관리-도구
편집 파일: rich.cpython-39.pyc
a ���gK� � @ s� g d �Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd� de �Z G d d � d e �Z G d d � d e �Z G d d� de �ZG dd� de�ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� de �ZG dd � d e �ZG d d � d e �ZG d d � d e �ZG d!d"� d"e �ZG d#d$� d$e �ZG d%d&� d&e �ZG d'd(� d(e�ZG d)d*� d*e �Z G d+d,� d,e �Z G d-d.� d.e �Z d/S )0)� Rich_Source�Rich_Destination� Rich_Service� Rich_Port� Rich_Protocol�Rich_Masquerade�Rich_IcmpBlock� Rich_IcmpType�Rich_SourcePort�Rich_ForwardPort�Rich_Log� Rich_NFLog� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� Rich_Audit� Rich_Limit� Rich_Rule�Rich_Tcp_Mss_Clamp� )� functions)�check_ipset_name)� REJECT_TYPES)�errors)� FirewallErrorc @ s e Zd Zddd�Zdd� ZdS )r Fc C s� || _ | j dkrd | _ || _| jdks0| jd u r8d | _n| jd urN| j�� | _|| _| jdkrdd | _|| _| j d u r�| jd u r�| jd u r�ttjd��d S )N� �no address, mac and ipset)�addr�mac�upper�ipset�invertr r � INVALID_RULE)�selfr r r r! � r$ �6/usr/lib/python3.9/site-packages/firewall/core/rich.py�__init__$ s �zRich_Source.__init__c C sj d| j r dnd }| jd ur*|d| j S | jd urB|d| j S | jd urZ|d| j S ttjd��d S )Nz source%s � NOTr � address="%s"zmac="%s"� ipset="%s"r )r! r r r r r r" �r# �retr$ r$ r% �__str__5 s �zRich_Source.__str__N)F��__name__� __module__� __qualname__r& r, r$ r$ r$ r% r # s r c @ s e Zd Zddd�Zdd� ZdS )r Fc C sV || _ | j dkrd | _ || _| jdkr,d | _|| _| j d u rR| jd u rRttjd��d S )Nr �no address and ipset)r r r! r r r" )r# r r r! r$ r$ r% r& A s �zRich_Destination.__init__c C sR d| j r dnd }| jd ur*|d| j S | jd urB|d| j S ttjd��d S )Nzdestination%s r' r r( r) r1 )r! r r r r r" r* r$ r$ r% r, M s �zRich_Destination.__str__N)Fr- r$ r$ r$ r% r @ s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S �N��name�r# r4 r$ r$ r% r& W s zRich_Service.__init__c C s d| j S )Nzservice name="%s"r3 �r# r$ r$ r% r, Z s zRich_Service.__str__Nr- r$ r$ r$ r% r V s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ || _d S r2 ��port�protocol)r# r8 r9 r$ r$ r% r& ^ s zRich_Port.__init__c C s d| j | jf S )Nz port port="%s" protocol="%s"r7 r6 r$ r$ r% r, b s zRich_Port.__str__Nr- r$ r$ r$ r% r ] s r c @ s e Zd Zdd� ZdS )r c C s d| j | jf S )Nz#source-port port="%s" protocol="%s"r7 r6 r$ r$ r% r, f s �zRich_SourcePort.__str__N�r. r/ r0 r, r$ r$ r$ r% r e s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 ��value�r# r< r$ r$ r% r& k s zRich_Protocol.__init__c C s d| j S )Nzprotocol value="%s"r; r6 r$ r$ r% r, n s zRich_Protocol.__str__Nr- r$ r$ r$ r% r j s r c @ s e Zd Zdd� Zdd� ZdS )r c C s d S r2 r$ r6 r$ r$ r% r& r s zRich_Masquerade.__init__c C s dS )N� masquerader$ r6 r$ r$ r% r, u s zRich_Masquerade.