| Current File : //usr/lib/python2.7/site-packages/firewall/core/io/zone.pyc |
�
�c�`c @ sj d d d g Z d d l j Z d d l Z d d l Z d d l Z d d l m Z d d l m Z m
Z
m Z m Z m
Z
m Z m Z m Z m Z m Z d d l m Z m Z d d l m Z m Z m Z m Z m Z m Z m Z d d l m Z d d
l m! Z! d d l m" Z" d d l# m$ Z$ d e f d
� � YZ% d e f d � � YZ& e' d � Z( e) d � Z* d S( t Zonet zone_readert zone_writeri����N( t config(
t checkIPt checkIP6t checkIPnMaskt
checkIP6nMaskt checkInterfacet uniqifyt max_zone_name_lent
u2b_if_py2t check_mact portStr( t DEFAULT_ZONE_TARGETt ZONE_TARGETS( t PY2t IO_Objectt IO_Object_ContentHandlert IO_Object_XMLGeneratort
check_portt check_tcpudpt check_protocol( t rich( t log( t errors( t
FirewallErrorc B sE e Z d Z dA dB dC d e f dD d d g f d dE g f d d g f d
e f d dF g f d d g f d
d g f d d g f d d g f d dG g f d e f f Z d Z d d d g Z i dH d 6dH d 6dH d 6d g d 6d d g d 6d g d 6d g d 6d d g d 6d g d 6dH d 6dH d 6d! g d" 6d# g d 6d d g d$ 6dH d% 6dH d& 6dH d' 6dH d( 6dH d) 6d* g d+ 6d# g d, 6dH d- 6Z i d d. d d g d 6d/ g d
6d0 d1 g d 6d2 g d 6d! d3 d4 d2 d5 g d 6d4 g d" 6d6 d7 g d% 6d8 g d( 6Z e
d9 � � Z d: � Z d; � Z
d< � Z d= � Z d> � Z d? � Z d@ � Z RS(I s Zone class t versiont t shortt descriptiont UNUSEDt targett servicest portst icmp_blockst
masqueradet
forward_portst
interfacest sourcest rules_strt protocolst source_portst icmp_block_inversions& (sssbsasa(ss)asba(ssss)asasasasa(ss)b)t _t -t /t zonet namet servicet portt protocols
icmp-blocks icmp-types forward-portt interfacet rulet sourcet addresst destinationt values source-portR t auditt acceptt rejectt dropt sett markt limits icmp-block-inversiont immutablet enableds to-ports to-addrt familyt mact invertt ipsett prefixt levelt typec C sL x3 t t j � D]" \ } \ } } | | k r | Sq Wt t j d � � d S( Ns
index_of()( t enumerateR t IMPORT_EXPORT_STRUCTURER R t
UNKNOWN_ERROR( t elementt it elt dummy( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyt index_ofb s " c C s� t t | � j � d | _ d | _ d | _ t | _ t | _ g | _
g | _ g | _ g | _
t | _ g | _ g | _ g | _ g | _ d | _ g | _ g | _ t | _ t | _ t | _ d S( NR ( t superR t __init__R R R t FalseR R R R! R" R) R# R$ R% R* R& R' t Nonet fw_configt rulesR( R+ t combinedt applied( t self( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyRS i s* c C s� d | _ d | _ d | _ t | _ t | _ | j 2| j 2| j 2| j
2t | _ | j 2| j
2| j 2| j 2d | _ | j 2| j 2t | _ t | _ t | _ d S( NR ( R R R RT R R R R! R" R) R# R$ R% R* R& R' RU RV RW R( R+ RX RY ( RZ ( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyt cleanup� s( c C s t | j � | _ t | j � | _ t | j � | _ t | j � | _ g | j D] } t | � ^ qR | _ g | j D]$ \ } } t | � t | � f ^ qw | _ g | j D] } t | � ^ q� | _ g | j D] } t | � ^ q� | _ g | j D]< \ } } } } t | � t | � t | � t | � f ^ q� | _ g | j
D]$ \ } } t | � t | � f ^ qG| _
g | j D] } t | � ^ q~| _ g | j D] } t | � ^ q�| _ g | j
D] } t | � ^ q�| _
g | j D] } t | � ^ q�| _ d S( s� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.N( R R R R R R! R" R) R# R% R* R& R' RW R( ( RZ t st pot prRN t p1t p2t p3t p4( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyt encode_strings� s %7%%O4%%%c C s� | d k rl g | D] } t j d | � ^ q | _ t t | � j | g | j D] } t | � ^ qP � n t t | � j | | � d S( NR( t rule_str( R t Rich_RuleRW RR R t __setattr__t str( RZ R0 R9 R\ ( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyRf � s (8c
C s? | d k r] | j r] | j j � } x| D]+ } | | k r+ t t j d | � � q+ q+ Wn�| d k r� x�| D]" } t | d � t | d � qp Wn�| d k r� x�| D] } t | � q� Wnx| d k r | j r | j j � } xQ| D]+ } | | k r� t t j d | � � q� q� Wn| d k r�x | D]� } t | d � t | d � | d
r�| d r�t t j
d | � � n | d
r�t | d
� n | d r3t | d � r�t | d � r�t t j
d
| d � � q�q3q3WnI| d k r.x:| D]" } t | d � t | d � qWn
| d k r^| t k r;t t j | � � q;n� | d k r�x� | D]' }
t |
� sqt t j |
� � qqqqWn� | d k r x� | D]R } t | � r�t | � r�t | � r�| j d � r�t t j
| � � q�q�Wn0 | d k r;x! | D] } t j d | � q Wn d S( NR! s '%s' not among existing servicesR" i i R) R# s" '%s' not among existing icmp typesR% i i s$ '%s' is missing to-port AND to-addr s# to-addr '%s' is not a valid addressR* R R& R' s ipset:R( Rd ( RV t get_servicesR R t INVALID_SERVICER R R t
get_icmptypest INVALID_ICMPTYPEt INVALID_FORWARDR R t INVALID_ADDRR t INVALID_TARGETR t INVALID_INTERFACER R R t
startswithR Re (
RZ R t itemt existing_servicesR1 R2 t protot existing_icmptypest icmptypet fwd_portR4 R6 R5 ( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyt
_check_config� sn
"
c C s t t | � j | � | j d � r> t t j d | � � n� | j d � rf t t j d | � � n� | j d � d k r� t t j d | � � nn d | k r� | | j d � } n | } t
| � t � k rt t j d | t
| � t � | j f � � n d S( NR. s '%s' can't start with '/'s '%s' can't end with '/'i s more than one '/' in '%s's' Zone of '%s' has %d chars, max is %d %s(
RR R t
check_nameRp R R t INVALID_NAMEt endswitht countt findt lenR
RX ( RZ R0 t checked_name( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyRx � s& c
C sE t | _ d | _ d | _ d | _ d | _ x3 | j D]( } | | j k r7 | j j | � q7 q7 Wx3 | j D]( } | | j k rm | j j | � qm qm Wx3 | j
D]( } | | j
k r� | j
j | � q� q� Wx3 | j D]( } | | j k r� | j j | � q� q� Wx3 | j D]( } | | j k r| j j | � qqWx3 | j
D]( } | | j
k rE| j
j | � qEqEW| j r�t | _ n x3 | j D]( } | | j k r�| j j | � q�q�Wx3 | j D]( } | | j k r�| j j | � q�q�Wx7 | j D], } | j j | � | j j t | � � q�W| j rAt | _ n d S( NR ( t TrueRX RU t filenameR R R R& t appendR' R! R" R) R# R$ R% R* RW R( Rg R+ (
RZ R/ R4 R6 R1 R2 Rs t icmpt forwardR5 ( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyt combine sH ( s versionR ( s shortR ( s descriptionR ( s targetR ( R R ( R R R R ( R R N( t __name__t
__module__t __doc__RT RK t DBUS_SIGNATUREt ADDITIONAL_ALNUM_CHARSRU t PARSER_REQUIRED_ELEMENT_ATTRSt PARSER_OPTIONAL_ELEMENT_ATTRSt staticmethodRQ RS R[ Rc Rf Rw Rx R� ( ( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyR ( sv
9 t zone_ContentHandlerc B s# e Z d � Z d � Z d � Z RS( c C s/ t j | | � d | _ t | _ d | _ d S( N( R RS RU t _ruleRT t _rule_errort _limit_ok( RZ Rq ( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyRS , s c C sw t j | | | � | j r d S| j j | | � | d k rd | k rb t j d | d � n d | k r� | d | j _ n d | k r� t j d | d � n d | k rs| d } | t k r� t t
j | � � n | d k r| t k r| | j _
