????
Your IP : 18.190.219.46
3
@)�fϢ � @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z m
Z
ddlm Z m Z m
Z
ddlmZmZmZ dd lmZmZmZmZmZmZ dd
lmZ dd lm Z dd lm Z dd
l m Z dd� Z dd� Z!dd� Z"dd� Z#dd� Z$G dd � d e�Z%G dd� de�Z&d d d�Z'd d d�Z(dS ) �Policy�
policy_reader�
policy_writer� N)�config)�checkIP�checkIP6)�uniqify�max_policy_name_len�portStr)�DEFAULT_POLICY_TARGET�POLICY_TARGETS�DEFAULT_POLICY_PRIORITY)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator�
check_port� check_tcpudp�check_protocol)�rich)�log)�errors)�
FirewallErrorc C s� |dkr �n�|dkr�n�|dkr�| j r`| j jrJtjdt| j �� d| _dS tj|d �| j _dS |d | jj kr�| jj j
|d � ntjd|d � �n|dk�rN| j r�| j jr�tjdt| j �� d| _dS tj |d |d �| j _dS t |d � t
|d � t|d d
�|d f}|| jjk�r4| jjj
|� ntjd |d |d � �nN|d k�r�| j �r�| j j�r�tjdt| j �� d| _dS tj|d �| j _nBt|d � |d | jjk�r�| jjj
|d � ntjd
|d � �n�|dk�rh| j �r.| j j�rtjdt| j �� d| _dS tj|d �| j _dS |d | jjk�rT| jjj
|d � ntjd|d � �n4|dk�r�| j �r�| j j�r�tjdt| j �� d| _dS tj|d �| j _dS tjd|d � �n�|dk�r2| j �r| j j�rtjdt| j �� d| _dS tj� | j _n | jj�r&tjd� nd| j_�nj|dk�r�d}d|k�rR|d }d}d|k�rh|d }| j �r�| j j�r�tjdt| j �� d| _dS tj|d |d ||�| j _dS t |d � t
|d � |�r�t |� |�r
t|� �r
t|� �r
tt j d| ��t|d d
�|d t|d
�t|�f}|| jj k�rL| jj j
|� n6tjd|d |d |�rld| nd|�r|d| nd� �n|d k�r@| j �r�| j j�r�tjdt| j �� d| _dS tj |d |d �| j _dS t |d � t
|d � t|d d
�|d f}|| jj k�r&| jj j
|� ntjd |d |d � �n\|d k�r�| j �sftjd � d| _dS | j j!�r�tjd t| j �� dS d!}d }d"|k�r�|d" }d }d#|k�r�|d# }d$|k�r�|d$ j"� dLk�r�d}tj#|||�| j _!�n�|dMk�r�| j �stjd+� d| _dS | j j$�r0tjd,� d| _dS |d'k�rHtj%� | j _$nh|d(k�rxd } d-|k�rh|d- } tj&| �| j _$n8|d)k�r�tj'� | j _$n |d*k�r�|d. }
tj(|
�| j _$| j j$| _)�n�|d/k�r^| j �s�tjd0� dS | j j�r�tjd1� dS d } d2|k�r*|d2 } | dNk�r*tjd;� d| _dS d<|k�r<|d< nd } tj*| | �| j _| j j| _)�n>|d=k�r�| j �s~tjd>� dS | j j+�r�tjd?t| j �� d| _dS tj,� | j _+| j j+| _)n�|d@k�r,d }
dA}dB|k�r|dB }
|
dOk�rtjdE|dB � d| _dS dF|k�rt-|dF �}tj.|
|dG�| _ np|dHk�r�| j)�sRtjdI� d| _dS | j)j/�rxtjdJt| j �� d| _dS |d }tj0||j1dK��| j)_/nd!S dS )PN�short� description�servicez;Invalid rule: More than one element in rule '%s', ignoring.T�namez#Service '%s' already set, ignoring.�port�protocol�-z#Port '%s/%s' already set, ignoring.�valuez$Protocol '%s' already set, ignoring.z
icmp-blockz&icmp-block '%s' already set, ignoring.z icmp-typez-Invalid rule: icmp-block '%s' outside of rule�
masqueradez!Masquerade already set, ignoring.z forward-port� zto-portzto-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%sz source-portz*Source port '%s/%s' already set, ignoring.� destinationz)Invalid rule: Destination outside of rulez?Invalid rule: More than one destination in rule '%s', ignoring.F�address�ipset�invert�yes�true�accept�reject�drop�markz$Invalid rule: Action outside of rulez"Invalid rule: More than one action�type�setr z!Invalid rule: Log outside of rulez Invalid rule: More than one log�level�emerg�alert�crit�error�warning�notice�info�debugz Invalid rule: Invalid log level�prefix�auditz#Invalid rule: Audit outside of rulez9Invalid rule: More than one audit in rule '%s', ignoring.�ruler �family�ipv4�ipv6z&Invalid rule: Rule family "%s" invalid�priority)r: r= �limitz4Invalid rule: Limit outside of action, log and auditz9Invalid rule: More than one limit in rule '%s', ignoring.�burst)r& r' )r( r) r* r+ )r/ r0 r1 r2 r3 r4 r5 r6 )r; r< )2�_rule�elementr r3 �str� _rule_errorr � Rich_Service�item�services�append� Rich_Portr r r
�ports�
Rich_Protocolr � protocols�Rich_IcmpBlock� icmp_blocks�
Rich_IcmpType�Rich_Masquerader �Rich_ForwardPortr r r r � INVALID_ADDR�
forward_ports�Rich_SourcePort� source_portsr" �lowerZRich_Destination�action� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� _limit_okZRich_Logr8 Z
Rich_Audit�int� Rich_Ruler> Z
Rich_Limit�get)�objr �attrs�entry�to_portZto_addrr% r# r$ Z_typeZ_setr. r7 r: r= r � rc � /usr/lib/python3.6/policy.py�common_startElement s�
re c C s� |dkr�| j s�y| jj� W n6 tk
rR } ztjd|t| j�� W Y d d }~X nLX t| j�| jjkr�| jj j
| j� | jjj
t| j�� ntjdt| j�� d | _d| _ n|d kr�d | _ d S ) Nr9 z%s: %sz Rule '%s' already set, ignoring.Fr( r) r* r+ r r8 )r( r) r* r+ r r8 ) rC r@ Zcheck� Exceptionr r3 rB rE � rules_str�rulesrG r[ )r_ r �erc rc rd �common_endElement s & rj c C s� t | t�rdnd}|dkrT| jrT| jj� }x$|D ] }||kr0ttjd| ��q0W �n�|dkr�x$|D ] }t|d � t|d � qbW �nb|dkr�x|D ] }t |� q�W �n@|d kr�| jr�| jj
� } x$|D ] }
|
| kr�ttj d
|
��q�W �n�|d k�r�x�|D ]�} t| d � t| d � | d �r>| d
�r>ttj d| ��| d �rTt| d � | d
r�t
| d
� r�t| d
� r�ttjd| d
��q�W �nT|dk�r�x&|D ] }t|d � t|d � �q�W �n |dk�r�x|D �]} tj| d�}
| j�r�|
j�r�t |
jtj��s t |
jtj��r�| jj
� } |
jj| k�rLttj d
|
jj ��nH|
j�r�| jj|
jj�}|j�r�|
j|jk�r�ttj d|
j|
jjf ��nL| j�r�t |
jtj��r�| jj� }|
jj|k�r�ttjdj|| j|
jj����q�W d S )Nr ZZonerF z '%s' not among existing servicesrI r � rK rM z"'%s' not among existing icmp typesrR � � z$'%s' is missing to-port AND to-addr z#to-addr '%s' is not a valid addressrT rg �
rich_rules)�rule_strz3rich rule family '%s' conflicts with icmp type '%s'z){} '{}': '{}' not among existing services)rg rn )�
isinstancer � fw_configZ get_servicesr r ZINVALID_SERVICEr r r Z
get_icmptypesZINVALID_ICMPTYPE�INVALID_FORWARDr r rQ r r] rA rL rN r r: Z get_icmptyper" rD �format)r_ r rE �
all_configZobj_typeZexisting_servicesr r �protoZexisting_icmptypesZicmptype�fwd_portr9 Zobj_richZictrc rc rd �common_check_config2 s�
rw c C s0 d|j i}|j}|d k r ||d< | jd|� d S )Nr r? r> )r r? �
simpleElement)�handlerr> �dr? rc rc rd �_handler_add_rich_limitx s