__str__Nr- r$ r$ r$ r% r q s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 r3 r5 r$ r$ r% r& y s zRich_IcmpBlock.__init__c C s d| j S )Nzicmp-block name="%s"r3 r6 r$ r$ r% r, | s zRich_IcmpBlock.__str__Nr- r$ r$ r$ r% r x s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 r3 r5 r$ r$ r% r& � s zRich_IcmpType.__init__c C s d| j S )Nzicmp-type name="%s"r3 r6 r$ r$ r% r, � s zRich_IcmpType.__str__Nr- r$ r$ r$ r% r s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 r; r= r$ r$ r% r& � s zRich_Tcp_Mss_Clamp.__init__c C s | j rd| j S dS d S )Nztcp-mss-clamp value="%s"� tcp-mss-clampr; r6 r$ r$ r% r, � s zRich_Tcp_Mss_Clamp.__str__Nr- r$ r$ r$ r% r � s r c @ s e Zd Zdd� Zdd� ZdS )r c C s< || _ || _|| _|| _| jd u r(d| _| jd u r8d| _d S �Nr �r8 r9 �to_port� to_address)r# r8 r9 rB rC r$ r$ r% r& � s zRich_ForwardPort.__init__c C s< d| j | j| jdkr d| j nd| jdkr4d| j ndf S )Nz(forward-port port="%s" protocol="%s"%s%sr z to-port="%s"z to-addr="%s"rA r6 r$ r$ r% r, � s ��zRich_ForwardPort.__str__Nr- r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _|| _d S r2 ��prefix�level�limit)r# rE rF rG r$ r$ r% r& � s zRich_Log.__init__c C s> d| j rd| j nd| jr$d| j nd| jr6d| j ndf S )Nz log%s%s%s� prefix="%s"r z level="%s"� %srD r6 r$ r$ r% r, � s ��zRich_Log.__str__c C sV | j r t| j �dkr ttjd��| jr>| jdvr>ttj| j��| jd urR| j�� d S )N� �+maximum accepted length of 'prefix' is 127.)ZemergZalertZcrit�errorZwarningZnotice�info�debug) rE �lenr r �INVALID_LOG_PREFIXrF ZINVALID_LOG_LEVELrG �checkr6 r$ r$ r% rQ � s � zRich_Log.check)NNN�r. r/ r0 r& r, rQ r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _|| _|| _d S r2 ��grouprE � thresholdrG )r# rT rE Z queue_sizerG r$ r$ r% r& � s zRich_NFLog.__init__c C sP d| j rd| j nd| jr$d| j nd| jr6d| j nd| jrHd| j ndf S )Nz nflog%s%s%s%sz group="%s"r rH z queue-size="%s"rI rS r6 r$ r$ r% r, � s ��zRich_NFLog.__str__c C st | j r t�| j �s ttjd��| jr>t| j�dkr>ttjd��| j r\t�| j �s\ttj d��| j d urp| j � � d S )Nz5nflog 'group' must be an integer between 0 and 65535.rJ rK z:nflog 'queue-size' must be an integer between 0 and 65535.) rT r Z checkUINT16r r ZINVALID_NFLOG_GROUPrE rO rP rU ZINVALID_NFLOG_QUEUErG rQ r6 r$ r$ r% rQ � s zRich_NFLog.check)NNNNrR r$ r$ r$ r% r � s r c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ d S r2 �rG �r# rG r$ r$ r% r& � s zRich_Audit.__init__c C s d| j rd| j nd S )Nzaudit%srI r rV r6 r$ r$ r% r, � s zRich_Audit.__str__)Nr- r$ r$ r$ r% r � s r c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ d S r2 rV rW r$ r$ r% r& � s zRich_Accept.__init__c C s d| j rd| j nd S )Nzaccept%srI r rV r6 r$ r$ r% r, � s zRich_Accept.__str__)Nr- r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S r2 ��typerG )r# Z_typerG r$ r$ r% r& � s zRich_Reject.