File manager - Edit - /home/newsbmcs.com/public_html/static/img/logo/io.zip
Back
PK �I�Z+�0�7 �7 LC_MESSAGES/django.monu �[��� �� � � K \ � 8 � � � � � ' 8 I O U [ a ! g � � � � � � � � � � � � � � $ . S [ p w � � � � � � � � � � � � $ ' + S Y g � o � � � < H > � ; � ( # D h � � � � � � & G Q Z c � � � � . � � � � � Z � R [ d k q x ~ � � � � � � � � � � � � $ + 3 > L W a { � � � � � � � � $ � � � ; P c u � � � � � � � � F � 0 " o S * � B � 1 8 C T k s � � � � E � G � /! 9! A! O! b! i! s! �! �! �! �! �! �! �! �! �! �! �! �! �! " 4" O" g" k" t" y" �" �" �" �" �" �" �" Y �" # # 0# ;# ?# I# O# S# X# l# # �# �# �# �# �# �# $ $ *$ >$ O$ a$ u$ �$ �$ �$ �$ �$ �$ �$ % % % % $% (% ,% 0% 4% 8% <% @% I% N% R% V% Y% ^% b% U o% 5 �& �& ' &' 6' J' ^' r' �' �' �' �' �' ! �' �' �' �' �' �' �' �' �' ( ( "( *( ?( O( g( ( �( �( �( �( �( �( �( ) ) ) -) 6) >) H) N) ^) n) w) �) ' �) �) �) �) � �) � �* � ?+ G �+ C ;, C , �, �, �, # - ,- H- \- q- �- �- �- �- $ �- . . #. ,. J. Q. ]. c. ; s. �. �. �. �. c �. 0/ 7/ M/ U/ f/ q/ �/ �/ �/ �/ �/ �/ �/ �/ �/ �/ �/ �/ 0 0 0 0 '0 60 <0 F0 P0 Z0 j0 0 �0 �0 �0 �0 �0 �0 �0 �0 �0 1 * 1 81 O1 B e1 �1 �1 �1 �1 2 2 2 &2 .2 62 92 E D2 * �2 m �2 & #3 5 J3 �3 �3 �3 �3 �3 �3 �3 �3 �3 �3 G 4 I N4 �4 �4 �4 �4 �4 �4 �4 5 5 5 :5 >5 E5 O5 W5 g5 m5 t5 z5 �5 �5 �5 �5 �5 �5 6 6 6 6 6 )6 -6 :6 O6 M Z6 �6 �6 �6 �6 �6 �6 �6 �6 �6 7 7 7 7 7 7 7 &7 +7 07 57 ;7 B7 I7 R7 [7 c7 i7 o7 u7 z7 �7 �7 �7 �7 �7 �7 �7 �7 �7 �7 �7 �7 �7 �7 �7 �7 �7 �7 �7 �7 � � K J � � � � o � V � � U � � � � e � � � � 6 Z � � i f � � W + � w � @ � � � � � E � y � � 8 H � I � � 4 � 3 z � . O � 9 � m � D � 2 � } ) � � v A ~ - g � � ] � � P a � � � F � � # � t � � � G � � h � � { � � n , R / � � � \ S � � � ^ � B ? ' : [ � 5 x � � � � ; � | � � r � s � � ( � � � b u � � Y � 1 L 7 � ` 0 M � " � � � � _ � $ * X k � � � � l � � � � ! � � � � < � d j � % � p C � � � > � q N � T � c & � = � Q � %(model_name)s with this %(field_label)s already exists. %(size)d byte %(size)d bytes %d day %d days %d hour %d hours %d minute %d minutes %d month %d months %d week %d weeks %d year %d years %s GB %s KB %s MB %s PB %s TB (Hidden field %(name)s) %(error)s , 0 minutes AM Afrikaans Albanian April Arabic Argentinian Spanish August Azerbaijani Basque Belarusian Bengali Big (8 byte) integer Boolean (Either True or False) Boolean (Either True, False or None) Bosnian Brazilian Portuguese Breton British English Bulgarian Burmese Catalan Change Clear Comma-separated integers Croatian Currently Czech Danish Date (with time) Date (without time) December Decimal number Delete Directory indexes are not allowed here. Dutch Email address English Ensure this filename has at most %(max)d character (it has %(length)d). Ensure this filename has at most %(max)d characters (it has %(length)d). Ensure this value has at least %(limit_value)d character (it has %(show_value)d). Ensure this value has at least %(limit_value)d characters (it has %(show_value)d). Ensure this value has at most %(limit_value)d character (it has %(show_value)d). Ensure this value has at most %(limit_value)d characters (it has %(show_value)d). Ensure this value is %(limit_value)s (it is %(show_value)s). Ensure this value is greater than or equal to %(limit_value)s. Ensure this value is less than or equal to %(limit_value)s. Enter a list of values. Enter a number. Enter a valid IPv4 address. Enter a valid IPv4 or IPv6 address. Enter a valid IPv6 address. Enter a valid URL. Enter a valid date. Enter a valid date/time. Enter a valid email address. Enter a valid time. Enter a valid value. Enter a whole number. Enter only digits separated by commas. Esperanto Estonian February Field of type: %(field_type)s File File path Finnish Floating point number Foreign Key (type determined by related field) French Fri Friday Frisian Future %(verbose_name_plural)s not available because %(class_name)s.allow_future is False. Galician Georgian German Greek Hebrew Hindi Hungarian IP address IPv4 address Icelandic Image Index of %(directory)s Indonesian Integer Interlingua Irish Italian January Japanese July June Kannada Kazakh Khmer Korean Latvian Lithuanian Luxembourgish Macedonian Malayalam Many-to-many relationship March May Mexican Spanish Mon Monday Mongolian Nepali Nicaraguan Spanish No No %(verbose_name_plural)s available No day specified No file was submitted. No file was submitted. Check the encoding type on the form. No month specified No week specified No year specified Norwegian Nynorsk November October One-to-one relationship Order Ossetic PM Persian Please correct the duplicate data for %(field)s, which must be unique. Please correct the duplicate data for %(field)s. Please correct the duplicate data for %(field_name)s which must be unique for the %(lookup)s in %(date_field)s. Please correct the duplicate values below. Please either submit a file or check the clear checkbox, not both. Polish Portuguese Positive integer Positive small integer Punjabi Raw binary data Romanian Russian Sat Saturday Select a valid choice. %(value)s is not one of the available choices. Select a valid choice. That choice is not one of the available choices. September Serbian Serbian Latin Simplified Chinese Slovak Slovenian Slug (up to %(max_length)s) Small integer Spanish String (up to %(max_length)s) Sun Sunday Swahili Swedish Tamil Tatar Telugu Text Thai The submitted file is empty. This field cannot be blank. This field cannot be null. This field is required. Thu Thursday Time Traditional Chinese Tue Tuesday Turkish URL Udmurt Ukrainian Unknown Upload a valid image. The file you uploaded was either not an image or a corrupted image. Urdu Venezuelan Spanish Vietnamese Wed Wednesday Welsh Yes a.m. abbrev. monthApril abbrev. monthAug. abbrev. monthDec. abbrev. monthFeb. abbrev. monthJan. abbrev. monthJuly abbrev. monthJune abbrev. monthMarch abbrev. monthMay abbrev. monthNov. abbrev. monthOct. abbrev. monthSept. alt. monthApril alt. monthAugust alt. monthDecember alt. monthFebruary alt. monthJanuary alt. monthJuly alt. monthJune alt. monthMarch alt. monthMay alt. monthNovember alt. monthOctober alt. monthSeptember and apr aug dec feb jan jul jun mar may midnight noon nov oct or p.m. sep yes,no,maybe Project-Id-Version: django Report-Msgid-Bugs-To: PO-Revision-Date: 2019-11-05 00:38+0000 Last-Translator: Ramiro Morales Language-Team: Ido (http://www.transifex.com/django/django/language/io/) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Language: io Plural-Forms: nplurals=2; plural=(n != 1); La %(model_name)s kun ica %(field_label)s ja existas. %(size)d byte %(size)d bytes %d dio %d dii %d horo %d hori %d minuto %d minuti %d monato %d monati %d semano %d semani %d yaro %d yari %s GB %s KB %s MB %s PB %s TB (Okulta feldo %(name)s) %(error)s , 0 minuti AM Afrikaans Shqip Aprilo العربية Español de Argentina Agosto Azərbaycanca Euskara беларуская বাংলা Granda (8 byte) integro Booleano (True o False) Booleano (True, False o None) босански Português do Brasil Brezhoneg British English български Burmese Català Modifikar Vakuigar Integri separata per komi hrvatski Aktuale čeština dansk Dato (kun horo) Dato (sen horo) Decembro Decimala numero Eliminar Onu ne permisas direktorio indexi hike. Nederlands E-postala adreso English Verifikez ke ica dosiero nomo havas %(max)d skribsigno admaxime (olu havas %(length)d). Verifikez ke ica arkivo nomo havas %(max)d skribsigni admaxime (olu havas %(length)d). Verifikez ke ica datumo havas %(limit_value)d litero adminime (olu havas %(show_value)d). Verifikez ke ica datumo havas %(limit_value)d literi adminime (olu havas %(show_value)d). Verifikez ke ica datumo havas %(limit_value)d litero admaxime (olu havas %(show_value)d). Verifikez ke ica datumo havas %(limit_value)d literi admaxime (olu havas %(show_value)d). Verifikez ke ica datumo esas %(limit_value)s (olu esas %(show_value)s). Verifikez ke ica datumo esas majora kam od egala a %(limit_value)s. Verifikez ke ica datumo esas minora kam od egala a %(limit_value)s. Skribez listo de datumi. Skribez numero. Skribez valida IPv4 adreso. Skribez valida adreso IPv4 od IPv6. Skribez valida IPv6 adreso. Skribez valida URL. Skribez valida dato. Skribez valida dato/horo. Skribez valida e-posto adreso. Skribez valida horo. Skribez valida datumo. Skribez kompleta numero Skribez nur cifri separata per komi. Esperanto Eesti Februaro Feldo de tipo: %(field_type)s Arkivo Arkivo voyo Suomi Glitkomo numero Exterklefo (la tipo esas determinata per la relatata feldo) Français Ven Venerdio Frysk La futura %(verbose_name_plural)s ne esas disponebla pro ke %(class_name)s.allow_future esas False. Galego ქართული Deutsch Ελληνικά עברית हिन्दी Magyar IP adreso IPv4 adreso Íslenska Imajo Indexi di %(directory)s Bahasa Indonesia Integro Interlingua Gaeilge Italiano Januaro 日本語 Julio Junio Kannaḍa Қазақша Khmer 한국어 Latviešu Lietuvių Lëtzebuergesch Македонски മലയാളം Multi-a-multi parenteso Marto Mayo Español de México Lun Lundio Монгол नेपाली Español de Nicaragua No Ne esas %(verbose_name_plural)s disponebla La dio ne specizigesis Nula arkivo sendesis. Nula arkivo sendesis. Verifikez la kodexigo tipo en la formulario. La monato ne specizigesis La semano ne specizigesis La yaro ne specizigesis Norsk nynorsk Novembro Oktobro Un-ad-un parenteso Ordinar Ossetic PM فارسی Korektigez la duopligata datumi por %(field)s, qui mustas esar unika. Koretigez duopligata datumi por %(field)s. Korektigez la duopligata datumi por %(field_name)s qui mustas esar unika por la %(lookup)s en %(date_field)s. Korektigez la duopligata datumi infre. Sendez arkivo o markizez la vakua markbuxo, ne la du. Polski Português Positiva integro Positiva mikra integro ਪੰਜਾਬੀ Kruda binara datumo Română Русский Sat Saturdio Selektez valida selekto. %(value)s ne esas un de la disponebla selekti. Selektez valida selekto. Ita selekto ne esas un de la disponebla selekti. Septembro Српски / srpski Serbian Latin 简体中文 Slovenčina Slovenščina Slug (til %(max_length)s) Mikra integro Español String (til %(max_length)s) Sun Sundio Kiswahili Svenska தமிழ் Tatar Telugu Texto ไทย La sendita arkivo esas vakua. Ica feldo ne povas esar vakua. Ica feldo ne povas esar nula. Ica feldo esas obligata. Jov Jovdio Horo 繁體中文 Mar Mardio Türkçe URL Удмурт Українська Nekonocata Kargez valida imajo. La arkivo qua vu kargis ne esis imajo od esis defektiva. اُردُو Español de Venezuela Tiếng Việt Mer Merkurdio Cymraeg Yes a.m. Aprilo Ago. Dec. Feb. Jan. Julio Junio Marto Mayo Nov. Okt. Sept. Aprilo Agosto Decembro Februaro Januaro Julio Junio Marto Mayo Novembro Oktobro Septembro e apr ago dec feb jan jul jun mar may noktomezo dimezo nov okt o p.m. sep yes,no,forsan PK �I�Z�!9TZ TZ LC_MESSAGES/django.ponu �[��� # This file is distributed under the same license as the Django package. # # Translators: # Viko Bartero <inactive+tergrundo@transifex.com>, 2014 msgid "" msgstr "" "Project-Id-Version: django\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2019-09-27 22:40+0200\n" "PO-Revision-Date: 2019-11-05 00:38+0000\n" "Last-Translator: Ramiro Morales\n" "Language-Team: Ido (http://www.transifex.com/django/django/language/io/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" "Language: io\n" "Plural-Forms: nplurals=2; plural=(n != 1);\n" msgid "Afrikaans" msgstr "Afrikaans" msgid "Arabic" msgstr "العربية" msgid "Asturian" msgstr "" msgid "Azerbaijani" msgstr "Azərbaycanca" msgid "Bulgarian" msgstr "български" msgid "Belarusian" msgstr "беларуская" msgid "Bengali" msgstr "বাংলা" msgid "Breton" msgstr "Brezhoneg" msgid "Bosnian" msgstr "босански" msgid "Catalan" msgstr "Català" msgid "Czech" msgstr "čeština" msgid "Welsh" msgstr "Cymraeg" msgid "Danish" msgstr "dansk" msgid "German" msgstr "Deutsch" msgid "Lower Sorbian" msgstr "" msgid "Greek" msgstr "Ελληνικά" msgid "English" msgstr "English" msgid "Australian English" msgstr "" msgid "British English" msgstr "British English" msgid "Esperanto" msgstr "Esperanto" msgid "Spanish" msgstr "Español" msgid "Argentinian Spanish" msgstr "Español de Argentina" msgid "Colombian Spanish" msgstr "" msgid "Mexican Spanish" msgstr "Español de México" msgid "Nicaraguan Spanish" msgstr "Español de Nicaragua" msgid "Venezuelan Spanish" msgstr "Español de Venezuela" msgid "Estonian" msgstr "Eesti" msgid "Basque" msgstr "Euskara" msgid "Persian" msgstr "فارسی" msgid "Finnish" msgstr "Suomi" msgid "French" msgstr "Français" msgid "Frisian" msgstr "Frysk" msgid "Irish" msgstr "Gaeilge" msgid "Scottish Gaelic" msgstr "" msgid "Galician" msgstr "Galego" msgid "Hebrew" msgstr "עברית" msgid "Hindi" msgstr "हिन्दी" msgid "Croatian" msgstr "hrvatski" msgid "Upper Sorbian" msgstr "" msgid "Hungarian" msgstr "Magyar" msgid "Armenian" msgstr "" msgid "Interlingua" msgstr "Interlingua" msgid "Indonesian" msgstr "Bahasa Indonesia" msgid "Ido" msgstr "" msgid "Icelandic" msgstr "Íslenska" msgid "Italian" msgstr "Italiano" msgid "Japanese" msgstr "日本語" msgid "Georgian" msgstr "ქართული" msgid "Kabyle" msgstr "" msgid "Kazakh" msgstr "Қазақша" msgid "Khmer" msgstr "Khmer" msgid "Kannada" msgstr "Kannaḍa" msgid "Korean" msgstr "한국어" msgid "Luxembourgish" msgstr "Lëtzebuergesch" msgid "Lithuanian" msgstr "Lietuvių" msgid "Latvian" msgstr "Latviešu" msgid "Macedonian" msgstr "Македонски" msgid "Malayalam" msgstr "മലയാളം" msgid "Mongolian" msgstr "Монгол" msgid "Marathi" msgstr "" msgid "Burmese" msgstr "Burmese" msgid "Norwegian Bokmål" msgstr "" msgid "Nepali" msgstr "नेपाली" msgid "Dutch" msgstr "Nederlands" msgid "Norwegian Nynorsk" msgstr "Norsk nynorsk" msgid "Ossetic" msgstr "Ossetic" msgid "Punjabi" msgstr "ਪੰਜਾਬੀ" msgid "Polish" msgstr "Polski" msgid "Portuguese" msgstr "Português" msgid "Brazilian Portuguese" msgstr "Português do Brasil" msgid "Romanian" msgstr "Română" msgid "Russian" msgstr "Русский" msgid "Slovak" msgstr "Slovenčina" msgid "Slovenian" msgstr "Slovenščina" msgid "Albanian" msgstr "Shqip" msgid "Serbian" msgstr "Српски / srpski" msgid "Serbian Latin" msgstr "Serbian Latin" msgid "Swedish" msgstr "Svenska" msgid "Swahili" msgstr "Kiswahili" msgid "Tamil" msgstr "தமிழ்" msgid "Telugu" msgstr "Telugu" msgid "Thai" msgstr "ไทย" msgid "Turkish" msgstr "Türkçe" msgid "Tatar" msgstr "Tatar" msgid "Udmurt" msgstr "Удмурт" msgid "Ukrainian" msgstr "Українська" msgid "Urdu" msgstr "اُردُو" msgid "Uzbek" msgstr "" msgid "Vietnamese" msgstr "Tiếng Việt" msgid "Simplified Chinese" msgstr "简体中文" msgid "Traditional Chinese" msgstr "繁體中文" msgid "Messages" msgstr "" msgid "Site Maps" msgstr "" msgid "Static Files" msgstr "" msgid "Syndication" msgstr "" msgid "That page number is not an integer" msgstr "" msgid "That page number is less than 1" msgstr "" msgid "That page contains no results" msgstr "" msgid "Enter a valid value." msgstr "Skribez valida datumo." msgid "Enter a valid URL." msgstr "Skribez valida URL." msgid "Enter a valid integer." msgstr "" msgid "Enter a valid email address." msgstr "Skribez valida e-posto adreso." #. Translators: "letters" means latin letters: a-z and A-Z. msgid "" "Enter a valid “slug” consisting of letters, numbers, underscores or hyphens." msgstr "" msgid "" "Enter a valid “slug” consisting of Unicode letters, numbers, underscores, or " "hyphens." msgstr "" msgid "Enter a valid IPv4 address." msgstr "Skribez valida IPv4 adreso." msgid "Enter a valid IPv6 address." msgstr "Skribez valida IPv6 adreso." msgid "Enter a valid IPv4 or IPv6 address." msgstr "Skribez valida adreso IPv4 od IPv6." msgid "Enter only digits separated by commas." msgstr "Skribez nur cifri separata per komi." #, python-format msgid "Ensure this value is %(limit_value)s (it is %(show_value)s)." msgstr "" "Verifikez ke ica datumo esas %(limit_value)s (olu esas %(show_value)s)." #, python-format msgid "Ensure this value is less than or equal to %(limit_value)s." msgstr "Verifikez ke ica datumo esas minora kam od egala a %(limit_value)s." #, python-format msgid "Ensure this value is greater than or equal to %(limit_value)s." msgstr "Verifikez ke ica datumo esas majora kam od egala a %(limit_value)s." #, python-format msgid "" "Ensure this value has at least %(limit_value)d character (it has " "%(show_value)d)." msgid_plural "" "Ensure this value has at least %(limit_value)d characters (it has " "%(show_value)d)." msgstr[0] "" "Verifikez ke ica datumo havas %(limit_value)d litero adminime (olu havas " "%(show_value)d)." msgstr[1] "" "Verifikez ke ica datumo havas %(limit_value)d literi adminime (olu havas " "%(show_value)d)." #, python-format msgid "" "Ensure this value has at most %(limit_value)d character (it has " "%(show_value)d)." msgid_plural "" "Ensure this value has at most %(limit_value)d characters (it has " "%(show_value)d)." msgstr[0] "" "Verifikez ke ica datumo havas %(limit_value)d litero admaxime (olu havas " "%(show_value)d)." msgstr[1] "" "Verifikez ke ica datumo havas %(limit_value)d literi admaxime (olu havas " "%(show_value)d)." msgid "Enter a number." msgstr "Skribez numero." #, python-format msgid "Ensure that there are no more than %(max)s digit in total." msgid_plural "Ensure that there are no more than %(max)s digits in total." msgstr[0] "" msgstr[1] "" #, python-format msgid "Ensure that there are no more than %(max)s decimal place." msgid_plural "Ensure that there are no more than %(max)s decimal places." msgstr[0] "" msgstr[1] "" #, python-format msgid "" "Ensure that there are no more than %(max)s digit before the decimal point." msgid_plural "" "Ensure that there are no more than %(max)s digits before the decimal point." msgstr[0] "" msgstr[1] "" #, python-format msgid "" "File extension “%(extension)s” is not allowed. Allowed extensions are: " "%(allowed_extensions)s." msgstr "" msgid "Null characters are not allowed." msgstr "" msgid "and" msgstr "e" #, python-format msgid "%(model_name)s with this %(field_labels)s already exists." msgstr "" #, python-format msgid "Value %(value)r is not a valid choice." msgstr "" msgid "This field cannot be null." msgstr "Ica feldo ne povas esar nula." msgid "This field cannot be blank." msgstr "Ica feldo ne povas esar vakua." #, python-format msgid "%(model_name)s with this %(field_label)s already exists." msgstr "La %(model_name)s kun ica %(field_label)s ja existas." #. Translators: The 'lookup_type' is one of 'date', 'year' or 'month'. #. Eg: "Title must be unique for pub_date year" #, python-format msgid "" "%(field_label)s must be unique for %(date_field_label)s %(lookup_type)s." msgstr "" #, python-format msgid "Field of type: %(field_type)s" msgstr "Feldo de tipo: %(field_type)s" #, python-format msgid "“%(value)s” value must be either True or False." msgstr "" #, python-format msgid "“%(value)s” value must be either True, False, or None." msgstr "" msgid "Boolean (Either True or False)" msgstr "Booleano (True o False)" #, python-format msgid "String (up to %(max_length)s)" msgstr "String (til %(max_length)s)" msgid "Comma-separated integers" msgstr "Integri separata per komi" #, python-format msgid "" "“%(value)s” value has an invalid date format. It must be in YYYY-MM-DD " "format." msgstr "" #, python-format msgid "" "“%(value)s” value has the correct format (YYYY-MM-DD) but it is an invalid " "date." msgstr "" msgid "Date (without time)" msgstr "Dato (sen horo)" #, python-format msgid "" "“%(value)s” value has an invalid format. It must be in YYYY-MM-DD HH:MM[:ss[." "uuuuuu]][TZ] format." msgstr "" #, python-format msgid "" "“%(value)s” value has the correct format (YYYY-MM-DD HH:MM[:ss[.uuuuuu]]" "[TZ]) but it is an invalid date/time." msgstr "" msgid "Date (with time)" msgstr "Dato (kun horo)" #, python-format msgid "“%(value)s” value must be a decimal number." msgstr "" msgid "Decimal number" msgstr "Decimala numero" #, python-format msgid "" "“%(value)s” value has an invalid format. It must be in [DD] [[HH:]MM:]ss[." "uuuuuu] format." msgstr "" msgid "Duration" msgstr "" msgid "Email address" msgstr "E-postala adreso" msgid "File path" msgstr "Arkivo voyo" #, python-format msgid "“%(value)s” value must be a float." msgstr "" msgid "Floating point number" msgstr "Glitkomo numero" #, python-format msgid "“%(value)s” value must be an integer." msgstr "" msgid "Integer" msgstr "Integro" msgid "Big (8 byte) integer" msgstr "Granda (8 byte) integro" msgid "IPv4 address" msgstr "IPv4 adreso" msgid "IP address" msgstr "IP adreso" #, python-format msgid "“%(value)s” value must be either None, True or False." msgstr "" msgid "Boolean (Either True, False or None)" msgstr "Booleano (True, False o None)" msgid "Positive integer" msgstr "Positiva integro" msgid "Positive small integer" msgstr "Positiva mikra integro" #, python-format msgid "Slug (up to %(max_length)s)" msgstr "Slug (til %(max_length)s)" msgid "Small integer" msgstr "Mikra integro" msgid "Text" msgstr "Texto" #, python-format msgid "" "“%(value)s” value has an invalid format. It must be in HH:MM[:ss[.uuuuuu]] " "format." msgstr "" #, python-format msgid "" "“%(value)s” value has the correct format (HH:MM[:ss[.uuuuuu]]) but it is an " "invalid time." msgstr "" msgid "Time" msgstr "Horo" msgid "URL" msgstr "URL" msgid "Raw binary data" msgstr "Kruda binara datumo" #, python-format msgid "“%(value)s” is not a valid UUID." msgstr "" msgid "Universally unique identifier" msgstr "" msgid "File" msgstr "Arkivo" msgid "Image" msgstr "Imajo" #, python-format msgid "%(model)s instance with %(field)s %(value)r does not exist." msgstr "" msgid "Foreign Key (type determined by related field)" msgstr "Exterklefo (la tipo esas determinata per la relatata feldo)" msgid "One-to-one relationship" msgstr "Un-ad-un parenteso" #, python-format msgid "%(from)s-%(to)s relationship" msgstr "" #, python-format msgid "%(from)s-%(to)s relationships" msgstr "" msgid "Many-to-many relationship" msgstr "Multi-a-multi parenteso" #. Translators: If found as last label character, these punctuation #. characters will prevent the default label_suffix to be appended to the #. label msgid ":?.!" msgstr "" msgid "This field is required." msgstr "Ica feldo esas obligata." msgid "Enter a whole number." msgstr "Skribez kompleta numero" msgid "Enter a valid date." msgstr "Skribez valida dato." msgid "Enter a valid time." msgstr "Skribez valida horo." msgid "Enter a valid date/time." msgstr "Skribez valida dato/horo." msgid "Enter a valid duration." msgstr "" #, python-brace-format msgid "The number of days must be between {min_days} and {max_days}." msgstr "" msgid "No file was submitted. Check the encoding type on the form." msgstr "Nula arkivo sendesis. Verifikez la kodexigo tipo en la formulario." msgid "No file was submitted." msgstr "Nula arkivo sendesis." msgid "The submitted file is empty." msgstr "La sendita arkivo esas vakua." #, python-format msgid "Ensure this filename has at most %(max)d character (it has %(length)d)." msgid_plural "" "Ensure this filename has at most %(max)d characters (it has %(length)d)." msgstr[0] "" "Verifikez ke ica dosiero nomo havas %(max)d skribsigno admaxime (olu havas " "%(length)d)." msgstr[1] "" "Verifikez ke ica arkivo nomo havas %(max)d skribsigni admaxime (olu havas " "%(length)d)." msgid "Please either submit a file or check the clear checkbox, not both." msgstr "Sendez arkivo o markizez la vakua markbuxo, ne la du." msgid "" "Upload a valid image. The file you uploaded was either not an image or a " "corrupted image." msgstr "" "Kargez valida imajo. La arkivo qua vu kargis ne esis imajo od esis defektiva." #, python-format msgid "Select a valid choice. %(value)s is not one of the available choices." msgstr "" "Selektez valida selekto. %(value)s ne esas un de la disponebla selekti." msgid "Enter a list of values." msgstr "Skribez listo de datumi." msgid "Enter a complete value." msgstr "" msgid "Enter a valid UUID." msgstr "" #. Translators: This is the default suffix added to form field labels msgid ":" msgstr "" #, python-format msgid "(Hidden field %(name)s) %(error)s" msgstr "(Okulta feldo %(name)s) %(error)s" msgid "ManagementForm data is missing or has been tampered with" msgstr "" #, python-format msgid "Please submit %d or fewer forms." msgid_plural "Please submit %d or fewer forms." msgstr[0] "" msgstr[1] "" #, python-format msgid "Please submit %d or more forms." msgid_plural "Please submit %d or more forms." msgstr[0] "" msgstr[1] "" msgid "Order" msgstr "Ordinar" msgid "Delete" msgstr "Eliminar" #, python-format msgid "Please correct the duplicate data for %(field)s." msgstr "Koretigez duopligata datumi por %(field)s." #, python-format msgid "Please correct the duplicate data for %(field)s, which must be unique." msgstr "Korektigez la duopligata datumi por %(field)s, qui mustas esar unika." #, python-format msgid "" "Please correct the duplicate data for %(field_name)s which must be unique " "for the %(lookup)s in %(date_field)s." msgstr "" "Korektigez la duopligata datumi por %(field_name)s qui mustas esar unika por " "la %(lookup)s en %(date_field)s." msgid "Please correct the duplicate values below." msgstr "Korektigez la duopligata datumi infre." msgid "The inline value did not match the parent instance." msgstr "" msgid "Select a valid choice. That choice is not one of the available choices." msgstr "" "Selektez valida selekto. Ita selekto ne esas un de la disponebla selekti." #, python-format msgid "“%(pk)s” is not a valid value." msgstr "" #, python-format msgid "" "%(datetime)s couldn’t be interpreted in time zone %(current_timezone)s; it " "may be ambiguous or it may not exist." msgstr "" msgid "Clear" msgstr "Vakuigar" msgid "Currently" msgstr "Aktuale" msgid "Change" msgstr "Modifikar" msgid "Unknown" msgstr "Nekonocata" msgid "Yes" msgstr "Yes" msgid "No" msgstr "No" msgid "Year" msgstr "" msgid "Month" msgstr "" msgid "Day" msgstr "" msgid "yes,no,maybe" msgstr "yes,no,forsan" #, python-format msgid "%(size)d byte" msgid_plural "%(size)d bytes" msgstr[0] "%(size)d byte" msgstr[1] "%(size)d bytes" #, python-format msgid "%s KB" msgstr "%s KB" #, python-format msgid "%s MB" msgstr "%s MB" #, python-format msgid "%s GB" msgstr "%s GB" #, python-format msgid "%s TB" msgstr "%s TB" #, python-format msgid "%s PB" msgstr "%s PB" msgid "p.m." msgstr "p.m." msgid "a.m." msgstr "a.m." msgid "PM" msgstr "PM" msgid "AM" msgstr "AM" msgid "midnight" msgstr "noktomezo" msgid "noon" msgstr "dimezo" msgid "Monday" msgstr "Lundio" msgid "Tuesday" msgstr "Mardio" msgid "Wednesday" msgstr "Merkurdio" msgid "Thursday" msgstr "Jovdio" msgid "Friday" msgstr "Venerdio" msgid "Saturday" msgstr "Saturdio" msgid "Sunday" msgstr "Sundio" msgid "Mon" msgstr "Lun" msgid "Tue" msgstr "Mar" msgid "Wed" msgstr "Mer" msgid "Thu" msgstr "Jov" msgid "Fri" msgstr "Ven" msgid "Sat" msgstr "Sat" msgid "Sun" msgstr "Sun" msgid "January" msgstr "Januaro" msgid "February" msgstr "Februaro" msgid "March" msgstr "Marto" msgid "April" msgstr "Aprilo" msgid "May" msgstr "Mayo" msgid "June" msgstr "Junio" msgid "July" msgstr "Julio" msgid "August" msgstr "Agosto" msgid "September" msgstr "Septembro" msgid "October" msgstr "Oktobro" msgid "November" msgstr "Novembro" msgid "December" msgstr "Decembro" msgid "jan" msgstr "jan" msgid "feb" msgstr "feb" msgid "mar" msgstr "mar" msgid "apr" msgstr "apr" msgid "may" msgstr "may" msgid "jun" msgstr "jun" msgid "jul" msgstr "jul" msgid "aug" msgstr "ago" msgid "sep" msgstr "sep" msgid "oct" msgstr "okt" msgid "nov" msgstr "nov" msgid "dec" msgstr "dec" msgctxt "abbrev. month" msgid "Jan." msgstr "Jan." msgctxt "abbrev. month" msgid "Feb." msgstr "Feb." msgctxt "abbrev. month" msgid "March" msgstr "Marto" msgctxt "abbrev. month" msgid "April" msgstr "Aprilo" msgctxt "abbrev. month" msgid "May" msgstr "Mayo" msgctxt "abbrev. month" msgid "June" msgstr "Junio" msgctxt "abbrev. month" msgid "July" msgstr "Julio" msgctxt "abbrev. month" msgid "Aug." msgstr "Ago." msgctxt "abbrev. month" msgid "Sept." msgstr "Sept." msgctxt "abbrev. month" msgid "Oct." msgstr "Okt." msgctxt "abbrev. month" msgid "Nov." msgstr "Nov." msgctxt "abbrev. month" msgid "Dec." msgstr "Dec." msgctxt "alt. month" msgid "January" msgstr "Januaro" msgctxt "alt. month" msgid "February" msgstr "Februaro" msgctxt "alt. month" msgid "March" msgstr "Marto" msgctxt "alt. month" msgid "April" msgstr "Aprilo" msgctxt "alt. month" msgid "May" msgstr "Mayo" msgctxt "alt. month" msgid "June" msgstr "Junio" msgctxt "alt. month" msgid "July" msgstr "Julio" msgctxt "alt. month" msgid "August" msgstr "Agosto" msgctxt "alt. month" msgid "September" msgstr "Septembro" msgctxt "alt. month" msgid "October" msgstr "Oktobro" msgctxt "alt. month" msgid "November" msgstr "Novembro" msgctxt "alt. month" msgid "December" msgstr "Decembro" msgid "This is not a valid IPv6 address." msgstr "" #, python-format msgctxt "String to return when truncating text" msgid "%(truncated_text)s…" msgstr "" msgid "or" msgstr "o" #. Translators: This string is used as a separator between list elements msgid ", " msgstr ", " #, python-format msgid "%d year" msgid_plural "%d years" msgstr[0] "%d yaro" msgstr[1] "%d yari" #, python-format msgid "%d month" msgid_plural "%d months" msgstr[0] "%d monato" msgstr[1] "%d monati" #, python-format msgid "%d week" msgid_plural "%d weeks" msgstr[0] "%d semano" msgstr[1] "%d semani" #, python-format msgid "%d day" msgid_plural "%d days" msgstr[0] "%d dio" msgstr[1] "%d dii" #, python-format msgid "%d hour" msgid_plural "%d hours" msgstr[0] "%d horo" msgstr[1] "%d hori" #, python-format msgid "%d minute" msgid_plural "%d minutes" msgstr[0] "%d minuto" msgstr[1] "%d minuti" msgid "0 minutes" msgstr "0 minuti" msgid "Forbidden" msgstr "" msgid "CSRF verification failed. Request aborted." msgstr "" msgid "" "You are seeing this message because this HTTPS site requires a “Referer " "header” to be sent by your Web browser, but none was sent. This header is " "required for security reasons, to ensure that your browser is not being " "hijacked by third parties." msgstr "" msgid "" "If you have configured your browser to disable “Referer” headers, please re-" "enable them, at least for this site, or for HTTPS connections, or for “same-" "origin” requests." msgstr "" msgid "" "If you are using the <meta name=\"referrer\" content=\"no-referrer\"> tag or " "including the “Referrer-Policy: no-referrer” header, please remove them. The " "CSRF protection requires the “Referer” header to do strict referer checking. " "If you’re concerned about privacy, use alternatives like <a rel=\"noreferrer" "\" …> for links to third-party sites." msgstr "" msgid "" "You are seeing this message because this site requires a CSRF cookie when " "submitting forms. This cookie is required for security reasons, to ensure " "that your browser is not being hijacked by third parties." msgstr "" msgid "" "If you have configured your browser to disable cookies, please re-enable " "them, at least for this site, or for “same-origin” requests." msgstr "" msgid "More information is available with DEBUG=True." msgstr "" msgid "No year specified" msgstr "La yaro ne specizigesis" msgid "Date out of range" msgstr "" msgid "No month specified" msgstr "La monato ne specizigesis" msgid "No day specified" msgstr "La dio ne specizigesis" msgid "No week specified" msgstr "La semano ne specizigesis" #, python-format msgid "No %(verbose_name_plural)s available" msgstr "Ne esas %(verbose_name_plural)s disponebla" #, python-format msgid "" "Future %(verbose_name_plural)s not available because %(class_name)s." "allow_future is False." msgstr "" "La futura %(verbose_name_plural)s ne esas disponebla pro ke %(class_name)s." "allow_future esas False." #, python-format msgid "Invalid date string “%(datestr)s” given format “%(format)s”" msgstr "" #, python-format msgid "No %(verbose_name)s found matching the query" msgstr "" msgid "Page is not “last”, nor can it be converted to an int." msgstr "" #, python-format msgid "Invalid page (%(page_number)s): %(message)s" msgstr "" #, python-format msgid "Empty list and “%(class_name)s.allow_empty” is False." msgstr "" msgid "Directory indexes are not allowed here." msgstr "Onu ne permisas direktorio indexi hike." #, python-format msgid "“%(path)s” does not exist" msgstr "" #, python-format msgid "Index of %(directory)s" msgstr "Indexi di %(directory)s" msgid "Django: the Web framework for perfectionists with deadlines." msgstr "" #, python-format msgid "" "View <a href=\"https://docs.djangoproject.com/en/%(version)s/releases/\" " "target=\"_blank\" rel=\"noopener\">release notes</a> for Django %(version)s" msgstr "" msgid "The install worked successfully! Congratulations!" msgstr "" #, python-format msgid "" "You are seeing this page because <a href=\"https://docs.djangoproject.com/en/" "%(version)s/ref/settings/#debug\" target=\"_blank\" rel=\"noopener" "\">DEBUG=True</a> is in your settings file and you have not configured any " "URLs." msgstr "" msgid "Django Documentation" msgstr "" msgid "Topics, references, & how-to’s" msgstr "" msgid "Tutorial: A Polling App" msgstr "" msgid "Get started with Django" msgstr "" msgid "Django Community" msgstr "" msgid "Connect, get help, or contribute" msgstr "" PK ���Z�`-�"P "P ipset.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2015-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """ipset io XML handler, reader, writer""" __all__ = [ "IPSet", "ipset_reader", "ipset_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.functions import checkIP, checkIP6, checkIPnMask, \ checkIP6nMask, check_mac, check_port, checkInterface, \ checkProtocol from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.ipset import IPSET_TYPES, IPSET_CREATE_OPTIONS from firewall.core.icmp import check_icmp_name, check_icmp_type, \ check_icmpv6_name, check_icmpv6_type from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class IPSet(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "type", "" ), # s ( "options", { "": "", }, ), # a{ss} ( "entries", [ "" ], ), # as ) DBUS_SIGNATURE = '(ssssa{ss}as)' ADDITIONAL_ALNUM_CHARS = [ "_", "-", ":", "." ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "ipset": [ "type" ], "option": [ "name" ], "entry": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "ipset": [ "version" ], "option": [ "value" ], } def __init__(self): super(IPSet, self).__init__() self.version = "" self.short = "" self.description = "" self.type = "" self.entries = [ ] self.options = { } self.applied = False def cleanup(self): self.version = "" self.short = "" self.description = "" self.type = "" del self.entries[:] self.options.clear() self.applied = False @staticmethod def check_entry(entry, options, ipset_type): family = "ipv4" if "family" in options: if options["family"] == "inet6": family = "ipv6" if not ipset_type.startswith("hash:"): raise FirewallError(errors.INVALID_IPSET, "ipset type '%s' not usable" % ipset_type) flags = ipset_type[5:].split(",") items = entry.split(",") if len(flags) != len(items) or len(flags) < 1: raise FirewallError( errors.INVALID_ENTRY, "entry '%s' does not match ipset type '%s'" % \ (entry, ipset_type)) for i in range(len(flags)): flag = flags[i] item = items[i] if flag == "ip": if "-" in item and family == "ipv4": # IP ranges only with plain IPs, no masks if i > 1: raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s'[%d]" % \ (item, entry, i)) splits = item.split("-") if len(splits) != 2: raise FirewallError( errors.INVALID_ENTRY, "invalid address range '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) for _split in splits: if (family == "ipv4" and not checkIP(_split)) or \ (family == "ipv6" and not checkIP6(_split)): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (_split, entry, ipset_type, family)) else: # IPs with mask only allowed in the first # position of the type if family == "ipv4": if item == "0.0.0.0": raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) if i == 0: ip_check = checkIPnMask else: ip_check = checkIP else: ip_check = checkIP6 if not ip_check(item): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) elif flag == "net": if "-" in item: # IP ranges only with plain IPs, no masks splits = item.split("-") if len(splits) != 2: raise FirewallError( errors.INVALID_ENTRY, "invalid address range '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) # First part can only be a plain IP if (family == "ipv4" and not checkIP(splits[0])) or \ (family == "ipv6" and not checkIP6(splits[0])): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (splits[0], entry, ipset_type, family)) # Second part can also have a mask if (family == "ipv4" and not checkIPnMask(splits[1])) or \ (family == "ipv6" and not checkIP6nMask(splits[1])): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (splits[1], entry, ipset_type, family)) else: # IPs with mask allowed in all positions, but no /0 if item.endswith("/0"): if not (family == "ipv6" and i == 0 and ipset_type == "hash:net,iface"): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) if (family == "ipv4" and not checkIPnMask(item)) or \ (family == "ipv6" and not checkIP6nMask(item)): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) elif flag == "mac": # ipset does not allow to add 00:00:00:00:00:00 if not check_mac(item) or item == "00:00:00:00:00:00": raise FirewallError( errors.INVALID_ENTRY, "invalid mac address '%s' in '%s'" % (item, entry)) elif flag == "port": if ":" in item: splits = item.split(":") if len(splits) != 2: raise FirewallError( errors.INVALID_ENTRY, "invalid port '%s'" % (item)) if splits[0] == "icmp": if family != "ipv4": raise FirewallError( errors.INVALID_ENTRY, "invalid protocol for family '%s' in '%s'" % \ (family, entry)) if not check_icmp_name(splits[1]) and not \ check_icmp_type(splits[1]): raise FirewallError( errors.INVALID_ENTRY, "invalid icmp type '%s' in '%s'" % \ (splits[1], entry)) elif splits[0] in [ "icmpv6", "ipv6-icmp" ]: if family != "ipv6": raise FirewallError( errors.INVALID_ENTRY, "invalid protocol for family '%s' in '%s'" % \ (family, entry)) if not check_icmpv6_name(splits[1]) and not \ check_icmpv6_type(splits[1]): raise FirewallError( errors.INVALID_ENTRY, "invalid icmpv6 type '%s' in '%s'" % \ (splits[1], entry)) elif splits[0] not in [ "tcp", "sctp", "udp", "udplite" ] \ and not checkProtocol(splits[0]): raise FirewallError( errors.INVALID_ENTRY, "invalid protocol '%s' in '%s'" % (splits[0], entry)) elif not check_port(splits[1]): raise FirewallError( errors.INVALID_ENTRY, "invalid port '%s'in '%s'" % (splits[1], entry)) else: if not check_port(item): raise FirewallError( errors.INVALID_ENTRY, "invalid port '%s' in '%s'" % (item, entry)) elif flag == "mark": if item.startswith("0x"): try: int_val = int(item, 16) except ValueError: raise FirewallError( errors.INVALID_ENTRY, "invalid mark '%s' in '%s'" % (item, entry)) else: try: int_val = int(item) except ValueError: raise FirewallError( errors.INVALID_ENTRY, "invalid mark '%s' in '%s'" % (item, entry)) if int_val < 0 or int_val > 4294967295: raise FirewallError( errors.INVALID_ENTRY, "invalid mark '%s' in '%s'" % (item, entry)) elif flag == "iface": if not checkInterface(item) or len(item) > 15: raise FirewallError( errors.INVALID_ENTRY, "invalid interface '%s' in '%s'" % (item, entry)) else: raise FirewallError(errors.INVALID_IPSET, "ipset type '%s' not usable" % ipset_type) def _check_config(self, config, item, all_config, all_io_objects): if item == "type": if config not in IPSET_TYPES: raise FirewallError(errors.INVALID_TYPE, "'%s' is not valid ipset type" % config) if item == "options": for key in config.keys(): if key not in IPSET_CREATE_OPTIONS: raise FirewallError(errors.INVALID_IPSET, "ipset invalid option '%s'" % key) if key in [ "timeout", "hashsize", "maxelem" ]: try: int_value = int(config[key]) except ValueError: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is not an integer" % \ (key, config[key])) if int_value < 0: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is negative" % \ (key, config[key])) elif key == "family" and \ config[key] not in [ "inet", "inet6" ]: raise FirewallError(errors.INVALID_FAMILY, config[key]) def import_config(self, config, all_io_objects): if "timeout" in config[4] and config[4]["timeout"] != "0": if len(config[5]) != 0: raise FirewallError(errors.IPSET_WITH_TIMEOUT) for entry in config[5]: IPSet.check_entry(entry, config[4], config[3]) super(IPSet, self).import_config(config, all_io_objects) # PARSER class ipset_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "ipset": if "type" in attrs: if attrs["type"] not in IPSET_TYPES: raise FirewallError(errors.INVALID_TYPE, "%s" % attrs["type"]) self.item.type = attrs["type"] if "version" in attrs: self.item.version = attrs["version"] elif name == "short": pass elif name == "description": pass elif name == "option": value = "" if "value" in attrs: value = attrs["value"] if attrs["name"] not in \ [ "family", "timeout", "hashsize", "maxelem" ]: raise FirewallError( errors.INVALID_OPTION, "Unknown option '%s'" % attrs["name"]) if self.item.type == "hash:mac" and attrs["name"] in [ "family" ]: raise FirewallError( errors.INVALID_OPTION, "Unsupported option '%s' for type '%s'" % \ (attrs["name"], self.item.type)) if attrs["name"] in [ "family", "timeout", "hashsize", "maxelem" ] \ and not value: raise FirewallError( errors.INVALID_OPTION, "Missing mandatory value of option '%s'" % attrs["name"]) if attrs["name"] in [ "timeout", "hashsize", "maxelem" ]: try: int_value = int(value) except ValueError: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is not an integer" % \ (attrs["name"], value)) if int_value < 0: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is negative" % \ (attrs["name"], value)) if attrs["name"] == "family" and value not in [ "inet", "inet6" ]: raise FirewallError(errors.INVALID_FAMILY, value) if attrs["name"] not in self.item.options: self.item.options[attrs["name"]] = value else: log.warning("Option %s already set, ignoring.", attrs["name"]) # nothing to do for entry and entries here def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) if name == "entry": self.item.entries.append(self._element) def ipset_reader(filename, path): ipset = IPSet() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) ipset.name = filename[:-4] ipset.check_name(ipset.name) ipset.filename = filename ipset.path = path ipset.builtin = False if path.startswith(config.ETC_FIREWALLD) else True ipset.default = ipset.builtin handler = ipset_ContentHandler(ipset) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_IPSET, "not a valid ipset file: %s" % \ msg.getException()) del handler del parser if "timeout" in ipset.options and ipset.options["timeout"] != "0" and \ len(ipset.entries) > 0: # no entries visible for ipsets with timeout log.warning("ipset '%s': timeout option is set, entries are ignored", ipset.name) del ipset.entries[:] i = 0 entries_set = set() while i < len(ipset.entries): if ipset.entries[i] in entries_set: log.warning("Entry %s already set, ignoring.", ipset.entries[i]) ipset.entries.pop(i) else: try: ipset.check_entry(ipset.entries[i], ipset.options, ipset.type) except FirewallError as e: log.warning("%s, ignoring.", e) ipset.entries.pop(i) else: entries_set.add(ipset.entries[i]) i += 1 del entries_set return ipset def ipset_writer(ipset, path=None): _path = path if path else ipset.path if ipset.filename: name = "%s/%s" % (_path, ipset.filename) else: name = "%s/%s.xml" % (_path, ipset.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start ipset element attrs = { "type": ipset.type } if ipset.version and ipset.version != "": attrs["version"] = ipset.version handler.startElement("ipset", attrs) handler.ignorableWhitespace("\n") # short if ipset.short and ipset.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(ipset.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if ipset.description and ipset.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(ipset.description) handler.endElement("description") handler.ignorableWhitespace("\n") # options for key,value in ipset.options.items(): handler.ignorableWhitespace(" ") if value != "": handler.simpleElement("option", { "name": key, "value": value }) else: handler.simpleElement("option", { "name": key }) handler.ignorableWhitespace("\n") # entries for entry in ipset.entries: handler.ignorableWhitespace(" ") handler.startElement("entry", { }) handler.characters(entry) handler.endElement("entry") handler.ignorableWhitespace("\n") # end ipset element handler.endElement('ipset') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z�ζ �. �. service.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Service", "service_reader", "service_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \ check_tcpudp, check_protocol, check_address from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class Service(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), ( "short", "" ), ( "description", "" ), ( "ports", [ ( "", "" ), ], ), ( "modules", [ "", ], ), ( "destination", { "": "", }, ), ( "protocols", [ "", ], ), ( "source_ports", [ ( "", "" ), ], ), ( "includes", [ "" ], ), ( "helpers", [ "", ], ), ) ADDITIONAL_ALNUM_CHARS = [ "_", "-" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "service": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "service": [ "name", "version" ], "port": [ "port", "protocol" ], "protocol": [ "value" ], "module": [ "name" ], "destination": [ "ipv4", "ipv6" ], "source-port": [ "port", "protocol" ], "include": [ "service" ], "helper": [ "name" ], } def __init__(self): super(Service, self).__init__() self.version = "" self.short = "" self.description = "" self.ports = [ ] self.protocols = [ ] self.modules = [ ] self.destination = { } self.source_ports = [ ] self.includes = [ ] self.helpers = [ ] def cleanup(self): self.version = "" self.short = "" self.description = "" del self.ports[:] del self.protocols[:] del self.modules[:] self.destination.clear() del self.source_ports[:] del self.includes[:] del self.helpers[:] def _check_config(self, config, item, all_config, all_io_objects): if item == "ports": for port in config: if port[0] != "": check_port(port[0]) check_tcpudp(port[1]) else: # only protocol check_protocol(port[1]) elif item == "protocols": for proto in config: check_protocol(proto) elif item == "source_ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item == "destination": for destination in config: if destination not in [ "ipv4", "ipv6" ]: raise FirewallError(errors.INVALID_DESTINATION, "'%s' not in {'ipv4'|'ipv6'}" % \ destination) check_address(destination, config[destination]) elif item == "modules": for module in config: if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") if len(module) < 2: raise FirewallError(errors.INVALID_MODULE, module) # PARSER class service_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "service": if "name" in attrs: log.warning("Ignoring deprecated attribute name='%s'", attrs["name"]) if "version" in attrs: self.item.version = attrs["version"] elif name == "short": pass elif name == "description": pass elif name == "port": if attrs["port"] != "": check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) entry = (attrs["port"], attrs["protocol"]) if entry not in self.item.ports: self.item.ports.append(entry) else: log.warning("Port '%s/%s' already set, ignoring.", attrs["port"], attrs["protocol"]) else: check_protocol(attrs["protocol"]) if attrs["protocol"] not in self.item.protocols: self.item.protocols.append(attrs["protocol"]) else: log.warning("Protocol '%s' already set, ignoring.", attrs["protocol"]) elif name == "protocol": check_protocol(attrs["value"]) if attrs["value"] not in self.item.protocols: self.item.protocols.append(attrs["value"]) else: log.warning("Protocol '%s' already set, ignoring.", attrs["value"]) elif name == "source-port": check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) entry = (attrs["port"], attrs["protocol"]) if entry not in self.item.source_ports: self.item.source_ports.append(entry) else: log.warning("SourcePort '%s/%s' already set, ignoring.", attrs["port"], attrs["protocol"]) elif name == "destination": for x in [ "ipv4", "ipv6" ]: if x in attrs: check_address(x, attrs[x]) if x in self.item.destination: log.warning("Destination address for '%s' already set, ignoring", x) else: self.item.destination[x] = attrs[x] elif name == "module": module = attrs["name"] if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") if module not in self.item.modules: self.item.modules.append(module) else: log.warning("Module '%s' already set, ignoring.", module) elif name == "include": if attrs["service"] not in self.item.includes: self.item.includes.append(attrs["service"]) else: log.warning("Include '%s' already set, ignoring.", attrs["service"]) elif name == "helper": if attrs["name"] not in self.item.helpers: self.item.helpers.append(attrs["name"]) else: log.warning("Helper '%s' already set, ignoring.", attrs["name"]) def service_reader(filename, path): service = Service() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) service.name = filename[:-4] service.check_name(service.name) service.filename = filename service.path = path service.builtin = False if path.startswith(config.ETC_FIREWALLD) else True service.default = service.builtin handler = service_ContentHandler(service) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_SERVICE, "not a valid service file: %s" % \ msg.getException()) del handler del parser return service def service_writer(service, path=None): _path = path if path else service.path if service.filename: name = "%s/%s" % (_path, service.filename) else: name = "%s/%s.xml" % (_path, service.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start service element attrs = {} if service.version and service.version != "": attrs["version"] = service.version handler.startElement("service", attrs) handler.ignorableWhitespace("\n") # short if service.short and service.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(service.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if service.description and service.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(service.description) handler.endElement("description") handler.ignorableWhitespace("\n") # ports for port in service.ports: handler.ignorableWhitespace(" ") handler.simpleElement("port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # protocols for protocol in service.protocols: handler.ignorableWhitespace(" ") handler.simpleElement("protocol", { "value": protocol }) handler.ignorableWhitespace("\n") # source ports for port in service.source_ports: handler.ignorableWhitespace(" ") handler.simpleElement("source-port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # modules for module in service.modules: handler.ignorableWhitespace(" ") handler.simpleElement("module", { "name": module }) handler.ignorableWhitespace("\n") # destination if len(service.destination) > 0: handler.ignorableWhitespace(" ") handler.simpleElement("destination", service.destination) handler.ignorableWhitespace("\n") # includes for include in service.includes: handler.ignorableWhitespace(" ") handler.simpleElement("include", { "service": include }) handler.ignorableWhitespace("\n") # helpers for helper in service.helpers: handler.ignorableWhitespace(" ") handler.simpleElement("helper", { "name": helper }) handler.ignorableWhitespace("\n") # end service element handler.endElement('service') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z�w{�{ { * __pycache__/firewalld_conf.cpython-310.pycnu �[��� o bhAb�5 � @ sT d dl Zd dlZd dlZd dlZd dlmZ d dlmZ g d�Z G dd� de �Z dS )� N)�config)�log) � DefaultZone� MinimalMark� CleanupOnExit�CleanupModulesOnExit�Lockdown� IPv6_rpfilter�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDriftingc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )�firewalld_confc C s i | _ g | _|| _| �� d S �N)�_config�_deleted�filename�clear)�selfr � r �A/usr/lib/python3/dist-packages/firewall/core/io/firewalld_conf.py�__init__% s zfirewalld_conf.__init__c C s i | _ g | _d S r )r r �r r r r r + s zfirewalld_conf.clearc C s | j �� g | _d S r )r r r r r r r �cleanup/ s zfirewalld_conf.cleanupc C s | j �|�� �S r )r �get�strip)r �keyr r r r 3 s zfirewalld_conf.getc C s4 |� � }|� � | j|< || jv r| j�|� d S d S r )r r r �remove)r r �value�_keyr r r �set6 s �zfirewalld_conf.setc C s8 d}| j �� D ]\}}|r|d7 }|d||f 7 }q|S )N� � z%s=%s)r �items)r �sr r! r r r �__str__< s zfirewalld_conf.__str__c C sx | � � zt| jd�}W n� ty� } z�t�d| j|� | �dtj� | �dt tj �� | �dtj r4dnd� | �dtj r?dnd� | �d tj rJdnd� | �d tjrUdnd� | �d tjr`dnd� | �d tj� | �d tj� | �dtj� | �dtjr�dnd� | �dtjr�dnd� | �dtjr�d� � d� � d }~ww |D ]k}|s� nf|�� }t|�dk s�|d dv r�q�dd� |�d�D �}t|�dkr�t�d|�� � q�|d tvr�t�d|�� � q�|d dkr�t�d |�� � q�| j�|d �d u�rt�d |�� � q�|d | j|d < q�|� � | �d��s)t�d tj� | �dt tj�� | �d�}zt |� W n' t t f�y[ |d u�rPt� d |�rK|ndtj � | �dt tj �� Y nw | �d�}|�rk|�!� d v�r�|d u�r}t� d!|�rx|ndtj � | �dtj �r�dnd� | �d�}|�r�|�!� d v�r�|d u�r�t� d"|�r�|ndtj � | �dtj �r�dnd� | �d �}|�r�|�!� d#v�r�|d u�r�t� d$|�r�|ndtj � | �d tj �r�dnd� | �d �}|�r�|�!� d#v�r|d u�rt� d%|�r�|ndtj� | �d tj�r dnd� | �d �}|�r |�!� d#v�r=|d u�r1t� d&|�r,|ndtj� | �d tj�r:dnd� | �d �}|�rK|tj"v�ra|d u�rXt� d'|tj� | �d t tj�� | �d �}|�rq|�!� tj#v�r�|d u�r�t� d(|�r~|ndtj� | �d t tj�� | �d�}|�r�|�!� tj$v�r�|d u�r�t� d)|�r�|ndtj� | �dt tj�� | �d�}|�r�|�!� d#v�r�|d u�r�t� d*|�r�|ndtj� | �dt tj�� | �d�}|�r�|�!� d#v�r |d u�rt� d+|�r�|ndtj� | �dt tj�� | �d�}|�r|�!� d#v�r:|d u�r,t� d,|�r'|ndtj� | �dtj�r5dnd� d S d S )-N�rzFailed to load '%s': %sr r r �yes�nor r r r r r r r r r � r )�#�;c S s g | ]}|� � �qS r )r )�.0�xr r r � <listcomp>a s z'firewalld_conf.read.