false;
/* create compilers and run the whole thing */
string version = fw->getStr("version");
if (XMLTools::version_compare(version, "8.3")>=0)
n = std::auto_ptr<NATCompiler_pix>(
new NATCompiler_asa8(objdb, fw, false, oscnf.get()));
else
n = std::auto_ptr<NATCompiler_pix>(
new NATCompiler_pix(objdb, fw, false, oscnf.get()));
RuleSet *nat = RuleSet::cast(fw->getFirstByType(NAT::TYPENAME));
if (nat)
{
nat->assignUniqueRuleIds();
n->setNamedObjectsManager(&named_objects_manager);
n->setSourceRuleSet(nat);
n->setRuleSetName(nat->getName());
n->setPersistentObjects(persistent_objects);
if (inTestMode()) n->setTestMode();
if (inEmbeddedMode()) n->setEmbeddedMode();
n->setSingleRuleCompileMode(single_rule_id);
n->setDebugLevel( dl );
if (rule_debug_on) n->setDebugRule( drn );
n->setVerbose( verbose );
if ( n->prolog() > 0 )
{
n->compile();
n->epilog();
preamble_commands += n->printPreambleCommands();
clear_commands += n->printClearCommands();
have_named_objects = (have_named_objects ||
named_objects_manager.haveNamedObjects());
have_object_groups = (have_object_groups ||
named_objects_manager.haveObjectGroups());
//named_objects_manager.saveObjectGroups();
} else
info(" Nothing to compile in NAT");
}
c = std::auto_ptr<PolicyCompiler_pix>(
new PolicyCompiler_pix(objdb, fw, false, oscnf.get() , n.get()));
RuleSet *policy = RuleSet::cast(fw->getFirstByType(Policy::TYPENAME));
if (policy)
{
policy->assignUniqueRuleIds();
c->setNamedObjectsManager(&named_objects_manager);
c->setSourceRuleSet(policy);
c->setRuleSetName(policy->getName());
c->setPersistentObjects(persistent_objects);
if (inTestMode()) c->setTestMode();
if (inEmbeddedMode()) c->setEmbeddedMode();
c->setSingleRuleCompileMode(single_rule_id);
c->setDebugLevel( dl );
if (rule_debug_on) c->setDebugRule( drp );
c->setVerbose( verbose );
if ( c->prolog() > 0 )
{
c->compile();
c->epilog();
preamble_commands += c->printPreambleCommands();
clear_commands += c->printClearCommands();
have_named_objects = (have_named_objects ||
named_objects_manager.haveNamedObjects());
have_object_groups = (have_object_groups ||
named_objects_manager.haveObjectGroups());
//named_objects_manager.saveObjectGroups();
} else
info(" Nothing to compile in Policy");
}
r = std::auto_ptr<RoutingCompiler_pix>(
new RoutingCompiler_pix(objdb, fw, false, oscnf.get()));
RuleSet *routing = RuleSet::cast(fw->getFirstByType(Routing::TYPENAME));
if (routing)
{
routing->assignUniqueRuleIds();
r->setNamedObjectsManager(&named_objects_manager);
r->setSourceRuleSet(routing);
r->setRuleSetName(routing->getName());
r->setPersistentObjects(persistent_objects);
if (inTestMode()) r->setTestMode();
if (inEmbeddedMode()) r->setEmbeddedMode();
r->setSingleRuleCompileMode(single_rule_id);
r->setDebugLevel( dl );
if (rule_debug_on) r->setDebugRule( drp );
r->setVerbose( verbose );
if ( r->prolog() > 0 )
{
r->compile();
r->epilog();
} else
info(" Nothing to compile in Routing");
}
/*
* compilers detach persistent objects when they finish, this
* means at this point library persistent_objects is not part
* of any object tree.
