Changeset 2056

Timestamp:

04/16/08 10:38:42 (7 months ago)

Author:

dsugar

Message:

Translation beginning to work, not done yet, needs to be tested to make sure required policy is in place.

Files:

• branches/networking/resources/cdsframework.spt (modified) (1 diff)
• branches/networking/resources/dictionary/dictionary.fdic (modified) (4 diffs)
• branches/networking/src/com/tresys/framework/compiler/Compiler.java (modified) (8 diffs)
• branches/networking/src/com/tresys/framework/compiler/dictionary/Target.java (modified) (1 diff)
• branches/networking/src/com/tresys/framework/compiler/linkage/Linkage.java (modified) (5 diffs)
• branches/networking/src/com/tresys/framework/compiler/linkage/net/Endpoint.java (modified) (2 diffs)
• branches/networking/src/com/tresys/framework/compiler/linkage/net/FNETParser.jj (modified) (3 diffs)
• branches/networking/src/com/tresys/framework/compiler/linkage/net/NetConnection.java (modified) (1 diff)
• branches/networking/src/com/tresys/framework/compiler/linkage/net/NetItem.java (modified) (1 diff)
• branches/networking/src/com/tresys/framework/compiler/linkage/net/NetResource.java (modified) (1 diff)
• branches/networking/src/com/tresys/framework/compiler/linkage/net/NetworkConfig.java (modified) (2 diffs)
• branches/networking/src/com/tresys/framework/compiler/policy/Component.java (modified) (2 diffs)
• branches/networking/src/com/tresys/framework/compiler/systemResources/LabeledNetworkResource.java (modified) (1 diff)
• branches/networking/src/com/tresys/framework/compiler/systemResources/NetworkInfo.java (modified) (2 diffs)
• branches/networking/src/com/tresys/framework/compiler/translator/NetworkIPSec.java (added)
• branches/networking/src/com/tresys/framework/compiler/translator/SELinuxDictionary.java (modified) (2 diffs)
• branches/networking/src/com/tresys/framework/compiler/translator/SELinuxPolicy.java (modified) (10 diffs)
• branches/networking/src/com/tresys/framework/plugin/builder/SELinuxSystem.java (modified) (2 diffs)
• branches/networking/src/com/tresys/framework/plugin/editor/action/AddCustomPolicy.java (modified) (1 diff)

branches/networking/resources/cdsframework.spt

@@ -56 +56 @@
-')
-
+define(`SEFramework_ipsec_resource',`
+')
+
-define(`SEFramework_read_boolean',`
-        allow $1 $2:file { read getattr };

branches/networking/resources/dictionary/dictionary.fdic

@@ -166 +166 @@
-        owner {
-                resource {
-n'
+ no
-                        association { polmatch }
-                }
@@ -176 +176 @@
-                [backflow: 2]
-                {
-
+
+
+
-                        other write {
-                                association { recvfrom }
@@ -190 +192 @@
-                {
-                        self {
+                                association { recvfrom }
+                        }
+                        other read {
-                                association { sendto }
-                        }
@@ -216 +221 @@
-        owner {
-                resource {
-n'
+ no
-                        packet { send recv }
-                }

