a
iK @ s g d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd de
Z G d d
d
e
Z G d d d e
Z
G d
d de
ZG dd deZG dd de
ZG dd de
ZG dd de
ZG dd de
ZG dd de
ZG dd d e
ZG d d d e
ZG d d d e
ZG d!d" d"e
ZG d#d$ d$e
ZG d%d& d&e
ZG d'd( d(eZG d)d* d*e
Z G d+d, d,e
Z G d-d. d.e
Z d/S )0) Rich_SourceRich_Destination Rich_Service Rich_Port
Rich_ProtocolRich_MasqueradeRich_IcmpBlock
Rich_IcmpTypeRich_SourcePortRich_ForwardPortRich_Log
Rich_NFLog Rich_Accept Rich_Reject Rich_Drop Rich_Mark
Rich_Audit
Rich_Limit Rich_RuleRich_Tcp_Mss_Clamp ) functions)check_ipset_name) REJECT_TYPES)errors)
FirewallErrorc @ s e Zd ZdddZdd ZdS )r Fc C s || _ | j dkrd | _ || _| jdks0| jd u r8d | _n| jd urN| j | _|| _| jdkrdd | _|| _| j d u r| jd u r| jd u rttjdd S )N no address, mac and ipset)addrmacupperipsetinvertr r INVALID_RULE)selfr r r r! r$ 6/usr/lib/python3.9/site-packages/firewall/core/rich.py__init__$ s
zRich_Source.__init__c C sj d| j r dnd }| jd ur*|d| j S | jd urB|d| j S | jd urZ|d| j S ttjdd S )Nz source%s NOTr address="%s"zmac="%s"
ipset="%s"r )r! r r r r r r" r# retr$ r$ r% __str__5 s
zRich_Source.__str__N)F__name__
__module__ __qualname__r& r, r$ r$ r$ r% r # s
r c @ s e Zd ZdddZdd ZdS )r Fc C sV || _ | j dkrd | _ || _| jdkr,d | _|| _| j d u rR| jd u rRttjdd S )Nr no address and ipset)r r r! r r r" )r# r r r! r$ r$ r% r& A s
zRich_Destination.__init__c C sR d| j r dnd }| jd ur*|d| j S | jd urB|d| j S ttjdd S )Nzdestination%s r' r r( r) r1 )r! r r r r r" r* r$ r$ r% r, M s
zRich_Destination.__str__N)Fr- r$ r$ r$ r% r @ s
r c @ s e Zd Zdd Zdd ZdS )r c C s
|| _ d S Nnamer# r4 r$ r$ r% r& W s zRich_Service.__init__c C s
d| j S )Nzservice name="%s"r3 r# r$ r$ r% r, Z s zRich_Service.__str__Nr- r$ r$ r$ r% r V s r c @ s e Zd Zdd Zdd ZdS )r c C s || _ || _d S r2 portprotocol)r# r8 r9 r$ r$ r% r& ^ s zRich_Port.__init__c C s d| j | jf S )Nz port port="%s" protocol="%s"r7 r6 r$ r$ r% r, b s zRich_Port.__str__Nr- r$ r$ r$ r% r ] s r c @ s e Zd Zdd ZdS )r c C s d| j | jf S )Nz#source-port port="%s" protocol="%s"r7 r6 r$ r$ r% r, f s zRich_SourcePort.__str__Nr. r/ r0 r, r$ r$ r$ r% r e s r c @ s e Zd Zdd Zdd ZdS )r c C s
|| _ d S r2 valuer# r< r$ r$ r% r& k s zRich_Protocol.__init__c C s
d| j S )Nzprotocol value="%s"r; r6 r$ r$ r% r, n s zRich_Protocol.__str__Nr- r$ r$ r$ r% r j s r c @ s e Zd Zdd Zdd ZdS )r c C s d S r2 r$ r6 r$ r$ r% r& r s zRich_Masquerade.__init__c C s dS )N
masquerader$ r6 r$ r$ r% r, u s zRich_Masquerade.__str__Nr- r$ r$ r$ r% r q s r c @ s e Zd Zdd Zdd ZdS )r c C s
|| _ d S r2 r3 r5 r$ r$ r% r& y s zRich_IcmpBlock.__init__c C s
d| j S )Nzicmp-block name="%s"r3 r6 r$ r$ r% r, | s zRich_IcmpBlock.__str__Nr- r$ r$ r$ r% r x s r c @ s e Zd Zdd Zdd ZdS )r c C s
