관리-도구
편집 파일: zone.cpython-39.pyc
a ���g�I � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZ ddlmZmZ ddlmZmZmZ ddlmZmZmZmZ ddlm Z dd l m Z dd lm Z dd l m!Z! G d d � d e�Z"G dd� de�Z#ddd�Z$ddd�Z%dS ))�Zone� zone_reader� zone_writer� N)�config)� checkIPnMask� checkIP6nMask�checkInterface�uniqify�max_zone_name_len� check_mac)�DEFAULT_ZONE_TARGET� ZONE_TARGETS)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�common_startElement�common_endElement�common_check_config� common_writer)�rich)�log)�errors)� FirewallErrorc sX e Zd ZdZdddddddgfd d gfd dgfd d dgfddgfddgfddgfddgfdd gfddfZg d�Zddddgddgdgdgdddgdgddddgddgddddddd gdgdd �Zg d �d gd d!gd"d#gg d$�g d%�d&d'gg d(�d)gdgd*� Zed+d,� �Z � fd-d.�Z d/d0� Z � fd1d2�Z � fd3d4�Z d5d6� Z� fd7d8�Zd9d:� Z� ZS );r z Zone class )�version� )�shortr )� descriptionr )�UNUSEDF)�targetr �servicesr �ports)r r � icmp_blocks)� masqueradeF� forward_ports)r r r r � interfaces�sources� rules_str� protocols� source_ports)�icmp_block_inversionF)�forwardT)�_�-�/N�name�port�protocol�value�set)r r �zone�servicer/ z icmp-blockz icmp-typer* � forward-port� interface�rule�source� destinationr0 z source-portr �nflog�auditZaccept�rejectZdropZmark�limit�icmp-block-inversion)r. � immutabler r Zenabledzto-portzto-addr�family�priority)�address�mac�invertr@ �ipset)rB rD rE �prefix�level)�grouprF z queue-size�type) r3 r" r5 r7 r8 r9 r r: r< z tcp-mss-clampc C s8 t tj�D ] \}\}}|| kr | S q ttjd��d S )Nz index_of())� enumerater �IMPORT_EXPORT_STRUCTUREr r Z UNKNOWN_ERROR)�element�i�elZdummy� rO �9/usr/lib/python3.9/site-packages/firewall/core/io/zone.py�index_off s z Zone.index_ofc s� t t| ��� d| _d| _d| _d| _t| _g | _ g | _ g | _ g | _ d| _ d| _g | _g | _g | _g | _g | _g | _d| _d| _d| _d S �Nr FT)�superr �__init__r r r r r r r r r' r! r* r" r# r( r$ r% �rulesr& r) �combined�applied��self�� __class__rO rP rT m s* z Zone.__init__c C s� d| _ d| _d| _d| _t| _| jd d �= | jd d �= | jd d �= | j d d �= d| _ d| _ | j d d �= | j d d �= | jd d �= | jd d �= | jd d �= | jd d �= d| _d| _d| _d S rR )r r r r r r r r r' r! r* r" r# r( r$ r% rU r& r) rV rW rX rO rO rP �cleanup� s( z Zone.cleanupc sN |dkr8dd� |D �| _ tt| ��|dd� | j D �� ntt| ��||� d S )Nr& c S s g | ]}t j|d ��qS ))Zrule_str)r Z Rich_Rule��.0�srO rO rP � <listcomp>� � z$Zone.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS rO )�strr] rO rO rP r` � ra )rU rS r � __setattr__)rY r. r1 rZ rO rP rc � s zZone.__setattr__c s t t| ��� }|d= |S )Nr )rS r �export_config_dict)rY ZconfrZ rO rP rd � s zZone.export_config_dictc C sv t | ||||� | j|d v r2ttjd�| j���|dkr\|tvrXttjd�| j|����n|dkr�|D ]f}t|�s�ttj d�| j|���|d D ]:}|| jkr�q�||d | j v r�ttj d�| j||���q�qhn�|d k�rr|D ]�}t |��s$t |��s$t |��s$|�d ��s$ttjd �| j|���|d D ]B}|| jk�r@�q,||d | jv �r,ttjd �| j||����q,q�d S ) NZpoliciesz0Zone '{}': Can't have the same name as a policy.r z Zone '{}': invalid target '{}'r$ z!Zone '{}': invalid interface '{}'Zzonesz4Zone '{}': interface '{}' already bound to zone '{}'r% �ipset:z Zone '{}': invalid source '{}'z1Zone '{}': source '{}' already bound to zone '{}')r r. r r Z NAME_CONFLICT�formatr �INVALID_TARGETr ZINVALID_INTERFACEr$ r r r � startswith� INVALID_ADDRr% )rY r �itemZ all_configZall_io_objectsr6 r3 r8 rO rO rP � _check_config� sT � � �� �� � ��zZone._check_configc s� t t| ��|� |�d�r.ttjd�|���n�|�d�rLttjd�|���nl|� d�dkrnttjd�|���nJd|v r�|d |� d�� }n|}t |�t � kr�ttjd�|t |�t � ���d S )Nr- z$Zone '{}': name can't start with '/'z"Zone '{}': name can't end with '/'� z%Zone '{}': name has more than one '/'z'Zone '{}': name has {} chars, max is {}) rS r � check_namerh r r � INVALID_NAMErf �endswith�count�find�lenr )rY r. Z