Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
/* firewall_rules_dlg.c
|
|
|
|
*
|
|
|
|
* $Id$
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Generate firewall ACL rules based on packet addresses and ports.
|
|
|
|
* For directional rules, an outside interface is assumed.
|
|
|
|
*
|
|
|
|
* There may be better ways to present the information, e.g. all rules
|
|
|
|
* in one huge text window, or some sort of tree view.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* To add a new product, add syntax functions modify the products[] array.
|
|
|
|
*
|
|
|
|
* To add a new syntax function, add its prototype above the products[]
|
|
|
|
* array, and add the function below with all the others.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* Copied from ssl-dlg.c */
|
|
|
|
|
2008-04-13 01:54:20 +00:00
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
# include "config.h"
|
|
|
|
#endif
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <string.h>
|
|
|
|
|
|
|
|
#ifdef HAVE_FCNTL_H
|
|
|
|
#include <fcntl.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef HAVE_UNISTD_H
|
|
|
|
#include <unistd.h>
|
|
|
|
#endif
|
|
|
|
|
2008-04-13 01:54:20 +00:00
|
|
|
#include <gtk/gtk.h>
|
|
|
|
|
|
|
|
#include <epan/packet.h>
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
#include <epan/addr_resolv.h>
|
|
|
|
#include <epan/epan_dissect.h>
|
|
|
|
#include <epan/filesystem.h>
|
2008-04-13 01:54:20 +00:00
|
|
|
#include <epan/dissectors/packet-ipv6.h>
|
|
|
|
|
2012-01-16 01:07:52 +00:00
|
|
|
#include <ui/alert_box.h>
|
2012-01-18 19:38:34 +00:00
|
|
|
#include <ui/last_open_dir.h>
|
2012-01-16 01:07:52 +00:00
|
|
|
#include <ui/simple_dialog.h>
|
2012-01-18 19:38:34 +00:00
|
|
|
|
2008-05-22 15:46:27 +00:00
|
|
|
#include <wsutil/file_util.h>
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
2012-01-15 21:59:11 +00:00
|
|
|
#include "ui/gtk/main.h"
|
|
|
|
#include "ui/gtk/dlg_utils.h"
|
|
|
|
#include "ui/gtk/file_dlg.h"
|
|
|
|
#include "ui/gtk/help_dlg.h"
|
|
|
|
#include "ui/gtk/gui_utils.h"
|
|
|
|
#include "ui/gtk/old-gtk-compat.h"
|
|
|
|
#include "ui/gtk/firewall_dlg.h"
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
#define MAX_RULE_LEN 200
|
|
|
|
|
|
|
|
/* Rule types */
|
|
|
|
typedef enum {
|
2010-02-17 20:53:29 +00:00
|
|
|
RT_NONE,
|
|
|
|
RT_MAC_SRC,
|
|
|
|
RT_MAC_DST,
|
|
|
|
RT_IPv4_SRC,
|
|
|
|
RT_IPv4_DST,
|
|
|
|
RT_PORT_SRC,
|
|
|
|
RT_PORT_DST,
|
|
|
|
RT_IPv4_PORT_SRC,
|
|
|
|
RT_IPv4_PORT_DST,
|
|
|
|
NUM_RULE_TYPES
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
} rule_type_t;
|
|
|
|
|
|
|
|
|
|
|
|
/* Copied from packet_info struct */
|
|
|
|
typedef struct _rule_info_t {
|
2010-02-17 20:53:29 +00:00
|
|
|
gint product;
|
|
|
|
address dl_src;
|
|
|
|
address dl_dst;
|
|
|
|
address net_src;
|
|
|
|
address net_dst;
|
|
|
|
port_type ptype;
|
|
|
|
guint32 srcport;
|
|
|
|
guint32 destport;
|
|
|
|
GtkWidget *text;
|
2010-02-18 22:04:50 +00:00
|
|
|
GtkWidget *filter_combo_box;
|
2010-02-17 20:53:29 +00:00
|
|
|
GtkWidget *deny_cb;
|
|
|
|
GtkWidget *inbound_cb;
|
|
|
|
GtkWidget *firewall_save_as_w;
|
|
|
|
gboolean inbound;
|
|
|
|
gboolean deny;
|
|
|
|
rule_type_t rule_type;
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
} rule_info_t;
|
|
|
|
|
|
|
|
/* Syntax function prototypes */
|
|
|
|
typedef void (*syntax_func)(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
|
|
|
|
static void sf_dummy(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
|
|
|
|
static void sf_ipfw_mac(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_netfilter_mac(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
|
|
|
|
static void sf_ios_std_ipv4(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_ios_ext_ipv4(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_ipfilter_ipv4(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_ipfw_ipv4(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_netfilter_ipv4(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_pf_ipv4(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
/* XXX - Can you addresses-only filters using WFW/netsh? */
|
|
|
|
|
|
|
|
static void sf_ios_ext_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_ipfilter_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_ipfw_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_netfilter_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_pf_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_netsh_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
|
|
|
|
static void sf_ios_ext_ipv4_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_ipfilter_ipv4_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_ipfw_ipv4_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_netfilter_ipv4_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_pf_ipv4_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
