From ad446d7308c8a8bee3731d6b43186efd856d7648 Mon Sep 17 00:00:00 2001 From: Vadim Kurland Date: Tue, 10 Jun 2008 04:18:57 +0000 Subject: [PATCH] int IDs in compiler for cisco ACLs --- src/cisco_lib/Helper.cpp | 65 +++++++++++--------- src/cisco_lib/Helper.h | 12 ++-- src/cisco_lib/PolicyCompiler_cisco.cpp | 35 ++++++----- src/cisco_lib/PolicyCompiler_cisco.h | 4 +- src/cisco_lib/PolicyCompiler_cisco_acls.cpp | 31 +++++----- src/iosacl/PolicyCompiler_iosacl_writers.cpp | 19 +++--- 6 files changed, 90 insertions(+), 76 deletions(-) diff --git a/src/cisco_lib/Helper.cpp b/src/cisco_lib/Helper.cpp index b34a0933a..e12ea423f 100644 --- a/src/cisco_lib/Helper.cpp +++ b/src/cisco_lib/Helper.cpp @@ -98,48 +98,51 @@ void Helper::expand_group_recursive(FWObject *o,list &ol) } } -string Helper::findInterfaceByAddress(libfwbuilder::Address *obj) +int Helper::findInterfaceByAddress(Address *obj) { return findInterfaceByAddress( obj->getAddressPtr() ); } -string Helper::findInterfaceByAddress(const libfwbuilder::InetAddr *addr) +int Helper::findInterfaceByAddress(const InetAddr *addr) { - if (addr==NULL) return ""; + if (addr==NULL) return -1; Firewall *fw=compiler->fw; list l2=fw->getByType(Interface::TYPENAME); - for (list::iterator i=l2.begin(); i!=l2.end(); ++i) { + for (list::iterator i=l2.begin(); i!=l2.end(); ++i) + { Interface *iface=Interface::cast(*i); if ( iface->belongs( *addr ) ) return iface->getId(); } - return ""; + return -1; } -string Helper::findInterfaceByNetzone(Address *obj) +int Helper::findInterfaceByNetzone(Address *obj) { return findInterfaceByNetzone(obj->getAddressPtr()); } -string Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string) +int Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string) { - if (addr==NULL) return ""; + if (addr==NULL) return -1; Firewall *fw=compiler->fw; - map zones; + map zones; FWObjectTypedChildIterator i=fw->findByType(Interface::TYPENAME); for ( ; i!=i.end(); ++i) { - string netzone_id = (*i)->getStr("network_zone"); - if (netzone_id != "") + // NOTE: "network_zone" is globally unique string ID + int netzone_id = + FWObjectDatabase::getIntId((*i)->getStr("network_zone")); + if (netzone_id != -1) { - FWObject *netzone=fw->getRoot()->findInIndex(netzone_id); + FWObject *netzone = fw->getRoot()->findInIndex(netzone_id); for (list::iterator j=netzone->begin(); j!=netzone->end(); ++j) { assert(Address::cast(*j)!=NULL); if (Address::cast(*j)->belongs(*addr)) - zones[(*i)->getId()]=netzone; + zones[(*i)->getId()] = netzone; } } } @@ -148,13 +151,13 @@ string Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string) * now compare dimensions of all netzones that contain address obj and * pick the one with smallest dimension */ - string res_id; + int res_id = -1; unsigned long res_dim=LONG_MAX; - for (map::iterator i=zones.begin(); i!=zones.end(); ++i) + for (map::iterator i=zones.begin(); i!=zones.end(); ++i) { - string iface_id=(*i).first; - FWObject *netzone=(*i).second; - unsigned long dim=calculateDimension(netzone); + int iface_id = (*i).first; + FWObject *netzone = (*i).second; + unsigned long dim = calculateDimension(netzone); if (dim<=res_dim) { @@ -167,18 +170,18 @@ string Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string) * Subnets defined by addresses of interfaces are automatically part * of the corresponding network zones */ - if (res_id.empty()) res_id=findInterfaceByAddress( addr ); + if (res_id == -1) res_id = findInterfaceByAddress( addr ); - if (res_id.empty()) + if (res_id == -1) throw(string("Can not find interface with network zone that includes " "address ") + addr->toString()); return res_id; } -list Helper::getAllInterfaceIDs() +list Helper::getAllInterfaceIDs() { - Firewall *fw=compiler->fw; - list intf_id_list; + Firewall *fw = compiler->fw; + list intf_id_list; FWObjectTypedChildIterator i=fw->findByType(Interface::TYPENAME); for ( ; i!