Edit File: rich.cpython-36.pyc
3 Y e�y � @ s� d ddddddddd d d d d ddddgZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd � d e �Z G dd� de �Z G dd� de �Z G dd� de �ZG d d� de�ZG d d� de �ZG d d� de �ZG d d� de �ZG d d� de �ZG d!d � d e �ZG d"d � d e �ZG d#d � d e �ZG d$d � d e �ZG d%d � d e �ZG d&d� de�ZG d'd� de �ZG d(d� de �ZG d)d� de �Z d*S )+� Rich_Source�Rich_Destination� Rich_Service� Rich_Port� Rich_Protocol�Rich_Masquerade�Rich_IcmpBlock� Rich_IcmpType�Rich_SourcePort�Rich_ForwardPort�Rich_Log� Rich_Audit� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� Rich_Limit� Rich_Rule� )� functions)�check_ipset_name)� REJECT_TYPES)�errors)� FirewallErrorc @ s e Zd Zddd�Zdd� ZdS )r Fc C s� || _ | j dkrd | _ || _| jdks0| jd kr8d | _n| jd k rN| jj� | _|| _| jdkrdd | _|| _| j d kr�| jd kr�| jd kr�ttjd��d S )N� zno address, mac and ipset)�addr�mac�upper�ipset�invertr r � INVALID_RULE)�selfr r r r � r! �/usr/lib/python3.6/rich.py�__init__$ s zRich_Source.__init__c C sj d| j r dnd }| jd k r*|d| j S | jd k rB|d| j S | jd k rZ|d| j S ttjd��d S )Nz source%s z NOTr z address="%s"zmac="%s"z ipset="%s"zno address, mac and ipset)r r r r r r r )r �retr! r! r" �__str__5 s zRich_Source.__str__N)F)�__name__� __module__� __qualname__r# r% r! r! r! r" r # s c @ s e Zd Zddd�Zdd� ZdS )r Fc C s || _ || _d S )N)r r )r r r r! r! r" r# B s zRich_Destination.__init__c C s d| j r dnd| jf S )Nzdestination %saddress="%s"znot r )r r )r r! r! r" r% F s zRich_Destination.__str__N)F)r& r' r( r# r% r! r! r! r" r A s c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S )N)�name)r r) r! r! r" r# K s zRich_Service.__init__c C s d| j S )Nzservice name="%s")r) )r r! r! r" r% N s zRich_Service.__str__N)r& r' r( r# r% r! r! r! r" r J s c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ || _d S )N)�port�protocol)r r* r+ r! r! r" r# R s zRich_Port.__init__c C s d| j | jf S )Nz port port="%s" protocol="%s")r* r+ )r r! r! r" r% V s zRich_Port.__str__N)r& r' r( r# r% r! r! r! r" r Q s c @ s e Zd Zdd� ZdS )r c C s d| j | jf S )Nz#source-port port="%s" protocol="%s")r* r+ )r r! r! r" r% Z s zRich_SourcePort.__str__N)r& r' r( r% r! r! r! r" r Y s c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S )N)�value)r r, r! r! r" r# _ s zRich_Protocol.__init__c C s d| j S )Nzprotocol value="%s")r, )r r! r! r" r% b s zRich_Protocol.__str__N)r& r' r( r# r% r! r! r! r" r ^ s c @ s e Zd Zdd� Zdd� ZdS )r c C s d S )Nr! )r r! r! r" r# f s zRich_Masquerade.__init__c C s dS )N� masquerader! )r r! r! r" r% i s zRich_Masquerade.__str__N)r& r' r( r# r% r! r! r! r" r e s c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S )N)r) )r r) r! r! r" r# m s zRich_IcmpBlock.__init__c C s d| j S )Nzicmp-block name="%s")r) )r r! r! r" r% p s zRich_IcmpBlock.__str__N)r& r' r( r# r% r! r! r! r" r l s c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S )N)r) )r r) r! r! r" r# t s zRich_IcmpType.__init__c C s d| j S )Nzicmp-type name="%s")r) )r r! r! r" r% w s zRich_IcmpType.__str__N)r& r' r( r# r% r! r! r! r" r s s c @ s e Zd Zdd� Zdd� ZdS )r c C s< || _ || _|| _|| _| jd kr(d| _| jd kr8d| _d S )Nr )r* r+ �to_port� to_address)r r* r+ r. r/ r! r! r" r# { s zRich_ForwardPort.