static void sf_netsh_ipv4_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny);
|
|
|
|
|
|
|
|
typedef struct _fw_product_t {
|
2010-02-17 20:53:29 +00:00
|
|
|
gchar *name;
|
|
|
|
gchar *comment_pfx;
|
|
|
|
syntax_func mac_func;
|
|
|
|
syntax_func ipv4_func;
|
|
|
|
syntax_func port_func;
|
|
|
|
syntax_func ipv4_port_func;
|
|
|
|
gboolean does_inbound;
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
} fw_product;
|
|
|
|
|
2010-10-12 17:39:44 +00:00
|
|
|
static fw_product products[] = {
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
{ "Cisco IOS (standard)", "!", NULL, sf_ios_std_ipv4, NULL, NULL, FALSE },
|
|
|
|
{ "Cisco IOS (extended)", "!",
|
|
|
|
NULL, sf_ios_ext_ipv4, sf_ios_ext_port, sf_ios_ext_ipv4_port, TRUE },
|
|
|
|
{ "IP Filter (ipfilter)", "#",
|
|
|
|
NULL, sf_ipfilter_ipv4, sf_ipfilter_port, sf_ipfilter_ipv4_port, TRUE },
|
|
|
|
{ "IPFirewall (ipfw)", "#",
|
|
|
|
sf_ipfw_mac, sf_ipfw_ipv4, sf_ipfw_port, sf_ipfw_ipv4_port, TRUE },
|
|
|
|
{ "Netfilter (iptables)", "#",
|
|
|
|
sf_netfilter_mac, sf_netfilter_ipv4, sf_netfilter_port,
|
|
|
|
sf_netfilter_ipv4_port, TRUE },
|
|
|
|
{ "Packet Filter (pf)", "#",
|
|
|
|
NULL, sf_pf_ipv4, sf_pf_port, sf_pf_ipv4_port, TRUE },
|
|
|
|
{ "Windows Firewall (netsh)", "#",
|
|
|
|
NULL, NULL, sf_netsh_port, sf_netsh_ipv4_port, FALSE }
|
|
|
|
};
|
|
|
|
#define NUM_PRODS (sizeof(products) / sizeof(fw_product))
|
|
|
|
|
|
|
|
|
|
|
|
static void select_product(GtkWidget * win, gpointer data);
|
|
|
|
static void select_filter(GtkWidget * win, gpointer data);
|
|
|
|
static void toggle_inbound(GtkToggleButton *t, gpointer data);
|
|
|
|
static void toggle_deny(GtkToggleButton *t, gpointer data);
|
|
|
|
static void set_rule_text(rule_info_t *rule_info);
|
|
|
|
static void firewall_destroy_cb(GtkWidget * win, gpointer data);
|
|
|
|
static void firewall_copy_cmd_cb(GtkWidget * w, gpointer data);
|
|
|
|
static void firewall_save_as_cmd_cb(GtkWidget * w, gpointer data);
|
2009-06-02 19:16:08 +00:00
|
|
|
static gboolean firewall_save_as_ok_cb(GtkWidget * w, gpointer fs);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
static void firewall_save_as_destroy_cb(GtkWidget * win, gpointer user_data);
|
|
|
|
|
|
|
|
#define WS_RULE_INFO_KEY "rule_info_key"
|
|
|
|
|
2010-02-17 20:53:29 +00:00
|
|
|
#if 0
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
/* List of "rule_info_t" structures for all rule windows. */
|
|
|
|
static GList *rule_infos;
|
|
|
|
|
|
|
|
/* Remove a "rule_info_t" structure from the list. */
|
|
|
|
static void
|
|
|
|
forget_rule_info(rule_info_t *rule_info)
|
|
|
|
{
|
|
|
|
rule_infos = g_list_remove(rule_infos, rule_info);
|
|
|
|
}
|
2010-02-17 20:53:29 +00:00
|
|
|
#endif
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
void
|
|
|
|
firewall_rule_cb(GtkWidget *w _U_, gpointer data _U_)
|
|
|
|
{
|
2010-02-18 22:04:50 +00:00
|
|
|
GtkWidget *rule_w, *vbox, *txt_scrollw, *text;
|
|
|
|
GtkWidget *label, *product_combo_box;
|
|
|
|
GtkWidget *hbox, *button_hbox, *button;
|
2011-07-11 21:29:47 +00:00
|
|
|
rule_info_t *rule_info;
|
2010-02-18 22:04:50 +00:00
|
|
|
packet_info *pinfo = &cfile.edt->pi;
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
guint i;
|
|
|
|
|
|
|
|
rule_info = g_new0(rule_info_t, 1);
|
|
|
|
COPY_ADDRESS(&(rule_info->dl_src), &(pinfo->dl_src));
|
|
|
|
COPY_ADDRESS(&(rule_info->dl_dst), &(pinfo->dl_dst));
|
|
|
|
COPY_ADDRESS(&(rule_info->net_src), &(pinfo->net_src));
|
|
|
|
COPY_ADDRESS(&(rule_info->net_dst), &(pinfo->net_dst));
|
|
|
|
rule_info->ptype = pinfo->ptype;
|
|
|
|
rule_info->srcport = pinfo->srcport;
|
|
|
|
rule_info->destport = pinfo->destport;
|
|
|
|
rule_info->inbound = TRUE;
|
|
|
|
rule_info->deny = TRUE;
|
|
|
|
rule_info->product = 0;
|
|
|
|
|
|
|
|
rule_w = dlg_window_new("Firewall ACL Rules");
|
|
|
|
|
|
|
|
gtk_widget_set_name(rule_w, "Firewall ACL rule window");
|
2008-06-29 15:51:43 +00:00
|
|
|
gtk_container_set_border_width(GTK_CONTAINER(rule_w), 6);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
/* setup the container */
|
|
|
|
vbox = gtk_vbox_new(FALSE, 6);
|
|
|
|
gtk_container_add(GTK_CONTAINER(rule_w), vbox);
|
|
|
|
|
|
|
|
/* rule type selectors hbox */
|
|
|
|
hbox = gtk_hbox_new(FALSE, 1);
|
|
|
|
gtk_box_pack_start(GTK_BOX(vbox), hbox, FALSE, FALSE, 0);
|
|
|
|
|
|
|
|
/* product selector */
|
|
|
|
label = gtk_label_new("Product");
|
|
|
|
gtk_box_pack_start(GTK_BOX(hbox), label, FALSE, FALSE, 0);
|
|
|
|
|
2011-07-24 16:50:55 +00:00
|
|
|
product_combo_box = gtk_combo_box_text_new();
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
for (i = 0; i < NUM_PRODS; i++) {
|
2011-07-24 16:50:55 +00:00
|
|
|
gtk_combo_box_text_append_text (GTK_COMBO_BOX_TEXT(product_combo_box), products[i].name);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
