Пример 1. реализации шлюза Cisco на BeanShell c управлением ssh

Материал из BiTel WiKi

(Различия между версиями)
Перейти к: навигация, поиск
(Новая: <source lang="java"> import java.util.*; import java.util.regex.*; import bitel.billing.common.module.ipn.*; import bitel.billing.server.ipn.bean.*; import bitel.billing.server.util.*; i...)
(обновил скрипт)
Строка 1: Строка 1:
 +
Подключение абонентов по схеме "vlan-на-клиента", при этом используется оборудование D-Link - на уровне доступа свитчи
 +
DES-1228G, в ядре - DGS-3610-26G.
 +
Это шлюз уровня доступа
 +
 +
Команды шлюза
 +
 +
<source lang="bash">
 +
[DEFAULT]
 +
 +
[REMOVE]
 +
no vlan {VID}
 +
[/REMOVE]
 +
 +
[OPEN]
 +
 +
vlan {VID}
 +
exit
 +
vlan 100
 +
subvlan {VID}
 +
exit
 +
vlan {VID}
 +
subvlan-address-range {addr1} {addr2}
 +
exit
 +
 +
ip access-list extended 101
 +
<LOOP>
 +
no deny ip host {A} any
 +
no deny ip any host {A}
 +
</LOOP>
 +
exit
 +
[/OPEN]
 +
 +
[CLOSE]
 +
interface gigabitethernet 0/22
 +
no ip access-group 101 in
 +
exit
 +
ip access-list extended 101
 +
no permit ip any any
 +
<LOOP>
 +
deny ip host {A} any
 +
deny ip any host {A}
 +
</LOOP>
 +
permit ip any any
 +
exit
 +
interface gigabitethernet 0/22
 +
ip access-group 101 in
 +
exit
 +
[/CLOSE]
 +
[/DEFAULT]
 +
 +
</source>
 +
 +
скрпит шлюза
<source lang="java">
<source lang="java">
-
import java.util.*;
+
import java.io.IOException;
-
import java.util.regex.*;
+
import java.util.ArrayList;
-
import bitel.billing.common.module.ipn.*;
+
import java.util.HashMap;
-
import bitel.billing.server.ipn.bean.*;
+
import java.util.List;
-
import bitel.billing.server.util.*;
+
import java.util.Map;
-
import bitel.billing.server.util.ssh.*;
+
-
import bitel.billing.common.*;
+
-
import java.util.regex.Pattern;
+
import java.util.regex.Matcher;
import java.util.regex.Matcher;
 +
import java.util.regex.Pattern;
 +
import java.util.StringTokenizer;
   
   
 +
import bitel.billing.common.module.ipn.IPNContractStatus;
 +
import bitel.billing.server.ipn.GateWorker;
 +
import bitel.billing.server.ipn.UserStatus;
 +
import bitel.billing.server.ipn.bean.*;
 +
import bitel.billing.server.util.DefaultServerSetup;
 +
import bitel.billing.server.util.Utils;
 +
import bitel.billing.server.util.telnet.OperationTimedoutException;
 +
import bitel.billing.server.util.telnet.TelnetSession;
 +
import ru.bitel.bgbilling.common.DefaultSetup;
 +
import bitel.billing.common.IPUtils;
 +
import bitel.billing.server.util.Utils;
 +
import bitel.billing.server.util.telnet.OperationTimedoutException;
 +
import bitel.billing.server.util.telnet.TelnetSession;
 +
import ru.bitel.bgbilling.modules.ipn.common.bean.*;
 +
import bitel.billing.server.util.telnet.ansi.TelnetAnsiSession;
   
   
 +
//includeBGBS( "bgbs://ru.bitel.bgbilling.kernel.script.common.bean.ScriptLibrary/manad" );
   
   
protected void doSync()
protected void doSync()
{
{
-
host = gate.getHost();
+
log.info( "start of cisco........................................................");
-
port = gate.getPort();
+
-
gid = gate.getId();
+
host = gate.getHost();
 +
port = gate.getPort();
   
   
-
gateSetup = new DefaultServerSetup( gate.getConfig(), "\r\n" );       
 
-
   
 
-
login = gateSetup.getStringValue( "login");
 
-
pswd = gate.getKeyword();
 
-
 
-
acl = gateSetup.getStringValue( "acl_name");
 
-
result = new StringBuffer();
 
