src/main/java/net/floodlightcontroller/firewall/FirewallRulesResource.java

package net.floodlightcontroller.firewall;

import java.io.IOException;
import java.util.Iterator;
import java.util.List;

import org.codehaus.jackson.JsonParseException;
import org.codehaus.jackson.JsonParser;
import org.codehaus.jackson.JsonToken;
import org.codehaus.jackson.map.MappingJsonFactory;
import org.openflow.util.HexString;
import org.restlet.resource.Delete;
import org.restlet.resource.Post;
import org.restlet.resource.Get;
import org.restlet.resource.ServerResource;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import net.floodlightcontroller.packet.Ethernet;
import net.floodlightcontroller.packet.IPv4;

public class FirewallRulesResource extends ServerResource {
    protected static Logger log = LoggerFactory.getLogger(FirewallRulesResource.class);

    @Get("json")
    public Object handleRequest() {
        IFirewallService firewall = 
                (IFirewallService)getContext().getAttributes().
                get(IFirewallService.class.getCanonicalName());

        return firewall.getRules();
    }

    /**
     * Takes a Firewall Rule string in JSON format and parses it into
     * our firewall rule data structure, then adds it to the firewall.
     * @param fmJson The Firewall rule entry in JSON format.
     * @return A string status message
     */
    @Post
    public String store(String fmJson) {
        IFirewallService firewall = 
                (IFirewallService)getContext().getAttributes().
                get(IFirewallService.class.getCanonicalName());

        FirewallRule rule;
        try {
            rule = jsonToFirewallRule(fmJson);
        } catch (IOException e) {
            log.error("Error parsing firewall rule: " + fmJson, e);
            e.printStackTrace();
            return "{\"status\" : \"Error! Could not parse firewall rule, see log for details.\"}";
        }
        String status = null;
        if (checkRuleExists(rule, firewall.getRules())) {
            status = "Error! A similar firewall rule already exists.";
            log.error(status);
        } else {
            // add rule to firewall
            firewall.addRule(rule);
            status = "Rule added";
        }
        return ("{\"status\" : \"" + status + "\"}");
    }

    /**
     * Takes a Firewall Rule string in JSON format and parses it into
     * our firewall rule data structure, then deletes it from the firewall.
     * @param fmJson The Firewall rule entry in JSON format.
     * @return A string status message
     */
    
    @Delete
    public String remove(String fmJson) {
        IFirewallService firewall = 
                (IFirewallService)getContext().getAttributes().
                get(IFirewallService.class.getCanonicalName());

        FirewallRule rule;
        try {
            rule = jsonToFirewallRule(fmJson);
        } catch (IOException e) {
            log.error("Error parsing firewall rule: " + fmJson, e);
            e.printStackTrace();
            return "{\"status\" : \"Error! Could not parse firewall rule, see log for details.\"}";
        }
        String status = null;
        boolean exists = false;
        Iterator<FirewallRule> iter = firewall.getRules().iterator();
        while (iter.hasNext()) {
            FirewallRule r = iter.next();
            if (r.ruleid == rule.ruleid) {
                exists = true;
                break;
            }
        }
        if (!exists) {
            status = "Error! Can't delete, a rule with this ID doesn't exist.";
            log.error(status);
        } else {
            // delete rule from firewall
            firewall.deleteRule(rule.ruleid);
            status = "Rule deleted";
        }
        return ("{\"status\" : \"" + status + "\"}");
    }

    /**
     * Turns a JSON formatted Firewall Rule string into a FirewallRule instance
     * @param fmJson The JSON formatted static firewall rule
     * @return The FirewallRule instance
     * @throws IOException If there was an error parsing the JSON
     */
     
    public static FirewallRule jsonToFirewallRule(String fmJson) throws IOException {
        FirewallRule rule = new FirewallRule();
        MappingJsonFactory f = new MappingJsonFactory();
        JsonParser jp;

        try {
            jp = f.createJsonParser(fmJson);
        } catch (JsonParseException e) {
            throw new IOException(e);
        }

        jp.nextToken();
        if (jp.getCurrentToken() != JsonToken.START_OBJECT) {
            throw new IOException("Expected START_OBJECT");
        }

        while (jp.nextToken() != JsonToken.END_OBJECT) {
            if (jp.getCurrentToken() != JsonToken.FIELD_NAME) {
                throw new IOException("Expected FIELD_NAME");
            }

            String n = jp.getCurrentName();
            jp.nextToken();
            if (jp.getText().equals("")) 
                continue;

            String tmp;
            
            // This is currently only applicable for remove().  In store(), ruleid takes a random number
            if (n == "ruleid") {
                rule.ruleid = Integer.parseInt((String)jp.getText());
            }
            