branches/networking/src/com/tresys/framework/compiler/Compiler.java

@@ -38 +38 @@
-import com.tresys.framework.compiler.policy.SystemResourceValidator;
-import com.tresys.framework.compiler.systemResources.SystemResources;
+import com.tresys.framework.compiler.translator.NetworkIPSec;
-import com.tresys.framework.compiler.translator.NetworkSecmark;
-import com.tresys.framework.compiler.translator.SELinuxDictionary;
@@ -372 +373 @@
-                System.out.println ("  -pc <flaskPath> specify path to base policy flask directory");
-                System.out.println ("  -fc <file_context> specify base policy file_context");
+                System.out.println ("  -m <mls file> specify mls inforation file for linkage to translate MLS labels");
+                System.out.println ("       into real sensitivities (defaults to s0 for all if not specified)");
-                System.out.println ();
-                System.out.println ("Dictionary arguments:");
-                System.out.println ("  -ds <dictionary source> specify source file for dictionary");
+                System.out.println ("  -do <dictionary output> specify destination for dictionary (spt) support file");
-                System.out.println ();
-                System.out.println ("Policy arguments:");
@@ -404 +408 @@
-                System.out.println ("  -if <interface file> specify interface file for linkage to reference policy");
-                System.out.println ("       and exposing an external API (defaults to stdout if not specified)");
-
-
+
+
+
+
-                System.out.println ();
-                System.out.println ("A dictionary file must be specified.");
@@ -420 +426 @@
-                // the translator
-                SELinuxPolicy translator = null;
+                NetworkConfig networkconfig = null;
-
-                dictSourceFilenames = new Vector/* <String> */();
@@ -460 +467 @@
-                }
-                
+                int errorCount = 0;
+                if (netConfigFilename != null)
+                {
+                        System.out.println ("Parsing network configuration from " + netConfigFilename);
+                        networkconfig = new NetworkConfig ();
+                        
+                        File file = new File (netConfigFilename);
+                        if (!file.exists ())
+                        {
+                                ErrorExit ("fnet file doesn't exist: " + netConfigFilename);
+                        }
+                                
+                        FNETParser parser = new FNETParser (networkconfig);
+                        try
+                        {
+                                CLIErrorHandler netErrorHandler = new CLIErrorHandler (netConfigFilename);
+                                parser.Parse (new FileReader (file), netErrorHandler);
+                                errorCount += netErrorHandler.errorCount;
+                        }
+                        catch (FileNotFoundException fnfe)
+                        {
+                                fnfe.printStackTrace ();
+                                errorCount ++;
+                        }
+                }
+                
+                if (errorCount > 0)
+                {
+                        ErrorExit ("Errors encountered while parsing netowrk configuraiton, exiting...");
+                }
+
-                // create linkage interface depending on compilation targets
-
+, networkconfig
-
-                // attempt to create Dictionary
-                dictionary = new Dictionary ();
-                int errorCount = 0;
-
-                // Add dictionary files to the dictionary
@@ -609 +646 @@
-                        }
-                }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-                if (customPolicyFileName != null)
-                {
@@ -665 +677 @@
-                        
-                }
-
+networkconfig, 
-
-                policy.Accept (translator);
@@ -793 +805 @@
-                        }
-                }
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                // hopefully this will trigger the finalize() methods and save us memory
-                // and cpu cycles

branches/networking/src/com/tresys/framework/compiler/dictionary/Target.java

@@ -16 +16 @@
-public class Target 
-{
-0
-1
-2
-3
-4
+5
+6
+Verb.read
+Verb.write
+Verb.readwrite
-        
-        public final static String TARGET_SELF = "self";

branches/networking/src/com/tresys/framework/compiler/linkage/Linkage.java

@@ -19 +19 @@
-
-import com.tresys.framework.compiler.policy.Ability;
+import com.tresys.framework.compiler.linkage.net.NetworkConfig;
-import com.tresys.framework.compiler.mls.MLSSupport;
-import com.tresys.framework.compiler.policy.BaseDomain;
@@ -49 +50 @@
-        private final BasePolicy BasePolicy;
-        private final MLSSupport m_MLSSupport;
+        private final NetworkConfig m_netConfig;
-        
-        
@@ -58 +60 @@
-         * @throws Exception    If memory allocation fails
-         */
-
+, NetworkConfig i_netConfig
-        {
-                BasePolicy = new BasePolicy(flaskPath);
@@ -65 +67 @@
-                capabilities = new HashMap();
-                m_MLSSupport = i_support;
+                m_netConfig = i_netConfig;
-        }
-        
@@ -75 +78 @@
-        {
-                return m_MLSSupport;
+        }
+        
+        public NetworkConfig getNetworkConfig ()
+        {
+                return m_netConfig;
-        }
-        