__init__c C s, d| j rd| j nd| jr$d| j ndf S )Nz reject%s%sz type="%s"r rI rX r6 r$ r$ r% r, � s �zRich_Reject.__str__c C sT | j rP|sttjd��|dv rP| j t| vrPd�t| �}ttjd| j |f ��d S )Nz9When using reject type you must specify also rule family.�Zipv4Zipv6z, z%Wrong reject type %s. Use one of: %s.)rY r r r" r �join)r# �familyZ valid_typesr$ r$ r% rQ � s �zRich_Reject.check)NNrR r$ r$ r$ r% r � s r c @ s e Zd Zdd� ZdS )r c C s d| j rd| j nd S )Nzdrop%srI r rV r6 r$ r$ r% r, � s zRich_Drop.__str__Nr: r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S r2 ��setrG )r# Z_setrG r$ r$ r% r& � s zRich_Mark.__init__c C s d| j | jrd| j ndf S )Nz mark set=%s%srI r r] r6 r$ r$ r% r, s �zRich_Mark.__str__c C s� | j d ur| j }n ttjd��d|v rr|�d�}t|�dkrHttj|��t�|d �rdt�|d �s�ttj|��nt�|�s�ttj|��d S )Nz no value set�/� r � )r^ r r Z INVALID_MARK�splitrO r Z checkUINT32)r# �x�splitsr$ r$ r% rQ s � zRich_Mark.check)NrR r$ r$ r$ r% r � s r c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) r c C sV || _ d| j v rR| j �d�}t|�dkrR|d dv rRd|d |d d d� f | _ d S )Nr_ r` ra )�secondZminuteZhourZdayz%s/%sr )r< rb rO )r# r< rd r$ r$ r% r& s �zRich_Limit.__init__c C s d }d| j v r| j �d�}|r*t|�dkr8ttj| j ��|\}}z t|�}W n ttj| j ��Y n0 |dk sx|dvr�ttj| j ��d}|dkr�d}n(|dkr�d}n|dkr�d }n |d kr�d }d | | d kr�ttjd| j ��|dk�r|d k�rttjd| j ��d S )Nr_ r` ra )�s�m�h�drf rg �< rh i ri i�Q i' r z %s too fastz %s too slow)r< rb rO r r Z INVALID_LIMIT�int)r# rd ZrateZdurationZmultr$ r$ r% rQ ! s: ��zRich_Limit.checkc C s d| j S )Nzlimit value="%s"r; r6 r$ r$ r% r, C s zRich_Limit.__str__c C s dS r@ r$ r6 r$ r$ r% �commandF s zRich_Limit.commandN)r. r/ r0 r& rQ r, rl r$ r$ r$ r% r s "r c @ s> e Zd ZdZdZddd�Zdd� Zd d � Zd d � Zd d� Z dS )r i ���i� Nr c C sV |d urt |�| _nd | _|| _d | _d | _d | _d | _d | _d | _|rR| � |� d S r2 ) �strr\ �priority�source� destination�element�log�audit�action�_import_from_string)r# r\ �rule_strrn r$ r$ r% r& M s zRich_Rule.__init__c C s� g }t �|�D ]j}d|v rj|�d�}t|�dks@|d r@|d sPttjd| ��|�|d |d d�� q|�d|i� q|�ddi� |S ) z Lexical analysis �=r` r ra z internal error in _lexer(): %s)� attr_name� attr_valuerq �EOL)r Z splitArgsrb rO r r r" �append)r# rv �tokens�r�attrr$ r$ r% �_lexer^ s �zRich_Rule._lexerc C s` |st tjd��t�|�}d| _d | _d | _d | _d | _ d | _ d | _ d | _ | � |�}|rv|d �d�dkrvt tjd��i }g }d}|| �d�dkr�|dgk� sT|| �d�}|| �d�}|| �d�}|r�|dvr�t tjd | ��n�|d v �r�|d k�r| j�rt tjd ��n�|d k�r2| j�r2t tjd��n�|dv �r\| j �r\t tjd|| j f ��nh|dv �r|| j �r|t tjd��nH|dk�r�| j �r�t tjd��n(|dv �r�| j �r�t tjd|| j f ��nt tjd| ��t|�dk�r�|t|�d nd} | dk�r�|�sT|�rT|dk�r&t tjd��n,|d k�r>t tjd ��nt tjd ||f ��n*d|v�rtt tjd ||f ��n |�d� �n�| dk�r6|dk�r�|d v�r�t tjd!