From f1e445a8baa946cb3778592be38eda263c43b0ea Mon Sep 17 00:00:00 2001 From: Leandro Lucarella Date: Fri, 20 Jun 2008 01:03:32 -0300 Subject: [PATCH] Split firewall handler in submodules (refs #2). --- services/firewall/handler.py | 57 ++-------------------------------- services/firewall/rule.py | 60 ++++++++++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+), 54 deletions(-) create mode 100644 services/firewall/rule.py diff --git a/services/firewall/handler.py b/services/firewall/handler.py index b234167..83cdd12 100644 --- a/services/firewall/handler.py +++ b/services/firewall/handler.py @@ -4,66 +4,15 @@ # of using script templates. from os import path -from formencode import Invalid -from formencode.validators import OneOf, CIDR, Int import logging ; log = logging.getLogger('pymin.services.firewall') -from pymin.item import Item -from pymin.validatedclass import Field -from pymin.dispatcher import Handler, handler, HandlerError from pymin.service.util import Restorable, ConfigWriter, ServiceHandler, \ - TransactionalHandler, ListSubHandler + TransactionalHandler -__all__ = ('FirewallHandler') +from rule import RuleHandler +__all__ = ('FirewallHandler',) -class UpOneOf(OneOf): - def validate_python(self, value, state): - value = value.upper() - return OneOf.validate_python(self, value, state) - -class Rule(Item): - r"""Rule(chain, target[, src[, dst[, ...]]]) -> Rule instance. - - chain - INPUT, OUTPUT or FORWARD. - target - ACCEPT, REJECT or DROP. - src - Source subnet as IP/mask. - dst - Destination subnet as IP/mask. - protocol - ICMP, UDP, TCP or ALL. - src_port - Source port (only for UDP or TCP protocols). - dst_port - Destination port (only for UDP or TCP protocols). - """ - chain = Field(UpOneOf(['INPUT', 'OUTPUT', 'FORWARD'], not_empty=True)) - target = Field(UpOneOf(['ACCEPT', 'REJECT', 'DROP'], not_empty=True)) - src = Field(CIDR(if_empty=None, if_missing=None)) - dst = Field(CIDR(if_empty=None, if_missing=None)) - protocol = Field(UpOneOf(['ICMP', 'UDP', 'TCP', 'ALL'], if_missing=None)) - src_port = Field(Int(min=0, max=65535, if_empty=None, if_missing=None)) - dst_port = Field(Int(min=0, max=65535, if_empty=None, if_missing=None)) - def chained_validator(self, fields, state): - errors = dict() - if fields['protocol'] not in ('TCP', 'UDP'): - for name in ('src_port', 'dst_port'): - if fields[name] is not None: - errors[name] = u"Should be None if protocol " \ - "(%(protocol)s) is not TCP or UDP" % fields - if errors: - raise Invalid(u"You can't specify any ports if the protocol " - u'is not TCP or UDP', fields, state, error_dict=errors) - -class RuleHandler(ListSubHandler): - r"""RuleHandler(parent) -> RuleHandler instance :: Handle a list of rules. - - This class is a helper for FirewallHandler to do all the work related to rules - administration. - - parent - The parent service handler. - """ - - handler_help = u"Manage firewall rules" - - _cont_subhandler_attr = 'rules' - _cont_subhandler_class = Rule class FirewallHandler(Restorable, ConfigWriter, ServiceHandler, TransactionalHandler): diff --git a/services/firewall/rule.py b/services/firewall/rule.py new file mode 100644 index 0000000..c774582 --- /dev/null +++ b/services/firewall/rule.py @@ -0,0 +1,60 @@ +# vim: set encoding=utf-8 et sw=4 sts=4 : + +from formencode import Invalid +from formencode.validators import OneOf, CIDR, Int + +from pymin.item import Item +from pymin.validatedclass import Field +from pymin.service.util import ListSubHandler + +__all__ = ('FirewallHandler',) + + +class UpOneOf(OneOf): + def validate_python(self, value, state): + value = value.upper() + return OneOf.validate_python(self, value, state) + +class Rule(Item): + r"""Rule(chain, target[, src[, dst[, ...]]]) -> Rule instance. + + chain - INPUT, OUTPUT or FORWARD. + target - ACCEPT, REJECT or DROP. + src - Source subnet as IP/mask. + dst - Destination subnet as IP/mask. + protocol - ICMP, UDP, TCP or ALL. + src_port - Source port (only for UDP or TCP protocols). + dst_port - Destination port (only for UDP or TCP protocols). + """ + chain = Field(UpOneOf(['INPUT', 'OUTPUT', 'FORWARD'], not_empty=True)) + target = Field(UpOneOf(['ACCEPT', 'REJECT', 'DROP'], not_empty=True)) + src = Field(CIDR(if_empty=None, if_missing=None)) + dst = Field(CIDR(if_empty=None, if_missing=None)) + protocol = Field(UpOneOf(['ICMP', 'UDP', 'TCP', 'ALL'], if_missing=None)) + src_port = Field(Int(min=0, max=65535, if_empty=None, if_missing=None)) + dst_port = Field(Int(min=0, max=65535, if_empty=None, if_missing=None)) + def chained_validator(self, fields, state): + errors = dict() + if fields['protocol'] not in ('TCP', 'UDP'): + for name in ('src_port', 'dst_port'): + if fields[name] is not None: + errors[name] = u"Should be None if protocol " \ + "(%(protocol)s) is not TCP or UDP" % fields + if errors: + raise Invalid(u"You can't specify any ports if the protocol " + u'is not TCP or UDP', fields, state, error_dict=errors) + +class RuleHandler(ListSubHandler): + r"""RuleHandler(parent) -> RuleHandler instance :: Handle a list of rules. + + This class is a helper for FirewallHandler to do all the work related to rules + administration. + + parent - The parent service handler. + """ + + handler_help = u"Manage firewall rules" + + _cont_subhandler_attr = 'rules' + _cont_subhandler_class = Rule + -- 2.43.0