shell bypass 403
3
]ûf8� � @ s� d ddddddddd d
d d d
ddddgZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd � d e
�Z G dd� de
�Z G dd� de
�Z
G dd� de
�ZG d d� de�ZG d d� de
�ZG d d� de
�ZG d d� de
�ZG d d� de
�ZG d!d � d e
�ZG d"d
� d
e
�ZG d#d � d e
�ZG d$d � d e
�ZG d%d
� d
e
�ZG d&d� de�ZG d'd� de
�Zd(d)d/d1d+�ZG d,d� de
�Z G d-d� de
�Z d.S )2� Rich_Source�Rich_Destination� Rich_Service� Rich_Port�
Rich_Protocol�Rich_Masquerade�Rich_IcmpBlock�
Rich_IcmpType�Rich_SourcePort�Rich_ForwardPort�Rich_Log�
Rich_Audit� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�
Rich_Limit� Rich_Rule� )� functions)�check_ipset_name)� REJECT_TYPES)�errors)�
FirewallErrorc @ s e Zd Zddd�Zdd� ZdS )r Fc C s� || _ | j dkrd | _ || _| jdks0| jd kr8d | _n| jd k rN| jj� | _|| _| jdkrdd | _|| _| j d kr�| jd kr�| jd kr�ttjd��d S )N� zno address, mac and ipset)�addr�mac�upper�ipset�invertr r � INVALID_RULE)�selfr r r r � r! �/usr/lib/python3.6/rich.py�__init__$ s
zRich_Source.__init__c C sj d| j r dnd }| jd k r*|d| j S | jd k rB|d| j S | jd k rZ|d| j S ttjd��d S )Nz source%s z NOTr z address="%s"zmac="%s"z
ipset="%s"zno address, mac and ipset)r r r r r r r )r �retr! r! r" �__str__5 s
zRich_Source.__str__N)F)�__name__�
__module__� __qualname__r# r% r! r! r! r" r # s
c @ s e Zd Zddd�Zdd� ZdS )r Fc C sV || _ | j dkrd | _ || _| jdkr,d | _|| _| j d krR| jd krRttjd��d S )Nr zno address and ipset)r r r r r r )r r r r r! r! r" r# B s
zRich_Destination.__init__c C sR d| j r dnd }| jd k r*|d| j S | jd k rB|d| j S ttjd��d S )Nzdestination%s z NOTr z address="%s"z
ipset="%s"zno address and ipset)r r r r r r )r r$ r! r! r" r% N s
zRich_Destination.__str__N)F)r& r' r( r# r% r! r! r! r" r A s
c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)�name)r r) r! r! r" r# Y s zRich_Service.__init__c C s
d| j S )Nzservice name="%s")r) )r r! r! r" r% \ s zRich_Service.__str__N)r& r' r( r# r% r! r! r! r" r X s c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ || _d S )N)�port�protocol)r r* r+ r! r! r" r# ` s zRich_Port.__init__c C s d| j | jf S )Nz port port="%s" protocol="%s")r* r+ )r r! r! r" r% d s zRich_Port.__str__N)r& r' r( r# r% r! r! r! r" r _ s c @ s e Zd Zdd� ZdS )r c C s d| j | jf S )Nz#source-port port="%s" protocol="%s")r* r+ )r r! r! r" r% h s zRich_SourcePort.__str__N)r& r' r( r% r! r! r! r" r g s c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)�value)r r, r! r! r" r# m s zRich_Protocol.__init__c C s
d| j S )Nzprotocol value="%s")r, )r r! r! r" r% p s zRich_Protocol.__str__N)r& r' r( r# r% r! r! r! r" r l s c @ s e Zd Zdd� Zdd� ZdS )r c C s d S )Nr! )r r! r! r" r# t s zRich_Masquerade.__init__c C s dS )N�
