File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/csf.cpython-310.pyc
Back
o ;jb? � @ s d Z ddlZddlZddlmZmZ dd� Zdd� Zdd � Z d_dd�Z dd� Z dd� Z dd� Z dd� Z d`dd�Zdd� Z dad d �Zd d � Zd d!� Zd"d#� Zd$d%� Zdbd'd(�Zdbd)d*�Zdbd+d,�Z dcd-d.�Z ddd/d0�Zd1d2� Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z ded;d<�Z ded=d>�Z! ? dfd@dA�Z" d_dBdC�Z#dDdE� Z$dFdG� Z%dHdI� Z& ? dfdJdK�Z'dgdLdM�Z(dgdNdO�Z)dPdQ� Z*dRdS� Z+dhdUdV�Z,dWdX� Z-dYdZ� Z.d[d\� Z/d]d^� Z0dS )iz� Support for Config Server Firewall (CSF) ======================================== :maintainer: Mostafa Hussein <mostafa.hussein91@gmail.com> :maturity: new :platform: Linux � N)�CommandExecutionError�SaltInvocationErrorc C s t jj�d�du r dS dS )z/ Only load if csf exists on the system �csfN)Fz;The csf execution module cannot be loaded: csf unavailable.T)�salt�utils�path�which� r r �D/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/csf.py� __virtual__ s r c C s8 | � dd��� }dj||d�}td |�}t|d � S )zn Checks if the ip exists as a temporary rule based on the method supplied, (tempallow, tempdeny). �temp� zccsf -t | awk -v code=1 -v type={_type} -v ip={ip} '$1==type && $2==ip {{code=0}} END {{exit code}}')�_type�ip� cmd.run_all�retcode)�replace�upper�format�__salt__�bool)�methodr r �cmd�existsr r r � _temp_exists s �� r c C s d| � �}t d ||�S )N� /etc/csf/csf.z file.contains�r )r �ruler r r r �_exists_with_port' s r �tcp�in�dr c C s\ | � d�r t| |�S |rt|||||||�} t| | �S td d|� d| � ��} t| d � S )z� Returns true a rule for the ip already exists based on the method supplied. Returns false if not found. CLI Example: .. code-block:: bash salt '*' csf.exists allow 1.2.3.4 salt '*' csf.exists tempdeny 1.2.3.4 r r zegrep ^'z +' /etc/csf/csf.r )� startswithr �_build_port_ruler r r ) r r �port�proto� direction� port_origin� ip_origin�ttl�commentr r r r r r , s � r c C sb d� tjj�d�| �}td |�}|d dkr+|d s |d }n|d }td|� ���|d }|S ) z Execute csf command z{} {}r r r r �stderr�stdoutz csf failed: )r r r r r r r )r Zcsf_cmd�out�retr r r � __csf_cmdN s r/ c C s d} t d | �}t|d �S )z> Return True if csf is running otherwise return False z test -e /etc/csf/csf.disabler r )r r )r r- r r r � _status_csf` s r0 c C s dddddddd�}|| S ) z? Returns the cmd option based on a long form argument. z-az-dz-arz-drz-taz-tdz-tr)�allow�deny�unallow�undeny� tempallow�tempdeny�temprmr )r �optsr r r �_get_opti s � r9 c C s, t | �}|� d|� �}|r|d|� �7 }|S )zA Returns the cmd args for csf basic allow/deny commands. � �r9 )r r r* �opt�argsr r r � _build_argsy s r> c C s^ t � r-|du r ddiS |du rt| ||�}t|�S | dvr!ddiS t| |||||||d�S dS )z@ Handles the cmd execution for allow and deny commands. N�error�&You must supply an ip address or CIDR.)r1 r2 z=Only allow and deny rules are allowed when specifying a port.)r r r$ r% r& r' r( r* )r0 r> r/ �_access_rule_with_port) r r r$ r% r& r' r( r* r= r r r � _access_rule� s* ���rB c C s8 | |||||d�}dj di |��}|r|d|� �7 }|S )N)r r$ r% r& r' r( z9{proto}|{direction}|{port_origin}={port}|{ip_origin}={ip}� #r )r ) r r$ r% r& r' r( r* �kwargsr r r r r# � s �r# c C sR t ||||||dd�}|�dd�}|�dd�}td d| � �d |� d �dd �} | S ) Nr �r$ r% r& r' r( r* �|z[|]�.z[.]