Changeset 125

Timestamp:

06/15/05 20:01:56 (3 years ago)

Author:

athomas

Message:

• Added a dedicated Config class with read only attributes, descriptions, etc.
  
• Added LinuxIPTables. Acquisition of Linux firewalls is working.
  
• Firewall grammar merging is now working.
  

Files:

• fwc/trunk/Config.py (added)
• fwc/trunk/ConfigReader.py (deleted)
• fwc/trunk/Engine.py (modified) (26 diffs)
• fwc/trunk/Firewall.py (modified) (6 diffs)
• fwc/trunk/fwc (modified) (2 diffs)
• fwc/trunk/LinuxIPTables.py (moved) (moved from fwc/trunk/IPTables.py) (6 diffs)
• fwc/trunk/Resolver.py (modified) (1 diff)
• fwc/trunk/Rule.py (deleted)
• fwc/trunk/util.py (modified) (1 diff)

fwc/trunk/Engine.py

@@ -3 +3 @@
-import socket
-from ConfigParser import RawConfigParser
+from Config import Config
-from string import Template
-from CLY.Parser import Parser
-from CLY.Symbols import *
-from util import *
-from Rule import Rule
-from Resolver import Resolver
-from Firewall import Firewall
-IPTables import 
+LinuxIPTables import Linux
-from Object import Object
-from Singleton import Singleton
@@ -17 +17 @@
-class Engine(Singleton):
-        version = '0.1'
-('IPTables',)
+{'linux' : 'LinuxIPTables'}
-
-        class Error(Exception): pass
@@ -24 +24 @@
-                self.__config = RawConfigParser()
-                self.__config.read(['/etc/fwcrc', os.path.expanduser('~/.fwcrc')])
+                self.config = Config()
+                self.config.define('prompt', 'fwc> ', 'FWC prompt')
+                # TODO: Merge loaded config into self.config
-                self.__firewalls = {}
-                # Grammar hooks.
@@ -54 +57 @@
-                                VAR : 'where',
-                                HELP : {
-ruleset
-ruleset
+policy
+policy
-                                },
-                                JUMP : RETURN,
@@ -122 +125 @@
-                                IF : have_firewall,
-                                GLOBAL_LABEL : 'commands',
-
+, self.__hooks['match']
-                                VAR : 'action',
-                                ACTION : {
@@ -168 +171 @@
-                                        },
-
+                                },
+                                'in' : {
+                                        GROUP : 20,
+                                        HELP : 'Match packets coming in an interface.',
+                                        lambda ctx, arg: INTERFACE(ctx, arg) and 'in_if' not in ctx or arg not in ctx['in_if'] : {
+                                                HELP : lambda ctx: [(k, v) for k, v in help_interface(ctx).iteritems() if 'in_if' not in ctx or k not in ctx['in_if']],
+                                                VAR : 'in_if',
+                                                LABEL : 'in-if',
+                                                JUMP_TO : 'in-if',
+                                                JUMP : 'commands',
+                                        },
+                                },
+                                'out' : {
+                                        GROUP : 20,
+                                        HELP : 'Match packets going out an interface.',
+                                        INTERFACE : {
+                                                HELP : help_interface,
+                                                VAR : 'out_if',
+                                                LABEL : 'out-if',
+                                                JUMP_TO : 'out-if',
+                                                JUMP : 'commands',
+                                        },
-                                },
-                                'from' : {
@@ -279 +304 @@
-                        'object' : {
-                                IF : have_firewall,
-Ruleset
+Firewall
-                                'import' : {
-                                        LABEL : 'import',
@@ -299 +324 @@
-                                },
-                                'create' : {
-ruleset
+policy
-                                        '|'.join(Resolver.get_object_types()) : {
-                                                VAR : 'type',
@@ -334 +359 @@
-                                },
-                                'delete' : {
-ruleset
+policy
-                                        's|'.join(Resolver.get_object_types()) + 's' : {
-                                                VAR : 'type',
@@ -375 +400 @@
-                                GROUP : 20,
-                                IF : have_firewall,
-ruleset
+policy
-                                LABEL : 'rule',
-                                RULE : {
@@ -387 +412 @@
-                                GROUP : 20,
-                                IF : have_firewall,
-ruleset
-ruleset
+policy
+policy
-                        },
-                        'move' : {
@@ -407 +432 @@
-                        'firewall' : {
-                                HELP : "Commands for firewall management.",
+                                'set' : {