<locals>.<listcomp>�=� z Invalid option definition: '%s'zInvalid option: '%s'r$ zMissing value: '%s'z!Duplicate option definition: '%s'z0DefaultZone is not set, using default value '%s'z7MinimalMark '%s' is not valid, using default value '%d')r+ �falser* �truez7CleanupOnExit '%s' is not valid, using default value %sz>CleanupModulesOnExit '%s' is not valid, using default value %s)r* r5 r+ r4 z2Lockdown '%s' is not valid, using default value %sz7IPv6_rpfilter '%s' is not valid, using default value %sz9IndividualCalls '%s' is not valid, using default value %sz3LogDenied '%s' is invalid, using default value '%s'z:AutomaticHelpers '%s' is not valid, using default value %sz9FirewallBackend '%s' is not valid, using default value %sz:FlushAllOnReload '%s' is not valid, using default value %sz6RFC3964_IPv4 '%s' is not valid, using default value %sz;AllowZoneDrifting '%s' is not valid, using default value %s)%r �openr � Exceptionr �errorr# r � FALLBACK_ZONE�str�FALLBACK_MINIMAL_MARK�FALLBACK_CLEANUP_ON_EXIT� FALLBACK_CLEANUP_MODULES_ON_EXIT�FALLBACK_LOCKDOWN�FALLBACK_IPV6_RPFILTER�FALLBACK_INDIVIDUAL_CALLS�FALLBACK_LOG_DENIED�FALLBACK_AUTOMATIC_HELPERS�FALLBACK_FIREWALL_BACKEND� FALLBACK_FLUSH_ALL_ON_RELOAD�FALLBACK_RFC3964_IPV4� FALLBACK_ALLOW_ZONE_DRIFTINGr �len�split� valid_keysr r �close�int� ValueError� TypeError�warning�lower�LOG_DENIED_VALUES�AUTOMATIC_HELPERS_VALUES�FIREWALL_BACKEND_VALUES)r �f�msg�line�pairr! r r r �readE s( ��� � �� � � � � � � � � � � � �zfirewalld_conf.readc C sj t | j�dk r d S g }tj�tj�st�tjd� ztj ddtj� | j � tj� | j �dd�}W n t yD } zt�d| � � d }~ww d}d}z tj| j dd d �}W n& t yz } ztj�| j �rnt�d | j |f � � d }W Y d }~n�d }~ww |D ]�}|s� n�|�d �}t |�dk r�|s�|�d � d }q}|d dkr�d}|�|� |�d � q}|�d�}t |�dkr�d}|�|d � q}|d �� } |d �� } | |v�r| | jv r�| j| | kr�d}|�d| | j| f � d }n| | jv r�d }n d}|�|d � |�| � q}d }q}t | j�dk�r>| j�� D ](\} } | |v �r �q| dv �r'�q|�s1|�d � d }|�d| | f � d }�q|�rE|�� |�� |�sTt�|j� d S tj�| j ��r�z t� | j d| j � W n t �y� } zt�|j� t d| j |f ��d }~ww z t� |j| j � W n t �y� } zt�|j� t d| j |f ��d }~ww t� | j d� d S )Nr, i� �wtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %s�rtzUTF-8)rY �encodingzFailed to open '%s': %sr% Tr r- r2 r3 z%s=%s )r r r z%s.oldzBackup of '%s' failed: %szFailed to create '%s': %si� ) rG r �os�path�existsr � ETC_FIREWALLD�mkdir�tempfile�NamedTemporaryFile�basenamer �dirnamer7 r r8 �ior6 r �writerH r �appendr& rJ r �name�shutil�copy2�IOError�move�chmod) r �done� temp_filerT �modified�emptyrS rU �pr r! r r r ri � s� ����� � � �� ��zfirewalld_conf.writeN) �__name__� __module__� __qualname__r r r r r# r( rW ri r r r r r $ s r ) �os.pathr_ rh rd rl �firewallr �firewall.core.loggerr rI �objectr r r r r �<module> s PK ���Z���m� � $ __pycache__/icmptype.cpython-310.pycnu �[��� o bhAb� � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z ddl m Z ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�IcmpType�icmptype_reader�icmptype_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�errors)� FirewallErrorc sh e Zd ZdddddgffZdZddgZd d d d �Zd d gd dgd�Z� fdd�Zdd� Z dd� Z � Z S )r )�version� )�shortr )� descriptionr � destinationr z(sssas)�_�-N)r r �icmptype�namer �ipv4�ipv6)r r c s* t t| ��� d| _d| _d| _g | _d S �Nr )�superr �__init__r r r r ��self�� __class__� �;/usr/lib/python3/dist-packages/firewall/core/io/icmptype.pyr 7 s zIcmpType.__init__c C s" d| _ d| _d| _| jd d �= d S r )r r r r r r r r �cleanup> s zIcmpType.cleanupc C s2 |dkr|D ]}|dvrt tjd| ��qd S d S )Nr �r r z '%s' not from {'ipv4'|'ipv6'})r r �INVALID_DESTINATION)r r �item� all_config�all_io_objectsr r r r � _check_configD s ����zIcmpType._check_config) �__name__� __module__� __qualname__�IMPORT_EXPORT_STRUCTURE�DBUS_SIGNATURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr r r& � __classcell__r r r r r $ s$ ��� r c @ s e Zd Zdd� ZdS )�icmptype_ContentHandlerc C s� t �| ||� | j�||� |dkr-d|v r t�d|d � d|v r+|d | j_d S d S |dkr3d S |dkr9d S |dkrWdD ]}||v rV|| �� d v rV| jj� t |�� q?d S d S ) Nr r z'Ignoring deprecated attribute name='%s'r r r r r! )�yes�true) r � startElementr# �parser_check_element_attrsr �warningr �lowerr �append�str)r r �attrs�xr r r r3 O s, ����z$icmptype_ContentHandler.startElementN)r' r( r) r3 r r r r r0 N s r0 c C s t � }| �d�sttjd| ��| d d� |_|�|j� | |_||_|� t j �r+dnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��4}t�d �}|�|� z|�|� W n tjys } z ttjd|�� ��d }~ww W d � ~~|S 1 s�w Y ~~|S ) Nz.xmlz%s is missing .xml suffix���FT�%s/%s�rbz not a valid icmptype file: %s)r �endswithr r � INVALID_NAMEr � check_name�filename�path� startswithr � ETC_FIREWALLD�builtin�defaultr0 �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException�INVALID_ICMPTYPE� getException) rA rB r �handler�parserr �f�source�msgr r r r c sJ � ����� � � r c C s |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� i }| jr�| jd kr�| j|d < |�d |� |�d � | jr�| jd kr�|�d � |�di � |�| j� |�d� |�d � | jr�| jd kr�|�d � |�di � |�| j� |�d� |�d � | jr�|�d � i }| jD ]} d|| < q�|�d|� |�d � |�d � |�d � |� � |� � ~d S )Nr< z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr r r � z r r r1 r ) rB rA r �os�exists�shutil�copy2� Exceptionr �error�dirnamerC r rD �mkdir�iorJ r � startDocumentr r3 �ignorableWhitespacer � characters� endElementr r � simpleElement� endDocument�close) r rB �_pathr rU �dirpathrS rQ r9 r: r r r r s` �� r )N)�__all__�xml.saxrG rZ rb r\ �firewallr �firewall.core.io.io_objectr r r �firewall.core.loggerr r �firewall.errorsr r r0 r r r r r r �<module> s * PK ���Zx�8W� � ! __pycache__/ifcfg.cpython-310.pycnu �[��� o bhAb� � @ sJ d Z dgZddlZddlZddlZddlZddlmZ G dd� de �Z dS )zifcfg file parser�ifcfg� N)�logc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s i | _ g | _|| _| �� d S �N)�_config�_deleted�filename�clear)�selfr � r �8/usr/lib/python3/dist-packages/firewall/core/io/ifcfg.py�__init__" s zifcfg.__init__c C s i | _ g | _d S r )r r �r r r r r ( s z ifcfg.clearc C s | j �� d S r )r r r r r r �cleanup, s z ifcfg.cleanupc C s | j �|�� �S r )r �get�strip)r �keyr r r r / s z ifcfg.getc C s4 |� � }|� � | j|< || jv r| j�|� d S d S r )r r r �remove)r r �value�_keyr r r �set2 s �z ifcfg.setc C s8 d}| j �� D ]\}}|r|d7 }|d||f 7 }q|S )N� � z%s=%s)r �items)r �sr r r r r �__str__8 s z ifcfg.__str__c C s2 | � � zt| jd�}W n ty! } z t�d| j|� � d }~ww |D ]n}|s* ni|�� }t|�dk s:|d dv r;q$dd� |�dd�D �}t|�d krMq$t|d �d krm|d � d �rm|d � d �rm|d dd � |d< |d d krtq$| j � |d �d ur�t� d | j|�� � q$|d | j |d < q$|�� d S )N�rzFailed to load '%s': %s� r )�#�;c S s g | ]}|� � �qS r )r )�.0�xr r r � <listcomp>P s z ifcfg.read.<locals>.<listcomp>�=� �"���r z%%s: Duplicate option definition: '%s')r �openr � Exceptionr �errorr �len�split� startswith�endswithr r �warning�close)r �f�msg�line�pairr r r �readA s< �� � � z ifcfg.readc C sd t | j�dk r d S g }ztjddtj�| j� tj�| j�dd�}W n t y6 } zt � d| � � d }~ww d}d}z t j | jddd �}W n& t yl } ztj�| j�r`t � d | j|f � � d }W Y d }~n�d }~ww |D ]�}|su n�|�d �}t |�dk r�|s�|�d � d }qo|d dkr�d}|�|� |�d � qo|�dd�}t |�dkr�d}|�|d � qo|d �� } |d �� } t | �dkr�| �d�r�| �d�r�| dd� } | |v�r| | jv r�| j| | kr�d}|�d| | j| f � d }n| | jv r�d }n d}|�|d � |�| � qod }qot | j�d k�r;| j�� D ] \} } | |v �r)�q |�s.d }|�d| | f � d }�q |�rB|�� |�� |�sQt�|j� d S tj�| j��r�z t�| jd| j � W n t �y� } zt�|j� t d| j|f ��d }~ww z t� |j| j� W n t �y� } zt�|j� t d| j|f ��d }~ww t� | jd� d S )Nr �wtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %s�rtzUTF-8)r5 �encodingzFailed to open '%s': %sr Tr r r" r# r$ r% z%s=%s z%s.bakzBackup of '%s' failed: %szFailed to create '%s': %si� ) r) r �tempfile�NamedTemporaryFile�os�path�basenamer �dirnamer' r r( �ior& �existsr �writer* r+ r, r �appendr r. r �name�shutil�copy2�IOError�move�chmod) r �done� temp_filer0 �modified�emptyr/ r1 �pr r r r r rC ^ s� ����� � �� � �� ��z ifcfg.writeN) �__name__� __module__� __qualname__r r r r r r r3 rC r r r r r ! s ) �__doc__�__all__�os.pathr= rA r; rF �firewall.core.loggerr �objectr r r r r �<module> s PK ���ZS���� � $ __pycache__/__init__.cpython-310.pycnu �[��� o bhAb< � @ sr d dl Z de jv r5d dlmZ eed�s dd� Zeede� d dlmZ eed�s7d d � Z eede � dS dS dS ) � N�_xmlplus)�AttributesImpl� __contains__c C s |t | d�v S )N�_attrs)�getattr)�self�name� r �;/usr/lib/python3/dist-packages/firewall/core/io/__init__.py� __AttributesImpl__contains__ s r )� XMLGenerator�_writec C s t | d��|� d S )N�_out)r �write)r �textr r r �__XMLGenerator_write$ s r ) �xml�__file__�xml.sax.xmlreaderr �hasattrr �setattr�xml.sax.saxutilsr r r r r r �<module> s � PK ���Z@��& �& % __pycache__/io_object.cpython-310.pycnu �[��� o bhAb�- � @ s� d Z g d�ZddlmZ ddlm mZ ddlZddlmZ ddl m Z ddl m Z ddl m Z G dd � d e�ZG d d � d e�ZG d d � d e�ZG dd� de�ZG dd� dejj�ZG dd� dej�Zdd� Zdd� Zdd� Zdd� Z dS ) z5Generic io_object handler, io specific check methods.)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol� check_address� N)� OrderedDict)� functions)�errors)� FirewallErrorc @ s� e Zd ZdZdZdZg Zi Zi Zdd� Z dd� Z dd � Z d d � Z d d � Z dd� Zi fdd�Zdd� Zdd� Zdd� Zdd� ZdS )r z; Abstract IO_Object as base for icmptype, service and zone � z()c C s" d| _ d| _d| _d| _d| _d S )N� F)�filename�path�name�default�builtin��selfr r �</usr/lib/python3/dist-packages/firewall/core/io/io_object.py�__init__- s zIO_Object.__init__c C s2 g }| j D ]}|�t�t| |d ��� qt|�S )Nr )�IMPORT_EXPORT_STRUCTURE�append�copy�deepcopy�getattr�tuple)r �ret�xr r r � export_config4 s zIO_Object.export_configc C sT i }t dd� | jD ��}|D ]}t| |�s tt| |�t�r't�t| |��||< q|S )Nc S � g | ] }|d |d f�qS �r � r ��.0r r r r � <listcomp>< � z0IO_Object.export_config_dict.<locals>.<listcomp>)�dictr r � isinstance�boolr r )r �conf� type_formats�keyr r r �export_config_dict: s �z IO_Object.export_config_dictc C s� | � ||� t| j�D ]=\}\}}t|| t�r=g }t� }|| D ]}||vr1|�|� |�|� q!~t| |t � |�� q t| |t � || �� q d S �N) � check_config� enumerater r) �list�setr �add�setattrr r ) r r+ �all_io_objects�i�element�dummy�_conf�_setr r r r � import_configB s ��zIO_Object.import_configc C s| | � ||� |D ]3}t| |�sttjd�|���t|| t�r0t| |tt � t � || ���� qt| |t � || �� qd S )Nz-Internal error. '{}' is not a valid attribute) �check_config_dict�hasattrr r � UNKNOWN_ERROR�formatr) r2 r5 r �fromkeysr r )r r+ r6 r- r r r �import_config_dictR s "�z IO_Object.import_config_dictc C st t |t�sttjd|td�t|�f ��t|�dk r ttjd��|D ]}|�� s7|| j vr7ttjd||f ��q"d S )N�'%s' not of type %s, but %sr r# zname can't be emptyz'%s' is not allowed in '%s') r) �strr r � INVALID_TYPE�type�len� INVALID_NAME�isalnum�ADDITIONAL_ALNUM_CHARS)r r �charr r r � check_name^ s �� ���zIO_Object.check_namec C sh t |�t | j�krttjdt |�t | j�f ��i }t| j�D ] \}\}}|| ||< q | �||� d S )Nz structure size mismatch %d != %d)rG r r r rE r1 r= )r r+ r6 � conf_dictr7 r �yr r r r0 k s ��zIO_Object.check_configc C sp t dd� | jD ��}|D ])}|dd� | jD �vr!ttjd�|���| �|| || � | �|| |||� q d S )Nc S r! r" r r$ r r r r& w r' z/IO_Object.check_config_dict.<locals>.<listcomp>c S s g | ]\}}|�qS r r )r% r rN r r r r& y s zoption '{}' is not valid)r( r r r �INVALID_OPTIONr@ �_check_config_structure� _check_config)r r+ r6 r, r- r r r r= v s �zIO_Object.check_config_dictc C s d S r/ r )r �dummy1�dummy2�dummy3�dummy4r r r rQ ~ s zIO_Object._check_configc C sX t |t|��sttjd|t|�t|�f ��t |t�r8t|�dkr)ttjd| ��|D ] }| �||d � q+d S t |t�rdt|�t|�krQttjd|t|�f ��t |�D ] \}}| �|| |� qUd S t |t �r�t|� � �d \}}|� � D ]2\}}t |t|��s�ttjd|t|�t|�f ��t |t|��s�ttjd|t|�t|�f ��qwd S d S )NrC r# zlen('%s') != 1r zlen('%s') != %d) r) rF r r rE r2 rG rP r r1 r( �items) r r+ � structurer r7 �value�skey�svaluer- r r r rP � sT �� �� ��� ������z!IO_Object._check_config_structurec C s� |� � }d}|| jv r/d}| j| d ur/| j| D ]}||v r%|�|� qttjd||f ��|| jv rGd}| j| D ] }||v rF|�|� q;|sQttjd| ��|D ] }ttjd||f ��d S )NFTzMissing attribute %s for %szUnexpected element %sz%s: Unexpected attribute %s)�getNames� PARSER_REQUIRED_ELEMENT_ATTRS�remover r � PARSE_ERROR� PARSER_OPTIONAL_ELEMENT_ATTRS)r r �attrs�_attrs�foundr r r r �parser_check_element_attrs� s6 � �� ��z$IO_Object.parser_check_element_attrsN)�__name__� __module__� __qualname__�__doc__r �DBUS_SIGNATURErJ r\ r_ r r r. r< rB rL r0 r= rQ rP rc r r r r r $ s$ !r c �$ e Zd Z� fdd�Zdd� Z� ZS )�UnexpectedElementErrorc s t t| ��� || _d S r/ )�superrj r r �r r �� __class__r r r � s z UnexpectedElementError.__init__c C s d| j S )NzUnexpected element '%s')r r r r r �__str__� � z UnexpectedElementError.__str__�rd re rf r ro � __classcell__r r rm r rj � s rj c ri )�MissingAttributeErrorc � t t| ��� || _|| _d S r/ )rk rs r r � attribute�r r ru rm r r r � � z MissingAttributeError.__init__c C � d| j | jf S )Nz$Element '%s': missing '%s' attribute�r ru r r r r ro � � �z MissingAttributeError.__str__rq r r rm r rs � � rs c ri )�UnexpectedAttributeErrorc rt r/ )rk r| r r ru rv rm r r r � rw z!UnexpectedAttributeError.__init__c C rx )Nz'Element '%s': unexpected attribute '%s'ry r r r r ro � rz z UnexpectedAttributeError.__str__rq r r rm r r| � r{ r| c @ s4 e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd S ) r c C s || _ d| _d S �Nr )�item�_element)r r~ r r r r � s z!IO_Object_ContentHandler.__init__c C � d| _ d S r} �r r r r r � startDocument� rp z&IO_Object_ContentHandler.startDocumentc C r� r} r� )r r r` r r r � startElement� rp z%IO_Object_ContentHandler.startElementc C s0 |dkr | j | j_d S |dkr| j | j_d S d S )N�short� description)r r~ r� r� rl r r r � endElement� s �z#IO_Object_ContentHandler.endElementc C s | j |�dd�7 _ d S )N� � )r �replace)r �contentr r r � characters� s z#IO_Object_ContentHandler.charactersN)rd re rf r r� r� r� r� r r r r r � s r c @ s e Zd Zdd� Zdd� ZdS )r c C sN t jj�| � |j| _|j| _i g| _| jd | _ g | _ d| _ d| _ d| _ d S )N���zutf-8F)�sax�handler�ContentHandlerr �write�_write�flush�_flush� _ns_contexts�_current_context�_undeclared_ns_maps� _encoding�_pending_start_element�_short_empty_elements)r �outr r r r � s z IO_Object_XMLGenerator.__init__c C sF | � d| � |�� D ]\}}| � d|t�|�f � q | � d� dS )z* slightly modified startElement() �<z %s=%sz/>N)r� rV �saxutils� quoteattr)r r r` rX r r r � simpleElement� s z$IO_Object_XMLGenerator.simpleElementN)rd re rf r r� r r r r r � s r c C s� t �| �}|dkrttjd| ��|dkr ttjd| ��|d u r)ttjd| ��t|�dkr?|d |d krAttjd| ��d S d S ) N���z port number in '%s' is too bigr� z'%s' is invalid port rangez port range '%s' is ambiguous� r r# )r � getPortRanger r � INVALID_PORTrG )�port� port_ranger r r r s$ ��� ��r c C s | dvr t tjd| ��d S )N)�tcp�udp�sctp�dccpz)'%s' not from {'tcp'|'udp'|'sctp'|'dccp'})r r �INVALID_PROTOCOL��protocolr r r r s ���r c C s t �| �s ttj| ��d S r/ )r � checkProtocolr r r� r� r r r r s �r c C s$ t �| |�sttjd|| f ��d S )Nz '%s' is not valid %s address)r r r r � INVALID_ADDR)�ipv�addrr r r r s ��r ) rg �__all__�xml.saxr� �xml.sax.saxutilsr� r � collectionsr �firewallr r �firewall.errorsr �objectr � Exceptionrj rs r| r� r� r � XMLGeneratorr r r r r r r r r �<module> s( PK ���Z� �r r # __pycache__/service.cpython-310.pycnu �[��� o bhAb�. � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZmZ ddlmZ ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�Service�service_reader�service_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol� check_address)�log)�errors)� FirewallErrorc s� e Zd Zdddddgfddgfdddifd dgfd dgfd dgfd dgff Zd dgZdddd�Zddgddgdgdgddgddgdgdgd�Z� fdd�Zd d � Zd d � Z � Z S ) r )�version� )�shortr )� descriptionr �ports)r r �modulesr � destination� protocols� source_ports�includes�helpers�_�-N)r r �service�namer �port�protocol�value�ipv4�ipv6r )r r r �moduler � source-port�include�helperc sN t t| ��� d| _d| _d| _g | _g | _g | _i | _ g | _ g | _ g | _ d S �Nr ) �superr �__init__r r r r r r r r r r ��self�� __class__� �:/usr/lib/python3/dist-packages/firewall/core/io/service.pyr* C s zService.__init__c C sh d| _ d| _d| _| jd d �= | jd d �= | jd d �= | j�� | jd d �= | j d d �= | j d d �= d S r( ) r r r r r r r �clearr r r r+ r/ r/ r0 �cleanupP s zService.cleanupc C s, |dkr$|D ]}|d dkrt |d � t|d � qt|d � qd S |dkr3|D ]}t|� q*d S |dkrJ|D ]}t |d � t|d � q9d S |dkrh|D ]}|dvr^ttjd | ��t||| � qPd S |d kr�|D ]%}|�d �r�|�d d�}d |v r�|�d d �}t |�dk r�ttj |��qnd S d S )Nr r r � r r r �r" r# z'%s' not in {'ipv4'|'ipv6'}r � nf_conntrack_r r � ) r r r r r �INVALID_DESTINATIONr � startswith�replace�len�INVALID_MODULE) r, r �item� all_config�all_io_objectsr �protor r$ r/ r/ r0 � _check_config\ sJ � � ���� ��zService._check_config) �__name__� __module__� __qualname__�IMPORT_EXPORT_STRUCTURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr* r2 r@ � __classcell__r/ r/ r- r0 r % s: � �� r c @ s e Zd Zdd� ZdS )�service_ContentHandlerc C s< t �| ||� | j�||� |dkr,d|v r t�d|d � d|v r*|d | j_d S d S |dkr2d S |dkr8d S |dkr�|d dkrrt|d � t|d � |d |d f}|| jj vre| jj � |� d S t�d |d |d � d S t |d � |d | jj vr�| jj � |d � d S t�d |d � d S |d kr�t |d � |d | jj vr�| jj � |d � d S t�d |d � d S |d kr�t|d � t|d � |d |d f}|| jj vr�| jj � |� d S t�d|d |d � d S |dk�r dD ]$}||v �rt||| � || jjv �rt�d|� q�|| | jj|< q�d S |dk�rV|d }|�d��r>|�dd�}d|v �r>|�dd�}|| jjv�rN| jj� |� d S t�d|� d S |dk�ry|d | jjv�ro| jj� |d � d S t�d|d � d S |dk�r�|d | jjv�r�| jj� |d � d S t�d|d � d S d S )Nr r z'Ignoring deprecated attribute name='%s'r r r r r r z#Port '%s/%s' already set, ignoring.z$Protocol '%s' already set, ignoring.r! r% z)SourcePort '%s/%s' already set, ignoring.r r4 z2Destination address for '%s' already set, ignoringr$ r5 r r z"Module '%s' already set, ignoring.r& z#Include '%s' already set, ignoring.r' z"Helper '%s' already set, ignoring.)r � startElementr< �parser_check_element_attrsr �warningr r r r �appendr r r r r r8 r9 r r r )r, r �attrs�entry�xr$ r/ r/ r0 rJ � s� �� � � � � ��� � � ��z#service_ContentHandler.startElementN)rA rB rC rJ r/ r/ r/ r0 rI � s rI c C s t � }| �d�sttjd| ��| d d� |_|�|j� | |_||_|� t j �r+dnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��4}t�d �}|�|� z|�|� W n tjys } z ttjd|�� ��d }~ww W d � ~~|S 1 s�w Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbz not a valid service file: %s)r �endswithr r � INVALID_NAMEr � check_name�filename�pathr8 r � ETC_FIREWALLD�builtin�defaultrI �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException�INVALID_SERVICE� getException) rW rX r �handler�parserr �f�source�msgr/ r/ r0 r � sJ � ����� � � r c C sJ |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� i }| jr�| jd kr�| j|d < |�d |� |�d � | jr�| jd kr�|�d � |�di � |�| j� |�d� |�d � | jr�| jd kr�|�d � |�di � |�| j� |�d� |�d � | jD ]} |�d � |�d| d | d d�� |�d � q�| j D ]} |�d � |�dd| i� |�d � q�| j D ]} |�d � |�d| d | d d�� |�d � �q| j D ]} |�d � |�dd| i� |�d � �q/t | j �dk�r^|�d � |�d| j � |�d � | j!D ]} |�d � |�dd | i� |�d � �qa| j"D ]} |�d � |�dd| i� |�d � �qz|�d � |�d � |�#� |�$� ~d S ) NrR z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr r r � z r r r r r3 )r r r r! r% r$ r r r& r' )%rX rW r �os�exists�shutil�copy2� Exceptionr �error�dirnamer8 r rY �mkdir�ior_ r � startDocumentr rJ �ignorableWhitespacer � characters� endElementr r � simpleElementr r r r: r r r � endDocument�close)r rX �_pathr rj �dirpathrh rf rN r r r$ r& r' r/ r/ r0 r � s� �� � r )N)�__all__�xml.saxr\ ro rw rq �firewallr �firewall.core.io.io_objectr r r r r r r �firewall.core.loggerr r �firewall.errorsr r rI r r r/ r/ r/ r0 �<module> s $ ]Q PK ���Z���� � " __pycache__/helper.cpython-310.pycnu �[��� o bhAb> � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z ddlmZ ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�Helper� helper_reader� helper_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp)�log)�errors)� FirewallErrorc sv e Zd ZdddddddgffZdZd d gZd d d gd �Zg d�ddgd�Z� fdd�Zdd� Z dd� Z dd� Z � Z S )r )�version� )�shortr )� descriptionr )�familyr )�moduler �ports)r r z (sssssa(ss))�-�.Nr )r r �helper)�namer r �port�protocol)r r c s6 t t| ��� d| _d| _d| _d| _d| _g | _d S �Nr ) �superr �__init__r r r r r r ��self�� __class__� �9/usr/lib/python3/dist-packages/firewall/core/io/helper.pyr : s zHelper.__init__c C s. d| _ d| _d| _d| _d| _| jd d �= d S r )r r r r r r r r" r" r# �cleanupC s zHelper.cleanupc C s( ddg}||vrt tjd||f ��d S )N�ipv4�ipv6z'%s' not in '%s')r r � INVALID_IPV)r �ipv�ipvsr" r" r# � check_ipvK s ��zHelper.check_ipvc C s| |dkr|D ]}t |d � t|d � qd S |dkr:|�d�s(ttjd| ��t|�dd��dk r<ttjd| ��d S d S ) Nr r � r � nf_conntrack_�('%s' does not start with 'nf_conntrack_'r �Module name '%s' too short)r r � startswithr r �INVALID_MODULE�len�replace)r r �item� all_config�all_io_objectsr r" r" r# � _check_configQ s" � ���zHelper._check_config) �__name__� __module__� __qualname__�IMPORT_EXPORT_STRUCTURE�DBUS_SIGNATURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr r$ r* r6 � __classcell__r" r" r r# r % s* ��� r c @ s e Zd Zdd� ZdS )�helper_ContentHandlerc C sJ t �| ||� | j�||� |dkrcd|v r |d | j_d|v r.| j�|d � |d | j_d|v ra|d �d�sCtt j d|d ��t |d � dd��dk rYtt j d |d ��|d | j_ d S d S |d krid S |d krod S |d kr�t|d � t|d � |d |d f}|| jjvr�| jj�|� d S t�d|d |d � d S d S )Nr r r r r, r- r r+ r. r r r r z#Port '%s/%s' already set, ignoring.)r � startElementr3 �parser_check_element_attrsr r* r r/ r r r0 r1 r2 r r r r �appendr �warning)r r �attrs�entryr" r" r# rA b sJ �� �� ��z"helper_ContentHandler.startElementN)r7 r8 r9 rA r" r" r" r# r@ a s r@ c C s t � }| �d�sttjd| ��| d d� |_|�|j� | |_||_|� t j �r+dnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��4}t�d �}|�|� z|�|� W n tjys } z ttjd|�� ��d }~ww W d � ~~|S 1 s�w Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid helper file: %s)r �endswithr r � INVALID_NAMEr � check_name�filename�pathr/ r � ETC_FIREWALLD�builtin�defaultr@ �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException�INVALID_HELPER� getException) rM rN r �handler�parserr �f�source�msgr" r" r# r � sJ � ����� � � r c C s: |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� i }| j|d < | jr�| jd kr�| j|d < | jr�| jd kr�| j|d < |�d |� |�d� | jr�| jd kr�|�d� |�di � |�| j� |�d� |�d� | jr�| jd kr�|�d� |�di � |�| j� |�d� |�d� | j D ]} |�d� |� d| d | d d�� |�d� q�|�d � |�d� |� � |� � ~d S )NrH z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr r r r r � z r r r r r+ )r r ) rN rM r �os�exists�shutil�copy2� Exceptionr �error�dirnamer/ r rO �mkdir�iorU r � startDocumentr r r rA �ignorableWhitespacer � characters� endElementr r � simpleElement� endDocument�close) r rN �_pathr r` �dirpathr^ r\ rE r r" r" r# r � s` �� r )N)�__all__�xml.saxrR re rm rg �firewallr �firewall.core.io.io_objectr r r r r �firewall.core.loggerr r �firewall.errorsr r r@ r r r" r" r" r# �<module> s <# PK ���Z���<J( J( ! __pycache__/ipset.cpython-310.pycnu �[��� o bhAb"P � @ s� d Z g d�ZddlmZ ddlZddlZddlZddlmZ ddl m Z m Z m Z m Z mZmZmZmZ ddlmZmZmZ ddlmZmZ ddlmZmZm Z m Z dd l m Z dd lm Z dd l!m"Z" G d d � d e�Z#G dd� de�Z$dd� Z%ddd�Z&dS )z$ipset io XML handler, reader, writer)�IPSet� ipset_reader� ipset_writer� N)�config)�checkIP�checkIP6� checkIPnMask� checkIP6nMask� check_mac� check_port�checkInterface� checkProtocol)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)� IPSET_TYPES�IPSET_CREATE_OPTIONS)�check_icmp_name�check_icmp_type�check_icmpv6_name�check_icmpv6_type)�log)�errors)� FirewallErrorc s� e Zd ZdddddddifddgffZdZg d �Zd d d gd gd d �Zdgdgd�Z� fdd�Zdd� Z e dd� �Z dd� Z � fdd�Z � ZS )r )�version� )�shortr )� descriptionr )�typer �optionsr �entriesz (ssssa{ss}as))�_�-�:�.Nr �name)r r �ipset�option�entryr �value)r& r' c s< t t| ��� d| _d| _d| _d| _g | _i | _d| _ d S �Nr F) �superr �__init__r r r r r r �applied��self�� __class__� �8/usr/lib/python3/dist-packages/firewall/core/io/ipset.pyr, C s zIPSet.__init__c C s8 d| _ d| _d| _d| _| jd d �= | j�� d| _d S r* )r r r r r r �clearr- r. r2 r2 r3 �cleanupM s z IPSet.cleanupc C s� d}d|v r|d dkrd}|� d�sttjd| ��|dd � �d�}| �d�}t|�t|�ks7t|�d k rAttjd | |f ��tt|��D �]�}|| }|| }|d kr�d |v r�|dkr�|d krmttjd || |f ��|�d �} t| �dkr�ttjd|| ||f ��| D ] } |dkr�t| �r�|dkr�t | �s�ttjd| | ||f ��q�qG|dkr�|dkr�ttjd|| ||f ��|dkr�t } nt} nt } | |�s�ttjd|| ||f ��qG|dk�r�d |v �rE|�d �} t| �dkr�ttjd|| ||f ��|dk�rt| d ��r|dk�r t | d ��s ttjd| d | ||f ��|dk�r*t | d ��r6|dk�rDt | d ��sDttjd| d | ||f ��qG|� d��rf|dk�rZ|dk�rZ|dk�sfttjd|| ||f ��|dk�rpt |��rz|dk�r�t |��s�ttjd|| ||f ��qG|dk�r�t |��r�|dk�r�ttjd|| f ��qG|dk�r_d|v �rO|�d�} t| �dk�r�ttjd| ��| d d k�r�|dk�r�ttjd || f ��t| d ��s�t| d ��s�ttjd | d | f ��qG| d d v �r!|dk�rttjd || f ��t| d ��s t| d ��s ttjd | d | f ��qG| d d!v�r;t| d ��s;ttjd"| d | f ��t| d ��sNttjd#| d | f ��qGt|��s^ttjd$|| f ��qG|d%k�r�|� d&��r�zt|d'�} W n+ t�y� ttjd(|| f ��w zt|�} W n t�y� ttjd(|| f ��w | dk �s�| d)k�r�ttjd(|| f ��qG|d*k�r�t|��r�t|�d+k�r�ttjd,|| f ��qGttjd| ��d S )-N�ipv4�family�inet6�ipv6zhash:zipset type '%s' not usable� �,� z)entry '%s' does not match ipset type '%s'�ipr" z invalid address '%s' in '%s'[%d]� z.invalid address range '%s' in '%s' for %s (%s)z(invalid address '%s' in '%s' for %s (%s)z0.0.0.0r �netz/0zhash:net,iface�macz00:00:00:00:00:00z invalid mac address '%s' in '%s'�portr# zinvalid port '%s'�icmpz(invalid protocol for family '%s' in '%s'z invalid icmp type '%s' in '%s')�icmpv6z ipv6-icmpz invalid icmpv6 type '%s' in '%s')�tcp�sctp�udp�udplitez invalid protocol '%s' in '%s'zinvalid port '%s'in '%s'zinvalid port '%s' in '%s'�mark�0x� zinvalid mark '%s' in '%s'l �� �iface� z invalid interface '%s' in '%s')� startswithr r � INVALID_IPSET�split�len� INVALID_ENTRY�ranger r r r �endswithr r r r r r r �int� ValueErrorr ) r( r � ipset_typer7 �flags�items�i�flag�item�splits�_split�ip_check�int_valr2 r2 r3 � check_entryV s� � ���� �� ���� �� ��� ������� �� ��� �� � �� � ��� �� � ��� ����� �� �� �� �� ��� ��zIPSet.check_entryc C s� |dkr|t vrttjd| ��|dkrj|�� D ]S}|tvr&ttjd| ��|dv rWzt|| �}W n tyE ttj d||| f ��w |dk rVttj d||| f ��q|d kri|| d vrittj || ��qd S d S ) Nr z '%s' is not valid ipset typer zipset invalid option '%s'��timeout�hashsize�maxelem�)Option '%s': Value '%s' is not an integerr �#Option '%s': Value '%s' is negativer7 ��inetr8 ) r r r � INVALID_TYPE�keysr rN rT rU � INVALID_VALUE�INVALID_FAMILY)r/ r r[ � all_config�all_io_objects�key� int_valuer2 r2 r3 � _check_config sH � � ��� ��� ��zIPSet._check_configc sp d|d v r|d d dkrt |d �dkrttj��|d D ] }t�||d |d � q tt| ��||� d S )Nrb � �0r: r � )rP r r �IPSET_WITH_TIMEOUTr r` r+ � import_config)r/ r rn r( r0 r2 r3 rv ' s zIPSet.import_config)�__name__� __module__� __qualname__�IMPORT_EXPORT_STRUCTURE�DBUS_SIGNATURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr, r5 � staticmethodr` rq rv � __classcell__r2 r2 r0 r3 r , s4 ��� 6r c @ s e Zd Zdd� Zdd� ZdS )�ipset_ContentHandlerc C s� t �| ||� | j�||� |dkr:d|v r,|d tvr&ttjd|d ��|d | j_d|v r8|d | j_ d S d S |dkr@d S |dkrFd S |dkr�d}d |v rT|d }|d d vrdttj d |d ��| jjd kr~|d dv r~ttj d|d | jjf ��|d d v r�|s�ttj d|d ��|d dv r�zt |�}W n t y� ttj d|d |f ��w |dk r�ttj d|d |f ��|d dkr�|dvr�ttj|��|d | jjvr�|| jj|d < d S t�d|d � d S d S )Nr& r z%sr r r r' r r) r% )r7 rb rc rd zUnknown option '%s'zhash:mac)r7 z%Unsupported option '%s' for type '%s'z&Missing mandatory value of option '%s'ra re r rf r7 rg z Option %s already set, ignoring.)r � startElementr[ �parser_check_element_attrsr r r ri r r �INVALID_OPTIONrT rU rk rl r r �warning)r/ r% �attrsr) rp r2 r2 r3 r� 2 s~ �� ��� � � ��� �� �z!ipset_ContentHandler.startElementc C s, t �| |� |dkr| jj�| j� d S d S )Nr( )r � endElementr[ r �append�_element)r/ r% r2 r2 r3 r� i s �z ipset_ContentHandler.endElementN)rw rx ry r� r� r2 r2 r2 r3 r� 1 s 7r� c C s t � }| �d�sttjd| ��| d d� |_|�|j� | |_||_|� t j �r+dnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��1}t�d �}|�|� z|�|� W n tjys } z ttjd|�� ��d }~ww W d � n1 s~w Y ~~d |jv r�|jd d kr�t|j�d kr�t � d |j� |jd d �= d } t � } | t|j�k �r |j| | v r�t � d |j| � |j� | � n9z|� |j| |j|j!