2010-02-18 22:04:50 +00:00
|
|
|
g_object_set_data(G_OBJECT(product_combo_box), WS_RULE_INFO_KEY, rule_info);
|
|
|
|
g_signal_connect(product_combo_box, "changed", G_CALLBACK(select_product), NULL);
|
|
|
|
gtk_box_pack_start(GTK_BOX(hbox), product_combo_box, FALSE, FALSE, 5);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
/* type selector */
|
|
|
|
label = gtk_label_new("Filter");
|
|
|
|
gtk_box_pack_start(GTK_BOX(hbox), label, FALSE, FALSE, 10);
|
|
|
|
|
2010-02-22 18:43:36 +00:00
|
|
|
rule_info->filter_combo_box = ws_combo_box_new_text_and_pointer();
|
2010-02-18 22:04:50 +00:00
|
|
|
g_object_set_data(G_OBJECT(rule_info->filter_combo_box), WS_RULE_INFO_KEY, rule_info); \
|
|
|
|
g_signal_connect(rule_info->filter_combo_box, "changed", G_CALLBACK(select_filter), NULL);
|
|
|
|
gtk_box_pack_start(GTK_BOX(hbox), rule_info->filter_combo_box, FALSE, FALSE, 5);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
/* inbound selector */
|
|
|
|
rule_info->inbound_cb = gtk_check_button_new_with_label("Inbound");
|
|
|
|
gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(rule_info->inbound_cb),
|
|
|
|
rule_info->inbound);
|
|
|
|
gtk_box_pack_start(GTK_BOX(hbox), rule_info->inbound_cb, FALSE, FALSE, 10);
|
2008-04-11 22:10:36 +00:00
|
|
|
g_signal_connect(rule_info->inbound_cb, "toggled", G_CALLBACK(toggle_inbound), rule_info);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
/* deny selector */
|
|
|
|
rule_info->deny_cb = gtk_check_button_new_with_label("Deny");
|
|
|
|
gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(rule_info->deny_cb),
|
|
|
|
rule_info->deny);
|
|
|
|
gtk_box_pack_start(GTK_BOX(hbox), rule_info->deny_cb, FALSE, FALSE, 10);
|
2008-04-11 22:10:36 +00:00
|
|
|
g_signal_connect(rule_info->deny_cb, "toggled", G_CALLBACK(toggle_deny), rule_info);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
/* create a scrolled window for the text */
|
|
|
|
txt_scrollw = scrolled_window_new(NULL, NULL);
|
|
|
|
gtk_scrolled_window_set_shadow_type(GTK_SCROLLED_WINDOW(txt_scrollw),
|
|
|
|
GTK_SHADOW_IN);
|
|
|
|
gtk_box_pack_start(GTK_BOX(vbox), txt_scrollw, TRUE, TRUE, 0);
|
|
|
|
|
|
|
|
/* create a text box */
|
|
|
|
text = gtk_text_view_new();
|
|
|
|
gtk_text_view_set_editable(GTK_TEXT_VIEW(text), FALSE);
|
|
|
|
gtk_container_add(GTK_CONTAINER(txt_scrollw), text);
|
|
|
|
rule_info->text = text;
|
|
|
|
|
2008-04-16 00:10:47 +00:00
|
|
|
/* Button row */
|
2008-06-21 13:36:31 +00:00
|
|
|
button_hbox = dlg_button_row_new(GTK_STOCK_HELP, GTK_STOCK_COPY, GTK_STOCK_SAVE, GTK_STOCK_CANCEL, NULL);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
gtk_box_pack_start(GTK_BOX(vbox), button_hbox, FALSE, FALSE, 0);
|
|
|
|
|
|
|
|
/* Create Copy Button */
|
2008-04-16 00:10:47 +00:00
|
|
|
button = g_object_get_data(G_OBJECT(button_hbox), GTK_STOCK_COPY);
|
2008-04-11 22:10:36 +00:00
|
|
|
g_signal_connect(button, "clicked", G_CALLBACK(firewall_copy_cmd_cb), rule_info);
|
2011-07-11 21:29:47 +00:00
|
|
|
gtk_widget_set_tooltip_text(button, "Copy rule to clipboard");
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
2008-04-16 00:10:47 +00:00
|
|
|
/* Create Save Button */
|
|
|
|
button = g_object_get_data(G_OBJECT(button_hbox), GTK_STOCK_SAVE);
|
2008-04-11 22:10:36 +00:00
|
|
|
g_signal_connect(button, "clicked", G_CALLBACK(firewall_save_as_cmd_cb), rule_info);
|
2011-07-11 21:29:47 +00:00
|
|
|
gtk_widget_set_tooltip_text(button, "Save the rule as currently displayed");
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
2008-04-16 00:10:47 +00:00
|
|
|
button = g_object_get_data(G_OBJECT(button_hbox), GTK_STOCK_CANCEL);
|
2011-07-11 21:29:47 +00:00
|
|
|
gtk_widget_set_tooltip_text(button, "Cancel the dialog");
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
window_set_cancel_button(rule_w, button, window_cancel_button_cb);
|
|
|
|
|
2008-06-21 13:36:31 +00:00
|
|
|
button = g_object_get_data(G_OBJECT(button_hbox), GTK_STOCK_HELP);
|
|
|
|
g_signal_connect(button, "clicked", G_CALLBACK(topic_cb), (gpointer)HELP_FIREWALL_DIALOG);
|
2008-04-16 00:10:47 +00:00
|
|
|
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
/* Tuck away the rule_info object into the window */
|
2008-04-11 16:44:31 +00:00
|
|
|
g_object_set_data(G_OBJECT(rule_w), WS_RULE_INFO_KEY, rule_info);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
2008-04-11 22:10:36 +00:00
|
|
|
g_signal_connect(rule_w, "delete_event", G_CALLBACK(window_delete_event_cb), NULL);
|
|
|
|
g_signal_connect(rule_w, "destroy", G_CALLBACK(firewall_destroy_cb), NULL);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
/* Make sure this widget gets destroyed if we quit the main loop,
|
|
|
|
so that if we exit, we clean up any temporary files we have
|
2011-08-15 14:30:14 +00:00
|
|
|
for "Follow SSL Stream" windows.
