a F‡©jK‰ã@sˆgd¢ZddlmZddlmZddlmZddlmZddlm Z Gdd„de ƒZ Gd d „d e ƒZ Gd d „d e ƒZ Gd d„de ƒZGdd„deƒZGdd„de ƒZGdd„de ƒZGdd„de ƒZGdd„de ƒZGdd„de ƒZGdd„de ƒZGdd„de ƒZGdd „d e ƒZGd!d"„d"e ƒZGd#d$„d$e ƒZGd%d&„d&e ƒZGd'd(„d(eƒZGd)d*„d*e ƒZGd+d,„d,e ƒZGd-d.„d.e ƒZd/S)0)Ú Rich_SourceÚRich_DestinationÚ Rich_ServiceÚ Rich_PortÚ Rich_ProtocolÚRich_MasqueradeÚRich_IcmpBlockÚ Rich_IcmpTypeÚRich_SourcePortÚRich_ForwardPortÚRich_LogÚ Rich_NFLogÚ Rich_AcceptÚ Rich_RejectÚ Rich_DropÚ Rich_MarkÚ Rich_AuditÚ Rich_LimitÚ Rich_RuleÚRich_Tcp_Mss_Clampé)Ú functions)Úcheck_ipset_name)Ú REJECT_TYPES)Úerrors)Ú FirewallErrorc@seZdZddd„Zdd„ZdS)rFcCs˜||_|jdkrd|_||_|jdks0|jdur8d|_n|jdurN|j ¡|_||_|jdkrdd|_||_|jdur”|jdur”|jdur”ttjdƒ‚dS)NÚúno address, mac and ipset)ÚaddrÚmacÚupperÚipsetÚinvertrrÚ INVALID_RULE)Úselfrrr r!©r$ú6/usr/lib/python3.9/site-packages/firewall/core/rich.pyÚ__init__$s     ÿzRich_Source.__init__cCsjd|jr dnd}|jdur*|d|jS|jdurB|d|jS|jdurZ|d|jSttjdƒ‚dS)Nz source%s ú NOTrú address="%s"zmac="%s"ú ipset="%s"r)r!rrr rrr"©r#Úretr$r$r%Ú__str__5s   ÿzRich_Source.__str__N)F©Ú__name__Ú __module__Ú __qualname__r&r,r$r$r$r%r#s rc@seZdZddd„Zdd„ZdS)rFcCsV||_|jdkrd|_||_|jdkr,d|_||_|jdurR|jdurRttjdƒ‚dS)Nrúno address and ipset)rr r!rrr")r#rr r!r$r$r%r&As  ÿzRich_Destination.__init__cCsRd|jr dnd}|jdur*|d|jS|jdurB|d|jSttjdƒ‚dS)Nzdestination%s r'rr(r)r1)r!rr rrr"r*r$r$r%r,Ms  ÿzRich_Destination.__str__N)Fr-r$r$r$r%r@s rc@seZdZdd„Zdd„ZdS)rcCs ||_dS©N©Úname©r#r4r$r$r%r&WszRich_Service.__init__cCs d|jS)Nzservice name="%s"r3©r#r$r$r%r,ZszRich_Service.__str__Nr-r$r$r$r%rVsrc@seZdZdd„Zdd„ZdS)rcCs||_||_dSr2©ÚportÚprotocol)r#r8r9r$r$r%r&^szRich_Port.__init__cCsd|j|jfS)Nzport port="%s" protocol="%s"r7r6r$r$r%r,bszRich_Port.__str__Nr-r$r$r$r%r]src@seZdZdd„ZdS)r cCsd|j|jfS)Nz#source-port port="%s" protocol="%s"r7r6r$r$r%r,fsÿzRich_SourcePort.__str__N©r.r/r0r,r$r$r$r%r esr c@seZdZdd„Zdd„ZdS)rcCs ||_dSr2©Úvalue©r#r<r$r$r%r&kszRich_Protocol.__init__cCs d|jS)Nzprotocol value="%s"r;r6r$r$r%r,nszRich_Protocol.__str__Nr-r$r$r$r%rjsrc@seZdZdd„Zdd„ZdS)rcCsdSr2r$r6r$r$r%r&rszRich_Masquerade.__init__cCsdS)NÚ masquerader$r6r$r$r%r,uszRich_Masquerade.