rule_set * mk_loop_counter::revert(rule_set const & source) {
context& ctx = source.get_context();
rule_manager& rm = source.get_rule_manager();
rule_set * result = alloc(rule_set, ctx);
unsigned sz = source.get_num_rules();
rule_ref new_rule(rm);
app_ref_vector tail(m);
app_ref head(m);
svector<bool> neg;
for (unsigned i = 0; i < sz; ++i) {
tail.reset();
neg.reset();
rule & r = *source.get_rule(i);
unsigned utsz = r.get_uninterpreted_tail_size();
unsigned tsz = r.get_tail_size();
for (unsigned j = 0; j < utsz; ++j) {
tail.push_back(del_arg(r.get_tail(j)));
neg.push_back(r.is_neg_tail(j));
}
for (unsigned j = utsz; j < tsz; ++j) {
tail.push_back(r.get_tail(j));
neg.push_back(false);
}
head = del_arg(r.get_head());
new_rule = rm.mk(head, tail.size(), tail.c_ptr(), neg.c_ptr(), r.name(), true);
result->add_rule(new_rule);
}
// model converter: ...
// proof converter: ...
return result;
}
// Parse a rule completely, from the first item to the final period (or string).
golem_rule *parse_rule(golem_tokenizer *tokenizer) {
log("> parse rule [%d]\n", tokenizer->token);
golem_rule *rule = new_rule(parse_item(tokenizer));
if (tokenizer->token == ',') {
log("- parse rule: target\n");
(void)get_token(tokenizer);
rule->target = parse_item(tokenizer);
}
if (tokenizer->token == ';') {
log("- parse rule: others\n");
parse_rule_others(tokenizer, rule);
}
if (tokenizer->token == ':') {
log("- parse rule: effects\n");
if (parse_rule_effects(tokenizer, rule)) {
log("< parsed rule [%d]\n", tokenizer->token);
return rule;
}
}
if (tokenizer->token == '.') {
get_token(tokenizer);
log("< parsed rule [%d]\n", tokenizer->token);
return rule;
}
log("Error: unfinished rule.\n");
return NULL;
}
rule_set * mk_loop_counter::operator()(rule_set const & source) {
m_refs.reset();
m_old2new.reset();
m_new2old.reset();
rule_manager& rm = source.get_rule_manager();
rule_set * result = alloc(rule_set, m_ctx);
unsigned sz = source.get_num_rules();
rule_ref new_rule(rm);
app_ref_vector tail(m);
app_ref head(m);
svector<bool> neg;
rule_counter& vc = rm.get_counter();
for (unsigned i = 0; i < sz; ++i) {
tail.reset();
neg.reset();
rule & r = *source.get_rule(i);
unsigned cnt = vc.get_max_rule_var(r)+1;
unsigned utsz = r.get_uninterpreted_tail_size();
unsigned tsz = r.get_tail_size();
for (unsigned j = 0; j < utsz; ++j, ++cnt) {
tail.push_back(add_arg(source, *result, r.get_tail(j), cnt));
neg.push_back(r.is_neg_tail(j));
}
for (unsigned j = utsz; j < tsz; ++j) {
tail.push_back(r.get_tail(j));
neg.push_back(false);
}
head = add_arg(source, *result, r.get_head(), cnt);
// set the loop counter to be an increment of the previous
bool found = false;
unsigned last = head->get_num_args()-1;
for (unsigned j = 0; !found && j < utsz; ++j) {
if (head->get_decl() == tail[j]->get_decl()) {
tail.push_back(m.mk_eq(head->get_arg(last),
a.mk_add(tail[j]->get_arg(last),
a.mk_numeral(rational(1), true))));
neg.push_back(false);
found = true;
}
}
// initialize loop counter to 0 if none was found.
if (!found) {
expr_ref_vector args(m);
args.append(head->get_num_args(), head->get_args());
args[last] = a.mk_numeral(rational(0), true);
head = m.mk_app(head->get_decl(), args.size(), args.c_ptr());
}
new_rule = rm.mk(head, tail.size(), tail.c_ptr(), neg.c_ptr(), r.name(), true);
result->add_rule(new_rule);
}
// model converter: remove references to extra argument.