branches/networking/src/com/tresys/framework/compiler/linkage/net/Endpoint.java

@@ -13 +13 @@
-
-import com.tresys.framework.compiler.AbstractToken;
+import com.tresys.framework.compiler.policy.Component;
+import com.tresys.framework.compiler.policy.IPolicyVisitor;
-import com.tresys.framework.compiler.systemResources.NetworkInfo;
-
@@ -20 +22 @@
- */
-public class Endpoint
+        extends Component
-{
-        private NetSystem m_system;
-
+//
-        private NetworkInfo m_netInfo;
-        
-        public Endpoint (NetSystem i_sys, AbstractToken i_domain, NetworkInfo i_info)
-        {
+                super (i_domain, null, null);
-                m_system = i_sys;
-
+//
-                m_netInfo = i_info;
-        }
+        
+        public Endpoint (Endpoint i_copyMe)
+        {
+                super (i_copyMe);
+                m_netInfo = i_copyMe.m_netInfo;
+                m_system = i_copyMe.m_system;
+        }
+        
+        /* (non-Javadoc)
+         * @see com.tresys.framework.compiler.policy.Component#Accept(com.tresys.framework.compiler.policy.IPolicyVisitor)
+         */
+        public void Accept (IPolicyVisitor i_visitor)
+        {
+                // TODO Auto-generated method stub
+                
+        }
+        
+        public NetworkInfo getNetworkInfo ()
+        {
+                return m_netInfo;
+        }
+/*      
+        public String getType ()
+        {
+                return m_tokDomain.image + "_t";
+        }
+
+        
+        /* (non-Javadoc)
+         * @see java.lang.Object#toString()
+         */
+        public String toString ()
+        {
+                StringBuffer str = new StringBuffer (super.toString ());
+//              str.append (m_tokDomain.toString ());
+                str.append ('#');
+                str.append (m_netInfo.toString ());
+                
+                return str.toString ();
+        }
-}

branches/networking/src/com/tresys/framework/compiler/linkage/net/FNETParser.jj

@@ -186 +186 @@
-//////////////////////////////////
-<DATA> TOKEN: {
+        <SEMICOLON : ";"> { SwitchTo (return_state_data); }
+        |<SEPERATOR : ".">
+        |<LBRACE: "{"> { return_state_brace = curLexState; SwitchTo (INBRACE); }
+}
+
+<INBRACE> TOKEN : {
-        <QSTRING:
-    "\""
@@ -197 +203 @@
-   )*
-    "\"">
-
-
-
-
-
-
-
-
-
+
-        |<IP: <DIGITS>"."<DIGITS>"."<DIGITS>"."<DIGITS>  >
-        |<NUMBER: <DIGITS> >
-        | < HEXKEY : "0x" (["0"-"9","a"-"f","A"-"F"])+> 
-        |<RBRACE: "}"> { SwitchTo (return_state_brace); }
+        |<LPAREN: "(">
+        |<RPAREN: ")">
+        |<KEY: (["0"-"9","a"-"z","A"-"Z","_","-"])+ > 
-}
-
@@ -258 +259 @@
-        }
-        
-BRACE
-ID
-BRACE
+PAREN
+KEY
+PAREN
-        {
-                resource.put (NetResource.KEY_ENC_TYPE, encAlg.image);
-                resource.put (NetResource.KEY_ENC_KEY, encKey.image);
-        }
-BRACE
-ID
-BRACE
+PAREN
+KEY
+PAREN
-        {
-                resource.put (NetResource.KEY_AUTH_TYPE, authAlg.image);

branches/networking/src/com/tresys/framework/compiler/linkage/net/NetConnection.java