qqsnk| d k rn\| d
k r&nM| d k r�| j r�| j j rmt j d t | j � � t | _ d St j | d � | j _ d S| d | j j k r�| j j j | d � qst j d
| d � n�
| d k r�| j r<| j j rt j d t | j � � t | _ d St j | d | d � | j _ d St | d � t | d � t | d d � | d f } | | j j k r�| j j j | � qst j d | d | d � n� | d k rs| j r | j j rt j d t | j � � t | _ d St j | d � | j _ qst | d � | d | j j k r\| j j j | d � qst j d | d � n | d k r | j r�| j j r�t j d t | j � � t | _ d St j | d � | j _ d S| d | j j k r| j j j | d � qst j d | d � nU | d k r�| j r�| j j ret j d t | j � � t | _ d St j | d � | j _ d St j d | d � n�
| d k rZd | k r�| d j! � d` k r�t j d | d � d S| j r/| j j rt j d t | j � � t | _ d St j" � | j _ qs| j j# rKt j d � qst | j _# n
| d k rd } d | k r�| d } n d } d | k r�| d } n | j r | j j r�t j d t | j � � t | _ d St j$ | d | d | | � | j _ d St | d � t | d � | r8t | � n | rtt% | � rtt& | � rtt t
j' d! | � � qtn t | d d � | d t | d � t | � f } | | j j( k r�| j j( j | � qst j d" | d | d | r�d# | n d | rd$ | n d � na| d% k r�| j r}| j j rYt j d t | j � � t | _ d St j) | d | d � | j _ d St | d � t | d � t | d d � | d f } | | j j* k r�| j j* j | � qst j d& | d | d � nw| d' k r�| j r+t j d( � t | _ d Sd | k rQt j d) � t | _ d S| d | j j+ k r�| j j+ j | d � qst j d* | d � n�| d+ k r, | j r� | j j, r�t j d, t | j � � t | _ d St- } d- | k r | d- j! � da k r t } n d } } }
d0 | k r7 | d0 } n d1 | k rP | d1 } n d2 | k ri | d2 }
n t j/ | | |
d- | �| j _, d Sd0 | k r� d2 | k r� t j d3 � d Sd0 | k r� d2 | k r� t j d4 � d Sd5 | k r
t j d6 | d5 � n d- | k r
t j d7 � d Sd0 | k r{
t0 | d0 � r{
t1 | d0 � r{
t2 | d0 � r{
t t
j' | d0 � � q{
n d2 | k r�
d8 | d2 } | | j j3 k r�
| j j3 j | � q�
t j d9 | d0 � n d0 | k rs| d0 } | | j j3 k r | j j3 j | � q) t j d9 | d0 � qsnG| d: k r� | j s[ t j d; � t | _ d S| j j4 r� t j d< t | j � � d St- } d- | k r� | d- j! � db k r� t } n t j5 | d0 | � | j _4 n�| dc k r� | j s t j dA � t | _ d S| j j6 r) t j dB � t | _ d S| d= k rJ t j7 � | j _6 n� | d> k r� d } dC | k ru | dC } n t j8 | � | j _6 nO | d? k r� t j9 � | j _6 n. | d@ k r� | dD } t j: | � | j _6 n | j j6 | _; n�| dE k r�
| j s
t j dF � d S| j j r1
t j dG � d Sd }
dH | k rv
| dH }
|
dd k rv
t j dQ � t | _ d Sn dR | k r�
| dR n d } t j< | |
� | j _ | j j | _; n�| dS k r8| j s�
t j dT � d S| j j= rt j dU t | j � � t | _ d St j> � | j _= | j j= | _; n;| dV k r�d } d5 | k r�| d5 } | de k r�t j dY | d5 � t | _ d Sn t j? | � | _ n� | dZ k r(| j; s�t j d[ � t | _ d S| j; j@ rt j d\ t | j � � t | _ d S| d } t jA | � | j; _@ nK | d] k r_| j jB rPt j d^ � qst | j _B n t j d_ | � d Sd S(f NR/ R0 s' Ignoring deprecated attribute name='%s'R RA s, Ignoring deprecated attribute immutable='%s'R R R R R1 s; Invalid rule: More than one element in rule '%s', ignoring.s# Service '%s' already set, ignoring.R2 R3 R- s# Port '%s/%s' already set, ignoring.R9 s$ Protocol '%s' already set, ignoring.s
