%PDF-
%PDF-
Mini Shell
Mini Shell
# -*- coding: utf-8 -*-
'''
Support for Config Server Firewall (CSF)
========================================
:maintainer: Mostafa Hussein <mostafa.hussein91@gmail.com>
:maturity: new
:platform: Linux
'''
# Import Python Libs
from __future__ import absolute_import, print_function, unicode_literals
import re
# Import Salt Libs
import salt.utils.path
from salt.exceptions import CommandExecutionError, SaltInvocationError
from salt.ext import six
def __virtual__():
'''
Only load if csf exists on the system
'''
if salt.utils.path.which('csf') is None:
return (False,
'The csf execution module cannot be loaded: csf unavailable.')
else:
return True
def _temp_exists(method, ip):
'''
Checks if the ip exists as a temporary rule based
on the method supplied, (tempallow, tempdeny).
'''
_type = method.replace('temp', '').upper()
cmd = "csf -t | awk -v code=1 -v type=_type -v ip=ip '$1==type && $2==ip {{code=0}} END {{exit code}}'".format(_type=_type, ip=ip)
exists = __salt__['cmd.run_all'](cmd)
return not bool(exists['retcode'])
def _exists_with_port(method, rule):
path = '/etc/csf/csf.{0}'.format(method)
return __salt__['file.contains'](path, rule)
def exists(method,
ip,
port=None,
proto='tcp',
direction='in',
port_origin='d',
ip_origin='d',
ttl=None,
comment=''):
'''
Returns true a rule for the ip already exists
based on the method supplied. Returns false if
not found.
CLI Example:
.. code-block:: bash
salt '*' csf.exists allow 1.2.3.4
salt '*' csf.exists tempdeny 1.2.3.4
'''
if method.startswith('temp'):
return _temp_exists(method, ip)
if port:
rule = _build_port_rule(ip, port, proto, direction, port_origin, ip_origin, comment)
return _exists_with_port(method, rule)
exists = __salt__['cmd.run_all']("egrep ^'{0} +' /etc/csf/csf.{1}".format(ip, method))
return not bool(exists['retcode'])
def __csf_cmd(cmd):
'''
Execute csf command
'''
csf_cmd = '{0} {1}'.format(salt.utils.path.which('csf'), cmd)
out = __salt__['cmd.run_all'](csf_cmd)
if out['retcode'] != 0:
if not out['stderr']:
ret = out['stdout']
else:
ret = out['stderr']
raise CommandExecutionError(
'csf failed: {0}'.format(ret)
)
else:
ret = out['stdout']
return ret
def _status_csf():
'''
Return True if csf is running otherwise return False
'''
cmd = 'test -e /etc/csf/csf.disable'
out = __salt__['cmd.run_all'](cmd)
return bool(out['retcode'])
def _get_opt(method):
'''
Returns the cmd option based on a long form argument.
'''
opts = {
'allow': '-a',
'deny': '-d',
'unallow': '-ar',
'undeny': '-dr',
'tempallow': '-ta',
'tempdeny': '-td',
'temprm': '-tr'
}
return opts[method]
def _build_args(method, ip, comment):
'''
Returns the cmd args for csf basic allow/deny commands.
'''
opt = _get_opt(method)
args = '{0} {1}'.format(opt, ip)
if comment:
args += ' {0}'.format(comment)
return args
def _access_rule(method,
ip=None,
port=None,
proto='tcp',
direction='in',
port_origin='d',
ip_origin='d',
comment=''):
'''
Handles the cmd execution for allow and deny commands.
