def _snat_rules(action, form): fields = SimpleNamespace(**form) # TODO: make this code for snat (currently using dnat code as template) if (action == 'remove'): try: # NOTE: validation needs to know the zone so it can ensure the position is valid validate.del_nat_rule(fields) except ValidationError as ve: error = ve else: with IPTablesManager() as iptables: iptables.delete_nat(fields) elif (action == 'add'): try: validate.add_snat_rule(fields) validate.ip_address( ip_iter=[fields.orig_src_ip, fields.new_src_ip]) except ValidationError as ve: error = ve else: with IPTablesManager() as iptables: iptables.add_nat(fields) else: return INVALID_FORM return error
def _dnat_rules(action, form): error = None fields = SimpleNamespace(**form) if (action == 'remove'): try: # NOTE: validation needs to know the zone so it can ensure the position is valid validate.del_nat_rule(fields) except ValidationError as ve: error = ve else: with IPTablesManager() as iptables: iptables.delete_nat(fields) configure.del_open_wan_protocol(fields) elif (action == 'add'): try: # checking all required fields are present and some other basic rules are followed # before validating values of standard fields. validate.add_dnat_rule(fields) if (fields.protocol in ['tcp', 'udp']): validate.network_port(fields.dst_port) validate.network_port(fields.host_port) validate.ip_address(fields.host_ip) if (fields.dst_ip != ''): validate.ip_address(fields.dst_ip) except ValidationError as ve: error = ve else: with IPTablesManager() as iptables: iptables.add_nat(fields) configure.add_open_wan_protocol(fields) else: return INVALID_FORM return error
def update_page(form): if ('update_wan_state' in form): wan_state = form.get('update_wan_state', DATA.INVALID) if wan_state is DATA.INVALID: return INVALID_FORM try: wan_state = INTF(validate.convert_int(wan_state)) except (ValidationError, KeyError): return INVALID_FORM else: configure.set_wan_interface(wan_state) elif ('update_wan_ip' in form): wan_ip_settings = { 'ip': form.get('wan_ip', DATA.INVALID), 'cidr': form.get('wan_cidr', DATA.INVALID), 'dfg': form.get('wan_dfg', DATA.INVALID) } if (DATA.INVALID in wan_ip_settings.values()): return INVALID_FORM try: validate.ip_address(wan_ip_settings['ip']) validate.cidr(wan_ip_settings['cidr']) validate.ip_address(wan_ip_settings['dfg']) except ValidationError as ve: return ve configure.set_wan_ip(wan_ip_settings) elif (_IP_DISABLED): return 'wan interface configuration currently disabled for system rework.' elif ('wan_ip_update' in form): wan_ip = form.get('ud_wan_ip', None) cidr = form.get('ud_wan_cidr', None) default_gateway = form.get('ud_wan_dfg', None) # missing forms keys. potential client side manipulation if any(x is None for x in [wan_ip, cidr, default_gateway]): return INVALID_FORM if ('static_wan' in form): # keys present, but fields left empty. (unable to force client side) if (not wan_ip or not default_gateway): return 'All fields are required when setting the wan interface to static.' try: validate.ip_address(wan_ip) validate.cidr(cidr) validate.default_gateway(default_gateway) except ValidationError as ve: return ve else: wan_settings = { 'ip_address': wan_ip, 'cidr': cidr, 'default_gateway': default_gateway } configure.set_wan_interface(wan_settings) else: # no arg indicates dynamic ip/dhcp assignment configure.set_wan_interface() elif ('wan_mac_update' in form): mac_address = form.get('ud_wan_mac', None) if (not mac_address): return INVALID_FORM try: validate.mac_address(mac_address) except ValidationError as ve: return ve else: configure.set_wan_mac(CFG.ADD, mac_address=mac_address) elif ('wan_mac_restore' in form): configure.set_wan_mac(CFG.DEL) else: return INVALID_FORM
def update_page(form): print(form) if ('dhcp_res_add' in form): dhcp_settings = { 'zone': form.get('zone', DATA.INVALID), 'mac': form.get('mac_address', ''), 'ip': form.get('ip_address', DATA.INVALID), 'description': form.get('description', DATA.INVALID) } if (DATA.INVALID in dhcp_settings.values()): return INVALID_FORM try: validate.dhcp_reservation(dhcp_settings) # will raise exception if ip address is already reserved configure.set_dhcp_reservation(dhcp_settings, CFG.ADD) except ValidationError as ve: return ve # Matching DHCP reservation REMOVE and sending to configuration method. elif ('dhcp_res_remove' in form): mac_address = form.get('dhcp_res_remove', None) if (not mac_address): return INVALID_FORM try: validate.mac_address(mac_address) except ValidationError as ve: return ve else: dhcp_settings = {'mac': mac_address.replace(':', '')} configure.set_dhcp_reservation(dhcp_settings, CFG.DEL) elif ('dhcp_lease_remove' in form): ip_addr = form.get('dhcp_lease_remove', None) if (not ip_addr): return INVALID_FORM try: validate.ip_address(ip_addr) configure.remove_dhcp_lease(ip_addr) except ValidationError as ve: return ve elif ('general_settings' in form): server_settings = { 'interface': form.get('interface', DATA.INVALID), # NOTE: switch does not post field if disabled. if not present, the server will disable the # corresponding field as normal. 