+                                        GROUP : 10,
+                                        IF : have_firewall,
+                                        HELP : 'Display or set firewall settings',
+                                        ACTION : {
+                                                HELP : 'List current settings.',
+                                                ACTION : self.__list_firewall_settings,
+                                        },
+                                        lambda ctx, setting: setting in self.firewall.config and not self.firewall.config.readonly(setting): {
+                                                VAR : 'setting',
+                                                HELP : lambda ctx: [ (v, 'Set ' + self.firewall.config.help(v)) for v in self.firewall.config if not self.firewall.config.readonly(v) ],
+                                                lambda ctx, value: self.firewall.config.validate(ctx['setting'], value) : {
+                                                        VAR : 'value',
+                                                        HELP : ('<value>', 'Value for setting'),
+                                                        ACTION : self.__firewall_set,
+                                                },
+                                        },
+                                },
+                                'unset' : {
+                                        GROUP : 10,
+                                        HELP : 'Unset a firewall setting.',
+                                        IF : have_firewall,
+                                        lambda ctx, setting: setting in self.firewall.config and not self.firewall.config.readonly(setting): {
+                                                VAR : 'setting',
+                                                HELP : lambda ctx: [ (v, 'Unset ' + self.firewall.config.help(v)) for v in self.firewall.config if not self.firewall.config.readonly(v) ],
+                                                ACTION : self.__firewall_unset,
+                                        }
+                                },
-                                'acquire' : {
-                                        HELP : 'Acquire a firewall for management.',
@@ -412 +465 @@
-                                                VAR : 'name',
-                                                HELP : ('<name>', 'Name of firewall.'),
-
-
-
-
-
+
+
-                                                        JUMP : 'acquire',
-                                                },
-                                                FIREWALL_TYPE : {
-                                                        IF : lambda ctx: 'ip' in ctx or name_to_ip(ctx['name']),
-                                                        VAR : 'type',
-                                                        HELP : help_firewall_type,
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                                                },
-                                        },
@@ -429 +494 @@
-                                'list' : {
-                                        HELP : "List available firewalls.",
+                                        ACTION : self.__list_firewalls,
-                                },
-                                'switch' : {
-
+active 
-                                        FIREWALL : {
-                                                VAR : 'firewall',
@@ -439 +505 @@
-                                        },
-                                },
-                                FIREWALL : {
-                                        GROUP : 10,
-                                        VAR : 'firewall',
-                                        HELP : help_firewall,
-                                        'list' : {
-                                                HELP : 'List settings for this firewall.',
-                                                ACTION : lambda ctx, firewall: self.__list_firewall_settings(firewall),
-                                        },
-                                },
-                        },
-                }
@@ -453 +510 @@
-                self._parser = Parser(self.__grammar)
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                if type == 'all':
-                        type = Resolver.get_object_types()
@@ -468 +547 @@
-
-        def __list_firewall_settings(self, firewall):
-
+, '^B^UDescription^N'
-                rows = []
-
-
-
+
+
-                rows.sort(lambda a, b: cmp(a[0], b[0]))
-                print_table(rows, heading)
-                
-        def __firewall_class(self, type):
-                for i in self.firewall_types:
-                        if i.lower() == type:
-                                type = i
-                                break
-                from DynamicLoader import loadClass
-type, type
-
-
+self.firewall_types[type], self.firewall_types[type]
+
+, description = ''
