Warning: session_start(): Session cannot be started after headers have already been sent in /home/tvrreohg/public_html/manga.php on line 13
3
YjϢ @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z m
Z
ddlm Z m Z m
Z
ddlmZmZmZ dd lmZmZmZmZmZmZ dd
lmZ dd lm Z dd lm Z dd
l m Z dd Z dd Z!dd Z"dd Z#dd Z$G dd d eZ%G dd deZ&d d dZ'd d dZ(dS ) Policy
policy_reader
policy_writer N)config)checkIPcheckIP6)uniqifymax_policy_name_lenportStr)DEFAULT_POLICY_TARGETPOLICY_TARGETSDEFAULT_POLICY_PRIORITY) IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator
check_port check_tcpudpcheck_protocol)rich)log)errors)
FirewallErrorc C s |dkr n|dkrn|dkr| j r`| j jrJtjdt| j d| _dS tj|d | j _dS |d | jj kr| jj j
|d ntjd|d n|dkrN| j r| j jrtjdt| j d| _dS tj |d |d | j _dS t |d t
|d t|d d
|d f}|| jjkr4| jjj
| ntjd |d |d nN|d kr| j r| j jrtjdt| j d| _dS tj|d | j _nBt|d |d | jjkr| jjj
|d ntjd
|d n|dkrh| j r.| j jrtjdt| j d| _dS tj|d | j _dS |d | jjkrT| jjj
|d ntjd|d n4|dkr| j r| j jrtjdt| j d| _dS tj|d | j _dS tjd|d n|dkr2| j r| j jrtjdt| j d| _dS tj | j _n | jjr&tjd nd| j_nj|dkrd}d|krR|d }d}d|krh|d }| j r| j jrtjdt| j d| _dS tj|d |d ||| j _dS t |d t
|d |rt | |r
t| r
t| r
tt j d| t|d d
|d t|d
t|f}|| jj krL| jj j
| n6tjd|d |d |rld| nd|r|d| nd n|d kr@| j r| j jrtjdt| j d| _dS tj |d |d | j _dS t |d t
|d t|d d
|d f}|| jj kr&| jj j
| ntjd |d |d n\|d kr| j sftjd d| _dS | j j!rtjd t| j dS d!}d }d"|kr|d" }d }d#|kr|d# }d$|kr|d$ j" dLkrd}tj#|||| j _!n|dMkr| j stjd+ d| _dS | j j$r0tjd, d| _dS |d'krHtj% | j _$nh|d(krxd } d-|krh|d- } tj&| | j _$n8|d)krtj' | j _$n |d*kr|d. }
tj(|
| j _$| j j$| _)n|d/kr^| j stjd0 dS | j jrtjd1 dS d } d2|kr*|d2 } | dNkr*tjd; d| _dS d<|kr<|d< nd } tj*| | | j _| j j| _)n>|d=kr| j s~tjd> dS | j j+rtjd?t| j d| _dS tj, | j _+| j j+| _)n|d@kr,d }
dA}dB|kr|dB }
|
dOkrtjdE|dB d| _dS dF|krt-|dF }tj.|
|dG| _ np|dHkr| j)sRtjdI d| _dS | j)j/rxtjdJt| j d| _dS |d }tj0||j1dK| j)_/nd!S dS )PNshort descriptionservicez;Invalid rule: More than one element in rule '%s', ignoring.Tnamez#Service '%s' already set, ignoring.portprotocol-z#Port '%s/%s' already set, ignoring.valuez$Protocol '%s' already set, ignoring.z
icmp-blockz&icmp-block '%s' already set, ignoring.z icmp-typez-Invalid rule: icmp-block '%s' outside of rule
masqueradez!Masquerade already set, ignoring.z forward-port zto-portzto-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%sz source-portz*Source port '%s/%s' already set, ignoring. destinationz)Invalid rule: Destination outside of rulez?Invalid rule: More than one destination in rule '%s', ignoring.Faddressipsetinvertyestrueacceptrejectdropmarkz$Invalid rule: Action outside of rulez"Invalid rule: More than one actiontypesetr z!Invalid rule: Log outside of rulez Invalid rule: More than one loglevelemergalertcriterrorwarningnoticeinfodebugz Invalid rule: Invalid log levelprefixauditz#Invalid rule: Audit outside of rulez9Invalid rule: More than one audit in rule '%s', ignoring.ruler familyipv4ipv6z&Invalid rule: Rule family "%s" invalidpriority)r: r= limitz4Invalid rule: Limit outside of action, log and auditz9Invalid rule: More than one limit in rule '%s', ignoring.burst)r& r' )r( r) r* r+ )r/ r0 r1 r2 r3 r4 r5 r6 )r; r< )2_ruleelementr r3 str _rule_errorr Rich_Serviceitemservicesappend Rich_Portr r r
