Skip to content

Commit 4a9cc14

Browse files
author
Mike Moss
committed
finally got around to making the rules prettier (any instead of 0.0.0.0/0)
1 parent 5349831 commit 4a9cc14

11 files changed

+170
-25
lines changed

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ bin/wofgen_netsh
66
bin/wofgen_netsh.exe
77
bin/wofgen_pf
88
bin/wofgen_pf.exe
9+
bin/wofgen_ipf
10+
bin/wofgen_ipf.exe
911
bin/wofgen_ufw
1012
bin/wofgen_ufw.exe
1113
bin/wofgen_wipfw

‎bin/Makefile

+5-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ SRC=../src
55

66
WOFGEN_SRC=$(SRC)/main.cpp $(SRC)/parser.cpp $(SRC)/parser_util.cpp $(SRC)/string_util.cpp
77

8-
all: wofgen_ipfw wofgen_iptables wofgen_netsh wofgen_pf wofgen_ufw wofgen_wipfw
8+
all: wofgen_ipfw wofgen_iptables wofgen_netsh wofgen_pf wofgen_ipf wofgen_ufw wofgen_wipfw
99

1010
wofgen_ipfw: $(WOFGEN_SRC) $(SRC)/ipfw.cpp
1111
$(CXX) $(CFLAGS) $^ -o $@ -D WOFGEN_IPFW
@@ -19,6 +19,9 @@ wofgen_netsh: $(WOFGEN_SRC) $(SRC)/netsh.cpp
1919
wofgen_pf: $(WOFGEN_SRC) $(SRC)/pf.cpp
2020
$(CXX) $(CFLAGS) $^ -o $@ -D WOFGEN_PF
2121

22+
wofgen_ipf: $(WOFGEN_SRC) $(SRC)/ipf.cpp
23+
$(CXX) $(CFLAGS) $^ -o $@ -D WOFGEN_IPF
24+
2225
wofgen_ufw: $(WOFGEN_SRC) $(SRC)/ufw.cpp
2326
$(CXX) $(CFLAGS) $^ -o $@ -D WOFGEN_UFW
2427

@@ -30,5 +33,6 @@ clean:
3033
- rm -f wofgen_iptables wofgen_iptables.exe
3134
- rm -f wofgen_netsh wofgen_netsh.exe
3235
- rm -f wofgen_pf wofgen_pf.exe
36+
- rm -f wofgen_ipf wofgen_ipf.exe
3337
- rm -f wofgen_ufw wofgen_ufw.exe
3438
- rm -f wofgen_wipfw wofgen_wipfw.exe

‎src/ipf.cpp

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
#include "parser.hpp"
2+
#include <string>
3+
4+
std::string pre_rules(std::string def_out,std::string def_in)
5+
{
6+
if(def_out=="deny")
7+
def_out="block";
8+
else
9+
def_out="pass ";
10+
if(def_in=="deny")
11+
def_in="block";
12+
else
13+
def_in="pass ";
14+
std::string pre;
15+
pre+="#Usually goes in: /etc/ipf/ipf.conf\n";
16+
pre+="#You may need to enable the firewall service: svcadm enable ipfilter\n";
17+
pre+=def_out+" out log all\n";
18+
pre+=def_in+" in log all\n";
19+
return pre;
20+
}
21+
22+
std::string post_rules(std::string def_out,std::string def_in)
23+
{
24+
return "";
25+
}
26+
27+
std::string gen_rule(wof_t wof)
28+
{
29+
if(wof_is_any_ip(wof.l_ip,wof.l_mask,wof.V6))
30+
wof.l_ip="any";
31+
if(wof_is_any_ip(wof.f_ip,wof.f_mask,wof.V6))
32+
wof.f_ip="any";
33+
if(wof.l_mask!="0"&&!wof_is_exact_ip(wof.l_mask,wof.V6))
34+
wof.l_ip+="/"+wof.l_mask;
35+
if(wof.f_mask!="0"&&!wof_is_exact_ip(wof.f_mask,wof.V6))
36+
wof.f_ip+="/"+wof.f_mask;
37+
38+
std::string rule;
39+
if(wof.action=="deny")
40+
rule+="block";
41+
else
42+
rule+="pass ";
43+
std::string dir_str=" out";
44+
if(wof.dir=="<")
45+
{
46+
dir_str=" in ";
47+
std::swap(wof.l_ip,wof.f_ip);
48+
std::swap(wof.l_mask,wof.f_mask);
49+
std::swap(wof.l_port,wof.f_port);
50+
}
51+
rule+=dir_str;
52+
rule+=" log quick ";
53+
rule+="proto "+wof.proto;
54+
55+
if(wof.l_ip!="any"||wof.l_port!="0")
56+
rule+=" from";
57+
if(wof.l_ip!="any")
58+
rule+=" "+wof.l_ip;
59+
if(wof.l_port!="0")
60+
rule+=" port="+wof.l_port;
61+
62+
if(wof.f_ip!="any"||wof.f_port!="0")
63+
rule+=" to";
64+
if(wof.f_ip!="any")
65+
rule+=" "+wof.f_ip;
66+
if(wof.f_port!="0")
67+
rule+=" port="+wof.f_port;
68+
rule+=" keep state";
69+
70+
return rule;
71+
}