'''
if _status_csf():
if ip is None:
return {'error': 'You must supply an ip address or CIDR.'}
if port is None:
args = _build_args(method, ip, comment)
return __csf_cmd(args)
else:
if method not in ['allow', 'deny']:
return {'error': 'Only allow and deny rules are allowed when specifying a port.'}
return _access_rule_with_port(method=method,
ip=ip,
port=port,
proto=proto,
direction=direction,
port_origin=port_origin,
ip_origin=ip_origin,
comment=comment)
def _build_port_rule(ip, port, proto, direction, port_origin, ip_origin, comment):
kwargs = {
'ip': ip,
'port': port,
'proto': proto,
'direction': direction,
'port_origin': port_origin,
'ip_origin': ip_origin,
}
rule = '{proto}|{direction}|{port_origin}={port}|{ip_origin}={ip}'.format(**kwargs)
if comment:
rule += ' #{0}'.format(comment)
return rule
def _remove_access_rule_with_port(method,
ip,
port,
proto='tcp',
direction='in',
port_origin='d',
ip_origin='d',
ttl=None):
rule = _build_port_rule(ip,
port=port,
proto=proto,
direction=direction,
port_origin=port_origin,
ip_origin=ip_origin,
comment='')
rule = rule.replace('|', '[|]')
rule = rule.replace('.', '[.]')
result = __salt__['file.replace']('/etc/csf/csf.{0}'.format(method),
pattern='^{0}(( +)?\#.*)?$\n'.format(rule), # pylint: disable=W1401
repl='')
return result
def _csf_to_list(option):
'''
Extract comma-separated values from a csf.conf
option and return a list.
'''
result = []
line = get_option(option)
if line:
csv = line.split('=')[1].replace(' ', '').replace('"', '')
result = csv.split(',')
return result
def split_option(option):
l = re.split("(?: +)?\=(?: +)?", option) # pylint: disable=W1401
return l
def get_option(option):
pattern = '^{0}(\ +)?\=(\ +)?".*"$'.format(option) # pylint: disable=W1401
grep = __salt__['file.grep']('/etc/csf/csf.conf', pattern, '-E')
if 'stdout' in grep and grep['stdout']:
line = grep['stdout']
return line
return None
def set_option(option, value):
current_option = get_option(option)
if not current_option:
return {'error': 'No such option exists in csf.conf'}
result = __salt__['file.replace']('/etc/csf/csf.conf',
pattern='^{0}(\ +)?\=(\ +)?".*"'.format(option), # pylint: disable=W1401
repl='{0} = "{1}"'.format(option, value))
return result
def get_skipped_nics(ipv6=False):
if ipv6:
option = 'ETH6_DEVICE_SKIP'
else:
option = 'ETH_DEVICE_SKIP'
skipped_nics = _csf_to_list(option)
return skipped_nics
def skip_nic(nic, ipv6=False):
nics = get_skipped_nics(ipv6=ipv6)
nics.append(nic)
return skip_nics(nics, ipv6)
def skip_nics(nics, ipv6=False):
if ipv6:
ipv6 = '6'
else:
ipv6 = ''
nics_csv = ','.join(six.moves.map(six.text_type, nics))
result = __salt__['file.replace']('/etc/csf/csf.conf',
pattern='^ETH{0}_DEVICE_SKIP(\ +)?\=(\ +)?".*"'.format(ipv6), # pylint: disable=W1401
repl='ETH{0}_DEVICE_SKIP = "{1}"'.format(ipv6, nics_csv))
return result
def _access_rule_with_port(method,
ip,
port,
proto='tcp',
direction='in',
port_origin='d',
ip_origin='d',
ttl=None,
comment=''):
results = {}
if direction == 'both':
directions = ['in', 'out']
else:
directions = [direction]
for direction in directions:
_exists = exists(method,
ip,
port=port,
proto=proto,
direction=direction,
port_origin=port_origin,
ip_origin=ip_origin,
ttl=ttl,
comment=comment)
if not _exists:
rule = _build_port_rule(ip,
port=port,
proto=proto,
direction=direction,
port_origin=port_origin,
ip_origin=ip_origin,
comment=comment)
path = '/etc/csf/csf.{0}'.format(method)
results[direction] = __salt__['file.append'](path, rule)
return results
def _tmp_access_rule(method,
ip=None,
ttl=None,
port=None,
direction='in',
port_origin='d',
ip_origin='d',
comment=''):
'''
Handles the cmd execution for tempdeny and tempallow commands.
