Edit File: smtp_blocking.cpython-311.opt-1.pyc
� P6h@B � �& � d Z ddlZddlZddlZddlZddlmZ ddlmZm Z m Z mZ ddlm c mZ ddlmZmZ ddlmZ ddlmZ ddlmZ dd lmZ dd lmZmZmZmZ ddlmZm Z ddl!m"Z" g d �Z#ddl$m%Z% edde&fde&fde&fg� � Z' edde&fde(fde)fde)fde&fde&fg� � Z*dZ+dZ, ej- e.� � Z/dZ0dZ1de e2 fd�Z3d � Z4d!� Z5 G d"� d#e�$� � Zd%e fd&�Z6d'� Z7d(� Z8 ed)�*� � d+� � � Z9d,e*fd-�Z:d,e(fd.�Z;d,e&fd/�Z<dS )0zs This module contains utilities to work with iptables to block SMTP traffic on the server akin to how CSF does it. � N)�suppress)� Generator�List�Tuple� NamedTuple)� Singleton�async_lru_cache)� Protector)�SMTPBlocking)�UnifiedAccessLogger)�ip_versions)� FirewallRules�firewall_logging_enabled�get_firewall�is_nat_available)� FirewallError�FirewallBatchCommandError)� hosting_panel)�sync_rules_for_all_versions�reset_rules_for_all_versions�is_SMTP_blocking_supported�read_SMTP_settings�get_active_settings_list�conflicts_exist)� IPVersion� TableState�chain_exists�chain_referenced�rules_ok�SMTPSettings�enabled�ports�allow_users�allow_groups�allow_local�redirectTi, �filter�nat�commandsc � �l K � |sdS | � |� � � d{V �� dS # t $ r Y dS w xY w)z� Use a non-zero return code of iptables as an indication of a failed check. An empty check command list is treated as a failure. Note: Should be called as close to the public functions as possible, since it has side effects. FNT)�commitr )�firewallr) s �O/opt/imunify360/venv/lib/python3.11/site-packages/im360/subsys/smtp_blocking.py�_true_on_successr. F si � � � � � ��u���o�o�h�'�'�'�'�'�'�'�'�'� �t�� � � � ��u�u����s �% � 3�3c # � K � | D ]I} t j |� � j V � �# t $ r t � d|� � Y �Fw xY wdS )z:Obtain UIDs of specified users skipping non-existing ones.zUNIX user %s does not existN)�pwd�getpwnam�pw_uid�KeyError�logger�warning)� usernames�users r- � _get_uidsr8 Z su � � � �� � �� ��,�t�$�$�+�+�+�+�+��� � � ��N�N�8�$�?�?�?��H� ����� � �$�%A�Ac # � K � | D ]I} t j |� � j V � �# t $ r t � d|� � Y �Fw xY wdS )z;Obtain GIDs of specified groups skipping non-existing ones.zUNIX group %s does not existN)�grp�getgrnam�gr_gidr3 r4 r5 )�groups�groups r- � _get_gidsr@ d su � � � �� � �� ��,�u�%�%�,�,�,�,�,��� � � ��N�N�9�5�A�A�A��H� ����� r9 c �" � e Zd ZdZdZdefZdefd�Zdee e df fd�Zdee e df fd �Zd e de fd�Zd� Zd � Zdee fd�Zdeee ddf fd�Zdedefd�Zd e defd�Zd e fd�Zd e fd�Zddd�Zdd�ZdS )r z� This class is used to synchronise iptables rules related to outgoing SMTP traffic blocking with SMTP_BLOCKING section of imunify config. �OUTPUT_imunify360_SMTP�-j� ip_versionc �n � || _ d | _ d | _ d| _ t j � � | _ d S )NF)rD �_candidate_settings�active_settings�rules_were_resetr �HostingPanel�_hosting_panel)�selfrD s r- �__init__zSMTPBlocking.__init__w s8 � �$���#'�� �#��� %���+�8�:�:����� �return.c �R �� | j j sg S g }dddddd� d� | j j D � � � � f�| j j r*|� g ��d�d �d �t j �R � � |� g ��d�d�d�d �d �t j �R � � |� �fd�t t j | j j | j j � � � � D � � � � |� �fd�t | j j � � D � � � � t! � � rb|� g ��t j t j t j | j � � t* j �� � �� � �R � � | j j r | j j rt1 | j � � sY|� g ��d �t j �d�d� | j t6 j j k rdnd� � �R � � |S )z� Return a list of rules that should be used in OUTPUT_imunify360_SMTP chain. These can either be installed using append_rule / insert_rule or checked using has_rule methods of the firewall interface. �-p�tcp�-m� multiport�--dports�,c 3 �4 K � | ]}t |� � V � �d S �N��str��.0�ps r- � <genexpr>z6SMTPBlocking._get_filter_smtp_rules.<locals>.<genexpr>� �( � � � �D�D��S��V�V�D�D�D�D�D�DrM �-o�lorC �owner�--uid-owner�0c 3 �h �K � | ],}g ��d �d�d�t |� � �d�t j �R V � �-dS �rR ra rb rC N�rY r �ACCEPT�r[ �uid�common_argss �r- r] z6SMTPBlocking._get_filter_smtp_rules.<locals>.<genexpr>� � �� � � � � � � �� �� � � � � � �C��� � � � �$� � � � � � � � rM c 3 �h �K � | ],}g ��d �d�d�t |� � �d�t j �R V � �-dS �rR ra z--gid-ownerrC Nrf �r[ �gidrj s �r- r] z6SMTPBlocking._get_filter_smtp_rules.<locals>.<genexpr>� � �� � � � � � � �� �� � � � � � �C��� � � � �$� � � � � � � � rM )r? �prefix)�actionz --reject-withzicmp{}-port-unreachable�6� )rF r"