| ��|| _nz|d k�r�zt|�| _W n$ t�y� t tjd"| ��Y n0 n:|�r(|d#k�rd$} n d%||f } t tj| ��n |�|� �n| d k�r�|d&v �rT|||< nV|d'v �rhd(|d)< nBt|�d*�|�d+�|�d,�|�d)d-��| _|�� |�� |d }�n�| d k�r |d.v �r�|||< nN|d'v �r�d(|d)< n:t|�d*�|�d,�|�d)d-��| _|�� |�� |d }�n,| d#k�rV|d/k�rFt|�| _ |�� n t tjd0���n�| d1k�r�|d/k�rt|||< n(t|�d/��| _ |�� |�� |d }�n�| d2k�r�|d3k�r�t|�| _ |�� n t tjd4���nr| d5k�r*|d6v �r�|||< n0t|�d5�|�d#��| _ |�� |�� |d }�n | d7k�rb|d3k�rRt |�| _ |�� n t tjd8���n�| d9k�r�|d3k�r�t |�| _ |�� n t tjd:���n�| d;k�r�t � | _ |�� |�� |d }�n�| d<k�r*|d=v �r�|||< n@t |�d5�|�d#�|�d>�|�d?��| _ |�� |�� |d }�n | d@k�r||d6v �rH|||< n0t |�d5�|�d#��| _ |�� |�� |d }�n�| dAk�r�|dBv �r�|||< nN|dCk�r�|�dC� n8t!|�dD�|�dE�|�dC��| _ |�� |�� |d }�n^| dFk�rd|dGv �r |||< nV|dCk�r |�dC� n@t"|�dH�|�dD�|�dI�|�dC��| _ |�� |�� |d }�n�| dk�r�|dCk�r�|�dC� n(t#|�dC��| _ |�� |�� |d }�n�| dJk�r�|dCk�r�|�dC� n(t$|�dC��| _ |�� |�� |d }�nN| dKk�rH|dCk�r |�dC� n(t%|�dC��| _ |�� |�� |d }�n| dLk�r�|dMk�rf|||< nF|dCk�r||�dC� n0t&|�dM�|�dC��| _ |�� |�� |d }n�| dNk� r|dOk�r�|||< nF|dCk�r�|�dC� n0t'|�dO�|�dC��| _ |�� |�� |d }n6| dCk� rJ|d/k� r>t(|�|dC< |�� n t tjdP��|d }q�| �)� d S )QNz empty ruler rq rz �rulerx ry )rn r\ �addressr r r! r< r8 r9 �to-port�to-addrr4 rT rE rF � queue-sizerY r^ zbad attribute '%s')r� ro rp r9 �servicer8 � icmp-block� icmp-typer> � forward-port� source-portrr �nflogrs �accept�drop�reject�markrG �not�NOTrz r? ro z more than one 'source' elementrp z#more than one 'destination' element)r9 r� r8 r� r� r> r� r� zFmore than one element. There cannot be both '%s' and '%s' in one rule.)rr r� z more than one logging elementrs z more than one 'audit' element)r� r� r� r� zOmore than one 'action' element. There cannot be both '%s' and '%s' in one rule.zunknown element %sra r r\ z0'family' outside of rule. Use 'rule family=...'.rn z4'priority' outside of rule. Use 'rule priority=...'.z:'%s' outside of any element. Use 'rule <element> %s= ...'.z,'%s' outside of rule. Use 'rule ... %s ...'.rZ zH'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead.z(invalid 'priority' attribute value '%s'.r9 zdwrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'.zDattribute '%s' outside of any element. Use 'rule <element> %s= ...'.)r� r r r! )r� r� Tr! r� r r F)r� r r! r< zinvalid 'protocol' elementr? r� r4 zinvalid 'service' elementr8 r7 r� z invalid 'icmp-block' elementr� zinvalid 'icmp-type' elementr> r� )r8 r9 r� r� r� r� r� rr )rE rF rG rE rF r� )rT rE r� rT r� r� r� r� rY r� r^ zinvalid 'limit' element)*r r r" r ZstripNonPrintableCharactersrn r\ ro rp rq rr rs rt r �getrO r{ rk � ValueError�INVALID_PRIORITYr �pop�clearr r r r r r r r r r r r r r r r r r rQ ) r# rv r| �attrsZ in_elements�indexrq rx ry Z in_element�err_msgr$ r$ r% ru o s� �" * " ( ( � z Rich_Rule._import_from_stringc