onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-11 15:41:41 +02:00
Code Issues Releases Wiki Activity

int IDs in compiler for cisco ACLs

Browse Source
This commit is contained in:
Vadim Kurland
2008-06-10 04:18:57 +00:00
parent efc9f2f507
commit ad446d7308
6 changed files with 90 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cisco_lib/Helper.cpp
+36 -29
View File
@@ -98,48 +98,51 @@ void Helper::expand_group_recursive(FWObject *o,list<FWObject*> &ol)
} }
} }
string Helper::findInterfaceByAddress(libfwbuilder::Address *obj) int Helper::findInterfaceByAddress(Address *obj)
{ {
return findInterfaceByAddress( obj->getAddressPtr() ); return findInterfaceByAddress( obj->getAddressPtr() );
} }
string Helper::findInterfaceByAddress(const libfwbuilder::InetAddr *addr) int Helper::findInterfaceByAddress(const InetAddr *addr)
{ {
if (addr==NULL) return ""; if (addr==NULL) return -1;
Firewall *fw=compiler->fw; Firewall *fw=compiler->fw;
list<FWObject*> l2=fw->getByType(Interface::TYPENAME); list<FWObject*> l2=fw->getByType(Interface::TYPENAME);
for (list<FWObject*>::iterator i=l2.begin(); i!=l2.end(); ++i) { for (list<FWObject*>::iterator i=l2.begin(); i!=l2.end(); ++i)
{
Interface *iface=Interface::cast(*i); Interface *iface=Interface::cast(*i);
if ( iface->belongs( *addr ) ) return iface->getId(); if ( iface->belongs( *addr ) ) return iface->getId();
} }
return ""; return -1;
} }
string Helper::findInterfaceByNetzone(Address *obj) int Helper::findInterfaceByNetzone(Address *obj)
{ {
return findInterfaceByNetzone(obj->getAddressPtr()); return findInterfaceByNetzone(obj->getAddressPtr());
} }
string Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string) int Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string)
{ {
if (addr==NULL) return ""; if (addr==NULL) return -1;
Firewall *fw=compiler->fw; Firewall *fw=compiler->fw;
map<string,FWObject*> zones; map<int,FWObject*> zones;
FWObjectTypedChildIterator i=fw->findByType(Interface::TYPENAME); FWObjectTypedChildIterator i=fw->findByType(Interface::TYPENAME);
for ( ; i!=i.end(); ++i) for ( ; i!=i.end(); ++i)
{ {
string netzone_id = (*i)->getStr("network_zone"); // NOTE: "network_zone" is globally unique string ID
if (netzone_id != "") int netzone_id =
FWObjectDatabase::getIntId((*i)->getStr("network_zone"));
if (netzone_id != -1)
{ {
FWObject *netzone=fw->getRoot()->findInIndex(netzone_id); FWObject *netzone = fw->getRoot()->findInIndex(netzone_id);
for (list<FWObject*>::iterator j=netzone->begin(); for (list<FWObject*>::iterator j=netzone->begin();
j!=netzone->end(); ++j) j!=netzone->end(); ++j)
{ {
assert(Address::cast(*j)!=NULL); assert(Address::cast(*j)!=NULL);
if (Address::cast(*j)->belongs(*addr)) if (Address::cast(*j)->belongs(*addr))
zones[(*i)->getId()]=netzone; zones[(*i)->getId()] = netzone;
} }
} }
} }
@@ -148,13 +151,13 @@ string Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string)
* now compare dimensions of all netzones that contain address obj and * now compare dimensions of all netzones that contain address obj and
* pick the one with smallest dimension * pick the one with smallest dimension
*/ */
string res_id; int res_id = -1;
unsigned long res_dim=LONG_MAX; unsigned long res_dim=LONG_MAX;
