a
i @ s g d Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m
Z
m Z m Z m
Z
mZmZmZ ddlmZmZmZ ddlmZmZmZmZmZmZ ddl m Z ddl m Z dd lm Z dd
l!m"Z" d d Z#d
d Z$dd Z%dd Z&G dd deZ'G dd deZ(d ddZ)d ddZ*dS ) )Policy
policy_reader
policy_writer N)config)checkIPcheckIP6 checkUINT16coalescePortRangemax_policy_name_lenportInPortRangeportStruniqify)DEFAULT_POLICY_TARGETPOLICY_TARGETSDEFAULT_POLICY_PRIORITY) IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator
check_port check_tcpudpcheck_protocol)rich)log)errors)
FirewallErrorc s |dkr n|dkr n|dkr| j r`| j jrJtdt| j d| _dS t d | j _dS d | jj vr| jj
d ntd d n<|dkr| j r| j jrtdt| j d| _dS t d d | j _dS t d t
d t d d
d f}tt fd d | jj}|D ]b}t|d
|d
r4t| jtrb| jjn| jj}tttjd|d
d |f qԐq4t|d
dd |D \}}|D ]&} t| d
d f}
| jj|
q|D ]&} t| d
d f}
| jj
|
q n|d kr| j r\| j jrHtdt| j d| _dS t d | j _nBt d d | jj vr| jj
d ntd d n2|dkr<| j r| j jrtdt| j d| _dS d} d v r d dvr d } t | | j _n*d} d v r,d d d} td| n|dkr| j r| j jrttdt| j d| _dS t d | j _dS d | jj!vr| jj!
d ntd d n|d kr&| j r| j jrtdt| j d| _dS t" d | j _dS td d n|d kr| j rl| j jr^tdt| j d| _dS t# | j _n | jj$rtd nd| j_$nF|d krd}
d! v r d! }
d}d" v rĈ d" }| j r| j jrtdt| j d| _dS t% d d |
|| j _dS t d t
d |
r8t |
|rbt&|sbt'|sbttj(d#| t d d
d t|
d
t|f}
|
| jj)vr| jj)
|
n6td$ d d |
rd%|
nd|rd&| nd n|d'krZ| j r2| j jrtdt| j d| _dS t* d d | j _dS t d t
d t d d
d f}tt fd(d | jj+}|D ]b}t|d
|d
r~t| jtr| jjn| jj}tttjd|d
d |f qԐq~t|d
d)d |D \}}|D ]&} t| d
d f}
| jj+|
q|D ]&} t| d
d f}
| jj+
|
q.nz|d*kr| j std+ d| _dS | j j,rtd,t| j dS d-}d }d. v r d. }d }d/ v rЈ d/ }d0 v r d0 - d1v rd}t.|||| j _,n|d2v r| j s,td3 d| _dS | j j/rJtd4 d| _dS |d5krbt0 | j _/nh|d6krd }d7 v r d7 }t1|| j _/n8|d8krt2 | j _/n |d9krʈ d: }t3|| j _/| j j/| _4n|d;k r| j std< dS | j j rtd= dS d }d> v rD d> }|d?v rDtd@ d| _dS d }dA v r dA }| rnt5|dBk rtdC d| _dS t6||| j _| j j| _4n4|dDk
r| j std< dS | j j rtd= dS d }dE v
r dE }t7|
s tdF d| _dS d }dA v
rJ dA }|
r6t5|dBk
rJtdG d| _dS d }dH v
r~ dH }t7|
s~tdI d| _dS t8|||| j _| j j| _4n6|dJk
r| j
stdK dS | j j9
rtdLt| j d| _dS t: | j _9| j j9| _4n|dMk rld }d
}dN v rD dN }|dOv rDtdP dN d| _dS dQ v rZt; dQ }tj<||dR| _ nh|dSk r| j4 stdT d| _dS | j4j= rtdUt| j d| _dS d }t>|| j4_=nd-S dS )VNshort descriptionservicez;Invalid rule: More than one element in rule '%s', ignoring.Tnamez#Service '%s' already set, ignoring.portprotocol-c s | d d kS N r xattrsr$ ;/usr/lib/python3.9/site-packages/firewall/core/io/policy.pyE z%common_startElement..r z'%s:%s' already in '%s'c S s g | ] \}}|qS r$ r$ .0Z_portZ _protocolr$ r$ r)
O r+ z'common_startElement..valuez$Protocol '%s' already set, ignoring.
