| Current File : /home/mmdealscpanel/yummmdeals.com/firewall.tar |
__init__.py 0000644 00000000000 15035135171 0006644 0 ustar 00 client.py 0000644 00000410670 15035135171 0006405 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2009-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from gi.repository import GLib, GObject
# force use of pygobject3 in python-slip
import sys
sys.modules['gobject'] = GObject
import dbus.mainloop.glib
import slip.dbus
from decorator import decorator
from firewall import config
from firewall.core.base import DEFAULT_ZONE_TARGET, DEFAULT_POLICY_TARGET, DEFAULT_POLICY_PRIORITY
from firewall.dbus_utils import dbus_to_python
from firewall.functions import b2u
from firewall.core.rich import Rich_Rule
from firewall.core.ipset import normalize_ipset_entry, check_entry_overlaps_existing, \
check_for_overlapping_entries
from firewall import errors
from firewall.errors import FirewallError
import dbus
import traceback
exception_handler = None
not_authorized_loop = False
@decorator
def handle_exceptions(func, *args, **kwargs):
"""Decorator to handle exceptions
"""
authorized = False
while not authorized:
try:
return func(*args, **kwargs)
except dbus.exceptions.DBusException as e:
dbus_message = e.get_dbus_message() # returns unicode
dbus_name = e.get_dbus_name()
if not exception_handler:
raise
if "NotAuthorizedException" in dbus_name:
exception_handler("NotAuthorizedException")
elif "org.freedesktop.DBus.Error" in dbus_name:
# dbus error, try again
exception_handler(dbus_message)
else:
authorized = True
if dbus_message:
exception_handler(dbus_message)
else:
exception_handler(b2u(str(e)))
except FirewallError as e:
if not exception_handler:
raise
else:
exception_handler(b2u(str(e)))
except Exception:
if not exception_handler:
raise
else:
exception_handler(b2u(traceback.format_exc()))
if not not_authorized_loop:
break
# zone config setings
class FirewallClientZoneSettings(object):
@handle_exceptions
def __init__(self, settings = None):
self.settings = ["", "", "", False, DEFAULT_ZONE_TARGET, [], [],
[], False, [], [], [], [], [], [], False, False]
self.settings_name = ["version", "short", "description", "UNUSED",
"target", "services", "ports",
"icmp_blocks", "masquerade", "forward_ports",
"interfaces", "sources", "rules_str",
"protocols", "source_ports", "icmp_block_inversion",
"forward"]
self.settings_dbus_type = ["s", "s", "s", "b",
"s", "s", "(ss)",
"s", "b", "(ssss)",
"s", "s", "s",
"s", "(ss)", "b",
"b"]
if settings:
if isinstance(settings, list):
for i,v in enumerate(settings):
self.settings[i] = settings[i]
if isinstance(settings, dict):
self.setSettingsDict(settings)
@handle_exceptions
def __repr__(self):
return '%s(%r)' % (self.__class__, self.settings)
@handle_exceptions
def getSettingsDict(self):
settings = {}
for key,value in zip(self.settings_name, self.settings):
if key == 'UNUSED':
continue
settings[key] = value
return settings
@handle_exceptions
def setSettingsDict(self, settings):
for key in settings:
self.settings[self.settings_name.index(key)] = settings[key]
@handle_exceptions
def getSettingsDbusDict(self):
settings = {}
for key,value,sig in zip(self.settings_name, self.settings, self.settings_dbus_type):
if key == 'UNUSED':
continue
if type(value) is list:
settings[key] = dbus.Array(value, signature=sig)
elif type(value) is dict:
settings[key] = dbus.Dictionary(value, signature=sig)
else:
settings[key] = value
return settings
@handle_exceptions
def getRuntimeSettingsDict(self):
settings = self.getSettingsDict()
# These are not configurable at runtime:
del settings['version']
del settings['short']
del settings['description']
del settings['target']
return settings
@handle_exceptions
def getRuntimeSettingsDbusDict(self):
settings = self.getSettingsDbusDict()
# These are not configurable at runtime:
del settings['version']
del settings['short']
del settings['description']
del settings['target']
return settings
@handle_exceptions
def getVersion(self):
return self.settings[0]
@handle_exceptions
def setVersion(self, version):
self.settings[0] = version
@handle_exceptions
def getShort(self):
return self.settings[1]
@handle_exceptions
def setShort(self, short):
self.settings[1] = short
@handle_exceptions
def getDescription(self):
return self.settings[2]
@handle_exceptions
def setDescription(self, description):
self.settings[2] = description
# self.settings[3] was used for 'immutable'
@handle_exceptions
def getTarget(self):
return self.settings[4] if self.settings[4] != DEFAULT_ZONE_TARGET else "default"
@handle_exceptions
def setTarget(self, target):
self.settings[4] = target if target != "default" else DEFAULT_ZONE_TARGET
@handle_exceptions
def getServices(self):
return self.settings[5]
@handle_exceptions
def setServices(self, services):
self.settings[5] = services
@handle_exceptions
def addService(self, service):
if service not in self.settings[5]:
self.settings[5].append(service)
else:
raise FirewallError(errors.ALREADY_ENABLED, service)
@handle_exceptions
def removeService(self, service):
if service in self.settings[5]:
self.settings[5].remove(service)
else:
raise FirewallError(errors.NOT_ENABLED, service)
@handle_exceptions
def queryService(self, service):
return service in self.settings[5]
@handle_exceptions
def getPorts(self):
return self.settings[6]
@handle_exceptions
def setPorts(self, ports):
self.settings[6] = ports