'enabled': True if form.get('server_enabled', False) else False, 'icmp_check': True if form.get('icmp_check', False) else False, 'lease_range': { 'start': validate.get_convert_int(form, 'start'), 'end': validate.get_convert_int(form, 'end') } } if (DATA.INVALID in server_settings.values()): return INVALID_FORM try: validate.dhcp_general_settings(server_settings) except ValidationError as ve: return ve else: configure.set_dhcp_settings(server_settings) else: return INVALID_FORM
def update_page(form): if (_SYSLOG_DISABLED): return 'Syslog is currently disabled due to rework.' elif ('servers_update' in form): syslog_server1 = form.get('syslog_server1', None) syslog_server2 = form.get('syslog_server2', None) syslog_port1 = form.get('syslog_port1', None) syslog_port2 = form.get('syslog_port2', None) syslog_servers = { 'server1': { 'ip_address': syslog_server1, 'port': syslog_port1 }, 'server2': { 'ip_address': syslog_server2, 'port': syslog_port2 } } # both servers are not present/ form keys missing if (any(x is None for x in [syslog_server1, syslog_port1]) or any(x is None for x in [syslog_server2, syslog_port2])): return INVALID_FORM try: for server_info in syslog_servers.values(): if (server_info['ip_address'] or server_info['port']): validate.ip_address(server_info['ip_address']) validate.network_port(server_info['port']) except ValidationError as ve: return ve else: configure.set_syslog_servers(syslog_servers) elif ('server_remove' in form): syslog_server_number = form.get('syslog_server_remove') server_num = validate.convert_int(syslog_server_number) if (not server_num): return INVALID_FORM configure.remove_syslog_server(server_num) elif ('settings_update' in form): enabled_tls_settings = form.getlist('syslog_tls') enabled_syslog_settings = form.getlist('syslog_settings') fallback_settings = form.getlist('fallback_settings') tls_retry = form.get('tls_retry_time', None) tcp_retry = form.get('tcp_retry_time', None) syslog_settings = { 'tls': enabled_tls_settings, 'syslog': enabled_syslog_settings, 'fallback': fallback_settings, 'tls_retry': tls_retry, 'tcp_retry': tcp_retry } if (not tls_retry or not tcp_retry): return INVALID_FORM try: validate.syslog_settings(syslog_settings) except ValidationError as ve: return ve else: configure.set_syslog_settings(syslog_settings) return INVALID_FORM
def update_page(form): if ('wl_add' in form): whitelist_settings = { 'domain': form.get('domain', DATA.INVALID), 'timer': validate.get_convert_int(form, 'rule_length') } if (DATA.INVALID in whitelist_settings.values()): return INVALID_FORM try: validate.domain(whitelist_settings['domain']) validate.timer(whitelist_settings['timer']) except ValidationError as ve: return ve else: configure.add_proxy_domain(whitelist_settings, ruleset='whitelist') elif ('wl_remove' in form): domain = form.get('wl_remove', DATA.INVALID) if (domain is DATA.INVALID): return INVALID_FORM configure.del_proxy_domain(domain, ruleset='whitelist') elif ('exc_add' in form): exception_settings = { 'domain': form.get('domain', DATA.INVALID), 'reason': form.get('reason', DATA.INVALID), 'action': CFG.ADD } if (DATA.INVALID in exception_settings.values()): return INVALID_FORM try: validate.domain(exception_settings['domain']) validate.standard(exception_settings['reason']) except ValidationError as ve: return ve else: configure.set_proxy_exception(exception_settings, ruleset='whitelist') elif ('exc_remove' in form): exception_settings = { 'domain': form.get('exc_remove', DATA.INVALID), 'reason': None, 'action': CFG.DEL } if (exception_settings['domain'] is DATA.INVALID): return INVALID_FORM configure.set_proxy_exception(exception_settings, ruleset='whitelist') # TODO: this should not restrict ips to only "local_net" now that we have multiple interfaces. # we should have the user select which interface it will be active on so we can properly validate the # ip address falls within that subnet. elif ('ip_wl_add' in form): whitelist_settings = { 'ip': form.get('ip_wl_ip', DATA.INVALID), 'user': form.get('ip_wl_user', DATA.INVALID), 'type': form.get('ip_wl_type', DATA.INVALID) } if (DATA.INVALID in whitelist_settings.values()): return INVALID_FORM try: validate.add_ip_whitelist(whitelist_settings) except ValidationError as ve: return ve else: configure.add_proxy_ip_whitelist(whitelist_settings) elif ('ip_wl_remove' in form): whitelist_ip = form.get('ip_wl_ip', DATA.INVALID) if (whitelist_ip is DATA.INVALID): return INVALID_FORM try: validate.ip_address(whitelist_ip) except ValidationError as ve: return ve else: configure.del_proxy_ip_whitelist(whitelist_ip) else: return INVALID_FORM