*/
objdb->reparent(persistent_objects);
if (haveErrorsAndWarnings())
{
all_errors.push_front(getErrors("").c_str());
}
policy_script = c->getCompiledScript();
nat_script = n->getCompiledScript();
routing_script = r->getCompiledScript();
named_objects_and_groups = named_objects_manager.getNamedObjectsDefinitions();
if (c->haveErrorsAndWarnings())
all_errors.push_back(c->getErrors("C ").c_str());
if (n->haveErrorsAndWarnings())
all_errors.push_back(n->getErrors("N ").c_str());
if (r->haveErrorsAndWarnings())
all_errors.push_back(r->getErrors("R ").c_str());
if (single_rule_compile_on)
{
return formSingleRuleCompileOutput(
QString::fromUtf8(
(named_objects_and_groups +
policy_script + nat_script + routing_script).c_str()));
}
system_configuration_script = oscnf->getCompiledScript();
system_configuration_script += "\n";
clear_commands += named_objects_manager.getClearCommands() + "\n";
// system_configuration_script += preamble_commands;
// system_configuration_script += clear_commands;
script_buffer = assembleFwScript(
cluster, fw, !cluster_id.empty(), oscnf.get());
QString ofname = getAbsOutputFileName(file_names[FW_FILE]);
info("Output file name: " + ofname.toStdString());
QFile fw_file(ofname);
if (fw_file.open(QIODevice::WriteOnly))
{
QTextStream fw_str(&fw_file);
fw_str << script_buffer;
fw_file.close();
fw_file.setPermissions(QFile::ReadOwner | QFile::WriteOwner |
QFile::ReadGroup | QFile::ReadOther |
QFile::ExeOwner |
QFile::ExeGroup |
QFile::ExeOther );
info(" Compiled successfully");
} else
{
QString err(" Failed to open file %1 for writing: %2; Current dir: %3");
abort(err.arg(fw_file.fileName())
.arg(fw_file.error()).arg(QDir::current().path()).toStdString());
}
if (!all_errors.isEmpty())
status = BaseCompiler::FWCOMPILER_WARNING;
}
catch (FWException &ex)
{
status = BaseCompiler::FWCOMPILER_ERROR;
return QString::fromUtf8(ex.toString().c_str());
}
return "";
}
bool ProjectPanel::event(QEvent *event)
{
if (event->type() >= QEvent::User)
{
fwbUpdateEvent *ev = dynamic_cast<fwbUpdateEvent*>(event);
int event_code = event->type() - QEvent::User;
QString data_file = ev->getFileName();
int obj_id = ev->getObjectId();
FWObject *obj = db()->findInIndex(obj_id);
if (fwbdebug)
qDebug() << this
<< "rcs:"
<< rcs
<< "rcs->getFileName():"
<< QString((rcs!=NULL) ? rcs->getFileName() : "")
<< "file:"
<< data_file
<< "event:"
<< ev->getEventName()
<< "object:"
<< ((obj!=NULL) ? QString::fromUtf8(obj->getName().c_str()) : "")
<< "(" << ((obj!=NULL) ? obj->getTypeName().c_str() : "") << ")"
<< "id=" << ((obj!=NULL) ? obj->getId() : -1);
if (event_code == UPDATE_GUI_STATE_EVENT && mdiWindow != NULL)
{
m_panel->om->updateCreateObjectMenu(getCurrentLib());
ev->accept();
return true;
}
if ((rcs && rcs->getFileName() == data_file) ||
(!rcs && data_file.isEmpty()))
{
switch (event_code)
{
case RELOAD_OBJECT_TREE_EVENT:
registerTreeReloadRequest();
ev->accept();
return true;
case RELOAD_OBJECT_TREE_IMMEDIATELY_EVENT:
m_panel->om->reload();
ev->accept();
return true;
case RELOAD_RULESET_EVENT:
registerRuleSetRedrawRequest();
// update rule set title as well
//updateFirewallName();
ev->accept();
return true;
case MAKE_CURRENT_RULE_VISIBLE_IN_RULESET_EVENT:
{
RuleSetView* rsv = getCurrentRuleSetView();
if (rsv) rsv->makeCurrentRuleVisible();
ev->accept();
return true;
}
case RELOAD_RULESET_IMMEDIATELY_EVENT:
redrawRuleSets();
//reopenFirewall();
// update rule set title as well
//updateFirewallName();
ev->accept();
return true;
}
if (obj == NULL) return false;
switch (event_code)
{
case DATA_MODIFIED_EVENT:
{
// This event does not trigger any updates in the UI,
// this purely data structure update event.