C s� | j d ur"| j dvr"ttj| j ��| j d u rn| jd urB| jjd usL| jd urVttj��t| j �t krnttj��| j | j k s�| j | j kr�ttjd| j | j f ��| j d u �r| jd u s�| jd u�r| j dk�r| jd u r�ttjd��| jd u �r| jd u �r| j dk�rttjd��t| j �tt ttfv�rZ| jd u �rZ| jd u �rZ| jd u �rZttjd��| jd u�rt| jjd u�r�| j d u �r�ttj��| jjd u�r�ttjd��| jjd u�r�ttjd��t�| j | jj��stttjt| jj���n�| jjd u�r6| jjd u�rttjd ��t� | jj��stttj t| jj���n>| jjd u�rht | jj��stttj t| jj���n ttjd ��| jd u�r&| jjd u�r�| j d u �r�ttj��| jjd u�r�ttj d��t�| j | jj��s&ttjt| jj���n>| jjd u�rt | jj��s&ttj t| jj���n ttjd ��t| j �t!k�rn| j j"d u �sVt#| j j"�d k �r�ttj$t| j j"����nRt| j �t%k�r�t�&| j j'��s�ttj(| j j'��| j j)d v�r�ttj*| j j)���n t| j �t+k�r�t�,| j j-��s�ttj*| j j-���n�t| j �tk�rF| jd u�r ttjd��| jd u�r�| jjd u�r�ttjd���nzt| j �tk�r�| j j"d u �svt#| j j"�d k �r�ttj.t| j j"���| j�r�ttjd���n t| j �t/k�r�| j j"d u �s�t#| j j"�d k �r�ttj.t| j j"����n�t| j �t k�r�t�&| j j'��sttj(| j j'��| j j)d v�r8ttj*| j j)��| j j0dk�rd| j j1dk�rdttj(| j j0��| j j0dk�r�t�&| j j0��s�ttj(| j j0��| j j1dk�r�t�2| j | j j1��s�ttj| j j1��| j d u �r�ttj��| jd u�r�ttjd��n�t| j �t3k�rDt�&| j j'��s$ttj(| j j'��| j j)d v�r�ttj*| j j)��n|t| j �tk�r�| jd u�rrttjd| j ��| j j-�r�t�4| j j-��s�ttj| j j-��n"| j d u�r�ttjdt| j � ��| jd u�r�| j�5� | jd u�r$t| j�t6t7t8fv�r ttj9t| j���| jj:d u�r$| jj:�5� | jd u�r�t| j�t7k�rP| j�5| j � nt| j�t;k�rj| j�5� | jj:d u�r�| jj:�5� d S )NrZ z/'priority' attribute must be between %d and %d.r zno element, no actionz%no element, no source, no destinationzno action, no log, no auditzaddress and maczaddress and ipsetz mac and ipsetzinvalid sourcezinvalid destinationra )ZtcpZudpZsctpZdccpzmasquerade and actionzmasquerade and mac sourcezicmp-block and actionr zforward-port and actionz+tcp-mss-clamp and %s are mutually exclusivezUnknown element %s)<r\ r r ZINVALID_FAMILYro r rp ZMISSING_FAMILYrY rq r rn � priority_min� priority_maxr� rr rt r" r r r rs r r r Z check_addressZ INVALID_ADDRrm Z check_macZ INVALID_MACr Z INVALID_IPSETZINVALID_DESTINATIONr r4 rO ZINVALID_SERVICEr Z check_portr8 Z INVALID_PORTr9 ZINVALID_PROTOCOLr Z checkProtocolr< ZINVALID_ICMPTYPEr rB rC Zcheck_single_addressr ZcheckTcpMssClamprQ r r r ZINVALID_AUDIT_TYPErG r r6 r$ r$ r% rQ f s � � ��� $ �� ��� � zRich_Rule.checkc C s� d}| j r|d| j 7 }| jr,|d| j 7 }| jr@|d| j 7 }| jrT|d| j 7 }| jrh|d| j 7 }| jr||d| j 7 }| jr�|d| j 7 }| jr�|d| j 7 }|S )Nr� z priority="%d"z family="%s"rI )rn r\ ro rp rq rr rs rt r* r$ r$ r% r, s$ zRich_Rule.__str__)NNr ) r. r/ r0 r� r� r& r ru rQ r, r$ r$ r$ r% r I s x 0r N) �__all__Zfirewallr Zfirewall.core.ipsetr Zfirewall.core.baser r Zfirewall.errorsr �objectr r r r r r r r r r r r r r r r r r r r r$ r$ r$ r% �<module> s2 1