3
Yj8 @ s d ddddddddd d
d d d
ddddgZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd d e
Z G dd de
Z G dd de
Z
G dd de
ZG d d deZG d d de
ZG d d de
ZG d d de
ZG d d de
ZG d!d d e
ZG d"d
d
e
ZG d#d d e
ZG d$d d e
ZG d%d
d
e
ZG d&d deZG d'd de
Zd(d)d/d1d+ZG d,d de
Z G d-d de
Z d.S )2 Rich_SourceRich_Destination Rich_Service Rich_Port
Rich_ProtocolRich_MasqueradeRich_IcmpBlock
Rich_IcmpTypeRich_SourcePortRich_ForwardPortRich_Log
Rich_Audit Rich_Accept Rich_Reject Rich_Drop Rich_Mark
Rich_Limit Rich_Rule ) functions)check_ipset_name) REJECT_TYPES)errors)
FirewallErrorc @ s e Zd ZdddZdd ZdS )r Fc C s || _ | j dkrd | _ || _| jdks0| jd kr8d | _n| jd k rN| jj | _|| _| jdkrdd | _|| _| j d kr| jd kr| jd krttjdd S )N zno address, mac and ipset)addrmacupperipsetinvertr r INVALID_RULE)selfr r r r r! /usr/lib/python3.6/rich.py__init__$ s
zRich_Source.__init__c C sj d| j r dnd }| jd k r*|d| j S | jd k rB|d| j S | jd k rZ|d| j S ttjdd S )Nz source%s z NOTr z address="%s"zmac="%s"z
ipset="%s"zno address, mac and ipset)r r r r r r r )r retr! r! r" __str__5 s
zRich_Source.__str__N)F)__name__
__module__ __qualname__r# r% r! r! r! r" r # s
c @ s e Zd ZdddZdd ZdS )r Fc C sV || _ | j dkrd | _ || _| jdkr,d | _|| _| j d krR| jd krRttjdd S )Nr zno address and ipset)r r r r r r )r r r r r! r! r" r# B s
zRich_Destination.__init__c C sR d| j r dnd }| jd k r*|d| j S | jd k rB|d| j S ttjdd S )Nzdestination%s z NOTr z address="%s"z
ipset="%s"zno address and ipset)r r r r r r )r r$ r! r! r" r% N s
zRich_Destination.__str__N)F)r& r' r( r# r% r! r! r! r" r A s
c @ s e Zd Zdd Zdd ZdS )r c C s
|| _ d S )N)name)r r) r! r! r" r# Y s zRich_Service.__init__c C s
d| j S )Nzservice name="%s")r) )r r! r! r" r% \ s zRich_Service.__str__N)r& r' r( r# r% r! r! r! r" r X s c @ s e Zd Zdd Zdd ZdS )r c C s || _ || _d S )N)portprotocol)r r* r+ r! r! r" r# ` s zRich_Port.__init__c C s d| j | jf S )Nz port port="%s" protocol="%s")r* r+ )r r! r! r" r% d s zRich_Port.__str__N)r& r' r( r# r% r! r! r! r" r _ s c @ s e Zd Zdd ZdS )r c C s d| j | jf S )Nz#source-port port="%s" protocol="%s")r* r+ )r r! r! r" r% h s zRich_SourcePort.__str__N)r& r' r( r% r! r! r! r" r g s c @ s e Zd Zdd Zdd ZdS )r c C s
|| _ d S )N)value)r r, r! r! r" r# m s zRich_Protocol.__init__c C s
d| j S )Nzprotocol value="%s")r, )r r! r! r" r% p s zRich_Protocol.__str__N)r& r' r( r# r% r! r! r! r" r l s c @ s e Zd Zdd Zdd ZdS )r c C s d S )Nr! )r r! r! r" r# t s zRich_Masquerade.__init__c C s dS )N
masquerader! )r r! r! r" r% w s zRich_Masquerade.__str__N)r& r' r( r# r% r! r! r! r" r s s c @ s e Zd Zdd Zdd ZdS )r c C s
|| _ d S )N)r) )r r) r! r! r" r# { s zRich_IcmpBlock.__init__c C s
d| j S )Nzicmp-block name="%s")r) )r r! r! r" r% ~ s zRich_IcmpBlock.__str__N)r& r' r( r# r% r! r! r! r" r z s c @ s e Zd Zdd Zdd ZdS )r c C s
|| _ d S )N)r) )r r) r! r! r" r# s zRich_IcmpType.__init__c C s
d| j S )Nzicmp-type name="%s")r) )r r! r! r" r% s zRich_IcmpType.__str__N)r& r' r( r# r% r! r! r! r" r s c @ s e Zd Zdd Zdd ZdS )r
