Re: is the generated script's commands in random order?

Halo,

I am resending this because my earlier response was blocked due to excessive size (65k).
Teh moderator can cancel it.

Simon Edwards wrote:
> Hello,
> 
> What you are saying is that you would like any kind of consistent order? ;)
> 

I think so,
Look the following example.
I load guarddog and make a simple change (allow SMB in one of my local subnets).
I keep the snapshots before and after the change. Here is the diff

--- rc.firewall.1       2005-12-27 15:07:29.000000000 +0200
+++ rc.firewall.2       2005-12-27 15:07:52.000000000 +0200
@@ -126,7 +126,6 @@
   # CONNECTED=1
   # [ClientZone] virtual
   # CONNECTED=1
-# PROTOCOL=microsoft-ds
   # [ServerZone] home
   # [ClientZone] Internet
   # CONNECTED=1
@@ -992,10 +991,6 @@
   # Rejected traffic from 'virtual' to 'Internet'

   # Traffic from 'virtual' to 'Local'
-# Allow 'microsoft-ds'
-# SMB over TCP
-ipchains -A f4to1 -p tcp --sport 0:65535 --dport 445:445 -j ACCEPT
-ipchains -A f1to4 -p tcp ! -y --sport 445:445 --dport 0:65535 -j ACCEPT

   # Rejected traffic from 'virtual' to 'Local'

@@ -1849,9 +1844,6 @@
   # Rejected traffic from 'virtual' to 'Internet'

   # Traffic from 'virtual' to 'Local'
-# Allow 'microsoft-ds'
-# SMB over TCP
-iptables -A f4to1 -p tcp --sport 0:65535 --dport 445:445 -m state --state NEW -
j ACCEPT

   # Rejected traffic from 'virtual' to 'Local'

So far so good.

Now if I quit guarddog and rerun it, and hit the apply button I would expect
the diff to be zero length instead of 1295 lines just to reorder protocols.
If I can have diff I can use some sort of revision control for my
configuration files. I still can but the changes are not visible. Instead
they are buried under unneeded protocol order changes (see attachment.)

Another argument is that if you can easily diff guarrdog output it would be
easier to 1) debug network problems and 2) educate users in iptables usage
at the same time.

So in other words I would like the output of guarddog to be diffable across
multiple runs, but of course not guarddog releases or even upgrades.

        .bill

example-- rc.firewall.2       2005-12-27 15:07:52.000000000 +0200
+++ rc.firewall.3       2005-12-27 15:09:35.000000000 +0200
@@ -50,44 +50,44 @@
  # [ServerZone] Internet
  # [ClientZone] Local
  # CONNECTED=1
+# PROTOCOL=bt-peer
+# PROTOCOL=netmeeting
+# PROTOCOL=telnet
+# PROTOCOL=cvspserver
+# PROTOCOL=edonkey2000
+# PROTOCOL=ssh
+# PROTOCOL=http
+# PROTOCOL=pop2
+# PROTOCOL=ftp
  # PROTOCOL=directconnect
-# PROTOCOL=nntp
-# PROTOCOL=netbios
  # PROTOCOL=ping
-# PROTOCOL=https
+# PROTOCOL=domain
+# PROTOCOL=netbios
+# PROTOCOL=microsoft-ds
  # PROTOCOL=smtp
+# PROTOCOL=nntp
+# PROTOCOL=https
  # PROTOCOL=imaps
+# PROTOCOL=imap
+# PROTOCOL=bt-tracker
+# PROTOCOL=rsync
+# PROTOCOL=pop3
  # PROTOCOL=nfs
-# PROTOCOL=http
  # PROTOCOL=x11
-# PROTOCOL=telnet
  # PROTOCOL=pop3s
-# PROTOCOL=pop2
-# PROTOCOL=pop3
-# PROTOCOL=rsync
-# PROTOCOL=bt-tracker
-# PROTOCOL=ftp
-# PROTOCOL=edonkey2000
-# PROTOCOL=microsoft-ds
-# PROTOCOL=cvspserver
-# PROTOCOL=domain
-# PROTOCOL=ssh
-# PROTOCOL=netmeeting
-# PROTOCOL=bt-peer
-# PROTOCOL=imap
  # [ClientZone] home
  # CONNECTED=1

[snipped the rest due to excessive size]



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click