Changeset 117

Timestamp:

05/14/05 23:46:29 (4 years ago)

Author:

athomas

Message:

• Implemented grouping and ordering.
  
• More additions to th efwc.
  

Files:

• fwc/trunk/fwc (modified) (26 diffs)
• fwc/trunk/Object.py (modified) (1 diff)
• fwc/trunk/Resolver.py (modified) (5 diffs)
• fwc/trunk/Rule.py (modified) (2 diffs)
• fwc/trunk/util.py (modified) (1 diff)

fwc/trunk/fwc

@@ -22 +22 @@
-firewall = Firewall("localhost", resolver)
-
-def to_list(value):
-        if type(value) is not list: return [value]
-        return value
-
-def check_port_protocol(context):
-        return 'protocol' in context and context['protocol'] in [ 'tcp', 'udp' ]
@@ -42 +38 @@
-        for o in resolver.get_objects('network'):
-                if o.description:
-o.description + "(%s)" % o.value
+"%s (%s)" % (o.description, o.value)
-                else:
-                        help[o.name] = o.value
@@ -85 +81 @@
-# Commands
-
-
+, reject_type = None, reject_subtype = None
-        if log:
-                if log == 'log':
@@ -92 +88 @@
-                        log = log[1]
-        if index != None: index = int(index)
-_list(source), to_list(sport), to_list(destination), to_list(dport), protocol, description, state, log
+list(source), tolist(sport), tolist(destination), tolist(dport), protocol, description, state, log, reject_type, reject_subtype
-
-def remove_rule(context, rules):
@@ -114 +110 @@
-                        cmd += " state ^B" + rule.state + "^B"
-                if rule.protocol:
-
+
+
+
+
-                if rule.source or rule.sport:
-                        cmd += " from"
@@ -127 +126 @@
-                        if rule.dport:
-                                cmd += " port ^B" + ' '.join(rule.dport) + "^B"
+                if rule.reject_type:
+                        cmd += " with ^B%s^B" % rule.reject_type
+                        if rule.reject_subtype:
+                                cmd += " ^B%s^B" % rule.reject_subtype
-                if rule.log:
-                        cmd += " log"
-                        if type(rule.log) is str:
-
+message 
-                if rule.description:
-                        cmd += " description ^B'%s'^B" % rule.description
@@ -143 +146 @@
-
-def list_objects(context, type = Resolver.get_object_types()):
-_
+
-                objects = resolver.get_objects(t)
-
+, lambda a, b: cmp(a.name, b.name)
-                        str = "%s ^B%s^B ^B^6%s^N" % (o.type, o.name, o.value)
-                        if o.description: str += " ^2'%s^N'" % o.description
@@ -158 +161 @@
-placement_rules = {
-        'replace' : {
-'Rule ordering.'
+10
-                UNLESS_VAR : [ 'old', 'where' ],
-                VAR : 'where',
@@ -169 +172 @@
-        },
-        'top|bottom' : {
-'Rule ordering.'
+10
-                UNLESS_VAR : 'where',
-                VAR : 'where',
@@ -179 +182 @@
-        },
-        'before|after' : {
-'Rule ordering.'
+10
-                UNLESS_VAR : 'where',
-                VAR : 'where',
@@ -195 +198 @@
-
-protocol_rules = {
-'tcp|udp|icmp|ah|esp'
-'Packet matching.'
+lambda ctx, foo: [x.name for x in resolver.get_objects('protocol')]
+30
-                UNLESS_VAR : 'protocol',
-                VAR : 'protocol',
-
-
-
-
-
-
-
+
-                JUMP : RETURN,
+        },
+        'protocol' : {
+                GROUP : 30,
+                HELP : 'Arbitrary IP protocol number.',
+                UNLESS_VAR : 'protocol',
+                '\d+' : {
+                        HELP : ('<protocol>', 'IP protocol number.'),
+                        JUMP : RETURN,
+                        VAR : 'protocol',
+                },
-        },
-}
@@ -212 +219 @@
-# Grammar
-cli = CLI({
+        'nat' : {
+                MERGE : [ placement_rules, protocol_rules ],
+                GROUP : 10,
+                HELP : 'NAT matching packets.',
+                VAR : 'action',
+                'to' : {
+                        HELP : 'Specify destination to NAT to.',
+                        Object.NETWORK_PATTERN : {
+                                VAR : 'nat_ip',
+                                HELP : ('<ip>', 'NAT to IP address.'),
+                                'if' : {
+                                        HELP : 'NAT on the following conditions.',
+                                        JUMP : 'commands',
+                                },
+                        },
+                },
+        },
-        'accept|drop|reject' : {
+                GROUP : 10,
-                IF : have_modifiable_firewall,
-                GLOBAL_LABEL : 'commands',
+                MERGE : [ placement_rules, protocol_rules ],
+                VAR : 'action',
+                ACTION : {
+                        HELP : 'Add rule to firewall.',
+                        # Only if a source or destination have actually been specified
+                        #IF : lambda ctx: 'source' in ctx or 'destination' in ctx,
+                        ACTION : insert_rule,
+                },
+                HELP : {
+                        'accept' : 'Add rule accepting matching packets.',
+                        'drop' : 'Add rule dropping matching packets.',
+                        'reject' : 'Add rule rejecting matching packets.',
+                },
+                'with' : {
+                        IF : lambda ctx: 'reject_type' not in ctx and ctx['action'] == 'reject',
+                        HELP : 'Reject with the specified packet type.',
+                        'tcp' : {
+                                VAR : 'reject_type',
+                                HELP : 'Reject with tcp... packet.',
+                                'reset' : {
+                                        VAR : 'reject_subtype',
+                                        IF : lambda ctx: 'protocol' in ctx and ctx['protocol'] == 'tcp',
+                                        HELP : 'Reject with TCP reset.',
+                                        JUMP : 'commands',
+                                },
+                        },
+                        'network|host|protocol|admin' : {
+                                VAR : 'reject_type',
+                                HELP : {