|
|
|
|
gtk_quit_add_destroy is deprecated and should not be used in newly-written code. This function is going to be removed in GTK+ 3.0
|
|
|
|
|
|
|
|
gtk_quit_add_destroy(gtk_main_level(), GTK_OBJECT(rule_w));
|
|
|
|
|
|
|
|
*/
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
2010-02-18 22:04:50 +00:00
|
|
|
gtk_combo_box_set_active(GTK_COMBO_BOX(product_combo_box), 0); /* invokes select_product callback */
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
gtk_widget_show_all(rule_w);
|
|
|
|
window_present(rule_w);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Set the current product. */
|
|
|
|
#define ADD_TO_FILTER_MENU(rt) \
|
2010-02-22 18:43:36 +00:00
|
|
|
ws_combo_box_append_text_and_pointer(GTK_COMBO_BOX(rule_info->filter_combo_box), name, GUINT_TO_POINTER(rt)); \
|
2010-02-18 22:04:50 +00:00
|
|
|
if (rule_type == RT_NONE) { \
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
rule_type = rt; \
|
|
|
|
}
|
|
|
|
|
|
|
|
#define NAME_TCP_UDP (rule_info->ptype == PT_TCP ? "TCP" : "UDP")
|
2010-02-18 22:04:50 +00:00
|
|
|
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
static void
|
2010-02-18 22:04:50 +00:00
|
|
|
select_product(GtkWidget *w, gpointer data _U_)
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
{
|
2010-02-18 22:04:50 +00:00
|
|
|
guint prod = gtk_combo_box_get_active(GTK_COMBO_BOX(w));
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
rule_info_t *rule_info;
|
|
|
|
gchar name[MAX_RULE_LEN], addr_str[MAX_RULE_LEN];
|
|
|
|
address *addr;
|
|
|
|
rule_type_t rule_type = RT_NONE;
|
2010-02-18 22:04:50 +00:00
|
|
|
gboolean sensitive = FALSE;
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
2008-04-11 16:44:31 +00:00
|
|
|
rule_info = g_object_get_data(G_OBJECT(w), WS_RULE_INFO_KEY);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
if (prod >= NUM_PRODS || !rule_info)
|
|
|
|
return;
|
|
|
|
|
|
|
|
rule_info->product = prod;
|
|
|
|
|
2010-02-18 22:04:50 +00:00
|
|
|
/* Clear the list store (ie: the como_box list items) */
|
2010-02-22 18:43:36 +00:00
|
|
|
ws_combo_box_clear_text_and_pointer(GTK_COMBO_BOX(rule_info->filter_combo_box));
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
2010-02-18 22:04:50 +00:00
|
|
|
/* Fill in valid combo_box list items (in the list store). */
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
if (products[prod].mac_func && rule_info->dl_src.type == AT_ETHER) {
|
|
|
|
addr = &(rule_info->dl_src);
|
|
|
|
address_to_str_buf(addr, name, MAX_RULE_LEN);
|
|
|
|
ADD_TO_FILTER_MENU(RT_MAC_SRC);
|
|
|
|
|
|
|
|
addr = &(rule_info->dl_dst);
|
|
|
|
address_to_str_buf(addr, name, MAX_RULE_LEN);
|
|
|
|
ADD_TO_FILTER_MENU(RT_MAC_DST);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (products[prod].ipv4_func && rule_info->net_src.type == AT_IPv4) {
|
|
|
|
addr = &(rule_info->net_src);
|
|
|
|
address_to_str_buf(addr, name, MAX_RULE_LEN);
|
|
|
|
ADD_TO_FILTER_MENU(RT_IPv4_SRC);
|
|
|
|
|
|
|
|
addr = &(rule_info->net_dst);
|
|
|
|
address_to_str_buf(addr, name, MAX_RULE_LEN);
|
|
|
|
ADD_TO_FILTER_MENU(RT_IPv4_DST);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (products[prod].port_func && (rule_info->ptype == PT_TCP || rule_info->ptype == PT_UDP)) {
|
|
|
|
g_snprintf(name, MAX_RULE_LEN, "%s port %u", NAME_TCP_UDP,
|
|
|
|
rule_info->srcport);
|
|
|
|
ADD_TO_FILTER_MENU(RT_PORT_SRC);
|
|
|
|
if (rule_info->srcport != rule_info->destport) {
|
|
|
|
g_snprintf(name, MAX_RULE_LEN, "%s port %u", NAME_TCP_UDP,
|
|
|
|
rule_info->destport);
|
|
|
|
ADD_TO_FILTER_MENU(RT_PORT_DST);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (products[prod].ipv4_port_func && rule_info->net_src.type == AT_IPv4 &&
|
|
|
|
(rule_info->ptype == PT_TCP || rule_info->ptype == PT_UDP)) {
|
|
|
|
addr = &(rule_info->net_src);
|
|
|
|
address_to_str_buf(addr, addr_str, MAX_RULE_LEN);
|
|
|
|
g_snprintf(name, MAX_RULE_LEN, "%s + %s port %u", addr_str,
|
|
|
|
NAME_TCP_UDP, rule_info->srcport);
|
|
|
|
ADD_TO_FILTER_MENU(RT_IPv4_PORT_SRC);
|
|
|
|
|
|
|
|
addr = &(rule_info->net_dst);
|
|
|
|
address_to_str_buf(addr, addr_str, MAX_RULE_LEN);
|
|
|
|
g_snprintf(name, MAX_RULE_LEN, "%s + %s port %u", addr_str,
|
|
|
|
NAME_TCP_UDP, rule_info->destport);
|
|
|
|
ADD_TO_FILTER_MENU(RT_IPv4_PORT_DST);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (rule_type != RT_NONE) {
|
2010-02-18 22:04:50 +00:00
|
|
|
gtk_combo_box_set_active(GTK_COMBO_BOX(rule_info->filter_combo_box), 0); /* invokes select_filter callback */
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
sensitive = TRUE;
|
2010-02-18 22:04:50 +00:00
|
|
|
} else {
|
|
|
|
select_filter(rule_info->filter_combo_box, NULL); /* Call if RT_NONE [with nothing selected] */
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
2010-02-18 22:04:50 +00:00
|
|
|
gtk_widget_set_sensitive(rule_info->filter_combo_box, sensitive);
|
|
|
|
gtk_widget_set_sensitive(rule_info->inbound_cb, products[prod].does_inbound && sensitive);