@handle_exceptions
def addPort(self, port, protocol):
if (port,protocol) not in self.settings[6]:
self.settings[6].append((port,protocol))
else:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def removePort(self, port, protocol):
if (port,protocol) in self.settings[6]:
self.settings[6].remove((port,protocol))
else:
raise FirewallError(errors.NOT_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def queryPort(self, port, protocol):
return (port,protocol) in self.settings[6]
@handle_exceptions
def getProtocols(self):
return self.settings[13]
@handle_exceptions
def setProtocols(self, protocols):
self.settings[13] = protocols
@handle_exceptions
def addProtocol(self, protocol):
if protocol not in self.settings[13]:
self.settings[13].append(protocol)
else:
raise FirewallError(errors.ALREADY_ENABLED, protocol)
@handle_exceptions
def removeProtocol(self, protocol):
if protocol in self.settings[13]:
self.settings[13].remove(protocol)
else:
raise FirewallError(errors.NOT_ENABLED, protocol)
@handle_exceptions
def queryProtocol(self, protocol):
return protocol in self.settings[13]
@handle_exceptions
def getSourcePorts(self):
return self.settings[14]
@handle_exceptions
def setSourcePorts(self, ports):
self.settings[14] = ports
@handle_exceptions
def addSourcePort(self, port, protocol):
if (port,protocol) not in self.settings[14]:
self.settings[14].append((port,protocol))
else:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def removeSourcePort(self, port, protocol):
if (port,protocol) in self.settings[14]:
self.settings[14].remove((port,protocol))
else:
raise FirewallError(errors.NOT_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def querySourcePort(self, port, protocol):
return (port,protocol) in self.settings[14]
@handle_exceptions
def getIcmpBlocks(self):
return self.settings[7]
@handle_exceptions
def setIcmpBlocks(self, icmpblocks):
self.settings[7] = icmpblocks
@handle_exceptions
def addIcmpBlock(self, icmptype):
if icmptype not in self.settings[7]:
self.settings[7].append(icmptype)
else:
raise FirewallError(errors.ALREADY_ENABLED, icmptype)
@handle_exceptions
def removeIcmpBlock(self, icmptype):
if icmptype in self.settings[7]:
self.settings[7].remove(icmptype)
else:
raise FirewallError(errors.NOT_ENABLED, icmptype)
@handle_exceptions
def queryIcmpBlock(self, icmptype):
return icmptype in self.settings[7]
@handle_exceptions
def getIcmpBlockInversion(self):
return self.settings[15]
@handle_exceptions
def setIcmpBlockInversion(self, flag):
self.settings[15] = flag
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addIcmpBlockInversion(self):
if not self.settings[15]:
self.settings[15] = True
else:
FirewallError(errors.ALREADY_ENABLED, "icmp-block-inversion")
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeIcmpBlockInversion(self):
if self.settings[15]:
self.settings[15] = False
else:
FirewallError(errors.NOT_ENABLED, "icmp-block-inversion")
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryIcmpBlockInversion(self):
return self.settings[15]
@handle_exceptions
def getForward(self):
return self.settings[16]
@handle_exceptions
def setForward(self, forward):
self.settings[16] = forward
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addForward(self):
if not self.settings[16]:
self.settings[16] = True
else:
FirewallError(errors.ALREADY_ENABLED, "forward")
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeForward(self):
if self.settings[16]:
self.settings[16] = False
else:
FirewallError(errors.NOT_ENABLED, "forward")
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryForward(self):
return self.settings[16]
@handle_exceptions
def getMasquerade(self):
return self.settings[8]
@handle_exceptions
def setMasquerade(self, masquerade):
self.settings[8] = masquerade
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addMasquerade(self):
if not self.settings[8]:
self.settings[8] = True
else:
FirewallError(errors.ALREADY_ENABLED, "masquerade")
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeMasquerade(self):
if self.settings[8]:
self.settings[8] = False
else:
FirewallError(errors.NOT_ENABLED, "masquerade")
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryMasquerade(self):
return self.settings[8]
@handle_exceptions
def getForwardPorts(self):
return self.settings[9]
@handle_exceptions
def setForwardPorts(self, ports):
self.settings[9] = ports
@handle_exceptions
def addForwardPort(self, port, protocol, to_port, to_addr):
if to_port is None:
to_port = ''
if to_addr is None:
to_addr = ''
if (port,protocol,to_port,to_addr) not in self.settings[9]:
self.settings[9].append((port,protocol,to_port,to_addr))
else:
raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s:%s:%s'" % \
(port, protocol, to_port, to_addr))
@handle_exceptions
def removeForwardPort(self, port, protocol, to_port, to_addr):
if to_port is None:
to_port = ''
if to_addr is None:
to_addr = ''
if (port,protocol,to_port,to_addr) in self.settings[9]:
self.settings[9].remove((port,protocol,to_port,to_addr))
else:
raise FirewallError(errors.NOT_ENABLED, "'%s:%s:%s:%s'" % \
(port, protocol, to_port, to_addr))
@handle_exceptions
def queryForwardPort(self, port, protocol, to_port, to_addr):
if to_port is None:
to_port = ''
if to_addr is None:
to_addr = ''
return (port,protocol,to_port,to_addr) in self.settings[9]
@handle_exceptions
def getInterfaces(self):
return self.settings[10]