‎src/ipfw.cpp

+11-2
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,15 @@ std::string post_rules(std::string def_out,std::string def_in)
2525

2626
std::string gen_rule(wof_t wof)
2727
{
28+
if(wof_is_any_ip(wof.l_ip,wof.l_mask,wof.V6))
29+
wof.l_ip="any";
30+
if(wof_is_any_ip(wof.f_ip,wof.f_mask,wof.V6))
31+
wof.f_ip="any";
32+
if(wof.l_mask!="0"&&!wof_is_exact_ip(wof.l_mask,wof.V6))
33+
wof.l_ip+="/"+wof.l_mask;
34+
if(wof.f_mask!="0"&&!wof_is_exact_ip(wof.f_mask,wof.V6))
35+
wof.f_ip+="/"+wof.f_mask;
36+
2837
std::string rule;
2938
rule+="ipfw -q add ";
3039
if(wof.action=="deny")
@@ -41,10 +50,10 @@ std::string gen_rule(wof_t wof)
4150
std::swap(wof.l_port,wof.f_port);
4251
}
4352
rule+=wof.proto;
44-
rule+=" from "+wof.l_ip+"/"+wof.l_mask;
53+
rule+=" from "+wof.l_ip;
4554
if(wof.l_port!="0")
4655
rule+=" "+wof.l_port;
47-
rule+=" to "+wof.f_ip+"/"+wof.f_mask;
56+
rule+=" to "+wof.f_ip;
4857
if(wof.f_port!="0")
4958
rule+=" "+wof.f_port;
5059
rule+=dir_str;

‎src/iptables.cpp

+18-5
Original file line numberDiff line numberDiff line change
@@ -65,12 +65,21 @@ std::string post_rules(std::string def_out,std::string def_in)
6565

6666
std::string gen_rule(wof_t wof)
6767
{
68-
std::string rule;
68+
if(wof_is_any_ip(wof.l_ip,wof.l_mask,wof.V6))
69+
wof.l_ip="any";
70+
if(wof_is_any_ip(wof.f_ip,wof.f_mask,wof.V6))
71+
wof.f_ip="any";
72+
if(wof.l_mask!="0"&&!wof_is_exact_ip(wof.l_mask,wof.V6))
73+
wof.l_ip+="/"+wof.l_mask;
74+
if(wof.f_mask!="0"&&!wof_is_exact_ip(wof.f_mask,wof.V6))
75+
wof.f_ip+="/"+wof.f_mask;
76+
77+
std::string rule;
6978
if(wof.V6)
7079
rule+="ip6tables";
7180
else
7281
rule+="iptables";
73-
rule+=" --append ";
82+
rule+=" -A ";
7483
std::string dir_str="OUTPUT";
7584
std::string l_letter="s";
7685
std::string f_letter="d";
@@ -81,17 +90,21 @@ std::string gen_rule(wof_t wof)
8190
}
8291
rule+=dir_str;
8392
rule+=" -p "+wof.proto;
84-
rule+=" -" +l_letter+" " +wof.l_ip+"/"+wof.l_mask;
8593

