Class: Yast::PortRangesClass

Inherits:

Module

Object
Module
Yast::PortRangesClass

show all

Defined in:: library/network/src/modules/PortRanges.rb

Overview

Tools for ranges of network ports, as used by iptables for firewalling.

A Port Range is a string of two numbers separated with a colon: "3000:3010". The range includes both ends. The numbers are nonnegative integers.

A Valid Port Range is an ascending pair of numbers between 1..65535.

Helpers collapse

#ReportOnlyOnce(what_to_report) ⇒ Boolean
Report the error, warning, message only once.

Instance Method Summary collapse

#CreateNewPortRange(min_pr, max_pr) ⇒ String
Function creates a port range from min and max params.
#DividePortsAndPortRanges(unsorted_ports, with_aliases) ⇒ Hash{String => Array<String>}
Function divides list of ports to the map of ports and port ranges.
#FlattenServices(old_list, protocol) ⇒ Array<String>
Function tries to flatten services into the minimal list.
#IsPortRange(check_this) ⇒ Boolean
Function returns where the string parameter is a port range.
#IsValidPortRange(port_range) ⇒ Boolean
Checks whether the port range is valid.
#main ⇒ Object
#PortIsInPortranges(port, port_ranges) ⇒ Boolean
Function returns where the port name or port number is included in the list of port ranges.
#RemovePortFromPortRanges(port_number, port_ranges) ⇒ Array<String>
Function removes port number from all port ranges.

Instance Method Details

#CreateNewPortRange(min_pr, max_pr) ⇒ `String`

Function creates a port range from min and max params. Max must be bigger than min. If something is wrong, it returns an empty string.

Examples:

CreateNewPortRange(10, 20) # => "10:20"
CreateNewPortRange(10, 10) # => "10"
CreateNewPortRange(0,  20) # => ""
CreateNewPortRange(20, 10) # => ""

Parameters:

integer —
min_port
integer —
max_port

Returns:

(String) —
new port range

# File 'library/network/src/modules/PortRanges.rb', line 276

def CreateNewPortRange(min_pr, max_pr)
  if min_pr.nil? || min_pr == 0
    Builtins.y2error(
      "Wrong definition of the starting port '%1', it must be between 1 and 65535",
      min_pr
    )
    return ""
  elsif max_pr.nil? || max_pr == 0 || Ops.greater_than(max_pr, 65_535)
    Builtins.y2error(
      "Wrong definition of the ending port '%1', it must be between 1 and 65535",
      max_pr
    )
    return ""
  end

  # max and min are the same, this is not a port range
  if min_pr == max_pr
    Builtins.tostring(min_pr)
  # right port range
  elsif Ops.less_than(min_pr, max_pr)
    Ops.add(
      Ops.add(Builtins.tostring(min_pr), ":"),
      Builtins.tostring(max_pr)
    )
  # min is bigger than max
  else
    Builtins.y2error(
      "Starting port '%1' cannot be bigger than ending port '%2'",
      min_pr,
      max_pr
    )
    ""
  end
end

#DividePortsAndPortRanges(unsorted_ports, with_aliases) ⇒ `Hash{String => Array<String>}`

Function divides list of ports to the map of ports and port ranges. If with_aliases is 'true' it also returns ports wit their port aliases. Port ranges are not affected with it.

Parameters:

unsorted_ports (Array<String>)
with_aliases (Boolean) —
should names of single ports be translated to numbers

Returns:

(Hash{String => Array<String>}) —
categorized ports: { "ports" => [ list of ports ], "port_ranges" => [ list of port ranges ], }

# File 'library/network/src/modules/PortRanges.rb', line 228

def DividePortsAndPortRanges(unsorted_ports, with_aliases)
  unsorted_ports = deep_copy(unsorted_ports)
  ret = {}

  Builtins.foreach(unsorted_ports) do |port|
    # port range
    if IsPortRange(port)
      Ops.set(
        ret,
        "port_ranges",
        Builtins.add(Ops.get(ret, "port_ranges", []), port)
      )
    # is a normal port
    # find also aliases
    elsif with_aliases
      Ops.set(
        ret,
        "ports",
        Convert.convert(
          Builtins.union(
            Ops.get(ret, "ports", []),
            PortAliases.GetListOfServiceAliases(port)
          ),
          from: "list",
          to:   "list <string>"
        )
      )
      # only add the port itself
    else
      Ops.set(ret, "ports", Builtins.add(Ops.get(ret, "ports", []), port))
    end
  end

  deep_copy(ret)
end

#FlattenServices(old_list, protocol) ⇒ `Array<String>`

Function tries to flatten services into the minimal list. If ports are already mentioned inside port ranges, they are dropped.

Parameters:

old_list (Array<String>) —
port numbers, names, or ranges
protocol (String) —
old_list is returned unchanged if protocol is other than "TCP" or "UDP"

Returns:

(Array<String>) —
of flattened services and port ranges

# File 'library/network/src/modules/PortRanges.rb', line 393

def FlattenServices(old_list, protocol)
  old_list = deep_copy(old_list)
  if !Builtins.contains(["TCP", "UDP"], protocol)
    message = Builtins.sformat(
      "Protocol %1 doesn't support port ranges, skipping...",
      protocol
    )
    Builtins.y2milestone(message) if ReportOnlyOnce(message)
    return deep_copy(old_list)
  end

  new_list = []
  list_of_ranges = []
  # Using port number, we can remove ports mentioned in port ranges
  ports_to_port_numbers = {}
  # Using this we can remove ports mentioned more than once
  port_numbers_to_port_names = {}

  Builtins.foreach(old_list) do |one_item|
    # Port range
    if IsPortRange(one_item)
      list_of_ranges = Builtins.add(list_of_ranges, one_item)
    else
      port_number = PortAliases.GetPortNumber(one_item)
      # Cannot find port number for this port, it is en error of the configuration
      if port_number.nil?
        Builtins.y2warning(
          "Unknown port %1 but leaving it in the configuration.",
          one_item
        )
        new_list = Builtins.add(new_list, one_item)
        # skip the 'nil' port number
        next
      end
      Ops.set(ports_to_port_numbers, one_item, port_number)
      Ops.set(
        port_numbers_to_port_names,
        port_number,
        Builtins.add(
          Ops.get(port_numbers_to_port_names, port_number, []),
          one_item
        )
      )
    end
  end

  Builtins.foreach(port_numbers_to_port_names) do |port_number, _port_names|
    # Port is not in any defined port range
    if PortIsInPortranges(Builtins.tostring(port_number), list_of_ranges)
      Builtins.y2milestone(
        "Removing port %1 mentioned in port ranges %2",
        port_number,
        list_of_ranges
      )
    elsif PortIsInPortranges(
      Builtins.tostring(Ops.subtract(port_number, 1)),
      list_of_ranges
    )
      # Port - 1 IS in some port range
      list_of_ranges = Builtins.add(
        list_of_ranges,
        CreateNewPortRange(Ops.subtract(port_number, 1), port_number)
      )
    # Creating fake port range, to be joined with another one
    # Port + 1 IS in some port range
    elsif PortIsInPortranges(
      Builtins.tostring(Ops.add(port_number, 1)),
      list_of_ranges
    )
      # Creating fake port range, to be joined with another one
      list_of_ranges = Builtins.add(
        list_of_ranges,
        CreateNewPortRange(port_number, Ops.add(port_number, 1))
      )
    # Port is not in any port range and also it cannot be joined with any one
    else
      # Port names of this port
      used_port_names = Ops.get(
        port_numbers_to_port_names,
        port_number,
        []
      )
      if Ops.greater_than(Builtins.size(used_port_names), 0)
        new_list = Builtins.add(new_list, Ops.get(used_port_names, 0, ""))
      else
        Builtins.y2milestone(
          "No port name for port number %1. Adding %1...",
          port_number
        )
        # There are no port names (hmm?), adding port number
        new_list = Builtins.add(new_list, Builtins.tostring(port_number))
      end
      # Port is in a port range
    end
  end

  list_of_ranges = Builtins.toset(list_of_ranges)
  # maximal count of steps
  max_loops = 5000

  # Joining port ranges together
  # this is a bit dangerous!
  Builtins.y2milestone("Joining list of ranges %1", list_of_ranges)
  while Ops.greater_than(max_loops, 0)
    # if something goes wrong
    max_loops = Ops.subtract(max_loops, 1)

    any_change_during_this_loop = false

    try_all_these_ranges = deep_copy(list_of_ranges)
    Builtins.foreach(try_all_these_ranges) do |port_range|
      if !IsValidPortRange(port_range)
        warning = Builtins.sformat(
          "Wrong port-range definition %1, cannot join",
          port_range
        )
        Builtins.y2warning(warning) if ReportOnlyOnce(warning)
        next
      end
      min_pr = Builtins.tointeger(
        Builtins.regexpsub(port_range, "^([0123456789]+):.*$", "\\1")
      )
      max_pr = Builtins.tointeger(
        Builtins.regexpsub(port_range, "^.*:([0123456789]+)$", "\\1")
      )
      if min_pr.nil? || max_pr.nil?
        Builtins.y2error("Not a port range %1", port_range)
        next
      end
      # try to join it with another port ranges
      # -->
      Builtins.foreach(try_all_these_ranges) do |try_this_pr|
        # Exact match means the same port range
        next if try_this_pr == port_range

        this_min = Builtins.regexpsub(
          try_this_pr,
          "^([0123456789]+):.*$",
          "\\1"
        )
        this_max = Builtins.regexpsub(
          try_this_pr,
          "^.*:([0123456789]+)$",
          "\\1"
        )
        if this_min.nil? || this_max.nil?
          Builtins.y2error(
            "Wrong port range %1, %2 > %3",
            port_range,
            this_min,
            this_max
          )
          # skip it
          next
        end
        this_min_pr = Builtins.tointeger(this_min)
        this_max_pr = Builtins.tointeger(this_max)
        # // wrong definition of the port range
        if Ops.less_than(this_min_pr, 1) ||
            Ops.greater_than(this_max_pr, @max_port_number)
          warning = Builtins.sformat(
            "Wrong port-range definition %1, cannot join",
            port_range
          )
          Builtins.y2warning(warning) if ReportOnlyOnce(warning)
          # skip it
          next
        end
        # If new port range should be created
        new_min = nil
        new_max = nil
        # rubocop:disable Lint/DuplicateBranch
        # wrong detection of duplicate branch as if cause logic and workflow
        # the second one is inside the first one
        if Ops.less_or_equal(min_pr, this_min_pr) &&
            Ops.greater_or_equal(max_pr, this_max_pr)
          # take min_pr & max_pr
          any_change_during_this_loop = true
          new_min = min_pr
          new_max = max_pr
          # the fist one is inside the second one
        elsif Ops.greater_or_equal(min_pr, this_min_pr) &&
            Ops.less_or_equal(max_pr, this_max_pr)
          # take this_min_pr & this_max_pr
          any_change_during_this_loop = true
          new_min = this_min_pr
          new_max = this_max_pr
          # the fist one partly covers the second one (by its right side)
        elsif Ops.less_or_equal(min_pr, this_min_pr) &&
            Ops.greater_or_equal(max_pr, this_min_pr)
          # take min_pr & this_max_pr
          any_change_during_this_loop = true
          new_min = min_pr
          new_max = this_max_pr
          # the second one partly covers the first one (by its left side)
        elsif Ops.greater_or_equal(min_pr, this_min_pr) &&
            Ops.greater_or_equal(max_pr, this_max_pr)
          # take this_min_pr & max_pr
          any_change_during_this_loop = true
          new_min = this_min_pr
          new_max = max_pr
          # the first one has the second one just next on the right
        elsif Ops.add(max_pr, 1) == this_min_pr
          # take min_pr & this_max_pr
          any_change_during_this_loop = true
          new_min = min_pr
          new_max = this_max_pr
          # the first one has the second one just next on the left side
        elsif Ops.subtract(min_pr, 1) == this_max_pr
          # take this_min_pr & max_pr
          any_change_during_this_loop = true
          new_min = this_min_pr
          new_max = max_pr
        end
        # rubocop:enable Lint/DuplicateBranch
        if any_change_during_this_loop && !new_min.nil? && !new_max.nil?
          new_port_range = CreateNewPortRange(new_min, new_max)
          Builtins.y2milestone(
            "Joining %1 and %2 into %3",
            port_range,
            try_this_pr,
            new_port_range
          )
          # Remove old port ranges
          list_of_ranges = Builtins.filter(list_of_ranges) do |filter_pr|
            filter_pr != port_range && filter_pr != try_this_pr
          end
          # Create a new one
          list_of_ranges = Builtins.add(list_of_ranges, new_port_range)
        end
      end
      # <--

      # renew list of current port ranges, they have changed
      raise Break if any_change_during_this_loop
    end

    break if !any_change_during_this_loop
  end
  Builtins.y2milestone("Result of joining: %1", list_of_ranges)

  new_list = Convert.convert(
    Builtins.union(new_list, list_of_ranges),
    from: "list",
    to:   "list <string>"
  )

  deep_copy(new_list)
end

#IsPortRange(check_this) ⇒ `Boolean`

Function returns where the string parameter is a port range. Port ranges are defined by the syntax "min_port_number:max_port_number". Port range means that these maximum and minimum ports define the range of currency in Firewall. Ports defining the range are included in it. This function doesn't check whether the port range is valid or not.

Examples:

IsPortRange("34:38")      -> true
IsPortRange("0:38")       -> true
IsPortRange("port-range") -> false
IsPortRange("19-22")      -> false

Parameters:

string —
to be checked

Returns:

(Boolean) —
whether the checked string is a port range or not

#IsValidPortRange(port_range) ⇒ `Boolean`

Checks whether the port range is valid.