masquerader! )r r! r! r" r% w s zRich_Masquerade.__str__N)r& r' r( r# r% r! r! r! r" r s s c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)r) )r r) r! r! r" r# { s zRich_IcmpBlock.__init__c C s
d| j S )Nzicmp-block name="%s")r) )r r! r! r" r% ~ s zRich_IcmpBlock.__str__N)r& r' r( r# r% r! r! r! r" r z s c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)r) )r r) r! r! r" r# � s zRich_IcmpType.__init__c C s
d| j S )Nzicmp-type name="%s")r) )r r! r! r" r% � s zRich_IcmpType.__str__N)r& r' r( r# r% r! r! r! r" r � s c @ s e Zd Zdd� Zdd� ZdS )r
c C s< || _ || _|| _|| _| jd kr(d| _| jd kr8d| _d S )Nr )r* r+ �to_port�
to_address)r r* r+ r. r/ r! r! r" r# � s
zRich_ForwardPort.__init__c C s< d| j | j| jdkr d| j nd| jdkr4d| j ndf S )Nz(forward-port port="%s" protocol="%s"%s%sr z
to-port="%s"z
to-addr="%s")r* r+ r. r/ )r r! r! r" r% � s zRich_ForwardPort.__str__N)r& r' r( r# r% r! r! r! r" r
� s c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ || _|| _d S )N)�prefix�level�limit)r r0 r1 r2 r! r! r" r# � s zRich_Log.__init__c C s> d| j rd| j nd| jr$d| j nd| jr6d| j ndf S )Nz log%s%s%sz prefix="%s"r z level="%s"z %s)r0 r1 r2 )r r! r! r" r% � s zRich_Log.__str__)NNN)r& r' r( r# r% r! r! r! r" r � s
c @ s e Zd Zddd�Zdd� ZdS )r Nc C s
|| _ d S )N)r2 )r r2 r! r! r" r# � s zRich_Audit.__init__c C s d| j rd| j nd S )Nzaudit%sz %sr )r2 )r r! r! r" r% � s zRich_Audit.__str__)N)r& r' r( r# r% r! r! r! r" r � s
c @ s e Zd Zddd�Zdd� ZdS )r
Nc C s
|| _ d S )N)r2 )r r2 r! r! r" r# � s zRich_Accept.__init__c C s d| j rd| j nd S )Nzaccept%sz %sr )r2 )r r! r! r" r% � s zRich_Accept.__str__)N)r& r' r( r# r% r! r! r! r" r
� s
c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S )N)�typer2 )r Z_typer2 r! r! r" r# � s zRich_Reject.__init__c C s, d| j rd| j nd| jr$d| j ndf S )Nz
reject%s%sz
type="%s"r z %s)r3 r2 )r r! r! r" r% � s zRich_Reject.__str__c C sT | j rP|sttjd��|dkrP| j t| krPdjt| �}ttjd| j |f ��d S )Nz9When using reject type you must specify also rule family.�ipv4�ipv6z, z%Wrong reject type %s.
Use one of: %s.)r4 r5 )r3 r r r r �join)r �familyZ valid_typesr! r! r" �check� s zRich_Reject.check)NN)r& r' r( r# r% r8 r! r! r! r" r � s
c @ s e Zd Zdd� ZdS )r c C s d| j rd| j nd S )Nzdrop%sz %sr )r2 )r r! r! r" r% � s zRich_Drop.__str__N)r& r' r( r% r! r! r! r" r � s c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S )N)�setr2 )r Z_setr2 r! r! r" r# � s zRich_Mark.__init__c C s d| j | jrd| j ndf S )Nz
mark set=%s%sz %sr )r9 r2 )r r! r! r" r% � s zRich_Mark.__str__c C s� | j d k r| j }n ttjd��d|krv|jd�}t|�dkrHttj|��tj|d � shtj|d � r�ttj|��ntj|�s�ttj|��d S )Nz no value set�/� r � )r9 r r Z INVALID_MARK�split�lenr Z checkUINT32)r �x�splitsr! r! r" r8 � s