__str__Nr-r$r$r$r%rqsrc@seZdZdd„Zdd„ZdS)rcCs ||_dSr2r3r5r$r$r%r&yszRich_IcmpBlock.__init__cCs d|jS)Nzicmp-block name="%s"r3r6r$r$r%r,|szRich_IcmpBlock.__str__Nr-r$r$r$r%rxsrc@seZdZdd„Zdd„ZdS)rcCs ||_dSr2r3r5r$r$r%r&€szRich_IcmpType.__init__cCs d|jS)Nzicmp-type name="%s"r3r6r$r$r%r,ƒszRich_IcmpType.__str__Nr-r$r$r$r%rsrc@seZdZdd„Zdd„ZdS)rcCs ||_dSr2r;r=r$r$r%r&‡szRich_Tcp_Mss_Clamp.__init__cCs|jrd|jSdSdS)Nztcp-mss-clamp value="%s"ú tcp-mss-clampr;r6r$r$r%r,Šs zRich_Tcp_Mss_Clamp.__str__Nr-r$r$r$r%r†src@seZdZdd„Zdd„ZdS)r cCs<||_||_||_||_|jdur(d|_|jdur8d|_dS©Nr©r8r9Úto_portÚ to_address)r#r8r9rBrCr$r$r%r&‘s  zRich_ForwardPort.__init__cCs<d|j|j|jdkrd|jnd|jdkr4d|jndfS)Nz(forward-port port="%s" protocol="%s"%s%srz to-port="%s"z to-addr="%s"rAr6r$r$r%r,œs þÿzRich_ForwardPort.__str__Nr-r$r$r$r%r �s r c@s&eZdZddd„Zdd„Zdd„ZdS) r NcCs||_||_||_dSr2©ÚprefixÚlevelÚlimit)r#rErFrGr$r$r%r&£szRich_Log.__init__cCs>d|jrd|jnd|jr$d|jnd|jr6d|jndfS)Nz log%s%s%sú prefix="%s"rz level="%s"ú %srDr6r$r$r%r,©s þÿzRich_Log.__str__cCsV|jr t|jƒdkr ttjdƒ‚|jr>|jdvr>ttj|jƒ‚|jdurR|j ¡dS)Néú+maximum accepted length of 'prefix' is 127.)ZemergZalertZcritÚerrorZwarningZnoticeÚinfoÚdebug) rEÚlenrrÚINVALID_LOG_PREFIXrFZINVALID_LOG_LEVELrGÚcheckr6r$r$r%rQ¯s ÿ zRich_Log.check)NNN©r.r/r0r&r,rQr$r$r$r%r ¢s r c@s&eZdZddd„Zdd„Zdd„ZdS) r NcCs||_||_||_||_dSr2©ÚgrouprEÚ thresholdrG)r#rTrEZ queue_sizerGr$r$r%r&¼szRich_NFLog.__init__cCsPd|jrd|jnd|jr$d|jnd|jr6d|jnd|jrHd|jndfS)Nz nflog%s%s%s%sz group="%s"rrHz queue-size="%s"rIrSr6r$r$r%r,ÂsýÿzRich_NFLog.__str__cCst|jrt |j¡sttjdƒ‚|jr>t|jƒdkr>ttjdƒ‚|j r\t |j ¡s\ttj dƒ‚|j durp|j   ¡dS)Nz5nflog 'group' must be an integer between 0 and 65535.rJrKz:nflog 'queue-size' must be an integer between 0 and 65535.) rTrZ checkUINT16rrZINVALID_NFLOG_GROUPrErOrPrUZINVALID_NFLOG_QUEUErGrQr6r$r$r%rQÉs    zRich_NFLog.check)NNNNrRr$r$r$r%r »s r c@seZdZddd„Zdd„ZdS)rNcCs ||_dSr2©rG©r#rGr$r$r%r&×szRich_Audit.__init__cCsd|jrd|jndS)Nzaudit%srIrrVr6r$r$r%r,ÛszRich_Audit.__str__)Nr-r$r$r$r%rÖs rc@seZdZddd„Zdd„ZdS)r NcCs ||_dSr2rVrWr$r$r%r&ßszRich_Accept.__init__cCsd|jrd|jndS)Nzaccept%srIrrVr6r$r$r%r,âszRich_Accept.__str__)Nr-r$r$r$r%r Þs r c@s&eZdZddd„Zdd„Zdd„ZdS) rNcCs||_||_dSr2©ÚtyperG)r#Z_typerGr$r$r%r&æszRich_Reject.