checked_namerZ rO rP rm � s, � �� ��zZone.check_namec C s� d| _ d | _d| _d| _d| _|jD ]}|| jvr$| j�|� q$|jD ]}|| jvrF| j�|� qF|jD ]}|| jvrh| j�|� qh|j D ]}|| j vr�| j �|� q�|j D ]}|| j vr�| j �|� q�|j D ]}|| j vr�| j �|� q�|j r�d| _ |j �rd| _ |jD ] }|| jv�r | j�|� �q |jD ] }|| jv�r0| j�|� �q0|jD ]"} | j�| � | j�t| �� �qV|j�r�d| _d S )NTr )rV �filenamer r r r$ �appendr% r r r' r! r* r" r# r( rU r& rb r) ) rY r3 r6 r8 r4 r/ �protoZicmpr* r7 rO rO rP �combine� sL z Zone.combine)�__name__� __module__� __qualname__�__doc__rK ZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRS� staticmethodrQ rT r\ rc rd rk rm rv � __classcell__rO rO rZ rP r ( s� ��� % r c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�zone_ContentHandlerc C s" t �| |� d | _d| _d | _d S )NF)r rT �_rule� _rule_errorZ _limit_ok)rY rj rO rO rP rT s z zone_ContentHandler.__init__c C s� t �| ||� | jrd S | j�||� t| ||�r6d S |dkr�d|v rVt�d|d � d|v rj|d | j_d|v r�t�d|d � d|v r�|d }|t vr�t t j |��|dkr�|t kr�|| j_�n�|d kr�| jjr�t�d � nd | j_�n�|d k�rh| j�rt�d � d | _d S d|v�r.t�d� d | _d S |d | jjv�rT| jj�|d � nt�d|d � �n2|dk�r`| j�r | jj�r�t�dt| j�� d | _d S d}d|v �r�|d �� dv �r�d }d } }}d|v �r�|d }d|v �r�|d }d|v �r|d }tj||||d�| j_d S d|v�rBd|v�rBt�d� d S d|v �rdd|v �rdt�d� d S d|v �r~t�d |d � d|v �r�t�d � d S d|v �r�t|d ��s�t|d ��s�t|d ��s�t t j|d ��d|v �r d |d }|| jj v�r| jj �|� nt�d |d � d|v �r�|d }|| jj v�rN| jj �|� nt�d |d � n:|d k�r�| jj �r�t�d!� nd | j_ nt�d"|� d S d S )#Nr3 r. z'Ignoring deprecated attribute name='%s'r r? z,Ignoring deprecated attribute immutable='%s'r r r* z Forward already set, ignoring.Tr6 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r8 z:Invalid rule: More than one source in rule '%s', ignoring.FrD )Zyes�truerB rC rE )rD z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.r@ z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.r> z+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s') r � startElementr rj Zparser_check_element_attrsr r Zwarningr r r r rg r r r* r~ r$ rt r8 rb �lowerr Z Rich_Sourcer r r ri r% r) ) rY r. �attrsr rD �addrrC rE �entryrO rO rP r� s� � � � � � � � � � � � z zone_ContentHandler.startElementc C s t �| |� t| |� d S )N)r � endElementr )rY r. rO rO rP r� � s z zone_ContentHandler.endElementN)rw rx ry rT r� r� rO rO rO rP r} s pr} Fc C s& t � }| �d�s ttjd| ��| d d� |_|s>|�|j� | |_||_|� t j �rZdnd|_ |j |_ d|_t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd| �� ��W Y d } ~ n d } ~ 0 0 W d � n1 �s0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid zone file: %s)r ro r r rn r. rm rs �pathrh r � ETC_FIREWALLDZbuiltin�defaultr* r} �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZ INVALID_ZONEZ getException) rs r� Z no_check_namer3 �handler�parserr. �fr8 �msgrO rO rP r � s> � ��:r c C sT |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� i }| j�r| jd k�r| j|d < | jtk�r*| j|d < |�d |� |�d � t| |� t| j�D ]*} |�d� |�dd| i� |�d � �qTt| j �D ]N} |�d� d| v �r�|�dd| dd � i� n|�dd| i� |�d � �q�| j �r|�d� |�di � |�d � | j �r*|�d� |�di � |�d � |� d � |�d � |� � |�!� ~d S )Nr� z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r3 � z r6 r. re r8 rE � rB r> r* )"r� rs r. �os�exists�shutil�copy2� Exceptionr �error�dirnamerh r r� �mkdir�ior� r Z startDocumentr r r r� ZignorableWhitespacer r r$ Z simpleElementr% r) r* r� Z endDocument�close) r3 r� �_pathr. r� �dirpathr� r� r� r6 r8 rO rO rP r � s` $ r )F)N)&�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r r Zfirewall.core.baser r Zfirewall.core.io.io_objectr r r Zfirewall.core.io.policyr r r r Z firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r r} r r rO rO rO rP �<module> s$ e| !