zRich_Mark.check)N)r& r' r( r# r% r8 r! r! r! r" r � s
r< �< � )�s�m�h�dc @ s� e Zd Zddd�Zdd� Zedd� �Zejdd� �Zed d
� �Zejd d
� �Ze d d
� �Z
dd� Z e dd� �Z dd� Z
dd� ZdS )r Nc C s || _ || _d S )N)r, �burst)r r, rG r! r! r" r# � s zRich_Limit.__init__c C s | j � | j� d S )N)� value_parse� burst_parse)r r! r! r" r8 � s zRich_Limit.checkc C s | j S )N)�_value)r r! r! r" r, � s zRich_Limit.valuec C sf |d krd | _ d S y| j|�\}}W n tk
r< |}Y nX |� d|� �}t| dd �|krb|| _ d S )Nr: rJ )rJ � _value_parser �getattr)r r, �rate�duration�vr! r! r" r, � s
c C s | j S )N)�_burst)r r! r! r" rG s zRich_Limit.burstc C s\ |d krd | _ d S y| j|�}W n tk
r8 |}Y n
X t|�}t| dd �|krX|| _ d S )NrP )rP � _burst_parser �strrL )r rG �br! r! r" rG s
c C s� d }d| kr| j d�}| s(t|�dkr4ttj| ��|\}}y t|�}W n ttj| ��Y nX |dkrv|d d� }|dk s�|dkr�ttj| ��d t| | d
kr�ttjd| f ��|dkr�|d kr�ttjd| f ��||fS )Nr: r; �second�minute�hour�dayr< rC rD rE rF i' r z %s too fastz %s too slow)rT rU rV rW )rC rD rE rF )r= r> r r �
INVALID_LIMIT�int�DURATION_TO_MULT)r, r@ rM rN r! r! r" rK s&
zRich_Limit._value_parsec C s | j | j�S )N)rK rJ )r r! r! r" rH : s zRich_Limit.value_parsec C sR | d kr d S y t | �}W n ttj| ��Y nX |dk sB|dkrNttj| ��|S )Nr< i��� )rY r r rX )rG rS r! r! r" rQ = s zRich_Limit._burst_parsec C s | j | j�S )N)rQ rP )r r! r! r" rI K s zRich_Limit.burst_parsec C s, d| j � d�}| jd k r(|d| j� �7 }|S )Nz
limit value="�"z burst=)rJ rP )r rC r! r! r" r% N s
zRich_Limit.__str__)N)r& r' r( r# r8 �propertyr, �setterrG � staticmethodrK rH rQ rI r% r! r! r! r" r � s
c @ s> e Zd ZdZdZddd�Zdd� Zd d
� Zd d � Zd
d� Z dS )r i � i� Nr c C sV |d k rt |�| _nd | _|| _d | _d | _d | _d | _d | _d | _|rR| j |� d S )N)
rR r7 �priority�source� destination�element�log�audit�action�_import_from_string)r r7 �rule_strr_ r! r! r" r# X s zRich_Rule.__init__c C s� g }x|t j|�D ]n}d|krp|jd�}t|�dksF|d sF|d rVttjd| ��|j|d |d d�� q|jd|i� qW |jddi� |S ) z Lexical analysis �=r; r r< z internal error in _lexer(): %s)� attr_name�
attr_valuerb �EOL)r Z splitArgsr= r> r r r �append)r rg �tokens�r�attrr! r! r" �_lexeri s
zRich_Rule._lexerc C s� |st tjd��tj|�}d| _d | _d | _d | _d | _ d | _
d | _ d | _ | j
|�}|rv|d jd�dkrvt tjd��i }g }d}�x`|| jd�dko�|dgk�s�|| jd�}|| jd�}|| jd�}|� r�|dHk�r�t tjd| ��� n�|dIk�r�|dk�r | j�r t tjd+��n�|dk�r<| j�r<t tjd,��n�|dJk�rf| j �rft tjd-|| j f ��nh|d"k�r�| j
�r�t tjd.��nH|d#k�r�| j �r�t tjd/��n(|dKk�r�| j �r�t tjd0|| j f ��nt tjd1| ��t|�dk�r�|t|�d2 nd3} | d3k�r�| �r`|�r`|d k�r2t tjd4��n,|dk�rJt tjd5��nt tjd6||f ��n*d|k�r�t tjd7||f ��n
|jd� �nL| dk�rD|d k�r�|dLk�r�t tjd:| ��|| _n||dk�ryt|�| _W n& tk
�r t tjd;| ��Y nX n:|�r6|dk�r d<}
n d=||f }
t tj|
��n
|j|� �n�| dk�r�|dMk�rb|||< nV|dNk�rvd>|d
< nBt|jd
�|jd �|jd �|jd