@handle_exceptions
def setInterfaces(self, interfaces):
self.settings[10] = interfaces
@handle_exceptions
def addInterface(self, interface):
if interface not in self.settings[10]:
self.settings[10].append(interface)
else:
raise FirewallError(errors.ALREADY_ENABLED, interface)
@handle_exceptions
def removeInterface(self, interface):
if interface in self.settings[10]:
self.settings[10].remove(interface)
else:
raise FirewallError(errors.NOT_ENABLED, interface)
@handle_exceptions
def queryInterface(self, interface):
return interface in self.settings[10]
@handle_exceptions
def getSources(self):
return self.settings[11]
@handle_exceptions
def setSources(self, sources):
self.settings[11] = sources
@handle_exceptions
def addSource(self, source):
if source not in self.settings[11]:
self.settings[11].append(source)
else:
raise FirewallError(errors.ALREADY_ENABLED, source)
@handle_exceptions
def removeSource(self, source):
if source in self.settings[11]:
self.settings[11].remove(source)
else:
raise FirewallError(errors.NOT_ENABLED, source)
@handle_exceptions
def querySource(self, source):
return source in self.settings[11]
@handle_exceptions
def getRichRules(self):
return self.settings[12]
@handle_exceptions
def setRichRules(self, rules):
rules = [ str(Rich_Rule(rule_str=r)) for r in rules ]
self.settings[12] = rules
@handle_exceptions
def addRichRule(self, rule):
rule = str(Rich_Rule(rule_str=rule))
if rule not in self.settings[12]:
self.settings[12].append(rule)
else:
raise FirewallError(errors.ALREADY_ENABLED, rule)
@handle_exceptions
def removeRichRule(self, rule):
rule = str(Rich_Rule(rule_str=rule))
if rule in self.settings[12]:
self.settings[12].remove(rule)
else:
raise FirewallError(errors.NOT_ENABLED, rule)
@handle_exceptions
def queryRichRule(self, rule):
rule = str(Rich_Rule(rule_str=rule))
return rule in self.settings[12]
# zone config
class FirewallClientConfigZone(object):
def __init__(self, bus, path):
self.bus = bus
self.path = path
self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path)
self.fw_zone = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_ZONE)
self.fw_properties = dbus.Interface(
self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties')
#TODO: check interface version and revision (need to match client
# version)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_property(self, prop):
return dbus_to_python(self.fw_properties.Get(
config.dbus.DBUS_INTERFACE_CONFIG_ZONE, prop))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_properties(self):
return dbus_to_python(self.fw_properties.GetAll(
config.dbus.DBUS_INTERFACE_CONFIG_ZONE))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def set_property(self, prop, value):
self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
prop, value)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSettings(self):
return FirewallClientZoneSettings(dbus_to_python(self.fw_zone.getSettings2()))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def update(self, settings):
self.fw_zone.update2(settings.getSettingsDbusDict())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def loadDefaults(self):
self.fw_zone.loadDefaults()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def remove(self):
self.fw_zone.remove()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def rename(self, name):
self.fw_zone.rename(name)
# version
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getVersion(self):
return self.fw_zone.getVersion()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setVersion(self, version):
self.fw_zone.setVersion(version)
# short
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getShort(self):
return self.fw_zone.getShort()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setShort(self, short):
self.fw_zone.setShort(short)
# description
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getDescription(self):
return self.fw_zone.getDescription()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setDescription(self, description):
self.fw_zone.setDescription(description)
# target
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getTarget(self):
return self.fw_zone.getTarget()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setTarget(self, target):
self.fw_zone.setTarget(target)
# service
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getServices(self):
return self.fw_zone.getServices()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setServices(self, services):
self.fw_zone.setServices(services)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addService(self, service):
self.fw_zone.addService(service)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeService(self, service):
self.fw_zone.removeService(service)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryService(self, service):
return self.fw_zone.queryService(service)
# port
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getPorts(self):
return self.fw_zone.getPorts()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setPorts(self, ports):
self.fw_zone.setPorts(ports)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addPort(self, port, protocol):
self.fw_zone.addPort(port, protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removePort(self, port, protocol):
self.fw_zone.removePort(port, protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryPort(self, port, protocol):
