| Current File : //lib/python3.9/site-packages/firewall/core/io/__pycache__/zone.cpython-39.pyc |
a
���g�I � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m
Z
m Z m Z m
Z
mZ ddlmZmZ ddlmZmZmZ ddlmZmZmZmZ ddlm Z dd l m Z dd
lm Z dd l m!Z! G d d
� d
e�Z"G dd� de�Z#ddd�Z$ddd�Z%dS ))�Zone� zone_reader� zone_writer� N)�config)� checkIPnMask�
checkIP6nMask�checkInterface�uniqify�max_zone_name_len� check_mac)�DEFAULT_ZONE_TARGET� ZONE_TARGETS)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�common_startElement�common_endElement�common_check_config�
common_writer)�rich)�log)�errors)�
FirewallErrorc sX e Zd ZdZdddddddgfd d
gfd dgfd d
dgfddgfddgfddgfddgfdd
gfddfZg d�Zddddgddgdgdgdddgdgddddgddgddddddd gdgdd �Zg d �d gd d!gd"d#gg d$�g d%�d&d'gg d(�d)gdgd*�
Zed+d,� �Z � fd-d.�Z
d/d0� Z � fd1d2�Z � fd3d4�Z
d5d6� Z� fd7d8�Zd9d:� Z� ZS );r z Zone class )�version� )�shortr )� descriptionr )�UNUSEDF)�targetr �servicesr �ports)r r � icmp_blocks)�
masqueradeF�
forward_ports)r r r r �
interfaces�sources� rules_str� protocols� source_ports)�icmp_block_inversionF)�forwardT)�_�-�/N�name�port�protocol�value�set)r r �zone�servicer/ z
icmp-blockz icmp-typer* � forward-port� interface�rule�source� destinationr0 z source-portr �nflog�auditZaccept�rejectZdropZmark�limit�icmp-block-inversion)r. � immutabler r Zenabledzto-portzto-addr�family�priority)�address�mac�invertr@ �ipset)rB rD rE �prefix�level)�grouprF z
queue-size�type)
r3 r" r5 r7 r8 r9 r r: r< z
tcp-mss-clampc C s8 t tj�D ] \}\}}|| kr
| S q
ttjd��d S )Nz
index_of())� enumerater �IMPORT_EXPORT_STRUCTUREr r Z
UNKNOWN_ERROR)�element�i�elZdummy� rO �9/usr/lib/python3.9/site-packages/firewall/core/io/zone.py�index_off s
z
Zone.index_ofc s� t t| ��� d| _d| _d| _d| _t| _g | _ g | _
g | _ g | _ d| _
d| _g | _g | _g | _g | _g | _g | _d| _d| _d| _d S �Nr FT)�superr �__init__r r r r r r r r r' r! r* r" r# r( r$ r% �rulesr& r) �combined�applied��self�� __class__rO rP rT m s* z
Zone.__init__c C s� d| _ d| _d| _d| _t| _| jd d �= | jd d �= | jd d �= | j d d �= d| _
d| _ | j d d �= | j
d d �= | jd d �= | jd d �= | jd d �= | jd d �= d| _d| _d| _d S rR )r r r r r r r r r' r! r* r" r# r( r$ r% rU r& r) rV rW rX rO rO rP �cleanup� s( z Zone.cleanupc sN |dkr8dd� |D �| _ tt| ��|dd� | j D �� ntt| ��||� d S )Nr& c S s g | ]}t j|d ��qS ))Zrule_str)r Z Rich_Rule��.0�srO rO rP �
<listcomp>� � z$Zone.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS rO )�strr] rO rO rP r` � ra )rU rS r � __setattr__)rY r. r1 rZ rO rP rc � s zZone.__setattr__c s t t| ��� }|d= |S )Nr )rS r �export_config_dict)rY ZconfrZ rO rP rd � s zZone.export_config_dictc C sv t | ||||� | j|d v r2ttjd�| j���|dkr\|tvrXttjd�| j|����n|dkr�|D ]f}t|�s�ttj d�| j|���|d D ]:}|| jkr�q�||d | j
v r�ttj d�| j||���q�qhn�|d k�rr|D ]�}t |��s$t |��s$t
|��s$|�d
��s$ttjd �| j|���|d D ]B}|| jk�r@�q,||d | jv �r,ttjd �| j||����q,q�d S )
NZpoliciesz0Zone '{}': Can't have the same name as a policy.r z Zone '{}': invalid target '{}'r$ z!Zone '{}': invalid interface '{}'Zzonesz4Zone '{}': interface '{}' already bound to zone '{}'r% �ipset:z Zone '{}': invalid source '{}'z1Zone '{}': source '{}' already bound to zone '{}')r r. r r Z
NAME_CONFLICT�formatr
�INVALID_TARGETr ZINVALID_INTERFACEr$ r r r �
startswith� INVALID_ADDRr% )rY r �itemZ
all_configZall_io_objectsr6 r3 r8 rO rO rP �
_check_config� sT
�
�
��
��
� ��zZone._check_configc s� t t| ��|� |�d�r.ttjd�|���n�|�d�rLttjd�|���nl|� d�dkrnttjd�|���nJd|v r�|d |�
d�� }n|}t |�t � kr�ttjd�|t |�t � ���d S )Nr- z$Zone '{}': name can't start with '/'z"Zone '{}': name can't end with '/'� z%Zone '{}': name has more than one '/'z'Zone '{}': name has {} chars, max is {})
rS r �
check_namerh r r � INVALID_NAMErf �endswith�count�find�lenr