|| _ d S r2 r3 r5 r$ r$ r% r& s zRich_IcmpType.__init__c C s
d| j S )Nzicmp-type name="%s"r3 r6 r$ r$ r% r, s zRich_IcmpType.__str__Nr- r$ r$ r$ r% r s r c @ s e Zd Zdd Zdd ZdS )r c C s
|| _ d S r2 r; r= r$ r$ r% r& s zRich_Tcp_Mss_Clamp.__init__c C s | j rd| j S dS d S )Nztcp-mss-clamp value="%s"
tcp-mss-clampr; r6 r$ r$ r% r, s
zRich_Tcp_Mss_Clamp.__str__Nr- r$ r$ r$ r% r s r c @ s e Zd Zdd Zdd ZdS )r
c C s< || _ || _|| _|| _| jd u r(d| _| jd u r8d| _d S Nr r8 r9 to_port
to_address)r# r8 r9 rB rC r$ r$ r% r& s
zRich_ForwardPort.__init__c C s< d| j | j| jdkr d| j nd| jdkr4d| j ndf S )Nz(forward-port port="%s" protocol="%s"%s%sr z
to-port="%s"z
to-addr="%s"rA r6 r$ r$ r% r, s zRich_ForwardPort.__str__Nr- r$ r$ r$ r% r
s r
c @ s& e Zd ZdddZdd Zdd ZdS ) r Nc C s || _ || _|| _d S r2 prefixlevellimit)r# rE rF rG r$ r$ r% r& s zRich_Log.__init__c C s> d| j rd| j nd| jr$d| j nd| jr6d| j ndf S )Nz log%s%s%s prefix="%s"r z level="%s" %srD r6 r$ r$ r% r, s zRich_Log.__str__c C sV | j r t| j dkr ttjd| jr>| jdvr>ttj| j| jd urR| j d S )N +maximum accepted length of 'prefix' is 127.)ZemergZalertZcriterrorZwarningZnoticeinfodebug) rE lenr r INVALID_LOG_PREFIXrF ZINVALID_LOG_LEVELrG checkr6 r$ r$ r% rQ s
zRich_Log.check)NNNr. r/ r0 r& r, rQ r$ r$ r$ r% r s
r c @ s& e Zd ZdddZdd Zdd ZdS ) r Nc C s || _ || _|| _|| _d S r2 grouprE thresholdrG )r# rT rE Z
queue_sizerG r$ r$ r% r& s zRich_NFLog.__init__c C sP d| j rd| j nd| jr$d| j nd| jr6d| j nd| jrHd| j ndf S )Nz
nflog%s%s%s%sz group="%s"r rH z queue-size="%s"rI rS r6 r$ r$ r% r, s zRich_NFLog.__str__c C st | j r t| j s ttjd| jr>t| jdkr>ttjd| j r\t| j s\ttj
d| j d urp| j d S )Nz5nflog 'group' must be an integer between 0 and 65535.rJ rK z:nflog 'queue-size' must be an integer between 0 and 65535.)
rT r Z checkUINT16r r ZINVALID_NFLOG_GROUPrE rO rP rU ZINVALID_NFLOG_QUEUErG rQ r6 r$ r$ r% rQ s
zRich_NFLog.check)NNNNrR r$ r$ r$ r% r s
r c @ s e Zd ZdddZdd ZdS )r Nc C s
|| _ d S r2 rG r# rG r$ r$ r% r& s zRich_Audit.__init__c C s d| j rd| j nd S )Nzaudit%srI r rV r6 r$ r$ r% r, s zRich_Audit.__str__)Nr- r$ r$ r$ r% r s
r c @ s e Zd ZdddZdd ZdS )r
Nc C s
|| _ d S r2 rV rW r$ r$ r% r& s zRich_Accept.__init__c C s d| j rd| j nd S )Nzaccept%srI r rV r6 r$ r$ r% r, s zRich_Accept.__str__)Nr- r$ r$ r$ r% r
s
r
c @ s& e Zd ZdddZdd Zdd ZdS ) r Nc C s || _ || _d S r2 typerG )r# Z_typerG r$ r$ r% r& s zRich_Reject.__init__c C s, d| j rd| j nd| jr$d| j ndf S )Nz
reject%s%sz
type="%s"r rI rX r6 r$ r$ r% r, s zRich_Reject.__str__c C sT | j rP|sttjd|dv rP| j t| vrPdt| }ttjd| j |f d S )Nz9When using reject type you must specify also rule family.Zipv4Zipv6z, z%Wrong reject type %s.