return self.fw_zone.queryPort(port, protocol)
# protocol
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getProtocols(self):
return self.fw_zone.getProtocols()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setProtocols(self, protocols):
self.fw_zone.setProtocols(protocols)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addProtocol(self, protocol):
self.fw_zone.addProtocol(protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeProtocol(self, protocol):
self.fw_zone.removeProtocol(protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryProtocol(self, protocol):
return self.fw_zone.queryProtocol(protocol)
# source-port
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSourcePorts(self):
return self.fw_zone.getSourcePorts()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setSourcePorts(self, ports):
self.fw_zone.setSourcePorts(ports)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addSourcePort(self, port, protocol):
self.fw_zone.addSourcePort(port, protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeSourcePort(self, port, protocol):
self.fw_zone.removeSourcePort(port, protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def querySourcePort(self, port, protocol):
return self.fw_zone.querySourcePort(port, protocol)
# icmp block
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIcmpBlocks(self):
return self.fw_zone.getIcmpBlocks()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setIcmpBlocks(self, icmptypes):
self.fw_zone.setIcmpBlocks(icmptypes)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addIcmpBlock(self, icmptype):
self.fw_zone.addIcmpBlock(icmptype)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeIcmpBlock(self, icmptype):
self.fw_zone.removeIcmpBlock(icmptype)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryIcmpBlock(self, icmptype):
return self.fw_zone.queryIcmpBlock(icmptype)
# icmp-block-inversion
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIcmpBlockInversion(self):
return self.fw_zone.getIcmpBlockInversion()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setIcmpBlockInversion(self, inversion):
self.fw_zone.setIcmpBlockInversion(inversion)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addIcmpBlockInversion(self):
self.fw_zone.addIcmpBlockInversion()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeIcmpBlockInversion(self):
self.fw_zone.removeIcmpBlockInversion()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryIcmpBlockInversion(self):
return self.fw_zone.queryIcmpBlockInversion()
# forward
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getForward(self):
return self.fw_zone.getSettings2()["forward"]
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setForward(self, forward):
self.fw_zone.update2({"forward": forward})
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addForward(self):
self.fw_zone.update2({"forward": True})
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeForward(self):
self.fw_zone.update2({"forward": False})
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryForward(self):
return self.fw_zone.getSettings2()["forward"]
# masquerade
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getMasquerade(self):
return self.fw_zone.getMasquerade()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setMasquerade(self, masquerade):
self.fw_zone.setMasquerade(masquerade)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addMasquerade(self):
self.fw_zone.addMasquerade()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeMasquerade(self):
self.fw_zone.removeMasquerade()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryMasquerade(self):
return self.fw_zone.queryMasquerade()
# forward port
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getForwardPorts(self):
return self.fw_zone.getForwardPorts()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setForwardPorts(self, ports):
self.fw_zone.setForwardPorts(ports)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addForwardPort(self, port, protocol, toport, toaddr):
if toport is None:
toport = ''
if toaddr is None:
toaddr = ''
self.fw_zone.addForwardPort(port, protocol, toport, toaddr)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeForwardPort(self, port, protocol, toport, toaddr):
if toport is None:
toport = ''
if toaddr is None:
toaddr = ''
self.fw_zone.removeForwardPort(port, protocol, toport, toaddr)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryForwardPort(self, port, protocol, toport, toaddr):
if toport is None:
toport = ''
if toaddr is None:
toaddr = ''
return self.fw_zone.queryForwardPort(port, protocol, toport, toaddr)
# interface
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getInterfaces(self):
return self.fw_zone.getInterfaces()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setInterfaces(self, interfaces):
self.fw_zone.setInterfaces(interfaces)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addInterface(self, interface):
self.fw_zone.addInterface(interface)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeInterface(self, interface):
self.fw_zone.removeInterface(interface)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryInterface(self, interface):
return self.fw_zone.queryInterface(interface)
# source
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSources(self):