ports
Rich_Protocolr protocolsRich_IcmpBlock icmp_blocks
Rich_IcmpTypeRich_Masquerader Rich_ForwardPortr r r r INVALID_ADDR
forward_portsRich_SourcePort source_portsr" lowerZRich_Destinationaction Rich_Accept Rich_Reject Rich_Drop Rich_Mark _limit_okZRich_Logr8 Z
Rich_Auditint Rich_Ruler> Z
Rich_Limitget)objr attrsentryto_portZto_addrr% r# r$ Z_typeZ_setr. r7 r: r= r rc /usr/lib/python3.6/policy.pycommon_startElement s
re c C s |dkr| j sy| jj W n6 tk
rR } ztjd|t| j W Y d d }~X nLX t| j| jjkr| jj j
| j | jjj
t| j ntjdt| j d | _d| _ n|d krd | _ d S ) Nr9 z%s: %sz Rule '%s' already set, ignoring.Fr( r) r* r+ r r8 )r( r) r* r+ r r8 ) rC r@ Zcheck Exceptionr r3 rB rE rules_strrulesrG r[ )r_ r erc rc rd common_endElement s & rj c C s t | trdnd}|dkrT| jrT| jj }x$|D ] }||kr0ttjd| q0W n|dkrx$|D ] }t|d t|d qbW nb|dkrx|D ] }t | qW n@|d kr| jr| jj
} x$|D ] }
|
| krttj d
|
qW n|d krx|D ]} t| d t| d | d r>| d
r>ttj d| | d rTt| d | d
rt
| d
rt| d
rttjd| d
qW nT|dkrx&|D ] }t|d t|d qW n |dkrx|D ]} tj| d}
| jr|
jrt |
jtjs t |
jtjr| jj
} |
jj| krLttj d
|
jj nH|
jr| jj|
jj}|jr|
j|jkrttj d|
j|
jjf nL| jrt |
jtjr| jj }|
jj|krttjdj|| j|
jjqW d S )Nr ZZonerF z '%s' not among existing servicesrI r rK rM z"'%s' not among existing icmp typesrR z$'%s' is missing to-port AND to-addr z#to-addr '%s' is not a valid addressrT rg
rich_rules)rule_strz3rich rule family '%s' conflicts with icmp type '%s'z){} '{}': '{}' not among existing services)rg rn )
isinstancer fw_configZ get_servicesr r ZINVALID_SERVICEr r r Z
get_icmptypesZINVALID_ICMPTYPEINVALID_FORWARDr r rQ r r] rA rL rN r r: Z get_icmptyper" rD format)r_ r rE
all_configZobj_typeZexisting_servicesr r protoZexisting_icmptypesZicmptypefwd_portr9 Zobj_richZictrc rc rd common_check_config2 s
rw c C s0 d|j i}|j}|d k r ||d< | jd| d S )Nr r? r> )r r?
simpleElement)handlerr> dr? rc rc rd _handler_add_rich_limitx s
r{ c C s | j rF| j dkrF|jd |jdi |j| j |jd |jd | jr| jdkr|jd |jdi |j| j |jd |jd x6t| jD ](}|jd |jdd|i |jd qW x@t| j D ]2}|jd |jd|d |d
d |jd qW x8t| j
D ]*}|jd |jd d
|i |jd qW x8t| j D ]*}|jd |jdd|i |jd qLW | j r|jd |jdi |jd xt| j
D ]}|jd |d |d
d }|d r|d dkr|d |d< |d r|d dkr|d |d< |jd| |jd qW xBt| jD ]4}|jd |jd|d |d
d |jd q>W xT| jD ]H}i }|jr|j|d< |jd krt|j|d< |jd |jd| |jd |jrVi }|jjr|jj|d< |jjr|jj|d< |jjr$|jj|d< |jjr6d |d < |jd |jd | |jd |jri }|jjrx|jj|d< |jjr|jj|d< |jjrd |d < |jd |jd | |jd |jrxd} i }t|jtj krd} |jj |d< nbt|jtj kr(d} |jj |d< |jj |d < n0t|jtj!krNd } |jj"|d
< n
t|jtj#krfd} nt|jtj$krd} |jj |d< nt|jtj%krd!} |jj |d< nt|jtj&krd} |jj |d< |jj |d < |jj'dkr|jj'|d< |jj(dkrX|jj(|d< nFt|jtj)krBd} |jj |d< |jj |d < nt*t+j,d"t|j |jd |j| | |jd |j-r i }|j-j.r|j-j.|d#< |j-j/r|j-j/|d$< |j-j0r|jd |jd%| |jd& t1||j-j0 |jd' |jd% n|jd |jd%| |jd |j2ri }|j2j0rx|jd |jd(i |jd& t1||j2j0 |jd' |jd( n|jd |jd(| |jd |j3rd}
i }t|j3tj4krd)}
n|t|j3tj5krd*}
|j3jr<|j3j|d+< nNt|j3tj6krd,}
n6t|j3tj7kr*d-}
|j3j8|d.< nt-j9d/t|j3 |j3j0r|jd |j|
| |jd& t1||j3j0 |jd' |j|
n|jd |j|
| |jd |jd |jd |jd qW d S )0Nr! z r
r r r r r rk )r r r r z