@@ -31 +31 @@
-                m_nESP = i_nesp;
-        }
+        
+        public Endpoint getSource ()
+        {
+                return m_source;
+        }
+        
+        public Endpoint getTarget ()
+        {
+                return m_target;
+        }
+        
+        public NetResource getResource ()
+        {
+                return m_networkresource;
+        }
+        
+        public int getESPNumber ()
+        {
+                return m_nESP;
+        }
+        
+        /* (non-Javadoc)
+         * @see java.lang.Object#toString()
+         */
+        public String toString ()
+        {
+                StringBuffer str = new StringBuffer ();
+                str.append (m_source.toString ());
+                str.append ('#');
+                str.append (m_target.toString ());
+                str.append ('#');
+//              str.append (m_networkresource.toString ());
+//              str.append ('#');
+                str.append (m_nESP);
+                return str.toString ();
+        }
-}

branches/networking/src/com/tresys/framework/compiler/linkage/net/NetItem.java

@@ -38 +38 @@
-                return m_sName;
-        }
+        
+        /* (non-Javadoc)
+         * @see java.lang.Object#equals(java.lang.Object)
+         */
+        public boolean equals (Object obj)
+        {
+                if (!(obj instanceof NetItem))
+                        return false;
+                
+                NetItem other = (NetItem) obj;
+                if (!m_sName.equals (other.m_sName))
+                        return false;
+                
+                if (!m_token.equals (other.m_token))
+                        return false;
+                
+                return true;
+        }
+        
+        /* (non-Javadoc)
+         * @see java.lang.Object#toString()
+         */
+        public String toString ()
+        {
+                return getName ();
+        }
-}

branches/networking/src/com/tresys/framework/compiler/linkage/net/NetResource.java

@@ -45 +45 @@
-                m_resInfo.put (i_sKey, i_Value);
-        }
+        
+        public Object get (String i_sKey)
+        {
+                return m_resInfo.get (i_sKey);
+        }
+        
+        /* (non-Javadoc)
+         * @see java.lang.Object#equals(java.lang.Object)
+         */
+        public boolean equals (Object obj)
+        {
+                if (!super.equals (obj))
+                        return false;
+                
+                if (!(obj instanceof NetResource))
+                        return false;
+                
+                return m_resInfo.equals (((NetResource) obj).m_resInfo);
+        }       
+        
+        /* (non-Javadoc)
+         * @see com.tresys.framework.compiler.linkage.net.NetItem#toString()
+         */
+        public String toString ()
+        {
+                StringBuffer buf = new StringBuffer (super.toString ());
+                
+                Object type = m_resInfo.get (KEY_TYPE);
+                if (type != null)
+                {
+                        buf.append (' ');
+                        buf.append (type.toString ());
+                }
+                
+                return buf.toString ();
+        }
-}

branches/networking/src/com/tresys/framework/compiler/linkage/net/NetworkConfig.java

@@ -12 +12 @@
-package com.tresys.framework.compiler.linkage.net;
-
+import java.util.ArrayList;
+import java.util.Collection;
-import java.util.HashMap;
+import java.util.Iterator;
-import java.util.Map;
-
@@ -54 +57 @@
-        public void Add (NetConnection i_connection)
-        {
+                String sName = i_connection.toString ();
+                m_connections.put (sName, i_connection);
+        }
+        
+        public Collection getConnections (NetResource i_res)
+        {
+                ArrayList list = new ArrayList ();
+                if (i_res == null)
+                        return list;
-                
+                for (Iterator itr = m_connections.values ().iterator (); itr.hasNext (); )
+                {
+                        NetConnection connection = (NetConnection) itr.next ();
+                        if (i_res.equals (connection.getResource ()))
+                                list.add (connection);
+                }
+                
+                return list;
-        }
-}

branches/networking/src/com/tresys/framework/compiler/policy/Component.java

@@ -436 +436 @@
-        {
-                HashMap matchingAccesses = new HashMap();
-
-
+
-                {
-                        Access axx = (Access) itr.next();
@@ -457 +456 @@
-        public boolean Contains(Access axx) 
-        {
-
-
+
-                {
-                        Access currAccess = (Access) itr.next();

branches/networking/src/com/tresys/framework/compiler/systemResources/LabeledNetworkResource.java