Examples:

IsValidPortRange("54:135") -> true  // valid
IsValidPortRange("135:54") -> false // reverse order
IsValidPortRange("0:135")  -> false // cannot be from 0
IsValidPortRange("135")    -> false // cannot be one number
IsValidPortRange("54-135") -> false // wrong separator

Parameters:

port_range (String)

Returns:

(Boolean) —
if it is valid

#main ⇒ `Object`

# File 'library/network/src/modules/PortRanges.rb', line 41

def main
  textdomain "base"

  Yast.import "PortAliases"

  # Variable for ReportOnlyOnce() function
  @report_only_once = []

  # Maximal number of port number, they are in the interval 1-65535 included.
  # The very same value should appear in SuSEFirewall::max_port_number.
  @max_port_number = 65_535
end

#PortIsInPortranges(port, port_ranges) ⇒ `Boolean`

Function returns where the port name or port number is included in the list of port ranges. Port ranges must be defined as a string with format "min_port_number:max_port_number".

Examples:

PortIsInPortranges ("130",  ["100:150","10:30"]) -> true
PortIsInPortranges ("30",   ["100:150","10:20"]) -> false
PortIsInPortranges ("pop3", ["100:150","10:30"]) -> true
PortIsInPortranges ("http", ["100:150","10:20"]) -> false

Parameters:

port (String) —
a number or a name (see PortAliasesClass)
port_ranges (Array<String>)

Returns:

(Boolean)

# File 'library/network/src/modules/PortRanges.rb', line 182

def PortIsInPortranges(port, port_ranges)
  port_ranges = deep_copy(port_ranges)
  return false if Builtins.size(port_ranges) == 0

  ret = false

  port_number = PortAliases.GetPortNumber(port)

  if !port_number.nil?
    Builtins.foreach(port_ranges) do |port_range|
      # is portrange really a port range?
      if IsValidPortRange(port_range)
        min_pr = Builtins.tointeger(
          Builtins.regexpsub(port_range, "^([0123456789]+):.*$", "\\1")
        )
        max_pr = Builtins.tointeger(
          Builtins.regexpsub(port_range, "^.*:([0123456789]+)$", "\\1")
        )

        # is the port inside?
        if Ops.less_or_equal(min_pr, max_pr) &&
            Ops.less_or_equal(min_pr, port_number) &&
            Ops.less_or_equal(port_number, max_pr)
          ret = true

          raise Break # break the loop, match found
        end
      end
    end
  end

  ret
end

#RemovePortFromPortRanges(port_number, port_ranges) ⇒ `Array<String>`

Function removes port number from all port ranges. Port must be in its numeric form. A port range may be a single port, that's OK. Or a non-port, then it will be kept.

Examples:

RemovePortFromPortRanges(25, ["19:88", "152:160"]) -> ["19:24", "26:88", "152:160"]

Parameters:

port_number (Fixnum) —
to be removed
port_ranges (Array<String>)

Returns:

(Array<String>) —
of filtered port_ranges

#ReportOnlyOnce(what_to_report) ⇒ `Boolean`

Report the error, warning, message only once. Stores the error, warning, message in memory. This is just a helper function that could avoid from filling y2log up with a lot of the very same messages - 'foreach()' is a very powerful builtin.

Examples:

string error = sformat("Port number %1 is invalid.", port_nr);
if (ReportOnlyOnce(error)) y2error(error);

Parameters:

string —
error, warning or message

Returns:

(Boolean) —
whether the message should be reported or not

# File 'library/network/src/modules/PortRanges.rb', line 67

def ReportOnlyOnce(what_to_report)
  return false if Builtins.contains(@report_only_once, what_to_report)

  @report_only_once = Builtins.add(@report_only_once, what_to_report)
  true
end

Class: Yast::PortRangesClass

Overview

Helpers collapse

Instance Method Summary collapse

Instance Method Details

#CreateNewPortRange(min_pr, max_pr) ⇒ String

Examples:

#DividePortsAndPortRanges(unsorted_ports, with_aliases) ⇒ Hash{String => Array<String>}

#FlattenServices(old_list, protocol) ⇒ Array<String>

#IsPortRange(check_this) ⇒ Boolean

Examples:

#IsValidPortRange(port_range) ⇒ Boolean

Examples:

#main ⇒ Object

#PortIsInPortranges(port, port_ranges) ⇒ Boolean

Examples:

#RemovePortFromPortRanges(port_number, port_ranges) ⇒ Array<String>

Examples:

#ReportOnlyOnce(what_to_report) ⇒ Boolean

Examples:

#CreateNewPortRange(min_pr, max_pr) ⇒ `String`

#DividePortsAndPortRanges(unsorted_ports, with_aliases) ⇒ `Hash{String => Array<String>}`

#FlattenServices(old_list, protocol) ⇒ `Array<String>`

#IsPortRange(check_this) ⇒ `Boolean`

#IsValidPortRange(port_range) ⇒ `Boolean`

#main ⇒ `Object`

#PortIsInPortranges(port, port_ranges) ⇒ `Boolean`

#RemovePortFromPortRanges(port_number, port_ranges) ⇒ `Array<String>`

#ReportOnlyOnce(what_to_report) ⇒ `Boolean`