94+
if(wof.l_ip!="any")
95+
rule+=" -" +l_letter+" " +wof.l_ip;
8696
if(wof.l_port!="0")
8797
rule+=" --"+l_letter+"port "+wof.l_port;
88-
rule+=" -" +f_letter+" " +wof.f_ip+"/"+wof.f_mask;
98+
if(wof.f_ip!="any")
99+
rule+=" -" +f_letter+" " +wof.f_ip;
89100
if(wof.f_port!="0")
90101
rule+=" --"+f_letter+"port "+wof.f_port;
91-
rule+=" --jump ";
102+
rule+=" -j ";
103+
92104
if(wof.action=="deny")
93105
rule+="DROP";
94106
else
95107
rule+="ACCEPT";
108+
96109
return rule;
97110
}

‎src/netsh.cpp

+13-10
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,15 @@ std::string post_rules(std::string def_out,std::string def_in)
3838

3939
std::string gen_rule(wof_t wof)
4040
{
41+
if(wof_is_any_ip(wof.l_ip,wof.l_mask,wof.V6))
42+
wof.l_ip="any";
43+
if(wof_is_any_ip(wof.f_ip,wof.f_mask,wof.V6))
44+
wof.f_ip="any";
45+
if(wof.l_mask!="0"&&!wof_is_exact_ip(wof.l_mask,wof.V6))
46+
wof.l_ip+="/"+wof.l_mask;
47+
if(wof.f_mask!="0"&&!wof_is_exact_ip(wof.f_mask,wof.V6))
48+
wof.f_ip+="/"+wof.f_mask;
49+
4150
std::string rule;
4251
rule+="netsh advfirewall firewall add rule profile=any ";
4352
rule+="name=\""+to_string(rule_num++)+"\"";
@@ -50,16 +59,10 @@ std::string gen_rule(wof_t wof)
5059
else
5160
rule+=" action=allow";
5261
rule+=" protocol="+wof.proto;
53-
rule+=" localip=";
54-
if(wof.l_mask!="0")
55-
rule+=wof.l_ip+"/"+wof.l_mask;
56-
else
57-
rule+="any";
58-
rule+=" remoteip=";
59-
if(wof.f_mask!="0")
60-
rule+=wof.f_ip+"/"+wof.f_mask;
61-
else
62-
rule+="any";
62+
if(wof.l_ip!="any")
63+
rule+=" localip="+wof.l_ip;
64+
if(wof.f_ip!="any")
65+
rule+=" remoteip="+wof.f_ip;
6366
if(wof.l_port!="0")
6467
rule+=" localport="+wof.l_port;
6568
if(wof.f_port!="0")

‎src/parser.cpp

+10
Original file line numberDiff line numberDiff line change
@@ -73,4 +73,14 @@ void wof_parse_line(std::string line,std::string& output,
7373
if(line.size()>0)
7474
throw std::runtime_error("Unknown string \""+line+"\".");
7575
}
76+
}
77+
78+
bool wof_is_any_ip(const std::string& ip,const std::string& mask,const bool V6)
79+
{
80+
return (mask=="0"||(!V6&&ip=="0.0.0.0")||(V6&&ip=="::"));
81+
}
82+
83+
bool wof_is_exact_ip(const std::string& mask,const bool V6)
84+
{
85+
return ((!V6&&mask=="32")||(V6&&mask=="128"));
7686
}

‎src/parser.hpp

+4
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,8 @@ struct wof_t
2020
void wof_parse_line(std::string line,std::string& output,
2121
std::string& def_out,std::string& def_in);
2222

23+
bool wof_is_any_ip(const std::string& ip,const std::string& mask,const bool V6);
24+
25+
bool wof_is_exact_ip(const std::string& mask,const bool V6);
26+
2327
#endif

‎src/pf.cpp

+11-2
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,15 @@ std::string post_rules(std::string def_out,std::string def_in)
2525