FWObject *p = obj;
while (p && Firewall::cast(p)==NULL) p = p->getParent();
Firewall *f = Firewall::cast(p);
// when user locks firewall object, this code tries to
// update last_modified timestamp in it because it
// depends on itself. Dont.
if (f && !f->isReadOnly())
{
f->updateLastModifiedTimestamp();
QCoreApplication::postEvent(
mw, new updateObjectInTreeEvent(data_file, f->getId()));
}
registerModifiedObject(obj);
QCoreApplication::postEvent(mw, new updateGUIStateEvent());
ev->accept();
return true;
}
case UPDATE_OBJECT_EVERYWHERE_EVENT:
{
Rule *rule = NULL;
RuleSet* current_ruleset = NULL;
RuleSetView* rsv = getCurrentRuleSetView();
RuleSetModel* md = NULL;
if (rsv)
{
md = (RuleSetModel*)rsv->model();
current_ruleset = md->getRuleSet();
}
if (RuleElement::cast(obj)) rule = Rule::cast(obj->getParent());
if (Rule::cast(obj)) rule = Rule::cast(obj);
if (rule && current_ruleset && md && rule->isChildOf(current_ruleset))
{
md->rowChanged(md->index(rule, 0));
ev->accept();
return true;
}
if (rule)
{
QCoreApplication::postEvent(
this, new showObjectInRulesetEvent(data_file, obj_id));
ev->accept();
return true;
}
if (rsv) rsv->updateObject(obj);
if (Library::cast(obj))
{
m_panel->om->updateLibName(obj);
m_panel->om->updateLibColor(obj);
}
QCoreApplication::postEvent(
mw, new updateObjectInTreeEvent(data_file, obj_id));
// QCoreApplication::postEvent(
// this, new reloadRulesetEvent(data_file));
ev->accept();
return true;
}
case OBJECT_NAME_CHANGED_EVENT:
{
objectNameChangedEvent *name_change_event =
dynamic_cast<objectNameChangedEvent*>(event);
m_panel->om->updateObjectInTree(obj);
if (name_change_event->rename_children)
{
// This performs automatic renaming of child objects if necessary
m_panel->om->autoRenameChildren(obj, name_change_event->old_name);
}
ev->accept();
return true;
}
case UPDATE_LAST_COMPILED_TIMESTAMP_EVENT:
if (rcs && !rcs->isRO() &&
Firewall::cast(obj) && !obj->isReadOnly())
{
Firewall::cast(obj)->updateLastCompiledTimestamp();
QCoreApplication::postEvent(
mw, new updateObjectInTreeEvent(data_file, obj_id));
ev->accept();
return true;
}
break;
case UPDATE_LAST_INSTALLED_TIMESTAMP_EVENT:
if (rcs && !rcs->isRO() &&
Firewall::cast(obj) && !obj->isReadOnly())
{
Firewall::cast(obj)->updateLastInstalledTimestamp();
QCoreApplication::postEvent(
mw, new updateObjectInTreeEvent(data_file, obj_id));
ev->accept();
return true;
}
break;
}
// Events below this should only be processed if
// ProjectPanel has been attached to an MDI window. There
// is no MDI window right after project panel is created
// but some operations may already be performed. See
// FWWindow::fileOpen where ProjectPanel is cfeated and
// file is opened before MDI window is attached. So the UI
// update events below will only be processed if MDI
// window exists.
if (mdiWindow == NULL) return false;
switch (event->type() - QEvent::User)
{
case INSERT_OBJECT_IN_TREE_EVENT:
{
FWObject *parent =
db()->findInIndex(
dynamic_cast<insertObjectInTreeEvent*>(event)->parent_id);
m_panel->om->insertSubtree(parent, obj);
ev->accept();
return true;
}
case REMOVE_OBJECT_FROM_TREE_EVENT:
{
m_panel->om->removeObjectFromTreeView(obj);
ev->accept();
return true;
}
case ADD_TREE_PAGE_EVENT:
m_panel->om->addLib(obj);
ev->accept();
return true;
case REMOVE_TREE_PAGE_EVENT:
m_panel->om->removeLib(obj);
ev->accept();
return true;
case UPDATE_OBJECT_IN_TREE_EVENT:
registerObjectToUpdateInTree(obj, false);
ev->accept();
return true;
case UPDATE_OBJECT_AND_SUBTREE_IN_TREE_EVENT:
registerObjectToUpdateInTree(obj, true);
ev->accept();
return true;
case UPDATE_OBJECT_AND_SUBTREE_IMMEDIATELY_EVENT:
m_panel->om->updateObjectInTree(obj, true);
ev->accept();
return true;
case OPEN_RULESET_EVENT:
openRuleSet(obj);
// update rule set title as well
//updateFirewallName();
ev->accept();
return true;
case OPEN_RULESET_IMMEDIATELY_EVENT:
openRuleSet(obj, true);
// update rule set title as well
//updateFirewallName();
ev->accept();
return true;
case SELECT_RULE_ELEMENT_EVENT:
{
RuleSetView* rsv = getCurrentRuleSetView();
rsv->selectRE(Rule::cast(obj),
dynamic_cast<selectRuleElementEvent*>(event)->column_type);
rsv->setFocus(Qt::OtherFocusReason);
ev->accept();
return true;
}
case SHOW_OBJECT_IN_RULESET_EVENT:
{
// if obj is child of RuleElement (i.e. a reference object)
FWReference *ref = FWReference::cast(obj);
if (ref)
{
RuleSet* current_ruleset = NULL;
RuleSetView* rsv = getCurrentRuleSetView();
RuleSetModel* md = NULL;
if (rsv)
{
md = (RuleSetModel*)rsv->model();
current_ruleset = md->getRuleSet();
}
if (current_ruleset && obj->isChildOf(current_ruleset))
{
clearManipulatorFocus();
rsv->selectRE(ref);
rsv->setFocus(Qt::OtherFocusReason);
} else
{
FWObject *rs = obj;
while (rs && RuleSet::cast(rs)==NULL) rs = rs->getParent();
if (rs)
{
// reopen rule set right now, before we post event
// to show the object in it.