� file.replacer �^z(( +)?\#.*)?$ ��pattern�repl)r# r r ) r r r$ r% r& r' r( r) r �resultr r r � _remove_access_rule_with_port� s" � �rN c C s< g }t | �}|r |�d�d �dd��dd�}|�d�}|S )zV Extract comma-separated values from a csf.conf option and return a list. �=� r: r �"�,)� get_option�splitr )�optionrM �lineZcsvr r r � _csf_to_list� s rW c C s t �d| �S )Nz(?: +)?\=(?: +)?)�rerT )rU r r r � split_option� s rY c C s< d| � d�}t d d|d�}d|v r |d r |d }|S d S )NrI �(\ +)?\=(\ +)?".*"$z file.grep�/etc/csf/csf.confz-Er, r )rU rK ZgreprV r r r rS � s rS c C s> t | �}|s ddiS td dd| � d�| � d|� d�d �}|S ) Nr? z!No such option exists in csf.confrH r[ rI z(\ +)?\=(\ +)?".*"� = "rQ rJ )rS r )rU �valueZcurrent_optionrM r r r � set_option� s �r^ Fc C s | rd}nd}t |�}|S )NZETH6_DEVICE_SKIPZETH_DEVICE_SKIP�rW )�ipv6rU Z skipped_nicsr r r �get_skipped_nics s ra c C s t |d�}|�| � t||�S )N)r` )ra �append� skip_nics)Znicr` �nicsr r r �skip_nic s re c C sJ |rd}nd}d� tt| ��}td dd|� d�d|� d |� d �d �}|S ) N�6r rR rH r[ z^ETHz _DEVICE_SKIP(\ +)?\=(\ +)?".*"ZETHz_DEVICE_SKIP = "rQ rJ )�join�map�strr )rd r` Znics_csvrM r r r rc s �rc c C sz i } |dkr ddg} n|g} | D ]*}t | ||||||||d� } | s:t|||||||d�} d| � �} td | | �| |< q| S )N�bothr r- )r$ r% r& r' r( r) r* rE r z file.append)r r# r )r r r$ r% r& r' r( r) r* �results� directions�_existsr r r r r rA " s< � � �rA c C sD t � r |du r ddiS |du rddiS t| |||||�}t|�S dS )zH Handles the cmd execution for tempdeny and tempallow commands. Nr? r@ zYou must supply a ttl.)r0 �_build_tmp_access_argsr/ ) r r r) r$ r& r' r( r* r= r r r �_tmp_access_ruleN s �ro c C sV t | �}|� d|� d|� �}|r|d|� �7 }|r |d|� �7 }|r)|d|� �7 }|S )z= Builds the cmd args for temporary access/deny opts. r: z -p z -d rC r; )r r r) r$ r& r* r< r= r r r rn d s rn c C s t � S )zd Check csf status CLI Example: .. code-block:: bash salt '*' csf.running )r0 r r r r �runnings s rp c C s t � rtd�S dS )zk Disable csf permanently CLI Example: .. code-block:: bash salt '*' csf.disable z-xN�r0 r/ r r r r �disable� � �rr c C s t � std�S dS )zn Activate csf if not running CLI Example: .. code-block:: bash salt '*' csf.enable z-eNrq r r r r �enable� rs rt c C � t d�S )z^ Restart csf CLI Example: .. code-block:: bash salt '*' csf.reload z-r)r/ r r r r �reload� s rv c C � t d| ||||�S )z� Add an rule to the temporary ip allow list. See :func:`_access_rule`. 1- Add an IP: CLI Example: .. code-block:: bash salt '*' csf.tempallow 127.0.0.1 3600 port=22 direction='in' comment='# Temp dev ssh access' r5 �ro �r r) r$ r& r* r r r r5 � � r5 c C rw )z� Add a rule to the temporary ip deny list. See :func:`_access_rule`. 1- Add an IP: CLI Example: .. code-block:: bash salt '*' csf.tempdeny 127.0.0.1 300 port=22 direction='in' comment='# Brute force attempt' r6 rx ry r r r r6 � rz r6 �sc C s t d| ||||||d�S )z� Add an rule to csf allowed hosts See :func:`_access_rule`. 1- Add an IP: CLI Example: .. code-block:: bash salt '*' csf.allow 127.0.0.1 salt '*' csf.allow 127.0.0.1 comment="Allow localhost" r1 rE �rB �r r$ r% r& r' r( r) r* r r r r1 � s �r1 c C s t d| ||||||�S )z� Add an rule to csf denied hosts See :func:`_access_rule`. 