=i.end(); ++i) { @@ -190,10 +193,10 @@ list Helper::getAllInterfaceIDs() return intf_id_list; } -list Helper::findInterfaceByNetzoneOrAll(RuleElement *re) +list Helper::findInterfaceByNetzoneOrAll(RuleElement *re) { - Firewall *fw=compiler->fw; - list intf_id_list; + Firewall *fw = compiler->fw; + list intf_id_list; if (re->isAny()) { return getAllInterfaceIDs(); @@ -242,7 +245,11 @@ list Helper::findInterfaceByNetzoneOrAll(RuleElement *re) string triplet::hash() { - return src->getAddressPtr()->toString() + "." + - dst->getAddressPtr()->toString() + "." + - srv->getId(); + ostringstream ostr; + ostr << src->getAddressPtr()->toString() + << "." + << dst->getAddressPtr()->toString() + <<"." + << srv->getId(); + return ostr.str(); } diff --git a/src/cisco_lib/Helper.h b/src/cisco_lib/Helper.h index f89d904dd..992b0bd83 100644 --- a/src/cisco_lib/Helper.h +++ b/src/cisco_lib/Helper.h @@ -49,19 +49,19 @@ namespace fwcompiler { * finds interface of the firewall to whose subnet object * 'obj' belongs to. Returns interface ID */ - std::string findInterfaceByAddress(const libfwbuilder::InetAddr *a); - std::string findInterfaceByAddress(libfwbuilder::Address *obj); + int findInterfaceByAddress(const libfwbuilder::InetAddr *a); + int findInterfaceByAddress(libfwbuilder::Address *obj); /** * finds interface of the firewall associated with the netzone * that object 'obj' belongs to. Returns interface ID */ - std::string findInterfaceByNetzone(const libfwbuilder::InetAddr *a) + int findInterfaceByNetzone(const libfwbuilder::InetAddr *a) throw(std::string); - std::string findInterfaceByNetzone(libfwbuilder::Address *obj); - std::list findInterfaceByNetzoneOrAll( + int findInterfaceByNetzone(libfwbuilder::Address *obj); + std::list findInterfaceByNetzoneOrAll( libfwbuilder::RuleElement *re); - std::list getAllInterfaceIDs(); + std::list getAllInterfaceIDs(); /** * recursively expands object 'o' and places all its children diff --git a/src/cisco_lib/PolicyCompiler_cisco.cpp b/src/cisco_lib/PolicyCompiler_cisco.cpp index 213795d55..45bc6a8c9 100644 --- a/src/cisco_lib/PolicyCompiler_cisco.cpp +++ b/src/cisco_lib/PolicyCompiler_cisco.cpp @@ -107,9 +107,10 @@ void PolicyCompiler_cisco::addDefaultPolicyRule() !getCachedFwOpt()->getStr("mgmt_addr").empty() ) { PolicyRule *r; - TCPService *ssh=TCPService::cast(dbcopy->create(TCPService::TYPENAME) ); - ssh->setInt("dst_range_start",22); - ssh->setInt("dst_range_end",22); + TCPService *ssh = TCPService::cast( + dbcopy->create(TCPService::TYPENAME) ); + ssh->setDstRangeStart(22); + ssh->setDstRangeEnd(22); dbcopy->add(ssh,false); cacheObj(ssh); // to keep cache consistent @@ -225,11 +226,11 @@ bool PolicyCompiler_cisco::splitIfDstAny::processNext() if (ICMPService::isA(s)) cl.push_back(s); if (TCPService::isA(s) && - s->getInt("dst_range_start")==22 && - s->getInt("dst_range_end")==22) cl.push_back(s); + TCPUDPService::cast(s)->getDstRangeStart()==22 && + TCPUDPService::cast(s)->getDstRangeEnd()==22) cl.push_back(s); if (TCPService::isA(s) && - s->getInt("dst_range_start")==23 && - s->getInt("dst_range_end")==23) cl.push_back(s); + TCPUDPService::cast(s)->getDstRangeStart()==23 && + TCPUDPService::cast(s)->getDstRangeEnd()==23) cl.push_back(s); } @@ -539,8 +540,8 @@ bool PolicyCompiler_cisco::tcpServiceToFW::processNext() assert(s!