managedomain.java

sifi-0.1.6.tar.gz 出自http://www.ifi.unizh.ch/ikm/SINUS/firewall/ 一个linux的防火墙工具。

/* ----------------------------------------------------------------------
   The SINUS Firewall -- a TCP/IP packet filter for Linux

   Written within the SINUS project at the University of Zurich,
   SWITCH, Telekurs Payserv AG, ETH Zurich.
   originally based on the sf Firewall Software (C) 1996 by Robert
   Muchsel and Roland Schmid.

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 2 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program; if not, write to the Free Software
   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

   SINUS Firewall resources:
   SINUS Homepage: http://www.ifi.unizh.ch/ikm/SINUS/
   Firewall Homepage: http://www.ifi.unizh.ch/ikm/SINUS/firewall.html
   Frequently asked questions: http://www.ifi.unizh.ch/ikm/SINUS/sf_faq.html
   Mailing list for comments, questions, bug reports: [e-mail]
   ----------------------------------------------------------------------  */



package sfclasses;

import java.awt.*;
import java.net.*;
import java.util.*;
import java.io.*;
import corejava.*;

/**
 * This class describes a complete manageable domain. This includes
 * the network topology, the firewall configuration, statistics...
 * @version 1.0 29 Nov 1996
 * @author Roland E. Schmid
 */

public class ManageDomain implements Persistent {

  public ManageDomain() {
    Topology = new Graph();
    generalTemplates = new boolean[Templates.numberGeneral];
    for (int i=0; i < Templates.numberGeneral; i++)
      generalTemplates[i] = Templates.defaultActivate[i];
  }

  // public methods

  /**
   * Returns the topology graph
   */
  public Graph getTopology() {
    return Topology;
  }

	/**
	 * Indicate wether the topology configuration is consistent or not.
	 * @return true if topoplogy configuration is consistent, false otherwise.
	 */
	public boolean isConsistent() {
		return Topology.isConsistent;
	}

  /**
   * This method is called when the Domain Edit mode is left. It is used
   * to scan all Items for changes the domain has to know of.
   */
  public void topologyChanged() {
    Firewalls = new Vector(5,5);
    Enumeration en = Topology.getAllVertices();
    DragDropObj ddo;
    while (en.hasMoreElements()) {
      ddo = (DragDropObj)en.nextElement();
      if (ddo instanceof ManageObject)
        ((ManageObject)ddo).mgDomain = this;
      if (ddo instanceof Host)
        if (((Host)ddo).isFirewall)
          Firewalls.addElement((Host)ddo);
    }
    constructFwAddr();
  }

  /** 
   * Run automatic configuration algorithm,
   * generate rules from templates
   */
  public void autoConfig() {

    autoconfValid = false;

    // ======================================================================
    // step 1: scan domain topology and determine levels of all objects
    // ======================================================================

    // initialize all objects with level -1, internet objects with level 0
    // insert internet objects in visit queue
    corejava.LinkedList visitQueue = new corejava.LinkedList();
    Enumeration en;
    ManageObject mo;
    maxlevel = -1;
    en = Topology.getAllVertices();
    while (en.hasMoreElements()) {
      mo = (ManageObject)en.nextElement();
      if (mo instanceof Internet) {
        mo.level = 0;
        visitQueue.insert(mo);
      }
      else
        mo.level = -1;
    }

    // traverse graph
    while (visitQueue.size() > 0) { // queue not empty
      visitQueue.reset();
      mo = (ManageObject)visitQueue.remove();
      traverse(mo, visitQueue);
    }
      
    // ======================================================================
    // step 2: calculate internalnets for all firewalls
    // ======================================================================

    // initialize all firewalls
    visitQueue = new corejava.LinkedList();
    en = Firewalls.elements();
    Host h;
    while (en.hasMoreElements()) {
      h = (Host)en.nextElement();
      h.internalAddresses = null;
      // insert firewall into sorted list (descending order of levels)
      visitQueue.reset();
      while (visitQueue.hasMoreElements() && 
             ((Host)visitQueue.currentElement()).level > h.level)
        visitQueue.nextElement();
      visitQueue.insert(h);
    }

    // calculate internalnets for all firewalls
    visitQueue.reset();
    while (visitQueue.hasMoreElements()) {
      h = (Host)visitQueue.remove();

      // initialize all objects
      en = Topology.getAllVertices();
      while (en.hasMoreElements()) {
        mo = (ManageObject)en.nextElement();
        mo.visited = false;
      }

      // collect internalnet addresses from topology
      h.internalAddresses = collect(h, h.level);
    }

    // ======================================================================
    // step 3: generate rules from templates
    // ======================================================================

    // general templates
    // -----------------
    Rule r;
    int numberOfFirewalls = Firewalls.size();
    for (int i=0; i < Templates.numberGeneral; i++) {
      if (generalTemplates[i]) {
        r = createRuleFromTemplate(i, 0);
        r.validFor = new boolean[numberOfFirewalls];
        for (int j=0; j < numberOfFirewalls; j++)
          r.validFor[j] = true;
      }
      else
        deleteTemplateRule(i, 0);
    }