Use one of: %s.)rY r r r" r join)r# familyZ valid_typesr$ r$ r% rQ s zRich_Reject.check)NNrR r$ r$ r$ r% r s
r c @ s e Zd Zdd ZdS )r c C s d| j rd| j nd S )Nzdrop%srI r rV r6 r$ r$ r% r, s zRich_Drop.__str__Nr: r$ r$ r$ r% r s r c @ s& e Zd ZdddZdd Zdd ZdS ) r Nc C s || _ || _d S r2 setrG )r# Z_setrG r$ r$ r% r& s zRich_Mark.__init__c C s d| j | jrd| j ndf S )Nz
mark set=%s%srI r r] r6 r$ r$ r% r, s zRich_Mark.__str__c C s | j d ur| j }n ttjdd|v rr|d}t|dkrHttj|t|d rdt|d sttj|nt|sttj|d S )Nz no value set/ r )r^ r r Z INVALID_MARKsplitrO r Z checkUINT32)r# xsplitsr$ r$ r% rQ s
zRich_Mark.check)NrR r$ r$ r$ r% r s
r c @ s, e Zd Zdd Zdd Zdd Zdd Zd S )
r c C sV || _ d| j v rR| j d}t|dkrR|d dv rRd|d |d d d f | _ d S )Nr_ r` ra )secondZminuteZhourZdayz%s/%sr )r< rb rO )r# r< rd r$ r$ r% r& s
zRich_Limit.__init__c C s d }d| j v r| j d}|r*t|dkr8ttj| j |\}}z t|}W n ttj| j Y n0 |dk sx|dvrttj| j d}|dkrd}n(|dkrd}n|dkrd }n |d
krd }d | | d
krttjd| j |dkr|d
krttjd| j d S )Nr_ r` ra )smhdrf rg < rh i ri iQ i' r z %s too fastz %s too slow)r< rb rO r r Z
INVALID_LIMITint)r# rd ZrateZdurationZmultr$ r$ r% rQ ! s:
zRich_Limit.checkc C s
d| j S )Nzlimit value="%s"r; r6 r$ r$ r% r, C s zRich_Limit.__str__c C s dS r@ r$ r6 r$ r$ r% commandF s zRich_Limit.commandN)r. r/ r0 r& rQ r, rl r$ r$ r$ r% r s "r c @ s> e Zd ZdZdZdddZdd Zd d
Zd d Zd
d Z dS )r i i Nr c C sV |d urt || _nd | _|| _d | _d | _d | _d | _d | _d | _|rR| | d S r2 )
strr\ prioritysource destinationelementlogauditaction_import_from_string)r# r\ rule_strrn r$ r$ r% r& M s zRich_Rule.__init__c C s g }t |D ]j}d|v rj|d}t|dks@|d r@|d sPttjd| ||d |d d q|d|i q|ddi |S ) z Lexical analysis =r` r ra z internal error in _lexer(): %s) attr_name
attr_valuerq EOL)r Z splitArgsrb rO r r r" append)r# rv tokensrattrr$ r$ r% _lexer^ s
zRich_Rule._lexerc C s` |st tjdt|}d| _d | _d | _d | _d | _ d | _
d | _ d | _ |
|}|rv|d ddkrvt tjdi }g }d}|| ddkr|dgk sT|| d}|| d}|| d}|r|dvrt tjd | n|d
v r|d kr| jrt tjd n|d
kr2| jr2t tjdn|dv r\| j r\t tjd|| j f nh|dv r|| j
r|t tjdnH|dkr| j rt tjdn(|dv r| j rt tjd|| j f nt tjd| t|dkr|t|d nd} | dkr|sT|rT|dkr&t tjdn,|d kr>t tjd nt tjd ||f n*d|vrtt tjd ||f n
|d n| dkr6|dkr|d vrt tjd!| || _nz|d krzt|| _W n$ ty t tjd"| Y n0 n:|r(|d#krd$}
n d%||f }
t tj|
n
|| n| d kr|d&v rT|||< nV|d'v rhd(|d)< nBt|d*|d+|d,|d)d-| _| | |d }n| d
kr |d.v r|||< nN|d'v rd(|d)< n:t|d*|d,|d)d-| _| | |d }n,| d#krV|d/krFt|| _ | n t tjd0n| d1kr|d/krt|||< n(t|d/| _ | | |d }n| d2kr|d3krt|| _ | n t tjd4nr| d5kr*|d6v r|||< n0t|d5|d#| _ | | |d }n | d7krb|d3krRt || _ | n t tjd8n| d9kr|d3krt || _ | n t tjd:n| d;krt | _ | | |d }n| d|d?| _ | | |d }n | d@kr||d6v rH|||< n0t |d5|d#| _ | | |d }n| dAkr|dBv r|||< nN|dCkr|dC n8t!|dD|dE|dC| _
| | |d }n^| dFkrd|dGv r
|||< nV|dCkr |dC n@t"|dH|dD|dI|dC| _
| | |d }n| dkr|dCkr|dC n(t#|dC| _ | | |d }n| dJkr|dCkr|dC n(t$|dC| _ | | |d }nN| dKkrH|dCkr |dC n(t%|dC| _ | | |d }n| dLkr|dMkrf|||< nF|dCkr||dC n0t&|dM|dC| _ | | |d }n| dNk r|dOkr|||< nF|dCkr|dC n0t'|dO|dC| _ | | |d }n6| dCk rJ|d/k r>t(||dC< | n t tjdP|d }q| ) d S )QNz