|
|
|
|
gtk_widget_set_sensitive(rule_info->deny_cb, sensitive);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
2010-02-18 22:04:50 +00:00
|
|
|
/* Set the rule text based upon the current product and current filter. */
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
static void
|
2010-02-18 22:04:50 +00:00
|
|
|
select_filter(GtkWidget *w, gpointer data _U_)
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
{
|
2010-02-18 22:04:50 +00:00
|
|
|
rule_type_t cur_type;
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
rule_info_t *rule_info;
|
2010-02-22 18:43:36 +00:00
|
|
|
gpointer ptr;
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
2008-04-11 16:44:31 +00:00
|
|
|
rule_info = g_object_get_data(G_OBJECT(w), WS_RULE_INFO_KEY);
|
2010-02-18 22:04:50 +00:00
|
|
|
if (!rule_info)
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
return;
|
|
|
|
|
2010-02-22 18:43:36 +00:00
|
|
|
|
|
|
|
if (ws_combo_box_get_active_pointer(GTK_COMBO_BOX(w), &ptr))
|
|
|
|
cur_type = GPOINTER_TO_UINT(ptr);
|
|
|
|
else
|
|
|
|
cur_type = RT_NONE; /* If nothing selected (eg: nothing in filter list) */
|
|
|
|
|
2010-02-18 22:04:50 +00:00
|
|
|
if (cur_type >= NUM_RULE_TYPES)
|
2010-02-22 18:43:36 +00:00
|
|
|
return;
|
2010-02-18 22:04:50 +00:00
|
|
|
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
rule_info->rule_type = cur_type;
|
|
|
|
|
|
|
|
set_rule_text(rule_info);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Set inbound/outbound */
|
|
|
|
static void
|
|
|
|
toggle_inbound(GtkToggleButton *t, gpointer data)
|
|
|
|
{
|
|
|
|
rule_info_t *rule_info = (rule_info_t *) data;
|
|
|
|
|
|
|
|
rule_info->inbound = gtk_toggle_button_get_active(t);
|
|
|
|
|
|
|
|
set_rule_text(rule_info);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Set deny/allow. */
|
|
|
|
static void
|
|
|
|
toggle_deny(GtkToggleButton *t, gpointer data)
|
|
|
|
{
|
|
|
|
rule_info_t *rule_info = (rule_info_t *) data;
|
|
|
|
|
|
|
|
rule_info->deny = gtk_toggle_button_get_active(t);
|
|
|
|
|
|
|
|
set_rule_text(rule_info);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Set the rule text */
|
|
|
|
#define DL_ADDR (rt == RT_MAC_SRC ? &(rule_info->dl_src) : &(rule_info->dl_dst))
|
|
|
|
#define NET_ADDR (rt == RT_IPv4_SRC ? &(rule_info->net_src) : &(rule_info->net_dst))
|
|
|
|
#define NET_PORT (rt == RT_PORT_SRC ? rule_info->srcport : rule_info->destport)
|
|
|
|
static void
|
|
|
|
set_rule_text(rule_info_t *rule_info) {
|
|
|
|
GString *rtxt = g_string_new("");
|
|
|
|
gchar addr_str[MAX_RULE_LEN];
|
|
|
|
rule_type_t rt = rule_info->rule_type;
|
|
|
|
guint prod = rule_info->product;
|
|
|
|
address *addr = NULL;
|
|
|
|
guint32 port = 0;
|
|
|
|
syntax_func rt_func = NULL;
|
|
|
|
|
|
|
|
GtkTextBuffer *buf = gtk_text_view_get_buffer(GTK_TEXT_VIEW(rule_info->text));
|
|
|
|
|
|
|
|
if (prod < NUM_PRODS) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_printf(rtxt, "%s %s\n", products[prod].comment_pfx, products[prod].name);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
switch(rt) {
|
|
|
|
case RT_NONE:
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "%s Not supported", products[prod].comment_pfx);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
rt_func = sf_dummy;
|
|
|
|
break;
|
|
|
|
case RT_MAC_SRC:
|
|
|
|
case RT_MAC_DST:
|
|
|
|
addr = DL_ADDR;
|
|
|
|
address_to_str_buf(addr, addr_str, MAX_RULE_LEN);
|
|
|
|
rt_func = products[prod].mac_func;
|
|
|
|
break;
|
|
|
|
case RT_IPv4_SRC:
|
|
|
|
case RT_IPv4_DST:
|
|
|
|
addr = NET_ADDR;
|
|
|
|
address_to_str_buf(addr, addr_str, MAX_RULE_LEN);
|
|
|
|
rt_func = products[prod].ipv4_func;
|
|
|
|
break;
|
|
|
|
case RT_PORT_SRC:
|
|
|
|
case RT_PORT_DST:
|
|
|
|
port = NET_PORT;
|
|
|
|
rt_func = products[prod].port_func;
|
|
|
|
break;
|
|
|
|
case RT_IPv4_PORT_SRC:
|
|
|
|
case RT_IPv4_PORT_DST:
|
|
|
|
addr = NET_ADDR;
|
|
|
|
address_to_str_buf(addr, addr_str, MAX_RULE_LEN);
|
|
|
|
port = NET_PORT;
|
|
|
|
rt_func = products[prod].ipv4_port_func;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (rt_func) {
|
|
|
|
rt_func(rtxt, addr_str, port, rule_info->ptype, rule_info->inbound, rule_info->deny);
|
|
|
|
} else {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "ERROR: Unable to create rule");
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
2009-04-15 21:35:51 +00:00
|
|
|
gtk_text_buffer_set_text(buf, rtxt->str, (gint) rtxt->len);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
g_string_free(rtxt, TRUE);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* Rule text functions */
|
|
|
|
/* Dummy */
|
2007-01-22 00:20:33 +00:00
|
|
|
static void sf_dummy(GString *rtxt _U_, gchar *addr _U_, guint32 port _U_, port_type ptype _U_, gboolean inbound _U_, gboolean deny _U_) {
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* MAC */
|
|
|
|
#define IPFW_DENY (deny ? "deny" : "allow")
|
|
|
|
#define IPFW_IN (inbound ? "in" : "out")
|
|
|