� W n ty� } zt � d| � |j� | � W Y d } ~ nd } ~ ww | �"|j| � | d7 } | t|j�k s�~ |S )Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid ipset file: %srb rs r z6ipset '%s': timeout option is set, entries are ignoredz Entry %s already set, ignoring.z %s, ignoring.r< )#r rS r r � INVALID_NAMEr% � check_name�filename�pathrM r � ETC_FIREWALLD�builtin�defaultr� �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseExceptionrN � getExceptionr rP r r r� �set�popr` r �add) r� r� r& �handler�parserr% �f�source�msgrY � entries_set�er2 r2 r3 r n sp � ����� � � ��� r c C sx |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� d | ji}| jr�| jd kr�| j|d < |�d |� |�d � | jr�| jd kr�|�d� |�di � |�| j� |�d� |�d � | jr�| jd kr�|�d� |�di � |�| j� |�d� |�d � | j� � D ]$\} } |�d� | d kr�|� d| | d�� n|� dd| i� |�d � q�| j D ] } |�d� |�di � |�| � |�d� |�d � �q |�d � |�d � |� � |� � ~d S )Nr� z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr r r r& � z r r r' )r% r) r% r( )!r� r� r% �os�exists�shutil�copy2� Exceptionr �error�dirnamerM r r� �mkdir�ior� r � startDocumentr r r� �ignorableWhitespacer � charactersr� r r rX � simpleElementr � endDocument�close) r& r� �_pathr% r� �dirpathr� r� r� ro r) r( r2 r2 r3 r � sj �� r )N)'�__doc__�__all__�xml.saxr� r� r� r� �firewallr �firewall.functionsr r r r r r r r �firewall.core.io.io_objectr r r �firewall.core.ipsetr r �firewall.core.icmpr r r r �firewall.core.loggerr r �firewall.errorsr r r� r r r2 r2 r2 r3 �<module> s( ( =3PK ���Z�$8��] �] " __pycache__/policy.cpython-310.pycnu �[��� o bhAb�� � @ s g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZmZmZ ddlmZmZmZ ddlmZmZmZmZmZmZ ddl m Z ddl m Z dd lm Z dd l!m"Z" d d � Z#d d� Z$dd� Z%dd� Z&G dd� de�Z'G dd� de�Z(d dd�Z)d dd�Z*dS ) )�Policy� policy_reader� policy_writer� N)�config)�checkIP�checkIP6� checkUINT16�coalescePortRange�max_policy_name_len�portInPortRange�portStr�uniqify)�DEFAULT_POLICY_TARGET�POLICY_TARGETS�DEFAULT_POLICY_PRIORITY)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol)�rich)�log)�errors)� FirewallErrorc s� |dkr dS |dkr dS |dkrO| j r2| j jr't�dt| j �� d| _dS t�� d �| j _dS � d | jj vrE| jj � � d � dS t�d� d � dS |dk�r| j rw| j jrit�dt| j �� d| _dS t� � d � d �| j _dS t � d � t � d � t� d d �� d f}tt� fd d �| jj��}|D ].}t|d |d �r�t| jt�r�| jjn| jj}t�ttjd|d � d |f �� dS q�t|d dd� |D ��\}}|D ]} t| d �� d f} | jj�| � q�|D ]} t| d �� d f} | jj� | � q�dS |d k�rQ| j �r-| j j�r"t�dt| j �� d| _dS t� � d �| j _dS t � d � � d | jj v�rG| jj � � d � dS t�d� d � dS |dk�r�| j �r�| j j�rmt�dt| j �� d| _dS d} d� v �rx� d } t� | �| j _dS t�d� d � dS |dk�r�| j �r�| j j�r�t�dt| j �� d| _dS t� � d �| j _dS � d | jj!v�r�| jj!� � d � dS t�d� d � dS |dk�r| j �r�| j j�r�t�dt| j �� d| _dS t�"� d �| j _dS t�d� d � dS |dk�r7| j �r%| j j�r t�dt| j �� d| _dS t�#� | j _dS | jj$�r1t�d� dS d| j_$dS |d k�r�d } d � v �rG� d } d } d � v �rR� d } | j �ry| j j�rit�dt| j �� d| _dS t�%� d � d | | �| j _dS t � d � t � d � | �r�t | � | �r�t&| ��s�t'| ��s�ttj(d | ��t� d d �� d t| d �t| �f} | | jj)v�r�| jj)� | � dS t�d!� d � d | �r�d"| nd | �r�d#| nd � dS |d$k�r�| j �r | j j�r�t�dt| j �� d| _dS t�*� d � d �| j _dS t � d � t � d � t� d d �� d f}tt� fd%d �| jj+��}|D ]1}t|d |d ��r`t| jt��rG| jjn| jj}t�ttjd|d � d |f �� dS �q0t|d d&d� |D ��\}}|D ]} t| d �� d f} | jj+�| � �qr|D ]} t| d �� d f} | jj+� | � �q�dS |d'k�r�| j �s�t�d(� d| _dS | j j,�r�t�d)t| j �� dS d*}d }d+� v �rΈ d+ }d }d,� v �rو d, }d-� v �r� d- �-� d.v �r�d}t�.|||�| j _,dS |d/v �r]| j �st�d0� d| _dS | j j/�rt�d1� d| _dS |d2k�r"t�0� | j _/n4|d3k�r:d }d4� v �r2� d4 }t�1|�| j _/n |d5k�rFt�2� | j _/n|d6k�rV� d7 }t�3|�| j _/| j j/| _4dS |d8k�r�| j �smt�d9� dS | j j�ryt�d:� dS d }d;� v �r�� d; }|d<v�r�t�d=� d| _dS d }d>� v �r�� d> }|�r�t5|�d?k�r�t�d@� d| _dS t�6||�| j _| j j| _4dS |dAk�r@| j �s�t�d9� dS | j j�r�t�d:� dS d }dB� v �r�� dB }t7|��s�t�dC� d| _dS d }d>� v �r� d> }|�r t5|�d?k�rt�dD� d| _dS d }dE� v �r0� dE }t7|��s0t�dF� d| _dS t�8|||�| j _| j j| _4dS |dGk�rp| j �sPt�dH� dS | j j9�rct�dIt| j �� d| _dS t�:� | j _9| j j9| _4dS |dJk�r�d }d }dK� v �r�� dK }|dLv�r�t�dM� dK � d| _dS dN� v �r�t;� dN �}tj<||dO�| _ dS |dPk�r�| j4�s�t�dQ� d| _dS | j4j=�r�t�dRt| j �� d| _dS � d }t�>|�| j4_=dS d*S )SN�short� description�servicez;Invalid rule: More than one element in rule '%s', ignoring.T�namez#Service '%s' already set, ignoring.�port�protocol�-c � | d � d kS �N� r � ��x��attrsr% �9/usr/lib/python3/dist-packages/firewall/core/io/policy.py�<lambda>E � z%common_startElement.<locals>.<lambda>r z'%s:%s' already in '%s'c S � g | ]\}}|�qS r% r% ��.0�_port� _protocolr% r% r* � <listcomp>O � z'common_startElement.<locals>.<listcomp>�valuez$Protocol '%s' already set, ignoring.� tcp-mss-clamp�pmtuz0Invalid rule: tcp-mss-clamp '%s' outside of rule� icmp-blockz&icmp-block '%s' already set, ignoring.� icmp-typez-Invalid rule: icmp-block '%s' outside of rule� masqueradez!Masquerade already set, ignoring.� forward-port� �to-port�to-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%s� source-portc r" r# r% r& r( r% r* r+ � r, c S r- r% r% r. r% r% r* r2 � r3 � destinationz)Invalid rule: Destination outside of rulez?Invalid rule: More than one destination in rule '%s', ignoring.F�address�ipset�invert��yes�true)�accept�reject�drop�markz$Invalid rule: Action outside of rulez"Invalid rule: More than one actionrF rG �typerH rI �setr z!Invalid rule: Log outside of rulez Invalid rule: More than one log�level)�emerg�alert�crit�error�warning�notice�info�debugz Invalid rule: Invalid log level�prefix� z Invalid rule: Invalid log prefix�nflog�groupz'Invalid rule: Invalid nflog group valuez"Invalid rule: Invalid nflog prefix� queue-sizez&Invalid rule: Invalid nflog queue-size�auditz#Invalid rule: Audit outside of rulez9Invalid rule: More than one audit in rule '%s', ignoring.�rule�family)�ipv4�ipv6z&Invalid rule: Rule family "%s" invalid�priority)r\ r_ �limitz4Invalid rule: Limit outside of action, log and auditz9Invalid rule: More than one limit in rule '%s', ignoring.)?�_rule�elementr rQ �str� _rule_errorr � Rich_Service�item�services�append� Rich_Portr r r �list�filter�portsr � isinstancer �derived_from_zoner r r �ALREADY_ENABLEDr �remove� Rich_Protocolr � protocols�Rich_Tcp_Mss_Clamp�Rich_IcmpBlock� icmp_blocks� Rich_IcmpType�Rich_Masquerader9 �Rich_ForwardPortr r � INVALID_ADDR� forward_ports�Rich_SourcePort� source_portsr? �lower�Rich_Destination�action� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� _limit_ok�len�Rich_Logr � Rich_NFLogrZ � Rich_Audit�int� Rich_Ruler` � Rich_Limit)�objr r) � new_port_id�existing_port_ids�port_id�_name� added_ranges�removed_ranges�_range�entry�_value�to_port�to_addrrB r@ rA �_type�_setrL rU rX � thresholdr\ r_ r4 r% r( r* �common_startElement! sL W � �� U � ��� I � ��� G � � �� � � . � �� $ � � � � � � � � ��� � � � � � ��� � � � � x ��� v � � �� i � � � _ � � \ �� Z � � � � ��� 9 �� � 7 � � � � � �� � � � �| � c � J � + � � � � � ��r� c C s� |dkrX| j sPz| j�� W n ty* } zt�d|t| j�� W Y d }~n*d }~ww t| j�| jjvrG| jj � | j� | jj� t| j�� n t�dt| j�� d | _d| _ d S |dv rad | _ d S d S )Nr[ z%s: %sz Rule '%s' already set, ignoring.F)rF rG rH rI r rZ ) rd ra �check� Exceptionr rQ rc rf � rules_str�rulesrh r� )r� r �er% r% r* �common_endElementz s& ��� �r� c C s2 t | t�rdnd}|dkr,d|v r,|d }|D ]}||vr)ttjd�|| j|���qd S |dkrC|D ]}t|d � t|d � q2d S |dkrR|D ]} t | � qId S |d kr�d |v r�|d } |D ]%} | | vr�ttj d �|| j| ��} | |� d i �v r�t � d �| �� q`| �q`d S |dkr�|D ]J} t| d � t| d � | d s�| d s�ttjd�|| j| ���| d r�t| d � | d r�t| d �s�t| d �s�ttjd�|| j| d ���q�d S |dkr�|D ]}t|d � t|d � q�d S |dv �r�|D ]�}tj|d�}|j�r�d |v �r�t |jtj��st |jtj��r�|d } |jj| v�rIttj d �|| j|jj��} |jj|� d i �v �rGt � d �| �� q�| �|j�r�|d |jj }|j�r�|j|jv�r�ttj d�|| j|j|jj��} |� d i �� |jj�}|�r�|j�r�|j|jv �r�t � d �| �� q�| �q�d S d S )Nr �Zonerg z){} '{}': '{}' not among existing servicesrl r r$ rr ru � icmptypesz+{} '{}': '{}' not among existing ICMP types�icmptypes_unsupportedz{} (unsupported)rz � � z-{} '{}': '{}' is missing to-port AND to-addr z,{} '{}': to-addr '{}' is not a valid addressr| )r� � rich_rules��rule_strz<{} '{}': rich rule family '{}' conflicts with icmp type '{}')rm r r r �INVALID_SERVICE�formatr r r r �INVALID_ICMPTYPE�getr �debug1�INVALID_FORWARDr r ry r r� rb rt rv r\ r? )r� r rf � all_config�all_io_objects�obj_type�existing_servicesr r �proto�existing_icmptypes�icmptype�ex�fwd_portr[ �obj_rich�ict�ict_unsupportedr% r% r* �common_check_config� s� ���� � ����� �� ���� � � � ������r� c C s� | j r#| j dkr#|�d� |�di � |�| j � |�d� |�d� | jrF| jdkrF|�d� |�di � |�| j� |�d� |�d� t| j�D ]}|�d� |�dd|i� |�d� qKt| j �D ]}|�d� |�d|d |d d �� |�d� qet| j �D ]}|�d� |�d d |i� |�d� q�t| j �D ]}|�d� |�dd|i� |�d� q�| j r�|�d� |�di � |�d� t| j �D ];}|�d� |d |d d �}|d r�|d dkr�|d |d< |d r�|d dkr�|d |d< |�d|� |�d� q�t| j�D ]}|�d� |�d|d |d d �� |�d� �q | jD �]'}i }|j�r8|j|d< |jd k�rEt|j�|d< |�d� |�d|� |�d� |j�r�i }|jj�rf|jj|d< |jj�rq|jj|d< |jj�r||jj|d< |jj�r�d |d < |�d � |�d |� |�d� |j�r�i }|jj�r�|jj|d< |jj�r�|jj|d< |jj�r�d |d < |�d � |�d |� |�d� |j�r�d} i }t|j�tj k�r�d} |jj |d< n�t|j�tj k�r�d} |jj |d< |jj |d < n�t|j�tj!k�rd } |jj"|d < n�t|j�tj#k�r d!} |jj"|d < n�t|j�tj$k�r,d} nyt|j�tj%k�r>d} |jj |d< ngt|j�tj&k�rPd"} |jj |d< nUt|j�tj'k�r�d} |jj |d< |jj |d < |jj(dk�rt|jj(|d< |jj)dk�r�|jj)|d< n#t|j�tj*k�r�d} |jj |d< |jj |d < n t+t,j-d#t|j� ��|�d � |�| |� |�d� |j.�rtt|j.�tj/k�ri }|j.j0�r�|j.j0|d$< |j.j1�r�|j.j1|d%< |j.j2�r|�d � |�d&|� |�d'� |�d(d |j.j2j"i� |�d)� |�d&� n |�d � |�d&|� |�d� n^i }|j.j3�r#|j.j3|d*< |j.j0�r.|j.j0|d$< |j.j4�r9|j.j4|d+< |j.j2�rd|�d � |�d,|� |�d'� |�d(d |j.j2j"i� |�d)� |�d,� n |�d � |�d,|� |�d� |j5�r�i }|j5j2�r�|�d � |�d-i � |�d'� |�d(d |j5j2j"i� |�d)� |�d-� n |�d � |�d-|� |�d� |j6�rBd} i }t|j6�tj7k�r�d.} n>t|j6�tj8k�r�d/} |j6j�r�|j6j|d0< n't|j6�tj9k�r�d1} nt|j6�tj:k�r�d2} |j6j;|d3< n t.�<d4t|j6�� |j6j2�r2|�d � |�| |� |�d'� |�d(d |j6j2j"i� |�d)� |�| � n |�d � |�| |� |�d� |�d� |�d� |�d� �q*d S )5Nr; � r � r r r r r r$ )r r r r4 r7 r9 r� r< r� r= r: r> r\ r_ r[ r@ �macrA �TruerB z �sourcer? r5 r8 z"Unknown element '%s' in obj_writerrU rL r z r` z rX rY rW rZ rF rG rJ rH rI rK zUnknown action '%s')=r �ignorableWhitespace� startElement� characters� endElementr r rg � simpleElementrl rr ru r9 rz r| r� r\ r_ rc r� �addrr� rA rB r? rb rJ r re r ri r r rq r4 rs rw rt rv rx r� � to_addressr{ r r �INVALID_OBJECTr r� rU rL r` rX r� rZ r r� r� r� r� rK rQ ) r� �handlerr r r �icmp�forwardr) r[ rb r r% r% r* � common_writer� s� � � � � � � � � ��r� c s� e Zd ZdZdZeZdgZdddddd gfd d gfd d gfd ddgfdd gfdd gfdd gfddd gfdd gffZg d�Z i dd�dd�ddg�d d g�d d d g�d d g�d!d g�d"d�d#d d g�d$d�d%d�d&d�d d'g�d(d d g�d)d�d*d�d+d�dddd,gd'gd gd gd-��Z d.d/gd0d1gd2d/gg d3�g d4�d5d6gg d7�d8gd'gd9� Z � fd:d;�Z d<d=� Z � fd>d?�Z� fd@dA�ZdBdC� Z� fdDdE�Z� ZS )Fr i ���i� r )�versionr; )r r; )r r; )�targetr; rg r; rl )r; r; ru )r9 Frz )r; r; r; r; r� rr r| )r_ r � ingress_zones� egress_zones)�_r! �/r Nr �policyr� r r r r r7 r8 r9 r: r[ r� r? r4 r> r rW rZ rK )rF rG rH rI r` � ingress-zone� egress-zoner� r_ r< r= r\ )r@ r� rB r\ rA )r@ rB rA rU rL )rX rU rY rJ ) r� r: r[ r� r? r rW rG r5 c s� t t| ��� d| _d| _d| _t| _g | _g | _ g | _ g | _ d| _ d| _ g | _g | _g | _g | _d| _| j| _d | _g | _g | _d S �Nr; F)�superr �__init__r� r r r r� rg rl rr ru �icmp_block_inversionr9 rz r| r� r� �applied�priority_defaultr_ rn r� r� ��self�� __class__r% r* r� s( zPolicy.__init__c C s� d| _ d| _d| _t| _| jd d �= | jd d �= | jd d �= | jd d �= d| _ d| _ | j d d �= | j d d �= | j d d �= | jd d �= d| _| j| _| jd d �= | jd d �= d S r� )r� r r r r� rg rl rr ru r� r9 rz r| r� r� r� r� r_ r� r� r� r% r% r* �cleanup" s$ zPolicy.cleanupc s |dkr| j S ttt| �|�S )Nr� )r� �getattrr� r �r� r r� r% r* � __getattr__6 s zPolicy.__getattr__c sD |dkrdd� |D �| _ dd� | j D �| _d S tt| ��||� d S )Nr� c S s g | ]}t j|d ��qS )r� )r r� �r/ �sr% r% r* r2 > s z&Policy.__setattr__.<locals>.<listcomp>c S s g | ]}t |��qS r% )rc r� r% r% r* r2 @ r3 )r� r� r� r � __setattr__)r� r r4 r� r% r* r� < s zPolicy.__setattr__c C s� t | ||||� | j|d v rttjd�| j���|dkr.|tvr,ttjd�| j|���d S |dkrT|| jv sA|| j ksA|| j k rRttj d�| j|| j | j | j���d S |dv r�dd gt |d � � � }|D ]a}||vrwttjd �| j|���|d vr�tdd g�t|�@ s�|d v r�t|�t|g� r�ttjd �| j|���|d kr�|d kr�d|v r�d |d v s�|dkr�d |v r�d |d v r�ttjd�| j���qfd S |dk�r1|�r1d|v r�d |d v r�ttjd�| j���d |v �r-d |d v r�ttjd�| j���|d D ]/}|dk�rq�||d v�rttjd�| j|���|d | j�r,ttjd�| j|���q�d S d S |dk�rk|D �]/}tj|d�}|j�r�t|jtj��r�d|v �rcd |d v �rcttjd�| j���d |v �r�d |d v �ryttjd�| j���|d D ]/}|dk�r��q}||d v�r�ttjd�| j|���|d | j�r�ttjd�| j|����q}�q8|j�r"t|jtj��r"d|v �r d |d v �r�|jj�r�ttjd�| j����q8|d �r |jj�s�ttjd�| j���d|d v�r |d D ](}||d v�r ttjd�| j|���|d | j�r ttjd�| j|����q��q8|j�rgt|jtj��rgd|v �rg|d D ]/}|d v �r@�q7||d v�rRttjd�| j|���|d | j�rettjd�| j|����q7�q8d S |dk�r�|D ]j} d|v �r�d |d v �r�| d �r�ttjd�| j����qr|d �r�| d �s�ttjd�| j���d|d v�r�|d D ](}||d v�r�ttjd�| j|���|d | j�r�ttjd�| j|����q��qrd S d S ) N�zonesz0Policy '{}': Can't have the same name as a zone.r� z#Policy '{}': '{}' is invalid targetr_ z^Policy '{}': {} is invalid priority. Must be in range [{}, {}]. The following are reserved: {})r� r� �ANY�HOSTz*Policy '{}': '{}' not among existing zones)r� r� zKPolicy '{}': '{}' may only contain one of: many regular zones, ANY, or HOSTr� r� zSPolicy '{}': 'HOST' can only appear in either ingress or egress zones, but not bothr9 z;Policy '{}': 'masquerade' is invalid for egress zone 'HOST'z<Policy '{}': 'masquerade' is invalid for ingress zone 'HOST'z&Policy '{}': Zone '{}' does not exist.z\Policy '{}': 'masquerade' cannot be used because ingress zone '{}' has assigned interfaces. r� r� zNPolicy '{}': A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zPPolicy '{}': 'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonez[Policy '{}': 'forward-port' cannot be used because egress zone '{}' has assigned interfaceszZPolicy '{}': 'mark' action cannot be used because egress zone '{}' has assigned interfacesrz r� )r� r r r � NAME_CONFLICTr� r �INVALID_TARGET�priority_reserved� priority_max� priority_min�INVALID_PRIORITYrj �keys� INVALID_ZONErK � interfacesr r� rb rm rw rx r� r� r r� ) r� r rf r� r� �existing_zones�zoner[ r� r� r% r% r* � _check_configD s< � ����� �� ������ �� �� �� �� �� ��� �� �� ��� . ��� �� ���zPolicy._check_configc s� t t| ��|� |�d�rttjd�|���|�d�r$ttjd�|���|� d�dkr4ttjd�|���d|v rB|d |� d�� }n|}t |�t � krYttjd�|t |�t � ���d S )Nr� z&Policy '{}': name can't start with '/'z$Policy '{}': name can't end with '/'r$ z'Policy '{}': name has more than one '/'z)Policy '{}': name has {} chars, max is {}) r� r � check_name� startswithr r � INVALID_NAMEr� �endswith�count�findr� r )r� r � checked_namer� r% r* r� � s0 � �����zPolicy.check_name)�__name__� __module__� __qualname__r� r� r r� r� �IMPORT_EXPORT_STRUCTURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr� r� r� r� r� r� � __classcell__r% r% r� r* r � s� ��������� � � � � ������� vr c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�policy_ContentHandlerc C s" t �| |� d | _d| _d | _d S )NF)r r� ra rd r� )r� rf r% r% r* r� � s z policy_ContentHandler.__init__c C s� t �| ||� | jr d S | j�||� t| ||�rd S |dkrSd|v r)|d | j_d|v r5t|d �| j_d|v rO|d }|t vrGt t j |��|rQ|| j_ d S d S d S |dkrt|d | jjvrj| jj�|d � d S t�d|d � d S |dkr�|d | jjvr�| jj�|d � d S t�d |d � d S |d kr�| js�t�d � d | _d S | jjr�t�d t| j�� d | _d S d}d|v r�|d �� dv r�d }d } }}d|v r�|d }d|v r�|d }d|v r�|d }tj||||d�| j_d S t�d|� d S )Nr� r� r_ r� r� r z(Ingress zone '%s' already set, ignoring.r� z'Egress zone '%s' already set, ignoring.r� z$Invalid rule: Source outside of ruleTz:Invalid rule: More than one source in rule '%s', ignoring.FrB rC r@ r� rA )rB zUnknown XML element '%s')r r� rd rf �parser_check_element_attrsr� r� r� r_ r r r r� r� r� rh r rQ r� ra r� rc r} r � Rich_Source)r� r r) r� rB r� r� rA r% r% r* r� � sn � � � z"policy_ContentHandler.startElementc C s t �| |� t| |� d S �N)r r� r� r� r% r% r* r� s z policy_ContentHandler.endElementN)r� r� r r� r� r� r% r% r% r* r � s @r Fc C s t � }| �d�sttjd| ��| d d� |_|s |�|j� | |_||_|� t j �r-dnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��4}t�d �}|�|� z|�|� W n tjyu } z ttjd| �� ��d } ~ ww W d � ~~|S 1 s�w Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid policy file: %s)r r� r r r� r r� �filename�pathr� r � ETC_FIREWALLD�builtin�defaultr �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException�INVALID_POLICY� getException) r r � no_check_namer� r� �parserr �fr� �msgr% r% r* r sL � ����� � � r c C s� |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� i }| jr�| jd kr�| j|d < | j| jkr�t| j�|d < | j|d < |�d |� |�d� t| |� t| j �D ]} |�d� |� dd| i� |�d� q�t| j �D ]} |�d� |� dd| i� |�d� q�|� d � |�d� |� � |�!� ~d S )Nr z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr; r� r_ r� r� r� r� r� r r� )"r r r �os�exists�shutil�copy2r� r rP �dirnamer� r r �mkdir�ior r � startDocumentr� r_ r� rc r� r� r� r� r r� r� r� r� � endDocument�close) r� r �_pathr r �dirpathr r� r) r� r% r% r* r ; sR �� r )Fr )+�__all__�xml.saxr r# r) r% �firewallr �firewall.functionsr r r r r r r r �firewall.core.baser r r �firewall.core.io.io_objectr r r r r r � firewall.corer �firewall.core.loggerr r �firewall.errorsr r� r� r� r� r r r r r% r% r% r* �<module> s4 ( [L v L PK ���Z�*X�, �, " __pycache__/direct.cpython-310.pycnu �[��� o bhAb�< � @ s� d dl mZ d dlZd dlZd dlZd dlmZ d dlmZ d dl m Z m Z d dl m Z mZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d lmZ G d d � d e�ZG d d� de �ZdS )� N)�config)�LastUpdatedOrderedDict)� splitArgs�joinArgs)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)� ipXtables)�ebtables)�errors)� FirewallErrorc @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�direct_ContentHandlerc C s t �| |� d| _d S )NF)r �__init__�direct)�self�item� r �9/usr/lib/python3/dist-packages/firewall/core/io/direct.pyr ( s z direct_ContentHandler.__init__c C s` t �| ||� | j�||� |dkr | jrttjd��d| _d S |dkrD| js.t� d� d S |d }|d }|d }| j� |||� d S |dkr�| jsRt� d � d S |d }|d vrbttj d | ��|d }|d }zt |d �}W n t y� t� d |d � Y d S w ||||g| _d S |dkr�| js�t� d� d S |d }|g| _d S t� d| � d S )Nr zMore than one direct tag.T�chainz$Parse Error: chain outside of direct�ipv�table�rulez#Parse Error: rule outside of direct��ipv4�ipv6�ebz"'%s' not from {'ipv4'|'ipv6'|'eb'}�priorityz'Parse Error: %s is not a valid priority� passthroughz&Parse Error: command outside of directzUnknown XML element %s)r � startElementr �parser_check_element_attrsr r r � PARSE_ERRORr �error� add_chain� INVALID_IPV�int� ValueError�_rule� _passthrough)r �name�attrsr r r r r r r r , sX � � �� z"direct_ContentHandler.startElementc C s� t �| |� |dkr(| jr | j�t| j�� | jj| j� nt� d� d | _d S |dkrJ| jr@| j �t| j�� | jj | j � nt� d� d | _ d S d S )Nr z2Error: rule does not have any arguments, ignoring.r z9Error: passthrough does not have any arguments, ignoring.) r � endElement�_elementr' �appendr r �add_ruler r" r( �add_passthrough)r r) r r r r+ \ s �z direct_ContentHandler.endElementN)�__name__� __module__� __qualname__r r r+ r r r r r ' s 0r c s6 e Zd ZdZddgfddddddgfgfdddgfgffZdZd g d �g d �d gd �Zi Z� fdd�Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!� Z"S )B�Directz Direct class �chains)� r5 r5 �rulesr5 r � passthroughsz(a(sss)a(sssias)a(sas))N�r r r �r r r r r )r r r r c s0 t t| ��� || _t� | _t� | _t� | _d S �N)�superr3 r �filenamer r4 r6 r7 )r r< �� __class__r r r � s zDirect.__init__c C s d S r: r )r �confr �all_conf�all_io_objectsr r r � _check_config� s zDirect._check_configc C s� g }g }| j D ]}| j | D ]}|�tt|�t|g� �� qq|�|� g }| jD ]"}| j| D ]}|�t|d |d |d |d t|d �f�� q1q*|�|� g }| jD ]}| j| D ] }|�t|t|�f�� q^qW|�|� t|�S )Nr � � )r4 r- �tuple�listr6 r7 )r �ret�x�keyr r r r r � export_config� s, � �� � zDirect.export_configc C s� | � � | �|� t| j�D ]6\}\}}|dkr$|| D ]}| j|� q |dkr4|| D ]}| j|� q,|dkrD|| D ]}| j|� q<qd S )Nr4 r6 r7 )�cleanup� check_config� enumerate�IMPORT_EXPORT_STRUCTUREr# r. r/ )r r? rA �i�element�dummyrH r r r � import_config� s ��zDirect.import_configc C s" | j �� | j�� | j�� d S r: )r4 �clearr6 r7 �r r r r rK � s zDirect.cleanupc C s� t d� | jD ]}t d|d |d d�| j| �f � qt d� | jD ]&}t d|d |d |d f � | j| D ]\}}t d |d �|�f � q:q$t d � | jD ]}t d | � | j| D ] }t d d �|� � q_qRd S )Nr4 z (%s, %s): %sr rC �,r6 z (%s, %s, %s):rD z (%d, ('%s'))z','r7 z %s:z ('%s'))�printr4 �joinr6 r7 )r rI r �argsr r r �output� s$ � � ��z Direct.outputc C s( g d�}||vrt tjd||f ��d S )Nr �'%s' not in '%s')r r r$ )r r �ipvsr r r � _check_ipv� s ��zDirect._check_ipvc C sF | � |� |dv rtj�� ntj�� }||vr!ttjd||f ��d S )N)r r rZ )r\ r �BUILT_IN_CHAINS�keysr r r � INVALID_TABLE)r r r �tablesr r r �_check_ipv_table� s � ��zDirect._check_ipv_tablec C sf | � ||� ||f}|| jvrg | j|< || j| vr%| j| �|� d S t�d|||f d � d S )Nz(Chain '%s' for table '%s' with ipv '%s' �already in list, ignoring)ra r4 r- r �warning�r r r r rI r r r r# � s � �zDirect.add_chainc C sp | � ||� ||f}|| jv r/|| j| v r/| j| �|� t| j| �dkr-| j|= d S d S td|||f ��)Nr z4Chain '%s' with table '%s' with ipv '%s' not in list)ra r4 �remove�lenr& rd r r r � remove_chain� s ���zDirect.remove_chainc C s, | � ||� ||f}|| jv o|| j| v S r: )ra r4 rd r r r � query_chain� s zDirect.query_chainc C s8 | � ||� ||f}|| jv r| j| S td||f ��)Nz&No chains for table '%s' with ipv '%s')ra r4 r& )r r r rI r r r � get_chains� s �zDirect.get_chainsc C � | j S r: )r4 rT r r r �get_all_chains� � zDirect.get_all_chainsc C s� | � ||� |||f}|| jvrt� | j|< |t|�f}|| j| vr,|| j| |< d S t�dd�|�||f d||f d � d S )N�(Rule '%s' for table '%s' and chain '%s' �',z with ipv '%s' and priority %d rb )ra r6 r rE r rc rW �r r r r r rX rI �valuer r r r. s � � �zDirect.add_rulec C s� | � ||� |||f}|t|�f}|| jv r4|| j| v r4| j| |= t| j| �dkr2| j|= d S d S tdd�|�||f d||f ��)Nr rm rn z)with ipv '%s' and priority %d not in list)ra rE r6 rf r& rW ro r r r � remove_rule s �� �zDirect.remove_rulec C sf | � ||� |||f}|| jv r/| j| �� D ]}| j| |= qt| j| �dkr1| j|= d S d S d S )Nr )ra r6 r^ rf )r r r r rI rp r r r � remove_rules s �zDirect.remove_rulesc C s: | � ||� |||f}|t|�f}|| jv o || j| v S r: )ra rE r6 ro r r r � query_rule' s zDirect.query_rulec C sB | � ||� |||f}|| jv r| j| S td||f d| ��)Nz'No rules for table '%s' and chain '%s' z with ipv '%s')ra r6 r& rd r r r � get_rules- s ��zDirect.get_rulesc C rj r: )r6 rT r r r � get_all_rules6 rl zDirect.get_all_rulesc C s` | � |� || jvrg | j|< || j| vr | j| �|� d S t�dd�|�|f d � d S )N� Passthrough '%s' for ipv '%s'rn rb )r\ r7 r- r rc rW �r r rX r r r r/ ; s � �zDirect.add_passthroughc C sn | � |� || jv r*|| j| v r*| j| �|� t| j| �dkr(| j|= d S d S tdd�|�|f d ��)Nr rv rn z not in list)r\ r7 re rf r& rW rw r r r �remove_passthroughE s � ��zDirect.remove_passthroughc C s" | � |� || jv o|| j| v S r: )r\ r7 rw r r r �query_passthroughO s zDirect.query_passthroughc C s* | � |� || jv r| j| S td| ��)Nz No passthroughs for ipv '%s')r\ r7 r& )r r r r r �get_passthroughsS s zDirect.get_passthroughsc C rj r: )r7 rT r r r �get_all_passthroughsZ rl zDirect.get_all_passthroughsc C s� | � � | j�d�sttjd| j ��t| �}t�� }|� |� t | jd��2}t� d �}|� |� z|� |� W n tjyO } z ttjd|�� ��d }~ww W d � d S 1 s[w Y d S )Nz.xmlz'%s' is missing .xml suffix�rbzNot a valid file: %s)rK r< �endswithr r � INVALID_NAMEr �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException� INVALID_TYPE� getException)r �handler�parser�f�source�msgr r r �read_ s. � �����"�z Direct.readc C s t j�| j�r)z t�| jd| j � W n ty( } z td| j|f ��d }~ww t j�tj �s7t � tj d� t j | jddd�}t |�}|�� |�di � |�d� | jD ]"}|\}}| j| D ]}|�d � |�d |||d �� |�d� qaqV| jD ]?}|\}}}| j| D ]2\}} t| �d k r�q�|�d � |�d |||d| d�� |�tj�t| ��� |�d � |�d� q�q|| jD ]3}| j| D ]+} t| �d k r�q�|�d � |�dd|i� |�tj�t| ��� |�d� |�d� q�q�|�d� |�d� |�� |� � ~d S )Nz%s.oldzBackup of '%s' failed: %si� �wtzUTF-8)�mode�encodingr � z r r8 rC r z%dr9 r r ) �os�path�existsr< �shutil�copy2� Exception�IOErrorr � ETC_FIREWALLD�mkdir�ior� r � startDocumentr �ignorableWhitespacer4 � simpleElementr6 rf r �saxutils�escaper r+ r7 � endDocument�close) r r� r� r� rI r r r r rX r r r �writeq sh �� � � � � � z Direct.write)#r0 r1 r2 �__doc__rN �DBUS_SIGNATURE� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr rB rJ rR rK rY r\ ra r# rg rh ri rk r. rq rr rs rt ru r/ rx ry rz r{ r� r� � __classcell__r r r= r r3 q sN �� r3 )�xml.saxr r� r� r� �firewallr �firewall.fw_typesr �firewall.functionsr r �firewall.core.io.io_objectr r r �firewall.core.loggerr � firewall.corer r r �firewall.errorsr r r3 r r r r �<module> s JPK ���ZֲNv� � % __pycache__/functions.cpython-310.pycnu �[��� o bhAb� � @ s� d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl m Z d dl m Z d dl mZ d d lmZ d d lmZ d d lmZ d d lmZ d d lmZ dd� ZdS )� N)�config)� FirewallError)�FirewallConfig)� zone_reader)�service_reader)� ipset_reader)�icmptype_reader)� helper_reader)� policy_reader)�Direct)�LockdownWhitelist)�firewalld_confc C s� t | �}t|jtjtjgd�t|jtjtj gd�t |j tj tj gd�t|jtjtjgd�t|jtjtjgd�t|jtjtjgd�d�}|�� D ]2}|| d D ])}tj � |�sXqOt t� |��D ]}|� d�rw|| d ||�}|| d |� q_qOqG|�!� tj �"tj#�r�zt$tj#�}|�%� |�&|�'� � W n, t(y� } z t(|j)dtj#|j*f ��d }~w t+y� } z t+dtj#|f ��d }~ww tj �"tj,��r zt-tj,�}|�%� |�&|�'� � W n- t(y� } z t(|j)dtj,|j*f ��d }~w t+�y } z t+dtj,|f ��d }~ww tj �"tj.��rOz t/tj.�}|�%� W d S t(�y9 } z t(|j)dtj.|j*f ��d }~w t+�yN } z t+dtj.