؛L
* d Z ddlZddlZddlZddlZddlmZ ddlmZm Z m
Z
m Z ddl m
c mZ ddlmZmZ ddlmZ ddlmZ ddlmZ dd lmZ dd
lmZmZm Z m Z m Z dd l m Z m!Z! dd l"m#Z# g d
Z$ddl%m&Z& e dde'fde'fde'fg Z( e dde'fde)fde*fde*fde'fde'fg Z+dZ,dZ- ej. e/ Z0d Z1d Z2d e e3 fd Z4d Z5d! Z6 G d" d#e$ Zd%e fd&Z7d' Z8d( Z9 ed)* d+ Z:d,e+fd-Z;d,e)fd.Zz6SMTPBlocking._get_filter_smtp_rules.. ( DDSVVDDDDDDrN -olorD owner --uid-owner0c 3 h K | ],}g d ddt | dt j R V -dS rS rb rc rD NrZ r ACCEPTr\ uid common_argss r. r^ z6SMTPBlocking._get_filter_smtp_rules..
C
$
rN c 3 h K | ],}g d ddt | dt j R V -dS rS rb z --gid-ownerrD Nrg r\ gidrk s r. r^ z6SMTPBlocking._get_filter_smtp_rules..
C
$
rN )r@ prefix)actionz
--reject-withzicmp{}-port-unreachable6 ) rG r# joinr& appendr rh extendr9 itertoolschainr$ rK smtp_allow_usersrA r% r r r SMTP compose_rule nflog_action nflog_grouprE r' r REJECTformatr
IPV6rL rulesrk s @r. _get_filter_smtp_rulesz#SMTPBlocking._get_filter_smtp_rules s
'- I HHDDT%=%CDDD D D
# / LLF+FtFTF4F 1EFF
$
!,8'8
$
!!9!FGG
$ % %
*> $+
+
LL "/ , 9"/";DO"L"L#6#;
$ - (4 ! 11
LL "( $
.44 #+.2C C C
rN c | j j r| j j r | j j sg S g }dddddd d | j j D f| g dd d
t j R | g dd d d
d
t j R | fdt t j | j j | j
j D | fdt | j j D | g d
t j R |S )z
Return a list of rules that should be used in
OUTPUT_imunify360_SMTP chain in nat table.
These can either be installed using append_rule / insert_rule or
checked using has_rule methods of the firewall interface.
rQ rR rS rT rU rV c 3 4 K | ]}t | V d S rX rY r[ s r. r^ z3SMTPBlocking._get_nat_smtp_rules.. r_ rN r` ra rD rb rc rd c 3 h K | ],}g d ddt | dt j R V -dS rf rZ r RETURNri s r. r^ z3SMTPBlocking._get_nat_smtp_rules.. rl rN c 3 h K | ],}g d ddt | dt j R V -dS rn r ro s r. r^ z3SMTPBlocking._get_nat_smtp_rules..# rq rN )rG r# r& r' rv rw r r rx r9 ry rz r$ rK r{ rA r% REDIRECTr s @r. _get_nat_smtp_rulesz SMTPBlocking._get_nat_smtp_rules s
$ * (4 (1
I HHDDT%=%CDDD D D
K{KDK$KKm6JKKLLL
$
!,8'8
$
!!9!FGG
A{ADA-*@AABBB rN tablec |t k r| S |t k r| S g S rX )FILTERr NATr )rL r s r. _get_smtp_rules_forz SMTPBlocking._get_smtp_rules_for4 s= F??..00 0 C<<++-- - rN c < | || j gS )Nr rz ) has_chainIM360_SMTP_CHAINrL r r- s r. _im360_chain_existsz SMTPBlocking._im360_chain_exists; s! ""d6K"LLMMrN c > | |d| j gS )NOUTPUTr rz rule)has_ruleIM360_SMTP_TARGET_RULEr s r. _im360_chain_referencedz$SMTPBlocking._im360_chain_referenced> s. 8$2M
rN c V g fd D }|S )zW
Check if SMTP rules in Imunify chain are in accord with new settings.
c 3 R K | ]!} j | V "dS r N)r r r\ r r- rL r s r. r^ z/SMTPBlocking._im360_rules_ok..J sX !! t'<4 " rN )r )rL r r- check_commandss ``` r. _im360_rules_okz SMTPBlocking._im360_rules_okE sY
! 4 4U ; ;
rN Nc # K | |d| j gV | || j | || j gV dS )z
Return commands that will ensure no OUTPUT blocking on Imunify part.
Since the possible errors need to be suppressed we yield
commands in batches, each of which can only contain one
error-prone command.
r r r N) delete_ruler flush_chainr delete_chainr s r. _reset_commandsz SMTPBlocking._reset_commandsS s
8$2M
!
uD4I J J ! !T5J ! K K
rN table_statec | j }| j }|dS |j p^|j pV|j o|j pG|j |j k p7t
|j |j z
pt
|j |j z
S )z)Check whether rules need to be recreated.NT) rH rG r r r& r' boolr$ r% )rL r activenews r. _should_create_rulesz!SMTPBlocking._should_create_rulesg s %& >4 ( (
< ''
<":3?':
< 3</
< F& 899
<
F'#*::;;
rN c V g }|j s/| j |j s0| d j | rf| j | fd
D n; j j s/| j |S )zf
Return commands that will ensure firewall rules are in accord
with settings.