+                                        'network' : 'Reject with icmp-network... packet.',
+                                        'host' : 'Reject with icmp-host... packet.',
+                                        'protocol' : 'Reject with icmp-protocol... packet.',
+                                        'admin' : 'Reject with icmp-admin... packet.',
+                                },
+                                'unreachable' : {
+                                        HELP : lambda ctx: { 'unreachable' : 'Reject with icmp-%s-unreachable.' % ctx['reject_type'] },
+                                        IF : lambda ctx: ctx['reject_type'] != 'admin',
+                                        VAR : 'reject_subtype',
+                                        JUMP : 'commands',
+                                },
+                                'prohibited' : {
+                                        HELP : lambda ctx: { 'prohibited' : 'Reject with icmp-%s-prohibited.' % ctx['reject_type'] },
+                                        IF : lambda ctx: ctx['reject_type'] in ('network', 'host', 'admin'),
+                                        VAR : 'reject_subtype',
+                                        JUMP : 'commands',
+                                },
+                        },
+
+                },
-                'state' : {
-'Packet matching.'
+20
-                        RANGE : 1,
-                        HELP : 'Match connections in this state (default: new).',
@@ -230 +304 @@
-                        },
-                },
-                ACTION : {
-                        HELP : 'Add rule to firewall.',
-                        # Only if a source or destination have actually been specified
-                        #IF : lambda ctx: 'source' in ctx or 'destination' in ctx,
-                        ACTION : insert_rule,
-                },
-                MERGE : [ placement_rules, protocol_rules ],
-                VAR : 'action',
-                HELP : {
-                        'accept' : 'Add rule accepting matching packets.',
-                        'drop' : 'Add rule dropping matching packets.',
-                        'reject' : 'Add rule rejecting matching packets.',
-                },
-                'from' : {
-'Packet matching.'
+20
-                        HELP : 'Match source network or port.',
-                        IF : lambda ctx: ('protocol' in ctx and ctx['protocol'] in ['tcp', 'udp'] and not 'sport' in ctx) or not 'source' in ctx,
@@ -252 +313 @@
-                                JUMP : 'commands',
-                                JUMP_TO : 'source',
+                                GROUP : 20,
-                                'port' : {
+                                        GROUP : 20,
-                                        RANGE : 1,
-                                        HELP : 'Match source port.',
@@ -268 +331 @@
-                        'port' : {
-                                HELP : 'Match source port.',
+                                GROUP : 20,
-                                PORT : {
-                                        HELP : help_port,
@@ -280 +344 @@
-                },
-                'description' : {
-                        GROUP : 'Meta information.',
-                        '.+' : {
-                                VAR : 'description',
@@ -290 +353 @@
-                },
-                'to' : {
+                        GROUP : 20,
-                        IF : lambda ctx: ('protocol' in ctx and ctx['protocol'] in ['tcp', 'udp'] and not 'dport' in ctx) or not 'destination' in ctx,
-                        UNLESS_VAR : [ 'dport', 'destination' ],
-                        NETWORK : {
+                                GROUP : 20,
-                                LABEL : 'destination',
-                                VAR : 'destination',
@@ -298 +363 @@
-                                JUMP_TO : 'destination',
-                                'port' : {
+                                        GROUP : 20,
-                                        PORT : {
-                                                LABEL : 'dport',
@@ -311 +377 @@
-                        },
-                        'port' : {
+                                GROUP : 20,
-                                PORT : {
-                                        LABEL : 'dports',
@@ -325 +392 @@
-                'log' : {
-                        VAR : 'log',
+                        UNLESS_VAR : 'log',
-                        HELP : "Log a message when this rule matches.",
-
-
-
-
+
+
+
+
+
+
+
-                        },
-                        JUMP : 'commands',
@@ -342 +413 @@
-        },
-        'object' : {
-Manage ruleset
+Ruleset manipulation
-                'import' : {
-
+
+
+
+
+
+
+
-                        ACTION : lambda x: resolver.populate_defaults(),
-                },
@@ -388 +465 @@
-                'delete' : {
-                        HELP : 'Delete a ruleset object.',
-network|port'
+|'.join(Resolver.get_object_types())
-                                VAR : 'type',
-                                HELP : {
@@ -402 +479 @@
-                                ACTION : list_objects,
-                        },
-network|port'
+|'.join(Resolver.get_object_types())
-                                VAR : 'type',
-
-
-
-
+
-                                ACTION : list_objects,
-                        },
@@ -413 +487 @@
-        },
-        'delete' : {
+                GROUP : 10,
-                IF : have_modifiable_firewall,
-                HELP : 'Remove rule(s) from the ruleset.',
@@ -424 +499 @@
-        },
-        'list' : {
+                GROUP : 10,
-                IF : have_firewall,
-                HELP : 'List ruleset.',
-                ACTION : list_ruleset,
-        },
-        HELP : "Commands to manage the ruleset.",
-        'move' : {
+                GROUP : 10,
-                IF : have_modifiable_firewall,
-                HELP : 'Move rule.',
@@ -514 +590 @@
-def format_help(help):
-        length = 0
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-readline.set_completer(cli_completion)