return self.fw_zone.getSources()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setSources(self, sources):
self.fw_zone.setSources(sources)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addSource(self, source):
self.fw_zone.addSource(source)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeSource(self, source):
self.fw_zone.removeSource(source)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def querySource(self, source):
return self.fw_zone.querySource(source)
# rich rule
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getRichRules(self):
return self.fw_zone.getRichRules()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setRichRules(self, rules):
self.fw_zone.setRichRules(rules)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addRichRule(self, rule):
self.fw_zone.addRichRule(rule)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeRichRule(self, rule):
self.fw_zone.removeRichRule(rule)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryRichRule(self, rule):
return self.fw_zone.queryRichRule(rule)
class FirewallClientPolicySettings(object):
@handle_exceptions
def __init__(self, settings=None):
self.settings = {"description": "",
"egress_zones": [],
"forward_ports": [],
"icmp_blocks": [],
"ingress_zones": [],
"masquerade": False,
"ports": [],
"priority": DEFAULT_POLICY_PRIORITY,
"protocols": [],
"rich_rules": [],
"services": [],
"short": "",
"source_ports": [],
"target": DEFAULT_POLICY_TARGET,
"version": "",
}
self.settings_dbus_type = ["s", "s", "(ssss)", "s",
"s", "b", "(ss)",
"i", "s", "s",
"s", "s", "(ss)",
"s", "s"]
if settings:
self.setSettingsDict(settings)
@handle_exceptions
def __repr__(self):
return '%s(%r)' % (self.__class__, self.settings)
@handle_exceptions
def getSettingsDict(self):
return self.settings
@handle_exceptions
def setSettingsDict(self, settings):
for key in settings:
self.settings[key] = settings[key]
@handle_exceptions
def getSettingsDbusDict(self):
settings = {}
for key,sig in zip(self.settings, self.settings_dbus_type):
value = self.settings[key]
if type(value) is list:
settings[key] = dbus.Array(value, signature=sig)
elif type(value) is dict:
settings[key] = dbus.Dictionary(value, signature=sig)
else:
settings[key] = value
return settings
def getRuntimeSettingsDbusDict(self):
settings = self.getSettingsDbusDict()
for key in ["version", "short", "description", "target"]:
del settings[key]
return settings
@handle_exceptions
def getVersion(self):
return self.settings["version"]
@handle_exceptions
def setVersion(self, version):
self.settings["version"] = version
@handle_exceptions
def getShort(self):
return self.settings["short"]
@handle_exceptions
def setShort(self, short):
self.settings["short"] = short
@handle_exceptions
def getDescription(self):
return self.settings["description"]
@handle_exceptions
def setDescription(self, description):
self.settings["description"] = description
@handle_exceptions
def getTarget(self):
return self.settings["target"]
@handle_exceptions
def setTarget(self, target):
self.settings["target"] = target
@handle_exceptions
def getServices(self):
return self.settings["services"]
@handle_exceptions
def setServices(self, services):
self.settings["services"] = services
@handle_exceptions
def addService(self, service):
if service not in self.settings["services"]:
self.settings["services"].append(service)
else:
raise FirewallError(errors.ALREADY_ENABLED, service)
@handle_exceptions
def removeService(self, service):
if service in self.settings["services"]:
self.settings["services"].remove(service)
else:
raise FirewallError(errors.NOT_ENABLED, service)
@handle_exceptions
def queryService(self, service):
return service in self.settings["services"]
@handle_exceptions
def getPorts(self):
return self.settings["ports"]
@handle_exceptions
def setPorts(self, ports):
self.settings["ports"] = ports
@handle_exceptions
def addPort(self, port, protocol):
if (port,protocol) not in self.settings["ports"]:
self.settings["ports"].append((port,protocol))
else:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def removePort(self, port, protocol):
if (port,protocol) in self.settings["ports"]:
self.settings["ports"].remove((port,protocol))
else:
raise FirewallError(errors.NOT_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def queryPort(self, port, protocol):
return (port,protocol) in self.settings["ports"]
@handle_exceptions
def getProtocols(self):
return self.settings["protocols"]
@handle_exceptions
def setProtocols(self, protocols):
self.settings["protocols"] = protocols
@handle_exceptions
def addProtocol(self, protocol):
if protocol not in self.settings["protocols"]:
self.settings["protocols"].append(protocol)
else:
raise FirewallError(errors.ALREADY_ENABLED, protocol)
@handle_exceptions
def removeProtocol(self, protocol):
if protocol in self.settings["protocols"]:
self.settings["protocols"].remove(protocol)
else:
raise FirewallError(errors.NOT_ENABLED, protocol)
@handle_exceptions
def queryProtocol(self, protocol):
return protocol in self.settings["protocols"]
@handle_exceptions
def getSourcePorts(self):
return self.settings["source_ports"]
@handle_exceptions
def setSourcePorts(self, ports):
self.settings["source_ports"] = ports
@handle_exceptions
def addSourcePort(self, port, protocol):
if (port,protocol) not in self.settings["source_ports"]:
self.settings["source_ports"].append((port,protocol))
else:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def removeSourcePort(self, port, protocol):
if (port,protocol) in self.settings["source_ports"]:
self.settings["source_ports"].remove((port,protocol))
else:
raise FirewallError(errors.NOT_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def querySourcePort(self, port, protocol):
return (port,protocol) in self.settings["source_ports"]
@handle_exceptions
def getIcmpBlocks(self):
return self.settings["icmp_blocks"]
@handle_exceptions
def setIcmpBlocks(self, icmpblocks):
self.settings["icmp_blocks"] = icmpblocks
@handle_exceptions
def addIcmpBlock(self, icmptype):
if icmptype not in self.settings["icmp_blocks"]:
self.settings["icmp_blocks"].append(icmptype)
else:
raise FirewallError(errors.ALREADY_ENABLED, icmptype)
@handle_exceptions
def removeIcmpBlock(self, icmptype):
if icmptype in self.settings["icmp_blocks"]:
self.settings["icmp_blocks"].remove(icmptype)
else:
raise FirewallError(errors.NOT_ENABLED, icmptype)
@handle_exceptions
def queryIcmpBlock(self, icmptype):
return icmptype in self.settings["icmp_blocks"]
@handle_exceptions
def getMasquerade(self):
return self.settings["masquerade"]
@handle_exceptions
def setMasquerade(self, masquerade):
self.settings["masquerade"] = masquerade
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addMasquerade(self):
if not self.settings["masquerade"]:
self.settings["masquerade"] = True
else:
FirewallError(errors.ALREADY_ENABLED, "masquerade")
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeMasquerade(self):
if self.settings["masquerade"]:
self.settings["masquerade"] = False
else:
FirewallError(errors.NOT_ENABLED, "masquerade")
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryMasquerade(self):
return self.settings["masquerade"]
@handle_exceptions
def getForwardPorts(self):
return self.settings["forward_ports"]
@handle_exceptions
def setForwardPorts(self, ports):
self.settings["forward_ports"] = ports
@handle_exceptions
def addForwardPort(self, port, protocol, to_port, to_addr):
if to_port is None:
to_port = ''
if to_addr is None:
to_addr = ''
if (port,protocol,to_port,to_addr) not in self.settings["forward_ports"]:
self.settings["forward_ports"].append((port,protocol,to_port,to_addr))
else:
raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s:%s:%s'" % \
(port, protocol, to_port, to_addr))
@handle_exceptions
def removeForwardPort(self, port, protocol, to_port, to_addr):
if to_port is None:
to_port = ''
if to_addr is None:
to_addr = ''
if (port,protocol,to_port,to_addr) in self.settings["forward_ports"]:
self.settings["forward_ports"].remove((port,protocol,to_port,to_addr))
else:
raise FirewallError(errors.NOT_ENABLED, "'%s:%s:%s:%s'" % \
(port, protocol, to_port, to_addr))
@handle_exceptions
def queryForwardPort(self, port, protocol, to_port, to_addr):
if to_port is None:
to_port = ''
if to_addr is None:
to_addr = ''
return (port,protocol,to_port,to_addr) in self.settings["forward_ports"]
@handle_exceptions
def getRichRules(self):
return self.settings["rich_rules"]
@handle_exceptions
def setRichRules(self, rules):
rules = [ str(Rich_Rule(rule_str=r)) for r in rules ]
self.settings["rich_rules"] = rules
@handle_exceptions
def addRichRule(self, rule):
rule = str(Rich_Rule(rule_str=rule))
if rule not in self.settings["rich_rules"]:
self.settings["rich_rules"].append(rule)
else:
raise FirewallError(errors.ALREADY_ENABLED, rule)
@handle_exceptions
def removeRichRule(self, rule):
rule = str(Rich_Rule(rule_str=rule))
if rule in self.settings["rich_rules"]:
self.settings["rich_rules"].remove(rule)
else:
raise FirewallError(errors.NOT_ENABLED, rule)
@handle_exceptions
def queryRichRule(self, rule):
rule = str(Rich_Rule(rule_str=rule))
return rule in self.settings["rich_rules"]
@handle_exceptions
def getIngressZones(self):
return self.settings["ingress_zones"]
@handle_exceptions
def setIngressZones(self, ingress_zones):
self.settings["ingress_zones"] = ingress_zones
@handle_exceptions
def addIngressZone(self, ingress_zone):
if ingress_zone not in self.settings["ingress_zones"]:
self.settings["ingress_zones"].append(ingress_zone)
else:
raise FirewallError(errors.ALREADY_ENABLED, ingress_zone)
@handle_exceptions
def removeIngressZone(self, ingress_zone):
if ingress_zone in self.settings["ingress_zones"]:
self.settings["ingress_zones"].remove(ingress_zone)
else:
raise FirewallError(errors.NOT_ENABLED, ingress_zone)
@handle_exceptions
def queryIngressZone(self, ingress_zone):
return ingress_zone in self.settings["ingress_zones"]
@handle_exceptions
def getEgressZones(self):
return self.settings["egress_zones"]
@handle_exceptions
def setEgressZones(self, egress_zones):
self.settings["egress_zones"] = egress_zones
@handle_exceptions
def addEgressZone(self, egress_zone):
if egress_zone not in self.settings["egress_zones"]:
self.settings["egress_zones"].append(egress_zone)
else:
raise FirewallError(errors.ALREADY_ENABLED, egress_zone)
@handle_exceptions
def removeEgressZone(self, egress_zone):
if egress_zone in self.settings["egress_zones"]:
self.settings["egress_zones"].remove(egress_zone)
else:
raise FirewallError(errors.NOT_ENABLED, egress_zone)
@handle_exceptions
def queryEgressZone(self, egress_zone):
return egress_zone in self.settings["egress_zones"]
@handle_exceptions
def getPriority(self):
return self.settings["priority"]
@handle_exceptions
def setPriority(self, priority):