empty ruler rq rz rulerx ry )rn r\ addressr r r! r< r8 r9 to-portto-addrr4 rT rE rF
queue-sizerY r^ zbad attribute '%s')r ro rp r9 servicer8
icmp-block icmp-typer> forward-port source-portrr nflogrs acceptdroprejectmarkrG notNOTrz r? ro z more than one 'source' elementrp z#more than one 'destination' element)r9 r r8 r r r> r r zFmore than one element. There cannot be both '%s' and '%s' in one rule.)rr r z more than one logging elementrs z more than one 'audit' element)r r r r zOmore than one 'action' element. There cannot be both '%s' and '%s' in one rule.zunknown element %sra r r\ z0'family' outside of rule. Use 'rule family=...'.rn z4'priority' outside of rule. Use 'rule priority=...'.z:'%s' outside of any element. Use 'rule %s= ...'.z,'%s' outside of rule. Use 'rule ... %s ...'.rZ zH'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead.z(invalid 'priority' attribute value '%s'.r9 zdwrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'.zDattribute '%s' outside of any element. Use 'rule %s= ...'.)r r r r! )r r Tr! r r r F)r r r! r< zinvalid 'protocol' elementr? r r4 zinvalid 'service' elementr8 r7 r z invalid 'icmp-block' elementr zinvalid 'icmp-type' elementr> r )r8 r9 r r r r r rr )rE rF rG rE rF r )rT rE r rT r r r r rY r r^ zinvalid 'limit' element)*r r r" r ZstripNonPrintableCharactersrn r\ ro rp rq rr rs rt r getrO r{ rk
ValueErrorINVALID_PRIORITYr popclearr r r r r r r r r
r r r r r
r r r r rQ ) r# rv r| attrsZ in_elementsindexrq rx ry Z
in_elementerr_msgr$ r$ r% ru o s
"
*
"
(
(
z Rich_Rule._import_from_stringc C s | j d ur"| j dvr"ttj| j | j d u rn| jd urB| jjd usL| jd urVttjt| j t
krnttj| j | j k s| j | j
krttjd| j | j
f | j d u r| jd u s| jd ur| j dkr| jd u rttjd| jd u r| jd u r| j dkrttjdt| j tt
ttfvrZ| jd u rZ| jd u rZ| jd u rZttjd| jd urt| jjd ur| j d u rttj| jjd urttjd| jjd urttjdt| j | jjstttjt| jjn| jjd ur6| jjd urttjd t | jjstttj t| jjn>| jjd urht | jjstttj t| jjn ttjd
| jd ur&| jjd ur| j d u rttj| jjd urttj dt| j | jjs&ttjt| jjn>| jjd urt | jjs&ttj t| jjn ttjd t| j t!krn| j j"d u sVt#| j j"d k rttj$t| j j"nRt| j t%krt&| j j'sttj(| j j'| j j)d
vrttj*| j j)n t| j t+krt,| j j-sttj*| j j-nt| j tkrF| jd ur ttjd| jd ur| jjd urttjdnzt| j tkr| j j"d u svt#| j j"d k rttj.t| j j"| jrttjdn t| j t/kr| j j"d u st#| j j"d k rttj.t| j j"nt| j t
krt&| j j'sttj(| j j'| j j)d
vr8ttj*| j j)| j j0dkrd| j j1dkrdttj(| j j0| j j0dkrt&| j j0sttj(| j j0| j j1dkrt2| j | j j1sttj| j j1| j d u rttj| jd urttjdnt| j t3krDt&| j j's$ttj(| j j'| j j)d
vrttj*| j j)n|t| j tkr| jd urrttjd| j | j j-rt4| j j-sttj| j j-n"| j d urttjdt| j | jd ur| j5 | jd ur$t| jt6t7t8fvr
ttj9t| j| jj:d ur$| jj:5 | jd urt| jt7krP| j5| j nt| jt;krj| j5 | jj:d ur| jj:5 d S )NrZ z/'priority' attribute must be between %d and %d.r zno element, no actionz%no element, no source, no destinationzno action, no log, no auditzaddress and maczaddress and ipsetz
mac and ipsetzinvalid sourcezinvalid destinationra )ZtcpZudpZsctpZdccpzmasquerade and actionzmasquerade and mac sourcezicmp-block and actionr zforward-port and actionz+tcp-mss-clamp and %s are mutually exclusivezUnknown element %s) s2
1