Current File : //usr/lib/python2.7/site-packages/salt/modules/csf.pyc
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l m Z m
Z
d d l m Z d � Z
d � Z d � Z d d d
d d d d d
� Z d � Z d � Z d � Z d � Z d d d d
d d d d � Z d � Z d d
d d d d � Z d � Z d � Z d � Z d � Z e d � Z e d � Z e d � Z d d
d d d d d � Z! d d d d
d d d d � Z" d � Z# d � Z$ d � Z% d! � Z& d" � Z' d d d d d d# � Z( d d d d d d$ � Z) d d d
d d% d d d& � Z* d d d
d d d d d' � Z+ d( � Z, d) � Z- d* � Z. d d d
d d% d d d+ � Z/ d d
d, � Z0 d d
d- � Z1 d. � Z2 d/ � Z3 d d0 d1 � Z4 d2 � Z5 d3 � Z6 d4 � Z7 d5 � Z8 d S(6 u�
Support for Config Server Firewall (CSF)
========================================
:maintainer: Mostafa Hussein <mostafa.hussein91@gmail.com>
:maturity: new
:platform: Linux
i ( t absolute_importt print_functiont unicode_literalsN( t CommandExecutionErrort SaltInvocationError( t sixc C@ s- t j j j d � d k r% t d f St Sd S( u/
Only load if csf exists on the system
u csfu; The csf execution module cannot be loaded: csf unavailable.N( t saltt utilst patht whicht Nonet Falset True( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt __virtual__ s c C@ sO | j d d � j � } d j d | d | � } t d | � } t | d � S( un
Checks if the ip exists as a temporary rule based
on the method supplied, (tempallow, tempdeny).
u tempu u_ csf -t | awk -v code=1 -v type=_type -v ip=ip '$1==type && $2==ip {{code=0}} END {{exit code}}'t _typet ipu cmd.run_allu retcode( t replacet uppert formatt __salt__t bool( t methodR R t cmdt exists( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt _temp_exists s c C@ s d j | � } t d | | � S( Nu /etc/csf/csf.{0}u
file.contains( R R ( R t ruleR ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt _exists_with_port* s u tcpu inu du c C@ sx | j d � r t | | � S| rM t | | | | | | | � } t | | � St d d j | | � � }
t |
d � S( u�
Returns true a rule for the ip already exists
based on the method supplied. Returns false if
not found.
CLI Example:
.. code-block:: bash
salt '*' csf.exists allow 1.2.3.4
salt '*' csf.exists tempdeny 1.2.3.4
u tempu cmd.run_allu egrep ^'{0} +' /etc/csf/csf.{1}u retcode( t
startswithR t _build_port_ruleR R R R ( R R t portt protot directiont port_origint ip_origint ttlt commentR R ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyR / s
c C@ s� d j t j j j d � | � } t d | � } | d d k rz | d sX | d } n
| d } t d j | � � � n
| d } | S( u
Execute csf command
u {0} {1}u csfu cmd.run_allu retcodei u stderru stdoutu csf failed: {0}( R R R R R R R ( R t csf_cmdt outt ret( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt __csf_cmdL s !
c C@ s$ d } t d | � } t | d � S( u>
Return True if csf is running otherwise return False
u test -e /etc/csf/csf.disableu cmd.run_allu retcode( R R ( R R% ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt _status_csf` s c C@ s? i d d 6d d 6d d 6d d 6d d
6d d 6d
d 6} | | S( u?
Returns the cmd option based on a long form argument.
u -au allowu -du denyu -aru unallowu -dru undenyu -tau tempallowu -tdu tempdenyu -tru temprm( ( R t opts( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt _get_opti s
c C@ s> t | � } d j | | � } | r: | d j | � 7} n | S( uA
Returns the cmd args for csf basic allow/deny commands.
u {0} {1}u {0}( R* R ( R R R# t optt args( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt _build_argsy s
c C@ s� t � r� | d k r i d d 6S| d k rH t | | | � } t | � S| d k r_ i d d 6St d | d | d | d | d
| d | d | d
| � Sn d S( u@
Handles the cmd execution for allow and deny commands.
u& You must supply an ip address or CIDR.u erroru allowu denyu= Only allow and deny rules are allowed when specifying a port.R R R R R R R! R# N( u allowu deny( R( R
R- R' t _access_rule_with_port( R R R R R R R! R# R, ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt _access_rule� s
c C@ s_ i | d 6| d 6| d 6| d 6| d 6| d 6} d j | � } | r[ | d j | � 7} n | S( Nu ipu portu protou directionu port_originu ip_originu9 {proto}|{direction}|{port_origin}={port}|{ip_origin}={ip}u #{0}( R ( R R R R R R! R# t kwargsR ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyR � s
c
C@ s� t | d | d | d | d | d | d d �} | j d d � } | j d
d � } t d d
j | � d d j | � d d �} | S( NR R R R R! R# u u |u [|]u .u [.]u file.replaceu /etc/csf/csf.{0}t patternu ^{0}(( +)?\#.*)?$
t repl( R R R R (
R R R R R R R! R" R t result( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt _remove_access_rule_with_port� s c C@ sY g } t | � } | rU | j d � d j d d � j d d � } | j d � } n | S( uV
Extract comma-separated values from a csf.conf
option and return a list.
