a
iI @ s g d Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m
Z
m Z m Z m
Z
mZ ddlmZmZ ddlmZmZmZ ddlmZmZmZmZ ddlm Z dd l m Z dd
lm Z dd l m!Z! G d d
d
eZ"G dd deZ#dddZ$dddZ%dS ))Zone zone_reader zone_writer N)config) checkIPnMask
checkIP6nMaskcheckInterfaceuniqifymax_zone_name_len check_mac)DEFAULT_ZONE_TARGET ZONE_TARGETS) IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator)common_startElementcommon_endElementcommon_check_config
common_writer)rich)log)errors)
FirewallErrorc sX e Zd ZdZdddddddgfd d
gfd dgfd d
dgfddgfddgfddgfddgfdd
gfddfZg dZddddgddgdgdgdddgdgddddgddgddddddd gdgdd Zg d d gd d!gd"d#gg d$g d%d&d'gg d(d)gdgd*
Zed+d, Z fd-d.Z
d/d0 Z fd1d2Z fd3d4Z
d5d6 Z fd7d8Zd9d: Z ZS );r z Zone class )version )shortr ) descriptionr )UNUSEDF)targetr servicesr ports)r r icmp_blocks)
masqueradeF
forward_ports)r r r r
interfacessources rules_str protocols source_ports)icmp_block_inversionF)forwardT)_-/Nnameportprotocolvalueset)r r zoneservicer/ z
icmp-blockz icmp-typer* forward-port interfacerulesource destinationr0 z source-portr nflogauditZacceptrejectZdropZmarklimiticmp-block-inversion)r. immutabler r Zenabledzto-portzto-addrfamilypriority)addressmacinvertr@ ipset)rB rD rE prefixlevel)grouprF z
queue-sizetype)
r3 r" r5 r7 r8 r9 r r: r< z
tcp-mss-clampc C s8 t tjD ] \}\}}|| kr
| S q
ttjdd S )Nz
index_of()) enumerater IMPORT_EXPORT_STRUCTUREr r Z
UNKNOWN_ERROR)elementielZdummy rO 9/usr/lib/python3.9/site-packages/firewall/core/io/zone.pyindex_off s
z
Zone.index_ofc s t t| d| _d| _d| _d| _t| _g | _ g | _
g | _ g | _ d| _
d| _g | _g | _g | _g | _g | _g | _d| _d| _d| _d S Nr FT)superr __init__r r r r r r r r r' r! r* r" r# r( r$ r% rulesr& r) combinedappliedself __class__rO rP rT m s* z
Zone.__init__c C s d| _ d| _d| _d| _t| _| jd d = | jd d = | jd d = | j d d = d| _
d| _ | j d d = | j
d d = | jd d = | jd d = | jd d = | jd d = d| _d| _d| _d S rR )r r r r r r r r r' r! r* r" r# r( r$ r% rU r& r) rV rW rX rO rO rP cleanup s( z Zone.cleanupc sN |dkr8dd |D | _ tt| |dd | j D ntt| || d S )Nr& c S s g | ]}t j|d qS ))Zrule_str)r Z Rich_Rule.0srO rO rP
z$Zone.__setattr__..c S s g | ] }t |qS rO )strr] rO rO rP r` ra )rU rS r __setattr__)rY r. r1 rZ rO rP rc s zZone.__setattr__c s t t| }|d= |S )Nr )rS r export_config_dict)rY ZconfrZ rO rP rd s zZone.export_config_dictc C sv t | |||| | j|d v r2ttjd| j|dkr\|tvrXttjd| j|n|dkr|D ]f}t|sttj d| j||d D ]:}|| jkrq||d | j
v rttj d| j||qqhn|d krr|D ]}t |s$t |s$t
|s$|d
s$ttjd | j||d D ]B}|| jkr@q,||d | jv r,ttjd | j||q,qd S )
NZpoliciesz0Zone '{}': Can't have the same name as a policy.r z Zone '{}': invalid target '{}'r$ z!Zone '{}': invalid interface '{}'Zzonesz4Zone '{}': interface '{}' already bound to zone '{}'r% ipset:z Zone '{}': invalid source '{}'z1Zone '{}': source '{}' already bound to zone '{}')r r. r r Z
NAME_CONFLICTformatr
INVALID_TARGETr ZINVALID_INTERFACEr$ r r r
startswith INVALID_ADDRr% )rY r itemZ
all_configZall_io_objectsr6 r3 r8 rO rO rP
_check_config sT
zZone._check_configc s t t| | |dr.ttjd|n|drLttjd|nl| ddkrnttjd|nJd|v r|d |
d }n|}t |t krttjd|t |t d S )Nr- z$Zone '{}': name can't start with '/'z"Zone '{}': name can't end with '/' z%Zone '{}': name has more than one '/'z'Zone '{}': name has {} chars, max is {})
rS r
check_namerh r r INVALID_NAMErf endswithcountfindlenr
)rY r. Z checked_namerZ rO rP rm s,