=NULL); if (TCPService::isA(s) && - s->getInt("dst_range_start")==port && - s->getInt("dst_range_end")==port) cl.push_back(o); + TCPUDPService::cast(s)->getDstRangeStart()==port && + TCPUDPService::cast(s)->getDstRangeEnd()==port) cl.push_back(o); } if (!cl.empty()) { @@ -635,7 +636,8 @@ bool PolicyCompiler_cisco::replaceFWinDSTPolicy::processNext() { try { - string iface_id=helper.findInterfaceByNetzone(compiler->getFirstSrc(rule)); + int iface_id = helper.findInterfaceByNetzone( + compiler->getFirstSrc(rule)); Interface *iface = compiler->getCachedFwInterface(iface_id); dst->clearChildren(); @@ -657,17 +659,16 @@ bool PolicyCompiler_cisco::replaceFWinDSTPolicy::processNext() } void PolicyCompiler_cisco::splitByNetworkZonesForRE::AddToInterface( - const std::string &interface_id, - libfwbuilder::Address *addr, - PolicyRule *rule) + int interface_id, Address *addr, PolicyRule *rule) { PolicyRule *new_rule; RuleElement *new_re; - new_rule=rules[interface_id]; + new_rule = rules[interface_id]; if (new_rule==NULL) { - new_rule= PolicyRule::cast(compiler->dbcopy->create(PolicyRule::TYPENAME) ); + new_rule = PolicyRule::cast(compiler->dbcopy->create( + PolicyRule::TYPENAME) ); compiler->temp_ruleset->add(new_rule); new_rule->duplicate(rule); rules[interface_id]=new_rule; @@ -705,7 +706,7 @@ bool PolicyCompiler_cisco::splitByNetworkZonesForRE::processNext() try { - string interface_id=helper.findInterfaceByNetzone(a); + int interface_id = helper.findInterfaceByNetzone(a); AddToInterface(interface_id, a, rule); } catch (string err) { @@ -731,7 +732,7 @@ bool PolicyCompiler_cisco::splitByNetworkZonesForRE::processNext() } } } - for (std::map::iterator i=rules.begin(); + for (std::map::iterator i=rules.begin(); i!=rules.end(); ++i) { tmp_queue.push_back((*i).second); diff --git a/src/cisco_lib/PolicyCompiler_cisco.h b/src/cisco_lib/PolicyCompiler_cisco.h index a2b2e7add..236f5bdf1 100644 --- a/src/cisco_lib/PolicyCompiler_cisco.h +++ b/src/cisco_lib/PolicyCompiler_cisco.h @@ -310,8 +310,8 @@ protected: class splitByNetworkZonesForRE : public PolicyRuleProcessor { std::string re_type; - std::map rules; - void AddToInterface(const std::string &interface_id, + std::map rules; + void AddToInterface(int interface_id, libfwbuilder::Address *addr, libfwbuilder::PolicyRule *rule); public: diff --git a/src/cisco_lib/PolicyCompiler_cisco_acls.cpp b/src/cisco_lib/PolicyCompiler_cisco_acls.cpp index 29a5e4bbc..a8a909a60 100644 --- a/src/cisco_lib/PolicyCompiler_cisco_acls.cpp +++ b/src/cisco_lib/PolicyCompiler_cisco_acls.cpp @@ -65,12 +65,12 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionBySrc::processNext() PolicyRule *rule=getNext(); if (rule==NULL) return false; Helper helper(compiler); - RuleElementItf *itfre=rule->getItf(); - RuleElementSrc *srcre=rule->getSrc(); + //RuleElementItf *itfre = rule->getItf(); + RuleElementSrc *srcre = rule->getSrc(); - list intf_id_list; + list intf_id_list; - if (rule->getInterfaceId().empty()) + if (rule->getInterfaceId() == -1) { if (rule->getDirection()==PolicyRule::Both) intf_id_list = helper.findInterfaceByNetzoneOrAll( srcre ); @@ -78,9 +78,10 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionBySrc::processNext() if (rule->getDirection()==PolicyRule::Inbound) intf_id_list = helper.getAllInterfaceIDs(); - for (list::iterator i = intf_id_list.begin(); i!