-
 
 
-
 
 
-
if( log.isDebugEnabled() )
 
-
{
 
-
log.debug( gate.getId() + " gate: " + host + ":" + port  + " login: " + login + " pswd: " +      pswd );
 
-
}
 
   
   
-
   
+
DefaultServerSetup gateSetup = new DefaultServerSetup( gate.getConfig(), "\r\n" );       
   
   
-
    session = null;
+
pswd = gate.getKeyword();
 +
login = gateSetup.getStringValue( "login");
 +
      timeout = gateSetup.getIntValue( "timeout", 0 );
   
   
-
    try
+
result = new StringBuffer();
-
    {
+
 
-
session = new SSHSession( host, port, login, pswd );
+
-
session.connect();
+
   
   
-
result.append(session.command( "terminal length 0" ) );
+
if( log.isDebugEnabled() )
-
+
{
 +
    log.debug( gate.getId() + " gate: " + host + ":" + port  + " login: " + login + " passwd: " + pswd );
 +
}
   
   
-
result = new StringBuffer();
 
-
result.append( session.command( "configure terminal" ) );
 
-
result.append( session.command( "ip access-list standard " + acl ) );
 
   
   
-
buffer = getBuffer( session, result, acl );
+
log.debug("before connect");
-
doCommands( session, result, buffer );  
+
session = new TelnetAnsiSession( host, port);
 +
      session.setTimeout( timeout );
 +
session.setLoginPromptSequence( ":" );
 +
result.append( session.connect() );
 +
log.debug("after connect");
 +
 +
result.append( session.doCommand( login ) );
 +
log.debug("after login");
 +
session.setLoginPromptSequence( "#" );
 +
result.append( session.doCommand( pswd ) );
 +
log.debug("after pswd");
 +
 +
result.append( session.doCommand( "terminal length 0" ) );
 +
result.append( session.doCommand( "terminal width 0" ) );
-
      result.append( session.command( "end" ) ); 
+
log.debug("after terminal");
-
      result.append( session.command( "exit", false ) );
+
 +
result.append( session.doCommand( "configure terminal" ) );
   
   
-
      if (log.isDebugEnabled())
+
log.debug( "execute commands" );
-
      {
+
doCommands( session, result, gateSetup );
-
        log.debug( "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" );
+
-
        log.debug( result.toString() );
+
-
        log.debug( "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" );
+
-
      }
+
   
   
-
        // пауза пока считает команду exit
+
result.append( session.doCommand( "exit" ) );
-
        Thread.sleep( 100 );
+
result.append( session.doCommand( "write memory" ) );
-
    }
+
session.doCommandAsync( "exit" );
-
    catch ( Exception e )
+
 
-
    {
+
-
    throw new RuntimeException ( e );
+
log.info("!!!!!!!!!!!start of log!!!!!!!!!!!!!!!!!!!!!");
-
    }
+
log.info( result );
-
    finally
+
log.info("!!!!!!!!!!!!!!! end of log !!!!!!!!!!!!!!!!!");
-
    {
+
-
        if( session != null )
+
log.debug( "ok" );
-
        {
+
-
            session.disconnect();
+
-
        }
+
log.info( "end of cisco........................................................");
-
    }
+
}
}
   
   
-
void doCommands( session, result, buffer )
+
protected void add()
-
{  
+
{
-
for( status : statusList )
+
-
{
+
}
-
log.info( "status.status=" + status.status );
+
-
isPermitted = isUserPermited ( status, buffer);
+
-
+
private void doCommands( session, result, gateSetup) throws IOException, OperationTimedoutException
 +
{
 +
acl = gateSetup.getStringValue( "acl");
-
//  если правило есть, а юзер заблокирован - удаляем правило
+
vlanResult = getVlanResult( session );
-
+
    log.info( "!!!!!!!!!!!!!!!!!!!!!!!!!!vlanResult!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" );
-
if ( isPermitted && status.status > 0 )
+
log.info( vlanResult );
-
{
+
log.info( "!!!!!!!!!!!!!!!!!!!!!!!!!!vlanResult!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" );
-
rules = getCloseRules( status );
+
 
-
}
+
aclResult = getAclResult( session, acl );
-
else if ( !isPermitted && status.status == 0 )
+
 