icmp-blockr rl zto-portrm zto-addrz forward-portz source-portr: r= r9 r# macr$ Truer% z sourcer" z icmp-typez"Unknown element '%s' in obj_writerr7 r. r z
z
r8 r( r) r, r* r+ r- zUnknown action '%s'):r ignorableWhitespace startElementZ
characters
endElementr r rF rx rI rK rM r rR rT rh r: r= rB r addrr} r$ r% r" rA r, r rD r rH r r rJ r rO rL rN rP rb
to_addressrS r r ZINVALID_OBJECTr r7 r. r> r{ r8 rV rW rX rY rZ r- r3 ) r_ ry r r r ZicmpZforwardr` r9 rA rV rc rc rd
common_writer s\
r c sP e Zd Zd7ZdZeZdgZd8d9d:d;d dgfd
dgfddgfddgfdd?gfd@ddgfddgffZdddgZ dddgdgddgdgdgdddgdddd gddgdddddd gd gdgdgd Z
ddgd d gd!dgd"d#d$d!d%gd"d$d%gd&d'gd(gd)gd*Z fd+d,Z d-d. Z
fd/d0Z fd1d2Zd3d4 Z fd5d6Z ZS )Ar i i r versionr! r r targetrF rI rM r FrR rn rK rT r=
ingress_zones egress_zones_r /Nr r r r r- )r r policyr r z
icmp-blockz icmp-typer z forward-portr9 r r" r z source-portr r8 r( r) r* r+ r> z ingress-zonez egress-zonezto-portzto-addrr: r# r} r% r$ r7 r. r, r? )r z forward-portr9 r r" r r) r> c s t t| j d| _d| _d| _t| _g | _g | _ g | _
g | _ d| _ g | _
g | _d | _g | _g | _d| _| j| _d | _g | _g | _d S )Nr! F)superr __init__r r r r r rF rI rK rM r rR rT rq rh rg appliedpriority_defaultr= Zderived_from_zoner r )self) __class__rc rd r s( zPolicy.__init__c C s d| _ d| _d| _t| _| jd d = | jd d = | jd d = | jd d = d| _ | j
d d = | j d d = d | _ | j
d d = | jd d = d| _| j| _| jd d = | jd d = d S )Nr! F)r r r r r rF rI rK rM r rR rT rq rh rg r r r= r r )r rc rc rd cleanup s$ zPolicy.cleanupc s" |dkr| j S ttt| |S d S )Nrn )rg getattrr r )r r )r rc rd __getattr__ s zPolicy.__getattr__c sB |dkr,dd |D | _ dd | j D | _ntt| j|| d S )Nrn c S s g | ]}t j|d qS ))ro )r r] ).0src rc rd
s z&Policy.__setattr__..c S s g | ] }t |qS rc )rB )r r rc rc rd r s )rh rg r r __setattr__)r r r )r rc rd r s zPolicy.__setattr__c
C s t | ||| |dkr2|tkr.ttjd| n|dkrz|| jksX|| jksX|| jk rvttjd|| j| j| jf n|dkrhddg}| j r|| j j
7 }x|D ]}||krttj d | |dkrt ddgt |@ s|d krt |t |g rttj d
| |dkr|dkr8d|kr8d|d ksT|dkrd|krd|d krttj d qW n|d kr|rd|krd|d krttj d
nxd|krd|d krttj dxR|d D ]F}|dkrސq| j j
|}| j rd| j j|krttj dqW n|dkr4x|D ] }tj|d}|jrt|jtjrd|kr|d|d kr|ttj d
nxd|kr,d|d krttj dxR|d D ]F}|dkrq| j j
|}| j rd| j j|krttj dqW q,|jrt|jtjrd|kr,d|d kr@|jjrttjdnt|d r,|jjs`ttjdd|d kr,x|d D ]8}| j j
|}| j rxd| j j|krxttj dqxW nv|jr,t|jtjr,d|kr,xR|d D ]F}|d krq| j j
|}| j rd| j j|krttj dqW q,W n|dkrx|D ]} d|krnd|d krnttj dnd|krDd|d kr| d rttjdnt|d rD| d sttjdd|d krDxD|d D ]8}| j j
|}| j rd| j j|krttj dqW qDW d S ) Nr z'%s' is invalid targetr= zQ%d is invalid priority. Must be in range [%d, %d]. The following are reserved: %sr r ANYHOSTz '%s' not among existing zonesz>'%s' may only contain one of: many regular zones, ANY, or HOSTzF'HOST' can only appear in either ingress or egress zones, but not bothr z.'masquerade' is invalid for egress zone 'HOST'z/'masquerade' is invalid for ingress zone 'HOST'Z