// proof converter: remove references to extra argument as well.
return result;
}
void scan_pdfrefximage(PDF pdf)
{
/*tex One could scan transform as well. */
int transform = 0;
/*tex Begin of experiment. */
int open = 0;
/*tex End of experiment. */
image_dict *idict;
/*tex This scans |<rule spec>| to |alt_rule|. */
scaled_whd alt_rule, dim;
alt_rule = scan_alt_rule();
/*tex Begin of experiment. */
if (scan_keyword("keepopen")) {
open = 1;
}
/*tex End of experiment. */
scan_int();
check_obj_type(pdf, obj_type_ximage, cur_val);
tail_append(new_rule(image_rule));
idict = idict_array[obj_data_ptr(pdf, cur_val)];
/*tex Begin of experiment, */
if (open) {
/*tex So we keep the original value when no close is given. */
idict->keepopen = 1;
}
/*tex End of experiment. */
if (img_state(idict) == DICT_NEW) {
normal_warning("image","don't rely on the image data to be okay");
width(tail_par) = 0;
height(tail_par) = 0;
depth(tail_par) = 0;
} else {
if (alt_rule.wd != null_flag || alt_rule.ht != null_flag || alt_rule.dp != null_flag) {
dim = scale_img(idict, alt_rule, transform);
} else {
dim = scale_img(idict, img_dimen(idict), img_transform(idict));
}
width(tail_par) = dim.wd;
height(tail_par) = dim.ht;
depth(tail_par) = dim.dp;
rule_transform(tail_par) = transform;
rule_index(tail_par) = img_index(idict);
}
}
void mk_unfold::expand_tail(rule& r, unsigned tail_idx, rule_set const& src, rule_set& dst) {
SASSERT(tail_idx <= r.get_uninterpreted_tail_size());
if (tail_idx == r.get_uninterpreted_tail_size()) {
dst.add_rule(&r);
}
else {
func_decl* p = r.get_decl(tail_idx);
rule_vector const& p_rules = src.get_predicate_rules(p);
rule_ref new_rule(rm);
for (unsigned i = 0; i < p_rules.size(); ++i) {
rule const& r2 = *p_rules[i];
if (m_unify.unify_rules(r, tail_idx, r2) &&
m_unify.apply(r, tail_idx, r2, new_rule)) {
expr_ref_vector s1 = m_unify.get_rule_subst(r, true);
expr_ref_vector s2 = m_unify.get_rule_subst(r2, false);
resolve_rule(rm, r, r2, tail_idx, s1, s2, *new_rule.get());
expand_tail(*new_rule.get(), tail_idx+r2.get_uninterpreted_tail_size(), src, dst);
}
}
}
}
static halfword img_to_node(lua_State * L, image * a)
{
image_dict *ad;
halfword n = null;
if (a == NULL) {
luaL_error(L, "img.tonode needs a valid image");
} else {
ad = img_dict(a);
if (a == NULL) {
luaL_error(L, "img.tonode image has no dictionary");
} else if (img_objnum(ad) == 0) {
luaL_error(L, "img.tonode got image without object number");
} else {
n = new_rule(image_rule);
rule_index(n) = img_index(ad);
width(n) = img_width(a);
height(n) = img_height(a);
depth(n) = img_depth(a);
rule_transform(n) = img_transform(a);
}
}
return n;
}
struct ruleset *parse_ruleset_file( FILE *f )
{
struct ruleset *rules = malloc( sizeof(struct ruleset ) );
char buf[512];
rules->rule_count = 0;
yyline = 0;
while( fgets( buf, sizeof(buf), f ) != NULL ) {
yyline++;
if( strncasecmp(buf, "registers", 9) == 0 ) {
parse_registers_block(buf, sizeof(buf), f);
} else if( buf[0] != '\0' && buf[0] != '#' && buf[0] != '\n' ) {
struct rule *rule;
char *p = buf;
rule = new_rule();
if( parse_rule( &p, rule ) != 0 ) {
free( rule );
} else {
rules->rules[rules->rule_count++] = rule;
}
}
}
return rules;
}
/*
* parse one line of the config file
* return the rule according to line
*/
static rule *parse_config_line(char *line, int *err)
{
rule *rule1;
expression *left, *left_exceptions, *right, *right_exceptions;
int i=-1, exit=0, apost=0, colon=-1, eval=0;
static char str1[LINE_LENGTH], str2[LINE_LENGTH+1];
*err = 0;
if (!line) return 0;
rule1 = 0;
left = left_exceptions = right = right_exceptions = 0;
while (!exit) {
i++;
switch(line[i]) {
case '"': apost = !apost;
eval = 1;
break;
case ':': if (!apost) colon = i;
eval = 1;
break;
case '#': if (apost) break;
case '\0':
case '\n':
exit = 1;
break;
case ' ': break;
case '\t': break;
default: eval = 1;