r{ c C s� | j rF| j dkrF|jd� |jdi � |j| j � |jd� |jd� | jr�| jdkr�|jd� |jdi � |j| j� |jd� |jd� x6t| j�D ](}|jd� |jdd|i� |jd� q�W x@t| j �D ]2}|jd� |jd|d |d
d �� |jd� q�W x8t| j
�D ]*}|jd� |jd d
|i� |jd� �qW x8t| j �D ]*}|jd� |jdd|i� |jd� �qLW | j �r�|jd� |jdi � |jd� x�t| j
�D ]�}|jd� |d |d
d �}|d �r�|d dk�r�|d |d< |d �r|d dk�r|d |d< |jd|� |jd� �q�W xBt| j�D ]4}|jd� |jd|d |d
d �� |jd� �q>W �xT| jD �]H}i }|j�r�|j|d< |jd k�r�t|j�|d< |jd� |jd|� |jd� |j�rVi }|jj�r�|jj|d< |jj�r|jj|d< |jj�r$|jj|d< |jj�r6d |d < |jd � |jd |� |jd� |j�r�i }|jj�rx|jj|d< |jj�r�|jj|d< |jj�r�d |d < |jd � |jd |� |jd� |j�rxd} i }t|j�tj k�r�d} |jj |d< �nbt|j�tj k�r(d} |jj |d< |jj |d < �n0t|j�tj!k�rNd } |jj"|d
< �n
t|j�tj#k�rfd} n�t|j�tj$k�r�d} |jj |d< n�t|j�tj%k�r�d!} |jj |d< n�t|j�tj&k�rd} |jj |d< |jj |d < |jj'dk�r�|jj'|d< |jj(dk�rX|jj(|d< nFt|j�tj)k�rBd} |jj |d< |jj |d < nt*t+j,d"t|j� ��|jd � |j| |� |jd� |j-�r i }|j-j.�r�|j-j.|d#< |j-j/�r�|j-j/|d$< |j-j0�r�|jd � |jd%|� |jd&� t1||j-j0� |jd'� |jd%� n|jd � |jd%|� |jd� |j2�r�i }|j2j0�rx|jd � |jd(i � |jd&� t1||j2j0� |jd'� |jd(� n|jd � |jd(|� |jd� |j3�r�d}
i }t|j3�tj4k�r�d)}
n|t|j3�tj5k�r�d*}
|j3j�r<|j3j|d+< nNt|j3�tj6k�rd,}
n6t|j3�tj7k�r*d-}
|j3j8|d.< nt-j9d/t|j3�� |j3j0�r�|jd � |j|
|� |jd&� t1||j3j0� |jd'� |j|
� n|jd � |j|
|� |jd� |jd� |jd� |jd� �q�W d S )0Nr! z r �
r r r r r rk )r r r r z
icmp-blockr rl zto-portrm zto-addrz forward-portz source-portr: r= r9 r# �macr$ �Truer% z �sourcer" z icmp-typez"Unknown element '%s' in obj_writerr7 r. r z
z
r8 r( r) r, r* r+ r- zUnknown action '%s'):r �ignorableWhitespace� startElementZ
characters�
endElementr r rF rx rI rK rM r rR rT rh r: r= rB r �addrr} r$ r% r" rA r, r rD r rH r r rJ r rO rL rN rP rb �
to_addressrS r r ZINVALID_OBJECTr r7 r. r> r{ r8 rV rW rX rY rZ r- r3 ) r_ ry r r r ZicmpZforwardr` r9 rA rV rc rc rd �
common_writer� s\
r� c sP e Zd Zd7ZdZeZdgZd8d9d:d;d dgfd
d<gfd dgfd=dd>gfddgfddgfdd?gfd@ddgfddgffZdddgZ dddgdgddgdgdgdddgdddd gddgdddddd gd gdgdgd �Z
ddgd d gd!dgd"d#d$d!d%gd"d$d%gd&d'gd(gd)gd*�Z � fd+d,�Z d-d.� Z
� fd/d0�Z� fd1d2�Zd3d4� Z� fd5d6�Z� ZS )Ar i � i� r �versionr! r r �targetrF rI rM r FrR rn rK rT r= �
ingress_zones� egress_zones�_r �/Nr r r r r- )r r �policyr r z
icmp-blockz icmp-typer z forward-portr9 r r" r z source-portr r8 r( r) r* r+ r> z ingress-zonez egress-zonezto-portzto-addrr: r# r} r% r$ r7 r. r, r? )r� z forward-portr9 r r" r r) r> c s� t t| �j� d| _d| _d| _t| _g | _g | _ g | _
g | _ d| _ g | _
g | _d | _g | _g | _d| _| j| _d | _g | _g | _d S )Nr! F)�superr �__init__r� r r r r� rF rI rK rM r rR rT rq rh rg �applied�priority_defaultr= Zderived_from_zoner� r� )�self)� __class__rc rd r� � s( zPolicy.__init__c C s� d| _ d| _d| _t| _| jd d �= | jd d �= | jd d �= | jd d �= d| _ | j
d d �= | j d d �= d | _ | j
