­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 3 O+eU @sddlZddlZddlmZmZddlmZddlZddl m Z m Z ddl m Z mZddlmZdgZed d d d d dddgZed ddddgZGdddZGdddZdS)N) defaultdict namedtuple)suppress) NetworkXErrorNetworkXNoPath) EdgeAttrDict EdgeAttrList) TERuletypeDomainTransitionAnalysisstepsourcetarget transition entrypointssetexec dyntransition setcurrentname entrypointexecutetype_transitionc@seZdZdZd!ddZeddZejddZed d Zejd d Zd d Z d"ddZ ddZ ddZ ddZ eddZddZddZddZdd ZdS)#r zDomain transition analysis.FNcCs>tjt|_||_||_||_d|_d|_t j |_ d|_ dS)zD Parameter: policy The policy to analyze. TN) loggingZ getLogger__name__logpolicyexcludereverse rebuildgraphrebuildsubgraphnxZDiGraphGsubG)selfrrrr$/usr/lib64/python3.6/dta.py__init__6s  z!DomainTransitionAnalysis.__init__cCs|jS)N)_reverse)r#r$r$r%rEsz DomainTransitionAnalysis.reversecCst||_d|_dS)NT)boolr'r)r# directionr$r$r%rIs cCs|jS)N)_exclude)r#r$r$r%rNsz DomainTransitionAnalysis.excludecs*|rfdd|D_ng_d_dS)Ncsg|]}jj|qSr$)r lookup_type).0t)r#r$r% Usz4DomainTransitionAnalysis.exclude..T)r*r)r#typesr$)r#r%rRsc csj|jj|}|jj|}|jr&|j|jjdj||tt|j t j |j ||VWdQRXdS)a Generator which yields one shortest domain transition path between the source and target types (there may be more). Parameters: source The source type. target The target type. Yield: generator(steps) steps A generator that returns the tuple of source, target, and rules for each domain transition. z8Generating one domain transition path from {0} to {1}...N) rr+r_build_subgraphrinfoformatrr)_DomainTransitionAnalysis__generate_stepsr shortest_pathr")r#r rsr-r$r$r%r4[s   z&DomainTransitionAnalysis.shortest_pathc cs|dkrtd|jj|}|jj|}|jr6|j|jjdj|||tt .x&t j |j |||D]}|j |VqjWWdQRXdS)a Generator which yields all domain transition paths between the source and target up to the specified maximum path length. Parameters: source The source type. target The target type. maxlen Maximum length of paths. Yield: generator(steps) steps A generator that returns the tuple of source, target, and rules for each domain transition. rz%Maximum path length must be positive.zIGenerating all domain transition paths from {0} to {1}, max length {2}...N) ValueErrorrr+rr0rr1r2rrr Zall_simple_pathsr"r3)r#r rmaxlenr5r-pathr$r$r% all_pathsxs     z"DomainTransitionAnalysis.all_pathsc csx|jj|}|jj|}|jr&|j|jjdj||tt,x$t j |j ||D]}|j |VqVWWdQRXdS)a Generator which yields all shortest domain transition paths between the source and target types. Parameters: source The source type. target The target type. Yield: generator(steps) steps A generator that returns the tuple of source, target, and rules for each domain transition. zBGenerating all shortest domain transition paths from {0} to {1}...N) rr+rr0rr1r2rrr all_shortest_pathsr"r3)r#r rr5r-r9r$r$r%r;s     z+DomainTransitionAnalysis.all_shortest_pathsccs|jj|}|jr|j|jjdj||jr0dndtt nxf|j j |D]V\}}t |j ||}|jrx||}}n ||}}t |||j|j||j|j|jVqPWWdQRXdS)aM Generator which yields all domain transitions out of a specified source type. Parameters: type_ The starting type. Yield: generator(steps) steps A generator that returns the tuple of source, target, and rules for each domain transition. z)Generating all domain transitions {1} {0}zin tozout fromN)rr+rr0rr1r2rrrr"Z out_edgesEdge step_outputr/_DomainTransitionAnalysis__generate_entrypointsrrr)r#Ztype_r5r redge real_source real_targetr$r$r% transitionss"     z$DomainTransitionAnalysis.transitionscCs|jr|jtj|jS)zR Get the domain transition graph statistics. Return: str )r _build_graphr r1r!)r#r$r$r% get_statssz"DomainTransitionAnalysis.get_statscsfddjDS)a Creates a list of entrypoint, execute, and type_transition rules for each entrypoint. Parameter: data The dictionary of entrypoints. Return: list of tuple(type, entry, exec, trans) type The entrypoint type. entry The list of entrypoint rules. exec The list of execute rules. trans The list of type_transition rules. cs,g|]$}t|j|j|j|qSr$)entrypoint_outputrrr)r,e)r?r$r%r.szCDomainTransitionAnalysis.