onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-11 23:53:59 +02:00
Code Issues Releases Wiki Activity

int IDs in compiler for cisco ACLs

Browse Source
This commit is contained in:
Vadim Kurland
2008-06-10 04:18:57 +00:00
parent efc9f2f507
commit ad446d7308
6 changed files with 90 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cisco_lib/Helper.cpp
+36 -29
View File
@@ -98,48 +98,51 @@ void Helper::expand_group_recursive(FWObject *o,list<FWObject*> &ol)
}
}
string Helper::findInterfaceByAddress(libfwbuilder::Address *obj)
int Helper::findInterfaceByAddress(Address *obj)
{
return findInterfaceByAddress( obj->getAddressPtr() );
}
string Helper::findInterfaceByAddress(const libfwbuilder::InetAddr *addr)
int Helper::findInterfaceByAddress(const InetAddr *addr)
{
if (addr==NULL) return "";
if (addr==NULL) return -1;
Firewall *fw=compiler->fw;
list<FWObject*> l2=fw->getByType(Interface::TYPENAME);
for (list<FWObject*>::iterator i=l2.begin(); i!=l2.end(); ++i) {
for (list<FWObject*>::iterator i=l2.begin(); i!=l2.end(); ++i)
{
Interface *iface=Interface::cast(*i);
if ( iface->belongs( *addr ) ) return iface->getId();
}
return "";
return -1;
}
string Helper::findInterfaceByNetzone(Address *obj)
int Helper::findInterfaceByNetzone(Address *obj)
{
return findInterfaceByNetzone(obj->getAddressPtr());
}
string Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string)
int Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string)
{
if (addr==NULL) return "";
if (addr==NULL) return -1;
Firewall *fw=compiler->fw;
map<string,FWObject*> zones;
map<int,FWObject*> zones;
FWObjectTypedChildIterator i=fw->findByType(Interface::TYPENAME);
for ( ; i!=i.end(); ++i)
{
string netzone_id = (*i)->getStr("network_zone");
if (netzone_id != "")
// NOTE: "network_zone" is globally unique string ID
int netzone_id =
FWObjectDatabase::getIntId((*i)->getStr("network_zone"));
if (netzone_id != -1)
{
FWObject *netzone=fw->getRoot()->findInIndex(netzone_id);
FWObject *netzone = fw->getRoot()->findInIndex(netzone_id);
for (list<FWObject*>::iterator j=netzone->begin();
j!=netzone->end(); ++j)
{
assert(Address::cast(*j)!=NULL);
if (Address::cast(*j)->belongs(*addr))
zones[(*i)->getId()]=netzone;
zones[(*i)->getId()] = netzone;
}
}
}
@@ -148,13 +151,13 @@ string Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string)
* now compare dimensions of all netzones that contain address obj and
* pick the one with smallest dimension
*/
string res_id;
int res_id = -1;
unsigned long res_dim=LONG_MAX;
for (map<string,FWObject*>::iterator i=zones.begin(); i!=zones.end(); ++i)
for (map<int,FWObject*>::iterator i=zones.begin(); i!=zones.end(); ++i)
{
string iface_id=(*i).first;
FWObject *netzone=(*i).second;
unsigned long dim=calculateDimension(netzone);
int iface_id = (*i).first;
FWObject *netzone = (*i).second;
unsigned long dim = calculateDimension(netzone);
if (dim<=res_dim)
{
@@ -167,18 +170,18 @@ string Helper::findInterfaceByNetzone(const InetAddr *addr) throw(string)
* Subnets defined by addresses of interfaces are automatically part
* of the corresponding network zones
*/
if (res_id.empty()) res_id=findInterfaceByAddress( addr );
