firegex 5.0.0__cp313-cp313-win_amd64.whl

firegex/__init__.py

@@ -0,0 +1,69 @@
+
+def _get_version():
+    v = "5.0.0" if "{" not in "5.0.0" else "0.0.0"
+    if v == "0.0.0":
+        import os
+        env_v = os.getenv("FIREGEX_VERSION")
+        if env_v:
+            return env_v
+        try:
+            import re
+
+            def parse_version(ver):
+                ver = ver.lstrip("v")
+                parts = re.split(r'[^0-9]+', ver)
+                return tuple(int(p) if p.isdigit() else 0 for p in parts if p)
+
+            def find_git_dir(start_path):
+                current = start_path
+                while current and current != "/" and current != "":
+                    gd = os.path.join(current, ".git")
+                    if os.path.isdir(gd):
+                        return gd
+                    parent = os.path.dirname(current)
+                    if parent == current:
+                        break
+                    current = parent
+                return None
+
+            git_dir = find_git_dir(os.path.abspath(os.path.dirname(__file__)))
+            if not git_dir:
+                return v
+                
+            branch = None
+            with open(os.path.join(git_dir, "HEAD"), "r") as f:
+                head = f.read().strip()
+                if head.startswith("ref: refs/heads/"):
+                    branch = head.split("ref: refs/heads/")[1]
+                    
+            if branch != "main":
+                return v
+                
+            tags = []
+            try:
+                with open(os.path.join(git_dir, "packed-refs"), "r") as f:
+                    for line in f:
+                        if " refs/tags/" in line:
+                            tags.append(line.strip().split(" refs/tags/")[1])
+            except Exception:
+                pass
+                
+            tags_dir = os.path.join(git_dir, "refs", "tags")
+            try:
+                for root, _, files in os.walk(tags_dir):
+                    for file in files:
+                        tags.append(os.path.relpath(os.path.join(root, file), tags_dir).replace(os.path.sep, "/"))
+            except Exception:
+                pass
+                
+            version_tags = [t for t in set(tags) if any(c.isdigit() for c in t)]
+            if version_tags:
+                return max(version_tags, key=parse_version)
+        except Exception:
+            pass
+    return v
+
+__version__ = _get_version()
+
+#Exported functions
+__all__ = []

firegex/__main__.py

@@ -0,0 +1,6 @@
+#!/usr/bin/env python3
+
+from firegex.cli import run
+
+if __name__ == "__main__":
+    run()

firegex/cli.py

@@ -0,0 +1,219 @@
+
+#!/usr/bin/env python3
+
+import json
+import os
+import socket
+import sys
+
+import typer
+from rich import print
+from rich.markup import escape
+from typer import Exit
+
+from firegex import __version__
+from firegex.pyfilters.proxysim import run_proxy_simulation
+
+app = typer.Typer(
+    no_args_is_help=True,
+    context_settings={"help_option_names": ["-h", "--help"]}
+)
+
+def close_cli(code:int=1):
+    raise Exit(code)
+
+DEV_MODE = __version__ == "0.0.0"
+
+def test_connection(host, port, use_ipv6=False):
+    family = socket.AF_INET6 if use_ipv6 else socket.AF_INET
+    sock = socket.socket(family, socket.SOCK_STREAM)
+    
+    try:
+        sock.settimeout(3)
+        sock.connect((host, port))
+        return True
+    except Exception:
+        return False
+    finally:
+        sock.close()
+
+@app.command("pyfilters", help="Run your Python filters against a real service, locally")
+def pyfilters(
+    filter_file: str = typer.Argument(..., help="The path to the filter file"),
+    address: str = typer.Argument(..., help="The address of the target to proxy"),
+    port: int = typer.Argument(..., help="The port of the target to proxy"),
+    
+    from_address: str = typer.Option(None, help="The address of the local server"),
+    from_port: int = typer.Option(7474, help="The port of the local server"),    
+    ipv6: bool = typer.Option(False, "-6", help="Use IPv6 for the connection"),
+):
+    if from_address is None:
+        from_address = "::1" if ipv6 else "127.0.0.1"
+    if not os.path.isfile(filter_file):
+        print(f"[bold red]'{escape(os.path.abspath(filter_file))}' not found[/]")
+        close_cli()
+    if not test_connection(address, port, ipv6):
+        print(f"[bold red]Can't connect to {escape(address)}:{port}[/]")
+        close_cli()
+    # No protocol to pass: the filter file says which one it speaks by what it asks for.
+    run_proxy_simulation(filter_file, address, port, from_address, from_port, ipv6)
+
+regex_app = typer.Typer(
+    no_args_is_help=True,
+    help="Try a regex ruleset with the engine firegex matches with",
+)
+app.add_typer(regex_app, name="regex")
+
+
+def _load_ruleset(path: str):
+    """Read a ruleset, with the errors an operator can act on.
+
+    The file is the same shape firegex itself uses, so a ruleset can be written here and
+    pasted there, or exported from there and replayed here.
+    """
+    from firegex.regex import HyperscanMissing, Rule, available, validate
+
+    if not available():
+        print(f"[bold red]{escape(str(HyperscanMissing()))}[/]")
+        close_cli()
+    if not os.path.isfile(path):
+        print(f"[bold red]'{escape(os.path.abspath(path))}' not found[/]")
+        close_cli()
+    try:
+        with open(path) as f:
+            raw = json.load(f)
+    except json.JSONDecodeError as e:
+        print(f"[bold red]{escape(path)} is not valid JSON: {escape(str(e))}[/]")
+        close_cli()
+    if not isinstance(raw, list):
+        print("[bold red]A ruleset is a list of rules[/]")
+        close_cli()
+
+    rules = []
+    broken = False
+    for index, item in enumerate(raw):
+        try:
+            rule = Rule.from_dict(item)
+        except (KeyError, ValueError) as e:
+            print(f"[bold red]rule {index} is malformed: {escape(str(e))}[/]")
+            broken = True
+            continue
+        # Judged against the mode it would actually run in, so what is accepted here is
+        # what firegex will accept.
+        why = validate(rule)
+        if why:
+            print(f"[bold red]{escape(rule.id)}: {escape(why)}[/]")
+            broken = True
+            continue
+        rules.append(rule)
+    if broken:
+        close_cli()
+    if not rules:
+        print("[bold red]The ruleset is empty[/]")
+        close_cli()
+    return rules
+
+
+@regex_app.command("check", help="Check that a ruleset compiles, and say what is in it")
+def regex_check(
+    rules_file: str = typer.Argument(..., help="The path to the ruleset (JSON)"),
+):
+    rules = _load_ruleset(rules_file)
+    print(f"[bold green]{len(rules)} rule(s), all valid[/]")
+    for rule in rules:
+        case = "" if rule.case_sensitive else ", any case"
+        print(f"  [bold]{escape(rule.id)}[/]  /{escape(rule.pattern)}/  "
+              f"[dim]{rule.direction.value}{case}, block[/]")
+
+
+@regex_app.command("test", help="Run a ruleset over a sample and show what it would do")
+def regex_test(
+    rules_file: str = typer.Argument(..., help="The path to the ruleset (JSON)"),
+    sample_file: str = typer.Option(None, "--sample", "-s",
+                                    help="File to match against; stdin when omitted"),
+    from_service: bool = typer.Option(False, "--from-service",
+                                      help="Treat the sample as traffic from the service"),
+):
+    from firegex.regex import Ruleset
+
+    rules = _load_ruleset(rules_file)
+    if sample_file:
+        if not os.path.isfile(sample_file):
+            print(f"[bold red]'{escape(os.path.abspath(sample_file))}' not found[/]")
+            close_cli()
+        with open(sample_file, "rb") as f:
+            sample = f.read()
+    else:
+        sample = sys.stdin.buffer.read()
+    if not sample:
+        print("[bold red]Nothing to match against[/]")
+        close_cli()
+
+    ruleset = Ruleset(rules)
+    is_input = not from_service
+    blocked_by = ruleset.apply(sample, is_input)
+
+    # Said before the verdict, because it changes what the verdict means: "passed
+    # through" from a run that could not try every rule is not the same answer.
+    for rule_id, why in ruleset.unscannable.items():
+        print(f"[bold yellow]not tried here[/] [bold]{escape(rule_id)}[/]: {escape(why)}. "
+              f"It is valid and will run on a real service — only matching it against a "
+              f"sample needs a mode hyperscan does not offer for it.")