d?��| _|j� |j� |d2 }�n | dk�r,|dOk�r�|||< nN|dPk�r�d>|d
< n:t|jd
�|jd �|jd
d?��| _|j� |j� |d2 }�n�| dk�rd|dk�rTt|�| _ |j� n t tjd@���nv| d k�r�|dk�r�t|�| _ |j� n t tjdA���n>| dk�r�|dQk�r�|||< n0t|jd�|jd��| _ |j� |j� |d2 }�n�| d k�r&|dk�rt|�| _ |j� n t tjdB���n�| d k�r^|dk�rNt |�| _ |j� n t tjdC���n|| d k�r�t � | _ |j� |j� |d2 }�nN| d k�r�|dRk�r�|||< n@t |jd�|jd�|jd�|jd��| _ |j� |j� |d2 }�n�| d!k�r@|dSk�r |||< n0t |jd�|jd��| _ |j� |j� |d2 }�n�| d"k�r�|dTk�r^|||< nN|d(k�rt|jd(� n8t |jd�|jd�|jd(��| _
|j� |j� |d2 }�n*| d#k�r�|d(k�r�|jd(� n(t!|jd(��| _ |j� |j� |d2 }�n�| d$k�rH|d(k�r |jd(� n(t"|jd(��| _ |j� |j� |d2 }�n�| d%k�r�|d(k�rh|jd(� n(t#|jd(��| _ |j� |j� |d2 }�nF| d&k�r�|dk�r�|||< nF|d(k�r�|jd(� n0t$|jd�|jd(��| _ |j� |j� |d2 }n�| d'k�r`|dk�r|||< nF|d(k�r.|jd(� n0t%|jd�|jd(��| _ |j� |j� |d2 }nz| d(k�r�|dUk�r�||dD|� �< nVdE|k�r�t tjdF��t&|dE |jdG��|d(< |jdEd � |jdGd � |j� |d2 }|d2 }q�W | j'� d S )VNz
empty ruler rb rk �ruleri rj r_ r7 �addressr r r r, r* r+ �to-port�to-addrr) r0 r1 r3 r9 rG zbad attribute '%s'r` ra �service�
icmp-block� icmp-typer- � forward-port� source-portrc rd �accept�drop�reject�markr2 �not�NOTz more than one 'source' elementz#more than one 'destination' elementzFmore than one element. There cannot be both '%s' and '%s' in one rule.zmore than one 'log' elementz more than one 'audit' elementzOmore than one 'action' element. There cannot be both '%s' and '%s' in one rule.zunknown element %sr< r z0'family' outside of rule. Use 'rule family=...'.z4'priority' outside of rule. Use 'rule priority=...'.z:'%s' outside of any element. Use 'rule <element> %s= ...'.z,'%s' outside of rule. Use 'rule ... %s ...'.r4 r5 zH'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead.z(invalid 'priority' attribute value '%s'.zdwrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'.zDattribute '%s' outside of any element. Use 'rule <element> %s= ...'.TFzinvalid 'protocol' elementzinvalid 'service' elementz invalid 'icmp-block' elementzinvalid 'icmp-type' elementzlimit.z limit.valuezinvalid 'limit' elementz limit.burst)r_ r7 rr r r r r, r* r+ rs rt r) r0 r1 r3 r9 rG )rq r` ra r+ ru r* rv rw r- rx ry rc rd rz r{ r| r} r2 r~ r rk )r+ ru r* rv rw r- rx ry )rz r{ r| r} )r4 r5 )rr r r r )r~ r )rr r r )r~ r )r* r+ )r* r+ rs rt )r* r+ )r0 r1 )r, rG )(r r r r ZstripNonPrintableCharactersr_ r7 r` ra rb rc rd re rp �getr> rl rY �
ValueError�INVALID_PRIORITYr �pop�clearr r r r r r r r
r r r r
r r r r r8 ) r rg rm ZattrsZ in_elements�indexrb ri rj Z
in_elementZerr_msgr! r! r" rf z s�
" "
*
"
(
z Rich_Rule._import_from_stringc C s` | j d k r"| j d kr"ttj| j ��| j d krn| jd k rB| jjd k sL| jd k rVttj��t| j �t
krnttj��| j | j k s�| j | j
kr�ttjd| j | j