tcp-mss-clamppmtu)NNone z (value='z)'z-Invalid rule: tcp-mss-clamp%s outside of rule
icmp-blockz&icmp-block '%s' already set, ignoring. icmp-typez-Invalid rule: icmp-block '%s' outside of rule
masqueradez!Masquerade already set, ignoring. forward-portto-portto-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%s source-portc s | d d kS r" r$ r% r' r$ r) r* r+ c S s g | ] \}}|qS r$ r$ r, r$ r$ r) r. r+ destinationz)Invalid rule: Destination outside of rulez?Invalid rule: More than one destination in rule '%s', ignoring.FaddressipsetinvertZyestrue)acceptrejectdropmarkz$Invalid rule: Action outside of rulez"Invalid rule: More than one actionrA rB typerC rD setr z!Invalid rule: Log outside of rulez Invalid rule: More than one loglevel)ZemergZalertZcriterrorwarningZnoticeinfodebugz Invalid rule: Invalid log levelprefix z Invalid rule: Invalid log prefixnfloggroupz'Invalid rule: Invalid nflog group valuez"Invalid rule: Invalid nflog prefix
queue-sizez&Invalid rule: Invalid nflog queue-sizeauditz#Invalid rule: Audit outside of rulez9Invalid rule: More than one audit in rule '%s', ignoring.rulefamily)Zipv4Zipv6z&Invalid rule: Rule family "%s" invalidpriority)rS rT limitz4Invalid rule: Limit outside of action, log and auditz9Invalid rule: More than one limit in rule '%s', ignoring.)?_ruleelementr rI str _rule_errorr Rich_Serviceitemservicesappend Rich_Portr r r listfilterportsr
isinstancer derived_from_zoner r r ZALREADY_ENABLEDr remove
Rich_Protocolr protocolsRich_Tcp_Mss_ClampRich_IcmpBlock icmp_blocks
Rich_IcmpTypeRich_Masquerader6 Rich_ForwardPortr r INVALID_ADDR
forward_portsRich_SourcePort source_portsr; lowerZRich_Destinationaction Rich_Accept Rich_Reject Rich_Drop Rich_Mark _limit_oklenRich_Logr Z
Rich_NFLogrQ Z
Rich_Auditint Rich_RulerU Z
Rich_Limit)objr r( Z new_port_idZexisting_port_idsZport_id_nameZ added_rangesZremoved_rangesZ_rangeentry_valuesto_portZto_addrr> r< r= Z_typeZ_setrG rL rO thresholdrS rT r/ r$ r' r) common_startElement! s
r c
C s |dkr| j sz| j W n8 tyT } z td|t| j W Y d }~nTd }~0 0 t| j| jjvr| jj
| j | jj
t| j ntdt| j d | _d| _ n|dv rd | _ d S )NrR z%s: %sz Rule '%s' already set, ignoring.F)rA rB rC rD r rQ ) rY rV check Exceptionr rI rX r[ rules_strrulesr] rw )r| r er$ r$ r) common_endElement| s *r c C s* t | trdnd}|dkrXd|v rX|d }|D ]$}||vr.ttjd|| j|q.n|dkr|D ] }t|d t|d qdn|dkr|D ] } t | qn|d kr d
|v r |d
}
|D ]T} | |
vrttj
d || j| } | | d i d
i v rt
d| q| qĐn|dkr|D ]}
t|
d t|
d |
d st|
d stttjd|| j|
|
d rt|
d |
d r,t|
d s,t|
d s,ttjd|| j|
d q,nR|dkr|D ] }t|d t|d qn |dv r&|D ]}tj|d}|jr`d
|v r`t |jtjsXt |jtjr`|d
}
|jj|
vrttj
d || j|jj} |jj| d i d
i v rt
d| n| n|jr"|d
|jj }|jr"|j|jvr"ttj
d|| j|j|jj} | d i d
i |jj}|rZ|jrZ|j|jv rZt
d| n| nt |jtjr|jj|d vr"ttjd|| j|jjn|jr|jjr|jj|d vr"ttj d|| j|jjn@|jr|jjr|jj|d vrttj d|| j|jjqd S )Nr ZZoner\ z){} '{}': '{}' not among existing servicesra r r# rf ri Z icmptypesz+{} '{}': '{}' not among existing ICMP typesZruntimeZicmptypes_unsupportedz{} (unsupported)rn z-{} '{}': '{}' is missing to-port AND to-addr z,{} '{}': to-addr '{}' is not a valid addressrp )r