|f ��d }~ww d S )N)�reader�add�dirs)�ipset�helper�icmptype�service�zone�policyr z.xmlr r z'%s': %s)0r r � add_ipsetr �FIREWALLD_IPSETS�ETC_FIREWALLD_IPSETSr � add_helper�FIREWALLD_HELPERS�ETC_FIREWALLD_HELPERSr � add_icmptype�FIREWALLD_ICMPTYPES�ETC_FIREWALLD_ICMPTYPESr � add_service�FIREWALLD_SERVICES�ETC_FIREWALLD_SERVICESr �add_zone�FIREWALLD_ZONES�ETC_FIREWALLD_ZONESr �add_policy_object�FIREWALLD_POLICIES�ETC_FIREWALLD_POLICIES�keys�os�path�isdir�sorted�listdir�endswith�full_check_config�isfile�FIREWALLD_DIRECTr �read� check_config� export_configr �code�msg� Exception�LOCKDOWN_WHITELISTr �FIREWALLD_CONFr ) �fw� fw_config�readersr �_dir�file�obj�errorr7 � rB �</usr/lib/python3/dist-packages/firewall/core/io/functions.py�check_on_disk_config& s� � � � � � �� ��� ��� ��� ����rD )r* �firewallr �firewall.errorsr �firewall.core.fw_configr �firewall.core.io.zoner �firewall.core.io.servicer �firewall.core.io.ipsetr �firewall.core.io.icmptyper �firewall.core.io.helperr �firewall.core.io.policyr �firewall.core.io.directr �#firewall.core.io.lockdown_whitelistr � firewall.core.io.firewalld_confr rD rB rB rB rC �<module> s PK ���Z��"�� � . __pycache__/lockdown_whitelist.cpython-310.pycnu �[��� o bhAb�/ � @ s� d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m Z d dl m Z d dl mZmZmZmZmZ d dlmZ d dlmZ G dd � d e �ZG d d � d e�ZdS ) � N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�uniqify� checkUser�checkUid� checkCommand� checkContext)�errors)� FirewallErrorc @ s e Zd Zdd� Zdd� ZdS )�!lockdown_whitelist_ContentHandlerc C s t �| |� d| _d S )NF)r �__init__� whitelist)�self�item� r �E/usr/lib/python3/dist-packages/firewall/core/io/lockdown_whitelist.pyr % s z*lockdown_whitelist_ContentHandler.__init__c C sX t �| ||� | j�||� |dkr | jrttjd��d| _d S |dkr:| js.t� d� d S |d }| j� |� d S |dkr�| jsHt� d� d S d |v rpzt |d �}W n t yg t� d |d � Y d S w | j� |� d S d|v r~| j�|d � d S d S |d kr�| js�t� d � d S d |vr�t� d� d S | j�|d � d S t� d| � d S )Nr zMore than one whitelist.T�commandz)Parse Error: command outside of whitelist�name�userz&Parse Error: user outside of whitelist�idz"Parse Error: %s is not a valid uid�selinuxz)Parse Error: selinux outside of whitelist�contextzParse Error: no contextzUnknown XML element %s)r � startElementr �parser_check_element_attrsr r r � PARSE_ERRORr �error� add_command�int� ValueError�add_uid�add_user� add_context)r r �attrsr �uidr r r r ) sR � ��� z.lockdown_whitelist_ContentHandler.startElementN)�__name__� __module__� __qualname__r r r r r r r $ s r c s, e Zd ZdZddgfddgfddgfddgffZdZd gZd d gd d gd �Zddd giZ� fdd�Z dd� Z dd� Z dd� Z dd� Z dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!� Z"S )B�LockdownWhitelistz LockdownWhitelist class �commands� �contexts�users�uidsr z (asasasai)�_Nr r )r r r r r r c s6 t t| ��� || _d | _g | _g | _g | _g | _d S �N) �superr* r �filename�parserr+ r- r. r/ )r r3 �� __class__r r r n s zLockdownWhitelist.__init__c C s� |dv r|D ]}| � ||d d� ||� qd S |dkr't|�s%ttj|��d S |dkr7t|�s5ttj|��d S |dkrGt|�sEttj|��d S |dkrUt |�sWttj |��d S d S )N�r+ r- r. r/ ���r r r r& ) � _check_configr r r �INVALID_COMMANDr �INVALID_CONTEXTr � INVALID_USERr � INVALID_UID)r r r � all_config�all_io_objects�xr r r r9 y s* � � � � �z LockdownWhitelist._check_configc C s4 | j d d �= | jd d �= | jd d �= | jd d �= d S r1 r7 �r r r r �cleanup� s zLockdownWhitelist.cleanupc C �> t |�s ttj|��|| jvr| j�|� d S ttjd| ��)Nz!Command "%s" already in whitelist)r r r r: r+ �append�ALREADY_ENABLED�r r r r r r � � �z LockdownWhitelist.add_commandc C �* || j v r | j �|� d S ttjd| ��)Nz Command "%s" not in whitelist.)r+ �remover r � NOT_ENABLEDrF r r r �remove_command� � �z LockdownWhitelist.remove_commandc C � || j v S r1 �r+ rF r r r � has_command� � z LockdownWhitelist.has_commandc C sB | j D ]}|�d�r|�|d d� �r dS q||kr dS qdS )N�*r8 TF)r+ �endswith� startswith)r r �_commandr r r � match_command� s ��z LockdownWhitelist.match_commandc C � | j S r1 rN rA r r r � get_commands� � z LockdownWhitelist.get_commandsc C sB t |�s ttjt|���|| jvr| j�|� d S ttjd| ��)Nz Uid "%s" already in whitelist)r r r r= �strr/ rD rE �r r& r r r r" � s �zLockdownWhitelist.add_uidc C rH )NzUid "%s" not in whitelist.)r/ rI r r rJ rZ r r r � remove_uid� rL z LockdownWhitelist.remove_uidc C rM r1 �r/ rZ r r r �has_uid� rP zLockdownWhitelist.has_uidc C rM r1 r\ rZ r r r � match_uid� rP zLockdownWhitelist.match_uidc C rV r1 r\ rA r r r �get_uids� rX zLockdownWhitelist.get_uidsc C rC )Nz User "%s" already in whitelist)r r r r< r. rD rE �r r r r r r# � rG zLockdownWhitelist.add_userc C rH )NzUser "%s" not in whitelist.)r. rI r r rJ r` r r r � remove_user� rL z LockdownWhitelist.remove_userc C rM r1 �r. r` r r r �has_user� rP zLockdownWhitelist.has_userc C rM r1 rb r` r r r � match_user� rP z LockdownWhitelist.match_userc C rV r1 rb rA r r r � get_users� rX zLockdownWhitelist.get_usersc C rC )Nz!Context "%s" already in whitelist)r r r r; r- rD rE �r r r r r r$ rG z LockdownWhitelist.add_contextc C rH )Nz Context "%s" not in whitelist.)r- rI r r rJ rf r r r �remove_context$ rL z LockdownWhitelist.remove_contextc C rM r1 �r- rf r r r � has_context+ rP z LockdownWhitelist.has_contextc C rM r1 rh rf r r r � match_context. rP z LockdownWhitelist.match_contextc C rV r1 rh rA r r r � get_contexts1 rX z LockdownWhitelist.get_contextsc C s� | � � | j�d�sttjd| j ��t| �}t�� }|� |� z |� | j� W ~~d S tj yB } z ttj d|� � ��d }~ww )Nz.xmlz'%s' is missing .xml suffixzNot a valid file: %s)rB r3 rR r r � INVALID_NAMEr �sax� make_parser�setContentHandler�parse�SAXParseException� INVALID_TYPE� getException)r �handlerr4 �msgr r r �read6 s( � �����zLockdownWhitelist.readc C s� t j�| j�r)z t�| jd| j � W n ty( } z td| j|f ��d }~ww t j�tj �s7t � tj d� t j | jddd�}t |�}|�� |�di � |�d� t| j�D ]}|�d � |�d d |i� |�d� qXt| j�D ]}|�d � |�d d t|�i� |�d� qrt| j�D ]}|�d � |�d d |i� |�d� q�t| j�D ]}|�d � |�dd|i� |�d� q�|�d� |�d� |�� |�� ~d S )Nz%s.oldzBackup of '%s' failed: %si� �wtzUTF-8)�mode�encodingr � z r r r r r r )�os�path�existsr3 �shutil�copy2� Exception�IOErrorr � ETC_FIREWALLD�mkdir�io�openr � startDocumentr �ignorableWhitespacer r+ � simpleElementr/ rY r. r- � endElement� endDocument�close)r ru �frt r r& r r r r r �writeG sF �� zLockdownWhitelist.write)#r' r( r) �__doc__�IMPORT_EXPORT_STRUCTURE�DBUS_SIGNATURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr r9 rB r rK rO rU rW r" r[ r] r^ r_ r# ra rc rd re r$ rg ri rj rk rv r� � __classcell__r r r5 r r* W sR ��� 1 r* )�xml.saxrm r{ r� r~ �firewallr �firewall.core.io.io_objectr r r �firewall.core.loggerr �firewall.functionsr r r r r r �firewall.errorsr r r* r r r r �<module> s 3PK ���Z��- - __pycache__/zone.cpython-310.pycnu �[��� o bhAbJ � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZ ddlmZmZ ddlmZmZmZ ddlmZmZmZmZ ddlm Z dd l m Z dd lm Z dd l m!Z! G d d � d e�Z"G dd� de�Z#ddd�Z$ddd�Z%dS ))�Zone� zone_reader� zone_writer� N)�config)� checkIPnMask� checkIP6nMask�checkInterface�uniqify�max_zone_name_len� check_mac)�DEFAULT_ZONE_TARGET� ZONE_TARGETS)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�common_startElement�common_endElement�common_check_config� common_writer)�rich)�log)�errors)� FirewallErrorc s� e Zd ZdZdddddddgfd d gfd dgfd d dgfddgfddgfddgfddgfdd gfddfZg d�Zi dd�dd�dd�dd g�d d d g�d d g�d d g�d!d�d"d d g�d#d g�d$d�d%d�d&d�d d'g�d(d d g�d)d�d*d�ddddd+gd'gdd,��Zg d-�d.gd/d0gd1d2gg d3�g d4�d5d6gg d7�d8gd'gd9� Zed:d;� �Z � fd<d=�Z d>d?� Z � fd@dA�Z � fdBdC�Z dDdE� Z� fdFdG�ZdHdI� Z� ZS )Jr z Zone class )�version� )�shortr )� descriptionr )�UNUSEDF)�targetr �servicesr �ports)r r � icmp_blocks)� masqueradeF� forward_ports)r r r r � interfaces�sources� rules_str� protocols� source_ports)�icmp_block_inversionF)�forwardT)�_�-�/r Nr �zone�service�name�port�protocolz icmp-blockz icmp-typer* � forward-port� interface�rule�source� destination�valuez source-portr �nflog�set)�audit�accept�reject�drop�mark�limit�icmp-block-inversion)r0 � immutabler r �enabledzto-portzto-addr�family�priority)�address�mac�invertrD �ipset)rF rH rI �prefix�level)�grouprJ z queue-size�type) r. r" r3 r5 r6 r7 r r9 r= z tcp-mss-clampc C s4 t tj�D ]\}\}}|| kr| S qttjd��)Nz index_of())� enumerater �IMPORT_EXPORT_STRUCTUREr r � UNKNOWN_ERROR)�element�i�el�dummy� rU �7/usr/lib/python3/dist-packages/firewall/core/io/zone.py�index_off s � z Zone.index_ofc s� t t| ��� d| _d| _d| _d| _t| _g | _ g | _ g | _ g | _ d| _ d| _g | _g | _g | _g | _g | _g | _d| _d| _d| _d S �Nr FT)�superr �__init__r r r r r r r r r' r! r* r" r# r( r$ r% �rulesr& r) �combined�applied��self�� __class__rU rV rZ m s* z Zone.__init__c C s� d| _ d| _d| _d| _t| _| jd d �= | jd d �= | jd d �= | j d d �= d| _ d| _ | j d d �= | j d d �= | jd d �= | jd d �= | jd d �= | jd d �= d| _d| _d| _d S rX )r r r r r r r r r' r! r* r" r# r( r$ r% r[ r& r) r\ r] r^ rU rU rV �cleanup� s( z Zone.cleanupc sP |dkr dd� |D �| _ tt| ��|dd� | j D �� d S tt| ��||� d S )Nr& c S s g | ]}t j|d ��qS ))�rule_str)r � Rich_Rule��.0�srU rU rV � <listcomp>� s z$Zone.__setattr__.<locals>.<listcomp>c S s g | ]}t |��qS rU )�strre rU rU rV rh � s )r[ rY r � __setattr__)r_ r0 r8 r` rU rV rj � s "zZone.__setattr__c s t t| ��� }|d= |S )Nr )rY r �export_config_dict)r_ �confr` rU rV rk � s zZone.export_config_dictc C sj t | ||||� | j|d v rttjd�| j���|dkr.|tvr,ttjd�| j|���d S |dkrj|D ]3}t|�sEttj d�| j|���|d D ] }|| jkrQqI||d | j v rfttj d�| j||���qIq4d S |d kr�|D ]B}t |�s�t |�s�t |�s�|�d �s�ttjd �| j|���|d D ] }|| jkr�q�||d | jv r�ttjd �| j||���q�qpd S d S ) N�policiesz0Zone '{}': Can't have the same name as a policy.r z Zone '{}': invalid target '{}'r$ z!Zone '{}': invalid interface '{}'�zonesz4Zone '{}': interface '{}' already bound to zone '{}'r% �ipset:z Zone '{}': invalid source '{}'z1Zone '{}': source '{}' already bound to zone '{}')r r0 r r � NAME_CONFLICT�formatr �INVALID_TARGETr �INVALID_INTERFACEr$ r r r � startswith� INVALID_ADDRr% )r_ r �item� all_config�all_io_objectsr4 r. r6 rU rU rV � _check_config� sd �� � ����� �� � �����zZone._check_configc s� t t| ��|� |�d�rttjd�|���|�d�r$ttjd�|���|� d�dkr4ttjd�|���d|v rB|d |� d�� }n|}t |�t � krYttjd�|t |�t � ���d S )Nr- z$Zone '{}': name can't start with '/'z"Zone '{}': name can't end with '/'� z%Zone '{}': name has more than one '/'z'Zone '{}': name has {} chars, max is {}) rY r � check_namert r r � INVALID_NAMErq �endswith�count�find�lenr )r_ r0 � checked_namer` rU rV r{ � s0 � �����zZone.check_namec C s� d| _ d | _d| _d| _d| _|jD ] }|| jvr | j�|� q|jD ] }|| jvr0| j�|� q#|jD ] }|| jvrA| j�|� q4|j D ] }|| j vrR| j �|� qE|j D ] }|| j vrc| j �|� qV|j D ] }|| j vrt| j �|� qg|j r{d| _ |j r�d| _ |jD ] }|| jvr�| j�|� q�|jD ] }|| jvr�| j�|� q�|jD ]} | j�| � | j�t| �� q�|jr�d| _d S d S )NTr )r\ �filenamer r r r$ �appendr% r r r' r! r* r" r# r( r[ r& ri r) ) r_ r. r4 r6 r/ r1 �proto�icmpr* r5 rU rU rV �combine� s^ � � � � � � � � �z Zone.combine)�__name__� __module__� __qualname__�__doc__rO �ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRS� staticmethodrW rZ rb rj rk ry r{ r� � __classcell__rU rU r` rV r ( s� ��������� � � � � ������� %r c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�zone_ContentHandlerc C s" t �| |� d | _d| _d | _d S )NF)r rZ �_rule� _rule_error� _limit_ok)r_ rv rU rU rV rZ s z zone_ContentHandler.__init__c C s� t �| ||� | jr d S | j�||� t| ||�rd S |dkrgd|v r+t�d|d � d|v r5|d | j_d|v rAt�d|d � d|v ra|d }|t vrSt t j |��|dkrc|t kre|| j_d S d S d S d S |d kr|| jjrvt�d � d S d | j_d S |d kr�| jr�t�d � d | _d S d|vr�t�d� d | _d S |d | jjvr�| jj�|d � d S t�d|d � d S |dk�r�| j�r| jjr�t�dt| j�� d | _d S d}d|v r�|d �� dv r�d }d } }}d|v r�|d }d|v r�|d }d|v �r|d }tj||||d�| j_d S d|v�r d|v�r t�d� d S d|v �r1d|v �r1t�d� d S d|v �r>t�d |d � d|v �rJt�d � d S d|v �rlt|d ��slt|d ��slt|d ��slt t j|d ��d|v �r�d |d }|| jj v�r�| jj �|� nt�d |d � d|v �r�|d }|| jj v�r�| jj �|� d S t�d |d � d S d S |d k�r�| jj �r�t�d!� d S d | j_ d S t�d"|� d S )#Nr. r0 z'Ignoring deprecated attribute name='%s'r rB z,Ignoring deprecated attribute immutable='%s'r r r* z Forward already set, ignoring.Tr4 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r6 z:Invalid rule: More than one source in rule '%s', ignoring.FrH )�yes�truerF rG rI )rH z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.rD z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.rA z+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s') r � startElementr� rv �parser_check_element_attrsr r �warningr r r r rr r r r* r� r$ r� r6 ri �lowerr � Rich_Sourcer r r ru r% r) ) r_ r0 �attrsr rH �addrrG rI �entryrU rU rV r� s� � � � � � � � � � � �� z zone_ContentHandler.startElementc C s t �| |� t| |� d S �N)r � endElementr )r_ r0 rU rU rV r� � s z zone_ContentHandler.endElementN)r� r� r� rZ r� r� rU rU rU rV r� s pr� Fc C s t � }| �d�sttjd| ��| d d� |_|s |�|j� | |_||_|� t j �r-dnd|_ |j |_ d|_t|�}t�� }|�|� d|| f }t|d��4}t�d �}|�|� z|�|� W n tjyx } z ttjd| �� ��d } ~ ww W d � ~~|S 1 s�w Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid zone file: %s)r r} r r r| r0 r{ r� �pathrt r � ETC_FIREWALLD�builtin�defaultr* r� �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException� INVALID_ZONE� getException) r� r� � no_check_namer. �handler�parserr0 �fr6 �msgrU rU rV r � sN � ����� � � r c C sF |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� i }| jr�| jd kr�| j|d < | jtkr�| j|d < |�d |� |�d � t| |� t| j�D ]} |�d� |�dd| i� |�d � q�t| j �D ]%} |�d� d| v r�|�dd| dd � i� n|�dd| i� |�d � q�| j r�|�d� |�di � |�d � | j �r|�d� |�di � |�d � |� d � |�d � |� � |�!� ~d S )Nr� z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr r r r. � z r4 r0 ro r6 rI � rF rA r* )"r� r� r0 �os�exists�shutil�copy2� Exceptionr �error�dirnamert r r� �mkdir�ior� r � startDocumentr r r r� �ignorableWhitespacer r r$ � simpleElementr% r) r* r� � endDocument�close) r. r� �_pathr0 r� �dirpathr� r� r� r4 r6 rU rU rV r � sd �� r )Fr� )&�__all__�xml.saxr� r� r� r� �firewallr �firewall.functionsr r r r r r �firewall.core.baser r �firewall.core.io.io_objectr r r �firewall.core.io.policyr r r r � firewall.corer �firewall.core.loggerr r �firewall.errorsr r r� r r rU rU rU rV �<module> s& f |!PK ���Z8�W�� � functions.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2018 Red Hat, Inc. # # Authors: # Eric Garver <egarver@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import os from firewall import config from firewall.errors import FirewallError from firewall.core.fw_config import FirewallConfig from firewall.core.io.zone import zone_reader from firewall.core.io.service import service_reader from firewall.core.io.ipset import ipset_reader from firewall.core.io.icmptype import icmptype_reader from firewall.core.io.helper import helper_reader from firewall.core.io.policy import policy_reader from firewall.core.io.direct import Direct from firewall.core.io.lockdown_whitelist import LockdownWhitelist from firewall.core.io.firewalld_conf import firewalld_conf def check_on_disk_config(fw): fw_config = FirewallConfig(fw) readers = { "ipset": {"reader": ipset_reader, "add": fw_config.add_ipset, "dirs": [config.FIREWALLD_IPSETS, config.ETC_FIREWALLD_IPSETS], }, "helper": {"reader": helper_reader, "add": fw_config.add_helper, "dirs": [config.FIREWALLD_HELPERS, config.ETC_FIREWALLD_HELPERS], }, "icmptype": {"reader": icmptype_reader, "add": fw_config.add_icmptype, "dirs": [config.FIREWALLD_ICMPTYPES, config.ETC_FIREWALLD_ICMPTYPES], }, "service": {"reader": service_reader, "add": fw_config.add_service, "dirs": [config.FIREWALLD_SERVICES, config.ETC_FIREWALLD_SERVICES], }, "zone": {"reader": zone_reader, "add": fw_config.add_zone, "dirs": [config.FIREWALLD_ZONES, config.ETC_FIREWALLD_ZONES], }, "policy": {"reader": policy_reader, "add": fw_config.add_policy_object, "dirs": [config.FIREWALLD_POLICIES, config.ETC_FIREWALLD_POLICIES], }, } for reader in readers.keys(): for _dir in readers[reader]["dirs"]: if not os.path.isdir(_dir): continue for file in sorted(os.listdir(_dir)): if file.endswith(".xml"): obj = readers[reader]["reader"](file, _dir) readers[reader]["add"](obj) fw_config.full_check_config() if os.path.isfile(config.FIREWALLD_DIRECT): try: obj = Direct(config.FIREWALLD_DIRECT) obj.read() obj.check_config(obj.export_config()) except FirewallError as error: raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_DIRECT, error.msg)) except Exception as msg: raise Exception("'%s': %s" % (config.FIREWALLD_DIRECT, msg)) if os.path.isfile(config.LOCKDOWN_WHITELIST): try: obj = LockdownWhitelist(config.LOCKDOWN_WHITELIST) obj.read() obj.check_config(obj.export_config()) except FirewallError as error: raise FirewallError(error.code, "'%s': %s" % (config.LOCKDOWN_WHITELIST, error.msg)) except Exception as msg: raise Exception("'%s': %s" % (config.LOCKDOWN_WHITELIST, msg)) if os.path.isfile(config.FIREWALLD_CONF): try: obj = firewalld_conf(config.FIREWALLD_CONF) obj.read() except FirewallError as error: raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_CONF, error.msg)) except Exception as msg: raise Exception("'%s': %s" % (config.FIREWALLD_CONF, msg)) PK ���Z�:2��5 �5 firewalld_conf.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import os.path import io import tempfile import shutil from firewall import config from firewall.core.logger import log valid_keys = [ "DefaultZone", "MinimalMark", "CleanupOnExit", "CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter", "IndividualCalls", "LogDenied", "AutomaticHelpers", "FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4", "AllowZoneDrifting" ] class firewalld_conf(object): def __init__(self, filename): self._config = { } self._deleted = [ ] self.filename = filename self.clear() def clear(self): self._config = { } self._deleted = [ ] def cleanup(self): self._config.clear() self._deleted = [ ] def get(self, key): return self._config.get(key.strip()) def set(self, key, value): _key = key.strip() self._config[_key] = value.strip() if _key in self._deleted: self._deleted.remove(_key) def __str__(self): s = "" for (key,value) in self._config.items(): if s: s += '\n' s += '%s=%s' % (key, value) return s # load self.filename def read(self): self.clear() try: f = open(self.filename, "r") except Exception as msg: log.error("Failed to load '%s': %s", self.filename, msg) self.set("DefaultZone", config.FALLBACK_ZONE) self.set("MinimalMark", str(config.FALLBACK_MINIMAL_MARK)) self.set("CleanupOnExit", "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no") self.set("CleanupModulesOnExit", "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no") self.set("Lockdown", "yes" if config.FALLBACK_LOCKDOWN else "no") self.set("IPv6_rpfilter","yes" if config.FALLBACK_IPV6_RPFILTER else "no") self.set("IndividualCalls", "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no") self.set("LogDenied", config.FALLBACK_LOG_DENIED) self.set("AutomaticHelpers", config.FALLBACK_AUTOMATIC_HELPERS) self.set("FirewallBackend", config.FALLBACK_FIREWALL_BACKEND) self.set("FlushAllOnReload", "yes" if config.FALLBACK_FLUSH_ALL_ON_RELOAD else "no") self.set("RFC3964_IPv4", "yes" if config.FALLBACK_RFC3964_IPV4 else "no") self.set("AllowZoneDrifting", "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no") raise for line in f: if not line: break line = line.strip() if len(line) < 1 or line[0] in ['#', ';']: continue # get key/value pair pair = [ x.strip() for x in line.split("=") ] if len(pair) != 2: log.error("Invalid option definition: '%s'", line.strip()) continue elif pair[0] not in valid_keys: log.error("Invalid option: '%s'", line.strip()) continue elif pair[1] == '': log.error("Missing value: '%s'", line.strip()) continue elif self._config.get(pair[0]) is not None: log.error("Duplicate option definition: '%s'", line.strip()) continue self._config[pair[0]] = pair[1] f.close() # check default zone if not self.get("DefaultZone"): log.error("DefaultZone is not set, using default value '%s'", config.FALLBACK_ZONE) self.set("DefaultZone", str(config.FALLBACK_ZONE)) # check minimal mark value = self.get("MinimalMark") try: int(value) except (ValueError, TypeError): if value is not None: log.warning("MinimalMark '%s' is not valid, using default " "value '%d'", value if value else '', config.FALLBACK_MINIMAL_MARK) self.set("MinimalMark", str(config.FALLBACK_MINIMAL_MARK)) # check cleanup on exit value = self.get("CleanupOnExit") if not value or value.lower() not in [ "no", "false", "yes", "true" ]: if value is not None: log.warning("CleanupOnExit '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_CLEANUP_ON_EXIT) self.set("CleanupOnExit", "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no") # check module cleanup on exit value = self.get("CleanupModulesOnExit") if not value or value.lower() not in [ "no", "false", "yes", "true" ]: if value is not None: log.warning("CleanupModulesOnExit '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_CLEANUP_MODULES_ON_EXIT) self.set("CleanupModulesOnExit", "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no") # check lockdown value = self.get("Lockdown") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("Lockdown '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_LOCKDOWN) self.set("Lockdown", "yes" if config.FALLBACK_LOCKDOWN else "no") # check ipv6_rpfilter value = self.get("IPv6_rpfilter") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("IPv6_rpfilter '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_IPV6_RPFILTER) self.set("IPv6_rpfilter","yes" if config.FALLBACK_IPV6_RPFILTER else "no") # check individual calls value = self.get("IndividualCalls") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("IndividualCalls '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_INDIVIDUAL_CALLS) self.set("IndividualCalls", "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no") # check log denied value = self.get("LogDenied") if not value or value not in config.LOG_DENIED_VALUES: if value is not None: log.warning("LogDenied '%s' is invalid, using default value '%s'", value, config.FALLBACK_LOG_DENIED) self.set("LogDenied", str(config.FALLBACK_LOG_DENIED)) # check automatic helpers value = self.get("AutomaticHelpers") if not value or value.lower() not in config.AUTOMATIC_HELPERS_VALUES: if value is not None: log.warning("AutomaticHelpers '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_AUTOMATIC_HELPERS) self.set("AutomaticHelpers", str(config.FALLBACK_AUTOMATIC_HELPERS)) value = self.get("FirewallBackend") if not value or value.lower() not in config.FIREWALL_BACKEND_VALUES: if value is not None: log.warning("FirewallBackend '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_FIREWALL_BACKEND) self.set("FirewallBackend", str(config.FALLBACK_FIREWALL_BACKEND)) value = self.get("FlushAllOnReload") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("FlushAllOnReload '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_FLUSH_ALL_ON_RELOAD) self.set("FlushAllOnReload", str(config.FALLBACK_FLUSH_ALL_ON_RELOAD)) value = self.get("RFC3964_IPv4") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("RFC3964_IPv4 '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_RFC3964_IPV4) self.set("RFC3964_IPv4", str(config.FALLBACK_RFC3964_IPV4)) value = self.get("AllowZoneDrifting") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("AllowZoneDrifting '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_ALLOW_ZONE_DRIFTING) self.set("AllowZoneDrifting", "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no") # save to self.filename if there are key/value changes def write(self): if len(self._config) < 1: # no changes: nothing to do return # handled keys done = [ ] if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) try: temp_file = tempfile.NamedTemporaryFile(mode='wt', prefix="%s." % os.path.basename(self.filename), dir=os.path.dirname(self.filename), delete=False) except Exception as msg: log.error("Failed to open temporary file: %s" % msg) raise modified = False empty = False try: f= io.open(self.filename, mode='rt', encoding='UTF-8') except Exception as msg: if os.path.exists(self.filename): log.error("Failed to open '%s': %s" % (self.filename, msg)) raise else: f = None else: for line in f: if not line: break # remove newline line = line.strip("\n") if len(line) < 1: if not empty: temp_file.write(u"\n") empty = True elif line[0] == '#': empty = False temp_file.write(line) temp_file.write(u"\n") else: p = line.split("=") if len(p) != 2: empty = False temp_file.write(line+u"\n") continue key = p[0].strip() value = p[1].strip() # check for modified key/value pairs if key not in done: if (key in self._config and \ self._config[key] != value): empty = False temp_file.write(u'%s=%s\n' % (key, self._config[key])) modified = True elif key in self._deleted: modified = True else: empty = False temp_file.write(line+u"\n") done.append(key) else: modified = True # write remaining key/value pairs if len(self._config) > 0: for (key,value) in self._config.items(): if key in done: continue if key in ["MinimalMark", "AutomaticHelpers", "AllowZoneDrifting"]: # omit deprecated from new config continue if not empty: temp_file.write(u"\n") empty = True temp_file.write(u'%s=%s\n' % (key, value)) modified = True if f: f.close() temp_file.close() if not modified: # not modified: remove tempfile os.remove(temp_file.name) return # make backup if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.old" % self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) # copy tempfile try: shutil.move(temp_file.name, self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Failed to create '%s': %s" % (self.filename, msg)) else: os.chmod(self.filename, 0o600) PK ���Z��p�J J zone.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Zone", "zone_reader", "zone_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.functions import checkIPnMask, checkIP6nMask, checkInterface, uniqify, max_zone_name_len, check_mac from firewall.core.base import DEFAULT_ZONE_TARGET, ZONE_TARGETS from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.io.policy import common_startElement, common_endElement, common_check_config, common_writer from firewall.core import rich from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class Zone(IO_Object): """ Zone class """ IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "UNUSED", False ), # b ( "target", "" ), # s ( "services", [ "", ], ), # as ( "ports", [ ( "", "" ), ], ), # a(ss) ( "icmp_blocks", [ "", ], ), # as ( "masquerade", False ), # b ( "forward_ports", [ ( "", "", "", "" ), ], ), # a(ssss) ( "interfaces", [ "" ] ), # as ( "sources", [ "" ] ), # as ( "rules_str", [ "" ] ), # as ( "protocols", [ "", ], ), # as ( "source_ports", [ ( "", "" ), ], ), # a(ss) ( "icmp_block_inversion", False ), # b ( "forward", True ), # b ) ADDITIONAL_ALNUM_CHARS = [ "_", "-", "/" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "zone": None, "service": [ "name" ], "port": [ "port", "protocol" ], "icmp-block": [ "name" ], "icmp-type": [ "name" ], "forward": None, "forward-port": [ "port", "protocol" ], "interface": [ "name" ], "rule": None, "source": None, "destination": None, "protocol": [ "value" ], "source-port": [ "port", "protocol" ], "log": None, "nflog": None, "audit": None, "accept": None, "reject": None, "drop": None, "mark": [ "set" ], "limit": [ "value" ], "icmp-block-inversion": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "zone": [ "name", "immutable", "target", "version" ], "masquerade": [ "enabled" ], "forward-port": [ "to-port", "to-addr" ], "rule": [ "family", "priority" ], "source": [ "address", "mac", "invert", "family", "ipset" ], "destination": [ "address", "invert", "ipset" ], "log": [ "prefix", "level" ], "nflog": [ "group", "prefix", "queue-size" ], "reject": [ "type" ], "tcp-mss-clamp": [ "value" ], } @staticmethod def index_of(element): for i, (el, dummy) in enumerate(Zone.IMPORT_EXPORT_STRUCTURE): if el == element: return i raise FirewallError(errors.UNKNOWN_ERROR, "index_of()") def __init__(self): super(Zone, self).