__init__cCs,d|jrd|jnd|jr$d|jndfS)Nz reject%s%sz type="%s"rrIrXr6r$r$r%r,êsÿzRich_Reject.__str__cCsT|jrP|sttjdƒ‚|dvrP|jt|vrPd t|¡}ttjd|j|fƒ‚dS)Nz9When using reject type you must specify also rule family.©Zipv4Zipv6z, z%Wrong reject type %s. Use one of: %s.)rYrrr"rÚjoin)r#ÚfamilyZ valid_typesr$r$r%rQîs  ÿzRich_Reject.check)NNrRr$r$r$r%rås rc@seZdZdd„ZdS)rcCsd|jrd|jndS)Nzdrop%srIrrVr6r$r$r%r,øszRich_Drop.__str__Nr:r$r$r$r%r÷src@s&eZdZddd„Zdd„Zdd„ZdS) rNcCs||_||_dSr2©ÚsetrG)r#Z_setrGr$r$r%r&ýszRich_Mark.__init__cCsd|j|jrd|jndfS)Nz mark set=%s%srIrr]r6r$r$r%r,sÿzRich_Mark.__str__cCsŒ|jdur|j}n ttjdƒ‚d|vrr| d¡}t|ƒdkrHttj|ƒ‚t |d¡rdt |d¡sˆttj|ƒ‚nt |¡sˆttj|ƒ‚dS)Nz no value setú/éré)r^rrZ INVALID_MARKÚsplitrOrZ checkUINT32)r#ÚxÚsplitsr$r$r%rQs      ÿ zRich_Mark.check)NrRr$r$r$r%rüs rc@s,eZdZdd„Zdd„Zdd„Zdd„Zd S) rcCsV||_d|jvrR|j d¡}t|ƒdkrR|ddvrRd|d|ddd…f|_dS)Nr_r`ra)ÚsecondZminuteZhourZdayz%s/%sr)r<rbrO)r#r<rdr$r$r%r&s    ÿzRich_Limit.__init__cCs d}d|jvr|j d¡}|r*t|ƒdkr8ttj|jƒ‚|\}}z t|ƒ}Wnttj|jƒ‚Yn0|dksx|dvr†ttj|jƒ‚d}|dkr˜d}n(|dkr¦d}n|dkr´d }n |d krÀd }d ||d krâttjd|jƒ‚|dk�r|d k�rttjd|jƒ‚dS)Nr_r`ra)ÚsÚmÚhÚdrfrgé<rhirii€Qi'rz %s too fastz %s too slow)r<rbrOrrZ INVALID_LIMITÚint)r#rdZrateZdurationZmultr$r$r%rQ!s:   ÿÿzRich_Limit.checkcCs d|jS)Nzlimit value="%s"r;r6r$r$r%r,CszRich_Limit.__str__cCsdSr@r$r6r$r$r%ÚcommandFszRich_Limit.commandN)r.r/r0r&rQr,rlr$r$r$r%rs"rc@s>eZdZdZdZddd„Zdd„Zd d „Zd d „Zd d„Z dS)ri€ÿÿiÿNrcCsV|durt|ƒ|_nd|_||_d|_d|_d|_d|_d|_d|_|rR|  |¡dSr2) Ústrr\ÚpriorityÚsourceÚ destinationÚelementÚlogÚauditÚactionÚ_import_from_string)r#r\Úrule_strrnr$r$r%r&Ms zRich_Rule.__init__cCsŒg}t |¡D]j}d|vrj| d¡}t|ƒdks@|dr@|dsPttjd|ƒ‚| |d|ddœ¡q| d|i¡q| ddi¡|S) z Lexical analysis ú=r`rrazinternal error in _lexer(): %s)Ú attr_nameÚ attr_valuerqÚEOL)rZ splitArgsrbrOrrr"Úappend)r#rvÚtokensÚrÚattrr$r$r%Ú_lexer^s ÿzRich_Rule._lexerc Cs` |sttjdƒ‚t |¡}d|_d|_d|_d|_d|_ d|_ d|_ d|_ |  |¡}|rv|d d¡dkrvttjdƒ‚i}g}d}|| d¡dkr |dgk� sT|| d¡}|| d¡}|| d¡}|rè|dvrættjd |ƒ‚nî|d v�rÆ|d k�r|j�rttjd ƒ‚n²|d k�r2|j�r2ttjdƒ‚n’|dv�r\|j �r\ttjd||j fƒ‚nh|dv�r||j �r|ttjdƒ‚nH|dk�rœ|j �rœttjdƒ‚n(|dv�rÖ|j �rÖttjd||j fƒ‚nttjd|ƒ‚t|ƒdk�rô|t|ƒdnd} | dk�r‚|�sT|�rT|dk�r&ttjdƒ‚n,|dk�r>ttjdƒ‚nttjd||fƒ‚n*d|v�rtttjd||fƒ‚n | d¡�nÈ| dk�r6|dk�r¸|d v�r°ttjd!