}
}
if (eval) {
if ((0<colon) && (colon+1<i)) {
/* valid line */
/* left expression */
strncpy(str1, line, colon);
str1[colon] = '\0';
if (parse_expression(str1, &left, &left_exceptions)) {
/* error */
LOG(L_ERR, "ERROR parsing line: %s\n", line);
goto error;
}
/* right expression */
strncpy(str2, line+colon+1, i-colon-1);
str2[i-colon-1] = '\0';
if (parse_expression(str2, &right, &right_exceptions)) {
/* error */
LOG(L_ERR, "ERROR parsing line: %s\n", line);
goto error;
}
rule1 = new_rule();
if (!rule1) {
LOG(L_ERR, "ERROR: Can't create new rule\n");
goto error;
}
rule1->left = left;
rule1->left_exceptions = left_exceptions;
rule1->right = right;
rule1->right_exceptions = right_exceptions;
return rule1;
} else {
/* error */
LOG(L_ERR, "ERROR parsing line: %s\n", line);
goto error;
}
}
return 0;
error:
if (left) free_expression(left);
if (left_exceptions) free_expression(left_exceptions);
if (right) free_expression(right);
if (right_exceptions) free_expression(right_exceptions);
*err = 1;
return 0;
}
int
init_acl(const char *path)
{
// initialize ipset
ipset_init_library();
ipset_init(&white_list_ipv4);
ipset_init(&white_list_ipv6);
ipset_init(&black_list_ipv4);
ipset_init(&black_list_ipv6);
ipset_init(&outbound_block_list_ipv4);
ipset_init(&outbound_block_list_ipv6);
cork_dllist_init(&black_list_rules);
cork_dllist_init(&white_list_rules);
cork_dllist_init(&outbound_block_list_rules);
struct ip_set *list_ipv4 = &black_list_ipv4;
struct ip_set *list_ipv6 = &black_list_ipv6;
struct cork_dllist *rules = &black_list_rules;
FILE *f = fopen(path, "r");
if (f == NULL) {
LOGE("Invalid acl path.");
return -1;
}
char buf[257];
while (!feof(f))
if (fgets(buf, 256, f)) {
// Trim the newline
int len = strlen(buf);
if (len > 0 && buf[len - 1] == '\n') {
buf[len - 1] = '\0';
}
char *comment = strchr(buf, '#');
if (comment) {
*comment = '\0';
}
char *line = trimwhitespace(buf);
if (strlen(line) == 0) {
continue;
}
if (strcmp(line, "[outbound_block_list]") == 0) {
list_ipv4 = &outbound_block_list_ipv4;
list_ipv6 = &outbound_block_list_ipv6;
rules = &outbound_block_list_rules;
continue;
} else if (strcmp(line, "[black_list]") == 0
|| strcmp(line, "[bypass_list]") == 0) {
list_ipv4 = &black_list_ipv4;
list_ipv6 = &black_list_ipv6;
rules = &black_list_rules;
continue;
} else if (strcmp(line, "[white_list]") == 0
|| strcmp(line, "[proxy_list]") == 0) {
list_ipv4 = &white_list_ipv4;
list_ipv6 = &white_list_ipv6;
rules = &white_list_rules;
continue;
} else if (strcmp(line, "[reject_all]") == 0
|| strcmp(line, "[bypass_all]") == 0) {
acl_mode = WHITE_LIST;
continue;
} else if (strcmp(line, "[accept_all]") == 0
|| strcmp(line, "[proxy_all]") == 0) {
acl_mode = BLACK_LIST;
continue;
} else if (strcmp(line, "[remote_dns]") == 0) {
continue;
}
char host[257];
int cidr;
parse_addr_cidr(line, host, &cidr);
struct cork_ip addr;
int err = cork_ip_init(&addr, host);
if (!err) {
if (addr.version == 4) {
if (cidr >= 0) {
ipset_ipv4_add_network(list_ipv4, &(addr.ip.v4), cidr);
} else {
ipset_ipv4_add(list_ipv4, &(addr.ip.v4));
}
} else if (addr.version == 6) {
if (cidr >= 0) {
ipset_ipv6_add_network(list_ipv6, &(addr.ip.v6), cidr);
} else {
ipset_ipv6_add(list_ipv6, &(addr.ip.v6));
}
}
} else {
rule_t *rule = new_rule();
accept_rule_arg(rule, line);
init_rule(rule);
add_rule(rules, rule);
}
}
fclose(f);
return 0;
}
bool mk_subsumption_checker::transform_rules(const rule_set & orig, rule_set & tgt) {
bool modified = false;
func_decl_set total_relations_with_included_rules;
rule_subsumption_index subs_index(m_context);
rule_ref_vector orig_rules(m_context.get_rule_manager());
orig_rules.append(orig.get_num_rules(), orig.begin());
rule * * rbegin = orig_rules.c_ptr();
rule * * rend = rbegin + orig_rules.size();
//before traversing we sort rules so that the shortest are in the beginning.