c C s< || _ || _|| _|| _| jd kr(d| _| jd kr8d| _d S )Nr )r* r+ to_port
to_address)r r* r+ r. r/ r! r! r" r# s
zRich_ForwardPort.__init__c C s< d| j | j| jdkr d| j nd| jdkr4d| j ndf S )Nz(forward-port port="%s" protocol="%s"%s%sr z
to-port="%s"z
to-addr="%s")r* r+ r. r/ )r r! r! r" r% s zRich_ForwardPort.__str__N)r& r' r( r# r% r! r! r! r" r
s c @ s e Zd ZdddZdd ZdS )r Nc C s || _ || _|| _d S )N)prefixlevellimit)r r0 r1 r2 r! r! r" r# s zRich_Log.__init__c C s> d| j rd| j nd| jr$d| j nd| jr6d| j ndf S )Nz log%s%s%sz prefix="%s"r z level="%s"z %s)r0 r1 r2 )r r! r! r" r% s zRich_Log.__str__)NNN)r& r' r( r# r% r! r! r! r" r s
c @ s e Zd ZdddZdd ZdS )r Nc C s
|| _ d S )N)r2 )r r2 r! r! r" r# s zRich_Audit.__init__c C s d| j rd| j nd S )Nzaudit%sz %sr )r2 )r r! r! r" r% s zRich_Audit.__str__)N)r& r' r( r# r% r! r! r! r" r s
c @ s e Zd ZdddZdd ZdS )r
Nc C s
|| _ d S )N)r2 )r r2 r! r! r" r# s zRich_Accept.__init__c C s d| j rd| j nd S )Nzaccept%sz %sr )r2 )r r! r! r" r% s zRich_Accept.__str__)N)r& r' r( r# r% r! r! r! r" r
s
c @ s& e Zd ZdddZdd Zdd ZdS ) r Nc C s || _ || _d S )N)typer2 )r Z_typer2 r! r! r" r# s zRich_Reject.__init__c C s, d| j rd| j nd| jr$d| j ndf S )Nz
reject%s%sz
type="%s"r z %s)r3 r2 )r r! r! r" r% s zRich_Reject.__str__c C sT | j rP|sttjd|dkrP| j t| krPdjt| }ttjd| j |f d S )Nz9When using reject type you must specify also rule family.ipv4ipv6z, z%Wrong reject type %s.
Use one of: %s.)r4 r5 )r3 r r r r join)r familyZ valid_typesr! r! r" check s zRich_Reject.check)NN)r& r' r( r# r% r8 r! r! r! r" r s
c @ s e Zd Zdd ZdS )r c C s d| j rd| j nd S )Nzdrop%sz %sr )r2 )r r! r! r" r% s zRich_Drop.__str__N)r& r' r( r% r! r! r! r" r s c @ s& e Zd ZdddZdd Zdd ZdS ) r Nc C s || _ || _d S )N)setr2 )r Z_setr2 r! r! r" r# s zRich_Mark.__init__c C s d| j | jrd| j ndf S )Nz
mark set=%s%sz %sr )r9 r2 )r r! r! r" r% s zRich_Mark.__str__c C s | j d k r| j }n ttjdd|krv|jd}t|dkrHttj|tj|d shtj|d rttj|ntj|sttj|d S )Nz no value set/ r )r9 r r Z INVALID_MARKsplitlenr Z checkUINT32)r xsplitsr! r! r" r8 s
zRich_Mark.check)N)r& r' r( r# r% r8 r! r! r! r" r s
r< < )smhdc @ s e Zd ZdddZdd Zedd Zejdd Zed d
Zejd d
Ze d d
Z
dd Z e dd Z dd Z
dd ZdS )r Nc C s || _ || _d S )N)r, burst)r r, rG r! r! r" r# s zRich_Limit.__init__c C s | j | j d S )N) value_parse burst_parse)r r! r! r" r8 s zRich_Limit.checkc C s | j S )N)_value)r r! r! r" r, s zRich_Limit.valuec C sf |d krd | _ d S y| j|\}}W n tk
r< |}Y nX | d| }t| dd |krb|| _ d S )Nr: rJ )rJ _value_parser getattr)r r, ratedurationvr! r! r" r, s
c C s | j S )N)_burst)r r! r! r" rG s zRich_Limit.burstc C s\ |d krd | _ d S y| j|}W n tk
r8 |}Y n
X t|}t| dd |krX|| _ d S )NrP )rP _burst_parser strrL )r rG br! r! r" rG s
c C s d }d| kr| j d}| s(t|dkr4ttj| |\}}y t|}W n ttj| Y nX |dkrv|d d }|dk s|dkrttj| d t| | d
krttjd| f |dkr|d krttjd| f ||fS )Nr: r; secondminutehourdayr< rC rD rE rF i' r z %s too fastz %s too slow)rT rU rV rW )rC rD rE rF )r= r> r r
