Changeset 2049

Timestamp:

04/07/08 11:17:40 (8 months ago)

Author:

dsugar

Message:

work on generating iptables (secmark) network rules from CDS Framework policy.

Files:

• branches/networking/resources/cdsframework.spt (modified) (1 diff)
• branches/networking/resources/dictionary/dictionary.fdic (modified) (1 diff)
• branches/networking/src/com/tresys/framework/compiler/Compiler.java (modified) (6 diffs)
• branches/networking/src/com/tresys/framework/compiler/systemResources/IPTablesNetworkResource.java (modified) (1 diff)
• branches/networking/src/com/tresys/framework/compiler/systemResources/NetworkInfo.java (modified) (2 diffs)
• branches/networking/src/com/tresys/framework/compiler/translator/NetworkSecmark.java (added)
• branches/networking/src/com/tresys/framework/compiler/translator/SELinuxPolicy.java (modified) (2 diffs)
• branches/networking/src/com/tresys/framework/plugin/editor/policy/text/PolicyOutlinePage.java (modified) (1 diff)
• branches/networking/src/com/tresys/framework/plugin/wizards/shape/ResourceShapePropertyPage.java (modified) (2 diffs)

branches/networking/resources/cdsframework.spt

@@ -51 +51 @@
-')
-
+define(`SEFramework_secmark_resource',`
+        ifdef(`corenet_client_packet',
+                `corenet_client_packet($1)')
+')
+
-define(`SEFramework_read_boolean',`
-        allow $1 $2:file { read getattr };

branches/networking/resources/dictionary/dictionary.fdic

@@ -211 +211 @@
-
-rdef secmark
-}
+)
-{
-        requires { secmark }

branches/networking/src/com/tresys/framework/compiler/Compiler.java

@@ -15 +15 @@
-package com.tresys.framework.compiler;
-
+import java.io.ByteArrayOutputStream;
-import java.io.FileOutputStream;
-import java.io.FileNotFoundException;
@@ -34 +35 @@
-import com.tresys.framework.compiler.policy.SystemResourceValidator;
-import com.tresys.framework.compiler.systemResources.SystemResources;
+import com.tresys.framework.compiler.translator.NetworkSecmark;
-import com.tresys.framework.compiler.translator.SELinuxDictionary;
-import com.tresys.framework.compiler.translator.SELinuxPolicy;
@@ -76 +78 @@
-        private static String customPolicyFileName;
-
+        static String secmarkFilename = null;
+        
+        static String ipsecFilename = null;
+        
-        private static void getOpt (String[] args)
-        {
@@ -246 +252 @@
-                                {
-                                        customPolicyFileName = args[x]; 
+                                }
+                                else
+                                {
+                                        printUsage ();
+                                        System.exit (1);
+                                }
+                        }
+                        else if ( args[x].equals ("-secmark"))
+                        {
+                                x++;
+                                if (x < args.length)
+                                {
+                                        secmarkFilename = args[x]; 
+                                }
+                                else
+                                {
+                                        printUsage ();
+                                        System.exit (1);
+                                }
+                        }
+                        else if ( args[x].equals ("-ipsec"))
+                        {
+                                x++;
+                                if (x < args.length)
+                                {
+                                        ipsecFilename = args[x]; 
-                                }
-                                else
@@ -339 +371 @@
-                System.out.println ("       (defaults to stdout if not specified)");
-                System.out.println ();
+                System.out.println ("Network arguments:");
+                System.out.println ("  -ipsec <output file> specify output file for generated ipsec ");
+                System.out.println ("           (Labeled Networking) Security Associations");
+                System.out.println ("  -secmark <output file> specify output file for generated secmark");
+                System.out.println ("           (IPTables Networking) rules");
+                System.out.println ();
-                System.out.println ("Output arguments (repeated here for reference):");
-                System.out.println ("  -do <dictionary output> specify destination for dictionary (spt) support file");
@@ -689 +727 @@
-                        System.exit (1);
-                }
+
+                if (secmarkFilename != null)
+                {
+                        NetworkSecmark networkInfo = new NetworkSecmark ();
+                        policy.Accept (networkInfo);
+                        
+                        ByteArrayOutputStream networkData = networkInfo.GetConfiguration ();
+                        if (networkData != null && networkData.size () > 0)
+                        {
+                                try
+                                {
+                                        File secmarkFile = new File (secmarkFilename);
+                                        PrintStream secmarkStream = new PrintStream (secmarkFile);
+                                        secmarkStream.print (networkData.toString ());
+                                        secmarkStream.flush ();
+                                        secmarkStream.close ();
+                                }
+                                catch (FileNotFoundException e)
+                                {
+                                        e.printStackTrace();
+                                }
+                        }
+                }
+                
-                // hopefully this will trigger the finalize() methods and save us memory
-                // and cpu cycles

