% rule distributor tool

The model tool is represented by the package {\ttfamily it.polito.policyorchestration.impl.\linebreak optimization.distribution} and it allows the framework to distribute one equivalent firewall into many different distributed firewall in a physical and virtual deployment. It distributes the rules only on the nodes where the traffic could flows and it minimizes the number of rules injected using the Performance tool~(\ref{lab:performance_tool}).
Distribution tool produces the output follows the workflow:

\begin{itemize}
	\item 
	reads the rules to be injected;
	\item
	reads the available filtering points where the rules could be injected;
	\item
	for each rule compute all the possible path from each destination to each hosts that could generate packets;
	\item
	for each node on the path set that is a possible candidate to host the rule;
	\item
	create all the equation to be passed to a SAT solver;
	\item
	distribute the rule on each chosen filtering point.
\end{itemize}

\subsection{Tool architecture}

The tool architecture is made up of a class that handles the distribution of the rules. It exploits the features of another class used to represent the deployment architecture through an interface and the performance tool to optimize the distribution.
The main class structure is the following.

\begin{itemize}
	\item 
	\code{RuleDistributorTool}: it is the class that handles the rule distribution, it knows only the set of rules and the set of filtering points associated to each rule.
	The class present the following methods:
	
	\begin{itemize}
		\item
		\code{public RuleDistributorTool(InfrastructureManager tool)}\newline
		it is the constructor that has an InfrastructureManager as parameter, in which there are the rules and all the informations used to optimized the distribution;
		\item
		\code{public void startOptimization()}\newline
		it is the method that gets all the available filtering points, it builds the paths for each rules, it creates the distribution model and than it optimizes that distribution.
		\item
		\code{public void injectRules()}\newline
		it is the method that, for each filtering point available, calls the methods which inject the rules associated into it self;
		\item
		\code{private void findAllTheRulesForEachFilteringPoint()}\newline
		it is a method that for each rule find a path, which means fining all the filtering points, between the receiving point and the transmission point. In other words a rule could be matched by a traffic pattern, this method finds all the destination points for this type of traffic and for each one it finds where the rule must be placed or could be place in a such way that the number of filtering point chosen is the minimum;
		\item
		\code{private void createBooleanVerticalEquationsForTheModel()}\newline
		it is a method that builds a boolean equation for each filtering point. The purpose of this equation is to set a variable $\mathcal{P}$\textit{\textsubscript{n,i}}, which could be \textit{true} or \textit{false}, and it represents if the rule \textit{n} must be injected on the filtering point \textit{i};
		\item
		\code{private void createBooleanHorizontalEquationsForTheModel()}\newline
		it is a method that builds a boolean equation for each rule. The purpose is to impose that if a rule, which as the same action of the default action, could be injected must be injected but at least one time;
		\item
		\code{private void optimizeModel()}\newline
		it is a method that creates a real cost equation by adding all the performance costs of each filtering point. At the end this function minimize the model and the optimization is computed;
		\item
		\code{private void distributeRulesAsModel()}\newline
		it is a method that reads the result of the computation of the optimizer and it sets for each filtering points their rules.
	\end{itemize}
		
	\item
	\code{DeploymentStructure}: it is the interface for the deployment structure that is independent from the environment.
	It has two methods:
	\begin{itemize}
		\item 
		\code{LinkedList<DeploymentNode> getAllFilteringPoints()}\newline
		it returns all the filtering point of the deployment structure
		\item
		\code{public LinkedList<TreeNode> getConditionClausePoints(ConditionClause c)}\newline
		it is a method that is useful to retrieve one or more filtering points and end-points from the tree structure.
	\end{itemize}
	
	\item
	\code{TreeStructure}: it is the class that handles the structure of the deployment and it implements the \code{DeploymentStructure} interface.
	It is in charge of modelling the physical and the virtual nodes and creating a tree where those nodes are placed.
	This class has the following methods:
	
	\begin{itemize}
		\item 
		{\ttfamily public TreeStructure(InfrastructureManager tool, LinkedList<IpSelector>\newline internalSubnetList)}\newline
		it is the constructor of the class, the parameters are the \code{InfrastructureManager tool} used to retrieve the physical and virtual environment and the \code{LinkedList<IpSelector> internalSubnetList} that is a list of all the subnet present inside the deployment. 
		This last parameter is useful to understand if the traffic pattern is from/to external points or internal ones;
		\item
		\code{private void populateTree()}
		it is the method that builds the tree with the\break information of the \code{InfrastructureManager tool};
	\end{itemize}
	