d d �= | jd d �= d| _| j| _| jd d �= | jd d �= d S )Nr! F)r� r r r r� rF rI rK rM r rR rT rq rh rg r� r� r= r� r� )r� rc rc rd �cleanup� s$ zPolicy.cleanupc s" |dkr| j S ttt| �|�S d S )Nrn )rg �getattrr� r )r� r )r� rc rd � __getattr__� s zPolicy.__getattr__c sB |dkr,dd� |D �| _ dd� | j D �| _ntt| �j||� d S )Nrn c S s g | ]}t j|d ��qS ))ro )r r] )�.0�src rc rd �
<listcomp>� s z&Policy.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS rc )rB )r� r� rc rc rd r� � s )rh rg r� r � __setattr__)r� r r )r� rc rd r� � s zPolicy.__setattr__c
C s t | |||� |dkr2|tkr.ttjd| ���n�|dkrz|| jksX|| jksX|| jk rvttjd|| j| j| jf ���n�|dk�rhddg}| j r�|| j j
� 7 }x�|D ]�}||kr�ttj d | ��|dkr�t ddg�t |�@ � s�|d k�rt |�t |g� �rttj d
| ��|dkr�|dk�r8d|k�r8d|d k�sT|dkr�d|kr�d|d kr�ttj d ��q�W �n�|d k�r|�rd|k�r�d|d k�r�ttj d
��nxd|k�rd|d k�r�ttj d��xR|d D ]F}|dk�rސq�| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �n�|dk�r4�x�|D �] }tj|d�}|j�r�t|jtj��r�d|k�r|d|d k�r|ttj d
��nxd|k�r,d|d k�r�ttj d��xR|d D ]F}|dk�r��q�| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �q,|j�r�t|jtj��r�d|k�r,d|d k�r@|jj�r�ttjd��nt|d �r,|jj�s`ttjd��d|d k�r,x�|d D ]8}| j j
|�}| j �rxd| j j|�k�rxttj d���qxW nv|j�r,t|jtj��r,d|k�r,xR|d D ]F}|d k�r�q�| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �q,W n�|dk�rx�|D ]�} d|k�rnd|d k�rnttj d��n�d|k�rDd|d k�r�| d �rttjd��nt|d �rD| d �s�ttjd��d|d k�rDxD|d D ]8}| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �qDW d S ) Nr� z'%s' is invalid targetr= zQ%d is invalid priority. Must be in range [%d, %d]. The following are reserved: %sr� r� �ANY�HOSTz '%s' not among existing zonesz>'%s' may only contain one of: many regular zones, ANY, or HOSTzF'HOST' can only appear in either ingress or egress zones, but not bothr z.'masquerade' is invalid for egress zone 'HOST'z/'masquerade' is invalid for ingress zone 'HOST'Z
interfaceszR'masquerade' cannot be used in a policy if an ingress zone has assigned interfacesrn )ro zAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonezS'forward-port' cannot be used in a policy if an egress zone has assigned interfaceszR'mark' action cannot be used in a policy if an egress zone has assigned interfacesrR z1'forward-port' is invalid for ingress zone 'HOST'rm )r� r� )r� r� )r� r� )r� r� )rw r r r �INVALID_TARGET�priority_reserved� priority_max� priority_minZINVALID_PRIORITYrq � get_zonesZ INVALID_ZONEr- Zget_zoneZget_zone_config_dictr r] rA rp rO rP r� rr rV rZ )
r� r rE rt Zexisting_zones�zoneZz_objr9 r_ rv rc rc rd �
_check_config� s�
"
zPolicy._check_configc s� t t| �j|� |jd�r,ttjd| ��n�|jd�rHttjd| ��n�|jd�dkrhttjd| ��njd|kr�|d |j d�� }n|}t
|�t � kr�ttjd|t
|�t � f ��| j r�|| j j
� kr�ttjd��d S )Nr� z'%s' can't start with '/'z'%s' can't end with '/'rk zmore than one '/' in '%s'z&Policy of '%s' has %d chars, max is %dz,Policies can't have the same name as a zone.)r� r �
check_name�
startswithr r � INVALID_NAME�endswith�count�find�lenr rq r� Z
NAME_CONFLICT)r� r Z checked_name)r� rc rd r� , s*
zPolicy.check_namei ���)r� r! )r r! )r r! )r� r! )r! r! )r F)r! r! r! r! )r! r! )r= r )�__name__�
__module__� __qualname__r� r� r
r� r� ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr� r� r� r� r� r� �
__classcell__rc rc )r� rd r Z sr
^c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�policy_ContentHandlerc C s" t j| |� d | _d| _d | _d S )NF)r r� r@ rC r[ )r� rE rc rc rd r� H s z policy_ContentHandler.__init__c C s t j| ||� | jrd S | jj||� t| ||�r6d S |dkr�d|krR|d | j_d|krjt|d �| j_d|kr�|d }|t kr�t
t j |��|r�|| j_
�n^|dkr�|d | jjkr�| jjj|d � ntjd|d � �n |dk�r |d | jjk�r| jjj|d � ntjd |d � n�|d
k�r�| j�sFtjd � d | _d S | jj�rltjd
t| j�� d | _d S d}d|k�r�|d j� dk�r�d }d } }}d|k�r�|d }d|k�r�|d }d|k�r�|d }tj||||d�| j_d S tjd|� d S d S )Nr� r� r= r� z ingress-zoner z(Ingress zone '%s' already set, ignoring.z egress-zonez'Egress zone '%s' already set, ignoring.r z$Invalid rule: Source outside of ruleTz:Invalid rule: More than one source in rule '%s', ignoring.Fr% r& r' r# r} r$ )r% zUnknown XML element '%s')r& r' )r r� rC rE Zparser_check_element_attrsre r� r\ r= r r r r� r� r� rG r r3 r� r@ r rB rU r Z Rich_Source)r� r r` r� r% r� r} r$ rc rc rd r� N sf
z"policy_ContentHandler.startElementc C s t j| |� t| |� d S )N)r r� rj )r� r rc rc rd r� � s z policy_ContentHandler.endElementN)r� r� r� r� r� r� rc rc rc rd r� G s @r� Fc
C s t � }| jd�s ttjd| ��| d d � |_|s>|j|j� | |_||_|j t
j �rZdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd| j� ��W Y d d } ~ X nX W d Q R X ~~|S )
Nz.xmlz'%s' is missing .xml suffix� FTz%s/%s�rbznot a valid policy file: %s���)r r� r r r� r r� �filename�pathr� r �
ETC_FIREWALLDZbuiltin�defaultr� �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZINVALID_POLICYZ getException)
r� r� Z
no_check_namer� ry �parserr �fr �msgrc rc rd r � s6
(c
C s� |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� i }| j�r| jd k�r| j|d
< | j| jk�r0t| j�|d < | j|d < |jd
|� |jd� t| |� x8t| j �D ]*} |jd� |j dd| i� |jd� �qfW x8t| j �D ]*} |jd� |j dd| i� |jd� �q�W |j d
� |jd� |j � |j!� ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr! r� r= r� r� r| z z ingress-zoner z egress-zone)"r� r� r �os�exists�shutilZcopy2rf r r2 �dirnamer� r r� �mkdir�ior� r Z
startDocumentr� r= r� rB r� r� r� r� r r� rx r� r� Z endDocument�close)
r� r� �_pathr r� �dirpathr� ry r` r� rc rc rd r � sN
)F)N))�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r
Zfirewall.core.baser r r
Zfirewall.core.io.io_objectr r r r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr re rj rw r{ r� r r� r r rc rc rc rd �<module> s4
F [ nL