if (res_id == -1) res_id = findInterfaceByAddress( addr );
if (res_id.empty())
if (res_id == -1)
throw(string("Can not find interface with network zone that includes "
"address ") + addr->toString());
return res_id;
}
list<string> Helper::getAllInterfaceIDs()
list<int> Helper::getAllInterfaceIDs()
{
Firewall *fw=compiler->fw;
list<string> intf_id_list;
Firewall *fw = compiler->fw;
list<int> intf_id_list;
FWObjectTypedChildIterator i=fw->findByType(Interface::TYPENAME);
for ( ; i!=i.end(); ++i)
{
@@ -190,10 +193,10 @@ list<string> Helper::getAllInterfaceIDs()
return intf_id_list;
}
list<string> Helper::findInterfaceByNetzoneOrAll(RuleElement *re)
list<int> Helper::findInterfaceByNetzoneOrAll(RuleElement *re)
{
Firewall *fw=compiler->fw;
list<string> intf_id_list;
Firewall *fw = compiler->fw;
list<int> intf_id_list;
if (re->isAny())
{
return getAllInterfaceIDs();
@@ -242,7 +245,11 @@ list<string> Helper::findInterfaceByNetzoneOrAll(RuleElement *re)
string triplet::hash()
{
return src->getAddressPtr()->toString() + "." +
dst->getAddressPtr()->toString() + "." +
srv->getId();
ostringstream ostr;
ostr << src->getAddressPtr()->toString()
<< "."
<< dst->getAddressPtr()->toString()
<<"."
<< srv->getId();
return ostr.str();
}
src/cisco_lib/Helper.h
+6 -6
View File
@@ -49,19 +49,19 @@ namespace fwcompiler {
* finds interface of the firewall to whose subnet object
* 'obj' belongs to. Returns interface ID
*/
std::string findInterfaceByAddress(const libfwbuilder::InetAddr *a);
std::string findInterfaceByAddress(libfwbuilder::Address *obj);
int findInterfaceByAddress(const libfwbuilder::InetAddr *a);
int findInterfaceByAddress(libfwbuilder::Address *obj);
/**
* finds interface of the firewall associated with the netzone
* that object 'obj' belongs to. Returns interface ID
*/
std::string findInterfaceByNetzone(const libfwbuilder::InetAddr *a)
int findInterfaceByNetzone(const libfwbuilder::InetAddr *a)
throw(std::string);
std::string findInterfaceByNetzone(libfwbuilder::Address *obj);
std::list<std::string> findInterfaceByNetzoneOrAll(
int findInterfaceByNetzone(libfwbuilder::Address *obj);
std::list<int> findInterfaceByNetzoneOrAll(
libfwbuilder::RuleElement *re);
std::list<std::string> getAllInterfaceIDs();
std::list<int> getAllInterfaceIDs();
/**
* recursively expands object 'o' and places all its children
src/cisco_lib/PolicyCompiler_cisco.cpp
+18 -17
View File
@@ -107,9 +107,10 @@ void PolicyCompiler_cisco::addDefaultPolicyRule()
!getCachedFwOpt()->getStr("mgmt_addr").empty() )
{
PolicyRule *r;
TCPService *ssh=TCPService::cast(dbcopy->create(TCPService::TYPENAME) );
ssh->setInt("dst_range_start",22);
ssh->setInt("dst_range_end",22);
TCPService *ssh = TCPService::cast(
dbcopy->create(TCPService::TYPENAME) );
ssh->setDstRangeStart(22);
ssh->setDstRangeEnd(22);
dbcopy->add(ssh,false);
cacheObj(ssh); // to keep cache consistent
@@ -225,11 +226,11 @@ bool PolicyCompiler_cisco::splitIfDstAny::processNext()
if (ICMPService::isA(s)) cl.push_back(s);
if (TCPService::isA(s) &&
s->getInt("dst_range_start")==22 &&
s->getInt("dst_range_end")==22) cl.push_back(s);
TCPUDPService::cast(s)->getDstRangeStart()==22 &&