|
static void sf_ipfw_mac(GString *rtxt, gchar *addr, guint32 port _U_, port_type ptype _U_, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "add %s MAC %s any %s",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
IPFW_DENY, addr, IPFW_IN);
|
|
|
|
}
|
|
|
|
|
|
|
|
#define NF_DROP (deny ? "DROP" : "ACCEPT")
|
|
|
|
#define NF_INPUT (inbound ? "INPUT" : "OUTPUT")
|
|
|
|
static void sf_netfilter_mac(GString *rtxt, gchar *addr, guint32 port _U_, port_type ptype _U_, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "iptables -A %s --mac-source %s -j %s",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
NF_INPUT, addr, NF_DROP);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* IPv4 */
|
|
|
|
#define IOS_DENY (deny ? "deny" : "permit")
|
|
|
|
static void sf_ios_std_ipv4(GString *rtxt, gchar *addr, guint32 port _U_, port_type ptype _U_, gboolean inbound _U_, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "access-list NUMBER %s host %s", IOS_DENY, addr);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_ios_ext_ipv4(GString *rtxt, gchar *addr, guint32 port _U_, port_type ptype _U_, gboolean inbound, gboolean deny) {
|
|
|
|
if (inbound)
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "access-list NUMBER %s ip host %s any", IOS_DENY, addr);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
else
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "access-list NUMBER %s ip any host %s", IOS_DENY, addr);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#define IPFILTER_DENY (deny ? "block" : "pass")
|
|
|
|
#define IPFILTER_IN (inbound ? "in" : "out")
|
|
|
|
static void sf_ipfilter_ipv4(GString *rtxt, gchar *addr, guint32 port _U_, port_type ptype _U_, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "%s %s on le0 from %s to any",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
IPFILTER_DENY, IPFILTER_IN, addr);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_ipfw_ipv4(GString *rtxt, gchar *addr, guint32 port _U_, port_type ptype _U_, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "add %s ip from %s to any %s",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
IPFW_DENY, addr, IPFW_IN);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_netfilter_ipv4(GString *rtxt, gchar *addr, guint32 port _U_, port_type ptype _U_, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "iptables -A %s -i eth0 -d %s/32 -j %s",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
NF_INPUT, addr, NF_DROP);
|
|
|
|
}
|
|
|
|
|
|
|
|
#define PF_DENY (deny ? "block" : "pass")
|
|
|
|
#define PF_IN (inbound ? "in" : "out")
|
|
|
|
static void sf_pf_ipv4(GString *rtxt, gchar *addr, guint32 port _U_, port_type ptype _U_, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "%s %s quick on $ext_if from %s to any",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
PF_DENY, PF_IN, addr);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Port */
|
|
|
|
#define RT_TCP_UDP (ptype == PT_TCP ? "tcp" : "udp")
|
|
|
|
static void sf_ios_ext_port(GString *rtxt, gchar *addr _U_, guint32 port, port_type ptype, gboolean inbound _U_, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "access-list NUMBER %s %s any any eq %u",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
IOS_DENY, RT_TCP_UDP, port);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_ipfilter_port(GString *rtxt, gchar *addr _U_, guint32 port, port_type ptype _U_, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "%s %s on le0 proto %s from any to any port = %u",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
IPFILTER_DENY, IPFILTER_IN, RT_TCP_UDP, port);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_ipfw_port(GString *rtxt, gchar *addr _U_, guint32 port, port_type ptype, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "add %s %s from any to any %u %s",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
IPFW_DENY, RT_TCP_UDP, port, IPFW_IN);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_netfilter_port(GString *rtxt, gchar *addr _U_, guint32 port, port_type ptype, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "iptables -A %s -p %s --destination-port %u -j %s",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
NF_INPUT, RT_TCP_UDP, port, NF_DROP);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_pf_port(GString *rtxt, gchar *addr _U_, guint32 port, port_type ptype, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "%s %s quick on $ext_if proto %s from any to any port %u",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
PF_DENY, PF_IN, RT_TCP_UDP, port);
|
|
|
|
}
|
|
|
|
|
|
|
|
#define NETSH_DENY (deny ? "DISABLE" : "ENABLE")
|
|
|
|
static void sf_netsh_port(GString *rtxt, gchar *addr _U_, guint32 port, port_type ptype, gboolean inbound _U_, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "add portopening %s %u Wireshark %s",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