for (map<string,FWObject*>::iterator i=zones.begin(); i!=zones.end(); ++i) for (map<int,FWObject*>::iterator i=zones.begin(); i!=zones.end(); ++i)
{ {
string iface_id=(*i).first; int iface_id = (*i).first;
FWObject *netzone=(*i).second; FWObject *netzone = (*i).second;
unsigned long dim=calculateDimension(netzone); unsigned long dim = calculateDimension(netzone);
if (dim<=res_dim) if (dim<=res_dim)
{ {
@@ -167,18 +170,18 @@ string Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string)
* Subnets defined by addresses of interfaces are automatically part * Subnets defined by addresses of interfaces are automatically part
* of the corresponding network zones * of the corresponding network zones
*/ */
if (res_id.empty()) res_id=findInterfaceByAddress( addr ); if (res_id == -1) res_id = findInterfaceByAddress( addr );
if (res_id.empty()) if (res_id == -1)
throw(string("Can not find interface with network zone that includes " throw(string("Can not find interface with network zone that includes "
"address ") + addr->toString()); "address ") + addr->toString());
return res_id; return res_id;
} }
list<string> Helper::getAllInterfaceIDs() list<int> Helper::getAllInterfaceIDs()
{ {
Firewall *fw=compiler->fw; Firewall *fw = compiler->fw;
list<string> intf_id_list; list<int> intf_id_list;
FWObjectTypedChildIterator i=fw->findByType(Interface::TYPENAME); FWObjectTypedChildIterator i=fw->findByType(Interface::TYPENAME);
for ( ; i!=i.end(); ++i) for ( ; i!=i.end(); ++i)
{ {
@@ -190,10 +193,10 @@ list<string> Helper::getAllInterfaceIDs()
return intf_id_list; return intf_id_list;
} }
list<string> Helper::findInterfaceByNetzoneOrAll(RuleElement *re) list<int> Helper::findInterfaceByNetzoneOrAll(RuleElement *re)
{ {
Firewall *fw=compiler->fw; Firewall *fw = compiler->fw;
list<string> intf_id_list; list<int> intf_id_list;
if (re->isAny()) if (re->isAny())
{ {
return getAllInterfaceIDs(); return getAllInterfaceIDs();
@@ -242,7 +245,11 @@ list<string> Helper::findInterfaceByNetzoneOrAll(RuleElement *re)
string triplet::hash() string triplet::hash()
{ {
return src->getAddressPtr()->toString() + "." + ostringstream ostr;
dst->getAddressPtr()->toString() + "." + ostr << src->getAddressPtr()->toString()
srv->getId(); << "."
<< dst->getAddressPtr()->toString()
<<"."
<< srv->getId();
return ostr.str();
} }
src/cisco_lib/Helper.h
+6 -6
View File
@@ -49,19 +49,19 @@ namespace fwcompiler {
* finds interface of the firewall to whose subnet object * finds interface of the firewall to whose subnet object
* 'obj' belongs to. Returns interface ID * 'obj' belongs to. Returns interface ID
*/ */
std::string findInterfaceByAddress(const libfwbuilder::InetAddr *a); int findInterfaceByAddress(const libfwbuilder::InetAddr *a);
std::string findInterfaceByAddress(libfwbuilder::Address *obj); int findInterfaceByAddress(libfwbuilder::Address *obj);
/** /**
* finds interface of the firewall associated with the netzone * finds interface of the firewall associated with the netzone
* that object 'obj' belongs to. Returns interface ID * that object 'obj' belongs to. Returns interface ID
*/ */
std::string findInterfaceByNetzone(const libfwbuilder::InetAddr *a) int findInterfaceByNetzone(const libfwbuilder::InetAddr *a)
throw(std::string); throw(std::string);