	\item
	\code{DeploymentNode}: it is the interface for the deployment node that is independent from the deployment structure used.
	It has two important methods:
	\begin{itemize}
			\item
		{\ttfamily  LinkedList<String> getORPointPath(ConditionClause arrival,\newline ConditionClause departure, IpSelector subnet)}\newline
		it is the method that finds the minimal set of possible filtering points from the\break end-point \code{arrival} to any \code{departure} points. The last parameter \code{subnet} identifies the entity that owns the rule for which the method tries to find a path for the corresponding traffic pattern.
		This method is based on ten models represented in Appendix~\ref{cap:pathModels} that the single node could be, it chooses what kind of model it is;
		\item
		{\ttfamily public LinkedList<String> getANDPointsPath(ConditionClause arrival,\newline ConditionClause departure, IpSelector subnet)}\newline
		it is the method that finds the minimal set of necessary filtering points from the\break end-point \code{arrival} to any \code{departure} points. The last parameter \code{subnet} identifies the entity that own the rule for which the method tries to find a path for the corresponding traffic pattern. This method is based on ten models represented in Appendix~\ref{cap:pathModels} that the single node could be, it chooses what kind of model it is;
	\end{itemize}
	
	\item
	\code{TreeNode}: it is the class that represents a single node inside the tree structure and implements the \code{DeploymentNode} interface. All the TreeNode that are internal nodes are filtering points, on the contrary the leaf nodes are the services with an IPaddress and a Port associated.
	The class has the following instance variables:
	
	\begin{itemize}
		\item
		\code{private String label}\newline
		it identifies the node;
		\item 
		\code{private TreeNode parent}\newline
		it is the variable pointer to the parent node, this is always not \code{null} except for the root element;
		\item
		\code{private List<TreeNode> children}\newline
		it is a list of the pointers to all the children of the current node, this list is always \code{notEmpty} except for the leaf elements;
		\item
		\code{private FilteringPoint filteringPoint}\newline
		it is the pointer to the physical or virtual filtering point of the \code{InfrastructureManager};
		\item
		\code{private LinkedList<ConditionClause> childConditionClauseList}\newline
		it is a list of all the end-points under this node, which means thay are all the end-points that are reachable from this node passing through its children;
		\item
		\code{private LinkedList<ConditionClause> fatherConditionClauseList}\newline
		it is the list of all the end-points above this node, which means all the end-points that are reachable from this node passing thought its parent.		
	\end{itemize}
	 
	\begin{itemize}
		\item 
		{\ttfamily public TreeNode(FilteringPoint filteringPoint, boolean isGateway,\newline ConditionClause externalConditionCaluse)}\newline
		it is the first constructor of the class, \code{filteringPoint} is the element of the\break deployment, \code{isGateway} identify if this node reaches directly the exterior of the\break infrastructure and \code{externalConditionCaluse} represents all the destination that are\break external to the deployment;
		\item
		{\ttfamily public TreeNode(String label, boolean isService, boolean isRoot,\newline ConditionClause externalConditionCaluse)}\newline
		it is the second constructor of the class, it is useful because both root element and leaf elements are not related to any \code{filteringPoint} or could not be gateway;
		\item
		\code{public void addChildConditionClause(ConditionClause c)}\newline
		\code{public void addChildConditionClauseList(LinkedList<ConditionClause> cl)}\newline
		\code{public LinkedList<ConditionClause> getChildConditionClauseList()}\newline
		\code{private boolean hasChildrenConditionClause(ConditionClause c)}\newline
		they are methods that manage the instance variable \code{childConditionClauseList};
		\item
		\code{public void addFatherConditionClauseList(LinkedList<ConditionClause> cl)}\newline
		\code{public LinkedList<ConditionClause> getFatherConditionClauseList()}\newline
		\code{private boolean hasFatherConditionClause(ConditionClause c)}\newline
		they are methods that manage the instance variable \code{fatherConditionClauseList};
	\end{itemize}
\end{itemize}
\pagebreak

\subsection{Modify the tool}

It is possible to change the model tree of the deployment with other model, as chain or graph. Currently it supports only the tree model because it is the mostly used physical and logical topology that avoids possible loops, besides that the work related to this thesis is based on an OpenStack deployment.
To change the model representation must add a new class that substitutes the \code{TreeStructure class} and implements the \code{deploymentStructure} interface. Then a new class is needed to substitute the \code{TreeNode class} that implements the \code{deploymentNode} interface. All the interface's methods must be implemented following the previous definition.