__init__c C s< d| j | j| jdkr d| j nd| jdkr4d| j ndf S )Nz(forward-port port="%s" protocol="%s"%s%sr z to-port="%s"z to-addr="%s")r* r+ r. r/ )r r! r! r" r% � s zRich_ForwardPort.__str__N)r& r' r( r# r% r! r! r! r" r z s c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ || _|| _d S )N)�prefix�level�limit)r r0 r1 r2 r! r! r" r# � s zRich_Log.__init__c C s> d| j rd| j nd| jr$d| j nd| jr6d| j ndf S )Nz log%s%s%sz prefix="%s"r z level="%s"z %s)r0 r1 r2 )r r! r! r" r% � s zRich_Log.__str__)NNN)r& r' r( r# r% r! r! r! r" r � s c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ d S )N)r2 )r r2 r! r! r" r# � s zRich_Audit.__init__c C s d| j rd| j nd S )Nzaudit%sz %sr )r2 )r r! r! r" r% � s zRich_Audit.__str__)N)r& r' r( r# r% r! r! r! r" r � s c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ d S )N)r2 )r r2 r! r! r" r# � s zRich_Accept.__init__c C s d| j rd| j nd S )Nzaccept%sz %sr )r2 )r r! r! r" r% � s zRich_Accept.__str__)N)r& r' r( r# r% r! r! r! r" r � s c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S )N)�typer2 )r Z_typer2 r! r! r" r# � s zRich_Reject.__init__c C s, d| j rd| j nd| jr$d| j ndf S )Nz reject%s%sz type="%s"r z %s)r3 r2 )r r! r! r" r% � s zRich_Reject.__str__c C sT | j rP|sttjd��|dkrP| j t| krPdjt| �}ttjd| j |f ��d S )Nz9When using reject type you must specify also rule family.�ipv4�ipv6z, z%Wrong reject type %s. Use one of: %s.)r4 r5 )r3 r r r r �join)r �familyZ valid_typesr! r! r" �check� s zRich_Reject.check)NN)r& r' r( r# r% r8 r! r! r! r" r � s c @ s e Zd Zdd� ZdS )r c C s d| j rd| j nd S )Nzdrop%sz %sr )r2 )r r! r! r" r% � s zRich_Drop.__str__N)r& r' r( r% r! r! r! r" r � s c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S )N)�setr2 )r Z_setr2 r! r! r" r# � s zRich_Mark.__init__c C s d| j | jrd| j ndf S )Nz mark set=%s%sz %sr )r9 r2 )r r! r! r" r% � s zRich_Mark.__str__c C s� | j d k r| j }n ttjd��d|krv|jd�}t|�dkrHttj|��tj|d � shtj|d � r�ttj|��ntj|�s�ttj|��d S )Nz no value set�/� r � )r9 r r Z INVALID_MARK�split�lenr Z checkUINT32)r �x�splitsr! r! r" r8 � s zRich_Mark.check)N)r& r' r( r# r% r8 r! r! r! r" r � s c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) r c C sV || _ d| j krR| j jd�}t|�dkrR|d d krRd|d |d d d� f | _ d S ) Nr: r; r< �second�minute�hour�dayz%s/%sr )rA rB rC rD )r, r= r> )r r, r@ r! r! r" r# � s zRich_Limit.__init__c C s d }d| j kr| j jd�}| s,t|�dkr:ttj| j ��|\}}y t|�}W n ttj| j ��Y nX |dk sz|dkr�ttj| j ��d}|dkr�d}n(|dkr�d}n|dkr�d}n |dkr�d}d | | d kr�ttjd | j ��|dk�r |dk�r ttjd | j ��d S )Nr: r; r< �s�m�h�d�< � i' r z %s too fastz %s too slow)rE rF rG rH i i� i�Q )r, r= r> r r Z INVALID_LIMIT�int)r r@ ZrateZdurationZmultr! r! r" r8 � s6 zRich_Limit.checkc C s d| j S )Nzlimit value="%s")r, )r r! r! r" r% s zRich_Limit.__str__c C s dS )Nr r! )r r! r! r" �command s zRich_Limit.commandN)r& r' r( r# r8 r% rL r! r! r! r" r � s "c @ s> e Zd ZdZdZddd�Zdd� Zd d � Zd d � Zd d� Z dS )r i � i� Nr c C sV |d k rt |�| _nd | _|| _d | _d | _d | _d | _d | _d | _|rR| j |� d S )N) �strr7 �priority�source� destination�element�log�audit�action�_import_from_string)r r7 �rule_strrN r! r! r" r# s zRich_Rule.