__init__() self.version = "" self.short = "" self.description = "" self.UNUSED = False self.target = DEFAULT_ZONE_TARGET self.services = [ ] self.ports = [ ] self.protocols = [ ] self.icmp_blocks = [ ] self.forward = True self.masquerade = False self.forward_ports = [ ] self.source_ports = [ ] self.interfaces = [ ] self.sources = [ ] self.rules = [ ] self.rules_str = [ ] self.icmp_block_inversion = False self.combined = False self.applied = False def cleanup(self): self.version = "" self.short = "" self.description = "" self.UNUSED = False self.target = DEFAULT_ZONE_TARGET del self.services[:] del self.ports[:] del self.protocols[:] del self.icmp_blocks[:] self.forward = True self.masquerade = False del self.forward_ports[:] del self.source_ports[:] del self.interfaces[:] del self.sources[:] del self.rules[:] del self.rules_str[:] self.icmp_block_inversion = False self.combined = False self.applied = False def __setattr__(self, name, value): if name == "rules_str": self.rules = [rich.Rich_Rule(rule_str=s) for s in value] # must convert back to string to get the canonical string. super(Zone, self).__setattr__(name, [str(s) for s in self.rules]) else: super(Zone, self).__setattr__(name, value) def export_config_dict(self): conf = super(Zone, self).export_config_dict() del conf["UNUSED"] return conf def _check_config(self, config, item, all_config, all_io_objects): common_check_config(self, config, item, all_config, all_io_objects) if self.name in all_io_objects["policies"]: raise FirewallError(errors.NAME_CONFLICT, "Zone '{}': Can't have the same name as a policy.".format(self.name)) if item == "target": if config not in ZONE_TARGETS: raise FirewallError(errors.INVALID_TARGET, "Zone '{}': invalid target '{}'".format( self.name, config)) elif item == "interfaces": for interface in config: if not checkInterface(interface): raise FirewallError(errors.INVALID_INTERFACE, "Zone '{}': invalid interface '{}'".format( self.name, interface)) for zone in all_io_objects["zones"]: if zone == self.name: continue if interface in all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_INTERFACE, "Zone '{}': interface '{}' already bound to zone '{}'".format( self.name, interface, zone)) elif item == "sources": for source in config: if not checkIPnMask(source) and not checkIP6nMask(source) and \ not check_mac(source) and not source.startswith("ipset:"): raise FirewallError(errors.INVALID_ADDR, "Zone '{}': invalid source '{}'".format( self.name, source)) for zone in all_io_objects["zones"]: if zone == self.name: continue if source in all_io_objects["zones"][zone].sources: raise FirewallError(errors.INVALID_ADDR, "Zone '{}': source '{}' already bound to zone '{}'".format( self.name, source, zone)) def check_name(self, name): super(Zone, self).check_name(name) if name.startswith('/'): raise FirewallError(errors.INVALID_NAME, "Zone '{}': name can't start with '/'".format(name)) elif name.endswith('/'): raise FirewallError(errors.INVALID_NAME, "Zone '{}': name can't end with '/'".format(name)) elif name.count('/') > 1: raise FirewallError(errors.INVALID_NAME, "Zone '{}': name has more than one '/'".format(name)) else: if "/" in name: checked_name = name[:name.find('/')] else: checked_name = name if len(checked_name) > max_zone_name_len(): raise FirewallError(errors.INVALID_NAME, "Zone '{}': name has {} chars, max is {}".format( name, len(checked_name), max_zone_name_len())) def combine(self, zone): self.combined = True self.filename = None self.version = "" self.short = "" self.description = "" for interface in zone.interfaces: if interface not in self.interfaces: self.interfaces.append(interface) for source in zone.sources: if source not in self.sources: self.sources.append(source) for service in zone.services: if service not in self.services: self.services.append(service) for port in zone.ports: if port not in self.ports: self.ports.append(port) for proto in zone.protocols: if proto not in self.protocols: self.protocols.append(proto) for icmp in zone.icmp_blocks: if icmp not in self.icmp_blocks: self.icmp_blocks.append(icmp) if zone.forward: self.forward = True if zone.masquerade: self.masquerade = True for forward in zone.forward_ports: if forward not in self.forward_ports: self.forward_ports.append(forward) for port in zone.source_ports: if port not in self.source_ports: self.source_ports.append(port) for rule in zone.rules: self.rules.append(rule) self.rules_str.append(str(rule)) if zone.icmp_block_inversion: self.icmp_block_inversion = True # PARSER class zone_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self._rule = None self._rule_error = False self._limit_ok = None def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) if self._rule_error: return self.item.parser_check_element_attrs(name, attrs) if common_startElement(self, name, attrs): return elif name == "zone": if "name" in attrs: log.warning("Ignoring deprecated attribute name='%s'", attrs["name"]) if "version" in attrs: self.item.version = attrs["version"] if "immutable" in attrs: log.warning("Ignoring deprecated attribute immutable='%s'", attrs["immutable"]) if "target" in attrs: target = attrs["target"] if target not in ZONE_TARGETS: raise FirewallError(errors.INVALID_TARGET, target) if target != "" and target != DEFAULT_ZONE_TARGET: self.item.target = target elif name == "forward": if self.item.forward: log.warning("Forward already set, ignoring.") else: self.item.forward = True elif name == "interface": if self._rule: log.warning('Invalid rule: interface use in rule.') self._rule_error = True return # zone bound to interface if "name" not in attrs: log.warning('Invalid interface: Name missing.') self._rule_error = True return if attrs["name"] not in self.item.interfaces: self.item.interfaces.append(attrs["name"]) else: log.warning("Interface '%s' already set, ignoring.", attrs["name"]) elif name == "source": if self._rule: if self._rule.source: log.warning("Invalid rule: More than one source in rule '%s', ignoring.", str(self._rule)) self._rule_error = True return invert = False if "invert" in attrs and \ attrs["invert"].lower() in [ "yes", "true" ]: invert = True addr = mac = ipset = None if "address" in attrs: addr = attrs["address"] if "mac" in attrs: mac = attrs["mac"] if "ipset" in attrs: ipset = attrs["ipset"] self._rule.source = rich.Rich_Source(addr, mac, ipset, invert=invert) return # zone bound to source if "address" not in attrs and "ipset" not in attrs: log.warning('Invalid source: No address no ipset.') return if "address" in attrs and "ipset" in attrs: log.warning('Invalid source: Address and ipset.') return if "family" in attrs: log.warning("Ignoring deprecated attribute family='%s'", attrs["family"]) if "invert" in attrs: log.warning('Invalid source: Invertion not allowed here.') return if "address" in attrs: if not checkIPnMask(attrs["address"]) and \ not checkIP6nMask(attrs["address"]) and \ not check_mac(attrs["address"]): raise FirewallError(errors.INVALID_ADDR, attrs["address"]) if "ipset" in attrs: entry = "ipset:%s" % attrs["ipset"] if entry not in self.item.sources: self.item.sources.append(entry) else: log.warning("Source '%s' already set, ignoring.", attrs["address"]) if "address" in attrs: entry = attrs["address"] if entry not in self.item.sources: self.item.sources.append(entry) else: log.warning("Source '%s' already set, ignoring.", attrs["address"]) elif name == "icmp-block-inversion": if self.item.icmp_block_inversion: log.warning("Icmp-Block-Inversion already set, ignoring.") else: self.item.icmp_block_inversion = True else: log.warning("Unknown XML element '%s'", name) return def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) common_endElement(self, name) def zone_reader(filename, path, no_check_name=False): zone = Zone() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) zone.name = filename[:-4] if not no_check_name: zone.check_name(zone.name) zone.filename = filename zone.path = path zone.builtin = False if path.startswith(config.ETC_FIREWALLD) else True zone.default = zone.builtin # new Zone() objects default this to True, but if reading on disk # configuration we have to assume False, because the absence of # <forward> element indicates False. Presence indicates True. zone.forward = False handler = zone_ContentHandler(zone) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_ZONE, "not a valid zone file: %s" % \ msg.getException()) del handler del parser return zone def zone_writer(zone, path=None): _path = path if path else zone.path if zone.filename: name = "%s/%s" % (_path, zone.filename) else: name = "%s/%s.xml" % (_path, zone.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start zone element attrs = {} if zone.version and zone.version != "": attrs["version"] = zone.version if zone.target != DEFAULT_ZONE_TARGET: attrs["target"] = zone.target handler.startElement("zone", attrs) handler.ignorableWhitespace("\n") common_writer(zone, handler) # interfaces for interface in uniqify(zone.interfaces): handler.ignorableWhitespace(" ") handler.simpleElement("interface", { "name": interface }) handler.ignorableWhitespace("\n") # source for source in uniqify(zone.sources): handler.ignorableWhitespace(" ") if "ipset:" in source: handler.simpleElement("source", { "ipset": source[6:] }) else: handler.simpleElement("source", { "address": source }) handler.ignorableWhitespace("\n") # icmp-block-inversion if zone.icmp_block_inversion: handler.ignorableWhitespace(" ") handler.simpleElement("icmp-block-inversion", { }) handler.ignorableWhitespace("\n") # forward if zone.forward: handler.ignorableWhitespace(" ") handler.simpleElement("forward", { }) handler.ignorableWhitespace("\n") # end zone element handler.endElement("zone") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z,E?|�< �< direct.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import xml.sax as sax import os import io import shutil from firewall import config from firewall.fw_types import LastUpdatedOrderedDict from firewall.functions import splitArgs, joinArgs from firewall.core.io.io_object import IO_Object, IO_Object_ContentHandler, \ IO_Object_XMLGenerator from firewall.core.logger import log from firewall.core import ipXtables from firewall.core import ebtables from firewall import errors from firewall.errors import FirewallError class direct_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self.direct = False def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "direct": if self.direct: raise FirewallError(errors.PARSE_ERROR, "More than one direct tag.") self.direct = True elif name == "chain": if not self.direct: log.error("Parse Error: chain outside of direct") return ipv = attrs["ipv"] table = attrs["table"] chain = attrs["chain"] self.item.add_chain(ipv, table, chain) elif name == "rule": if not self.direct: log.error("Parse Error: rule outside of direct") return ipv = attrs["ipv"] if ipv not in [ "ipv4", "ipv6", "eb" ]: raise FirewallError(errors.INVALID_IPV, "'%s' not from {'ipv4'|'ipv6'|'eb'}" % ipv) table = attrs["table"] chain = attrs["chain"] try: priority = int(attrs["priority"]) except ValueError: log.error("Parse Error: %s is not a valid priority" % attrs["priority"]) return self._rule = [ ipv, table, chain, priority ] elif name == "passthrough": if not self.direct: log.error("Parse Error: command outside of direct") return ipv = attrs["ipv"] self._passthrough = [ ipv ] else: log.error('Unknown XML element %s' % name) return def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) if name == "rule": if self._element: # add arguments self._rule.append(splitArgs(self._element)) self.item.add_rule(*self._rule) else: log.error("Error: rule does not have any arguments, ignoring.") self._rule = None elif name == "passthrough": if self._element: # add arguments self._passthrough.append(splitArgs(self._element)) self.item.add_passthrough(*self._passthrough) else: log.error("Error: passthrough does not have any arguments, " + "ignoring.") self._passthrough = None class Direct(IO_Object): """ Direct class """ IMPORT_EXPORT_STRUCTURE = ( # chain: [ ipv, table, [ chain ] ] ( "chains", [ ( "", "", "" ), ], ), # a(sss) # rule: [ ipv, table, chain, [ priority, [ arg ] ] ] ( "rules", [ ( "", "", "", 0, [ "" ] ), ], ), # a(sssias) # passthrough: [ ipv, [ [ arg ] ] ] ( "passthroughs", [ ( "", [ "" ]), ], ), # a(sas) ) DBUS_SIGNATURE = '(a(sss)a(sssias)a(sas))' PARSER_REQUIRED_ELEMENT_ATTRS = { "direct": None, "chain": [ "ipv", "table", "chain" ], "rule": [ "ipv", "table", "chain", "priority" ], "passthrough": [ "ipv" ] } PARSER_OPTIONAL_ELEMENT_ATTRS = { } def __init__(self, filename): super(Direct, self).__init__() self.filename = filename self.chains = LastUpdatedOrderedDict() self.rules = LastUpdatedOrderedDict() self.passthroughs = LastUpdatedOrderedDict() def _check_config(self, conf, item, all_conf, all_io_objects): pass # check arg lists def export_config(self): ret = [ ] x = [ ] for key in self.chains: for chain in self.chains[key]: x.append(tuple(list(key) + list([chain]))) ret.append(x) x = [ ] for key in self.rules: for rule in self.rules[key]: x.append(tuple((key[0], key[1], key[2], rule[0], list(rule[1])))) ret.append(x) x = [ ] for key in self.passthroughs: for rule in self.passthroughs[key]: x.append(tuple((key, list(rule)))) ret.append(x) return tuple(ret) def import_config(self, conf, all_io_objects): self.cleanup() self.check_config(conf) for i,(element,dummy) in enumerate(self.IMPORT_EXPORT_STRUCTURE): if element == "chains": for x in conf[i]: self.add_chain(*x) if element == "rules": for x in conf[i]: self.add_rule(*x) if element == "passthroughs": for x in conf[i]: self.add_passthrough(*x) def cleanup(self): self.chains.clear() self.rules.clear() self.passthroughs.clear() def output(self): print("chains") for key in self.chains: print(" (%s, %s): %s" % (key[0], key[1], ",".join(self.chains[key]))) print("rules") for key in self.rules: print(" (%s, %s, %s):" % (key[0], key[1], key[2])) for (priority,args) in self.rules[key]: print(" (%d, ('%s'))" % (priority, "','".join(args))) print("passthroughs") for key in self.passthroughs: print(" %s:" % (key)) for args in self.passthroughs[key]: print(" ('%s')" % ("','".join(args))) def _check_ipv(self, ipv): ipvs = ['ipv4', 'ipv6', 'eb'] if ipv not in ipvs: raise FirewallError(errors.INVALID_IPV, "'%s' not in '%s'" % (ipv, ipvs)) def _check_ipv_table(self, ipv, table): self._check_ipv(ipv) tables = ipXtables.BUILT_IN_CHAINS.keys() if ipv in ['ipv4', 'ipv6'] \ else ebtables.BUILT_IN_CHAINS.keys() if table not in tables: raise FirewallError(errors.INVALID_TABLE, "'%s' not in '%s'" % (table, tables)) # chains def add_chain(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table) if key not in self.chains: self.chains[key] = [ ] if chain not in self.chains[key]: self.chains[key].append(chain) else: log.warning("Chain '%s' for table '%s' with ipv '%s' " % \ (chain, table, ipv) + "already in list, ignoring") def remove_chain(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table) if key in self.chains and chain in self.chains[key]: self.chains[key].remove(chain) if len(self.chains[key]) == 0: del self.chains[key] else: raise ValueError( \ "Chain '%s' with table '%s' with ipv '%s' not in list" % \ (chain, table, ipv)) def query_chain(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table) return (key in self.chains and chain in self.chains[key]) def get_chains(self, ipv, table): self._check_ipv_table(ipv, table) key = (ipv, table) if key in self.chains: return self.chains[key] else: raise ValueError("No chains for table '%s' with ipv '%s'" % \ (table, ipv)) def get_all_chains(self): return self.chains # rules def add_rule(self, ipv, table, chain, priority, args): self._check_ipv_table(ipv, table) key = (ipv, table, chain) if key not in self.rules: self.rules[key] = LastUpdatedOrderedDict() value = (priority, tuple(args)) if value not in self.rules[key]: self.rules[key][value] = priority else: log.warning("Rule '%s' for table '%s' and chain '%s' " % \ ("',".join(args), table, chain) + "with ipv '%s' and priority %d " % (ipv, priority) + "already in list, ignoring") def remove_rule(self, ipv, table, chain, priority, args): self._check_ipv_table(ipv, table) key = (ipv, table, chain) value = (priority, tuple(args)) if key in self.rules and value in self.rules[key]: del self.rules[key][value] if len(self.rules[key]) == 0: del self.rules[key] else: raise ValueError("Rule '%s' for table '%s' and chain '%s' " % \ ("',".join(args), table, chain) + \ "with ipv '%s' and priority %d not in list" % (ipv, priority)) def remove_rules(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table, chain) if key in self.rules: for value in self.rules[key].keys(): del self.rules[key][value] if len(self.rules[key]) == 0: del self.rules[key] def query_rule(self, ipv, table, chain, priority, args): self._check_ipv_table(ipv, table) key = (ipv, table, chain) value = (priority, tuple(args)) return (key in self.rules and value in self.rules[key]) def get_rules(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table, chain) if key in self.rules: return self.rules[key] else: raise ValueError("No rules for table '%s' and chain '%s' " %\ (table, chain) + "with ipv '%s'" % (ipv)) def get_all_rules(self): return self.rules # # passthrough # def add_passthrough(self, ipv, args): self._check_ipv(ipv) if ipv not in self.passthroughs: self.passthroughs[ipv] = [ ] if args not in self.passthroughs[ipv]: self.passthroughs[ipv].append(args) else: log.warning("Passthrough '%s' for ipv '%s'" % \ ("',".join(args), ipv) + "already in list, ignoring") def remove_passthrough(self, ipv, args): self._check_ipv(ipv) if ipv in self.passthroughs and args in self.passthroughs[ipv]: self.passthroughs[ipv].remove(args) if len(self.passthroughs[ipv]) == 0: del self.passthroughs[ipv] else: raise ValueError("Passthrough '%s' for ipv '%s'" % \ ("',".join(args), ipv) + "not in list") def query_passthrough(self, ipv, args): self._check_ipv(ipv) return ipv in self.passthroughs and args in self.passthroughs[ipv] def get_passthroughs(self, ipv): self._check_ipv(ipv) if ipv in self.passthroughs: return self.passthroughs[ipv] else: raise ValueError("No passthroughs for ipv '%s'" % (ipv)) def get_all_passthroughs(self): return self.passthroughs # read def read(self): self.cleanup() if not self.filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % self.filename) handler = direct_ContentHandler(self) parser = sax.make_parser() parser.setContentHandler(handler) with open(self.filename, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_TYPE, "Not a valid file: %s" % \ msg.getException()) def write(self): if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.old" % self.filename) except Exception as msg: raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) f = io.open(self.filename, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start whitelist element handler.startElement("direct", { }) handler.ignorableWhitespace("\n") # chains for key in self.chains: (ipv, table) = key for chain in self.chains[key]: handler.ignorableWhitespace(" ") handler.simpleElement("chain", { "ipv": ipv, "table": table, "chain": chain }) handler.ignorableWhitespace("\n") # rules for key in self.rules: (ipv, table, chain) = key for (priority, args) in self.rules[key]: if len(args) < 1: continue handler.ignorableWhitespace(" ") handler.startElement("rule", { "ipv": ipv, "table": table, "chain": chain, "priority": "%d" % priority }) handler.ignorableWhitespace(sax.saxutils.escape(joinArgs(args))) handler.endElement("rule") handler.ignorableWhitespace("\n") # passthroughs for ipv in self.passthroughs: for args in self.passthroughs[ipv]: if len(args) < 1: continue handler.ignorableWhitespace(" ") handler.startElement("passthrough", { "ipv": ipv }) handler.ignorableWhitespace(sax.saxutils.escape(joinArgs(args))) handler.endElement("passthrough") handler.ignorableWhitespace("\n") # end zone element handler.endElement("direct") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z <�᭾ �� policy.pynu �[��� # -*- coding: utf-8 -*- # # SPDX-License-Identifier: GPL-2.0-or-later __all__ = [ "Policy", "policy_reader", "policy_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.functions import ( checkIP, checkIP6, checkUINT16, coalescePortRange, max_policy_name_len, portInPortRange, portStr, uniqify, ) from firewall.core.base import DEFAULT_POLICY_TARGET, POLICY_TARGETS, DEFAULT_POLICY_PRIORITY from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \ check_tcpudp, check_protocol from firewall.core import rich from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError def common_startElement(obj, name, attrs): if name == "short": pass elif name == "description": pass elif name == "service": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Service(attrs["name"]) return True if attrs["name"] not in obj.item.services: obj.item.services.append(attrs["name"]) else: log.warning("Service '%s' already set, ignoring.", attrs["name"]) elif name == "port": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Port(attrs["port"], attrs["protocol"]) return True check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) # coalesce and warn about overlapping ranges new_port_id = (portStr(attrs["port"], "-"), attrs["protocol"]) existing_port_ids = list(filter(lambda x: x[1] == attrs["protocol"], obj.item.ports)) for port_id in existing_port_ids: if portInPortRange(new_port_id[0], port_id[0]): # the range is wholly contained already, so just warn _name = obj.item.derived_from_zone if isinstance(obj.item, Policy) else obj.item.name log.warning(FirewallError(errors.ALREADY_ENABLED, "'%s:%s' already in '%s'" % (new_port_id[0], attrs["protocol"], _name))) break # for else: # the range can be coalesced into the existing set added_ranges, removed_ranges = coalescePortRange(new_port_id[0], [_port for (_port, _protocol) in existing_port_ids]) for _range in removed_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.ports.remove(entry) for _range in added_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.ports.append(entry) elif name == "protocol": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Protocol(attrs["value"]) else: check_protocol(attrs["value"]) if attrs["value"] not in obj.item.protocols: obj.item.protocols.append(attrs["value"]) else: log.warning("Protocol '%s' already set, ignoring.", attrs["value"]) elif name == "tcp-mss-clamp": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True _value="pmtu" if "value" in attrs: _value = attrs["value"] obj._rule.element = rich.Rich_Tcp_Mss_Clamp(_value) else: log.warning("Invalid rule: tcp-mss-clamp '%s' outside of rule", attrs["value"]) elif name == "icmp-block": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_IcmpBlock(attrs["name"]) return True if attrs["name"] not in obj.item.icmp_blocks: obj.item.icmp_blocks.append(attrs["name"]) else: log.warning("icmp-block '%s' already set, ignoring.", attrs["name"]) elif name == "icmp-type": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_IcmpType(attrs["name"]) return True else: log.warning("Invalid rule: icmp-block '%s' outside of rule", attrs["name"]) elif name == "masquerade": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Masquerade() else: if obj.item.masquerade: log.warning("Masquerade already set, ignoring.") else: obj.item.masquerade = True elif name == "forward-port": to_port = "" if "to-port" in attrs: to_port = attrs["to-port"] to_addr = "" if "to-addr" in attrs: to_addr = attrs["to-addr"] if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_ForwardPort(attrs["port"], attrs["protocol"], to_port, to_addr) return True check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) if to_port: check_port(to_port) if to_addr: if not checkIP(to_addr) and not checkIP6(to_addr): raise FirewallError(errors.INVALID_ADDR, "to-addr '%s' is not a valid address" \ % to_addr) entry = (portStr(attrs["port"], "-"), attrs["protocol"], portStr(to_port, "-"), str(to_addr)) if entry not in obj.item.forward_ports: obj.item.forward_ports.append(entry) else: log.warning("Forward port %s/%s%s%s already set, ignoring.", attrs["port"], attrs["protocol"], " >%s" % to_port if to_port else "", " @%s" % to_addr if to_addr else "") elif name == "source-port": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_SourcePort(attrs["port"], attrs["protocol"]) return True check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) # coalesce and warn about overlapping ranges new_port_id = (portStr(attrs["port"], "-"), attrs["protocol"]) existing_port_ids = list(filter(lambda x: x[1] == attrs["protocol"], obj.item.source_ports)) for port_id in existing_port_ids: if portInPortRange(new_port_id[0], port_id[0]): # the range is wholly contained already, so just warn _name = obj.item.derived_from_zone if isinstance(obj.item, Policy) else obj.item.name log.warning(FirewallError(errors.ALREADY_ENABLED, "'%s:%s' already in '%s'" % (new_port_id[0], attrs["protocol"], _name))) break # for else: # the range can be coalesced into the existing set added_ranges, removed_ranges = coalescePortRange(new_port_id[0], [_port for (_port, _protocol) in existing_port_ids]) for _range in removed_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.source_ports.remove(entry) for _range in added_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.source_ports.append(entry) elif name == "destination": if not obj._rule: log.warning('Invalid rule: Destination outside of rule') obj._rule_error = True return True if obj._rule.destination: log.warning("Invalid rule: More than one destination in rule '%s', ignoring.", str(obj._rule)) return True invert = False address = None if "address" in attrs: address = attrs["address"] ipset = None if "ipset" in attrs: ipset = attrs["ipset"] if "invert" in attrs and \ attrs["invert"].lower() in [ "yes", "true" ]: invert = True obj._rule.destination = rich.Rich_Destination(address, ipset, invert) elif name in [ "accept", "reject", "drop", "mark" ]: if not obj._rule: log.warning('Invalid rule: Action outside of rule') obj._rule_error = True return True if obj._rule.action: log.warning('Invalid