2626
std::string gen_rule(wof_t wof)
2727
{
28+
if(wof_is_any_ip(wof.l_ip,wof.l_mask,wof.V6))
29+
wof.l_ip="any";
30+
if(wof_is_any_ip(wof.f_ip,wof.f_mask,wof.V6))
31+
wof.f_ip="any";
32+
if(wof.l_mask!="0"&&!wof_is_exact_ip(wof.l_mask,wof.V6))
33+
wof.l_ip+="/"+wof.l_mask;
34+
if(wof.f_mask!="0"&&!wof_is_exact_ip(wof.f_mask,wof.V6))
35+
wof.f_ip+="/"+wof.f_mask;
36+
2837
std::string rule;
2938
if(wof.action=="deny")
3039
rule+="block";
@@ -45,10 +54,10 @@ std::string gen_rule(wof_t wof)
4554
else
4655
rule+="inet ";
4756
rule+="proto "+wof.proto;
48-
rule+=" from "+wof.l_ip+"/"+wof.l_mask;
57+
rule+=" from "+wof.l_ip;
4958
if(wof.l_port!="0")
5059
rule+=" port "+wof.l_port;
51-
rule+=" to "+wof.f_ip+"/"+wof.f_mask;
60+
rule+=" to "+wof.f_ip;
5261
if(wof.f_port!="0")
5362
rule+=" port "+wof.f_port;
5463

‎src/ufw.cpp

+13-2
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,22 @@ std::string post_rules(std::string def_out,std::string def_in)
2323

2424
std::string gen_rule(wof_t wof)
2525
{
26+
if(wof_is_any_ip(wof.l_ip,wof.l_mask,wof.V6))
27+
wof.l_ip="any";
28+
if(wof_is_any_ip(wof.f_ip,wof.f_mask,wof.V6))
29+
wof.f_ip="any";
30+
if(wof.l_mask!="0"&&!wof_is_exact_ip(wof.l_mask,wof.V6))
31+
wof.l_ip+="/"+wof.l_mask;
32+
if(wof.f_mask!="0"&&!wof_is_exact_ip(wof.f_mask,wof.V6))
33+
wof.f_ip+="/"+wof.f_mask;
34+
2635
std::string rule;
2736
rule+="ufw ";
2837
if(wof.action=="deny")
2938
rule+="deny";
3039
else
3140
rule+="allow";
41+
3242
std::string dir_str=" out";
3343
if(wof.dir=="<")
3444
{
@@ -37,12 +47,13 @@ std::string gen_rule(wof_t wof)
3747
std::swap(wof.l_mask,wof.f_mask);
3848
std::swap(wof.l_port,wof.f_port);
3949
}
50+
4051
rule+=dir_str;
4152
rule+=" proto "+wof.proto;
42-
rule+=" from "+wof.l_ip+"/"+wof.l_mask;
53+
rule+=" from "+wof.l_ip;
4354
if(wof.l_port!="0")
4455
rule+=" port "+wof.l_port;
45-
rule+=" to "+wof.f_ip+"/"+wof.f_mask;
56+
rule+=" to "+wof.f_ip;
4657
if(wof.f_port!="0")
4758
rule+=" port "+wof.f_port;
4859

‎src/wipfw.cpp

+12-3
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,15 @@ std::string post_rules(std::string def_out,std::string def_in)
2121

2222
std::string gen_rule(wof_t wof)
2323
{
24+
if(wof_is_any_ip(wof.l_ip,wof.l_mask,wof.V6))
25+
wof.l_ip="any";
26+
if(wof_is_any_ip(wof.f_ip,wof.f_mask,wof.V6))
27+
wof.f_ip="any";
28+
if(wof.l_mask!="0"&&!wof_is_exact_ip(wof.l_mask,wof.V6))
29+
wof.l_ip+="/"+wof.l_mask;
30+
if(wof.f_mask!="0"&&!wof_is_exact_ip(wof.f_mask,wof.V6))
31+
wof.f_ip+="/"+wof.f_mask;
32+
2433
std::string rule;
2534
rule+="-q add ";
2635
if(wof.action=="deny")
@@ -37,14 +46,14 @@ std::string gen_rule(wof_t wof)
3746
std::swap(wof.l_port,wof.f_port);
3847
}
3948
rule+=wof.proto;
40-
rule+=" from "+wof.l_ip+"/"+wof.l_mask;
49+
rule+=" from "+wof.l_ip;
4150
if(wof.l_port!="0")
4251
rule+=" "+wof.l_port;
43-
rule+=" to "+wof.f_ip+"/"+wof.f_mask;
52+
rule+=" to "+wof.f_ip;
4453
if(wof.f_port!="0")
4554
rule+=" "+wof.f_port;
4655
rule+=dir_str;
4756
rule+=" keep-state";
4857

4958
return rule;
50-
}
59+
}

0 commit comments

Comments
 (0)