RT_TCP_UDP, port, NETSH_DENY);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* IPv4 + port */
|
|
|
|
static void sf_ios_ext_ipv4_port(GString *rtxt, gchar *addr, guint32 port _U_, port_type ptype _U_, gboolean inbound, gboolean deny) {
|
|
|
|
if (inbound)
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "access-list NUMBER %s %s host %s any eq %u", IOS_DENY, RT_TCP_UDP, addr, port);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
else
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "access-list NUMBER %s %s any host %s eq %u", IOS_DENY, RT_TCP_UDP, addr, port);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_ipfilter_ipv4_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny) {
|
|
|
|
if (inbound)
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "%s %s on le0 proto %s from %s to any port = %u",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
IPFILTER_DENY, IPFILTER_IN, RT_TCP_UDP, addr, port);
|
|
|
|
else
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "%s %s on le0 proto %s from any to %s port = %u",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
IPFILTER_DENY, IPFILTER_IN, RT_TCP_UDP, addr, port);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_ipfw_ipv4_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "add %s %s from %s to any %u %s",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
IPFW_DENY, RT_TCP_UDP, addr, port, IPFW_IN);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_pf_ipv4_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "%s %s quick on $ext_if proto %s from %s to any port %u",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
PF_DENY, PF_IN, RT_TCP_UDP, addr, port);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_netfilter_ipv4_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "iptables -A %s -p %s -d %s/32 --destination-port %u -j %s",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
NF_INPUT, RT_TCP_UDP, addr, port, NF_DROP);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void sf_netsh_ipv4_port(GString *rtxt, gchar *addr, guint32 port, port_type ptype, gboolean inbound _U_, gboolean deny) {
|
2008-05-06 05:50:31 +00:00
|
|
|
g_string_append_printf(rtxt, "add portopening %s %u Wireshark %s %s",
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
RT_TCP_UDP, port, NETSH_DENY, addr);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* The destroy call back has the responsibility of
|
|
|
|
* unlinking the temporary file
|
|
|
|
* and freeing the filter_out_filter */
|
|
|
|
static void
|
|
|
|
firewall_destroy_cb(GtkWidget *w, gpointer data _U_)
|
|
|
|
{
|
|
|
|
rule_info_t *rule_info;
|
|
|
|
|
2008-04-11 16:44:31 +00:00
|
|
|
rule_info = g_object_get_data(G_OBJECT(w), WS_RULE_INFO_KEY);
|
2010-02-17 20:53:29 +00:00
|
|
|
#if 0
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
forget_rule_info(rule_info);
|
2010-02-17 20:53:29 +00:00
|
|
|
#endif
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
g_free(rule_info);
|
2011-08-15 14:36:58 +00:00
|
|
|
gtk_widget_destroy(w);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
firewall_copy_cmd_cb(GtkWidget *w _U_, gpointer data)
|
|
|
|
{
|
|
|
|
rule_info_t *rule_info = data;
|
|
|
|
|
|
|
|
GtkTextIter start, end;
|
|
|
|
GtkTextBuffer *buf;
|
|
|
|
|
|
|
|
buf = gtk_text_view_get_buffer(GTK_TEXT_VIEW(rule_info->text));
|
|
|
|
gtk_text_buffer_get_start_iter(buf, &start);
|
|
|
|
gtk_text_buffer_get_end_iter(buf, &end);
|
2010-02-18 22:04:50 +00:00
|
|
|
gtk_text_buffer_select_range(buf, &start, &end);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
gtk_text_buffer_copy_clipboard(buf, gtk_clipboard_get(GDK_SELECTION_CLIPBOARD));
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Keep a static pointer to the current "Save SSL Follow Stream As" window, if
|
|
|
|
* any, so that if somebody tries to do "Save"
|
|
|
|
* while there's already a "Save SSL Follow Stream" window up, we just pop
|
|
|
|
* up the existing one, rather than creating a new one.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
firewall_save_as_cmd_cb(GtkWidget *w _U_, gpointer data)
|
|
|
|
{
|
|
|
|
GtkWidget *new_win;
|
|
|
|
rule_info_t *rule_info = data;
|
|
|
|
|
2009-06-02 19:16:08 +00:00
|
|
|
#if 0 /* XXX: GtkFileChooserDialog/gtk_dialog_run currently being used is effectively modal so this is not req'd */
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
if (rule_info->firewall_save_as_w != NULL) {
|
|
|
|
/* There's already a dialog box; reactivate it. */
|
|
|
|
reactivate_window(rule_info->firewall_save_as_w);
|
|
|
|
return;
|
|
|
|
}
|
2009-06-02 19:16:08 +00:00
|
|
|
#endif
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
new_win = file_selection_new("Wireshark: Save Firewall ACL Rule",
|
|
|
|
FILE_SELECTION_SAVE);
|
|
|
|
rule_info->firewall_save_as_w = new_win;
|
2009-06-02 19:16:08 +00:00
|
|
|
gtk_file_chooser_set_do_overwrite_confirmation(GTK_FILE_CHOOSER(new_win), TRUE);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