=intf_id_list.end(); ++i) + for (list::iterator i = intf_id_list.begin(); + i!=intf_id_list.end(); ++i) { - string intf_id = *i; + int intf_id = *i; Interface *ifs = Interface::cast( rule->getRoot()->findInIndex(intf_id) ); assert(ifs); @@ -114,12 +115,12 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionByDst::processNext() return true; } - RuleElementItf *itfre=rule->getItf(); + //RuleElementItf *itfre=rule->getItf(); RuleElementDst *dstre=rule->getDst(); - list intf_id_list; + list intf_id_list; - if (rule->getInterfaceId().empty()) + if (rule->getInterfaceId() == -1) { if (rule->getDirection()==PolicyRule::Both) intf_id_list = helper.findInterfaceByNetzoneOrAll( dstre ); @@ -127,9 +128,9 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionByDst::processNext() if (rule->getDirection()==PolicyRule::Outbound) intf_id_list = helper.getAllInterfaceIDs(); - for (list::iterator i = intf_id_list.begin(); i!=intf_id_list.end(); ++i) + for (list::iterator i = intf_id_list.begin(); i!=intf_id_list.end(); ++i) { - string intf_id = *i; + int intf_id = *i; Interface *ifs = Interface::cast( rule->getRoot()->findInIndex(intf_id) ); assert(ifs); @@ -153,9 +154,9 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionIfInterfaceSet::processNext() { PolicyRule *rule=getNext(); if (rule==NULL) return false; - RuleElementItf *itfre=rule->getItf(); + //RuleElementItf *itfre=rule->getItf(); - if (rule->getInterfaceId().empty() || + if (rule->getInterfaceId() == -1 || rule->getBool("interface_and_direction_set_from_src") || rule->getBool("interface_and_direction_set_from_dst")) { @@ -165,9 +166,9 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionIfInterfaceSet::processNext() PolicyRule *new_rule; - if ( ! rule->getInterfaceId().empty() ) + if ( rule->getInterfaceId() > -1 ) { - string rule_iface_id = rule->getInterfaceId(); + int rule_iface_id = rule->getInterfaceId(); if (rule->getDirection()==PolicyRule::Both) { diff --git a/src/iosacl/PolicyCompiler_iosacl_writers.cpp b/src/iosacl/PolicyCompiler_iosacl_writers.cpp index ed86c2a90..5041a3ad6 100644 --- a/src/iosacl/PolicyCompiler_iosacl_writers.cpp +++ b/src/iosacl/PolicyCompiler_iosacl_writers.cpp @@ -174,7 +174,7 @@ string PolicyCompiler_iosacl::PrintRule::_printRule(PolicyRule *rule) { PolicyCompiler_iosacl *iosacl_comp = dynamic_cast(compiler); - FWOptions *ruleopt =rule->getOptionsObject(); + //FWOptions *ruleopt =rule->getOptionsObject(); bool write_comments = compiler->fw->getOptionsObject()->getBool("iosacl_include_comments"); @@ -413,13 +413,18 @@ string PolicyCompiler_iosacl::PrintRule::_printAddr(libfwbuilder::Address *o) } } return str.str(); - } else - { - compiler->abort(string("Object ") + o->getName() + - string(" (id=") + o->getId() + string(") ") + - string(" has no ip address and can not be used ") + - string("in the rule.")); } + + ostringstream errstr; + errstr << "Object " + << o->getName() + << " (id=" + << o->getId() + << ") " + << " has no ip address and can not be used " + << "in the rule."; + compiler->abort(errstr.str()); + return ""; // to make compiler happy } /*