interfaceszR'masquerade' cannot be used in a policy if an ingress zone has assigned interfacesrn )ro zAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonezS'forward-port' cannot be used in a policy if an egress zone has assigned interfaceszR'mark' action cannot be used in a policy if an egress zone has assigned interfacesrR z1'forward-port' is invalid for ingress zone 'HOST'rm )r r )r r )r r )r r )rw r r r INVALID_TARGETpriority_reserved priority_max priority_minZINVALID_PRIORITYrq get_zonesZ INVALID_ZONEr- Zget_zoneZget_zone_config_dictr r] rA rp rO rP r rr rV rZ )
r r rE rt Zexisting_zoneszoneZz_objr9 r_ rv rc rc rd
_check_config s
"
zPolicy._check_configc s t t| j| |jdr,ttjd| n|jdrHttjd| n|jddkrhttjd| njd|kr|d |j d }n|}t
|t krttjd|t
|t f | j r|| j j
krttjdd S )Nr z'%s' can't start with '/'z'%s' can't end with '/'rk zmore than one '/' in '%s'z&Policy of '%s' has %d chars, max is %dz,Policies can't have the same name as a zone.)r r
check_name
startswithr r INVALID_NAMEendswithcountfindlenr rq r Z
NAME_CONFLICT)r r Z checked_name)r rc rd r , s*
zPolicy.check_namei )r r! )r r! )r r! )r r! )r! r! )r F)r! r! r! r! )r! r! )r= r )__name__
__module__ __qualname__r r r
r r ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r r r r r
__classcell__rc rc )r rd r Z sr
^c @ s$ e Zd Zdd Zdd Zdd ZdS )policy_ContentHandlerc C s" t j| | d | _d| _d | _d S )NF)r r r@ rC r[ )r rE rc rc rd r H s z policy_ContentHandler.__init__c C s t j| || | jrd S | jj|| t| ||r6d S |dkrd|krR|d | j_d|krjt|d | j_d|kr|d }|t krt
t j ||r|| j_
n^|dkr|d | jjkr| jjj|d ntjd|d n |dkr |d | jjkr| jjj|d ntjd |d n|d
kr| jsFtjd d | _d S | jjrltjd
t| j d | _d S d}d|kr|d j dkrd }d } }}d|kr|d }d|kr|d }d|kr|d }tj||||d| j_d S tjd| d S d S )Nr r r= r z ingress-zoner z(Ingress zone '%s' already set, ignoring.z egress-zonez'Egress zone '%s' already set, ignoring.r z$Invalid rule: Source outside of ruleTz:Invalid rule: More than one source in rule '%s', ignoring.Fr% r& r' r# r} r$ )r% zUnknown XML element '%s')r& r' )r r rC rE Zparser_check_element_attrsre r r\ r= r r r r r r rG r r3 r r@ r rB rU r Z Rich_Source)r r r` r r% r r} r$ rc rc rd r N sf
z"policy_ContentHandler.startElementc C s t j| | t| | d S )N)r r rj )r r rc rc rd r s z policy_ContentHandler.endElementN)r r r r r r rc rc rc rd r G s @r Fc
C s t }| jds ttjd| | d d |_|s>|j|j | |_||_|j t
j rZdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd| j W Y d d } ~ X nX W d Q R X ~~|S )
Nz.xmlz'%s' is missing .xml suffix FTz%s/%srbznot a valid policy file: %s)r r r r r r r filenamepathr r
ETC_FIREWALLDZbuiltindefaultr saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZINVALID_POLICYZ getException)
r r Z
no_check_namer ry parserr fr msgrc rc rd r s6
(c
C s |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j i }| jr| jd kr| j|d
< | j| jkr0t| j|d < | j|d < |jd
| |jd t| | x8t| j D ]*} |jd |j dd| i |jd qfW x8t| j D ]*} |jd |j dd| i |jd qW |j d
|jd |j |j! ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr! r r= r r r| z z ingress-zoner z egress-zone)"r r r osexistsshutilZcopy2rf r r2 dirnamer r r mkdirior r Z
startDocumentr r= r rB r r r r r r rx r r Z endDocumentclose)
r r _pathr r dirpathr ry r` r rc rc rd r sN
)F)N))__all__Zxml.saxr r r r Zfirewallr Zfirewall.functionsr r r r r
Zfirewall.core.baser r r
Zfirewall.core.io.io_objectr r r r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr re rj rw r{ r r r r r rc rc rc rd s4
F [ nL