rule: More than one action') obj._rule_error = True return True if name == "accept": obj._rule.action = rich.Rich_Accept() elif name == "reject": _type = None if "type" in attrs: _type = attrs["type"] obj._rule.action = rich.Rich_Reject(_type) elif name == "drop": obj._rule.action = rich.Rich_Drop() elif name == "mark": _set = attrs["set"] obj._rule.action = rich.Rich_Mark(_set) obj._limit_ok = obj._rule.action elif name == "log": if not obj._rule: log.warning('Invalid rule: Log outside of rule') return True if obj._rule.log: log.warning('Invalid rule: More than one log') return True level = None if "level" in attrs: level = attrs["level"] if level not in [ "emerg", "alert", "crit", "error", "warning", "notice", "info", "debug" ]: log.warning('Invalid rule: Invalid log level') obj._rule_error = True return True prefix = None if "prefix" in attrs: prefix = attrs["prefix"] if not prefix or len(prefix) > 127: log.warning('Invalid rule: Invalid log prefix') obj._rule_error = True return True obj._rule.log = rich.Rich_Log(prefix, level) obj._limit_ok = obj._rule.log elif name == "nflog": if not obj._rule: log.warning('Invalid rule: Log outside of rule') return True if obj._rule.log: log.warning('Invalid rule: More than one log') return True group = None if "group" in attrs: group = attrs["group"] if not checkUINT16(group): log.warning('Invalid rule: Invalid nflog group value') obj._rule_error = True return True prefix = None if "prefix" in attrs: prefix = attrs["prefix"] if not prefix or len(prefix) > 127: log.warning('Invalid rule: Invalid nflog prefix') obj._rule_error = True return True threshold = None if "queue-size" in attrs: threshold = attrs["queue-size"] if not checkUINT16(threshold): log.warning('Invalid rule: Invalid nflog queue-size') obj._rule_error = True return True obj._rule.log = rich.Rich_NFLog(group, prefix, threshold) obj._limit_ok = obj._rule.log elif name == "audit": if not obj._rule: log.warning('Invalid rule: Audit outside of rule') return True if obj._rule.audit: log.warning("Invalid rule: More than one audit in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.audit = rich.Rich_Audit() obj._limit_ok = obj._rule.audit elif name == "rule": family = None priority = 0 if "family" in attrs: family = attrs["family"] if family not in [ "ipv4", "ipv6" ]: log.warning('Invalid rule: Rule family "%s" invalid', attrs["family"]) obj._rule_error = True return True if "priority" in attrs: priority = int(attrs["priority"]) obj._rule = rich.Rich_Rule(family=family, priority=priority) elif name == "limit": if not obj._limit_ok: log.warning('Invalid rule: Limit outside of action, log and audit') obj._rule_error = True return True if obj._limit_ok.limit: log.warning("Invalid rule: More than one limit in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True value = attrs["value"] obj._limit_ok.limit = rich.Rich_Limit(value) else: return False return True def common_endElement(obj, name): if name == "rule": if not obj._rule_error: try: obj._rule.check() except Exception as e: log.warning("%s: %s", e, str(obj._rule)) else: if str(obj._rule) not in obj.item.rules_str: obj.item.rules.append(obj._rule) obj.item.rules_str.append(str(obj._rule)) else: log.warning("Rule '%s' already set, ignoring.", str(obj._rule)) obj._rule = None obj._rule_error = False elif name in [ "accept", "reject", "drop", "mark", "log", "audit" ]: obj._limit_ok = None def common_check_config(obj, config, item, all_config, all_io_objects): obj_type = "Policy" if isinstance(obj, Policy) else "Zone" if item == "services" and "services" in all_io_objects: existing_services = all_io_objects["services"] for service in config: if service not in existing_services: raise FirewallError(errors.INVALID_SERVICE, "{} '{}': '{}' not among existing services".format( obj_type, obj.name, service)) elif item == "ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item == "protocols": for proto in config: check_protocol(proto) elif item == "icmp_blocks" and "icmptypes" in all_io_objects: existing_icmptypes = all_io_objects["icmptypes"] for icmptype in config: if icmptype not in existing_icmptypes: ex = FirewallError(errors.INVALID_ICMPTYPE, "{} '{}': '{}' not among existing ICMP types".format( obj_type, obj.name, icmptype)) if icmptype in all_io_objects.get("icmptypes_unsupported", {}): log.debug1("{} (unsupported)".format(ex)) else: raise ex elif item == "forward_ports": for fwd_port in config: check_port(fwd_port[0]) check_tcpudp(fwd_port[1]) if not fwd_port[2] and not fwd_port[3]: raise FirewallError(errors.INVALID_FORWARD, "{} '{}': '{}' is missing to-port AND to-addr ".format( obj_type, obj.name, fwd_port)) if fwd_port[2]: check_port(fwd_port[2]) if fwd_port[3]: if not checkIP(fwd_port[3]) and not checkIP6(fwd_port[3]): raise FirewallError(errors.INVALID_ADDR, "{} '{}': to-addr '{}' is not a valid address".format( obj_type, obj.name, fwd_port[3])) elif item == "source_ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item in ["rules_str", "rich_rules"]: for rule in config: obj_rich = rich.Rich_Rule(rule_str=rule) if obj_rich.element and "icmptypes" in all_io_objects and \ (isinstance(obj_rich.element, rich.Rich_IcmpBlock) or isinstance(obj_rich.element, rich.Rich_IcmpType)): existing_icmptypes = all_io_objects["icmptypes"] if obj_rich.element.name not in existing_icmptypes: ex = FirewallError(errors.INVALID_ICMPTYPE, "{} '{}': '{}' not among existing ICMP types".format( obj_type, obj.name, obj_rich.element.name)) if obj_rich.element.name in all_io_objects.get("icmptypes_unsupported", {}): log.debug1("{} (unsupported)".format(ex)) else: raise ex elif obj_rich.family: ict = all_io_objects["icmptypes"][obj_rich.element.name] if ict.destination and obj_rich.family not in ict.destination: ex = FirewallError(errors.INVALID_ICMPTYPE, "{} '{}': rich rule family '{}' conflicts with icmp type '{}'".format( obj_type, obj.name, obj_rich.family, obj_rich.element.name)) ict_unsupported = all_io_objects.get("icmptypes_unsupported", {}).get(obj_rich.element.name) if ict_unsupported and ict_unsupported.destination and \ obj_rich.family in ict_unsupported.destination: log.debug1("{} (unsupported)".format(ex)) else: raise ex def common_writer(obj, handler): # short if obj.short and obj.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(obj.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if obj.description and obj.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(obj.description) handler.endElement("description") handler.ignorableWhitespace("\n") # services for service in uniqify(obj.services): handler.ignorableWhitespace(" ") handler.simpleElement("service", { "name": service }) handler.ignorableWhitespace("\n") # ports for port in uniqify(obj.ports): handler.ignorableWhitespace(" ") handler.simpleElement("port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # protocols for protocol in uniqify(obj.protocols): handler.ignorableWhitespace(" ") handler.simpleElement("protocol", { "value": protocol }) handler.ignorableWhitespace("\n") # icmp-blocks for icmp in uniqify(obj.icmp_blocks): handler.ignorableWhitespace(" ") handler.simpleElement("icmp-block", { "name": icmp }) handler.ignorableWhitespace("\n") # masquerade if obj.masquerade: handler.ignorableWhitespace(" ") handler.simpleElement("masquerade", { }) handler.ignorableWhitespace("\n") # forward-ports for forward in uniqify(obj.forward_ports): handler.ignorableWhitespace(" ") attrs = { "port": forward[0], "protocol": forward[1] } if forward[2] and forward[2] != "" : attrs["to-port"] = forward[2] if forward[3] and forward[3] != "" : attrs["to-addr"] = forward[3] handler.simpleElement("forward-port", attrs) handler.ignorableWhitespace("\n") # source-ports for port in uniqify(obj.source_ports): handler.ignorableWhitespace(" ") handler.simpleElement("source-port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # rules for rule in obj.rules: attrs = { } if rule.family: attrs["family"] = rule.family if rule.priority != 0: attrs["priority"] = str(rule.priority) handler.ignorableWhitespace(" ") handler.startElement("rule", attrs) handler.ignorableWhitespace("\n") # source if rule.source: attrs = { } if rule.source.addr: attrs["address"] = rule.source.addr if rule.source.mac: attrs["mac"] = rule.source.mac if rule.source.ipset: attrs["ipset"] = rule.source.ipset if rule.source.invert: attrs["invert"] = "True" handler.ignorableWhitespace(" ") handler.simpleElement("source", attrs) handler.ignorableWhitespace("\n") # destination if rule.destination: attrs = { } if rule.destination.addr: attrs["address"] = rule.destination.addr if rule.destination.ipset: attrs["ipset"] = rule.destination.ipset if rule.destination.invert: attrs["invert"] = "True" handler.ignorableWhitespace(" ") handler.simpleElement("destination", attrs) handler.ignorableWhitespace("\n") # element if rule.element: element = "" attrs = { } if type(rule.element) == rich.Rich_Service: element = "service" attrs["name"] = rule.element.name elif type(rule.element) == rich.Rich_Port: element = "port" attrs["port"] = rule.element.port attrs["protocol"] = rule.element.protocol elif type(rule.element) == rich.Rich_Protocol: element = "protocol" attrs["value"] = rule.element.value elif type(rule.element) == rich.Rich_Tcp_Mss_Clamp: element = "tcp-mss-clamp" attrs["value"] = rule.element.value elif type(rule.element) == rich.Rich_Masquerade: element = "masquerade" elif type(rule.element) == rich.Rich_IcmpBlock: element = "icmp-block" attrs["name"] = rule.element.name elif type(rule.element) == rich.Rich_IcmpType: element = "icmp-type" attrs["name"] = rule.element.name elif type(rule.element) == rich.Rich_ForwardPort: element = "forward-port" attrs["port"] = rule.element.port attrs["protocol"] = rule.element.protocol if rule.element.to_port != "": attrs["to-port"] = rule.element.to_port if rule.element.to_address != "": attrs["to-addr"] = rule.element.to_address elif type(rule.element) == rich.Rich_SourcePort: element = "source-port" attrs["port"] = rule.element.port attrs["protocol"] = rule.element.protocol else: raise FirewallError( errors.INVALID_OBJECT, "Unknown element '%s' in obj_writer" % type(rule.element)) handler.ignorableWhitespace(" ") handler.simpleElement(element, attrs) handler.ignorableWhitespace("\n") # rule.element # log if rule.log: if type(rule.log) == rich.Rich_Log: attrs = { } if rule.log.prefix: attrs["prefix"] = rule.log.prefix if rule.log.level: attrs["level"] = rule.log.level if rule.log.limit: handler.ignorableWhitespace(" ") handler.startElement("log", attrs) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.log.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement("log") else: handler.ignorableWhitespace(" ") handler.simpleElement("log", attrs) handler.ignorableWhitespace("\n") else: attrs = { } if rule.log.group: attrs["group"] = rule.log.group if rule.log.prefix: attrs["prefix"] = rule.log.prefix if rule.log.threshold: attrs["queue-size"] = rule.log.threshold if rule.log.limit: handler.ignorableWhitespace(" ") handler.startElement("nflog", attrs) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.log.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement("nflog") else: handler.ignorableWhitespace(" ") handler.simpleElement("nflog", attrs) handler.ignorableWhitespace("\n") # audit if rule.audit: attrs = {} if rule.audit.limit: handler.ignorableWhitespace(" ") handler.startElement("audit", { }) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.audit.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement("audit") else: handler.ignorableWhitespace(" ") handler.simpleElement("audit", attrs) handler.ignorableWhitespace("\n") # action if rule.action: action = "" attrs = { } if type(rule.action) == rich.Rich_Accept: action = "accept" elif type(rule.action) == rich.Rich_Reject: action = "reject" if rule.action.type: attrs["type"] = rule.action.type elif type(rule.action) == rich.Rich_Drop: action = "drop" elif type(rule.action) == rich.Rich_Mark: action = "mark" attrs["set"] = rule.action.set else: log.warning("Unknown action '%s'", type(rule.action)) if rule.action.limit: handler.ignorableWhitespace(" ") handler.startElement(action, attrs) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.action.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement(action) else: handler.ignorableWhitespace(" ") handler.simpleElement(action, attrs) handler.ignorableWhitespace("\n") handler.ignorableWhitespace(" ") handler.endElement("rule") handler.ignorableWhitespace("\n") class Policy(IO_Object): priority_min = -32768 priority_max = 32767 priority_default = DEFAULT_POLICY_PRIORITY priority_reserved = [0] IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "target", "" ), # s ( "services", [ "", ], ), # as ( "ports", [ ( "", "" ), ], ), # a(ss) ( "icmp_blocks", [ "", ], ), # as ( "masquerade", False ), # b ( "forward_ports", [ ( "", "", "", "" ), ], ), # a(ssss) ( "rich_rules", [ "" ] ), # as ( "protocols", [ "", ], ), # as ( "source_ports", [ ( "", "" ), ], ), # a(ss) ( "priority", 0 ), # i ( "ingress_zones", [ "" ] ), # as ( "egress_zones", [ "" ] ), # as ) ADDITIONAL_ALNUM_CHARS = [ "_", "-", "/" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "policy": ["target"], "service": [ "name" ], "port": [ "port", "protocol" ], "icmp-block": [ "name" ], "icmp-type": [ "name" ], "masquerade": None, "forward-port": [ "port", "protocol" ], "rule": None, "source": None, "destination": None, "protocol": [ "value" ], "source-port": [ "port", "protocol" ], "log": None, "nflog": None, "audit": None, "accept": None, "reject": None, "drop": None, "mark": [ "set" ], "limit": [ "value" ], "ingress-zone": [ "name" ], "egress-zone": [ "name" ], } PARSER_OPTIONAL_ELEMENT_ATTRS = { "policy": [ "version", "priority" ], "forward-port": [ "to-port", "to-addr" ], "rule": [ "family", "priority" ], "source": [ "address", "mac", "invert", "family", "ipset" ], "destination": [ "address", "invert", "ipset" ], "log": [ "prefix", "level" ], "nflog": [ "group", "prefix", "queue-size" ], "reject": [ "type" ], "tcp-mss-clamp": [ "value" ], } def __init__(self): super(Policy, self).__init__() self.version = "" self.short = "" self.description = "" self.target = DEFAULT_POLICY_TARGET self.services = [ ] self.ports = [ ] self.protocols = [ ] self.icmp_blocks = [ ] self.icmp_block_inversion = False # for zones, not written to policy config self.masquerade = False self.forward_ports = [ ] self.source_ports = [ ] self.rules = [ ] self.rules_str = [ ] self.applied = False self.priority = self.priority_default self.derived_from_zone = None self.ingress_zones = [] self.egress_zones = [] def cleanup(self): self.version = "" self.short = "" self.description = "" self.target = DEFAULT_POLICY_TARGET del self.services[:] del self.ports[:] del self.protocols[:] del self.icmp_blocks[:] self.icmp_block_inversion = False self.masquerade = False del self.forward_ports[:] del self.source_ports[:] del self.rules[:] del self.rules_str[:] self.applied = False self.priority = self.priority_default del self.ingress_zones[:] del self.egress_zones[:] def __getattr__(self, name): if name == "rich_rules": return self.rules_str else: return getattr(super(Policy, self), name) def __setattr__(self, name, value): if name == "rich_rules": self.rules = [rich.Rich_Rule(rule_str=s) for s in value] # must convert back to string to get the canonical string. self.rules_str = [str(s) for s in self.rules] else: super(Policy, self).__setattr__(name, value) def _check_config(self, config, item, all_config, all_io_objects): common_check_config(self, config, item, all_config, all_io_objects) if self.name in all_io_objects["zones"]: raise FirewallError(errors.NAME_CONFLICT, "Policy '{}': Can't have the same name as a zone.".format(self.name)) if item == "target": if config not in POLICY_TARGETS: raise FirewallError(errors.INVALID_TARGET, "Policy '{}': '{}' is invalid target".format(self.name, config)) elif item == "priority": if config in self.priority_reserved or \ config > self.priority_max or \ config < self.priority_min: raise FirewallError(errors.INVALID_PRIORITY, "Policy '{}': {} is invalid priority. Must be in range [{}, {}]. The following are reserved: {}".format( self.name, config, self.priority_min, self.priority_max, self.priority_reserved)) elif item in ["ingress_zones", "egress_zones"]: existing_zones = ["ANY", "HOST"] + list(all_io_objects["zones"].keys()) for zone in config: if zone not in existing_zones: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': '{}' not among existing zones".format( self.name, zone)) if ((zone not in ["ANY", "HOST"] and (set(["ANY", "HOST"]) & set(config))) or \ (zone in ["ANY", "HOST"] and (set(config) - set([zone])))): raise FirewallError(errors.INVALID_ZONE, "Policy '{}': '{}' may only contain one of: many regular zones, ANY, or HOST".format( self.name, item)) if zone == "HOST" and \ ((item == "ingress_zones" and "egress_zones" in all_config and "HOST" in all_config["egress_zones"]) or \ (item == "egress_zones" and "ingress_zones" in all_config and "HOST" in all_config["ingress_zones"])): raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'HOST' can only appear in either ingress or egress zones, but not both".format( self.name)) elif item == "masquerade" and config: if "egress_zones" in all_config and "HOST" in all_config["egress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for egress zone 'HOST'".format( self.name)) elif "ingress_zones" in all_config: if "HOST" in all_config["ingress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for ingress zone 'HOST'".format( self.name)) for zone in all_config["ingress_zones"]: if zone == "ANY": continue if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' cannot be used because ingress zone '{}' has assigned interfaces. ".format(self.name, zone)) elif item == "rich_rules": for rule in config: obj = rich.Rich_Rule(rule_str=rule) if obj.element and isinstance(obj.element, rich.Rich_Masquerade): if "egress_zones" in all_config and "HOST" in all_config["egress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for egress zone 'HOST'".format( self.name)) elif "ingress_zones" in all_config: if "HOST" in all_config["ingress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for ingress zone 'HOST'".format( self.name)) for zone in all_config["ingress_zones"]: if zone == "ANY": continue if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' cannot be used because ingress zone '{}' has assigned interfaces. ".format(self.name, zone)) elif obj.element and isinstance(obj.element, rich.Rich_ForwardPort): if "egress_zones" in all_config: if "HOST" in all_config["egress_zones"]: if obj.element.to_address: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'".format( self.name)) elif all_config["egress_zones"]: if not obj.element.to_address: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': 'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone".format( self.name)) if "ANY" not in all_config["egress_zones"]: for zone in all_config["egress_zones"]: if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'forward-port' cannot be used because egress zone '{}' has assigned interfaces".format(self.name, zone)) elif obj.action and isinstance(obj.action, rich.Rich_Mark): if "egress_zones" in all_config: for zone in all_config["egress_zones"]: if zone in ["ANY", "HOST"]: continue if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'mark' action cannot be used because egress zone '{}' has assigned interfaces".format(self.name, zone)) elif item == "forward_ports": for fwd_port in config: if "egress_zones" in all_config: if "HOST" in all_config["egress_zones"]: if fwd_port[3]: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'".format( self.name)) elif all_config["egress_zones"]: if not fwd_port[3]: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': 'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone".format( self.name)) if "ANY" not in all_config["egress_zones"]: for zone in all_config["egress_zones"]: if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'forward-port' cannot be used because egress zone '{}' has assigned interfaces".format(self.name, zone)) def check_name(self, name): super(Policy, self).check_name(name) if name.startswith('/'): raise FirewallError(errors.INVALID_NAME, "Policy '{}': name can't start with '/'".format(name)) elif name.endswith('/'): raise FirewallError(errors.INVALID_NAME, "Policy '{}': name can't end with '/'".format(name)) elif name.count('/') > 1: raise FirewallError(errors.INVALID_NAME, "Policy '{}': name has more than one '/'".format(name)) else: if "/" in name: checked_name = name[:name.find('/')] else: checked_name = name if len(checked_name) > max_policy_name_len(): raise FirewallError(errors.INVALID_NAME, "Policy '{}': name has {} chars, max is {}".format( name, len(checked_name), max_policy_name_len())) # PARSER class policy_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self._rule = None self._rule_error = False self._limit_ok = None def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) if self._rule_error: return self.item.parser_check_element_attrs(name, attrs) if common_startElement(self, name, attrs): return elif name == "policy": if "version" in attrs: self.item.version = attrs["version"] if "priority" in attrs: self.item.priority = int(attrs["priority"]) if "target" in attrs: target = attrs["target"] if target not in POLICY_TARGETS: raise FirewallError(errors.INVALID_TARGET, target) if target: self.item.target = target elif name == "ingress-zone": if attrs["name"] not in self.item.ingress_zones: self.item.ingress_zones.append(attrs["name"]) else: log.warning("Ingress zone '%s' already set, ignoring.", attrs["name"]) elif name == "egress-zone": if attrs["name"] not in self.item.egress_zones: self.item.egress_zones.append(attrs["name"]) else: log.warning("Egress zone '%s' already set, ignoring.", attrs["name"]) elif name == "source": if not self._rule: log.warning('Invalid rule: Source outside of rule') self._rule_error = True return if self._rule.source: log.warning("Invalid rule: More than one source in rule '%s', ignoring.", str(self._rule)) self._rule_error = True return invert = False if "invert" in attrs and \ attrs["invert"].lower() in [ "yes", "true" ]: invert = True addr = mac = ipset = None if "address" in attrs: addr = attrs["address"] if "mac" in attrs: mac = attrs["mac"] if "ipset" in attrs: ipset = attrs["ipset"] self._rule.source = rich.Rich_Source(addr, mac, ipset, invert=invert) return else: log.warning("Unknown XML element '%s'", name) return def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) common_endElement(self, name) def policy_reader(filename, path, no_check_name=False): policy = Policy() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) policy.name = filename[:-4] if not no_check_name: policy.check_name(policy.name) policy.filename = filename policy.path = path policy.builtin = False if path.startswith(config.ETC_FIREWALLD) else True policy.default = policy.builtin handler = policy_ContentHandler(policy) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_POLICY, "not a valid policy file: %s" % \ msg.getException()) del handler del parser return policy def policy_writer(policy, path=None): _path = path if path else policy.path if policy.filename: name = "%s/%s" % (_path, policy.filename) else: name = "%s/%s.xml" % (_path, policy.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start policy element attrs = {} if policy.version and policy.version != "": attrs["version"] = policy.version if policy.priority != policy.priority_default: attrs["priority"] = str(policy.priority) attrs["target"] = policy.target handler.startElement("policy", attrs) handler.ignorableWhitespace("\n") common_writer(policy, handler) # ingress-zones for zone in uniqify(policy.ingress_zones): handler.ignorableWhitespace(" ") handler.simpleElement("ingress-zone", { "name": zone }) handler.ignorableWhitespace("\n") # egress-zones for zone in uniqify(policy.egress_zones): handler.ignorableWhitespace(" ") handler.simpleElement("egress-zone", { "name": zone }) handler.ignorableWhitespace("\n") # end policy element handler.endElement("policy") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���ZT���- �- io_object.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """Generic io_object handler, io specific check methods.""" __all__ = [ "IO_Object", "IO_Object_ContentHandler", "IO_Object_XMLGenerator", "check_port", "check_tcpudp", "check_protocol", "check_address" ] import xml.sax as sax import xml.sax.saxutils as saxutils import copy from collections import OrderedDict from firewall import functions from firewall import errors from firewall.errors import FirewallError class IO_Object(object): """ Abstract IO_Object as base for icmptype, service and zone """ IMPORT_EXPORT_STRUCTURE = ( ) DBUS_SIGNATURE = '()' ADDITIONAL_ALNUM_CHARS = [ ] # additional to alnum PARSER_REQUIRED_ELEMENT_ATTRS = { } PARSER_OPTIONAL_ELEMENT_ATTRS = { } def __init__(self): self.filename = "" self.path = "" self.name = "" self.default = False self.builtin = False def export_config(self): ret = [ ] for x in self.IMPORT_EXPORT_STRUCTURE: ret.append(copy.deepcopy(getattr(self, x[0]))) return tuple(ret) def export_config_dict(self): conf = {} type_formats = dict([(x[0], x[1]) for x in self.IMPORT_EXPORT_STRUCTURE]) for key in type_formats: if getattr(self, key) or isinstance(getattr(self, key), bool): conf[key] = copy.deepcopy(getattr(self, key)) return conf def import_config(self, conf, all_io_objects): self.check_config(conf, all_io_objects) for i,(element,dummy) in enumerate(self.IMPORT_EXPORT_STRUCTURE): if isinstance(conf[i], list): # remove duplicates without changing the order _conf = [ ] _set = set() for x in conf[i]: if x not in _set: _conf.append(x) _set.add(x) del _set setattr(self, element, copy.deepcopy(_conf)) else: setattr(self, element, copy.deepcopy(conf[i])) def import_config_dict(self, conf, all_io_objects): self.check_config_dict(conf, all_io_objects) for key in conf: if not hasattr(self, key): raise FirewallError(errors.UNKNOWN_ERROR, "Internal error. '{}' is not a valid attribute".format(key)) if isinstance(conf[key], list): # maintain list order while removing duplicates setattr(self, key, list(OrderedDict.fromkeys(copy.deepcopy(conf[key])))) else: setattr(self, key, copy.deepcopy(conf[key])) def check_name(self, name): if not isinstance(name, str): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % (name, type(""), type(name))) if len(name) < 1: raise FirewallError(errors.INVALID_NAME, "name can't be empty") for char in name: if not char.isalnum() and char not in self.ADDITIONAL_ALNUM_CHARS: raise FirewallError( errors.INVALID_NAME, "'%s' is not allowed in '%s'" % ((char, name))) def check_config(self, conf, all_io_objects={}): if len(conf) != len(self.IMPORT_EXPORT_STRUCTURE): raise FirewallError( errors.INVALID_TYPE, "structure size mismatch %d != %d" % \ (len(conf), len(self.IMPORT_EXPORT_STRUCTURE))) conf_dict = {} for i,(x,y) in enumerate(self.IMPORT_EXPORT_STRUCTURE): conf_dict[x] = conf[i] self.check_config_dict(conf_dict, all_io_objects) def check_config_dict(self, conf, all_io_objects): type_formats = dict([(x[0], x[1]) for x in self.IMPORT_EXPORT_STRUCTURE]) for key in conf: if key not in [x for (x,y) in self.IMPORT_EXPORT_STRUCTURE]: raise FirewallError(errors.INVALID_OPTION, "option '{}' is not valid".format(key)) self._check_config_structure(conf[key], type_formats[key]) self._check_config(conf[key], key, conf, all_io_objects) def _check_config(self, dummy1, dummy2, dummy3, dummy4): # to be overloaded by sub classes return def _check_config_structure(self, conf, structure): if not isinstance(conf, type(structure)): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % \ (conf, type(structure), type(conf))) if isinstance(structure, list): # same type elements, else struct if len(structure) != 1: raise FirewallError(errors.INVALID_TYPE, "len('%s') != 1" % structure) for x in conf: self._check_config_structure(x, structure[0]) elif isinstance(structure, tuple): if len(structure) != len(conf): raise FirewallError(errors.INVALID_TYPE, "len('%s') != %d" % (conf, len(structure))) for i,value in enumerate(structure): self._check_config_structure(conf[i], value) elif isinstance(structure, dict): # only one key value pair in structure (skey, svalue) = list(structure.items())[0] for (key, value) in conf.items(): if not isinstance(key, type(skey)): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % (\ key, type(skey), type(key))) if not isinstance(value, type(svalue)): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % (\ value, type(svalue), type(value))) # check required elements and attributes and also optional attributes def parser_check_element_attrs(self, name, attrs): _attrs = attrs.getNames() found = False if name in self.PARSER_REQUIRED_ELEMENT_ATTRS: found = True if self.PARSER_REQUIRED_ELEMENT_ATTRS[name] is not None: for x in self.PARSER_REQUIRED_ELEMENT_ATTRS[name]: if x in _attrs: _attrs.remove(x) else: raise FirewallError( errors.PARSE_ERROR, "Missing attribute %s for %s" % (x, name)) if name in self.PARSER_OPTIONAL_ELEMENT_ATTRS: found = True for x in self.PARSER_OPTIONAL_ELEMENT_ATTRS[name]: if x in _attrs: _attrs.remove(x) if not found: raise FirewallError(errors.PARSE_ERROR, "Unexpected element %s" % name) # raise attributes[0] for x in _attrs: raise FirewallError(errors.PARSE_ERROR, "%s: Unexpected attribute %s" % (name, x)) # PARSER class UnexpectedElementError(Exception): def __init__(self, name): super(UnexpectedElementError, self).__init__() self.name = name def __str__(self): return "Unexpected element '%s'" % (self.name) class MissingAttributeError(Exception): def __init__(self, name, attribute): super(MissingAttributeError, self).__init__() self.name = name self.attribute = attribute def __str__(self): return "Element '%s': missing '%s' attribute" % \ (self.name, self.attribute) class UnexpectedAttributeError(Exception): def __init__(self, name, attribute): super(UnexpectedAttributeError, self).__init__() self.name = name self.attribute = attribute def __str__(self): return "Element '%s': unexpected attribute '%s'" % \ (self.name, self.attribute) class IO_Object_ContentHandler(sax.handler.ContentHandler): def __init__(self, item): self.item = item self._element = "" def startDocument(self): self._element = "" def startElement(self, name, attrs): self._element = "" def endElement(self, name): if name == "short": self.item.short = self._element elif name == "description": self.item.description = self._element def characters(self, content): self._element += content.replace('\n', ' ') class IO_Object_XMLGenerator(saxutils.XMLGenerator): def __init__(self, out): # fix memory leak in saxutils.XMLGenerator.__init__: # out = _gettextwriter(out, encoding) # creates unbound object results in garbage in gc # # saxutils.XMLGenerator.__init__(self, out, "utf-8") # replaced by modified saxutils.XMLGenerator.__init__ code: sax.handler.ContentHandler.__init__(self) self._write = out.write self._flush = out.flush self._ns_contexts = [{}] # contains uri -> prefix dicts self._current_context = self._ns_contexts[-1] self._undeclared_ns_maps = [] self._encoding = "utf-8" self._pending_start_element = False self._short_empty_elements = False def simpleElement(self, name, attrs): """ slightly modified startElement() """ self._write('<' + name) for (name, value) in attrs.items(): self._write(' %s=%s' % (name, saxutils.quoteattr(value))) self._write('/>') def check_port(port): port_range = functions.getPortRange(port) if port_range == -2: raise FirewallError(errors.INVALID_PORT, "port number in '%s' is too big" % port) elif port_range == -1: raise FirewallError(errors.INVALID_PORT, "'%s' is invalid port range" % port) elif port_range is None: raise FirewallError(errors.INVALID_PORT, "port range '%s' is ambiguous" % port) elif len(port_range) == 2 and port_range[0] >= port_range[1]: raise FirewallError(errors.INVALID_PORT, "'%s' is invalid port range" % port) def check_tcpudp(protocol): if protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, "'%s' not from {'tcp'|'udp'|'sctp'|'dccp'}" % \ protocol) def check_protocol(protocol): if not functions.checkProtocol(protocol): raise FirewallError(errors.INVALID_PROTOCOL, protocol) def check_address(ipv, addr): if not functions.check_address(ipv, addr): raise FirewallError(errors.INVALID_ADDR, "'%s' is not valid %s address" % (addr, ipv)) PK ���ZP�h֕ � icmptype.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "IcmpType", "icmptype_reader", "icmptype_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class IcmpType(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "destination", [ "", ], ), # as ) DBUS_SIGNATURE = '(sssas)' ADDITIONAL_ALNUM_CHARS = [ "_", "-" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "icmptype": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "icmptype": [ "name", "version" ], "destination": [ "ipv4", "ipv6" ], } def __init__(self): super(IcmpType, self).__init__() self.version = "" self.short = "" self.description = "" self.destination = [ ] def cleanup(self): self.version = "" self.short = "" self.description = "" del self.destination[:] def _check_config(self, config, item, all_config, all_io_objects): if item == "destination": for destination in config: if destination not in [ "ipv4", "ipv6" ]: raise FirewallError(errors.INVALID_DESTINATION, "'%s' not from {'ipv4'|'ipv6'}" % \ destination) # PARSER class icmptype_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "icmptype": if "name" in attrs: log.warning("Ignoring deprecated attribute name='%s'" % attrs["name"]) if "version" in attrs: self.item.version = attrs["version"] elif name == "short": pass elif name == "description": pass elif name == "destination": for x in [ "ipv4", "ipv6" ]: if x in attrs and \ attrs[x].lower() in [ "yes", "true" ]: self.item.destination.append(str(x)) def icmptype_reader(filename, path): icmptype = IcmpType() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "%s is missing .xml suffix" % filename) icmptype.name = filename[:-4] icmptype.check_name(icmptype.name) icmptype.filename = filename icmptype.path = path icmptype.builtin = False if path.startswith(config.ETC_FIREWALLD) else True icmptype.default = icmptype.builtin handler = icmptype_ContentHandler(icmptype) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_ICMPTYPE, "not a valid icmptype file: %s" % \ msg.getException()) del handler del parser return icmptype def icmptype_writer(icmptype, path=None): _path = path if path else icmptype.path if icmptype.filename: name = "%s/%s" % (_path, icmptype.filename) else: name = "%s/%s.xml" % (_path, icmptype.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start icmptype element attrs = {} if icmptype.version and icmptype.version != "": attrs["version"] = icmptype.version handler.startElement("icmptype", attrs) handler.ignorableWhitespace("\n") # short if icmptype.short and icmptype.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(icmptype.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if icmptype.description and icmptype.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(icmptype.description) handler.endElement("description") handler.ignorableWhitespace("\n") # destination if icmptype.destination: handler.ignorableWhitespace(" ") attrs = { } for x in icmptype.destination: attrs[x] = "yes" handler.simpleElement("destination", attrs) handler.ignorableWhitespace("\n") # end icmptype element handler.endElement('icmptype') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z�eΪ� � ifcfg.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """ifcfg file parser""" __all__ = [ "ifcfg" ] import os.path import io import tempfile import shutil from firewall.core.logger import log class ifcfg(object): def __init__(self, filename): self._config = { } self._deleted = [ ] self.filename = filename self.clear() def clear(self): self._config = { } self._deleted = [ ] def cleanup(self): self._config.clear() def get(self, key): return self._config.get(key.strip()) def set(self, key, value): _key = key.strip() self._config[_key] = value.strip() if _key in self._deleted: self._deleted.remove(_key) def __str__(self): s = "" for (key, value) in self._config.items(): if s: s += '\n' s += '%s=%s' % (key, value) return s # load self.filename def read(self): self.clear() try: f = open(self.filename, "r") except Exception as msg: log.error("Failed to load '%s': %s", self.filename, msg) raise for line in f: if not line: break line = line.strip() if len(line) < 1 or line[0] in ['#', ';']: continue # get key/value pair pair = [ x.strip() for x in line.split("=", 1) ] if len(pair) != 2: continue if len(pair[1]) >= 2 and \ pair[1].startswith('"') and pair[1].endswith('"'): pair[1] = pair[1][1:-1] if pair[1] == '': continue elif self._config.get(pair[0]) is not None: log.warning("%s: Duplicate option definition: '%s'", self.filename, line.strip()) continue self._config[pair[0]] = pair[1] f.close() def write(self): if len(self._config) < 1: # no changes: nothing to do return # handled keys done = [ ] try: temp_file = tempfile.NamedTemporaryFile( mode='wt', prefix="%s." % os.path.basename(self.filename), dir=os.path.dirname(self.filename), delete=False) except Exception as msg: log.error("Failed to open temporary file: %s" % msg) raise modified = False empty = False try: f = io.open(self.filename, mode='rt', encoding='UTF-8') except Exception as msg: if os.path.exists(self.filename): log.error("Failed to open '%s': %s" % (self.filename, msg)) raise else: f = None else: for line in f: if not line: break # remove newline line = line.strip("\n") if len(line) < 1: if not empty: temp_file.write(u"\n") empty = True elif line[0] == '#': empty = False temp_file.write(line) temp_file.write(u"\n") else: p = line.split("=", 1) if len(p) != 2: empty = False temp_file.write(line+u"\n") continue key = p[0].strip() value = p[1].strip() if len(value) >= 2 and \ value.startswith('"') and value.endswith('"'): value = value[1:-1] # check for modified key/value pairs if key not in done: if key in self._config and self._config[key] != value: empty = False temp_file.write(u'%s=%s\n' % (key, self._config[key])) modified = True elif key in self._deleted: modified = True else: empty = False temp_file.write(line+u"\n") done.append(key) else: modified = True # write remaining key/value pairs if len(self._config) > 0: for (key, value) in self._config.items(): if key in done: continue if not empty: empty = True temp_file.write(u'%s=%s\n' % (key, value)) modified = True if f: f.close() temp_file.close() if not modified: # not modified: remove tempfile os.remove(temp_file.name) return # make backup if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.bak" % self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) # copy tempfile try: shutil.move(temp_file.name, self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Failed to create '%s': %s" % (self.filename, msg)) else: os.chmod(self.filename, 0o600) PK ���Z��@�> > helper.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Helper", "helper_reader", "helper_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \ check_tcpudp from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class Helper(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "family", "", ), # s ( "module", "", ), # s ( "ports", [ ( "", "" ), ], ), # a(ss) ) DBUS_SIGNATURE = '(sssssa(ss))' ADDITIONAL_ALNUM_CHARS = [ "-", "." ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "helper": [ "module" ], } PARSER_OPTIONAL_ELEMENT_ATTRS = { "helper": [ "name", "version", "family" ], "port": [ "port", "protocol" ], } def __init__(self): super(Helper, self).__init__() self.version = "" self.short = "" self.description = "" self.module = "" self.family = "" self.ports = [ ] def cleanup(self): self.version = "" self.short = "" self.description = "" self.module = "" self.family = "" del self.ports[:] def check_ipv(self, ipv): ipvs = [ 'ipv4', 'ipv6' ] if ipv not in ipvs: raise FirewallError(errors.INVALID_IPV, "'%s' not in '%s'" % (ipv, ipvs)) def _check_config(self, config, item, all_config, all_io_objects): if item == "ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item == "module": if not config.startswith("nf_conntrack_"): raise FirewallError( errors.INVALID_MODULE, "'%s' does not start with 'nf_conntrack_'" % config) if len(config.replace("nf_conntrack_", "")) < 1: raise FirewallError(errors.INVALID_MODULE, "Module name '%s' too short" % config) # PARSER class helper_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "helper": if "version" in attrs: self.item.version = attrs["version"] if "family" in attrs: self.item.check_ipv(attrs["family"]) self.item.family = attrs["family"] if "module" in attrs: if not attrs["module"].startswith("nf_conntrack_"): raise FirewallError( errors.INVALID_MODULE, "'%s' does not start with 'nf_conntrack_'" % \ attrs["module"]) if len(attrs["module"].replace("nf_conntrack_", "")) < 1: raise FirewallError( errors.INVALID_MODULE, "Module name '%s' too short" % attrs["module"]) self.item.module = attrs["module"] elif name == "short": pass elif name == "description": pass elif name == "port": check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) entry = (attrs["port"], attrs["protocol"]) if entry not in self.item.ports: self.item.ports.append(entry) else: log.warning("Port '%s/%s' already set, ignoring.", attrs["port"], attrs["protocol"]) def helper_reader(filename, path): helper = Helper() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) helper.name = filename[:-4] helper.check_name(helper.name) helper.filename = filename helper.path = path helper.builtin = False if path.startswith(config.ETC_FIREWALLD) else True helper.default = helper.builtin handler = helper_ContentHandler(helper) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_HELPER, "not a valid helper file: %s" % \ msg.getException()) del handler del parser return helper def helper_writer(helper, path=None): _path = path if path else helper.path if helper.filename: name = "%s/%s" % (_path, helper.filename) else: name = "%s/%s.xml" % (_path, helper.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start helper element attrs = {} attrs["module"] = helper.module if helper.version and helper.version != "": attrs["version"] = helper.version if helper.family and helper.family != "": attrs["family"] = helper.family handler.startElement("helper", attrs) handler.ignorableWhitespace("\n") # short if helper.short and helper.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(helper.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if helper.description and helper.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(helper.description) handler.endElement("description") handler.ignorableWhitespace("\n") # ports for port in helper.ports: handler.ignorableWhitespace(" ") handler.simpleElement("port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # end helper element handler.endElement('helper') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z� $��/ �/ lockdown_whitelist.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.logger import log from firewall.functions import uniqify, checkUser, checkUid, checkCommand, \ checkContext from firewall import errors from firewall.errors import FirewallError class lockdown_whitelist_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self.whitelist = False def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "whitelist": if self.whitelist: raise FirewallError(errors.PARSE_ERROR, "More than one whitelist.") self.whitelist = True elif name == "command": if not self.whitelist: log.error("Parse Error: command outside of whitelist") return command = attrs["name"] self.item.add_command(command) elif name == "user": if not self.whitelist: log.error("Parse Error: user outside of whitelist") return if "id" in attrs: try: uid = int(attrs["id"]) except ValueError: log.error("Parse Error: %s is not a valid uid" % attrs["id"]) return self.item.add_uid(uid) elif "name" in attrs: self.item.add_user(attrs["name"]) elif name == "selinux": if not self.whitelist: log.error("Parse Error: selinux outside of whitelist") return if "context" not in attrs: log.error("Parse Error: no context") return self.item.add_context(attrs["context"]) else: log.error('Unknown XML element %s' % name) return class LockdownWhitelist(IO_Object): """ LockdownWhitelist class """ IMPORT_EXPORT_STRUCTURE = ( ( "commands", [ "" ] ), # as ( "contexts", [ "" ] ), # as ( "users", [ "" ] ), # as ( "uids", [ 0 ] ) # ai ) DBUS_SIGNATURE = '(asasasai)' ADDITIONAL_ALNUM_CHARS = [ "_" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "whitelist": None, "command": [ "name" ], "user": None, # "group": None, "selinux": [ "context" ], } PARSER_OPTIONAL_ELEMENT_ATTRS = { "user": [ "id", "name" ], # "group": [ "id", "name" ], } def __init__(self, filename): super(LockdownWhitelist, self).__init__() self.filename = filename self.parser = None self.commands = [ ] self.contexts = [ ] self.users = [ ] self.uids = [ ] # self.gids = [ ] # self.groups = [ ] def _check_config(self, config, item, all_config, all_io_objects): if item in [ "commands", "contexts", "users", "uids" ]: for x in config: self._check_config(x, item[:-1], all_config, all_io_objects) elif item == "command": if not checkCommand(config): raise FirewallError(errors.INVALID_COMMAND, config) elif item == "context": if not checkContext(config): raise FirewallError(errors.INVALID_CONTEXT, config) elif item == "user": if not checkUser(config): raise FirewallError(errors.INVALID_USER, config) elif item == "uid": if not checkUid(config): raise FirewallError(errors.INVALID_UID, config) def cleanup(self): del self.commands[:] del self.contexts[:] del self.users[:] del self.uids[:] # del self.gids[:] # del self.groups[:] # commands def add_command(self, command): if not checkCommand(command): raise FirewallError(errors.INVALID_COMMAND, command) if command not in self.commands: self.commands.append(command) else: raise FirewallError(errors.ALREADY_ENABLED, 'Command "%s" already in whitelist' % command) def remove_command(self, command): if command in self.commands: self.commands.remove(command) else: raise FirewallError(errors.NOT_ENABLED, 'Command "%s" not in whitelist.' % command) def has_command(self, command): return (command in self.commands) def match_command(self, command): for _command in self.commands: if _command.endswith("*"): if command.startswith(_command[:-1]): return True else: if _command == command: return True return False def get_commands(self): return self.commands # user ids def add_uid(self, uid): if not checkUid(uid): raise FirewallError(errors.INVALID_UID, str(uid)) if uid not in self.uids: self.uids.append(uid) else: raise FirewallError(errors.ALREADY_ENABLED, 'Uid "%s" already in whitelist' % uid) def remove_uid(self, uid): if uid in self.uids: self.uids.remove(uid) else: raise FirewallError(errors.NOT_ENABLED, 'Uid "%s" not in whitelist.' % uid) def has_uid(self, uid): return (uid in self.uids) def match_uid(self, uid): return (uid in self.uids) def get_uids(self): return self.uids # users def add_user(self, user): if not checkUser(user): raise FirewallError(errors.INVALID_USER, user) if user not in self.users: self.users.append(user) else: raise FirewallError(errors.ALREADY_ENABLED, 'User "%s" already in whitelist' % user) def remove_user(self, user): if user in self.users: self.users.remove(user) else: raise FirewallError(errors.NOT_ENABLED, 'User "%s" not in whitelist.' % user) def has_user(self, user): return (user in self.users) def match_user(self, user): return (user in self.users) def get_users(self): return self.users # # group ids # # def add_gid(self, gid): # if gid not in self.gids: # self.gids.append(gid) # # def remove_gid(self, gid): # if gid in self.gids: # self.gids.remove(gid) # else: # raise FirewallError(errors.NOT_ENABLED, # 'Gid "%s" not in whitelist.' % gid) # # def has_gid(self, gid): # return (gid in self.gids) # # def match_gid(self, gid): # return (gid in self.gids) # # def get_gids(self): # return self.gids # # groups # # def add_group(self, group): # if group not in self.groups: # self.groups.append(group) # # def remove_group(self, group): # if group in self.groups: # self.groups.remove(group) # else: # raise FirewallError(errors.NOT_ENABLED, # 'Group "%s" not in whitelist.' % group) # # def has_group(self, group): # return (group in self.groups) # # def match_group(self, group): # return (group in self.groups) # # def get_groups(self): # return self.groups # selinux contexts def add_context(self, context): if not checkContext(context): raise FirewallError(errors.INVALID_CONTEXT, context) if context not in self.contexts: self.contexts.append(context) else: raise FirewallError(errors.ALREADY_ENABLED, 'Context "%s" already in whitelist' % context) def remove_context(self, context): if context in self.contexts: self.contexts.remove(context) else: raise FirewallError(errors.NOT_ENABLED, 'Context "%s" not in whitelist.' % context) def has_context(self, context): return (context in self.contexts) def match_context(self, context): return (context in self.contexts) def get_contexts(self): return self.contexts # read and write def read(self): self.cleanup() if not self.filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % self.filename) handler = lockdown_whitelist_ContentHandler(self) parser = sax.make_parser() parser.setContentHandler(handler) try: parser.parse(self.filename) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_TYPE, "Not a valid file: %s" % \ msg.getException()) del handler del parser def write(self): if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.old" % self.filename) except Exception as msg: raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) f = io.open(self.filename, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start whitelist element handler.startElement("whitelist", { }) handler.ignorableWhitespace("\n") # commands for command in uniqify(self.commands): handler.ignorableWhitespace(" ") handler.simpleElement("command", { "name": command }) handler.ignorableWhitespace("\n") for uid in uniqify(self.uids): handler.ignorableWhitespace(" ") handler.simpleElement("user", { "id": str(uid) }) handler.ignorableWhitespace("\n") for user in uniqify(self.users): handler.ignorableWhitespace(" ") handler.simpleElement("user", { "name": user }) handler.ignorableWhitespace("\n") # for gid in uniqify(self.gids): # handler.ignorableWhitespace(" ") # handler.simpleElement("user", { "id": str(gid) }) # handler.ignorableWhitespace("\n") # for group in uniqify(self.groups): # handler.ignorableWhitespace(" ") # handler.simpleElement("group", { "name": group }) # handler.ignorableWhitespace("\n") for context in uniqify(self.contexts): handler.ignorableWhitespace(" ") handler.simpleElement("selinux", { "context": context }) handler.ignorableWhitespace("\n") # end whitelist element handler.endElement("whitelist") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z,�:< < __init__.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # # fix xmlplus to be compatible with the python xml sax parser and python 3 # by adding __contains__ to xml.sax.xmlreader.AttributesImpl import xml if "_xmlplus" in xml.__file__: from xml.sax.xmlreader import AttributesImpl if not hasattr(AttributesImpl, "__contains__"): # this is missing: def __AttributesImpl__contains__(self, name): return name in getattr(self, "_attrs") # add it using the name __contains__ setattr(AttributesImpl, "__contains__", __AttributesImpl__contains__) from xml.sax.saxutils import XMLGenerator if not hasattr(XMLGenerator, "_write"): # this is missing: def __XMLGenerator_write(self, text): getattr(self, "_out").write(text) # add it using the name _write setattr(XMLGenerator, "_write", __XMLGenerator_write) PK �I�Z+�0�7 �7 LC_MESSAGES/django.monu �[��� PK �I�Z�!9TZ TZ 28 LC_MESSAGES/django.ponu �[��� PK ���Z�`-�"P "P ˒ ipset.pynu �[��� PK ���Z�ζ �. �. %� service.pynu �[��� PK ���Z�w{�{ { * E __pycache__/firewalld_conf.cpython-310.pycnu �[��� PK ���Z���m� � $ / __pycache__/icmptype.cpython-310.pycnu �[��� PK ���Zx�8W� � ! �@ __pycache__/ifcfg.cpython-310.pycnu �[��� PK ���ZS���� � $ �P __pycache__/__init__.cpython-310.pycnu �[��� PK ���Z@��& �& % �S __pycache__/io_object.cpython-310.pycnu �[��� PK ���Z� �r r # { __pycache__/service.cpython-310.pycnu �[��� PK ���Z���� � " � __pycache__/helper.cpython-310.pycnu �[��� PK ���Z���<J( J( ! � __pycache__/ipset.cpython-310.pycnu �[��� PK ���Z�$8��] �] " �� __pycache__/policy.cpython-310.pycnu �[��� PK ���Z�*X�, �, " �2 __pycache__/direct.cpython-310.pycnu �[��� PK ���ZֲNv� � % �_ __pycache__/functions.cpython-310.pycnu �[��� PK ���Z��"�� � . �i __pycache__/lockdown_whitelist.cpython-310.pycnu �[��� PK ���Z��- - � __pycache__/zone.cpython-310.pycnu �[��� PK ���Z8�W�� � u� functions.pynu �[��� PK ���Z�:2��5 �5 �� firewalld_conf.pynu �[��� PK ���Z��p�J J �� zone.pynu �[��� PK ���Z,E?|�< �< �I direct.pynu �[��� PK ���Z <�᭾ �� � policy.pynu �[��� PK ���ZT���- �- �E io_object.pynu �[��� PK ���ZP�h֕ � �s icmptype.pynu �[��� PK ���Z�eΪ� � �� ifcfg.pynu �[��� PK ���Z��@�> > �� helper.pynu �[��� PK ���Z� $��/ �/ � lockdown_whitelist.pynu �[��� PK ���Z,�:< < .� __init__.pynu �[��� PK � ��
| ver. 1.4 |
Github
|
.
| PHP 8.2.28 | Generation time: 0.02 |
proxy
|
phpinfo
|
Settings