0x1998 - MANAGER
Düzenlenen Dosya: smtp_blocking.cpython-311.pyc
� �·i�B � �* � d Z ddlZddlZddlZddlZddlmZ ddlmZm Z m Z mZ ddlm c mZ ddlmZmZ ddlmZ ddlmZ ddlmZ dd lmZ dd lmZmZmZmZmZ ddlm Z m!Z! ddl"m#Z# g d �Z$ddl%m&Z& edde'fde'fde'fg� � Z( edde'fde)fde*fde*fde'fde'fg� � Z+dZ,dZ- ej. e/� � Z0dZ1dZ2de e3 fd�Z4d � Z5d!� Z6 G d"� d#e�$� � Zd%e fd&�Z7d'� Z8d(� Z9 ed)�*� � d+� � � Z:d,e+fd-�Z;d,e)fd.�Z<d,e'fd/�Z=dS )0zs This module contains utilities to work with iptables to block SMTP traffic on the server akin to how CSF does it. � N)�suppress)� Generator�List�Tuple� NamedTuple)� Singleton�async_lru_cache)� Protector)�SMTPBlocking)�UnifiedAccessLogger)�ip_versions)� FirewallRules�firewall_logging_enabled�get_firewall�is_nat_available�rule_logging_enabled)� FirewallError�FirewallBatchCommandError)� hosting_panel)�sync_rules_for_all_versions�reset_rules_for_all_versions�is_SMTP_blocking_supported�read_SMTP_settings�get_active_settings_list�conflicts_exist)� IPVersion� TableState�chain_exists�chain_referenced�rules_ok�SMTPSettings�enabled�ports�allow_users�allow_groups�allow_local�redirectTi, �filter�nat�commandsc � �l K � |sdS | � |� � � d{V �� dS # t $ r Y dS w xY w)z� Use a non-zero return code of iptables as an indication of a failed check. An empty check command list is treated as a failure. Note: Should be called as close to the public functions as possible, since it has side effects. FNT)�commitr )�firewallr* s �O/opt/imunify360/venv/lib/python3.11/site-packages/im360/subsys/smtp_blocking.py�_true_on_successr/ G si � � � � � ��u���o�o�h�'�'�'�'�'�'�'�'�'� �t�� � � � ��u�u����s �% � 3�3c # � K � | D ]I} t j |� � j V � �# t $ r t � d|� � Y �Fw xY wdS )z:Obtain UIDs of specified users skipping non-existing ones.zUNIX user %s does not existN)�pwd�getpwnam�pw_uid�KeyError�logger�warning)� usernames�users r. � _get_uidsr9 [ su � � � �� � �� ��,�t�$�$�+�+�+�+�+��� � � ��N�N�8�$�?�?�?��H� ����� � �$�%A�Ac # � K � | D ]I} t j |� � j V � �# t $ r t � d|� � Y �Fw xY wdS )z;Obtain GIDs of specified groups skipping non-existing ones.zUNIX group %s does not existN)�grp�getgrnam�gr_gidr4 r5 r6 )�groups�groups r. � _get_gidsrA e su � � � �� � �� ��,�u�%�%�,�,�,�,�,��� � � ��N�N�9�5�A�A�A��H� ����� r: c �" � e Zd ZdZdZdefZdefd�Zdee e df fd�Zdee e df fd �Zd e de fd�Zd� Zd � Zdee fd�Zdeee ddf fd�Zdedefd�Zd e defd�Zd e fd�Zd e fd�Zddd�Zdd�ZdS )r z� This class is used to synchronise iptables rules related to outgoing SMTP traffic blocking with SMTP_BLOCKING section of imunify config. �OUTPUT_imunify360_SMTP�-j� ip_versionc �n � || _ d | _ d | _ d| _ t j � � | _ d S )NF)rE �_candidate_settings�active_settings�rules_were_resetr �HostingPanel�_hosting_panel)�selfrE s r. �__init__zSMTPBlocking.__init__x s8 � �$���#'�� �#��� %���+�8�:�:����� �return.c � �� | j j sg S g }dddddd� d� | j j D � � � � f�| j j r*|� g ��d�d �d �t j �R � � |� g ��d�d�d�d �d �t j �R � � |� �fd�t t j | j j | j j � � � � D � � � � |� �fd�t | j j � � D � � � � t! � � r{t# t$ j � � rb|� g ��t j t j t j | j � � t$ j �� � �� � �R � � | j j r | j j rt3 | j � � sY|� g ��d �t j �d�d� | j t8 j j k rdnd� � �R � � |S )z� Return a list of rules that should be used in OUTPUT_imunify360_SMTP chain. These can either be installed using append_rule / insert_rule or checked using has_rule methods of the firewall interface. �-p�tcp�-m� multiport�--dports�,c 3 �4 K � | ]}t |� � V � �d S �N��str��.0�ps r. � <genexpr>z6SMTPBlocking._get_filter_smtp_rules.<locals>.<genexpr>� �( � � � �D�D��S��V�V�D�D�D�D�D�DrN �-o�lorD �owner�--uid-owner�0c 3 �h �K � | ],}g ��d �d�d�t |� � �d�t j �R V � �-dS �rS rb rc rD N�rZ r �ACCEPT�r\ �uid�common_argss �r. r^ z6SMTPBlocking._get_filter_smtp_rules.<locals>.<genexpr>� � �� � � � � � � �� �� � � � � � �C��� � � � �$� � � � � � � � rN c 3 �h �K � | ],}g ��d �d�d�t |� � �d�t j �R V � �-dS �rS rb z--gid-ownerrD Nrg �r\ �gidrk s �r. r^ z6SMTPBlocking._get_filter_smtp_rules.<locals>.<genexpr>� � �� � � � � � � �� �� � � � � � �C��� � � � �$� � � � � � � � rN )r@ �prefix)�actionz --reject-withzicmp{}-port-unreachable�6� )rG r# �joinr&