            // This assumes user having dpid info for involved switches
            else if (n == "switchid") {
                tmp = jp.getText();
                if (tmp.equalsIgnoreCase("-1") == false) {
                    // user inputs hex format dpid 
                    rule.dpid = HexString.toLong(tmp);                    
                    rule.wildcard_dpid = false;
                }
            } 
            
            else if (n == "src-inport") {
                rule.in_port = Short.parseShort(jp.getText());
                rule.wildcard_in_port = false;
            } 
            
            else if (n == "src-mac") {
                tmp = jp.getText();
                if (tmp.equalsIgnoreCase("ANY") == false) {
                    rule.wildcard_dl_src = false;
                    rule.dl_src = Ethernet.toLong(Ethernet.toMACAddress(tmp));
                }
            } 
            
            else if (n == "dst-mac") {
                tmp = jp.getText();
                if (tmp.equalsIgnoreCase("ANY") == false) {
                    rule.wildcard_dl_dst = false;
                    rule.dl_dst = Ethernet.toLong(Ethernet.toMACAddress(tmp));
                }
            } 
            
            else if (n == "dl-type") {
                tmp = jp.getText();
                if (tmp.equalsIgnoreCase("ARP")) {
                    rule.wildcard_dl_type = false;
                    rule.dl_type = Ethernet.TYPE_ARP;
                }
            } 
            
            else if (n == "src-ip") {
                tmp = jp.getText();
                if (tmp.equalsIgnoreCase("ANY") == false) {
                    rule.wildcard_nw_src = false;
                    rule.wildcard_dl_type = false;
                    rule.dl_type = Ethernet.TYPE_IPv4;
                    int[] cidr = IPCIDRToPrefixBits(tmp);
                    rule.nw_src_prefix = cidr[0];
                    rule.nw_src_maskbits = cidr[1];
                }
            } 
            
            else if (n == "dst-ip") {
                tmp = jp.getText();
                if (tmp.equalsIgnoreCase("ANY") == false) {
                    rule.wildcard_nw_dst = false;
                    rule.wildcard_dl_type = false;
                    rule.dl_type = Ethernet.TYPE_IPv4;
                    int[] cidr = IPCIDRToPrefixBits(tmp);
                    rule.nw_dst_prefix = cidr[0];
                    rule.nw_dst_maskbits = cidr[1];
                }
            } 
            
            else if (n == "nw-proto") {
                tmp = jp.getText();
                if (tmp.equalsIgnoreCase("TCP")) {
                    rule.wildcard_nw_proto = false;
                    rule.nw_proto = IPv4.PROTOCOL_TCP;
                    rule.wildcard_dl_type = false;
                    rule.dl_type = Ethernet.TYPE_IPv4;
                } else if (tmp.equalsIgnoreCase("UDP")) {
                    rule.wildcard_nw_proto = false;
                    rule.nw_proto = IPv4.PROTOCOL_UDP;
                    rule.wildcard_dl_type = false;
                    rule.dl_type = Ethernet.TYPE_IPv4;
                } else if (tmp.equalsIgnoreCase("ICMP")) {
                    rule.wildcard_nw_proto = false;
                    rule.nw_proto = IPv4.PROTOCOL_ICMP;
                    rule.wildcard_dl_type = false;
                    rule.dl_type = Ethernet.TYPE_IPv4;
                } 
            } 
            
            else if (n == "tp-src") {
                rule.wildcard_tp_src = false;
                rule.tp_src = Short.parseShort(jp.getText());
            } 
            
            else if (n == "tp-dst") {
                rule.wildcard_tp_dst = false;
                rule.tp_dst = Short.parseShort(jp.getText());
            } 
            
            else if (n == "priority") {
                rule.priority = Integer.parseInt(jp.getText());
            } 
            
            else if (n == "action") {
                if (jp.getText().equalsIgnoreCase("allow") == true) {
                    rule.action = FirewallRule.FirewallAction.ALLOW;
                } else if (jp.getText().equalsIgnoreCase("deny") == true) {
                    rule.action = FirewallRule.FirewallAction.DENY;
                }
            }
        }

        return rule;
    }

    public static int[] IPCIDRToPrefixBits(String cidr) {
        int ret[] = new int[2];

        // as IP can also be a prefix rather than an absolute address
        // split it over "/" to get the bit range
        String[] parts = cidr.split("/");
        String cidr_prefix = parts[0].trim();
        int cidr_bits = 0;
        if (parts.length == 2) {
            try {
                cidr_bits = Integer.parseInt(parts[1].trim());
            } catch (Exception exp) {
                cidr_bits = 32;
            }
        }
        ret[0] = IPv4.toIPv4Address(cidr_prefix);
        ret[1] = cidr_bits;

        return ret;
    }

    public static boolean checkRuleExists(FirewallRule rule, List<FirewallRule> rules) {
        Iterator<FirewallRule> iter = rules.iterator();
        while (iter.hasNext()) {
            FirewallRule r = iter.next();

            // check if we find a similar rule
            if (rule.isSameAs(r)) {
                return true;
            }
        }

        // no rule matched, so it doesn't exist in the rules
        return false;
    }
}