|ƒ‚||_nz|dk�røzt|ƒ|_Wn$t�yôttjd"|ƒ‚Yn0n:|�r(|d#k�rd$} n d%||f} ttj| ƒ‚n | |¡�n| d k�r®|d&v�rT|||<nV|d'v�rhd(|d)<nBt| d*¡| d+¡| d,¡| d)d-¡ƒ|_| ¡| ¡|d}�nœ| d k�r|d.v�rÌ|||<nN|d'v�ràd(|d)<n:t| d*¡| d,¡| d)d-¡ƒ|_| ¡| ¡|d}�n,| d#k�rV|d/k�rFt|ƒ|_ | ¡n ttjd0ƒ‚�nô| d1k�r |d/k�rt|||<n(t| d/¡ƒ|_ | ¡| ¡|d}�nª| d2k�rØ|d3k�rÈt|ƒ|_ | ¡n ttjd4ƒ‚�nr| d5k�r*|d6v�rö|||<n0t| d5¡| d#¡ƒ|_ | ¡| ¡|d}�n | d7k�rb|d3k�rRt|ƒ|_ | ¡n ttjd8ƒ‚�nè| d9k�rš|d3k�rŠt|ƒ|_ | ¡n ttjd:ƒ‚�n°| d;k�rÈtƒ|_ | ¡| ¡|d}�n‚| d¡| d?¡ƒ|_ | ¡| ¡|d}�n | d@k�r||d6v�rH|||<n0t | d5¡| d#¡ƒ|_ | ¡| ¡|d}�nÎ| dAk�rì|dBv�rš|||<nN|dCk�r°| dC¡n8t!| dD¡| dE¡| dC¡ƒ|_ | ¡| ¡|d}�n^| dFk�rd|dGv�r |||<nV|dCk�r | dC¡n@t"| dH¡| dD¡| dI¡| dC¡ƒ|_ | ¡| ¡|d}�næ| dk�r°|dCk�r„| dC¡n(t#| dC¡ƒ|_ | ¡| ¡|d}�nš| dJk�rü|dCk�rÐ| dC¡n(t$| dC¡ƒ|_ | ¡| ¡|d}�nN| dKk�rH|dCk�r| dC¡n(t%| dC¡ƒ|_ | ¡| ¡|d}�n| dLk�r®|dMk�rf|||<nF|dCk�r|| dC¡n0t&| dM¡| dC¡ƒ|_ | ¡| ¡|d}nœ| dNk� r|dOk�rÌ|||<nF|dCk�râ| dC¡n0t'| dO¡| dC¡ƒ|_ | ¡| ¡|d}n6| dCk� rJ|d/k� r>t(|ƒ|dC<| ¡n ttjdPƒ‚|d}q‚| )¡dS)QNz empty rulerrqrzÚrulerxry)rnr\Úaddressrr r!r<r8r9úto-portúto-addrr4rTrErFú queue-sizerYr^zbad attribute '%s')r€rorpr9Úservicer8ú icmp-blockú icmp-typer>ú forward-portú source-portrrÚnflogrsÚacceptÚdropÚrejectÚmarkrGÚnotÚNOTrzr?rozmore than one 'source' elementrpz#more than one 'destination' element)r9r…r8r†r‡r>rˆr‰zFmore than one element. There cannot be both '%s' and '%s' in one rule.)rrrŠzmore than one logging elementrszmore than one 'audit' element)r‹rŒr�rŽzOmore than one 'action' element. There cannot be both '%s' and '%s' in one rule.zunknown element %srarr\z0'family' outside of rule. Use 'rule family=...'.rnz4'priority' outside of rule. Use 'rule priority=...'.z:'%s' outside of any element. Use 'rule %s= ...'.z,'%s' outside of rule. Use 'rule ... %s ...'.rZzH'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead.z(invalid 'priority' attribute value '%s'.r9zdwrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'.zDattribute '%s' outside of any element. Use 'rule %s= ...'