-
// правила нет, а юзер открыт - добавляем правило
+
log.info( "!!!!!!!!!!!!!!!!!!!!!!!!!!aclResult!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" );
-
{
+
log.info( aclResult );
-
rules = getOpenRules( status );
+
log.info( "!!!!!!!!!!!!!!!!!!!!!!!!!! end aclResult!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" );
 +
 +
for( UserStatus status : statusList )
 +
{
 +
VlanManager manager = new VlanManager(status.mid, con);
 +
gateId  = gate.getId();
 +
//log.info("gateId=" + gateId);
 +
vid = manager.getVlan( gateId, status.contractId );
 +
//log.info("vid=" + vid);
 +
log.debug( "status=" + status.status);
 +
 +
 
 +
String addr1 = null;
 +
String addr2 = null;
 +
 +
  date = new GregorianCalendar();
 +
 
 +
AddressRangeManager man = new AddressRangeManager( con, mid );
 +
  addressList = man.getContractAddressRange( status.contractId , date, -1 );
 +
  if ( addressList.size() > 0 )
 +
  {
 +
        AddressRange range =  addressList.get(0);
 +
addr1 = IPUtils.convertIpToString( range.getAddr1() );
 +
addr2 = IPUtils.convertIpToString( range.getAddr2() );
}
}
else
else
{
{
 +
log.info( "empty adress on cid = " + status.contractId );
continue;
continue;
-
}           
 
-
for ( rule : rules )
 
-
{
 
-
result.append(  session.command( rule ) );
 
}
}
-
}
 
-
}
 
-
 
 
-
private List getOpenRules( status )
 
-
{
 
   
   
-
log.info( "getting open rules" );
+
rules = null;
-
return getRules( status, "\\[OPEN\\]((.|\n)*)\\[/OPEN\\]" );
+
if (status.status == IPNContractStatus.STATUS_OPEN && (!vlanExists(vid, vlanResult) ||  isUserDenied( addr1, addr2, aclResult) ) )
 +
{
 +
rules = getOpenRules( status, vid, gateSetup, addr1, addr2, acl );  
 +
}
 +
else if (status.status == IPNContractStatus.STATUS_REMOVED && ( vlanExists(vid, vlanResult) || isUserDenied( addr1, addr2,aclResult)  ) )
 +
{
 +
rules = getRemoveRules( status, vid, gateSetup, addr1, addr2, acl );
 +
}
 +
//if closed and etc
 +
else if ( status.status != IPNContractStatus.STATUS_OPEN && status.status != IPNContractStatus.STATUS_REMOVED &&  !isUserDenied( addr1, addr2, aclResult) )
 +
{
 +
rules = getCloseRules( status, vid, gateSetup, addr1, addr2, acl );
 +
}
 +
 +
if (vid > 0 && rules != null )
 +
{
 +
for ( String rule : rules )
 +
{
 +
//log.debug  ("command=" + rule );
 +
result.append(  session.doCommand( rule ) );
 +
}
 +
}
 +
 +
}
 +
}
}
   
   
-
private List  getCloseRules( status )
+
getOpenRules( status, vid, gateSetup, addr1, addr2, acl )
{
{
-
log.info( "getting close rules" );
+
  log.debug( "geting open rules...");  
-
return getRules( status, "\\[CLOSE\\]((.|\n)*)\\[/CLOSE\\]");
+
return getRules( status, "\\[OPEN\\](.*)\\[/OPEN\\]", vid, gateSetup, addr1, addr2, acl );
}
}
   
   
 +
getCloseRules( status, vid, gateSetup, addr1, addr2, acl )
 +
{
 +
  log.debug( "geting close rules..."); 
 +
return getRules( status, "\\[CLOSE\\](.*)\\[/CLOSE\\]", vid, gateSetup, addr1, addr2, acl );
 +
}
   
   
 +
getRemoveRules( UserStatus status, vid, gateSetup, addr1, addr2, acl )
 +
{   
 +
  log.debug( "geting remove rules..."); 
 +
return getRules( status, "\\[REMOVE\\](.*)\\[/REMOVE\\]", vid, gateSetup, addr1, addr2, acl );
 +
}
   
   
-
+
getRules( status, template, vid, gateSetup, addr1, addr2, acl )
-
private List  getRules( status, String template )
+
{
{
// пользовательское правило, без типа - то все оставляем как есть
// пользовательское правило, без типа - то все оставляем как есть
-
rule = status.rule.getRuleText();
+
CiscoRule  ciscoRule = new CiscoRule ( status.rule.getRuleText() );
-
+
rule = ciscoRule.getAddresses();
 +
 