1- Deny an IP: CLI Example: .. code-block:: bash salt '*' csf.deny 127.0.0.1 salt '*' csf.deny 127.0.0.1 comment="Too localhosty" r2 r| r} r r r r2 � s �r2 c C s t d�}|� d| � �}t|�S )Nr7 r: )r9 r/ )r r< r= r r r �remove_temp_rule s r~ c C � t d| �S )z� Remove a rule from the csf denied hosts See :func:`_access_rule`. 1- Deny an IP: CLI Example: .. code-block:: bash salt '*' csf.unallow 127.0.0.1 r3 r| �r r r r r3 � r3 c C r )z� Remove a rule from the csf denied hosts See :func:`_access_rule`. 1- Deny an IP: CLI Example: .. code-block:: bash salt '*' csf.undeny 127.0.0.1 r4 r| r� r r r r4 r� r4 c C sX | � d�s|r t|�S |s | dkrt|�S | dkr t|�S |r*t| ||||||d�S d S )Nr r1 r2 )r r r$ r% r& r' r( )r" r~ r3 r4 rN ) r r r$ r% r& r' r( r) r* r r r � remove_rule( s$ ��r� c C s� g }t | �} t| �} |�� }|�� }t||� d�tt| ��}t|�}|D ] }td dd|� d|� d�|� d|� d|� d�d �}|� |� q%|S ) a Fully replace the incoming or outgoing ports line in the csf.conf file - e.g. TCP_IN, TCP_OUT, UDP_IN, UDP_OUT, etc. CLI Example: .. code-block:: bash salt '*' csf.allow_ports ports="[22,80,443,4505,4506]" proto='tcp' direction='in' rR rH r[ rI �_rZ r\ rQ rJ ) �set�listr � _validate_direction_and_protorg rh ri �build_directionsr rb )�portsr% r& rk Z ports_csvrl rM r r r � allow_portsI s � r� c C sN | � � } |� � }i }t|| � t|�}|D ]}| � d|� �}t|�||< q|S )z� Lists ports from csf.conf based on direction and protocol. e.g. - TCP_IN, TCP_OUT, UDP_IN, UDP_OUT, etc.. CLI Example: .. code-block:: bash salt '*' csf.allow_port 22 proto='tcp' direction='in' r� )r r� r� rW )r% r& rk rl rU r r r � get_portsl s r� c C s, | � � dvr td��|� � dvrtd��d S )N)�IN�OUT�BOTHz/You must supply a direction of in, out, or both)ZTCPZUDPZTCP6ZUDP6z=You must supply tcp, udp, tcp6, or udp6 for the proto keyword)r r )r& r% r r r r� � s �r� c C s& | � � } | dkrddg}|S | g}|S )Nr� r� r� )r )r& rl r r r r� � s �r� rj c C s\ t ||d�}|�� }t||� t|�}g }|D ]}|| }|�| � |t|||d�7 }q|S )a Like allow_ports, but it will append to the existing entry instead of replacing it. Takes a single port instead of a list of ports. CLI Example: .. code-block:: bash salt '*' csf.allow_port 22 proto='tcp' direction='in' )r% r& )r� r r� r� rb r� )r$ r% r& r� rl rk Z_portsr r r � allow_port� s r� c C s t d�d } | S )NZTESTINGr r_ )Ztestingr r r �get_testing_status� s r� c C sB | dkrd} n | dkrd} nt d��td ddd | � d �d �}|S ) N�on�1�off�0z%Only valid arg is 'on' or 'off' here.rH r[ z^TESTING(\ +)?\=(\ +)?".*"z TESTING = "rQ rJ )r r )�valrM r r r �_toggle_testing� s �r� c C ru )Nr� �r� r r r r �enable_testing_mode� � r� c C ru )Nr� r� r r r r �disable_testing_mode� r� r� )Nr r r! r! Nr )NNr r r! r! r )r r r! r! N)F)r r r! r! Nr )NNNr r! r! r )NNNNr )Nr r r! r{ Nr )r r )r rj )1�__doc__rX Zsalt.utils.pathr Zsalt.exceptionsr r r r r r r/ r0 r9 r> rB r# rN rW rY rS r^ ra re rc rA ro rn rp rr rt rv r5 r6 r1 r2 r~ r3 r4 r� r� r� r� r� r� r� r� r� r� r r r r �<module> s� �" �& � �. � �$ � � ! #
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings