from Domain import InetDomain
Module implementing address domains.
from Zorp import *
Module defining global constants, and interface entry points to the Zorp core.
from traceback import print_exc
import types
This is a simple Zone class using InetDomain as its address type.
Initializes an InetZone instance
__init__ ( self, name, addr, inbound_services=None, outbound_services=None, admin_parent=None, umbrella=0, ) |
Initializes an InetZone object instance, and sets its attributes based on arguments.
Table 4-123. Arguments for InetZone.__init__()
self | this instance |
name | name of this zone |
addr | a string representing an address range, interpreted by the domain class (last argument), or a list of strings representing multiple address ranges. |
inbound_services | set of permitted inbound services as described by RootZone |
outbound_services | set of permitted outbound services as described by RootZone |
admin_parent | name of the administrative parent |
umbrella | TRUE if this zone is an umbrella zone |
A zone is the basis of access control in Zorp. It encapsulates an address range (for example an IPv4 subnet). Parsing and representing an address is done by the Domain class and derivates.
Zones are organized into two different hierarchies. The first is based on the address it encapsulates. In this case a zone is a child of some other zone, if the parent is containing it. (For example 0.0.0.0/0 contains 192.168.0.0/24) This hierarchy is used when searching the containing zone of a given network address.
The other hierarchy is based on administrative decisions. Administrative children inherit security attributes (permitted set of services etc.) from their parents.
The RootZone class serves two purposes:
1. it is the base class for all Zone-like classes, implementing interfaces for access control, and hierarchy travelsal.
2. an instance of this class is an address domain independent root of the Zone address hierarchy and delegates searches to the appropriate Zone.
Table 4-124. Attributes for class RootZone
name | a unique name of this zone |
inbound_services | mapping indexed by service name, containing an item for each permitted inbound service |
outbound_services | similar to inbound_services, but used for outbound services. |
admin_parent | parent of this zone in the administrative hierarchy |
umbrella | true for umbrella zones (ie. zones that do not inherit security attributes from their administrative parents) |
Initialize a RootZone instance.
__init__ ( self, name, inbound_services=None, outbound_services=None, admin_parent=None, umbrella=0, ) |
This function is primarily called by derived classes to initialize basic Zone data structures.
Table 4-125. Arguments for RootZone.__init__()
self | this instance |
name | name of this zone |
inbound_services | an array of allowed inbound service names |
outbound_services | an array of allowed outbound service names |
admin_parent | administrative parent name |
umbrella | this is an umbrella zone |
domain | address domain |
ZoneException
Overridden operator to return the textual representation of self.
__str__ ( self ) |
Called by the Python core to format the object contents when it is written.
Table 4-126. Arguments for RootZone.__str__()
self | this instance |
Add a address-based child to this zone.
addAddrChild ( self, child ) |
This function adds a children to the set of child zones.
Table 4-127. Arguments for RootZone.addAddrChild()
self | this instance |
child | child to add |
Add an administrative child
addAdminChild ( self, child ) |
This function adds child to the set of administrative children.
Table 4-128. Arguments for RootZone.addAdminChild()
self | this instance |
child | child zone add |
Delete an address child.
delAddrChild ( self, child ) |
This function removes an item from the set of address children.
Table 4-129. Arguments for RootZone.delAddrChild()
self | this instance |
child | child to remove |
Find the root Zone of the given address domain.
findDomain ( self, domain ) |
Finds the first child in self which uses domain as address domain.
Table 4-130. Arguments for RootZone.findDomain()
self | this instance |
domain | class implementing address range specifics (for example InetDomain for IPv4) |
ZoneException
Find the most specific Zone for address.
findZone ( self, address ) |
This function searches the address hierarchy for the most specific Zone containing address.
Table 4-131. Arguments for RootZone.findZone()
self | this instance |
address | address we are trying to find (should be derived from SockAddr) |
ZoneException
Inbound access control check.
isInboundServicePermitted ( self, session ) |
This function is called when a session is connecting to a server to check whether it is permitted.
Table 4-132. Arguments for RootZone.isInboundServicePermitted()
self | this instance |
session | session that should be checked |
Z_ACCEPT if the service is permitted, Z_REJECT otherwise
Outbound access control check.
isOutboundServicePermitted ( self, session ) |
This function is called when an incoming connection is detected to check whether it is allowable.
Table 4-133. Arguments for RootZone.isOutboundServicePermitted()
self | this instance |
session | session that should be checked |
Z_ACCEPT if the service is permitted, Z_REJECT otherwise
Iterate over the set of address children
iterAddrChildren ( self, fn, parm=None, ) |
This function iterates over the set of address children and calls fn for each item.
Table 4-134. Arguments for RootZone.iterAddrChildren()
self | this instance |
fn | function to call |
parm | opaque argument passed to fn |
Iterate over the set of administrative children.
iterAdminChildren ( self, fn, parm=None, ) |
This function iterates over the set of administrative children calling the function fn for each item, with parameters parm, self and the item.
The callback fn may delete items from admin_children, this function uses a local copy of that array.
Table 4-135. Arguments for RootZone.iterAdminChildren()
self | this instance |
fn | function to call |
parm | opaque object passed to fn |
Set address parent of this zone.
setAddrParent ( self, parent ) |
This function sets the address parent of this Zone.
Table 4-136. Arguments for RootZone.setAddrParent()
self | this instance |
parent | parent Zone |
Set administrative parent of this zone.
setAdminParent ( self, parent ) |
This function sets the administrative parent of this Zone.
Table 4-137. Arguments for RootZone.setAdminParent()
self | this instance |
parent | parent Zone |
This class differs from RootZone in that it uses a real address domain (for IPv4 InetDomain is used), unlike RootZone which is a general wrapper for all address types (IPv4, IPv6, SPX etc.)
Initializes a Zone instance.
__init__ ( self, name, addr, inbound_services=None, outbound_services=None, admin_parent=None, umbrella=0, domain=None, ) |
This class initializes a Zone instance by calling the inherited constructor, and setting local attributes.
Table 4-138. Arguments for Zone.__init__()
self | this instance |
name | name of this zone |
addr | a string representing an address range interpreted by the domain class (last argument), or a list of strings representing multiple address ranges. |
inbound_services | set of permitted inbound services as described by RootZone |
outbound_services | set of permitted outbound services as described by RootZone |
admin_parent | name of the administrative parent |
umbrella | TRUE if this zone is an umbrella zone |
domain | address domain class parsing addr and performing address comparisons for IPv4 addresses it should be InetDomain |
ValueError
If addr is a list of addresses (like ['192.168.1.1', '192.168.1.5']), several subzones are automatically created with administrative parent set to self. This way you can define members with additional privilege easily.
Format the Zone as string
__str__ ( self ) |
This function is called by the Python core when this object is used as string.
Find the most specific containing Zone of addr
findZone ( self, addr ) |
This function returns the most specific Zone containing addr
Table 4-139. Arguments for Zone.findZone()
self | this instance |
addr | address to look up |
ZoneException
Helper function to place this zone into the address hierarchy.
setAddrRelatives ( self ) |
This function is called by the Zone constructor to place this zone into the address hierarchy.
Table 4-140. Arguments for Zone.setAddrRelatives()
self | this instance |
NotImplementedError