+
+    if blocked_by is not None:
+        print(f"[bold red]blocked[/] by [bold]{escape(blocked_by)}[/]")
+        close_cli(0)
+    print("[bold green]passed through[/]"
+          + (" by the rules that could be tried" if ruleset.unscannable else ""))
+
+
+@regex_app.command("proxy", help="Run a local proxy applying a ruleset, like `fgex pyfilters`")
+def regex_proxy(
+    rules_file: str = typer.Argument(..., help="The path to the ruleset (JSON)"),
+    address: str = typer.Argument(..., help="The address of the target to proxy"),
+    port: int = typer.Argument(..., help="The port of the target to proxy"),
+    from_address: str = typer.Option(None, help="The address of the local server"),
+    from_port: int = typer.Option(7474, help="The port of the local server"),
+    ipv6: bool = typer.Option(False, "-6", help="Use IPv6 for the connection"),
+):
+    from firegex.regex import Ruleset
+    from firegex.regex.sim import run_regex_simulation
+
+    rules = _load_ruleset(rules_file)
+    if from_address is None:
+        from_address = "::1" if ipv6 else "127.0.0.1"
+    if not test_connection(address, port, ipv6):
+        print(f"[bold red]Can't connect to {escape(address)}:{port}[/]")
+        close_cli()
+    print("[dim]Blocking matches per chunk here, but across the whole stream on a real "
+          "service: a pattern split over two reads is caught there and not here.[/]")
+    ruleset = Ruleset(rules)
+    # Built before the first connection rather than on it, so the warning is on screen
+    # while the operator is still reading the banner instead of appearing mid-traffic.
+    for is_input in (True, False):
+        ruleset._db(is_input)
+    for rule_id, why in ruleset.unscannable.items():
+        print(f"[bold yellow]not applied here[/] [bold]{escape(rule_id)}[/]: {escape(why)}. "
+              f"It is valid and will run on a real service.")
+    run_regex_simulation(ruleset, address, port, from_address, from_port, ipv6)
+
+
+def version_callback(verison: bool):
+    if verison:
+        print(__version__, "Development Mode" if DEV_MODE else "Release")
+        raise typer.Exit()
+
+@app.callback()
+def main(
+    verison: bool = typer.Option(False, "--version", "-v", help="Show the version of the client", callback=version_callback),
+):
+    pass
+
+def run():
+    try:
+        app()
+    except KeyboardInterrupt:
+        print("[bold yellow]Operation cancelled[/]") 
+ 
+if __name__ == "__main__":
+    run()

firegex/pyfilters/__init__.py

@@ -0,0 +1,58 @@
+from firegex.pyfilters.models import (
+    RawPacket,
+    TCPInputStream,
+    TCPOutputStream,
+    TCPClientStream,
+    TCPServerStream,
+    HttpHistory,
+    HttpStreamHistory,
+)
+from firegex.pyfilters.internals.models import Action, FullStreamAction, ExceptionAction
+
+ACCEPT = Action.ACCEPT
+DROP = Action.DROP
+REJECT = Action.REJECT
+
+#: Set on a function by `@pyfilter`. Marking the function *is* the registration — there
+#: is no registry to keep, to clear between files, or to race two compilations against.
+PYFILTER_MARK = "__firegex_pyfilter__"
+
+
+def pyfilter(func):
+    """Mark a function as a filter, and hand it back unchanged.
+
+    The mark lives on the function, so the file that defines it holds the whole list:
+    `collect_pyfilters` reads a module's globals in definition order. What that replaced
+    was a set of *names* on a module-global attribute of this decorator, which had three
+    consequences worth not having back — a set has no order, so the order filters ran in
+    was whatever hashing produced; the state outlived the file, so every caller had to
+    clear it before and after; and a name registered from somewhere the module globals
+    could not reach (a nested `def`) was registered and then not found.
+
+    The function is returned as it is, not wrapped. The wrapper it used to get forwarded
+    `*args` and did nothing else, at the cost of a stack frame in every traceback the
+    operator has to read.
+    """
+    setattr(func, PYFILTER_MARK, True)
+    return func
+
+
+def collect_pyfilters(namespace: dict) -> list[str]:
+    """The filters a module defines, in the order it defines them.
+
+    Definition order is the order they run in, which is the only order a reader of the
+    file can predict.