__init__c C s� g }x|t j|�D ]n}d|krp|jd�}t|�dksF|d sF|d rVttjd| ��|j|d |d d�� q|jd|i� qW |jddi� |S ) z Lexical analysis �=r; r r< z internal error in _lexer(): %s)� attr_name� attr_valuerQ �EOL)r Z splitArgsr= r> r r r �append)r rV �tokens�r�attrr! r! r" �_lexer! s zRich_Rule._lexerc C s� |st tjd��tj|�}d| _d | _d | _d | _d | _ d | _ d | _ d | _ | j |�}|rv|d jd�dkrvt tjd��i }g }d}�x|| jd�dko�|dgk�s�|| jd�}|| jd�}|| jd�}|� r�|dDk�r�t tjd| ��� n�|dEk�r�|dk�r | j�r t tjd*��n�|dk�r<| j�r<t tjd+��n�|dFk�rf| j �rft tjd,|| j f ��nh|d!k�r�| j �r�t tjd-��nH|d"k�r�| j �r�t tjd.��n(|dGk�r�| j �r�t tjd/|| j f ��nt tjd0| ��t|�dk�r�|t|�d1 nd2} | d2k�r�| �r`|�r`|d k�r2t tjd3��n,|dk�rJt tjd4��nt tjd5||f ��n*d|k�r�t tjd6||f ��n |jd� �n�| dk�rD|d k�r�|dHk�r�t tjd9| ��|| _n||dk�ryt|�| _W n& tk �r t tjd:| ��Y nX n:|�r6|dk�r d;} n d<||f } t tj| ��n |j|� �nH| dk�r�|dIk�rb|||< nV|dJk�rvd=|d < nBt|jd �|jd �|jd �|jd d>��| _|j� |j� |d1 }�n�| dk�r"|dKk�r�|||< nD|dLk�r�d=|d < n0t|jd �|jd ��| _|j� |j� |d1 }�nj| dk�rZ|dk�rJt|�| _ |j� n t tjd?���n2| dk�r�|dk�r�t|�| _ |j� n t tjd@���n�| dk�r�|dMk�r�|||< n0t|jd�|jd��| _ |j� |j� |d1 }�n�| d k�r |dk�r t|�| _ |j� n t tjdA���np| d k�rT|dk�rDt |�| _ |j� n t tjdB���n8| d k�r�t � | _ |j� |j� |d1 }�n | d k�r�|dNk�r�|||< n@t |jd�|jd�|jd�|jd��| _ |j� |j� |d1 }�n�| d k�r6|dOk�r|||< n0t |jd�|jd��| _ |j� |j� |d1 }�nV| d!k�r�|dPk�rT|||< nN|d'k�rj|jd'� n8t |jd�|jd�|jd'��| _ |j� |j� |d1 }�n�| d"k�r�|d'k�r�|jd'� n(t!|jd'��| _ |j� |j� |d1 }�n�| d#k�r>|d'k�r|jd'� n(t"|jd'��| _ |j� |j� |d1 }�nN| d$k�r�|d'k�r^|jd'� n(t#|jd'��| _ |j� |j� |d1 }�n| d%k�r�|dk�r�|||< nF|d'k�r�|jd'� n0t$|jd�|jd'��| _ |j� |j� |d1 }n�| d&k�rV|dk�r|||< nF|d'k�r$|jd'� n0t%|jd�|jd'��| _ |j� |j� |d1 }n6| d'k�r�|dk�r�t&|�|d'< |j� n t tjdC��|d1 }q�W | j'� d S )QNz empty ruler rQ rZ �rulerX rY rN r7 �addressr r r r, r* r+ �to-port�to-addrr) r0 r1 r3 r9 zbad attribute '%s'rO rP �service� icmp-block� icmp-typer- � forward-port� source-portrR rS �accept�drop�reject�markr2 �not�NOTz more than one 'source' elementz#more than one 'destination' elementzFmore than one element. There cannot be both '%s' and '%s' in one rule.zmore than one 'log' elementz more than one 'audit' elementzOmore than one 'action' element. There cannot be both '%s' and '%s' in one rule.zunknown element %sr< r z0'family' outside of rule. Use 'rule family=...'.z4'priority' outside of rule. Use 'rule priority=...'.z:'%s' outside of any element. Use 'rule <element> %s= ...'.z,'%s' outside of rule. Use 'rule ... %s ...'.r4 r5 zH'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead.z(invalid 'priority' attribute value '%s'.zdwrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'.zDattribute '%s' outside of any element. Use 'rule <element> %s= ...'