 +
//log.info("rule=" + rule);
   
   
//типизированное правило
//типизированное правило
Строка 135: Строка 251:
   
   
{
{
-
ruleText = ManadUtils.getRule( status.gateType, status.ruleType );
+
    rule = generateRule( rule, status.gateType, status.ruleType, vid, status.contractId, gateSetup, addr1, addr2, acl );
-
Map replacements = new HashMap ();
+
}
-
rule = ManadUtils.generateRule( ruleText, status.rule.getRuleText(), replacements, status.ruleType );
+
   
-
}
+
//log.info("rule=" + rule);
 +
 +
   
   
-
Pattern pattern = Pattern.compile( template );
+
pattern = Pattern.compile( template, Pattern.DOTALL );
-
Matcher m = pattern.matcher( rule );
+
m = pattern.matcher( rule );
if (m.find())
if (m.find())
{
{
-
rule = m.group( 1 );
+
    rule = m.group( 1 );
}
}
-
 
-
log.info("rule=" + rule);
 
   
   
rule.replaceAll( "\r", "" );
rule.replaceAll( "\r", "" );
 +
 +
parts  = rule.split( "\n" );
parts  = rule.split( "\n" );
   
   
result = new ArrayList();
result = new ArrayList();
-
for ( part : parts )
+
for ( String part : parts )
{
{
if ( !Utils.isEmptyString( part ))
if ( !Utils.isEmptyString( part ))
Строка 160: Строка 278:
}
}
}
}
-
 
   
   
return result;
return result;
 +
}
 +
 +
generateRule( addresses, gateType, ruleType, int vid, int cid, gateSetup, addr1, addr2, acl )
 +
{
 +
supervlan = gateSetup.getIntValue( "supervlan", 0 );
 +
 +
Map replacements = new HashMap();
 +
 +
        if ( addr1 != null && addr2 != null )
 +
{
 +
replacements.put( "\\{addr1\\}", addr1 );
 +
replacements.put( "\\{addr2\\}", addr2 );
 +
replacements.put( "\\{SUPERVLAN\\}", String.valueOf( supervlan) );
 +
replacements.put( "\\{ACL\\}", acl );
 +
}
 +
 +
    ruleText = ManadUtils.getRule( gateType, ruleType );
 +
    if ( vid > 0)
 +
    {
 +
        replacements.put( "\\{VID\\}", String.valueOf( vid ) );
 +
    }
 +
    return ManadUtils.generateRule( ruleText, addresses, replacements, ruleType );
}
}
-
private getBuffer( session, result, acl )
+
private isUserDenied ( addr1, addr2, buffer)
{
{
-
buffer = session.command( "do sh ip access-list " + acl );  
+
//эскейпируем точки в адресе
-
result.append( buffer );
+
String address1 = addr1.replace( ".", "\\." );
-
return buffer;
+
String address2 = addr2.replace( ".", "\\." );
 +
 
 +
return isUserDeniedForAddress( address1, buffer ) &&  isUserDeniedForAddress( address2, buffer );
}
}
-
private isUserPermited ( status, buffer)
+
private isUserDeniedForAddress ( address, buffer)
{
{
-
addreses = status.rule.getRuleText().split( "\\s*,\\s*" );
+
//эскейпируем точки в адресе
-
//
+
//String address = addr1.replace( ".", "\\." );
-
for ( i = 0; i < addreses.length; i++)
+
//log.debug( "aaddr1=" + address );
-
{
+
String template = ".*deny ip host\\s+" + address + "\\s+any.*$";
-
address = IPUtils.convertLongIpToString( Utils.parseLongString( addreses[i], 0 ) );
+
//log.debug( "template=" + template );
-
log.info( "ip=" + address);
+
Pattern pattern = Pattern.compile( template, Pattern.DOTALL );
 +
Matcher m = pattern.matcher( buffer );
 +
boolean found = m.find();
 +
if ( found )
 +
{
 +
log.debug( "user2 denied" );
 +
return true;
 +
}
-
address = address.replace( ".", "\\." );
+
 +
 +
pattern = Pattern.compile( ".*deny ip any host\\s" + address + "\\s.*$", Pattern.DOTALL );
 +
m = pattern.matcher( buffer );
 +
found = m.find();
 +
log.debug( found ? "user denied" :"user not denied" );
 +
 +
 +
return found;
-
Pattern pattern = Pattern.compile( ".*permit\\s" + address + "(\\s.*)?$", Pattern.DOTALL );
 