+    """
+    seen, names = set(), []
+    for name, obj in namespace.items():
+        if callable(obj) and getattr(obj, PYFILTER_MARK, False) and id(obj) not in seen:
+            seen.add(id(obj))
+            names.append(name)
+    return names
+
+__all__ = [
+    "ACCEPT", "DROP", "REJECT",
+    "Action", "FullStreamAction", "ExceptionAction", "pyfilter", "collect_pyfilters",
+    "RawPacket", "TCPInputStream", "TCPOutputStream", "TCPClientStream", "TCPServerStream",
+    "HttpHistory", "HttpStreamHistory"
+]

firegex/pyfilters/internals/__init__.py

@@ -0,0 +1,317 @@
+from inspect import Parameter, signature
+from itertools import product
+from firegex.pyfilters.internals.models import Action, ExceptionAction, FullStreamAction
+from firegex.pyfilters.internals.models import FilterHandler, PacketHandlerResult
+import functools
+from firegex.pyfilters.internals.data import DataStreamCtx
+from firegex.pyfilters.internals.exceptions import NotReadyToRun, StreamFullReject, DropPacket, RejectConnection, StreamFullDrop
+from firegex.pyfilters.internals.data import RawPacket
+
+def _type_name(annotation) -> str:
+    return getattr(annotation, "__name__", None) or str(annotation)
+
+
+def _wanted_by(filters: list[str], glob: dict) -> list[tuple[str, object, list[object]]]:
+    """`(name, func, annotations)` for each named filter, looked up once.
+
+    Both passes below need the same three things, and reading them twice is how the two
+    ended up disagreeing about what to say when an annotation is not a model — one
+    complained that no protocol provides it, the other that this file's protocol does
+    not. One reading, one message.
+    """
+    found = []
+    for name in filters:
+        if not isinstance(name, str):
+            raise Exception("Invalid filter list: must be a list of strings")
+        func = glob.get(name)
+        if func is None:
+            raise Exception(f"Filter {name} not found")
+        if not callable(func):
+            raise Exception(f"{func} is not a function")
+        annotations = []
+        for param, spec in signature(func).parameters.items():
+            if spec.annotation is Parameter.empty:
+                # The library decides when to call a filter from what it asks for, so a
+                # parameter that asks for nothing leaves it with nothing to go on.
+                raise Exception(
+                    f"Parameter {param!r} of {name} has no type annotation. Annotate it "
+                    f"with what the filter wants to be given — RawPacket, a TCP stream, "
+                    f"an HTTP model — because that is what decides when it is called."
+                )
+            annotations.append(spec.annotation)
+        found.append((name, func, annotations))
+    return found
+
+
+def infer_proto(wanted: list[tuple[str, object, list[object]]]) -> str:
+    """Which application protocol a file speaks, read off what it asks for.
+
+    A filter file does not declare its protocol; it shows it. Asking for an
+    `HttpRequest` is what makes a file an HTTP filter, and asking only for a
+    `RawPacket` or a TCP stream is what makes one protocol-agnostic — so the same file
+    can hold both, and a TCP service can carry a filter that parses HTTP alongside one
+    that does not.
+
+    The one thing that cannot work is a file asking for two *different* application
+    protocols, because a connection is only ever one of them. That is refused here,
+    naming both functions, rather than being resolved by picking a winner.
+    """
+    from firegex.pyfilters.models import type_annotations_associations
+
+    candidates = set(type_annotations_associations)
+    # What actually narrowed the choice, kept so a conflict can be explained in terms
+    # of the operator's own code instead of a protocol name they never typed.
+    narrowing: list[tuple[str, object, set[str]]] = []
+
+    for name, _func, annotations in wanted:
+        for annotation in annotations:
+            protos = {
+                proto
+                for proto, types in type_annotations_associations.items()
+                if annotation in types
+            }
+            if not protos:
+                known = sorted({
+                    _type_name(t)
+                    for types in type_annotations_associations.values()
+                    for t in types
+                })
+                raise Exception(
+                    f"Invalid type annotation {_type_name(annotation)} for function "
+                    f"{name}: no protocol provides it. Available: " + ", ".join(known)
+                )
+            if not candidates & protos:
+                clash = next((n for n in narrowing if not n[2] & protos), None)
+                if clash:
+                    raise Exception(
+                        f"{name} asks for {_type_name(annotation)}, which only "
+                        f"{'/'.join(sorted(protos))} provides, while {clash[0]} asks for "
+                        f"{_type_name(clash[1])}, which only "
+                        f"{'/'.join(sorted(clash[2]))} does. A connection speaks one "
+                        f"application protocol, so one file cannot filter both: split "
+                        f"them into two filters on the same service."