//this will help make subsumption checks more efficient
std::sort(rbegin, rend, rule_size_comparator);
for(rule_set::iterator rit = rbegin; rit!=rend; ++rit) {
rule * r = *rit;
func_decl * head_pred = r->get_decl();
if(m_total_relations.contains(head_pred)) {
if(!orig.is_output_predicate(head_pred) ||
total_relations_with_included_rules.contains(head_pred)) {
//We just skip definitions of total non-output relations as
//we'll eliminate them from the problem.
//We also skip rules of total output relations for which we have
//already output the rule which implies their totality.
modified = true;
continue;
}
rule * defining_rule;
VERIFY(m_total_relation_defining_rules.find(head_pred, defining_rule));
if (defining_rule) {
rule_ref totality_rule(m_context.get_rule_manager());
VERIFY(transform_rule(defining_rule, subs_index, totality_rule));
if(defining_rule!=totality_rule) {
modified = true;
}
tgt.add_rule(totality_rule);
SASSERT(totality_rule->get_decl()==head_pred);
}
else {
modified = true;
}
total_relations_with_included_rules.insert(head_pred);
continue;
}
rule_ref new_rule(m_context.get_rule_manager());
if(!transform_rule(r, subs_index, new_rule)) {
modified = true;
continue;
}
if(m_new_total_relation_discovery_during_transformation && is_total_rule(new_rule)) {
on_discovered_total_relation(head_pred, new_rule.get());
}
if(subs_index.is_subsumed(new_rule)) {
modified = true;
continue;
}
if(new_rule.get()!=r) {
modified = true;
}
tgt.add_rule(new_rule);
subs_index.add(new_rule);
}
tgt.inherit_predicates(orig);
TRACE("dl",
tout << "original set size: "<<orig.get_num_rules()<<"\n"
<< "reduced set size: "<<tgt.get_num_rules()<<"\n"; );
int main(int argc, char *argv[]) {
char *label = NULL;
char *user = NULL;
char *subject = NULL, *object = NULL, *access = NULL;
enum action {
ACT_NONE,
ACT_SET,
ACT_GET,
ACT_FLUSH,
ACT_PRINT,
ACT_RULE,
ACT_USER,
ACT_HELP,
} action = ACT_NONE;
int opt;
getopt_init();
while (-1 != (opt = getopt(argc, argv, "S:GFPR:U:o:a:h"))) {
enum action act = ACT_NONE;
switch(opt) {
case 'S':
act = ACT_SET;
label = optarg;
break;
case 'G':
act = ACT_GET;
break;
case 'F':
act = ACT_FLUSH;
break;
case 'P':
act = ACT_PRINT;
break;
case 'R':
act = ACT_RULE;
subject = optarg;
break;
case 'U':
act = ACT_USER;
user = optarg;
label = argv[optind++];
break;
case 'o':
object = optarg;
break;
case 'a':
access = optarg;
break;
case 'h':
act = ACT_HELP;
break;
default:
printf("Unknown argument -- %c\n", optopt);
return -EINVAL;
}
if (act != ACT_NONE) {
if (action != ACT_NONE) {
printf("Incorrect commmand line, multiplie action specified\n");
return -EINVAL;
}
action = act;
}
}
switch(action) {
case ACT_SET:
return smac_labelset(label);
case ACT_GET:
return print_label(optind < argc ? argv[optind] : NULL);
case ACT_FLUSH:
return smac_flushenv();
case ACT_RULE:
return new_rule(subject, object, access);
case ACT_PRINT:
return print_rules();
case ACT_USER:
return cmd_smac_adm_user_set(user, label);
case ACT_NONE:
default:
break;
}
return 0;
}