openRuleSet(rs);
QCoreApplication::postEvent(
this, new showObjectInRulesetEvent(data_file, obj_id));
}
}
ev->accept();
return true;
}
// if obj is RuleElement - select its first element
RuleElement *re = RuleElement::cast(obj);
if (re && re->size() > 0)
{
QCoreApplication::postEvent(
this, new showObjectInRulesetEvent(data_file, obj->front()->getId()));
ev->accept();
return true;
}
// if obj is Rule - select its comment (the only common rule element)
Rule *rule = Rule::cast(obj);
if (rule)
{
RuleSet* current_ruleset = NULL;
RuleSetView* rsv = getCurrentRuleSetView();
RuleSetModel* md = NULL;
if (rsv)
{
md = (RuleSetModel*)rsv->model();
current_ruleset = md->getRuleSet();
}
if (current_ruleset && rule->isChildOf(current_ruleset))
{
rsv->selectRE(rule, ColDesc::Comment);
rsv->setFocus(Qt::OtherFocusReason);
ev->accept();
return true;
} else
{
// this rule does not belong to the current ruleset
// reopen rule set right now, before we post event
// to show the object in it.
openRuleSet(rule->getParent(), true);
QCoreApplication::postEvent(
this, new showObjectInRulesetEvent(data_file, obj->getId()));
}
ev->accept();
return true;
}
ev->accept();
return true;
}
case SHOW_OBJECT_IN_TREE_EVENT:
//m_panel->om->setFocus();
m_panel->om->openObjectInTree(obj);
ev->accept();
return true;
case EXPAND_OBJECT_IN_TREE:
m_panel->om->expandObjectInTree(obj);
ev->accept();
return true;
case OPEN_LIBRARY_FOR_OBJECT_EVENT:
m_panel->om->openLibForObject(obj);
ev->accept();
return true;
case CLOSE_OBJECT_EVENT:
if (RuleSet::cast(obj))
{
if (visibleRuleSet == obj)
{
clearFirewallTabs();
closeRuleSet(obj);
}
} else
{
m_panel->om->closeObject();
mdiWindow->update();
}
ev->accept();
return true;
case ADD_USER_FOLDER_EVENT:
m_panel->om->addUserFolderToTree(obj, dynamic_cast<addUserFolderEvent *>(event)->m_userFolder);
ev->accept();
return true;
case REMOVE_USER_FOLDER_EVENT:
m_panel->om->removeUserFolderFromTree(obj, dynamic_cast<removeUserFolderEvent *>(event)->m_userFolder);
ev->accept();
return true;
case MOVE_TOFROM_USER_FOLDER_EVENT:
moveToFromUserFolderEvent *moveEvent =
dynamic_cast<moveToFromUserFolderEvent *>(event);
m_panel->om->moveToFromUserFolderInTree(obj, db()->findInIndex(moveEvent->m_objIdToMove), moveEvent->m_oldFolder, moveEvent->m_newFolder);
ev->accept();
return true;
}
}
return false;
}
//if (fwbdebug) qDebug() << this << "event:" << event;
return QWidget::event(event);
}