-                if name in self.__firewalls:
-                        raise Engine.Error("Firewall '%s' already acquired" % name)
@@ -501 +575 @@
-                        fw = FirewallClass(name, ip, self)
-                        fw.acquire()
+                        fw.config.description = description
-                        self.set_firewall(fw)
+                except KeyboardInterrupt:
+                        warning("User aborted acquisition of firewall")
-                except Exception, e:
-                        error(e)
-
-ontext
+tx
-                info("Firewall console exit.")
-                sys.exit(0)
-
-ontext, action, source = [], sport = [], destination = [], dport = [], protocol = None, description = None, where = 'bottom', index = None, state = 'new', log = None, reject_type = None, reject_subtype = None
+tx, source = [], sport = [], in_if = [], destination = [], dport = [], out_if = [], log = None, index = None, where = 'bottom', **argd
-                if log:
-                        if log == 'log':
@@ -516 +593 @@
-                                log = log[1]
-                if index != None: index = int(index)
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                self.firewall.remove(map(int, rules))
-
-ontext
+tx
-                if index and old == index: return
-                try:
@@ -532 +622 @@
-                        raise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
-                try:
-                        self.resolver.add_object(Object(type, name, value, description))
@@ -588 +647 @@
-                                self.unhook(hook, grammar)
-                        self.resolver = None
+                        self.prompt = 'fwc> '
-
-                self.firewall = firewall
-                if self.firewall:
-                        self.resolver = firewall.resolver
-
+config.
-                        for hook, grammar in firewall.hooks.iteritems():
-                                self.hook(hook, grammar)
-
+
+
-
-        def hook(self, hook, grammar):
@@ -605 +666 @@
-                self.__hooks[hook].remove(grammar)
-
-        def rawgetv(self, section, key, default = None):
-                try:
-                        return self.__config.get(section, key)
-                except:
-                        return default
-
-        def getv(self, section, key, default = None):
-                try:
-                        return self.expandv(section, self.__config.get(section, key))
-                except:
-                        return default
-
-        def hasv(self, section, key):
-                return self.__config.has_option(section, key)
-
-        def setv(self, section, key, value):
-                return self.__config.set(section, key, value)
-
-        def setdefaultv(self, section, key, value):
-                if not self.hasv(section, key):
-                        self.setv(section, key, value)
-
-        def listv(self, section):
-                return self.__config.options(section)
-
-        def expandv(self, section, text):
-                vars = dict(self.__config.items(section))
-                lasttext = ''
-                while '$' in text and lasttext != text:
-                        lasttext = text[:]
-                        text = Template(text).safe_substitute(vars)
-                return text
-
-
-
-ontext
-ontext
-
-ontext
+tx
+tx
+
+tx
-        """ Return true if the current firewall is have_firewall. """
-        return Engine().firewall
-
-ontext
+tx
-        if include_generic:
-                help = { '<%s>' % type : '%s object.' % type.title() }
@@ -659 +687 @@
-        return help
-
-ontext
+tx
-        help = { '<network>' : 'Network address.'}
-'network'
+Object.NETWORK
-                if o.description:
-                        help[o.name] = "%s (%s)" % (o.description, ', '.join(tolist(o.value)))
@@ -668 +696 @@
-        return help
-                
-
+
+
+
+
+
+
+
+
+
+
-        help = { '<port>' : 'Port.'}
-'port'
+Object.PORT
-                text = o.description or "Port object %s" % o.name
-                help[o.name] = text + " (%s)" % ', '.join(tolist(o.value))
-        return help
-
-ontext
+tx
-        help = {}
-        for name, fw in Engine()._Engine__firewalls.iteritems():
-
+
+
+
+
-                if Engine().firewall == fw:
-                        help[name] += ' ^B(current)^B'
@@ -691 +731 @@
-
-
-ontext
+tx
-        return re.match(Object.IP_PATTERN, str)
-
-
+
+
+
+
+
-        return re.match(Object.NETWORK_PATTERN, str) \
-ontext
-
-ontext
+tx
+
+tx
-        return re.match(Object.PORT_PATTERN, str) \
-ontext
-
-ontext
+tx
+
+tx
-        range = str.split('-')
-ontext
-
-ontext
+tx
+
+tx
-        try:
-                return int(str) >= 0 and int(str) < len(Engine().firewall.get_rules())
@@ -712 +756 @@
-                return False
-
-ontext
-ontext
-
-ontext
+tx
+tx
+
+tx
-        help = {}
-
+.keys()
-                help[type.lower()] = 'Firewall type %s' % type
-        return help
-
-ontext
-map(str.lower, Engine().firewall_types)
+tx
+Engine().firewall_types