)rY r. Z checked_namerZ rO rP rm � s,
�
�� ��zZone.check_namec
C s� d| _ d | _d| _d| _d| _|jD ]}|| jvr$| j�|� q$|jD ]}|| jvrF| j�|� qF|jD ]}|| jvrh| j�|� qh|j D ]}|| j vr�| j �|� q�|j
D ]}|| j
vr�| j
�|� q�|j D ]}|| j vr�| j �|� q�|j r�d| _ |j
�rd| _
|jD ] }|| jv�r
| j�|� �q
|jD ] }|| jv�r0| j�|� �q0|jD ]"} | j�| � | j�t| �� �qV|j�r�d| _d S )NTr )rV �filenamer r r r$ �appendr% r r r' r! r* r" r# r( rU r& rb r) )
rY r3 r6 r8 r4 r/ �protoZicmpr* r7 rO rO rP �combine� sL
z Zone.combine)�__name__�
__module__� __qualname__�__doc__rK ZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRS� staticmethodrQ rT r\ rc rd rk rm rv �
__classcell__rO rO rZ rP r ( s� ���
% r c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�zone_ContentHandlerc C s" t �| |� d | _d| _d | _d S )NF)r rT �_rule� _rule_errorZ _limit_ok)rY rj rO rO rP rT
s z zone_ContentHandler.__init__c C s� t �| ||� | jrd S | j�||� t| ||�r6d S |dkr�d|v rVt�d|d � d|v rj|d | j_d|v r�t�d|d � d|v r�|d }|t vr�t
t j |��|dkr�|t
kr�|| j_�n�|d kr�| jjr�t�d
� nd | j_�n�|d k�rh| j�rt�d
� d | _d S d|v�r.t�d� d | _d S |d | jjv�rT| jj�|d � nt�d|d � �n2|dk�r`| j�r | jj�r�t�dt| j�� d | _d S d}d|v �r�|d �� dv �r�d }d } }}d|v �r�|d }d|v �r�|d }d|v �r|d }tj||||d�| j_d S d|v�rBd|v�rBt�d� d S d|v �rdd|v �rdt�d� d S d|v �r~t�d |d � d|v �r�t�d � d S d|v �r�t|d ��s�t|d ��s�t|d ��s�t
t j|d ��d|v �r d |d }|| jj v�r| jj �|� nt�d |d � d|v �r�|d }|| jj v�rN| jj �|� nt�d |d � n:|d k�r�| jj �r�t�d!� nd | j_ nt�d"|� d S d S )#Nr3 r. z'Ignoring deprecated attribute name='%s'r r? z,Ignoring deprecated attribute immutable='%s'r r r* z Forward already set, ignoring.Tr6 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r8 z:Invalid rule: More than one source in rule '%s', ignoring.FrD )Zyes�truerB rC rE )rD z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.r@ z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.r> z+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s') r � startElementr rj Zparser_check_element_attrsr r Zwarningr r
r r rg r r r* r~ r$ rt r8 rb �lowerr Z Rich_Sourcer r r ri r% r) ) rY r. �attrsr rD �addrrC rE �entryrO rO rP r� s� � �
�
�
�
�
�
�
�
�
�
z zone_ContentHandler.startElementc C s t �| |� t| |� d S )N)r �
endElementr )rY r. rO rO rP r� � s z zone_ContentHandler.endElementN)rw rx ry rT r� r� rO rO rO rP r} s pr} Fc
C s& t � }| �d�s ttjd| ��| d d� |_|s>|�|j� | |_||_|� t
j �rZdnd|_ |j |_
d|_t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd| �� ��W Y d } ~ n
d } ~ 0 0 W d � n1 �s0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid zone file: %s)r ro r r rn r. rm rs �pathrh r �
ETC_FIREWALLDZbuiltin�defaultr* r} �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZ INVALID_ZONEZ getException)
rs r� Z
no_check_namer3 �handler�parserr. �fr8 �msgrO rO rP r � s>
�
��:r c
C sT |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n
d }~0 0 tj �
|�}|� t j
�r�tj �|�s�tj �t j
�s�t�t j
d� t�|d� tj|ddd�}t|�}|�� i }| j�r| jd k�r| j|d
< | jtk�r*| j|d < |�d |� |�d
� t| |� t| j�D ]*} |�d� |�dd| i� |�d
� �qTt| j �D ]N}
|�d� d|
v �r�|�dd|
dd � i� n|�dd|
i� |�d
� �q�| j �r|�d� |�di � |�d
� | j �r*|�d� |�di � |�d
� |� d � |�d
� |� � |�!� ~d S )Nr� z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r3 �
z r6 r. re r8 rE � rB r> r* )"r� rs r. �os�exists�shutil�copy2� Exceptionr �error�dirnamerh r r� �mkdir�ior� r Z
startDocumentr r r r� ZignorableWhitespacer r r$ Z
simpleElementr% r) r* r� Z endDocument�close) r3 r� �_pathr. r� �dirpathr� r� r� r6 r8 rO rO rP r � s` $
r )F)N)&�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r
r Zfirewall.core.baser r
Zfirewall.core.io.io_objectr r r Zfirewall.core.io.policyr r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r r} r r rO rO rO rP �<module> s$ e|
!