관리-도구
편집 파일: zone.cpython-36.pyc
3 @)�f�M � @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZmZ ddlmZmZ ddlmZmZmZmZ dd lmZmZmZm Z dd l m Z dd l m Z dd lm!Z! dd l"m#Z# G dd � d e�Z$G dd� de�Z%ddd�Z&ddd�Z'dS )�Zone� zone_reader� zone_writer� N)�config)� checkIPnMask� checkIP6nMask�checkInterface�uniqify�max_zone_name_len� u2b_if_py2� check_mac)�DEFAULT_ZONE_TARGET� ZONE_TARGETS)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�common_startElement�common_endElement�common_check_config� common_writer)�rich)�log)�errors)� FirewallErrorc sf e Zd ZdZd@dAdBdCdDd dgfd dEgfd dgfdFd dGgfddgfddgfddgfddgfddHgfdIdJfZdddgZddddgddgdgdgdddgdgdddd gddgdddddd gd gdd �Zdd ddgd gd!d"gd#d$gd%d&d'd#d(gd%d'd(gd)d*gd+gd,gd-� Zed.d/� �Z � fd0d1�Z d2d3� Z d4d5� Z � fd6d7�Z � fd8d9�Zd:d;� Z� fd<d=�Zd>d?� Z� ZS )Kr z Zone class �version� �short� description�UNUSEDF�target�services�ports� icmp_blocks� masquerade� forward_ports� interfaces�sources� rules_str� protocols� source_ports�icmp_block_inversion�forward�_�-�/N�name�port�protocol�value�set)r r �zone�servicer1 z icmp-blockz icmp-typer, z forward-port� interface�rule�source� destinationr2 z source-portr ZauditZaccept�rejectZdropZmark�limitzicmp-block-inversion� immutableZenabledzto-portzto-addr�familyZpriority�address�mac�invert�ipset�prefix�level�typeZburst) r5 r$ z forward-portr8 r9 r: r r; r< c C s8 x&t tj�D ]\}\}}|| kr |S q W ttjd��d S )Nz index_of())� enumerater �IMPORT_EXPORT_STRUCTUREr r Z UNKNOWN_ERROR)�element�iZelZdummy� rJ �/usr/lib/python3.6/zone.py�index_ofd s z Zone.index_ofc s� t t| �j� d| _d| _d| _d| _t| _g | _ g | _ g | _ g | _ d| _ d| _g | _g | _g | _g | _d | _g | _g | _d| _d| _d| _d S )Nr F)�superr �__init__r r r r r r r! r" r) r# r, r$ r% r* r& r' � fw_config�rulesr( r+ �combined�applied)�self)� __class__rJ rK rN k s, z Zone.__init__c C s� d| _ d| _d| _d| _t| _| jd d �= | jd d �= | jd d �= | j d d �= d| _ d| _ | j d d �= | j d d �= | jd d �= | jd d �= d | _| jd d �= | jd d �= d| _d| _d| _d S )Nr F)r r r r r r r! r" r) r# r, r$ r% r* r& r' rO rP r( r+ rQ rR )rS rJ rJ rK �cleanup� s* z Zone.cleanupc C s� t | j�| _t | j�| _t | j�| _t | j�| _dd� | jD �| _dd� | jD �| _dd� | jD �| _dd� | jD �| _dd� | j D �| _ dd� | j D �| _ dd� | j D �| _ d d� | j D �| _ d d� | j D �| _ d d� | jD �| _d S ) z� HACK. I haven't been able to make sax parser return strings encoded (because of python 2) instead of in unicode. Get rid of it once we throw out python 2 support.c S s g | ] }t |��qS rJ )r )�.0�srJ rJ rK � <listcomp>� s z'Zone.encode_strings.<locals>.