TCPUDPService::cast(s)->getDstRangeEnd()==22) cl.push_back(s);
if (TCPService::isA(s) &&
s->getInt("dst_range_start")==23 &&
s->getInt("dst_range_end")==23) cl.push_back(s);
TCPUDPService::cast(s)->getDstRangeStart()==23 &&
TCPUDPService::cast(s)->getDstRangeEnd()==23) cl.push_back(s);
}
@@ -539,8 +540,8 @@ bool PolicyCompiler_cisco::tcpServiceToFW::processNext()
assert(s!=NULL);
if (TCPService::isA(s) &&
s->getInt("dst_range_start")==port &&
s->getInt("dst_range_end")==port) cl.push_back(o);
TCPUDPService::cast(s)->getDstRangeStart()==port &&
TCPUDPService::cast(s)->getDstRangeEnd()==port) cl.push_back(o);
}
if (!cl.empty())
{
@@ -635,7 +636,8 @@ bool PolicyCompiler_cisco::replaceFWinDSTPolicy::processNext()
{
try
{
string iface_id=helper.findInterfaceByNetzone(compiler->getFirstSrc(rule));
int iface_id = helper.findInterfaceByNetzone(
compiler->getFirstSrc(rule));
Interface *iface = compiler->getCachedFwInterface(iface_id);
dst->clearChildren();
@@ -657,17 +659,16 @@ bool PolicyCompiler_cisco::replaceFWinDSTPolicy::processNext()
}
void PolicyCompiler_cisco::splitByNetworkZonesForRE::AddToInterface(
const std::string &interface_id,
libfwbuilder::Address *addr,
PolicyRule *rule)
int interface_id, Address *addr, PolicyRule *rule)
{
PolicyRule *new_rule;
RuleElement *new_re;
new_rule=rules[interface_id];
new_rule = rules[interface_id];
if (new_rule==NULL)
{
new_rule= PolicyRule::cast(compiler->dbcopy->create(PolicyRule::TYPENAME) );
new_rule = PolicyRule::cast(compiler->dbcopy->create(
PolicyRule::TYPENAME) );
compiler->temp_ruleset->add(new_rule);
new_rule->duplicate(rule);
rules[interface_id]=new_rule;
@@ -705,7 +706,7 @@ bool PolicyCompiler_cisco::splitByNetworkZonesForRE::processNext()
try
{
string interface_id=helper.findInterfaceByNetzone(a);
int interface_id = helper.findInterfaceByNetzone(a);
AddToInterface(interface_id, a, rule);
} catch (string err)
{
@@ -731,7 +732,7 @@ bool PolicyCompiler_cisco::splitByNetworkZonesForRE::processNext()
}
}
}
for (std::map<std::string,PolicyRule*>::iterator i=rules.begin();
for (std::map<int,PolicyRule*>::iterator i=rules.begin();
i!=rules.end(); ++i)
{
tmp_queue.push_back((*i).second);
src/cisco_lib/PolicyCompiler_cisco.h
+2 -2
View File
@@ -310,8 +310,8 @@ protected:
class splitByNetworkZonesForRE : public PolicyRuleProcessor
{
std::string re_type;
std::map<std::string,libfwbuilder::PolicyRule*> rules;
void AddToInterface(const std::string &interface_id,
std::map<int,libfwbuilder::PolicyRule*> rules;
void AddToInterface(int interface_id,
libfwbuilder::Address *addr,
libfwbuilder::PolicyRule *rule);
public:
src/cisco_lib/PolicyCompiler_cisco_acls.cpp
+16 -15
View File
@@ -65,12 +65,12 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionBySrc::processNext()
PolicyRule *rule=getNext(); if (rule==NULL) return false;
Helper helper(compiler);
RuleElementItf *itfre=rule->getItf();
RuleElementSrc *srcre=rule->getSrc();
//RuleElementItf *itfre = rule->getItf();
RuleElementSrc *srcre = rule->getSrc();
list<string> intf_id_list;
list<int> intf_id_list;
if (rule->getInterfaceId().empty())
if (rule->getInterfaceId() == -1)
{
if (rule->getDirection()==PolicyRule::Both)