.)r�rr r!)r�r�Tr!r�rr F)r�r r!r<zinvalid 'protocol' elementr?r…r4zinvalid 'service' elementr8r7r†zinvalid 'icmp-block' elementr‡zinvalid 'icmp-type' elementr>rˆ)r8r9r‚rƒr‚rƒr‰rr)rErFrGrErFrŠ)rTrEr„rTr„r‹rŒr�rYrŽr^zinvalid 'limit' element)*rrr"rZstripNonPrintableCharactersrnr\rorprqrrrsrtrÚgetrOr{rkÚ ValueErrorÚINVALID_PRIORITYrÚpopÚclearrrrrrrrrr r r r rr rrrrrQ) r#rvr|ÚattrsZ in_elementsÚindexrqrxryZ in_elementÚerr_msgr$r$r%ruos˜      ý"                *      "                              (                 (                         ÿ       zRich_Rule._import_from_stringcCsˆ|jdur"|jdvr"ttj|jƒ‚|jdurn|jdurB|jjdusL|jdurVttjƒ‚t|j ƒt krnttjƒ‚|j |j ks†|j |j kržttjd|j |j fƒ‚|j du�r|jdusÌ|jdu�r|j dk�r|jdurâttjdƒ‚|jdu�r|jdu�r|j dk�rttjdƒ‚t|j ƒtt ttfv�rZ|jdu�rZ|jdu�rZ|jdu�rZttjdƒ‚|jdu�rt|jjdu�rè|jdu�rŠttjƒ‚|jjdu�r¤ttjdƒ‚|jjdu�r¾ttjdƒ‚t |j|jj¡�stttjt|jjƒƒ‚nŒ|jjdu�r6|jjdu�rttjd ƒ‚t |jj¡�stttjt|jjƒƒ‚n>|jjdu�rht|jjƒ�stttjt|jjƒƒ‚n ttjd ƒ‚|jdu�r&|jjdu�rè|jdu�r¤ttjƒ‚|jjdu�r¾ttj dƒ‚t |j|jj¡�s&ttjt|jjƒƒ‚n>|jjdu�rt|jjƒ�s&ttjt|jjƒƒ‚n ttjd ƒ‚t|j ƒt!k�rn|j j"du�sVt#|j j"ƒd k�rÀttj$t|j j"ƒƒ‚�nRt|j ƒt%k�rÀt &|j j'¡�sžttj(|j j'ƒ‚|j j)d v�rÀttj*|j j)ƒ‚�nt|j ƒt+k�rôt ,|j j-¡�sÀttj*|j j-ƒ‚�nÌt|j ƒtk�rF|jdu�rttjdƒ‚|jdu�rÀ|jjdu�rÀttjdƒ‚�nzt|j ƒtk�r¢|j j"du�svt#|j j"ƒd k�rŠttj.t|j j"ƒƒ‚|j�rÀttjdƒ‚�nt|j ƒt/k�rê|j j"du�sÒt#|j j"ƒd k�rÀttj.t|j j"ƒƒ‚�nÖt|j ƒt k�rôt &|j j'¡�sttj(|j j'ƒ‚|j j)d v�r8ttj*|j j)ƒ‚|j j0dk�rd|j j1dk�rdttj(|j j0ƒ‚|j j0dk�r’t &|j j0¡�s’ttj(|j j0ƒ‚|j j1dk�rÄt 2|j|j j1¡�sÄttj|j j1ƒ‚|jdu�rÚttjƒ‚|jdu�rÀttjdƒ‚nÌt|j ƒt3k�rDt &|j j'¡�s$ttj(|j j'ƒ‚|j j)d v�rÀttj*|j j)ƒ‚n|t|j ƒtk�rž|jdu�rrttjd|jƒ‚|j j-�rÀt 4|j j-¡�sÀttj|j j-ƒ‚n"|j du�rÀttjdt|j ƒƒ‚|jdu�rÖ|j 5¡|jdu�r$t|jƒt6t7t8fv�r ttj9t|jƒƒ‚|jj:du�r$|jj: 5¡|jdu�r„t|jƒt7k�rP|j 5|j¡nt|jƒt;k�rj|j 5¡|jj:du�r„|jj: 5¡dS)NrZz/'priority' attribute must be between %d and %d.rzno element, no actionz%no element, no source, no destinationzno action, no log, no auditzaddress and maczaddress and ipsetz mac and ipsetzinvalid sourcezinvalid destinationra)ZtcpZudpZsctpZdccpzmasquerade and actionzmasquerade and mac sourcezicmp-block and actionrzforward-port and actionz+tcp-mss-clamp and %s are mutually exclusivezUnknown element %s)s2      1