view release on metacpan or  search on metacpan

lib/Firewall/Policy/Designer/Topsec.pm  view on Meta::CPAN

package Firewall::Policy::Designer::Topsec;

#------------------------------------------------------------------------------
# 加载项目模块
#------------------------------------------------------------------------------
use Moose;
use namespace::autoclean;
no warnings 'uninitialized';
use List::Util qw( uniq );
use Mojo::Util qw(dumper);

#------------------------------------------------------------------------------
# getAnalyzerReport 获取防火墙策略源目地址、服务端口分析报告
#------------------------------------------------------------------------------
use Firewall::Utils::Ip;
use Firewall::Policy::Searcher::Topsec;
use Firewall::Policy::Searcher::Report::FwInfo;

#------------------------------------------------------------------------------
# Firewall::Policy::Designer::Topsec 通用属性
#------------------------------------------------------------------------------
has dbi => ( is => 'ro', does => 'Firewall::DBI::Role', required => 1, );

has searcherReportFwInfo => ( is => 'ro', isa => 'Firewall::Policy::Searcher::Report::FwInfo', required => 1, );

has commandText => ( is => 'ro', isa => 'ArrayRef[Str]', default => sub { [] }, );

#------------------------------------------------------------------------------
# addToCommandText 设置 commandText 属性，入参为标量
#------------------------------------------------------------------------------
sub addToCommandText {
  my ( $self, $commands ) = @_;
  push @{$self->{"commandText"}}, $commands;
}

#------------------------------------------------------------------------------
# design 策略设计函数入口，入参为防火墙策略报告 -> searcherReportFwInfo
#------------------------------------------------------------------------------
sub design {
  my $self = shift;

  # 提取防火墙策略报告下 type 属性
  my $type   = $self->{"searcherReportFwInfo"}{"type"};
  my $action = $self->{"searcherReportFwInfo"}{"action"};

  # 情况1：当类型为 new，则新建策略
  if ( $type eq 'new' ) {
    $self->createRule();
  }

  # 情况2：当类型为 modify，则修改策略
  elsif ( $type eq 'modify' ) {
    $self->modifyRule();
  }

  # 情况3：当类型为 ignore，还需要检查是否存在 NAT 策略
  elsif ( $type eq 'ignore' ) {
    my $param = $action->{"new"} if defined $action;
    for my $natDirection ( keys %{$param} ) {
      if ( $natDirection eq 'natSrc' || $natDirection eq 'natDst' ) {
        $self->createNat( $param->{$natDirection}, $type );
      }
    }
  }

  # 其他情况：抛出异常，定位排除
  else {
    confess "ERROR: searcherReportFwInfo->type("
      . $self->{"searcherReportFwInfo"}{"type"}
      . ") must be 'new' or 'modify'";
  }

  # 拼接数组为字符串并返回
  return join( "\n", uniq @{$self->{"commandText"}} );
} ## end sub design

#------------------------------------------------------------------------------
# createRule 新增策略
#------------------------------------------------------------------------------
sub createRule {
  my $self = shift;

  # 新增策略其 action 为 new
  my $create = $self->{"searcherReportFwInfo"}{"action"}{"new"};

  # 获取源目安全区并拼接