-
        Matcher m = pattern.matcher( buffer );
 
-
//если хотя бы один адрес отстуствует, то считаем что клиент закрыт       
 
-
if ( !m.find() )
 
-
{
 
-
log.info( "is not permitted" );
 
-
return false;
 
-
}
 
-
 
-
}
 
-
log.info( "is permitted" );
 
-
return true;
 
}
}
 +
 +
 +
private vlanExists ( vlan, buffer)
 +
{
 +
Pattern pattern = Pattern.compile( ".*" + vlan + "\\s+ON\\s+.*", Pattern.DOTALL );
 +
Matcher m = pattern.matcher( buffer );
 +
found = m.find();
 +
log.debug( found ? "vlan found" : "vlan not found" );
 +
 +
 +
return found;
 +
}
 +
 +
private getVlanResult( session )
 +
{
 +
return session.doCommand( "show supervlan");
 +
}
 +
 +
private getAclResult( session, acl )
 +
{
 +
return session.doCommand( "show access-lists " + acl );
 +
}
 +
</source>
</source>

Версия 05:54, 16 апреля 2010

Подключение абонентов по схеме "vlan-на-клиента", при этом используется оборудование D-Link - на уровне доступа свитчи DES-1228G, в ядре - DGS-3610-26G. Это шлюз уровня доступа

Команды шлюза 

[DEFAULT]
 
[REMOVE]
no vlan {VID}
[/REMOVE]
 
[OPEN]
 
vlan {VID}
exit
vlan 100
subvlan {VID}
exit
vlan {VID}
subvlan-address-range {addr1} {addr2}
exit
 
ip access-list extended 101
<LOOP>
no deny ip host {A} any
no deny ip any host {A}
</LOOP>
exit
[/OPEN]
 
[CLOSE]
interface gigabitethernet 0/22
no ip access-group 101 in
exit
ip access-list extended 101
no permit ip any any
<LOOP>
deny ip host {A} any
deny ip any host {A}
</LOOP>
permit ip any any
exit
interface gigabitethernet 0/22
ip access-group 101 in
exit
[/CLOSE]
[/DEFAULT]

скрпит шлюза 

import java.io.IOException;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.util.StringTokenizer;
 
import bitel.billing.common.module.ipn.IPNContractStatus;
import bitel.billing.server.ipn.GateWorker;
import bitel.billing.server.ipn.UserStatus;
import bitel.billing.server.ipn.bean.*;
import bitel.billing.server.util.DefaultServerSetup;
import bitel.billing.server.util.Utils;
import bitel.billing.server.util.telnet.OperationTimedoutException;
import bitel.billing.server.util.telnet.TelnetSession;
import ru.bitel.bgbilling.common.DefaultSetup;
import bitel.billing.common.IPUtils;
import bitel.billing.server.util.Utils;
import bitel.billing.server.util.telnet.OperationTimedoutException;
import bitel.billing.server.util.telnet.TelnetSession;
import ru.bitel.bgbilling.modules.ipn.common.bean.*;
import bitel.billing.server.util.telnet.ansi.TelnetAnsiSession;
 
//includeBGBS( "bgbs://ru.bitel.bgbilling.kernel.script.common.bean.ScriptLibrary/manad" ); 
 
protected void doSync()
{
		log.info( "start of cisco........................................................");
 
		host = gate.getHost();
		port = gate.getPort();
 
 
		DefaultServerSetup gateSetup = new DefaultServerSetup( gate.getConfig(), "\r\n" );        
 
		pswd = gate.getKeyword();		
		login = gateSetup.getStringValue( "login");
       timeout = gateSetup.getIntValue( "timeout", 0 );		
 
		result = new StringBuffer();
 
 
		if( log.isDebugEnabled() )
		{
		    log.debug( gate.getId() + " gate: " + host + ":" + port  + " login: " + login + " passwd: " + 		 pswd );
		}
 
 
 		log.debug("before connect");
		session = new TelnetAnsiSession( host, port);
       session.setTimeout( timeout );
		session.setLoginPromptSequence( ":" );						
		result.append( session.connect() );
		log.debug("after connect");
 
		result.append( session.doCommand( login ) );
		log.debug("after login");
		session.setLoginPromptSequence( "#" );
		result.append( session.doCommand( pswd ) );
		log.debug("after pswd");
 