<listcomp>c S s g | ]\}}t |�t |�f�qS rJ )r )rV �po�prrJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rZ rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rI rJ rJ rK rX � s c S s0 g | ](\}}}}t |�t |�t |�t |�f�qS rJ )r )rV Zp1Zp2Zp3Zp4rJ rJ rK rX � s c S s g | ]\}}t |�t |�f�qS rJ )r )rV rY rZ rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rI rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rW rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rW rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rW rJ rJ rK rX � s N)r r r r r r! r" r) r# r% r* r& r' rP r( )rS rJ rJ rK �encode_strings� s zZone.encode_stringsc sN |dkr8dd� |D �| _ tt| �j|dd� | j D �� ntt| �j||� d S )Nr( c S s g | ]}t j|d ��qS ))Zrule_str)r Z Rich_Rule)rV rW rJ rJ rK rX � s z$Zone.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS rJ )�str)rV rW rJ rJ rK rX � s )rP rM r � __setattr__)rS r0 r3 )rT rJ rK r] � s zZone.__setattr__c s t t| �j� }|d= |S )Nr )rM r �export_config_dict)rS Zconf)rT rJ rK r^ � s zZone.export_config_dictc C sL t | |||� |dkr.|tkr*ttj|���n|dkr�xl|D ]d}t|�sTttj|��| jr<xD| jj� D ]6}|| j krvqf|| jj |�j krfttjdj ||���qfW q<W n�|dk�rHx�|D ]�}t |� r�t|� r�t|� r�|jd� r�ttj|��| jr�xL| jj� D ]>}|| j k�r�q|| jj |�jk�rttjdj ||����qW q�W d S )Nr r& z)interface '{}' already bound to zone '{}'r' zipset:z&source '{}' already bound to zone '{}')r r r r �INVALID_TARGETr ZINVALID_INTERFACErO Z get_zonesr0 Zget_zoner& �formatr r r � startswith� INVALID_ADDRr' )rS r �itemZ all_configr7 r5 r9 rJ rJ rK � _check_config� s6 zZone._check_configc s� t t| �j|� |jd�r,ttjd| ��n�|jd�rHttjd| ��n�|jd�dkrhttjd| ��nnd|kr�|d |j d�� }n|}t |�t � kr�ttjd|t |�t � | j f ��| j r�|| j j� kr�ttjd��d S )Nr/ z'%s' can't start with '/'z'%s' can't end with '/'� zmore than one '/' in '%s'z'Zone of '%s' has %d chars, max is %d %sz+Zones can't have the same name as a policy.)rM r � check_namera r r � INVALID_NAME�endswith�count�find�lenr rQ rO Zget_policy_objectsZ NAME_CONFLICT)rS r0 Z checked_name)rT rJ rK rf � s, zZone.check_namec C s� d| _ d | _d| _d| _d| _x$|jD ]}|| jkr&| jj|� q&W x$|jD ]}|| jkrL| jj|� qLW x$|jD ]}|| jkrr| jj|� qrW x$|j D ]}|| j kr�| j j|� q�W x$|j D ]}|| j kr�| j j|� q�W x$|j D ]}|| j kr�| j j|� q�W |j �rd| _ |j �r d| _ x(|jD ] }|| jk�r&| jj|� �q&W x(|jD ] }|| jk�rP| jj|� �qPW x,|jD ]"} | jj| � | jjt| �� �qzW |j�r�d| _d S )NTr )rQ �filenamer r r r& �appendr' r! r" r) r# r, r$ r% r* rP r( r\ r+ ) rS r5 r7 r9 r6 r1 �protoZicmpr, r8 rJ rJ rK �combine� sL z Zone.combine)r r )r r )r r )r F)r r )r r )r$ F)r r r r )r r )r+ F)r, F)�__name__� __module__� __qualname__�__doc__rG ZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRS� staticmethodrL rN rU r[ r] r^ rd rf ro � __classcell__rJ rJ )rT rK r ( sx c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�zone_ContentHandlerc C s" t j| |� d | _d| _d | _d S )NF)r rN �_rule� _rule_errorZ _limit_ok)rS rc rJ rJ rK rN s z zone_ContentHandler.