std::string findInterfaceByNetzone(libfwbuilder::Address *obj); int findInterfaceByNetzone(libfwbuilder::Address *obj);
std::list<std::string> findInterfaceByNetzoneOrAll( std::list<int> findInterfaceByNetzoneOrAll(
libfwbuilder::RuleElement *re); libfwbuilder::RuleElement *re);
std::list<std::string> getAllInterfaceIDs(); std::list<int> getAllInterfaceIDs();
/** /**
* recursively expands object 'o' and places all its children * recursively expands object 'o' and places all its children
src/cisco_lib/PolicyCompiler_cisco.cpp
+18 -17
View File
@@ -107,9 +107,10 @@ void PolicyCompiler_cisco::addDefaultPolicyRule()
!getCachedFwOpt()->getStr("mgmt_addr").empty() ) !getCachedFwOpt()->getStr("mgmt_addr").empty() )
{ {
PolicyRule *r; PolicyRule *r;
TCPService *ssh=TCPService::cast(dbcopy->create(TCPService::TYPENAME) ); TCPService *ssh = TCPService::cast(
ssh->setInt("dst_range_start",22); dbcopy->create(TCPService::TYPENAME) );
ssh->setInt("dst_range_end",22); ssh->setDstRangeStart(22);
ssh->setDstRangeEnd(22);
dbcopy->add(ssh,false); dbcopy->add(ssh,false);
cacheObj(ssh); // to keep cache consistent cacheObj(ssh); // to keep cache consistent
@@ -225,11 +226,11 @@ bool PolicyCompiler_cisco::splitIfDstAny::processNext()
if (ICMPService::isA(s)) cl.push_back(s); if (ICMPService::isA(s)) cl.push_back(s);
if (TCPService::isA(s) && if (TCPService::isA(s) &&
s->getInt("dst_range_start")==22 && TCPUDPService::cast(s)->getDstRangeStart()==22 &&
s->getInt("dst_range_end")==22) cl.push_back(s); TCPUDPService::cast(s)->getDstRangeEnd()==22) cl.push_back(s);
if (TCPService::isA(s) && if (TCPService::isA(s) &&
s->getInt("dst_range_start")==23 && TCPUDPService::cast(s)->getDstRangeStart()==23 &&
s->getInt("dst_range_end")==23) cl.push_back(s); TCPUDPService::cast(s)->getDstRangeEnd()==23) cl.push_back(s);
} }
@@ -539,8 +540,8 @@ bool PolicyCompiler_cisco::tcpServiceToFW::processNext()
assert(s!=NULL); assert(s!=NULL);
if (TCPService::isA(s) && if (TCPService::isA(s) &&
s->getInt("dst_range_start")==port && TCPUDPService::cast(s)->getDstRangeStart()==port &&
s->getInt("dst_range_end")==port) cl.push_back(o); TCPUDPService::cast(s)->getDstRangeEnd()==port) cl.push_back(o);
} }
if (!cl.empty()) if (!cl.empty())
{ {
@@ -635,7 +636,8 @@ bool PolicyCompiler_cisco::replaceFWinDSTPolicy::processNext()
{ {
try try
{ {
string iface_id=helper.findInterfaceByNetzone(compiler->getFirstSrc(rule)); int iface_id = helper.findInterfaceByNetzone(
compiler->getFirstSrc(rule));
Interface *iface = compiler->getCachedFwInterface(iface_id); Interface *iface = compiler->getCachedFwInterface(iface_id);
dst->clearChildren(); dst->clearChildren();
@@ -657,17 +659,16 @@ bool PolicyCompiler_cisco::replaceFWinDSTPolicy::processNext()
} }
void PolicyCompiler_cisco::splitByNetworkZonesForRE::AddToInterface( void PolicyCompiler_cisco::splitByNetworkZonesForRE::AddToInterface(
const std::string &interface_id, int interface_id, Address *addr, PolicyRule *rule)
libfwbuilder::Address *addr,
PolicyRule *rule)
{ {
PolicyRule *new_rule; PolicyRule *new_rule;
RuleElement *new_re; RuleElement *new_re;
new_rule=rules[interface_id]; new_rule = rules[interface_id];
if (new_rule==NULL) if (new_rule==NULL)
{ {