fwc/trunk/Firewall.py

@@ -1 @@
-Reader import ConfigReader
+ import Config
-from Resolver import Resolver
-from Rule import Rule
-from Object import Object
-
+
+
-
-(ConfigReader)
+
-        """
-                The Firewall class contains all 
@@ -14 +14 @@
-        class InvalidRule(Error): pass
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                self.__rules = []
-                self.resolver = Resolver()
-name, self.ip, self.engine, self.hooks = name, ip,
+engine, self.hooks =
-
-        def resolve_rule(self, rule):
@@ -48 +68 @@
-                                raise Firewall.InvalidIndex("invalid location '%s' for rule addition" % where)
-                except IndexError:
-ruleset
+policy
-
-        def move(self, old, new):
@@ -64 +84 @@
-                                raise
-                except IndexError:
-ruleset
+policy
-
-        def remove(self, index):
@@ -83 +103 @@
-                return self.__rules[rule]
-
+        def describe_rule(self, rule, pretty = True):
+                description = "^B%s^B" % rule.action
+                if rule.protocol:
+                        try:
+                                description += ' protocol ^B%s^B' % int(rule.protocol)
+                        except:
+                                description += " ^B" + rule.protocol + "^B"
+                if rule.source or rule.sport:
+                        description += " from"
+                        if rule.source:
+                                description += " ^B" + ' '.join(rule.source) + "^B"
+                        if rule.sport:
+                                description += " port ^B" + ' '.join(rule.sport) + "^B"
+                if rule.in_if:
+                        description += " in ^B%s^B" % ' '.join(rule.in_if)
+                if rule.destination or rule.dport:
+                        description += " to"
+                        if rule.destination:
+                                description += " ^B" + ' '.join(rule.destination) + "^B"
+                        if rule.dport:
+                                description += " port ^B" + ' '.join(rule.dport) + "^B"
+                if rule.out_if:
+                        description += " out ^B%s^B" % ' '.join(rule.out_if)
+                if rule.reject_type:
+                        description += " with ^B%s^B" % rule.reject_type
+                        if rule.reject_subtype:
+                                description += " ^B%s^B" % rule.reject_subtype
+                if rule.log:
+                        description += " log"
+                        if type(rule.log) is str:
+                                description += " message ^B'%s'^B" % rule.log
+                if rule.description:
+                        description += " description ^B'%s'^B" % rule.description
+                if not pretty:
+                        description = re.sub(r'\^.', '', description)
+                return description
+
+        def list_rules(self):
+                for ruleno, rule in enumerate(self.__rules):
+                        cprint("^B%3i:^B %s" % (ruleno, self.describe_rule(rule)))
+
-        def get_rules(self):
-                return self.__rules
@@ -91 +152 @@
-        @abstract
-        def install(self):
-ruleset
+policy
-
-        @abstract

fwc/trunk/fwc

@@ -10 +10 @@
-from CLY.Interactive import interact
-from util import *
-from Rule import Rule
-from Object import Object
-from Firewall import Firewall
@@ -28 +27 @@
-
-while True:
-getv('default', 'prompt', 'fwc> ')
+config.prompt
-
-        if result.state == Result.NOP:

fwc/trunk/LinuxIPTables.py

@@ -1 +1 @@
-from Interface import Interface
-from Firewall import Firewall
-from ConfigReader import ConfigReader
-from CLY.Symbols import *
-from Object import Object
@@ -7 +6 @@
-import os
-
-
+
+
+
+
+
+
+
-        def __init__(self, name, ip, engine):
-
+
+
+
+
+
+
+
-                        'match' : {
-                                'state' : {
@@ -15 +26 @@
-                                        RANGE : 1,
-                                        HELP : 'Match connections in this state (default: new).',
-'new|established|invalid|related'