INVALID_LIMITintDURATION_TO_MULT)r, r@ rM rN r! r! r" rK s&
zRich_Limit._value_parsec C s | j | jS )N)rK rJ )r r! r! r" rH : s zRich_Limit.value_parsec C sR | d kr d S y t | }W n ttj| Y nX |dk sB|dkrNttj| |S )Nr< i )rY r r rX )rG rS r! r! r" rQ = s zRich_Limit._burst_parsec C s | j | jS )N)rQ rP )r r! r! r" rI K s zRich_Limit.burst_parsec C s, d| j d}| jd k r(|d| j 7 }|S )Nz
limit value=""z burst=)rJ rP )r rC r! r! r" r% N s
zRich_Limit.__str__)N)r& r' r( r# r8 propertyr, setterrG staticmethodrK rH rQ rI r% r! r! r! r" r s
c @ s> e Zd ZdZdZdddZdd Zd d
Zd d Zd
d Z dS )r i i Nr c C sV |d k rt || _nd | _|| _d | _d | _d | _d | _d | _d | _|rR| j | d S )N)
rR r7 prioritysource destinationelementlogauditaction_import_from_string)r r7 rule_strr_ r! r! r" r# X s zRich_Rule.__init__c C s g }x|t j|D ]n}d|krp|jd}t|dksF|d sF|d rVttjd| |j|d |d d q|jd|i qW |jddi |S ) z Lexical analysis =r; r r< z internal error in _lexer(): %s) attr_name
attr_valuerb EOL)r Z splitArgsr= r> r r r append)r rg tokensrattrr! r! r" _lexeri s
zRich_Rule._lexerc C s |st tjdtj|}d| _d | _d | _d | _d | _ d | _
d | _ d | _ | j
|}|rv|d jddkrvt tjdi }g }d}x`|| jddko|dgks|| jd}|| jd}|| jd}| r|dHkrt tjd| n|dIkr|dkr | jr t tjd+n|dkr<| jr|d
< nBt|jd
|jd |jd |jd
d?| _|j |j |d2 }n | dkr,|dOkr|||< nN|dPkrd>|d
< n:t|jd
|jd |jd
d?| _|j |j |d2 }n| dkrd|dkrTt|| _ |j n t tjd@nv| d kr|dkrt|| _ |j n t tjdAn>| dkr|dQkr|||< n0t|jd|jd| _ |j |j |d2 }n| d kr&|dkrt|| _ |j n t tjdBn| d kr^|dkrNt || _ |j n t tjdCn|| d krt | _ |j |j |d2 }nN| d kr|dRkr|||< n@t |jd|jd|jd|jd| _ |j |j |d2 }n| d!kr@|dSkr |||< n0t |jd|jd| _ |j |j |d2 }n| d"kr|dTkr^|||< nN|d(krt|jd( n8t |jd|jd|jd(| _
|j |j |d2 }n*| d#kr|d(kr|jd( n(t!|jd(| _ |j |j |d2 }n| d$krH|d(kr |jd( n(t"|jd(| _ |j |j |d2 }n| d%kr|d(krh|jd( n(t#|jd(| _ |j |j |d2 }nF| d&kr|dkr|||< nF|d(kr|jd( n0t$|jd|jd(| _ |j |j |d2 }n| d'kr`|dkr|||< nF|d(kr.|jd( n0t%|jd|jd(| _ |j |j |d2 }nz| d(kr|dUkr||dD| < nVdE|krt tjdFt&|dE |jdG|d(< |jdEd |jdGd |j |d2 }|d2 }qW | j' d S )VNz
empty ruler rb rk ruleri rj r_ r7 addressr r r r, r* r+ to-portto-addrr) r0 r1 r3 r9 rG zbad attribute '%s'r` ra service
icmp-block icmp-typer- forward-port source-portrc rd acceptdroprejectmarkr2 notNOTz more than one 'source' elementz#more than one 'destination' elementzFmore than one element. There cannot be both '%s' and '%s' in one rule.zmore than one 'log' elementz more than one 'audit' elementzOmore than one 'action' element. There cannot be both '%s' and '%s' in one rule.zunknown element %sr< r z0'family' outside of rule. Use 'rule family=...'.z4'priority' outside of rule. Use 'rule priority=...'.z:'%s' outside of any element. Use 'rule %s= ...'.z,'%s' outside of rule. Use 'rule ... %s ...'.r4 r5 zH'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead.z(invalid 'priority' attribute value '%s'.zdwrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'.zDattribute '%s' outside of any element. Use 'rule %s= ...'