__generate_entrypoints..)r)r?r$)r?r%Z__generate_entrypointss z/DomainTransitionAnalysis.__generate_entrypointsc cs~xxtdt|D]f}||d}||}t|j||}|jrH||}}n ||}}t|||j|j||j|j |j VqWdS)a Generator which yields the source, target, and associated rules for each domain transition. Parameter: path A list of graph node names representing an information flow path. Yield: tuple(source, target, transition, entrypoints, setexec, dyntransition, setcurrent) source The source type for this step of the domain transition. target The target type for this step of the domain transition. transition The list of transition rules. entrypoints Generator which yields entrypoint-related rules. setexec The list of setexec rules. dyntranstion The list of dynamic transition rules. setcurrent The list of setcurrent rules. rN) rangelenr<r"rr=rr>rrr)r#r9r5r rr?r@rAr$r$r%Z__generate_stepss   z)DomainTransitionAnalysis.__generate_stepscCs|jjdj|j|j_|jjdj|jtt}tt}tdd}tdd}tdd}x4|jj D]$}|j t j kr8|j dkrqp|j}|j dkrd |krxJtj|jj|jjD].\}} || krt|j|| d d } | jj|qWd |krPxNtj|jj|jjD]2\}} || krt|j|| d d } | jj|qWd |kr~x"|jjD]}||j|qfWd|kr6x|jjD]}||j|qWnd|krx8tj|jj|jjD]\}} ||| j|qWd|krxtj|jj|jjD]\}} ||| j|qWqp|j t jkrp|j dkrRqp|j} xnsz7DomainTransitionAnalysis._build_graph..cSsttS)N)rrIr$r$r$r%rJoscSs tddS)NcSsttS)N)rrIr$r$r$r%rJrszIDomainTransitionAnalysis._build_graph....)rr$r$r$r%rJrsprocessfilerT)createrrrrrFz+Completed building domain transition graph.z$Graph stats: nodes: {0}, edges: {1}.)rKrL)*r!clearr2rrrr1rrIZterulesZruletyper ZallowZtclassperms itertoolsproductr expandrr<rappendrrdefaultedgessetkeys intersectionrrrextendrremove_edges_fromrrdebugr number_of_nodesnumber_of_edges)r#rrrrZ type_transZrulerOr5r-r?rFdZ invalid_edgeZclear_transitionZclear_dyntransitionZ invalid_transZinvalid_dyntransentryZexematchmr$r$r%rCas      " "     "  "   $             z%DomainTransitionAnalysis._build_graphc Csg}x|jjD]\}}t|j||}t|j}|j|j|sBqx8|D]0}|j|=|j|=tt |j |=WdQRXqHW|j r|j r|j |qW|jj |dS)N)r"rUr<rVrintersection_updaterrrKeyErrorrrrSrZ)r#Z invalid_edgesr rr?rrFr$r$r%Z__remove_excluded_entrypointss    z6DomainTransitionAnalysis.__remove_excluded_entrypointscCs|jr|j|jjd|jjdj|j|jjdj|j|jrZ|jjdd|_ n |jj |_ |jr|j j |j|j d|_ |jjd|jjdjtj|j tj|j dS) Nz$Building domain transition subgraph.z Excluding {0}z Reverse {0}T)copyFz.Completed building domain transition subgraph.z'Subgraph stats: nodes: {0}, edges: {1}.)rrCrr1r[r2rrr!r"rdZremove_nodes_from6_DomainTransitionAnalysis__remove_excluded_entrypointsrr r\r])r#r$r$r%r0s      z(DomainTransitionAnalysis._build_subgraph)FN)r6)r __module__ __qualname____doc__r&propertyrsetterrr4r:r;rBrD staticmethodr>r3rCrer0r$r$r$r%r 2s"     $' ^c@sbeZdZdZedZedZedZedZe dZ e dZ e dZ dd d Z d d ZddZdS)r<aS A graph edge. Also used for returning domain transition steps. Parameters: graph The NetworkX graph. source The source type of the edge. target The target tyep of the edge. Keyword Parameters: create (T/F) create the edge if it does not exist. The default is False. rrrrrrrFcCsj||_||_||_|jj||sf|s.tdn8|jj||d|_d|_d|_d|_ d|_ d|_ d|_ dS)NzEdge does not exist in graph) r!r rZhas_edger7Zadd_edgerrrrrrr)r#Zgraphr rrMr$r$r%r&Es z Edge.__init__cs4t|tr&fddt|jdDSj|SdS)Ncsg|]}j|qSr$)_index_to_item)r,i)r#r$r%r.[sz$Edge.__getitem__..r6) isinstanceslicerGindicesrl)r#keyr$)r#r% __getitem__Ws zEdge.__getitem__cCs.|dkr|jS|dkr|jStdj|dS)z'Return source or target based on index.rrz,Invalid index (edges only have 2 items): {0}N)r r IndexErrorr2)r#indexr$r$r%rl_s zEdge._index_to_itemN)F)rrfrgrhr rrrrrrrrr&rrrlr$r$r$r%r<.s  r<)rPr collectionsrr contextlibrZnetworkxr Znetworkx.exceptionrrZ descriptorsrr Z policyrepr __all__r=rEr r<r$r$r$r%s2