u =i u u u "u ,( t
get_optiont splitR ( t optionR3 t linet csv( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt _csf_to_list� s +c C@ s t j d | � } | S( Nu (?: +)?\=(?: +)?( t reR6 ( R7 t l( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt split_option� s c C@ sM d j | � } t d d | d � } d | k rI | d rI | d } | Sd S( Nu ^{0}(\ +)?\=(\ +)?".*"$u file.grepu /etc/csf/csf.confu -Eu stdout( R R R
( R7 R1 t grepR8 ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyR5 � s
c C@ sR t | � } | s i d d 6St d d d d j | � d d j | | � �} | S( Nu! No such option exists in csf.confu erroru file.replaceu /etc/csf/csf.confR1 u ^{0}(\ +)?\=(\ +)?".*"R2 u {0} = "{1}"( R5 R R ( R7 t valuet current_optionR3 ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt
set_option� s
c C@ s% | r d } n d } t | � } | S( Nu ETH6_DEVICE_SKIPu ETH_DEVICE_SKIP( R: ( t ipv6R7 t skipped_nics( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt get_skipped_nics� s
c C@ s) t d | � } | j | � t | | � S( NRB ( RD t appendt skip_nics( t nicRB t nics( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt skip_nic� s
c C@ sk | r d } n d } d j t j j t j | � � } t d d d d j | � d d j | | � �} | S(
Nu 6u u ,u file.replaceu /etc/csf/csf.confR1 u% ^ETH{0}_DEVICE_SKIP(\ +)?\=(\ +)?".*"R2 u ETH{0}_DEVICE_SKIP = "{1}"( t joinR t movest mapt text_typeR R ( RH RB t nics_csvR3 ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyRF s !
c C@ s� i } | d k r! d d g }
n | g }
x� |
D]� } t | | d | d | d | d | d | d | d
| �} | s1 t | d | d | d | d | d | d
| �} d j | � }
t d |
| � | | <q1 q1 W| S(
Nu bothu inu outR R R R R! R" R# u /etc/csf/csf.{0}u file.append( R R R R ( R R R R R R R! R" R# t resultst
directionst _existsR R ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyR. s2
c C@ s` t � r\ | d k r i d d 6S| d k r7 i d d 6St | | | | | | � } t | � Sd S( uH
Handles the cmd execution for tempdeny and tempallow commands.
u& You must supply an ip address or CIDR.u erroru You must supply a ttl.N( R( R
t _build_tmp_access_argsR' ( R R R" R R R R! R# R, ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt _tmp_access_rule5 s c C@ sy t | � } d j | | | � } | r= | d j | � 7} n | rY | d j | � 7} n | ru | d j | � 7} n | S( u=
Builds the cmd args for temporary access/deny opts.
u {0} {1} {2}u -p {0}u -d {0}u #{0}( R* R ( R R R" R R R# R+ R, ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyRR I s c C@ s t � S( uc
Check csf status
CLI Example:
.. code-block:: bash
salt '*' csf.running
( R( ( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt runningX s c C@ s t � r t d � Sd S( uj
Disable csf permanently
CLI Example:
.. code-block:: bash
salt '*' csf.disable
u -xN( R( R' ( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt disabled s c C@ s t � s t d � Sd S( um
Activate csf if not running
CLI Example:
.. code-block:: bash
salt '*' csf.enable
u -eN( R( R' ( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt enableq s c C@ s
t d � S( u]
Restart csf
CLI Example:
.. code-block:: bash
salt '*' csf.reload
u -r( R' ( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt reload~ s c C@ s t d | | | | | � S( u�
Add an rule to the temporary ip allow list.
See :func:`_access_rule`.
1- Add an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.tempallow 127.0.0.1 3600 port=22 direction='in' comment='# Temp dev ssh access'
u tempallow( RS ( R R" R R R# ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt tempallow� s c C@ s t d | | | | | � S( u�
Add a rule to the temporary ip deny list.
See :func:`_access_rule`.
1- Add an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.tempdeny 127.0.0.1 300 port=22 direction='in' comment='# Brute force attempt'
u tempdeny( RS ( R R" R R R# ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt tempdeny� s u sc C@ s1 t d | d | d | d | d | d | d | �S( u�
Add an rule to csf allowed hosts
See :func:`_access_rule`.