'''
if _status_csf():
if ip is None:
return {'error': 'You must supply an ip address or CIDR.'}
if ttl is None:
return {'error': 'You must supply a ttl.'}
args = _build_tmp_access_args(method, ip, ttl, port, direction, comment)
return __csf_cmd(args)
def _build_tmp_access_args(method, ip, ttl, port, direction, comment):
'''
Builds the cmd args for temporary access/deny opts.
'''
opt = _get_opt(method)
args = '{0} {1} {2}'.format(opt, ip, ttl)
if port:
args += ' -p {0}'.format(port)
if direction:
args += ' -d {0}'.format(direction)
if comment:
args += ' #{0}'.format(comment)
return args
def running():
'''
Check csf status
CLI Example:
.. code-block:: bash
salt '*' csf.running
'''
return _status_csf()
def disable():
'''
Disable csf permanently
CLI Example:
.. code-block:: bash
salt '*' csf.disable
'''
if _status_csf():
return __csf_cmd('-x')
def enable():
'''
Activate csf if not running
CLI Example:
.. code-block:: bash
salt '*' csf.enable
'''
if not _status_csf():
return __csf_cmd('-e')
def reload():
'''
Restart csf
CLI Example:
.. code-block:: bash
salt '*' csf.reload
'''
return __csf_cmd('-r')
def tempallow(ip=None, ttl=None, port=None, direction=None, comment=''):
'''
Add an rule to the temporary ip allow list.
See :func:`_access_rule`.
1- Add an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.tempallow 127.0.0.1 3600 port=22 direction='in' comment='# Temp dev ssh access'
'''
return _tmp_access_rule('tempallow', ip, ttl, port, direction, comment)
def tempdeny(ip=None, ttl=None, port=None, direction=None, comment=''):
'''
Add a rule to the temporary ip deny list.
See :func:`_access_rule`.
1- Add an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.tempdeny 127.0.0.1 300 port=22 direction='in' comment='# Brute force attempt'
'''
return _tmp_access_rule('tempdeny', ip, ttl, port, direction, comment)
def allow(ip,
port=None,
proto='tcp',
direction='in',
port_origin='d',
ip_origin='s',
ttl=None,
comment=''):
'''
Add an rule to csf allowed hosts
See :func:`_access_rule`.
1- Add an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.allow 127.0.0.1
salt '*' csf.allow 127.0.0.1 comment="Allow localhost"
'''
return _access_rule('allow',
ip,
port=port,
proto=proto,
direction=direction,
port_origin=port_origin,
ip_origin=ip_origin,
comment=comment)
def deny(ip,
port=None,
proto='tcp',
direction='in',
port_origin='d',
ip_origin='d',
ttl=None,
comment=''):
'''
Add an rule to csf denied hosts
See :func:`_access_rule`.
1- Deny an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.deny 127.0.0.1
salt '*' csf.deny 127.0.0.1 comment="Too localhosty"
'''
return _access_rule('deny', ip, port, proto, direction, port_origin, ip_origin, comment)
def remove_temp_rule(ip):
opt = _get_opt('temprm')
args = '{0} {1}'.format(opt, ip)
return __csf_cmd(args)
def unallow(ip):
'''
Remove a rule from the csf denied hosts
See :func:`_access_rule`.
1- Deny an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.unallow 127.0.0.1
'''
return _access_rule('unallow', ip)
def undeny(ip):
'''
Remove a rule from the csf denied hosts
See :func:`_access_rule`.