__init__c C s� t j| ||� | jrd S | jj||� t| ||�r6d S |dkr�d|krVtjd|d � d|krj|d | j_d|kr�tjd|d � d|kr�|d }|t kr�t t j |��|dkr�|t kr�|| j_�n�|d kr�| jjr�tjd � nd | j_�n�|d k�rh| j�rtjd � d | _d S d|k�r.tjd� d | _d S |d | jjk�rT| jjj|d � ntjd|d � �n8|dk�rf| j�r | jj�r�tjdt| j�� d | _d S d}d|k�r�|d j� d$k�r�d }d } }}d|k�r�|d }d|k�r�|d }d|k�r|d }tj||||d�| j_d S d|k�rBd|k�rBtjd� d S d|k�rdd|k�rdtjd� d S d |k�r~tjd |d � d|k�r�tjd � d S d|k�r�t|d � �r�t|d � �r�t|d � �r�t t j|d ��d|k�r$d |d }|| jj k�r| jj j|� ntjd |d � d|k�r�|d }|| jj k�rT| jj j|� ntjd |d � n:|d!k�r�| jj �r�tjd"� nd | j_ ntjd#|� d S d S )%Nr5 r0 z'Ignoring deprecated attribute name='%s'r r= z,Ignoring deprecated attribute immutable='%s'r r r, z Forward already set, ignoring.Tr7 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r9 z:Invalid rule: More than one source in rule '%s', ignoring.FrA �yes�truer? r@ rB )rA z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.r> z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.zicmp-block-inversionz+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s')ry rz ) r � startElementrx rc Zparser_check_element_attrsr r Zwarningr r r r r_ r r r, rw r& rm r9 r\ �lowerr Z Rich_Sourcer r r rb r' r+ ) rS r0 �attrsr rA Zaddrr@ rB �entryrJ rJ rK r{ & s� z zone_ContentHandler.startElementc C s t j| |� t| |� d S )N)r � endElementr )rS r0 rJ rJ rK r � s z zone_ContentHandler.endElementN)rp rq rr rN r{ r rJ rJ rJ rK rv s prv Fc C s t � }| jd�s ttjd| ��| d d � |_|s>|j|j� | |_||_|j t j �rZdnd|_ |j |_ t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk r� } zttjd| j� ��W Y d d } ~ X nX W d Q R X ~~t�r|j� |S ) Nz.xmlz'%s' is missing .xml suffix� FTz%s/%s�rbznot a valid zone file: %s���)r rh r r rg r0 rf rl �pathra r � ETC_FIREWALLDZbuiltin�defaultrv �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZ INVALID_ZONEZ getExceptionr r[ ) rl r� Z no_check_namer5 �handler�parserr0 �fr9 �msgrJ rJ rK r � s: (c C s\ |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk r� } ztj d||� W Y d d }~X nX tj j |�}|j t j �r�tj j|� r�tj jt j �s�tjt j d� tj|d� tj|ddd�}t|�}|j� i }| j�r| jd k�r| j|d < | jtk�r*| j|d < |jd |� |jd � t| |� x8t| j�D ]*} |jd� |jdd| i� |jd � �qVW x\t| j �D ]N} |jd� d| k�r�|jdd| dd � i� n|jdd| i� |jd � �q�W | j �r |jd� |jdi � |jd � | j �r2|jd� |jdi � |jd � |j d � |jd � |j � |j!� ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r5 � z r7 r0 zipset:r9 rB � r? zicmp-block-inversionr, )"r� rl r0 �os�exists�shutilZcopy2� Exceptionr �error�dirnamera r r� �mkdir�ior� r Z startDocumentr r r r{ ZignorableWhitespacer r r& Z simpleElementr' r+ r, r Z endDocument�close) r5 r� �_pathr0 r� �dirpathr� r� r} r7 r9 rJ rJ rK r � s` )F)N)(�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r r r Zfirewall.core.baser r Zfirewall.core.io.io_objectr r r r Zfirewall.core.io.policyr r r r Z firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r rv r r rJ rJ rJ rK �<module> s$ $ x|