1- Add an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.allow 127.0.0.1
salt '*' csf.allow 127.0.0.1 comment="Allow localhost"
u allowR R R R R! R# ( R/ ( R R R R R R! R" R# ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt allow� s c C@ s t d | | | | | | | � S( u�
Add an rule to csf denied hosts
See :func:`_access_rule`.
1- Deny an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.deny 127.0.0.1
salt '*' csf.deny 127.0.0.1 comment="Too localhosty"
u deny( R/ ( R R R R R R! R" R# ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt deny� s c C@ s( t d � } d j | | � } t | � S( Nu temprmu {0} {1}( R* R R' ( R R+ R, ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt remove_temp_rule� s c C@ s
t d | � S( u�
Remove a rule from the csf denied hosts
See :func:`_access_rule`.
1- Deny an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.unallow 127.0.0.1
u unallow( R/ ( R ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt unallow� s c C@ s
t d | � S( u�
Remove a rule from the csf denied hosts
See :func:`_access_rule`.
1- Deny an IP:
CLI Example:
.. code-block:: bash
salt '*' csf.undeny 127.0.0.1
u undeny( R/ ( R ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt undeny� s c C@ s� | j d � s | r t | � S| sT | d k r; t | � S| d k rT t | � Sn | r� t d | d | d | d | d | d | d
| � Sd S( Nu tempu allowu denyR R R R R R R! ( R R\ R] R^ R4 ( R R R R R R R! R" R# ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt remove_rule� s
c
C@ s� g } t | � } t | � } | j � } | j � } t | | � d j t j j t j | � � } t | � } xR | D]J } t
d d d d j | | � d d j | | | � �} | j | � qw W| S( u
Fully replace the incoming or outgoing ports
line in the csf.conf file - e.g. TCP_IN, TCP_OUT,
UDP_IN, UDP_OUT, etc.
CLI Example:
.. code-block:: bash
salt '*' csf.allow_ports ports="[22,80,443,4505,4506]" proto='tcp' direction='in'
u ,u file.replaceu /etc/csf/csf.confR1 u ^{0}_{1}(\ +)?\=(\ +)?".*"$R2 u {0}_{1} = "{2}"(
t sett listR t _validate_direction_and_protoRJ R RK RL RM t build_directionsR R RE ( t portsR R RO t ports_csvRP R3 ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt allow_ports s
!
c C@ sn | j � } | j � } i } t | | � t | � } x0 | D]( } d j | | � } t | � | | <q> W| S( u�
Lists ports from csf.conf based on direction and protocol.
e.g. - TCP_IN, TCP_OUT, UDP_IN, UDP_OUT, etc..
CLI Example:
.. code-block:: bash
salt '*' csf.allow_port 22 proto='tcp' direction='in'
u {0}_{1}( R Rb Rc R R: ( R R RO RP R7 ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt get_ports7 s
c C@ sF | j � d
k r! t d � � n | j � d k rB t d � � n d S( Nu INu OUTu BOTHu/ You must supply a direction of in, out, or bothu TCPu UDPu TCP6u UDP6u= You must supply tcp, udp, tcp6, or udp6 for the proto keyword( u INu OUTu BOTH( u TCPu UDPu TCP6u UDP6( R R ( R R ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyRb O s c C@ s4 | j � } | d k r' d d g } n | g } | S( Nu BOTHu INu OUT( R ( R RP ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyRc [ s
u bothc C@ s� t d | d | � } | j � } t | | � t | � } g } xA | D]9 } | | } | j | � | t | d | d | �7} qG W| S( u
Like allow_ports, but it will append to the
existing entry instead of replacing it.
Takes a single port instead of a list of ports.
CLI Example:
.. code-block:: bash
salt '*' csf.allow_port 22 proto='tcp' direction='in'
R R ( Rg R Rb Rc RE Rf ( R R R Rd RP RO t _ports( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt
allow_portd s
c C@ s t d � d } | S( Nu TESTINGi ( R: ( t testing( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt get_testing_status} s c C@ s_ | d k r d } n! | d k r* d } n t d � � t d d d d d
d j | � �} | S( Nu onu 1u offu 0u% Only valid arg is 'on' or 'off' here.u file.replaceu /etc/csf/csf.confR1 u ^TESTING(\ +)?\=(\ +)?".*"R2 u TESTING = "{0}"( R R R ( t valR3 ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt _toggle_testing� s
c C@ s
t d � S( Nu on( Rm ( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt enable_testing_mode� s c C@ s
t d � S( Nu off( Rm ( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt disable_testing_mode� s (9 t __doc__t
__future__R R R R; t salt.utils.pathR t salt.exceptionsR R t salt.extR R
R R R
R R' R( R* R- R/ R R4 R: R= R5 RA R RD RI RF R. RS RR RT RU RV RW RX RY RZ R[ R\ R] R^ R_ Rf Rg Rb Rc Ri Rk Rm Rn Ro ( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/csf.pyt <module> s�
Mini Shell