1- Deny an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.undeny 127.0.0.1
'''
return _access_rule('undeny', ip)
def remove_rule(method,
ip,
port=None,
proto='tcp',
direction='in',
port_origin='d',
ip_origin='s',
ttl=None,
comment=''):
if method.startswith('temp') or ttl:
return remove_temp_rule(ip)
if not port:
if method == 'allow':
return unallow(ip)
elif method == 'deny':
return undeny(ip)
if port:
return _remove_access_rule_with_port(method=method,
ip=ip,
port=port,
proto=proto,
direction=direction,
port_origin=port_origin,
ip_origin=ip_origin)
def allow_ports(ports, proto='tcp', direction='in'):
'''
Fully replace the incoming or outgoing ports
line in the csf.conf file - e.g. TCP_IN, TCP_OUT,
UDP_IN, UDP_OUT, etc.
CLI Example:
.. code-block:: bash
salt '*' csf.allow_ports ports="[22,80,443,4505,4506]" proto='tcp' direction='in'
'''
results = []
ports = set(ports)
ports = list(ports)
proto = proto.upper()
direction = direction.upper()
_validate_direction_and_proto(direction, proto)
ports_csv = ','.join(six.moves.map(six.text_type, ports))
directions = build_directions(direction)
for direction in directions:
result = __salt__['file.replace']('/etc/csf/csf.conf',
pattern='^{0}_{1}(\ +)?\=(\ +)?".*"$'.format(proto, direction), # pylint: disable=W1401
repl='{0}_{1} = "{2}"'.format(proto, direction, ports_csv))
results.append(result)
return results
def get_ports(proto='tcp', direction='in'):
'''
Lists ports from csf.conf based on direction and protocol.
e.g. - TCP_IN, TCP_OUT, UDP_IN, UDP_OUT, etc..
CLI Example:
.. code-block:: bash
salt '*' csf.allow_port 22 proto='tcp' direction='in'
'''
proto = proto.upper()
direction = direction.upper()
results = {}
_validate_direction_and_proto(direction, proto)
directions = build_directions(direction)
for direction in directions:
option = '{0}_{1}'.format(proto, direction)
results[direction] = _csf_to_list(option)
return results
def _validate_direction_and_proto(direction, proto):
if direction.upper() not in ['IN', 'OUT', 'BOTH']:
raise SaltInvocationError(
'You must supply a direction of in, out, or both'
)
if proto.upper() not in ['TCP', 'UDP', 'TCP6', 'UDP6']:
raise SaltInvocationError(
'You must supply tcp, udp, tcp6, or udp6 for the proto keyword'
)
return
def build_directions(direction):
direction = direction.upper()
if direction == 'BOTH':
directions = ['IN', 'OUT']
else:
directions = [direction]
return directions
def allow_port(port, proto='tcp', direction='both'):
'''
Like allow_ports, but it will append to the
existing entry instead of replacing it.
Takes a single port instead of a list of ports.
CLI Example:
.. code-block:: bash
salt '*' csf.allow_port 22 proto='tcp' direction='in'
'''
ports = get_ports(proto=proto, direction=direction)
direction = direction.upper()
_validate_direction_and_proto(direction, proto)
directions = build_directions(direction)
results = []
for direction in directions:
_ports = ports[direction]
_ports.append(port)
results += allow_ports(_ports, proto=proto, direction=direction)
return results
def get_testing_status():
testing = _csf_to_list('TESTING')[0]
return testing
def _toggle_testing(val):
if val == 'on':
val = '1'
elif val == 'off':
val = '0'
else:
raise SaltInvocationError(
"Only valid arg is 'on' or 'off' here."
)
result = __salt__['file.replace']('/etc/csf/csf.conf',
pattern='^TESTING(\ +)?\=(\ +)?".*"', # pylint: disable=W1401
repl='TESTING = "{0}"'.format(val))
return result
def enable_testing_mode():
return _toggle_testing('on')
def disable_testing_mode():
return _toggle_testing('off')
Zerion Mini Shell 1.0