fwc/trunk/Object.py

@@ -3 +3 @@
-        NETWORK = 'network'
-        PORT = 'port'
+        PROTOCOL = 'protocol'
-
-        NETWORK_PATTERN = r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:/\d{1,2})?'
-        PORT_PATTERN = r'\d{1,5}'
+        PROTOCOL_PATTERN = r'\d{1,3}'
-
-        # Regex matching a valid object name

fwc/trunk/Resolver.py

@@ -3 +3 @@
-from util import *
-
+def get_object_types():
+        return ('network', 'port', 'protocol')
+
-class Resolver:
+        """
+                The Resolver class handles the resolution of symbolic network object
+                names into actual network objects. This currently includes port objects
+                and network objects.
+
+                The canonical name for objects is in the form:
+
+                        <type>:<name>
+
+                eg. port:ssh, network:swapoff.org, etc.
+
+        """
-        class Error(Exception): pass
-        class InvalidObject(Error): pass
@@ -11 +26 @@
-                def __init__(self, resolver):
-                        self.__resolver = resolver
-self.__resolver.
+
-                        self.__type = self.__types.pop()
-                        self.__objectit = iter(self.__resolver.get_objects(self.__type))
@@ -27 +42 @@
-        def __init__(self):
-                self.__objects = {}
-Resolver.
+
-                        self.__objects[t] = {}
-
-                # Set up default objects
-                self.add_object(Object(Object.NETWORK, 'any', '0.0.0.0/0', 'Any network address'))
+                self.add_object(Object(Object.NETWORK, 'localhost', '127.0.0.1', 'Local host'))
-                self.add_object(Object(Object.PORT, 'any', '0-65535', 'Any port'))
+                # Default protocols
+                self.add_object(Object(Object.PROTOCOL, 'tcp', '6', 'Transmission Control Protocol'))
+                self.add_object(Object(Object.PROTOCOL, 'udp', '17', 'User Datagram Protocol'))
+                self.add_object(Object(Object.PROTOCOL, 'icmp', '1', 'Internet Control Message Protocol'))
-
-        def resolve_object(self, type, name):
@@ -42 +62 @@
-                return self.resolve_object('network', network)
-
-        def resolve_ip(self, ip):
-                return self.resolve_object('ip', ip)
-
-        def resolve_port(self, port):
-                return self.resolve_object('port', port)
+
+        def resolve_protocol(self, protocol):
+                return self.resolve_object('protocol', protocol)
-
-        def resolve(self, descriptor):
@@ -66 +86 @@
-                        raise Resolver.InvalidObject("Object '%s:%s' not in ruleset" % (object.type, object.name))
-
-
+, types = get_object_types()
-                """ Populate object database from system. """
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
+
+
+
+
-
-        def get_objects(self, type):

fwc/trunk/Rule.py

@@ -1 +1 @@
-class Rule:
-
+, reject_type = None, reject_subtype = None
-                self.action = action
-                self.source = source
@@ -11 +11 @@
-                self.state = state
-                self.log = log
-
+
+

fwc/trunk/util.py

@@ -813 +813 @@
-        """ Print a green notice prefixed by INF. """
-        cprint("^2^BINF ^B" + ' '.join(map(str, args)) + '^N')
+
+def tolist(o):
+        """ Convert a scalar object into a list or simply return the list/tuple. """
+        if type(o) is list or type(o) is tuple: return list(o)
+        return [o]