branches/networking/src/com/tresys/framework/compiler/systemResources/IPTablesNetworkResource.java

@@ -39 +39 @@
-                m_sProtocol = i_sProtocol;
-        }
+
+        public NetworkInfo getLocalInfo ()
+        {
+                return m_netLocal;
+        }
+        
+        public NetworkInfo getRemoteInfo ()
+        {
+                return m_netRemote;
+        }
+        
+        public String getProtocol ()
+        {
+                return m_sProtocol;
+        }
-}

branches/networking/src/com/tresys/framework/compiler/systemResources/NetworkInfo.java

@@ -16 +16 @@
- *
- */
-
+public 
-{
-        protected final String m_sNode;
@@ -27 +27 @@
-                m_sIPAddr = i_sIP;
-                m_nPorts = i_aPorts;
+        }
+        
+        public String getNode ()
+        {
+                return m_sNode;
+        }
+        
+        public String getIPAddr ()
+        {
+                return m_sIPAddr;
+        }
+        
+        public int [] getPorts ()
+        {
+                return m_nPorts;
-        }
-        

branches/networking/src/com/tresys/framework/compiler/translator/SELinuxPolicy.java

@@ -272 +272 @@
-                                        }
-                                }
+                                else if (rdef.GetSysResourceState (SystemResourceTypes.secmark) != SysResourceState.No)
+                                {
+                                        MakeSecmarkType (sType, outStream, sIndent);
+                                }
-                        }
-
@@ -1929 +1933 @@
-
-        /**
+         * Assign a type to packet type.
+         * 
+         * @param       String type
+         * @return  Assignment statement
+         */
+        private void MakeSecmarkType (String sType, PrintStream ps, String i_sLinePrefix)
+        {
+                if (i_sLinePrefix != null)
+                        ps.print (i_sLinePrefix);
+                ps.println ("SEFramework_secmark_resource(" + sType + ")");
+        }
+
+        /**
-         * Makes a file context entry for a directory
-         * 

branches/networking/src/com/tresys/framework/plugin/editor/policy/text/PolicyOutlinePage.java

@@ -193 +193 @@
-//              }
-                
-
+
+
+
+
+
-        }
-        

branches/networking/src/com/tresys/framework/plugin/wizards/shape/ResourceShapePropertyPage.java

@@ -363 +363 @@
-        {
-                private boolean m_bShowControlRdef;
+                private boolean m_bShowFile = true;
+                private boolean m_bShowDir = true;
+                private boolean m_bShowNetwork = false;
-                
-                RDEFFilter (boolean i_bShowControlRdef)
@@ -373 +376 @@
-                        if (element instanceof Rdef)
-                        {
-
+
+
+
-                                        return m_bShowControlRdef;
+                                
+                                if (rdef.GetSysResourceState (SystemResourceTypes.dir) != SysResourceState.No)
+                                        return m_bShowDir;
+
+                                if (rdef.GetSysResourceState (SystemResourceTypes.file) != SysResourceState.No)
+                                        return m_bShowFile;
+
+                                if (rdef.GetSysResourceState (SystemResourceTypes.ipsec) != SysResourceState.No)
+                                        return m_bShowNetwork;
+
+                                if (rdef.GetSysResourceState (SystemResourceTypes.secmark) != SysResourceState.No)
+                                        return m_bShowNetwork;
+
-                                return true;
-                        }