)r r r c 3 R K | ]!} j | V "dS r ) append_ruler r s r. r^ z.SMTPBlocking._sync_commands.. sX $$ t'<4 % rN )
r rw create_chainr r insert_ruler r r rx r rG r# )rL r r r- r* s `` ` r. _sync_commandszSMTPBlocking._sync_commandsy sw
' OO%%d&;5%II
+ OO$$ " 4 %
$ $[ 1 1 OO$$T%:%$HH
OO ! 4 4U ; ;
+1
(()>e(LL rN c K | || D ]I}t t 5 | | d {V d d d n # 1 swxY w Y Jt d| d S )Nz(SMTP Rules in table '%s' have been reset)r r r r, r5 info)rL r r- batchs r. _reset_rules_in_tablez"SMTPBlocking._reset_rules_in_table s ))%:: - -E344
-
- ooe,,,,,,,,,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- >FFFFFs AA A c K t || || d {V }| j j s |r | || d {V d S t |t || || d {V t || || d {V }| ||| }|r8| | d {V t d| d S d S )N)r r r z;SMTP settings have been synced with the rules in table '%s') r/ r rG r" r r r r r r, r5 r )rL r r- r r r* s r. _sync_rules_in_tablez!SMTPBlocking._sync_rules_in_table s - d..uh??
'/
B00AAAAAAAAA F %#3$66uhGG$ $ ,$..uh??
&&uk8DD //(++ + + + + + + + KKM
rN c K |pt | j d{V }| t | d{V t | j r!| t
| d{V d| _ dS )z*Ensure no OUTPUT blocking on Imunify part.NT)r rE r r r r rI )rL r- s r. reset_ruleszSMTPBlocking.reset_rules s B\$/%B%B B B B B B B((::::::::: DO , , <,,S(;; ; ; ; ; ; ; ; $ rN c K t | j d{V }|| _ | t | d{V t | j r!| t | d{V | j | _ d| _ dS )z2Ensure iptables rules are in accord with settings.NF) r rE rG r r r r rH rI )rL new_settingsr- s r.
sync_ruleszSMTPBlocking.sync_rules s %do66666666#/ ''999999999 DO , , ;++C:: : : : : : : : $ 7 % rN rX )rO N) __name__
__module__ __qualname____doc__r r r rM r r rZ r r listr r r dictr r r r r r r r r r r rN r. r r o s
0 "$4 5;9 ; ; ; ;gU38_(= g g g gRJT%S/%: J J J JX N N N
$t*
4:tT) *
(
t
$#C #j # # # #JG G G G G 6% % % % %
&
&
&
&
&
&rN r ) metaclassip_versions_to_resetc K | D ]=}t | j s't | d {V >d S rX )r rI r )r versions r. _reset_rules_for_ip_versionsr s_ ' 6 6G$$5 6 w''3355 5 5 5 5 5 5 56 6rN c v K d t j D } | rt | d{V dS dS )z8
Mainly used for `SMTPBlocker` plugin shutdown.
c : g | ]}t | j |S r )r rI )r\ r s r.
z0reset_rules_for_all_versions.. s9 G$$5 rN N)r
allr )r s r. r r sk "((
A*+?@@@@@@@@@@@A ArN c K t j 4 d{V t j D ]*}t | | d{V + ddd d{V dS # 1 d{V swxY w Y dS )z
Used whenever there is a need to check compatibility between Imunify
config and currently used SMTP blocking iptables rules.
N)r
RULE_EDIT_LOCKr
r" r r )r r s r. r r sF
' A A A A A A A A"*,, A AG w''22<@@ @ @ @ @ @ @ @ @ AA A A A A A A A A A A A A A A A A A A A A A A A A A A A A As ?A((
A25A2 )maxsizec v K t j 4 d{V t t j j d{V } | | dt j g d{V n"# t $ r Y ddd d{V dS w xY w | | dt j g d{V n2# t $ r%}t
d| Y d}~nd}~ww xY wddd d{V n# 1 d{V swxY w Y dS )z&Check if iptables has xt_owner module.Nr )rz r FzASomething went wrong during the removal of the SMTP test rule: %sT)r
r r r
r V4r, r r smtp_test_ruler r r5 r6 )r- errs r. r r s| ' %kn&788888888 // (( &]-I-K-K )
// (( &]-I-K-K )
NN@
- 8 4s` %D(AA>=D(>
B D( B D(!AC$#D($
D.D D(DD((
D25D2rO c t t j t j t t j t t j t j t j S )z,Return current settings from Imunify config.)r" r# r$ r% r& r' ) r!
SMTPConfigENABLEDPORTSset ALLOW_USERS ALLOW_GROUPS ALLOW_LOCALr r rN r. r r sM "
.//011 *$
rN c g } t j D ])}| t | j *| S )zk
Return the latest applied SMTP settings.
Used to compare with the settings from config file.
)r
r" rw r rH )active_settings_listr s r. r r sL &(( K K ##L$9$9$IJJJJ rN c K t j } t t j d{V | f S )zC
Return True if any other SMTP blocking features is active
N)r rJ get_SMTP_conflict_statusanycsfis_SMTP_block_enabled)panel_SMTP_conflicts r. r r + sV "$$==?? c/111111113FG H HHrN )>r r< ry loggingr1
contextlibr typingr r r r im360.subsys.csfsubsysr defence360agent.utilsr r im360.contracts.configr
r r r im360.internals.corer
im360.internals.core.firewallr r r r r "im360.internals.core.firewall.baser r im360.subsys.panelsr __all__ defence360agent.utils.validater r r r r r! CAPTURE_CSF_LOCKCSF_LOCK_TIMEOUT getLoggerr r5 r r r r/ r9 rA r r r r r r r r rN r. r s
5 5 5 5 5 5 5 5 5 5 5 5 - , , , , , = = = = = = 6 6 6 6 6 6 , , , , , , . - - - - - 5 4 4 4 4 4
Zd 0$ 7*d9KL
z D $ T
8 $ $ tDz ( b& b& b& b& b&Y b& b& b& b&J 6T 6 6 6 6
A
A
AA A A B L $ It I I I I I IrN