+                    )
+                raise Exception(
+                    f"{name} asks for {_type_name(annotation)}, which no protocol in "
+                    f"this file can provide"
+                )
+            if candidates & protos != candidates:
+                narrowing.append((name, annotation, protos))
+            candidates &= protos
+
+    return simplest_proto(candidates)
+
+
+def simplest_proto(candidates=None) -> str:
+    """The least specific protocol among `candidates` — all of them by default.
+
+    A file that only wants raw payloads is a TCP filter, not an HTTP one that happens
+    never to parse, so "fewest models" is what "simplest" means.
+    """
+    from firegex.pyfilters.models import type_annotations_associations
+    return min(
+        candidates if candidates else type_annotations_associations,
+        key=lambda p: (len(type_annotations_associations[p]), p),
+    )
+
+
+def generate_filter_structure(filters: list[str], proto: str | None, glob: dict) -> list[FilterHandler]:
+    """One `FilterHandler` per filter, in the order given, for one protocol."""
+    from firegex.pyfilters.models import type_annotations_associations
+
+    wanted = _wanted_by(filters, glob)
+    if proto is None:
+        proto = infer_proto(wanted)
+    if proto not in type_annotations_associations:
+        raise Exception("Invalid protocol")
+    provides = type_annotations_associations[proto]
+
+    handlers = []
+    for name, func, annotations in wanted:
+        for annotation in annotations:
+            if annotation not in provides:
+                raise Exception(
+                    f"Invalid type annotation {_type_name(annotation)} for function "
+                    f"{name}: this file speaks {proto}, which does not provide it"
+                )
+        handlers.append(FilterHandler(
+            func=func,
+            name=func.__name__,
+            params={a: provides[a] for a in annotations},
+            proto=proto,
+        ))
+    return handlers
+
+
+def get_filters_info(code:str, proto:str|None = None) -> list[FilterHandler]:
+    """The filters a file defines. `proto` is inferred from the code when not given.
+
+    Only the operator's own source is `exec`ed. Everything around it used to be too —
+    the import, the registry reset before and after — which was a string compiled at
+    runtime for each step of what a plain call does, and which existed only because the
+    registry was global state that had to be cleared around every use.
+    """
+    from firegex.pyfilters import collect_pyfilters
+
+    glob: dict = {}
+    exec(code, glob, glob)
+    return generate_filter_structure(collect_pyfilters(glob), proto, glob)
+
+
+def get_filter_names(code:str, proto:str|None = None) -> list[str]:
+    return [ele.name for ele in get_filters_info(code, proto)]    
+
+
+def get_code_proto(code:str) -> str:
+    """Which application protocol a file speaks, for a caller that needs to say so.
+
+    Raises the same errors `get_filters_info` does, so a file that mixes two protocols
+    is reported here with the reason rather than silently classified as one of them.
+    """
+    from firegex.pyfilters.models import type_annotations_associations
+    infos = get_filters_info(code)
+    if infos:
+        return infos[0].proto
+    # A file with no filters yet speaks the simplest protocol there is: it asks for
+    # nothing, so nothing is ruled out.
+    return min(
+        type_annotations_associations,
+        key=lambda p: (len(type_annotations_associations[p]), p),
+    )
+
+#: What a model raises while being built, and the verdict it means. `NotReadyToRun` is
+#: not here: it is the ordinary "there is nothing to give this filter yet", handled by
+#: skipping the call rather than by ending the packet.
+#: Each is credited to what actually decided it, never to the filter function: those two
+#: are raised only when the parser could not read the traffic, and a function the
+#: operator wrote was listed as having refused a connection it was never shown.
+_RAISED_VERDICT = {
+    StreamFullDrop: (Action.DROP, "@MAX_STREAM_SIZE_REACHED"),
+    StreamFullReject: (Action.REJECT, "@MAX_STREAM_SIZE_REACHED"),
+    DropPacket: (Action.DROP, "@INVALID_ENCODING"),
+    RejectConnection: (Action.REJECT, "@INVALID_ENCODING"),
+}
+
+
+def handle_packet(glob: dict) -> None:
+    """Run every enabled filter over the chunk in `glob`, and leave a verdict there.
+
+    The first filter to answer anything but ACCEPT ends the packet — every verdict
+    there is now terminal. `UNSTABLE_MANGLE` used to be the exception: it was remembered
+    and the walk carried on, because a later filter might still refuse the rewritten
+    chunk. It is gone, and so is that branch: see the note on `Action` in `models.py`.
+    """
+    internal_data = DataStreamCtx(glob)
+    result = PacketHandlerResult(glob)
+
+    # Built once per packet and shared by every filter that asks for the same thing: two
+    # filters both taking an `HttpRequest` parse the chunk once between them.