		result.append( session.doCommand( "terminal length 0" ) );
		result.append( session.doCommand( "terminal width 0" ) );
 
		log.debug("after terminal");
 
		result.append( session.doCommand( "configure terminal" ) );
 
		log.debug( "execute commands" );
		doCommands( session, result, gateSetup );
 
		result.append( session.doCommand( "exit" ) );
		result.append( session.doCommand( "write memory" ) );
		session.doCommandAsync( "exit" );
 
 
		log.info("!!!!!!!!!!!start of log!!!!!!!!!!!!!!!!!!!!!");
		log.info( result );
		log.info("!!!!!!!!!!!!!!! end of log !!!!!!!!!!!!!!!!!");		
 
		log.debug( "ok" );
 
 
	log.info( "end of cisco........................................................");
 
}
 
protected void add()
{
 
}
 
 
private void doCommands( session, result, gateSetup) throws IOException, OperationTimedoutException
{		
	acl = gateSetup.getStringValue( "acl");
 
	vlanResult = getVlanResult( session );	
    log.info( "!!!!!!!!!!!!!!!!!!!!!!!!!!vlanResult!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" );	
	log.info( vlanResult );	
	log.info( "!!!!!!!!!!!!!!!!!!!!!!!!!!vlanResult!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" );	
 
	aclResult = getAclResult( session, acl );
 
	log.info( "!!!!!!!!!!!!!!!!!!!!!!!!!!aclResult!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" );	
	log.info( aclResult );	
	log.info( "!!!!!!!!!!!!!!!!!!!!!!!!!! end aclResult!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" );	
 
	for( UserStatus status : statusList )
	{
		VlanManager manager = new VlanManager(status.mid, con); 
		gateId  = gate.getId();
		//log.info("gateId=" + gateId);
		vid = manager.getVlan( gateId, status.contractId );
		//log.info("vid=" + vid);	
		log.debug( "status=" + status.status);	
 
 
		String addr1 = null;
		String addr2 = null;
 
   		date = new GregorianCalendar();
 
		AddressRangeManager man = new AddressRangeManager( con, mid );
   		addressList = man.getContractAddressRange( status.contractId , date, -1 );
   		if ( addressList.size() > 0 )
   		{
        	AddressRange range =  addressList.get(0);
			addr1 = IPUtils.convertIpToString( range.getAddr1() );
			addr2 = IPUtils.convertIpToString( range.getAddr2() );	
		}
		else
		{
			log.info( "empty adress on cid = " + status.contractId );
			continue;
		}
 
 
		rules = null;
		if (status.status == IPNContractStatus.STATUS_OPEN && (!vlanExists(vid, vlanResult) ||  isUserDenied( addr1, addr2, aclResult) ) )
		{ 
			rules = getOpenRules( status, vid, gateSetup, addr1, addr2, acl ); 
		} 			
		else if (status.status == IPNContractStatus.STATUS_REMOVED && ( vlanExists(vid, vlanResult) || isUserDenied( addr1, addr2,aclResult)  ) )
		{
			rules = getRemoveRules( status, vid, gateSetup, addr1, addr2, acl );	
		}
		//if closed and etc 
		else if ( status.status != IPNContractStatus.STATUS_OPEN && status.status != IPNContractStatus.STATUS_REMOVED &&  !isUserDenied( addr1, addr2, aclResult) )
		{
			rules = getCloseRules( status, vid, gateSetup, addr1, addr2, acl );
		}
 
		if (vid > 0 && rules != null )
		{
			for ( String rule : rules )
			{					
				//log.debug  ("command=" + rule );
				result.append(  session.doCommand( rule ) );				
			}
		}
 
	}		
 
}
 
getOpenRules( status, vid, gateSetup, addr1, addr2, acl )
{
   log.debug( "geting open rules..."); 
	return getRules( status, "\\[OPEN\\](.*)\\[/OPEN\\]", vid, gateSetup, addr1, addr2, acl );
}
 
getCloseRules( status, vid, gateSetup, addr1, addr2, acl )
{
   log.debug( "geting close rules...");  
	return getRules( status, "\\[CLOSE\\](.*)\\[/CLOSE\\]", vid, gateSetup, addr1, addr2, acl );
}
 
getRemoveRules( UserStatus status, vid, gateSetup, addr1, addr2, acl )
{    
   log.debug( "geting remove rules...");  
	return getRules( status, "\\[REMOVE\\](.*)\\[/REMOVE\\]", vid, gateSetup, addr1, addr2, acl );
}
 
getRules(  status, template, vid, gateSetup, addr1, addr2, acl )
{
	// пользовательское правило, без типа - то все оставляем как есть
	CiscoRule  ciscoRule = new CiscoRule ( status.rule.getRuleText() );
	rule = ciscoRule.getAddresses();
 