new_rule= PolicyRule::cast(compiler->dbcopy->create(PolicyRule::TYPENAME) ); new_rule = PolicyRule::cast(compiler->dbcopy->create(
PolicyRule::TYPENAME) );
compiler->temp_ruleset->add(new_rule); compiler->temp_ruleset->add(new_rule);
new_rule->duplicate(rule); new_rule->duplicate(rule);
rules[interface_id]=new_rule; rules[interface_id]=new_rule;
@@ -705,7 +706,7 @@ bool PolicyCompiler_cisco::splitByNetworkZonesForRE::processNext()
try try
{ {
string interface_id=helper.findInterfaceByNetzone(a); int interface_id = helper.findInterfaceByNetzone(a);
AddToInterface(interface_id, a, rule); AddToInterface(interface_id, a, rule);
} catch (string err) } catch (string err)
{ {
@@ -731,7 +732,7 @@ bool PolicyCompiler_cisco::splitByNetworkZonesForRE::processNext()
} }
} }
} }
for (std::map<std::string,PolicyRule*>::iterator i=rules.begin(); for (std::map<int,PolicyRule*>::iterator i=rules.begin();
i!=rules.end(); ++i) i!=rules.end(); ++i)
{ {
tmp_queue.push_back((*i).second); tmp_queue.push_back((*i).second);
src/cisco_lib/PolicyCompiler_cisco.h
+2 -2
View File
@@ -310,8 +310,8 @@ protected:
class splitByNetworkZonesForRE : public PolicyRuleProcessor class splitByNetworkZonesForRE : public PolicyRuleProcessor
{ {
std::string re_type; std::string re_type;
std::map<std::string,libfwbuilder::PolicyRule*> rules; std::map<int,libfwbuilder::PolicyRule*> rules;
void AddToInterface(const std::string &interface_id, void AddToInterface(int interface_id,
libfwbuilder::Address *addr, libfwbuilder::Address *addr,
libfwbuilder::PolicyRule *rule); libfwbuilder::PolicyRule *rule);
public: public:
src/cisco_lib/PolicyCompiler_cisco_acls.cpp
+16 -15
View File
@@ -65,12 +65,12 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionBySrc::processNext()
PolicyRule *rule=getNext(); if (rule==NULL) return false; PolicyRule *rule=getNext(); if (rule==NULL) return false;
Helper helper(compiler); Helper helper(compiler);
RuleElementItf *itfre=rule->getItf(); //RuleElementItf *itfre = rule->getItf();
RuleElementSrc *srcre=rule->getSrc(); RuleElementSrc *srcre = rule->getSrc();
list<string> intf_id_list; list<int> intf_id_list;
if (rule->getInterfaceId().empty()) if (rule->getInterfaceId() == -1)
{ {
if (rule->getDirection()==PolicyRule::Both) if (rule->getDirection()==PolicyRule::Both)
intf_id_list = helper.findInterfaceByNetzoneOrAll( srcre ); intf_id_list = helper.findInterfaceByNetzoneOrAll( srcre );
@@ -78,9 +78,10 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionBySrc::processNext()
if (rule->getDirection()==PolicyRule::Inbound) if (rule->getDirection()==PolicyRule::Inbound)
intf_id_list = helper.getAllInterfaceIDs(); intf_id_list = helper.getAllInterfaceIDs();
for (list<string>::iterator i = intf_id_list.begin(); i!=intf_id_list.end(); ++i) for (list<int>::iterator i = intf_id_list.begin();
i!=intf_id_list.end(); ++i)
{ {
string intf_id = *i; int intf_id = *i;
Interface *ifs = Interface::cast( Interface *ifs = Interface::cast(
rule->getRoot()->findInIndex(intf_id) ); rule->getRoot()->findInIndex(intf_id) );
assert(ifs); assert(ifs);
@@ -114,12 +115,12 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionByDst::processNext()
return true; return true;
} }
RuleElementItf *itfre=rule->getItf(); //RuleElementItf *itfre=rule->getItf();