/* Tuck away the rule_info object into the window */
|
2008-04-11 16:44:31 +00:00
|
|
|
g_object_set_data(G_OBJECT(new_win), WS_RULE_INFO_KEY, rule_info);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
2008-04-11 22:10:36 +00:00
|
|
|
g_signal_connect(new_win, "destroy", G_CALLBACK(firewall_save_as_destroy_cb), rule_info);
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
2009-06-02 19:16:08 +00:00
|
|
|
#if 0
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
if (gtk_dialog_run(GTK_DIALOG(new_win)) == GTK_RESPONSE_ACCEPT)
|
|
|
|
{
|
|
|
|
firewall_save_as_ok_cb(new_win, new_win);
|
|
|
|
} else {
|
|
|
|
window_destroy(new_win);
|
|
|
|
}
|
2009-06-02 19:16:08 +00:00
|
|
|
#else
|
|
|
|
/* "Run" the GtkFileChooserDialog. */
|
|
|
|
/* Upon exit: If "Accept" run the OK callback. */
|
|
|
|
/* If the OK callback returns with a FALSE status, re-run the dialog.*/
|
|
|
|
/* If not accept (ie: cancel) destroy the window. */
|
|
|
|
/* XXX: If the OK callback pops up an alert box (eg: for an error) it *must* */
|
|
|
|
/* return with a TRUE status so that the dialog window will be destroyed. */
|
|
|
|
/* Trying to re-run the dialog after popping up an alert box will not work */
|
|
|
|
/* since the user will not be able to dismiss the alert box. */
|
|
|
|
/* The (somewhat unfriendly) effect: the user must re-invoke the */
|
|
|
|
/* GtkFileChooserDialog whenever the OK callback pops up an alert box. */
|
|
|
|
/* */
|
|
|
|
/* ToDo: use GtkFileChooserWidget in a dialog window instead of */
|
|
|
|
/* GtkFileChooserDialog. */
|
|
|
|
while (gtk_dialog_run(GTK_DIALOG(new_win)) == GTK_RESPONSE_ACCEPT) {
|
|
|
|
if (firewall_save_as_ok_cb(NULL, new_win)) {
|
|
|
|
break; /* we're done */
|
|
|
|
}
|
|
|
|
}
|
|
|
|
window_destroy(new_win);
|
|
|
|
#endif
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-06-02 19:16:08 +00:00
|
|
|
static gboolean
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
firewall_save_as_ok_cb(GtkWidget * w _U_, gpointer fs)
|
|
|
|
{
|
|
|
|
gchar *to_name, *rule;
|
|
|
|
rule_info_t *rule_info;
|
|
|
|
FILE *fh;
|
|
|
|
gchar *dirname;
|
|
|
|
|
|
|
|
GtkTextIter start, end;
|
|
|
|
GtkTextBuffer *buf;
|
|
|
|
|
2009-06-02 19:16:08 +00:00
|
|
|
to_name = gtk_file_chooser_get_filename(GTK_FILE_CHOOSER(fs));
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
|
|
|
|
/* Perhaps the user specified a directory instead of a file.
|
|
|
|
Check whether they did. */
|
|
|
|
if (test_for_directory(to_name) == EISDIR) {
|
|
|
|
/* It's a directory - set the file selection box to display that
|
|
|
|
directory, and leave the selection box displayed. */
|
|
|
|
set_last_open_dir(to_name);
|
|
|
|
g_free(to_name);
|
|
|
|
file_selection_set_current_folder(fs, get_last_open_dir());
|
2009-06-02 19:16:08 +00:00
|
|
|
gtk_file_chooser_set_current_name(fs, "");
|
|
|
|
return FALSE; /* run the dialog again */
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
2008-04-11 16:44:31 +00:00
|
|
|
rule_info = g_object_get_data(G_OBJECT(fs), WS_RULE_INFO_KEY);
|
2008-05-22 15:46:27 +00:00
|
|
|
fh = ws_fopen(to_name, "w");
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
if (fh == NULL) {
|
|
|
|
open_failure_alert_box(to_name, errno, TRUE);
|
|
|
|
g_free(to_name);
|
2009-06-02 19:16:08 +00:00
|
|
|
return TRUE;
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
buf = gtk_text_view_get_buffer(GTK_TEXT_VIEW(rule_info->text));
|
|
|
|
gtk_text_buffer_get_start_iter(buf, &start);
|
|
|
|
gtk_text_buffer_get_end_iter(buf, &end);
|
|
|
|
rule = gtk_text_buffer_get_text(buf, &start, &end, FALSE);
|
|
|
|
|
|
|
|
fputs(rule, fh);
|
|
|
|
fclose(fh);
|
|
|
|
|
2009-06-02 19:16:08 +00:00
|
|
|
#if 0 /* handled by caller (for now) */
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
gtk_widget_hide(GTK_WIDGET(fs));
|
|
|
|
window_destroy(GTK_WIDGET(fs));
|
2009-06-02 19:16:08 +00:00
|
|
|
#endif
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
/* Save the directory name for future file dialogs. */
|
|
|
|
dirname = get_dirname(to_name); /* Overwrites to_name */
|
|
|
|
set_last_open_dir(dirname);
|
|
|
|
g_free(to_name);
|
2009-06-02 19:16:08 +00:00
|
|
|
|
|
|
|
return TRUE;
|
Add support for generating firewall ACL rules. MAC, IPv4, port, and
IPv4+port rules are supported along with several syntaxes: IOS standard,
IOS extended, ipfilter, ipfw, pf, and netsh. IPv6 is currently not
supported, but shouldn't be too difficult to add.
All of the rules were created using the documentation for each product.
None of them have been tested. For the time being, use them with
caution.
svn path=/trunk/; revision=18737
2006-07-14 20:14:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
firewall_save_as_destroy_cb(GtkWidget * win _U_, gpointer data)
|
|
|
|
{
|
|
|
|
rule_info_t *rule_info = data;
|
|
|
|
|
|
|
|
/* Note that we no longer have a dialog box. */
|
|
|
|
rule_info->firewall_save_as_w = NULL;
|
|
|
|
}
|