관리-도구
편집 파일: policy.cpython-39.pyc
a ���g� � @ s g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z mZmZm Z mZmZmZ ddlmZmZmZ ddlmZmZmZmZmZmZ ddlmZ ddlmZ dd lm Z dd l!m"Z" dd� Z#d d� Z$dd� Z%dd� Z&G dd� de�Z'G dd� de�Z(ddd�Z)ddd�Z*dS ))�Policy� policy_reader� policy_writer� N)�config)�checkIP�checkIP6�checkUINT16�coalescePortRange�max_policy_name_len�portInPortRange�portStr�uniqify)�DEFAULT_POLICY_TARGET�POLICY_TARGETS�DEFAULT_POLICY_PRIORITY)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port�check_tcpudp�check_protocol)�rich)�log)�errors)� FirewallErrorc s� |dkr�n�|dkr�n�|dkr�| j r`| j jrJt�dt| j �� d| _dS t�� d �| j _dS � d | jj vr�| jj � � d � nt�d� d � �n<|dk�r| j r�| j jr�t�dt| j �� d| _dS t�� d � d �| j _dS t� d � t � d � t� d d �� d f}tt� fdd�| jj��}|D ]b}t|d |d ��r4t| jt��rb| jjn| jj}t�ttjd|d � d |f �� �qԐq4t|d dd� |D ��\}}|D ]&} t| d �� d f} | jj�| � �q�|D ]&} t| d �� d f} | jj� | � �q� n�|d k�r�| j �r\| j j�rHt�dt| j �� d| _dS t�� d �| j _nBt� d � � d | jjv�r�| jj� � d � nt�d� d � � n2|dk�r<| j �r| j j�r�t�dt| j �� d| _dS d}d� v �r�� d dv�r�� d }t�|�| j _n*d}d� v �r,d� d � d�}t�d|� �n�|dk�r�| j �r�| j j�rtt�dt| j �� d| _dS t� � d �| j _dS � d | jj!v�r�| jj!� � d � nt�d� d � �n|dk�r&| j �r| j j�r�t�dt| j �� d| _dS t�"� d �| j _dS t�d� d � �n�|dk�r�| j �rl| j j�r^t�dt| j �� d| _dS t�#� | j _n| jj$�r�t�d� nd| j_$�nF|d k�r�d} d!� v �r�� d! } d}d"� v �rĈ d" }| j �r| j j�r�t�dt| j �� d| _dS t�%� d � d | |�| j _dS t� d � t � d � | �r8t| � |�rbt&|��sbt'|��sbttj(d#| ��t� d d �� d t| d �t|�f} | | jj)v�r�| jj)� | � n6t�d$� d � d | �r�d%| nd|�r�d&| nd� �n�|d'k�rZ| j �r2| j j�rt�dt| j �� d| _dS t�*� d � d �| j _dS t� d � t � d � t� d d �� d f}tt� fd(d�| jj+��}|D ]b}t|d |d ��r~t| jt��r�| jjn| jj}t�ttjd|d � d |f �� �qԐq~t|d d)d� |D ��\}}|D ]&} t| d �� d f} | jj+�| � �q|D ]&} t| d �� d f} | jj+� | � �q.�nz|d*k�r| j �s�t�d+� d| _dS | j j,�r�t�d,t| j �� dS d-}d }d.� v �r�� d. }d }d/� v �rЈ d/ }d0� v �r� d0 �-� d1v �r�d}t�.|||�| j _,�n�|d2v �r�| j �s,t�d3� d| _dS | j j/�rJt�d4� d| _dS |d5k�rbt�0� | j _/nh|d6k�r�d }d7� v �r�� d7 }t�1|�| j _/n8|d8k�r�t�2� | j _/n |d9k�rʈ d: }t�3|�| j _/| j j/| _4�n�|d;k� r�| j �s�t�d<� dS | j j� rt�d=� dS d }d>� v � rD� d> }|d?v� rDt�d@� d| _dS d }dA� v � r�� dA }|� rnt5|�dBk� r�t�dC� d| _dS t�6||�| j _| j j| _4�n4|dDk� r�| j � s�t�d<� dS | j j� r�t�d=� dS d }dE� v � r� dE }t7|�� st�dF� d| _dS d }dA� v � rJ� dA }|� r6t5|�dBk� rJt�dG� d| _dS d }dH� v � r~� dH }t7|�� s~t�dI� d| _dS t�8|||�| j _| j j| _4�n6|dJk� r�| j � s�t�dK� dS | j j9� r�t�dLt| j �� d| _dS t�:� | j _9| j j9| _4n�|dMk�rld }d }dN� v �rD� dN }|dOv�rDt�dP� dN � d| _dS dQ� v �rZt;� dQ �}tj<||dR�| _ nh|dSk�r�| j4�s�t�dT� d| _dS | j4j=�r�t�dUt| j �� d| _dS � d }t�>|�| j4_=nd-S dS )VN�short�description�servicez;Invalid rule: More than one element in rule '%s', ignoring.T�namez#Service '%s' already set, ignoring.�port�protocol�-c s | d � d kS �N� r � ��x��attrsr$ �;/usr/lib/python3.9/site-packages/firewall/core/io/policy.py�<lambda>E � z%common_startElement.<locals>.<lambda>r z'%s:%s' already in '%s'c S s g | ]\}}|�qS r$ r$ ��.0Z_portZ _protocolr$ r$ r) � <listcomp>O r+ z'common_startElement.<locals>.<listcomp>�valuez$Protocol '%s' already set, ignoring.� tcp-mss-clamp�pmtu)N�None� z (value='z)'z-Invalid rule: tcp-mss-clamp%s outside of rule� icmp-blockz&icmp-block '%s' already set, ignoring.� icmp-typez-Invalid rule: icmp-block '%s' outside of rule� masqueradez!Masquerade already set, ignoring.�forward-port�to-port�to-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%s�source-portc s | d � d kS r"