@@ -29 +29 @@
-                m_netInfo = i_nInfo;
-        }
+        
+        public NetworkInfo getNetworkInfo ()
+        {
+                return m_netInfo;
+        }
-}

branches/networking/src/com/tresys/framework/compiler/systemResources/NetworkInfo.java

@@ -11 +11 @@
-
-package com.tresys.framework.compiler.systemResources;
+
+import java.util.Arrays;
-
-/**
@@ -45 +47 @@
-        
-        /* (non-Javadoc)
+         * @see java.lang.Object#equals(java.lang.Object)
+         */
+        public boolean equals (Object obj)
+        {
+                if (super.equals (obj))
+                        return true;
+                
+                if (!(obj instanceof NetworkInfo))
+                        return false;
+
+                NetworkInfo other = (NetworkInfo) obj;
+                if (!m_sNode.equals (other.m_sNode))
+                        return false;
+                
+                if (!m_sIPAddr.equals (other.m_sIPAddr))
+                        return false;
+                
+                if (!Arrays.equals (m_nPorts, other.m_nPorts))
+                        return false;
+                
+                return true;
+        }
+        
+        /* (non-Javadoc)
-         * @see java.lang.Object#toString()
-         */

branches/networking/src/com/tresys/framework/compiler/translator/SELinuxDictionary.java

@@ -81 +81 @@
-
-                        m_bufferDictionary.println ("## <param name=\"domain\">");
-'
+
-                        m_bufferDictionary.println ("## </param>");
-
@@ -109 +109 @@
-
-                        m_bufferDictionary.println ("## <param name=\"domain\">");
-'
+
-                        m_bufferDictionary.println ("## </param>");
-                        m_bufferDictionary.println ("## <param name=\"resource\">");

branches/networking/src/com/tresys/framework/compiler/translator/SELinuxPolicy.java

@@ -61 +61 @@
-import com.tresys.framework.compiler.linkage.libselinuxjava.selinux;
-import com.tresys.framework.compiler.linkage.libselinuxjava.selinuxConstants;
+import com.tresys.framework.compiler.linkage.net.Endpoint;
+import com.tresys.framework.compiler.linkage.net.NetConnection;
+import com.tresys.framework.compiler.linkage.net.NetResource;
+import com.tresys.framework.compiler.linkage.net.NetworkConfig;
-import com.tresys.framework.compiler.mls.MLSLevel;
-import com.tresys.framework.compiler.policy.Ability;
@@ -104 +108 @@
-        
-        private final Linkage m_linkage;
+        private final NetworkConfig m_netConfig;
-        private final boolean m_bGeneratePolicyTemplate;
-        
@@ -123 +128 @@
-        private TreeSet/*<String>*/m_dirPermSet = new TreeSet/*<String>*/();
-        
-
+NetworkConfig i_netConfig, 
-        {
-                m_linkage = _linkage;
@@ -129 +134 @@
-                m_hasFileContext = false;
-                m_bGeneratePolicyTemplate = false;
+                m_netConfig = i_netConfig;
-        
-                if (fcFile != null && fcFile.exists()) 
@@ -138 +144 @@
-        }
-        
-
+NetworkConfig i_netConfig, 
-        {
-                m_linkage = i_linkage;
-                m_bGeneratePolicyTemplate = i_bGenerateTemplates;
-                m_sModuleName = i_sModuleName;
+                m_netConfig = i_netConfig;
-        }
-        
@@ -219 +226 @@
-                {
-                        Rdef rdef = (Rdef) itr.next();
-
+
+
+
+
+
+
+
-                        String sType = i_resource.GetTypeWithDictionaryObject(rdef.GetName());
-
@@ -816 +829 @@
-                                        {
-                                                sResType = ((ControlResource)resource).getType();
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                                        else 
-                                        {
-                              &n