1 /*
2 
3                           Firewall Builder
4 
5                  Copyright (C) 2011 NetCitadel, LLC
6 
7   Author:  Vadim Kurland     vadim@fwbuilder.org
8 
9   This program is free software which we release under the GNU General Public
10   License. You may redistribute and/or modify this program under the terms
11   of that license as published by the Free Software Foundation; either
12   version 2 of the License, or (at your option) any later version.
13 
14   This program is distributed in the hope that it will be useful,
15   but WITHOUT ANY WARRANTY; without even the implied warranty of
16   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17   GNU General Public License for more details.
18 
19   To get a copy of the GNU General Public License, write to the Free Software
20   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
21 
22 */
23 
24 
25 #ifndef _FWB_POLICY_IMPORTER_PIX_H_
26 #define _FWB_POLICY_IMPORTER_PIX_H_
27 
28 #include <map>
29 #include <list>
30 #include <string>
31 #include <functional>
32 #include <sstream>
33 
34 #include "IOSImporter.h"
35 
36 #include "fwbuilder/libfwbuilder-config.h"
37 #include "fwbuilder/Logger.h"
38 #include "fwbuilder/Rule.h"
39 #include "fwbuilder/NAT.h"
40 
41 #include <QString>
42 
43 
44 class GlobalPool
45 {
46 public:
47     int num;
48     std::string str_num;
49     std::string pool_interface;
50     std::string start;
51     std::string end;
52     std::string netmask;
53 
GlobalPool()54     GlobalPool()
55     {
56         num = -1;
57         str_num = "";
58         pool_interface = "";
59         start = "";
60         end = "";
61         netmask = "";
62     }
63 
64     GlobalPool& operator=(const GlobalPool &other);
65     std::string toStdString();
66     QString toString();
67 };
68 
69 class PIXImporter : public IOSImporter
70 {
71     libfwbuilder::FWObject* getMirroredServiceObject(libfwbuilder::FWObject *obj);
72     libfwbuilder::FWObject* mirrorServiceObjectRecursively(libfwbuilder::FWObject *obj);
73     void mixServiceObjects(libfwbuilder::FWObject *src_ports,
74                            libfwbuilder::FWObject *dst_ports,
75                            libfwbuilder::FWObject *service_group);
76     void natRuleWithACL(libfwbuilder::NATRule *rule);
77 
78 public:
79 
80     QString named_object_name;
81     QString named_object_comment;
82     libfwbuilder::FWObject *current_named_object;
83 
84     QString object_group_name;
85     QString object_group_comment;
86     QString object_group_service_protocol;
87     libfwbuilder::FWObject *current_object_group;
88 
89     QMap<QString,libfwbuilder::FWObject*> named_objects_registry;
90 
91     // variables for the nat rules
92     libfwbuilder::NATRule::NATRuleTypes rule_type;
93     std::string prenat_interface;
94     std::string postnat_interface;
95 
96     std::string real_a;
97     std::string real_nm;
98     std::string mapped_a;
99     std::string mapped_nm;
100     std::string real_addr_acl;
101     std::string mapped_port_spec;
102     std::string real_port_spec;
103     std::string static_max_conn;
104     std::string static_max_emb_conn;
105 
106     std::string nat_num;
107     std::string nat_a;
108     std::string nat_nm;
109     std::string nat_acl;
110 
111     GlobalPool tmp_global_pool;
112     std::map<int, std::list<GlobalPool> > global_pools;
113 
114     PIXImporter(libfwbuilder::FWObject *lib,
115                 std::istringstream &input,
116                 libfwbuilder::Logger *log,
117                 const std::string &fwname);
118     ~PIXImporter();
119 
120     virtual void clear();
121 
122     void clearTempVars();
123 
124     void addGlobalPool();
125 
126     virtual void run();
127 
128     void pushPolicyRule();
129     void pushNATRule();
130     void buildDNATRule();
131     void buildSNATRule();
132     void buildNoNATRule();
133     virtual void pushRule();
134 
135     // this method actually adds interfaces to the firewall object
136     // and does final clean up.
137     virtual libfwbuilder::Firewall* finalize();
138 
139     virtual libfwbuilder::FWObject* makeSrcObj();
140     virtual libfwbuilder::FWObject* makeDstObj();
141     virtual libfwbuilder::FWObject* makeSrvObj();
142 
143     virtual void addLogging();
144 
145     void fixServiceObjectUsedForSrcPorts();
146     void fixServiceObjectUsedForBothSrcAndDstPorts();
147 
148     /*
149      * the difference is that in PIX, we get interface label instead
150      * of its name in "access-group" command
151      */
152     virtual void setInterfaceAndDirectionForRuleSet(
153         const std::string &ruleset_name,
154         const std::string &interface_name,
155         const std::string &dir);
156 
157     virtual void newNamedObjectAddress(const std::string &name);
158     virtual void newNamedObjectService(const std::string &name);
159 
160     /*
161      * it looks like "description" line is always the last in the
162      * named object block output of "show run" command on ASA, however
163      * "description" is optional and we create the object when we see
164      * "subnet", "host" or "service" line. This function adds
165      * description to existing named object.
166      */
167     virtual void setNamedObjectDescription(const std::string &txt);
168 
169     virtual void commitNamedAddressObject();
170     virtual void commitNamedAddressRangeObject();
171     virtual void commitNamedIPServiceObject();
172     virtual void commitNamedICMPServiceObject();
173     virtual void commitNamedTCPUDPServiceObject();
174 
175     virtual libfwbuilder::FWObject* commitObject(libfwbuilder::FWObject *obj);
176     virtual libfwbuilder::FWObject* setNameOfNamedObject(
177         libfwbuilder::FWObject *obj);
178 
179     void newObjectGroupNetwork(const std::string &group_name);
180     void newObjectGroupService(const std::string &group_name);
181     void newObjectGroupProtocol(const std::string &group_name);
182     void newObjectGroupICMP(const std::string &group_name);
183 
184     bool isKnownServiceGroupName(const std::string &object_group_name);
185 
setObjectGroupServiceProtocol(const std::string & proto)186     void setObjectGroupServiceProtocol(const std::string &proto)
187     { object_group_service_protocol = proto.c_str(); }
188 
189     void setObjectGroupDescription(const std::string &descr);
190 
191     void addNamedObjectToObjectGroup(const std::string &object_name);
192 
193     void addNetworkToObjectGroup();
194     void addIPServiceToObjectGroup();
195     void addTCPUDPServiceToObjectGroup();
196     void addICMPServiceToObjectGroup();
197 
198     libfwbuilder::Interface* getInterfaceByLabel(const std::string &label);
199 
200     void rearrangeVlanInterfaces();
201 };
202 
203 #endif
204