def update_page(form): # TODO: i dont like this. fix this. i did alittle, but more can be done if ('dns_update' in form): dns_servers = { form.get('dnsname1', DATA.INVALID): form.get('dnsserver1', DATA.INVALID), form.get('dnsname2', DATA.INVALID): form.get('dnsserver2', DATA.INVALID) } # explicit identity check on None to prevent from matching empty fields vs missing for keys. if (DATA.INVALID in [*dns_servers.keys(), *dns_servers.values()]): return INVALID_FORM try: dns_server_info = {} for i, (server_name, server_ip) in enumerate(dns_servers.items(), 1): if (server_ip != ''): validate.standard(server_name) validate.ip_address(server_ip) dns_server_info[form.get(f'dnsname{i}')] = form.get(f'dnsserver{i}') except ValidationError as ve: return ve else: configure.set_dns_servers(dns_server_info) elif ('dns_record_update' in form): dns_record_name = form.get('dns_record_name', None) dns_record_ip = form.get('dns_record_ip', None) if (not dns_record_name or not dns_record_ip): return INVALID_FORM try: validate.dns_record_add(dns_record_name) validate.ip_address(dns_record_ip) except ValidationError as ve: return ve else: configure.update_dns_record(dns_record_name, CFG.ADD, dns_record_ip) elif ('dns_record_remove' in form): dns_record_name = form.get('dns_record_remove', None) if (not dns_record_name): return INVALID_FORM try: validate.dns_record_remove(dns_record_name) except ValidationError as ve: return ve else: configure.update_dns_record(dns_record_name, CFG.DEL) elif ('dns_protocol_update' in form): dns_tls_settings = { 'enabled': form.getlist('dns-protocol-settings') } try: validate.dns_over_tls(dns_tls_settings) except ValidationError as ve: return ve else: configure.set_dns_over_tls(dns_tls_settings) elif ('dns_cache_clear' in form): clear_dns_cache = { 'top_domains': form.get('clear_top_domains', DATA.INVALID), 'dns_cache': form.get('clear_dns_cache', DATA.INVALID) } # only one is required, so will only be invalid if both are missing. if all([x is DATA.INVALID for x in clear_dns_cache.values()]): return INVALID_FORM configure.set_dns_cache_clear_flag(clear_dns_cache) else: return INVALID_FORM
def update_page(form): # Matching logging update form and sending to configuration method. if ('dnx_ddos_update' in form): action = CFG.ADD if 'ddos' in form else CFG.DEL ddos_limits = {} for protocol in ['tcp', 'udp', 'icmp']: form_limit = form.get(f'{protocol}_limit', None) if (form_limit is None): return INVALID_FORM if (form_limit == ''): continue limit = validate.convert_int(form_limit) if (not limit): return f'{protocol} limit must be an integer or left empty.' if (not 5 <= limit <= 200): return f'{protocol} limit must be in range 5-200.' ddos_limits[protocol] = limit configure.set_ips_ddos(action) if (ddos_limits): configure.set_ips_ddos_limits(ddos_limits) elif ('dnx_portscan_update' in form): enabled_settings = form.getlist('ps_settings', None) try: validate.portscan_settings(enabled_settings) except ValidationError as ve: return ve else: configure.set_ips_portscan(enabled_settings) elif ('general_settings' in form): ids_mode = True if 'ids_mode' in form else False passive_block_length = form.get('passive_block_length', None) if (not passive_block_length): return INVALID_FORM pb_length = validate.convert_int(passive_block_length) try: validate.ips_passive_block_length(pb_length) except ValidationError as ve: return ve else: configure.set_ips_general_settings(pb_length, ids_mode) elif ('ips_wl_add' in form): whitelist_ip = form.get('ips_wl_ip', None) whitelist_name = form.get('ips_wl_name', None) if (not whitelist_ip or not whitelist_name): return INVALID_FORM try: validate.ip_address(whitelist_ip) validate.standard(whitelist_name) except ValidationError as ve: return ve else: configure.update_ips_ip_whitelist(whitelist_ip, whitelist_name, action=CFG.ADD) elif ('ips_wl_remove' in form): whitelist_ip = form.get('ips_wl_ip', None) if (not whitelist_ip): return INVALID_FORM try: validate.ip_address(whitelist_ip) except ValidationError as ve: return ve else: configure.update_ips_ip_whitelist(whitelist_ip, None, action=CFG.DEL) elif ('ips_wl_dns' in form): action = CFG.ADD if 'dns_enabled' in form else CFG.DEL configure.update_ips_dns_whitelist(action) elif ('ips_pbl_remove' in form): host_info = form.get('ips_pbl_remove', DATA.INVALID) if (host_info is DATA.INVALID): return INVALID_FORM try: host_ip, timestamp = host_info.split('/') validate.ip_address(host_ip) except: return INVALID_FORM if (validate.convert_int(timestamp) is DATA.INVALID): return INVALID_FORM else: with IPTablesManager() as iptables: iptables.remove_passive_block(host_ip, timestamp) else: return INVALID_FORM