.TFzinvalid 'protocol' elementzinvalid 'service' elementz invalid 'icmp-block' elementzinvalid 'icmp-type' elementzlimit.z limit.valuezinvalid 'limit' elementz limit.burst)r_ r7 rr r r r r, r* r+ rs rt r) r0 r1 r3 r9 rG )rq r` ra r+ ru r* rv rw r- rx ry rc rd rz r{ r| r} r2 r~ r rk )r+ ru r* rv rw r- rx ry )rz r{ r| r} )r4 r5 )rr r r r )r~ r )rr r r )r~ r )r* r+ )r* r+ rs rt )r* r+ )r0 r1 )r, rG )(r r r r ZstripNonPrintableCharactersr_ r7 r` ra rb rc rd re rp getr> rl rY
ValueErrorINVALID_PRIORITYr popclearr r r r r r r r
r r r r
r r r r r8 ) r rg rm ZattrsZ in_elementsindexrb ri rj Z
in_elementZerr_msgr! r! r" rf z s
" "
*
"
(
z Rich_Rule._import_from_stringc C s` | j d k r"| j d kr"ttj| j | j d krn| jd k rB| jjd k sL| jd k rVttjt| j t
krnttj| j | j k s| j | j
krttjd| j | j
f | j d ko| jd ks| jd k o| j dkr
| jd krttjd| jd ko| jd ko| j dkr
ttjdt| j tt
tgkrP| jd krP| jd krP| jd krPttjd| jd k rj| jjd k r| j d krttj| jjd k rttjd| jjd k rttjd tj| j | jjsjttjt| jjn| jjd k r,| jjd k rttjd
tj| jjsjttj t| jjn>| jjd k r^t | jjsjttj t| jjn ttjd | jd k r | jjd k r| j d krttj| jjd k rttj d tj| j | jjs ttjt| jjn>| jjd k rt | jjs ttj t| jjn ttjd t| j t krd| j j!d ksLt"| j j!d
k r`ttj#t| j j!nt| j t$krtj%| j j&sttj'| j j&| j j(d!kr`ttj)| j j(nt| j t*krtj+| j j,s`ttj)| j j,nvt| j tkr<| jd k rttjd| jd k r`| jjd k r`ttjdn$t| j tkr| j j!d kslt"| j j!d
k rttj-t| j j!| jr`ttjdnt| j t.kr| j j!d kst"| j j!d
k r`ttj-t| j j!nt| j t
krtj%| j j&sttj'| j j&| j j(d"kr.ttj)| j j(| j j/dkrZ| j j0dkrZttj'| j j/| j j/dkrtj%| j j/ rttj'| j j/| j j0dkrtj1| j | j j0 rttj| j j0| j d krttj| jd k r`ttjdnrt| j t2kr>tj%| j j&s ttj'| j j&| j j(d#kr`ttj)| j j(n"| j d k r`ttjdt| j | jd k r| jj3r| jj3d$krttj4| jj3| jj5d k r| jj5j6 | jd k rt| jt7t8t9gkrttj:t| j| jj5d k r| jj5j6 | jd k r\t| jt8kr(| jj6| j nt| jt;krB| jj6 | jj5d k r\| jj5j6 d S )%Nr4 r5 z/'priority' attribute must be between %d and %d.r zno element, no actionz%no element, no source, no destinationzno action, no log, no auditzaddress and maczaddress and ipsetz
mac and ipsetzinvalid sourcezinvalid destinationr< tcpudpsctpdccpzmasquerade and actionzmasquerade and mac sourcezicmp-block and actionr zforward-port and actionzUnknown element %semergalertcriterrorwarningnoticeinfodebug)r4 r5 )r r r r )r r r r )r r r r )r r r r r r r r ) ZINVALID_SERVICEr Z
check_portr* Z INVALID_PORTr+ ZINVALID_PROTOCOLr Z
checkProtocolr, ZINVALID_ICMPTYPEr r. r/ Zcheck_single_addressr r1 ZINVALID_LOG_LEVELr2 r8 r
r r ZINVALID_AUDIT_TYPEr )r r! r! r" r8 h s
zRich_Rule.checkc C s d}| j r|d| j 7 }| jr,|d| j 7 }| jr@|d| j 7 }| jrT|d| j 7 }| jrh|d| j 7 }| jr||d| j 7 }| jr|d| j 7 }| jr|d| j 7 }tj rtj
|S |S )Nrq z priority="%d"z family="%s"z %s) r_ r7 r` ra rb rc rd re r ZPY2Zu2b)r r$ r! r! r" r% s$ zRich_Rule.__str__i )NNr )
r& r' r( r r r# rp rf r8 r% r! r! r! r" r T s
o -Ni i iQ ) __all__Zfirewallr Zfirewall.core.ipsetr Zfirewall.core.baser r Zfirewall.errorsr objectr r r r r r r r r r
r r r
r r r rZ r r r! r! r! r" s@
d