rich_rulesZrule_strz<{} '{}': rich rule family '{}' conflicts with icmp type '{}'Zipsetsz'{} '{}': '{}' not among existing ipsets) rb r r r ZINVALID_SERVICEformatr r r r ZINVALID_ICMPTYPEgetr Zdebug1INVALID_FORWARDr r rm r r{ rW rh rj rS r; rZ sourcer= Z
INVALID_IPSET)r| r r[
all_configall_io_objectsZobj_typeZexisting_servicesr r protoZexisting_icmptypesZicmptypeexfwd_portrR Zobj_richZictZict_unsupportedr$ r$ r) common_check_config s
r c C s | j rF| j dkrF|d |di || j |d |d | jr| jdkr|d |di || j |d |d t| jD ](}|d |dd|i |d qt| j D ]2}|d |d|d |d
d |d qt| j
D ]*}|d |d d
|i |d qt| j D ]*}|d |dd|i |d q>| j r|d |di |d t| j
D ]}|d |d |d
d }|d r|d dkr|d |d< |d r|d dkr|d |d< |d| |d qt| jD ]4}|d |d|d |d
d |d q(| jD ]n}i }|jr|j|d< |jd krt|j|d< |d |d| |d |jr:i }|jjr|jj|d< |jjr|jj|d< |jjr|jj|d< |jjrd |d < |d |d | |d |jri }|jjr\|jj|d< |jjrr|jj|d< |jjrd |d < |d |d | |d |jrd} i }t|jtj krd} |jj |d< nt|jtj kr d} |jj |d< |jj |d < nnt|jtj!kr2d } |jj"|d
< nHt|jtj#krpd!} |jj"rz|jj"d"krz|jj"|d
< n
t|jtj$krd} nt|jtj%krd} |jj |d< nt|jtj&krd#} |jj |d< nt|jtj'kr4d} |jj |d< |jj |d < |jj(dkr|jj(|d< |jj)dkrz|jj)|d< nFt|jtj*krdd} |jj |d< |jj |d < nt+t,j-d$t|j |d || | |d |j.rt|j.tj/kr\i }|j.j0r|j.j0|d%< |j.j1r|j.j1|d&< |j.j2r:|d |d'| |d( |d)d
|j.j2j"i |d* |d' n|d |d'| |d ni }|j.j3rv|j.j3|d+< |j.j0r|j.j0|d%< |j.j4r|j.j4|d,< |j.j2r|d |d-| |d( |d)d
|j.j2j"i |d* |d- n|d |d-| |d |j5ri }|j5j2rz|d |d.i |d( |d)d
|j5j2j"i |d* |d. n|d |d.| |d |j6rd}
i }t|j6tj7krd/}
n|t|j6tj8krd0}
|j6jr>|j6j|d1< nNt|j6tj9krd2}
n6t|j6tj:kr,d3}
|j6j;|d4< nt. z r r; r0 r1 r5 z"Unknown element '%s' in obj_writerrL rG r z
rU z
rO rP rN rQ rA rB rE rC rD rF zUnknown action '%s')=r ignorableWhitespace startElementZ
characters
endElementr r
r\
simpleElementra rf ri r6 rn rp r rS rT rX r addrr r= r> r; rW rE r rZ r r^ r r re r/ rg rk rh rj rl r
to_addressro r r ZINVALID_OBJECTr ry rL rG rU rO r rQ rr rs rt ru rv rF rI ) r| handlerr r r ZicmpZforwardr( rR rW rr r$ r$ r)
common_writer s
r c sN e Zd ZdZdZeZdgZdddddd gfd
d gfd d gfd
ddgfdd gfdd gfdd gfddd gfdd gffZg dZ dddgdgddgdgdgdddgdddd gddgddddddd gd gdgdgd Z
d d gd!d"gd#d gg d$g d%d&d'gg d(d)gd gd* Z fd+d,Z d-d. Z
fd/d0Z fd1d2Zd3d4 Z fd5d6Z ZS )7r i i r )versionr3 )r r3 )r r3 )targetr3 r\ r3 ra )r3 r3 ri )r6 Frn )r3 r3 r3 r3 r rf rp )rT r
ingress_zones egress_zones)_r! /Nr r r r r/ rF )r r policyr r r4 r5 r6 r7 rR r r; r r: r rN rQ rA rB rC rD rU ingress-zone egress-zoner rT r8 r9 rS )r< r r> rS r= )r< r> r= rL rG )rO rL rP rE ) r r7 rR r r; r rN rB r0 c s t t| d| _d| _d| _t| _g | _g | _ g | _
g | _ d| _ d| _
g | _g | _g | _g | _d| _| j| _d | _g | _g | _d S Nr3 F)superr __init__r r r r r r\ ra rf ri icmp_block_inversionr6 rn rp r r appliedpriority_defaultrT rc r r self __class__r$ r) r ' s( zPolicy.__init__c C s d| _ d| _d| _t| _| jd d = | jd d = | jd d = | jd d = d| _ d| _
| j d d = | j d d = | j