f ��| j d ko�| jd ks�| jd k o�| j dk�r
| jd kr�ttjd��| jd ko�| jd ko�| j dk�r
ttjd��t| j �tt
tgk�rP| jd k�rP| jd k�rP| jd k�rPttjd��| jd k �rj| jjd k �r�| j d k�r�ttj��| jjd k �r�ttjd��| jjd k �r�ttjd ��tj| j | jj��sjttjt| jj���n�| jjd k �r,| jjd k �rttjd
��tj| jj��sjttj t| jj���n>| jjd k �r^t | jj��sjttj t| jj���n ttjd ��| jd k �r | jjd k �r�| j d k�r�ttj��| jjd k �r�ttj d ��tj| j | jj��s ttjt| jj���n>| jjd k �rt | jj��s ttj t| jj���n ttjd ��t| j �t k�rd| j j!d k�sLt"| j j!�d
k �r`ttj#t| j j!����n�t| j �t$k�r�tj%| j j&��s�ttj'| j j&��| j j(d!k�r`ttj)| j j(���n�t| j �t*k�r�tj+| j j,��s`ttj)| j j,���nvt| j �tk�r<| jd k �rttjd��| jd k �r`| jjd k �r`ttjd���n$t| j �tk�r�| j j!d k�slt"| j j!�d
k �r�ttj-t| j j!���| j�r`ttjd���n�t| j �t.k�r�| j j!d k�s�t"| j j!�d
k �r`ttj-t| j j!����n�t| j �t
k�r�tj%| j j&��sttj'| j j&��| j j(d"k�r.ttj)| j j(��| j j/dk�rZ| j j0dk�rZttj'| j j/��| j j/dk�r�tj%| j j/� �r�ttj'| j j/��| j j0dk�r�tj1| j | j j0� �r�ttj| j j0��| j d k�r�ttj��| jd k �r`ttjd��nrt| j �t2k�r>tj%| j j&��s ttj'| j j&��| j j(d#k�r`ttj)| j j(��n"| j d k �r`ttjdt| j � ��| jd k �r�| jj3�r�| jj3d$k�r�ttj4| jj3��| jj5d k �r�| jj5j6� | jd k �r�t| j�t7t8t9gk�r�ttj:t| j���| jj5d k �r�| jj5j6� | jd k �r\t| j�t8k�r(| jj6| j � nt| j�t;k�rB| jj6� | jj5d k �r\| jj5j6� d S )%Nr4 r5 z/'priority' attribute must be between %d and %d.r zno element, no actionz%no element, no source, no destinationzno action, no log, no auditzaddress and maczaddress and ipsetz
mac and ipsetzinvalid sourcezinvalid destinationr< �tcp�udp�sctp�dccpzmasquerade and actionzmasquerade and mac sourcezicmp-block and actionr zforward-port and actionzUnknown element %s�emerg�alert�crit�error�warning�notice�info�debug)r4 r5 )r� r� r� r� )r� r� r� r� )r� r� r� r� )r� r� r� r� r� r� r� r� )<r7 r r ZINVALID_FAMILYr` r ra ZMISSING_FAMILYr3 rb r
r_ � priority_min� priority_maxr� rc re r r r rd r r r Z
check_addressZ INVALID_ADDRrR Z check_macZ INVALID_MACr Z
INVALID_IPSETZINVALID_DESTINATIONr r) r> ZINVALID_SERVICEr Z
check_portr* Z INVALID_PORTr+ ZINVALID_PROTOCOLr Z
checkProtocolr, ZINVALID_ICMPTYPEr r. r/ Zcheck_single_addressr r1 ZINVALID_LOG_LEVELr2 r8 r
r r ZINVALID_AUDIT_TYPEr )r r! r! r" r8 h s�
zRich_Rule.checkc C s� d}| j r|d| j 7 }| jr,|d| j 7 }| jr@|d| j 7 }| jrT|d| j 7 }| jrh|d| j 7 }| jr||d| j 7 }| jr�|d| j 7 }| jr�|d| j 7 }tj r�tj
|�S |S )Nrq z priority="%d"z family="%s"z %s) r_ r7 r` ra rb rc rd re r ZPY2Zu2b)r r$ r! r! r" r% s$ zRich_Rule.__str__i ���)NNr )
r& r' r( r� r� r# rp rf r8 r% r! r! r! r" r T s
o -Ni i� i�Q ) �__all__Zfirewallr Zfirewall.core.ipsetr Zfirewall.core.baser r Zfirewall.errorsr �objectr r r r r r r r r r
r r r
r r r rZ r r r! r! r! r" �<module> s@
d