RuleElementDst *dstre=rule->getDst(); RuleElementDst *dstre=rule->getDst();
list<string> intf_id_list; list<int> intf_id_list;
if (rule->getInterfaceId().empty()) if (rule->getInterfaceId() == -1)
{ {
if (rule->getDirection()==PolicyRule::Both) if (rule->getDirection()==PolicyRule::Both)
intf_id_list = helper.findInterfaceByNetzoneOrAll( dstre ); intf_id_list = helper.findInterfaceByNetzoneOrAll( dstre );
@@ -127,9 +128,9 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionByDst::processNext()
if (rule->getDirection()==PolicyRule::Outbound) if (rule->getDirection()==PolicyRule::Outbound)
intf_id_list = helper.getAllInterfaceIDs(); intf_id_list = helper.getAllInterfaceIDs();
for (list<string>::iterator i = intf_id_list.begin(); i!=intf_id_list.end(); ++i) for (list<int>::iterator i = intf_id_list.begin(); i!=intf_id_list.end(); ++i)
{ {
string intf_id = *i; int intf_id = *i;
Interface *ifs = Interface::cast( Interface *ifs = Interface::cast(
rule->getRoot()->findInIndex(intf_id) ); rule->getRoot()->findInIndex(intf_id) );
assert(ifs); assert(ifs);
@@ -153,9 +154,9 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionIfInterfaceSet::processNext()
{ {
PolicyRule *rule=getNext(); if (rule==NULL) return false; PolicyRule *rule=getNext(); if (rule==NULL) return false;
RuleElementItf *itfre=rule->getItf(); //RuleElementItf *itfre=rule->getItf();
if (rule->getInterfaceId().empty() || if (rule->getInterfaceId() == -1 ||
rule->getBool("interface_and_direction_set_from_src") || rule->getBool("interface_and_direction_set_from_src") ||
rule->getBool("interface_and_direction_set_from_dst")) rule->getBool("interface_and_direction_set_from_dst"))
{ {
@@ -165,9 +166,9 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionIfInterfaceSet::processNext()
PolicyRule *new_rule; PolicyRule *new_rule;
if ( ! rule->getInterfaceId().empty() ) if ( rule->getInterfaceId() > -1 )
{ {
string rule_iface_id = rule->getInterfaceId(); int rule_iface_id = rule->getInterfaceId();
if (rule->getDirection()==PolicyRule::Both) if (rule->getDirection()==PolicyRule::Both)
{ {
src/iosacl/PolicyCompiler_iosacl_writers.cpp
+12 -7
View File
@@ -174,7 +174,7 @@ string PolicyCompiler_iosacl::PrintRule::_printRule(PolicyRule *rule)
{ {
PolicyCompiler_iosacl *iosacl_comp = PolicyCompiler_iosacl *iosacl_comp =
dynamic_cast<PolicyCompiler_iosacl*>(compiler); dynamic_cast<PolicyCompiler_iosacl*>(compiler);
FWOptions *ruleopt =rule->getOptionsObject(); //FWOptions *ruleopt =rule->getOptionsObject();
bool write_comments = bool write_comments =
compiler->fw->getOptionsObject()->getBool("iosacl_include_comments"); compiler->fw->getOptionsObject()->getBool("iosacl_include_comments");
@@ -413,13 +413,18 @@ string PolicyCompiler_iosacl::PrintRule::_printAddr(libfwbuilder::Address *o)
} }
} }
return str.str(); return str.str();
} else
{
compiler->abort(string("Object ") + o->getName() +
string(" (id=") + o->getId() + string(") ") +
string(" has no ip address and can not be used ") +
string("in the rule."));
} }
ostringstream errstr;
errstr << "Object "
<< o->getName()
<< " (id="
<< o->getId()
<< ") "
<< " has no ip address and can not be used "
<< "in the rule.";
compiler->abort(errstr.str());
return ""; // to make compiler happy
} }
/* /*