d d = | jd d = d| _| j| _| jd d = | jd d = d S r )r r r r r r\ ra rf ri r r6 rn rp r r r r rT r r r r$ r$ r) cleanup= s$ zPolicy.cleanupc s" |dkr| j S ttt| |S d S )Nr )r getattrr r r r r r$ r) __getattr__Q s zPolicy.__getattr__c sB |dkr,dd |D | _ dd | j D | _ntt| || d S )Nr c S s g | ]}t j|d qS )r )r r{ r- r r$ r$ r) r. Y r+ z&Policy.__setattr__..c S s g | ] }t |qS r$ )rX r r$ r$ r) r. [ r+ )r r r r __setattr__)r r r/ r r$ r) r W s zPolicy.__setattr__c
C s t | |||| | j|d v r2ttjd| j|dkr\|tvrXttjd| j|n|dkr|| jv s|| j ks|| j
k rttj d| j|| j
| j | jnH|dv rdd gt |d
}|D ]}||vrttjd
| j||d vrtdd gt|@ s.|d v rDt|t|g rDttjd | j||d kr|d
krnd|v rnd |d v s|dkrd
|v rd |d
v rttjd| jqΐnL|dkr|rd|v rd |d v rttjd| jnd
|v rd |d
v rttjd| j|d
D ]r}|dkr(q||d vrLttjd| j||d ddkr|d | jrttjd| j|qnb|dkr|D ]p}tj|d}|jrt|jtjrd|v rd |d v rttjd| jnd
|v r d |d
v r ttjd| j|d
D ]r}|dkr:q(||d vr^ttjd| j||d ddkr(|d | jr(ttjd| j|q(q|jrt|jtjrd|v r d |d v r|jjrttjd| jn|d r |jjsttjd| jd|d vr |d D ]P}||d vrVttjd| j||d | jr.ttjd | j|q.n|jrt|jtjrd|v r|d D ]^}|d v rq||d vrttjd| j||d | jrttjd | j|qqn|d kr|D ]} d|v r d |d v r\| d rttjd| jn|d r | d sttjd| jd|d vr |d D ]P}||d vrttjd| j||d | jrttjd | j|qq d S ) NZzonesz0Policy '{}': Can't have the same name as a zone.r z#Policy '{}': '{}' is invalid targetrT z^Policy '{}': {} is invalid priority. Must be in range [{}, {}]. The following are reserved: {})r r ANYHOSTz*Policy '{}': '{}' not among existing zones)r r zKPolicy '{}': '{}' may only contain one of: many regular zones, ANY, or HOSTr r zSPolicy '{}': 'HOST' can only appear in either ingress or egress zones, but not bothr6 z;Policy '{}': 'masquerade' is invalid for egress zone 'HOST'z r? r< r r= )r> zUnknown XML element '%s')r r rY r[ Zparser_check_element_attrsr r rz rT r r r r r r r] r rI r rV r rX rq r Z Rich_Source)r r r( r r> r r r= r$ r$ r) r sl
z"policy_ContentHandler.startElementc C s t | | t| | d S )N)r r r r r$ r$ r) r 5 s z policy_ContentHandler.endElementN)r r r r r r r$ r$ r$ r) r s @r Fc
C s t }| ds ttjd| | d d |_|s>||j | |_||_| t
j rZdnd|_ |j |_
t|}t }|| d|| f }t|dn}td }|| z|| W n: tjy } z ttjd| W Y d } ~ n
d } ~ 0 0 W d n1 s0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffixFT%s/%srbznot a valid policy file: %s)r r r r r r r filenamepathr r
ETC_FIREWALLDZbuiltindefaultr saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZINVALID_POLICYZ getException)
r r Z
no_check_namer r parserr fr msgr$ r$ r) r : s<
:r c
C s |r|n| j }| jr$d|| jf }nd|| jf }tj |rzt|d| W n2 ty } zt d|| W Y d }~n
d }~0 0 tj
|}| t j
rtj |stj t j
stt j
d t|d tj|ddd}t|}| i }| jr| jd kr| j|d
< | j| jkr0t| j|d < | j|d < |d
| |d t| | t| j D ]*} |d | dd| i |d qdt| j D ]*} |d | dd| i |d q| d
|d | |! ~d S )Nr z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr3 r rT r r r r r r r )"r r r osexistsshutilcopy2r r rH dirnamer r r mkdirior r Z
startDocumentr rT r rX r r r r r
r r r r Z endDocumentclose)
r r _pathr r dirpathr r r( r r$ r$ r) r W sN $
r )F)N)+__all__Zxml.saxr r r r Zfirewallr Zfirewall.functionsr r r r r
r r r
Zfirewall.core.baser r r Zfirewall.core.io.io_objectr r r r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r r r r r r r r r$ r$ r$ r) s2 (
]d w L