icmp-blocks& icmp-block '%s' already set, ignoring.s icmp-types- Invalid rule: icmp-block '%s' outside of ruleR$ RB t not falses* Ignoring deprecated attribute enabled='%s's! Masquerade already set, ignoring.s forward-ports to-ports to-addrs# to-addr '%s' is not a valid addresss- Forward port %s/%s%s%s already set, ignoring.s >%ss @%ss source-ports* Source port '%s/%s' already set, ignoring.R4 s$ Invalid rule: interface use in rule.s Invalid interface: Name missing.s% Interface '%s' already set, ignoring.R6 s: Invalid rule: More than one source in rule '%s', ignoring.RE t yest trueR7 RD RF s$ Invalid source: No address no ipset.s" Invalid source: Address and ipset.RC s) Ignoring deprecated attribute family='%s's+ Invalid source: Invertion not allowed here.s ipset:%ss" Source '%s' already set, ignoring.R8 s) Invalid rule: Destination outside of rules? Invalid rule: More than one destination in rule '%s', ignoring.R; R< R= R? s$ Invalid rule: Action outside of rules" Invalid rule: More than one actionRI R> R s! Invalid rule: Log outside of rules Invalid rule: More than one logRH t emergt alertt critt errort warningt noticet infot debugs Invalid rule: Invalid log levelRG R: s# Invalid rule: Audit outside of rules9 Invalid rule: More than one audit in rule '%s', ignoring.R5 t ipv4t ipv6s& Invalid rule: Rule family "%s" invalidR@ s4 Invalid rule: Limit outside of action, log and audits9 Invalid rule: More than one limit in rule '%s', ignoring.s icmp-block-inversions+ Icmp-Block-Inversion already set, ignoring.s Unknown XML element '%s'( R� R� ( s yesR� ( s yesR� ( s accepts rejects drops mark( R� R� R� s errors warningR� s infos debug( R� R� (C R t startElementR� Rq t parser_check_element_attrsR R� R R R R Rn R R R� RM Rg R R t Rich_ServiceR! R� t Rich_PortR R R
R" t
Rich_ProtocolR R) t Rich_IcmpBlockR# t
Rich_IcmpTypet lowert Rich_MasqueradeR$ t Rich_ForwardPortR R Rm R% t Rich_SourcePortR* R& R6 RT RU t Rich_SourceR R R R' R8 t Rich_Destinationt actiont Rich_Acceptt Rich_Rejectt Rich_Dropt Rich_MarkR� t Rich_LogR: t
Rich_AuditRe R@ t
Rich_LimitR+ ( RZ R0 t attrsR t entryt to_portt to_addrRE t addrRD RF t _typet _setRH RG RC R9 ( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyR� 2 st
c C s t j | | � | d k r� | j s� y | j j � Wn/ t k
rg } t j d | t | j � � q� Xt | j � | j j
k r� | j j j | j � | j j
j t | j � � q� t j d t | j � � n d | _ t | _ n | d
k rd | _ n d S( NR5 s %s: %ss Rule '%s' already set, ignoring.R; R< R= R? R R: ( s accepts rejects drops marks logs audit( R t
endElementR� R� t checkt ExceptionR R� Rg Rq R( RW R� RU RT R� ( RZ R0 t e( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyR� � s ( R� R� RS R� R� ( ( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyR� + s � dc
C sb t � } | j d � s1 t t j d | � � n | d | _ | sW | j | j � n | | _ | | _ | j t
j � r� t n t
| _ | j | _ t | � } t j � } | j | � d | | f } t | d � �i } t j d � } | j | � y | j | � Wn2 t j k
r>} t t j d | j � � � n XWd QX~ ~ t r^| j � n | S( Ns .xmls '%s' is missing .xml suffixi����s %s/%st rbs not a valid zone file: %s( R Rz R R Ry R0 Rx R� t pathRp R t
ETC_FIREWALLDRT R t builtint defaultR� t saxt make_parsert setContentHandlert opent InputSourceRU t
setByteStreamt parset SAXParseExceptiont INVALID_ZONEt getExceptionR Rc (
R� R� t
no_check_nameR/ t handlert parserR0 t fR6 t msg( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyR � s:
!