	//log.info("rule=" + rule);
 
	//типизированное правило
	if( status.ruleType != null )
 
	{	
	    rule = generateRule( rule, status.gateType, status.ruleType, vid, status.contractId, gateSetup, addr1, addr2, acl );
	}
 
	//log.info("rule=" + rule);
 
 
 
	pattern = Pattern.compile( template, Pattern.DOTALL );
	m = pattern.matcher( rule );
	if (m.find())
	{
	    rule = m.group( 1 );
	}		
 
	rule.replaceAll( "\r", "" );
 
 
	parts  = rule.split( "\n" );
 
	result = new ArrayList();
	for ( String part : parts )
	{
		if ( !Utils.isEmptyString( part ))
		{
			result.add( part );
		}
	}
 
	return result;
}		
 
generateRule( addresses, gateType, ruleType, int vid, int cid, gateSetup, addr1, addr2, acl )
{		
 		 supervlan = gateSetup.getIntValue( "supervlan", 0 );
 
		 Map replacements = new HashMap();
 
        if ( addr1 != null && addr2 != null )
		 {
			replacements.put( "\\{addr1\\}", addr1 );
			replacements.put( "\\{addr2\\}", addr2 );
			replacements.put( "\\{SUPERVLAN\\}", String.valueOf( supervlan) );
			replacements.put( "\\{ACL\\}", acl );
		 }
 
    ruleText = ManadUtils.getRule( gateType, ruleType );
    if ( vid > 0)
    {
        replacements.put( "\\{VID\\}", String.valueOf( vid ) );
    }
    return ManadUtils.generateRule( ruleText, addresses, replacements, ruleType );		
}
 
private isUserDenied ( addr1, addr2, buffer)
{
	//эскейпируем точки в адресе
	String address1 = addr1.replace( ".", "\\." );
	String address2 = addr2.replace( ".", "\\." );
 
	return isUserDeniedForAddress( address1, buffer ) &&  isUserDeniedForAddress( address2, buffer );
}
 
private isUserDeniedForAddress ( address, buffer)
{
	//эскейпируем точки в адресе
	//String address = addr1.replace( ".", "\\." );
	//log.debug( "aaddr1=" + address );
	String template = ".*deny ip host\\s+" + address + "\\s+any.*$";
	//log.debug( "template=" + template );
	Pattern pattern = Pattern.compile( template, Pattern.DOTALL );
	Matcher m = pattern.matcher( buffer );
	boolean found = m.find();
	if ( found ) 
	{
		log.debug( "user2 denied" );
		return true;
	}
 
 
 
	pattern = Pattern.compile( ".*deny ip any host\\s" + address + "\\s.*$", Pattern.DOTALL );
	m = pattern.matcher( buffer );
	found = m.find();
	log.debug( found ? "user denied" :"user not denied" );	
 
 
	return found;
 
}
 
 
private vlanExists ( vlan, buffer)
{
	Pattern pattern = Pattern.compile( ".*" + vlan + "\\s+ON\\s+.*", Pattern.DOTALL );
	Matcher m = pattern.matcher( buffer );
	found = m.find();
	log.debug( found ? "vlan found" : "vlan not found" );
 
 
	return found;
}
 
private getVlanResult( session )
{
	return session.doCommand( "show supervlan"); 
}
 
private getAclResult( session, acl )
{
	return session.doCommand( "show access-lists " + acl ); 
}
Источник — «http://wiki.bitel.ru/index.php/%D0%9F%D1%80%D0%B8%D0%BC%D0%B5%D1%80_1._%D1%80%D0%B5%D0%B0%D0%BB%D0%B8%D0%B7%D0%B0%D1%86%D0%B8%D0%B8_%D1%88%D0%BB%D1%8E%D0%B7%D0%B0_Cisco_%D0%BD%D0%B0_BeanShell_c_%D1%83%D0%BF%D1%80%D0%B0%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%D0%BC_ssh»
Личные инструменты