zZone.check_namec
C s d| _ d | _d| _d| _d| _|jD ]}|| jvr$| j| q$|jD ]}|| jvrF| j| qF|jD ]}|| jvrh| j| qh|j D ]}|| j vr| j | q|j
D ]}|| j
vr| j
| q|j D ]}|| j vr| j | q|j rd| _ |j
rd| _
|jD ] }|| jvr
| j| q
|jD ] }|| jvr0| j| q0|jD ]"} | j| | jt| qV|jrd| _d S )NTr )rV filenamer r r r$ appendr% r r r' r! r* r" r# r( rU r& rb r) )
rY r3 r6 r8 r4 r/ protoZicmpr* r7 rO rO rP combine sL
z Zone.combine)__name__
__module__ __qualname____doc__rK ZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRS staticmethodrQ rT r\ rc rd rk rm rv
__classcell__rO rO rZ rP r ( s
% r c @ s$ e Zd Zdd Zdd Zdd ZdS )zone_ContentHandlerc C s" t | | d | _d| _d | _d S )NF)r rT _rule _rule_errorZ _limit_ok)rY rj rO rO rP rT
s z zone_ContentHandler.__init__c C s t | || | jrd S | j|| t| ||r6d S |dkrd|v rVtd|d d|v rj|d | j_d|v rtd|d d|v r|d }|t vrt
t j ||dkr|t
kr|| j_n|d kr| jjrtd
nd | j_n|d krh| jrtd
d | _d S d|vr.td d | _d S |d | jjvrT| jj|d ntd|d n2|dkr`| jr | jjrtdt| j d | _d S d}d|v r|d dv rd }d } }}d|v r|d }d|v r|d }d|v r|d }tj||||d| j_d S d|vrBd|vrBtd d S d|v rdd|v rdtd d S d|v r~td |d d|v rtd d S d|v rt|d st|d st|d st
t j|d d|v r d |d }|| jj vr| jj | ntd |d d|v r|d }|| jj vrN| jj | ntd |d n:|d kr| jj rtd! nd | j_ ntd"| d S d S )#Nr3 r. z'Ignoring deprecated attribute name='%s'r r? z,Ignoring deprecated attribute immutable='%s'r r r* z Forward already set, ignoring.Tr6 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r8 z:Invalid rule: More than one source in rule '%s', ignoring.FrD )ZyestruerB rC rE )rD z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.r@ z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.r> z+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s') r startElementr rj Zparser_check_element_attrsr r Zwarningr r
r r rg r r r* r~ r$ rt r8 rb lowerr Z Rich_Sourcer r r ri r% r) ) rY r. attrsr rD addrrC rE entryrO rO rP r s
z zone_ContentHandler.startElementc C s t | | t| | d S )N)r
endElementr )rY r. rO rO rP r s z zone_ContentHandler.endElementN)rw rx ry rT r r rO rO rO rP r} s pr} Fc
C s& t }| ds ttjd| | d d |_|s>||j | |_||_| t
j rZdnd|_ |j |_
d|_t|}t }|| d|| f }t|dn}td }|| z|| W n: tjy } z ttjd| W Y d } ~ n
d } ~ 0 0 W d n1 s0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffixFT%s/%srbznot a valid zone file: %s)r ro r r rn r. rm rs pathrh r
ETC_FIREWALLDZbuiltindefaultr* r} saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZ INVALID_ZONEZ getException)
rs r Z
no_check_namer3 handlerparserr. fr8 msgrO rO rP r s>
:r c
C sT |r|n| j }| jr$d|| jf }nd|| jf }tj |rzt|d| W n2 ty } zt d|| W Y d }~n
d }~0 0 tj
|}| t j
rtj |stj t j
stt j
d t|d tj|ddd}t|}| i }| jr| jd kr| j|d
< | jtkr*| j|d < |d | |d
t| | t| jD ]*} |d |dd| i |d
qTt| j D ]N}
|d d|
v r|dd|
dd i n|dd|
i |d
q| j r|d |di |d
| j r*|d |di |d
| d |d
| |! ~d S )Nr z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr r r r3
z r6 r. re r8 rE rB r> r* )"r rs r. osexistsshutilcopy2 Exceptionr errordirnamerh r r mkdirior r Z
startDocumentr r r r ZignorableWhitespacer r r$ Z
simpleElementr% r) r* r Z endDocumentclose) r3 r _pathr. r dirpathr r r r6 r8 rO rO rP r s` $
r )F)N)&__all__Zxml.saxr r r r Zfirewallr Zfirewall.functionsr r r r r
r Zfirewall.core.baser r
Zfirewall.core.io.io_objectr r r Zfirewall.core.io.policyr r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r r} r r rO rO rO rP s$ e|
!