c
C s%
| r | n | j } | j r4 d | | j f } n d | | j f } t j j | � r� y t j | d | � Wq� t k
r� } t j d | | � q� Xn t j j
| � } | j t j
� rt j j | � rt j j t j
� s� t j t j
d � n t j | d � n t j | d d d d �} t | � } | j � i } | j rq| j d
k rq| j | d <n | j t k r�| j | d <n | j d
| � | j d � | j r| j d
k r| j d � | j d i � | j | j � | j d � | j d � n | j rq| j d
k rq| j d � | j d i � | j | j � | j d � | j d � n xH t | j � D]7 } | j d � | j d i | d 6� | j d � q�Wxr t | j � D]a }
| j d � d |
k r | j d i |
d d 6� n | j d i |
d 6� | j d � q�WxH t | j � D]7 } | j d � | j d i | d 6� | j d � qAWxW t | j! � D]F } | j d � | j d i | d d 6| d d 6� | j d � q�WxH t | j" � D]7 }
| j d � | j d i |
d 6� | j d � q�W| j# rW| j d � | j d i � | j d � n xH t | j$ � D]7 } | j d � | j d i | d 6� | j d � qgW| j% r�| j d � | j d! i � | j d � n x� t | j& � D]� } | j d � i | d d 6| d d 6} | d" rB| d" d
k rB| d" | d# <n | d$ rm| d$ d
k rm| d$ | d% <n | j d& | � | j d � q�WxW t | j' � D]F } | j d � | j d' i | d d 6| d d 6� | j d � q�Wx| j( D]�} i } | j) r| j) | d( <n | j d � | j d) | � | j d � | j* r�i } | j* j+ ro| j* j+ | d <n | j* j, r�| j* j, | d* <n | j* j- r�| j* j- | d <n | j* j. r�d+ | d, <n | j d- � | j d | � | j d � n | j/ rUi | j/ j+ d 6} | j/ j. r(d+ | d, <n | j d- � | j d. | � | j d � n | j0 r� d
} i } t1 | j0 � t2 j3 k r�d } | j0 j | d <n�t1 | j0 � t2 j4 k r�d } | j0 j5 | d <| j0 j6 | d <n�t1 | j0 � t2 j7 k r
d } | j0 j8 | d <nnt1 | j0 � t2 j9 k r.d! } nMt1 | j0 � t2 j: k r_d } | j0 j | d <n t1 | j0 � t2 j; k r�d/ } | j0 j | d <n� t1 | j0 � t2 j< k r d& } | j0 j5 | d <| j0 j6 | d <| j0 j= d
k r�| j0 j= | d# <n | j0 j> d
k r{ | j0 j> | d% <q{ n` t1 | j0 � t2 j? k r\ d' } | j0 j5 | d <| j0 j6 | d <n t@ tA jB d0 t1 | j0 � � � | j d- � | j | | � | j d � n | j r�
i } | j jC r� | j jC | d1 <n | j jD r� | j jD | d2 <n | j jE rh
| j d- � | j d3 | � | j d4 � | j d5 i | j jE j8 d 6� | j d6 � | j d3 � n | j d- � | j d3 | � | j d � n | jF rD i } | jF jE r | j d- � | j d7 i � | j d4 � | j d5 i | jF jE j8 d 6� | j d6 � | j d7 � n | j d- � | j d7 | � | j d � n | jG r� d
} i } t1 | jG � t2 jH k rz d8 } n� t1 | jG � t2 jI k r� d9 } | jG j1 r% | jG j1 | d: <q% nk t1 | jG � t2 jJ k r� d; } nJ t1 | jG � t2 jK k r d< } | jG jL | d= <n t jM d> t1 | jG � � | jG jE r� | j d- � | j | | � | j d4 � | j d5 i | jG jE j8 d 6� | j d6 � | j | � n | j d- � | j | | � | j d � n | j d � | j d) � | j d � q�W| j d
� | j d � | jN � | jO � ~ d S(? Ns %s/%ss %s/%s.xmls %s.olds Backup of file '%s' failed: %si� t modet wtt encodings UTF-8R R R R/ s
s R R R4 R0 s ipset:R6 i RF R7 R1 R2 i i R3 R9 s icmp-block-inversions
icmp-blockR$ i s to-porti s to-addrs forward-ports source-portRC R5 RD R RE s R8 s icmp-types# Unknown element '%s' in zone_writerRG RH R s
R@ s
R: R; R< RI R= R? R> s Unknown action '%s'(P R� R� R0 t ost existst shutilt copy2R� R R� t dirnameRp R R� t mkdirt ioR� R t
startDocumentR R R R� t ignorableWhitespaceR t
charactersR� R R R& t
simpleElementR' R! R" R) R+ R# R$ R% R* RW RC R6 R� RD RF RE R8 RM RI R R� R� R2 R3 R� R9 R� R� R� R� R� t
to_addressR� R R t INVALID_OBJECTRG RH R@ R: R� R� R� R� R� R> R� t endDocumentt close( R/ R� t _pathR0 R� t dirpathR� R� R� R4 R6 R1 R2 R3 R� R� R5 RM R� ( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyR � s� %
&
(+ t __all__t xml.saxR� R� R� R� t firewallR t firewall.functionsR R R R R R R
R R R
t firewall.core.baseR R t firewall.core.io.io_objectR R R R R R R t
firewall.coreR t firewall.core.loggerR R t firewall.errorsR R R� RT R RU R ( ( ( s9 /usr/lib/python2.7/site-packages/firewall/core/io/zone.pyt <module> s$ F4� � �