.TFzinvalid 'protocol' elementzinvalid 'service' elementz invalid 'icmp-block' elementzinvalid 'icmp-type' elementzinvalid 'limit' element)rN r7 ra r r r r, r* r+ rb rc r) r0 r1 r3 r9 )r` rO rP r+ rd r* re rf r- rg rh rR rS ri rj rk rl r2 rm rn rZ )r+ rd r* re rf r- rg rh )ri rj rk rl )r4 r5 )ra r r r )rm rn )ra r )rm rn )r* r+ )r* r+ rb rc )r* r+ )r0 r1 )(r r r r ZstripNonPrintableCharactersrN r7 rO rP rQ rR rS rT r_ �getr> r[ rK � ValueError�INVALID_PRIORITYr �pop�clearr r r r r r r r r r r r r r r r r8 ) r rV r\ ZattrsZ in_elements�indexrQ rX rY Z in_elementZerr_msgr! r! r" rU 2 s� " " * ( z Rich_Rule._import_from_stringc C s | j d k r"| j d kr"ttj| j ��| j d krn| jd k rB| jjd k sL| jd k rVttj��t| j �t krnttj��| j | j k s�| j | j kr�ttjd| j | j f ��| j d ko�| jd ks�| jd k o�| j dk�r | jd kr�ttjd��| jd ko�| jd ko�| j dk�r ttjd��t| j �tt tgk�rP| jd k�rP| jd k�rP| jd k�rPttjd��| jd k �rj| jjd k �r�| j d k�r�ttj��| jjd k �r�ttjd��| jjd k �r�ttjd ��tj| j | jj��sjttjt| jj���n�| jjd k �r,| jjd k �rttjd ��tj| jj��sjttj t| jj���n>| jjd k �r^t | jj��sjttj t| jj���n ttjd ��| jd k �r�| j d k�r�ttj��| jjd k�s�tj| j | jj� �r�ttjt| jj���t| j �t k�r | j j d k�s�t!| j j �d k �rttj"t| j j ����n�t| j �t#k�r^tj$| j j%��s<ttj&| j j%��| j j'd k�rttj(| j j'���n�t| j �t)k�r�tj*| j j+��sttj(| j j+���nvt| j �tk�r�| jd k �r�ttjd��| jd k �r| jjd k �rttjd���n$t| j �tk�r@| j j d k�st!| j j �d k �r(ttj,t| j j ���| j�rttjd���n�t| j �t-k�r�| j j d k�spt!| j j �d k �rttj,t| j j ����n�t| j �t k�r�tj$| j j%��s�ttj&| j j%��| j j'd!k�r�ttj(| j j'��| j j.dk�r| j j/dk�rttj&| j j.��| j j.dk�r2tj$| j j.� �r2ttj&| j j.��| j j/dk�rftj0| j | j j/� �rfttj| j j/��| j d k�r|ttj��| jd k �rttjd��nrt| j �t1k�r�tj$| j j%��s�ttj&| j j%��| j j'd"k�rttj(| j j'��n"| j d k �rttjdt| j � ��| jd k �rV| jj2�r<| jj2d#k�r<ttj3| jj2��| jj4d k �rV| jj4j5� | jd k �r�t| j�t6t7t8gk�r�ttj9t| j���| jj4d k �r�| jj4j5� | jd k �rt| j�t7k�r�| jj5| j � nt| j�t:k�r�| jj5� | jj4d k �r| jj4j5� d S )$Nr4 r5 z/'priority' attribute must be between %d and %d.r zno element, no actionz%no element, no source, no destinationzno action, no log, no auditzaddress and maczaddress and ipsetz mac and ipsetzinvalid sourcer< �tcp�udp�sctp�dccpzmasquerade and actionzmasquerade and mac sourcezicmp-block and actionr zforward-port and actionzUnknown element %s�emerg�alert�crit�error�warning�notice�info�debug)r4 r5 )ru rv rw rx )ru rv rw rx )ru rv rw rx )ry rz r{ r| r} r~ r r� );r7 r r ZINVALID_FAMILYrO r rP ZMISSING_FAMILYr3 rQ r rN � priority_min� priority_maxrq rR rT r r r rS r r r Z check_addressZ INVALID_ADDRrM Z check_macZ INVALID_MACr Z INVALID_IPSETr r) r> ZINVALID_SERVICEr Z check_portr* Z INVALID_PORTr+ ZINVALID_PROTOCOLr Z checkProtocolr, ZINVALID_ICMPTYPEr r. r/ Zcheck_single_addressr r1 ZINVALID_LOG_LEVELr2 r8 r r r ZINVALID_AUDIT_TYPEr )r r! r! r" r8 s� zRich_Rule.checkc C s� d}| j r|d| j 7 }| jr,|d| j 7 }| jr@|d| j 7 }| jrT|d| j 7 }| jrh|d| j 7 }| jr||d| j 7 }| jr�|d| j 7 }| jr�|d| j 7 }tj r�tj |�S |S )Nr` z priority="%d"z family="%s"z %s) rN r7 rO rP rQ rR rS rT r ZPY2Zu2b)r r$ r! r! r" r% � s$ zRich_Rule.__str__i ���)NNr ) r& r' r( r� r� r# r_ rU r8 r% r! r! r! r" r s f %N) �__all__Zfirewallr Zfirewall.core.ipsetr Zfirewall.core.baser r Zfirewall.errorsr �objectr r r r r r r r r r r r r r r r r r r! r! r! r" �<module> s8 1