    // server templates
    // ----------------
    Macro m1, m2;
    Rule r1, r2;

    // delete old address macros generated by previous autoconfiguration
    en = Macros.elements();
    while (en.hasMoreElements()) {
      m1 = (Macro)en.nextElement();
      if (m1.macroSpecial == Macro.MACRO_TEMPLATE)
        Macros.removeElement(m1);
    } 

    // number of first new address macro
    try {
      m1 = (Macro)Macros.lastElement();
    }
    catch (NoSuchElementException e) {
      m1 = null;
    }
    int nextMacroNumber = m1 == null ? Macro.firstDynamic : m1.macroNumber - 1;

    // generate rules for all server templates
    for (int i=Templates.startServer; i < Templates.startServer+Templates.numberServer; i++) {

      // generate rules for the firewalls of each level separately
      for (int lv=1; lv <= maxlevel; lv++) {

        m1 = new Macro(nextMacroNumber);
        nextMacroNumber--;
        m1.macroName = "TEMP"+i+"_"+(2*lv-1);
        m1.macroType = Macro.MACRO_ADDRESSLIST;
        m1.macroSpecial = Macro.MACRO_TEMPLATE;
        m1.port = Templates.srvport[i];
        m1.prend = Templates.srvprend[i];
        Macros.addElement(m1);

        m2 = new Macro(nextMacroNumber);
        nextMacroNumber--;
        m2.macroName = "TEMP"+i+"_"+(2*lv);
        m2.macroType = Macro.MACRO_ADDRESSLIST;
        m2.macroSpecial = Macro.MACRO_TEMPLATE;
        m2.port = Templates.srvport[i];
        m2.prend = Templates.srvprend[i];
        Macros.addElement(m2);

        boolean rused = false;
        r1 = createRuleFromTemplate(i, 2*lv - 1);
        r2 = createRuleFromTemplate(i, 2*lv);
        r1.comment += " - Level "+lv+" outgoing";
        r2.comment += " - Level "+lv+" incoming";
        r1.validFor = new boolean[numberOfFirewalls];
        r2.validFor = new boolean[numberOfFirewalls];
        for (int j=0; j < numberOfFirewalls; j++)
          if (((Host)Firewalls.elementAt(j)).level == lv) {
            r1.validFor[j] = true;
            r2.validFor[j] = true;
            rused = true;
          }
          else {
            r1.validFor[j] = false;
            r2.validFor[j] = false;
          }
        if (r1.fw_src_idx == Macro.STATIC_INSIDE_OUTSIDE)
          r1.fw_src_idx = Macro.STATIC_OUTSIDE;
        if (r1.fw_dst_idx == Macro.STATIC_INSIDE_OUTSIDE)
          r1.fw_dst_idx = Macro.STATIC_OUTSIDE;
        if (r1.fw_src_idx == Macro.STATIC_SERVER)
          r1.fw_src_idx = m1.macroNumber;
        if (r1.fw_dst_idx == Macro.STATIC_SERVER)
          r1.fw_dst_idx = m1.macroNumber;

        if (r2.fw_src_idx == Macro.STATIC_INSIDE_OUTSIDE)
          r2.fw_src_idx = Macro.STATIC_INSIDE;
        if (r2.fw_dst_idx == Macro.STATIC_INSIDE_OUTSIDE)
          r2.fw_dst_idx = Macro.STATIC_INSIDE;
        if (r2.fw_src_idx == Macro.STATIC_SERVER)
          r2.fw_src_idx = m2.macroNumber;
        if (r2.fw_dst_idx == Macro.STATIC_SERVER)
          r2.fw_dst_idx = m2.macroNumber;

        // traverse all servers
        en = Topology.getAllVertices();
        while (en.hasMoreElements()) {
          mo = (ManageObject)en.nextElement();
          if (!(mo instanceof Host))
            continue;
          h = (Host)mo;
          if (!h.isServer)
            continue;

          // check if template is selected for this server
          if (!h.hostTemplates[i - Templates.startServer]) 
            continue; // ignore this server in the rules being constructed

          if (h.level >= lv) // add server to rule 1
            if (h.publicServer || lv > 1)
              m1.addresses.union(h.HostAddresses);

          if (h.level < lv && h.level >= 0) // add server to rule 2
            m2.addresses.union(h.HostAddresses);

        } // while (server-loop)

        if (!rused || m1.addresses.empty()) {
          deleteTemplateRule(i, 2*lv - 1);
          Macros.removeElement(m1);
        }

        if (!rused || m2.addresses.empty()) {
          deleteTemplateRule(i, 2*lv);
          Macros.removeElement(m2);
        }

      } // for (level-loop)

      // delete all template rules with subID > 2*maxlevel
      en = Rules.elements();
      while (en.hasMoreElements()) {
        r1 = (Rule)en.nextElement();
        if (r1.templateID == i && r1.subID > (2*maxlevel)) 
          Rules.removeElement(r1);
      }

    } // for (template-loop)