intf_id_list = helper.findInterfaceByNetzoneOrAll( srcre );
@@ -78,9 +78,10 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionBySrc::processNext()
if (rule->getDirection()==PolicyRule::Inbound)
intf_id_list = helper.getAllInterfaceIDs();
for (list<string>::iterator i = intf_id_list.begin(); i!=intf_id_list.end(); ++i)
for (list<int>::iterator i = intf_id_list.begin();
i!=intf_id_list.end(); ++i)
{
string intf_id = *i;
int intf_id = *i;
Interface *ifs = Interface::cast(
rule->getRoot()->findInIndex(intf_id) );
assert(ifs);
@@ -114,12 +115,12 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionByDst::processNext()
return true;
}
RuleElementItf *itfre=rule->getItf();
//RuleElementItf *itfre=rule->getItf();
RuleElementDst *dstre=rule->getDst();
list<string> intf_id_list;
list<int> intf_id_list;
if (rule->getInterfaceId().empty())
if (rule->getInterfaceId() == -1)
{
if (rule->getDirection()==PolicyRule::Both)
intf_id_list = helper.findInterfaceByNetzoneOrAll( dstre );
@@ -127,9 +128,9 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionByDst::processNext()
if (rule->getDirection()==PolicyRule::Outbound)
intf_id_list = helper.getAllInterfaceIDs();
for (list<string>::iterator i = intf_id_list.begin(); i!=intf_id_list.end(); ++i)
for (list<int>::iterator i = intf_id_list.begin(); i!=intf_id_list.end(); ++i)
{
string intf_id = *i;
int intf_id = *i;
Interface *ifs = Interface::cast(
rule->getRoot()->findInIndex(intf_id) );
assert(ifs);
@@ -153,9 +154,9 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionIfInterfaceSet::processNext()
{
PolicyRule *rule=getNext(); if (rule==NULL) return false;
RuleElementItf *itfre=rule->getItf();
//RuleElementItf *itfre=rule->getItf();
if (rule->getInterfaceId().empty() ||
if (rule->getInterfaceId() == -1 ||
rule->getBool("interface_and_direction_set_from_src") ||
rule->getBool("interface_and_direction_set_from_dst"))
{
@@ -165,9 +166,9 @@ bool PolicyCompiler_cisco::setInterfaceAndDirectionIfInterfaceSet::processNext()
PolicyRule *new_rule;
if ( ! rule->getInterfaceId().empty() )
if ( rule->getInterfaceId() > -1 )
{
string rule_iface_id = rule->getInterfaceId();
int rule_iface_id = rule->getInterfaceId();
if (rule->getDirection()==PolicyRule::Both)
{
src/iosacl/PolicyCompiler_iosacl_writers.cpp
+12 -7
View File
@@ -174,7 +174,7 @@ string PolicyCompiler_iosacl::PrintRule::_printRule(PolicyRule *rule)
{
PolicyCompiler_iosacl *iosacl_comp =
dynamic_cast<PolicyCompiler_iosacl*>(compiler);
FWOptions *ruleopt =rule->getOptionsObject();
//FWOptions *ruleopt =rule->getOptionsObject();
bool write_comments =
compiler->fw->getOptionsObject()->getBool("iosacl_include_comments");
@@ -413,13 +413,18 @@ string PolicyCompiler_iosacl::PrintRule::_printAddr(libfwbuilder::Address *o)
}
}
return str.str();
} else
{
compiler->abort(string("Object ") + o->getName() +
string(" (id=") + o->getId() + string(") ") +
string(" has no ip address and can not be used ") +
string("in the rule."));
}
ostringstream errstr;
errstr << "Object "
<< o->getName()
<< " (id="
<< o->getId()
<< ") "
<< " has no ip address and can not be used "
<< "in the rule.";
compiler->abort(errstr.str());
return ""; // to make compiler happy
}
/*