+    built = {RawPacket: internal_data.current_pkt}
+
+    for filter in internal_data.filter_call_info:
+        args = []
+        for data_type, build in filter.params.items():
+            if data_type not in built:
+                try:
+                    built[data_type] = build(internal_data)
+                except NotReadyToRun:
+                    built[data_type] = None
+                except tuple(_RAISED_VERDICT) as raised:
+                    action, matched_by = _RAISED_VERDICT[type(raised)]
+                    result.action = action
+                    result.matched_by = matched_by or filter.name
+                    return result.set_result()
+            if built[data_type] is None:
+                args = None  # nothing to give this filter yet; it is not called
+                break
+            args.append(built[data_type])
+
+        if args is None:
+            continue
+
+        # A model may hand back several of itself — a chunk carrying three HTTP requests
+        # is three calls, not one call with a list. Where more than one parameter does
+        # that, the filter sees every combination.
+        for call_args in product(*(a if isinstance(a, list) else [a] for a in args)):
+            res = filter.func(*call_args)
+            if res is None or res == Action.ACCEPT:
+                continue
+            if not isinstance(res, Action):
+                raise Exception(f"Invalid return type {type(res)} for function {filter.name}")
+            result.matched_by = filter.name
+            result.action = res
+            return result.set_result()
+
+    return result.set_result()  # nothing refused it: ACCEPT
+
+
+#: The knobs a filter file may set, and what each one is kept as. Three copies of "if
+#: the name is there and the value is the right type, store it" differing only in the
+#: name and the type; the one that was *not* a copy had drifted — it checked `Action`
+#: where the setter and the documentation both said `ExceptionAction`, so the knob could
+#: not be set at all, in either direction.
+_SETTINGS = {
+    "FGEX_STREAM_MAX_SIZE": ("stream_max_size", int),
+    "FGEX_FULL_STREAM_ACTION": ("full_stream_action", FullStreamAction),
+    "FGEX_INVALID_ENCODING_ACTION": ("invalid_encoding_action", ExceptionAction),
+}
+
+
+def compile(glob: dict) -> None:
+    """Prepare a filter file's globals to be handed packets.
+
+    Called once per connection, after the operator's source has been executed into
+    `glob`: it resolves which functions run, in what order, over what models, and reads
+    the file's settings.
+    """
+    internal_data = DataStreamCtx(glob, init_pkt=False)
+
+    glob["print"] = functools.partial(print, flush=True)
+
+    # Which functions run: `None` for every one the file defines, a list for exactly
+    # those of them. A name the file no longer defines is passed over rather than
+    # refusing the whole file — a switched-off function deleted from the code afterwards
+    # would otherwise stop every other filter in it from loading. Worked out here, in the
+    # process that has just run the module, so the caller never has to run it to ask.
+    from firegex.pyfilters import collect_pyfilters
+    defined = collect_pyfilters(glob)
+    enabled = glob.get("__firegex_pyfilter_enabled")
+    if enabled is None:
+        names = defined
+    else:
+        wanted = set(enabled)
+        names = [name for name in defined if name in wanted]
+    # Absent means "read it off the code", which is the normal case: the file shows
+    # which protocol it speaks by what its filters ask for, so nothing has to be kept
+    # in step with it by hand.
+    internal_data.filter_call_info = generate_filter_structure(
+        names, glob.get("__firegex_proto"), glob
+    )
+
+    for name, (attribute, kind) in _SETTINGS.items():
+        if name not in glob:
+            continue
+        value = glob[name]
+        if kind is int:
+            # A size is taken from anything that reads as one, and anything else is
+            # ignored — which is what the other two settings already did, and what this
+            # one only claimed to do: `int(value)` raises for a typo, so a file setting
+            # `FGEX_STREAM_MAX_SIZE = "1MB"` did not get the default, it failed to load
+            # altogether. The operator lost every filter in that file over an optional
+            # knob, and the message named neither the setting nor the file.
+            try:
+                value = int(value)
+            except (TypeError, ValueError):
+                continue
+            if value <= 0:
+                continue
+        elif not isinstance(value, kind):
+            continue
+        setattr(internal_data, attribute, value)
+
+    PacketHandlerResult(glob).reset_result()
+
+    def fake_exit(*_a, **_k):
+        print("WARNING: This function should not be called", flush=True)
+
+    glob["exit"] = fake_exit