self.settings["priority"] = int(priority)
class FirewallClientConfigPolicy(object):
def __init__(self, bus, path):
self.bus = bus
self.path = path
self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path)
self.fw_policy = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_POLICY)
self.fw_properties = dbus.Interface(
self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties')
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_property(self, prop):
return dbus_to_python(self.fw_properties.Get(
config.dbus.DBUS_INTERFACE_CONFIG_POLICY, prop))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_properties(self):
return dbus_to_python(self.fw_properties.GetAll(
config.dbus.DBUS_INTERFACE_CONFIG_POLICY))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def set_property(self, prop, value):
self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_POLICY,
prop, value)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSettings(self):
return FirewallClientPolicySettings(dbus_to_python(self.fw_policy.getSettings()))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def update(self, settings):
self.fw_policy.update(settings.getSettingsDbusDict())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def loadDefaults(self):
self.fw_policy.loadDefaults()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def remove(self):
self.fw_policy.remove()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def rename(self, name):
self.fw_policy.rename(name)
# service config settings
class FirewallClientServiceSettings(object):
@handle_exceptions
def __init__(self, settings=None):
self.settings = ["", "", "", [], [], {}, [], [], [], []]
self.settings_name = ["version", "short", "description", "ports",
"modules", "destination", "protocols",
"source_ports", "includes", "helpers"]
self.settings_dbus_type = ["s", "s", "s", "(ss)",
"s", "ss", "s",
"(ss)", "s", "s"]
if settings:
if type(settings) is list:
for i,v in enumerate(settings):
self.settings[i] = settings[i]
elif type(settings) is dict:
self.setSettingsDict(settings)
@handle_exceptions
def __repr__(self):
return '%s(%r)' % (self.__class__, self.settings)
@handle_exceptions
def getSettingsDict(self):
settings = {}
for key,value in zip(self.settings_name, self.settings):
settings[key] = value
return settings
@handle_exceptions
def setSettingsDict(self, settings):
for key in settings:
self.settings[self.settings_name.index(key)] = settings[key]
@handle_exceptions
def getSettingsDbusDict(self):
settings = {}
for key,value,sig in zip(self.settings_name, self.settings, self.settings_dbus_type):
if type(value) is list:
settings[key] = dbus.Array(value, signature=sig)
elif type(value) is dict:
settings[key] = dbus.Dictionary(value, signature=sig)
else:
settings[key] = value
return settings
@handle_exceptions
def getVersion(self):
return self.settings[0]
@handle_exceptions
def setVersion(self, version):
self.settings[0] = version
@handle_exceptions
def getShort(self):
return self.settings[1]
@handle_exceptions
def setShort(self, short):
self.settings[1] = short
@handle_exceptions
def getDescription(self):
return self.settings[2]
@handle_exceptions
def setDescription(self, description):
self.settings[2] = description
@handle_exceptions
def getPorts(self):
return self.settings[3]
@handle_exceptions
def setPorts(self, ports):
self.settings[3] = ports
@handle_exceptions
def addPort(self, port, protocol):
if (port,protocol) not in self.settings[3]:
self.settings[3].append((port,protocol))
else:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def removePort(self, port, protocol):
if (port,protocol) in self.settings[3]:
self.settings[3].remove((port,protocol))
else:
raise FirewallError(errors.NOT_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def queryPort(self, port, protocol):
return (port,protocol) in self.settings[3]
@handle_exceptions
def getProtocols(self):
return self.settings[6]
@handle_exceptions
def setProtocols(self, protocols):
self.settings[6] = protocols
@handle_exceptions
def addProtocol(self, protocol):
if protocol not in self.settings[6]:
self.settings[6].append(protocol)
else:
raise FirewallError(errors.ALREADY_ENABLED, protocol)
@handle_exceptions
def removeProtocol(self, protocol):
if protocol in self.settings[6]:
self.settings[6].remove(protocol)
else:
raise FirewallError(errors.NOT_ENABLED, protocol)
@handle_exceptions
def queryProtocol(self, protocol):
return protocol in self.settings[6]
@handle_exceptions
def getSourcePorts(self):
return self.settings[7]
@handle_exceptions
def setSourcePorts(self, ports):
self.settings[7] = ports
@handle_exceptions
def addSourcePort(self, port, protocol):
if (port,protocol) not in self.settings[7]:
self.settings[7].append((port,protocol))
else:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def removeSourcePort(self, port, protocol):
if (port,protocol) in self.settings[7]:
self.settings[7].remove((port,protocol))
else:
raise FirewallError(errors.NOT_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def querySourcePort(self, port, protocol):
return (port,protocol) in self.settings[7]
@handle_exceptions
def getModules(self):
return self.settings[4]
@handle_exceptions
def setModules(self, modules):
self.settings[4] = modules
@handle_exceptions
def addModule(self, module):
if module not in self.settings[4]:
self.settings[4].append(module)
else:
raise FirewallError(errors.ALREADY_ENABLED, module)
@handle_exceptions
def removeModule(self, module):
if module in self.settings[4]:
self.settings[4].remove(module)
else:
raise FirewallError(errors.NOT_ENABLED, module)
@handle_exceptions
def queryModule(self, module):
return module in self.settings[4]
@handle_exceptions
def getDestinations(self):
return self.settings[5]
@handle_exceptions
def setDestinations(self, destinations):
self.settings[5] = destinations
@handle_exceptions
def setDestination(self, dest_type, address):
if dest_type not in self.settings[5] or \
self.settings[5][dest_type] != address:
self.settings[5][dest_type] = address
else:
raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % \
(dest_type, address))
@handle_exceptions
def removeDestination(self, dest_type, address=None):
if dest_type in self.settings[5]:
if address is not None and self.settings[5][dest_type] != address:
raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % \
(dest_type, address))
del self.settings[5][dest_type]
else:
raise FirewallError(errors.NOT_ENABLED, "'%s'" % dest_type)
@handle_exceptions
def queryDestination(self, dest_type, address):
return (dest_type in self.settings[5] and \
address == self.settings[5][dest_type])
@handle_exceptions
def getIncludes(self):
return self.settings[8]
@handle_exceptions
def setIncludes(self, includes):
self.settings[8] = includes
@handle_exceptions
def addInclude(self, include):
if include not in self.settings[8]:
self.settings[8].append(include)
else:
raise FirewallError(errors.ALREADY_ENABLED, include)
@handle_exceptions
def removeInclude(self, include):
if include in self.settings[8]:
self.settings[8].remove(include)
else:
raise FirewallError(errors.NOT_ENABLED, include)
@handle_exceptions
def queryInclude(self, include):
return include in self.settings[8]
@handle_exceptions
def getHelpers(self):
return self.settings[9]
@handle_exceptions
def setHelpers(self, helpers):
self.settings[9] = helpers
@handle_exceptions
def addHelper(self, helper):
if helper not in self.settings[9]:
self.settings[9].append(helper)
else:
raise FirewallError(errors.ALREADY_ENABLED, helper)
@handle_exceptions
def removeHelper(self, helper):
if helper in self.settings[9]:
self.settings[9].remove(helper)
else:
raise FirewallError(errors.NOT_ENABLED, helper)
@handle_exceptions
def queryHelper(self, helper):
return helper in self.settings[9]
# ipset config settings
class FirewallClientIPSetSettings(object):
@handle_exceptions
def __init__(self, settings=None):
if settings:
self.settings = settings
else:
self.settings = ["", "", "", "", {}, []]
@handle_exceptions
def __repr__(self):
return '%s(%r)' % (self.__class__, self.settings)
@handle_exceptions
def getVersion(self):
return self.settings[0]
@handle_exceptions
def setVersion(self, version):
self.settings[0] = version
@handle_exceptions
def getShort(self):
return self.settings[1]
@handle_exceptions
def setShort(self, short):
self.settings[1] = short
@handle_exceptions
def getDescription(self):
return self.settings[2]
@handle_exceptions
def setDescription(self, description):
self.settings[2] = description
@handle_exceptions
def getType(self):
return self.settings[3]
@handle_exceptions
def setType(self, ipset_type):
self.settings[3] = ipset_type
@handle_exceptions
def getOptions(self):
return self.settings[4]
@handle_exceptions
def setOptions(self, options):
self.settings[4] = options
@handle_exceptions
def addOption(self, key, value):
if key not in self.settings[4] or self.settings[4][key] != value:
self.settings[4][key] = value
else:
raise FirewallError(errors.ALREADY_ENABLED, "'%s=%s'" % (key,value)
if value else key)
@handle_exceptions
def removeOption(self, key):
if key in self.settings[4]:
del self.settings[4][key]
else:
raise FirewallError(errors.NOT_ENABLED, key)
@handle_exceptions
def queryOption(self, key, value):
return key in self.settings[4] and self.settings[4][key] == value
@handle_exceptions
def getEntries(self):
return self.settings[5]
@handle_exceptions
def setEntries(self, entries):
if "timeout" in self.settings[4] and \
self.settings[4]["timeout"] != "0":
raise FirewallError(errors.IPSET_WITH_TIMEOUT)
check_for_overlapping_entries(entries)
self.settings[5] = entries
@handle_exceptions
def addEntry(self, entry):
if "timeout" in self.settings[4] and \
self.settings[4]["timeout"] != "0":
raise FirewallError(errors.IPSET_WITH_TIMEOUT)
entry = normalize_ipset_entry(entry)
if entry not in self.settings[5]:
check_entry_overlaps_existing(entry, self.settings[5])
self.settings[5].append(entry)
else:
raise FirewallError(errors.ALREADY_ENABLED, entry)
@handle_exceptions
def removeEntry(self, entry):
if "timeout" in self.settings[4] and \
self.settings[4]["timeout"] != "0":
raise FirewallError(errors.IPSET_WITH_TIMEOUT)
entry = normalize_ipset_entry(entry)
if entry in self.settings[5]:
self.settings[5].remove(entry)
else:
raise FirewallError(errors.NOT_ENABLED, entry)
@handle_exceptions
def queryEntry(self, entry):
if "timeout" in self.settings[4] and \
self.settings[4]["timeout"] != "0":
raise FirewallError(errors.IPSET_WITH_TIMEOUT)
entry = normalize_ipset_entry(entry)
return entry in self.settings[5]
# ipset config
class FirewallClientConfigIPSet(object):
@handle_exceptions
def __init__(self, bus, path):
self.bus = bus
self.path = path
self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path)
self.fw_ipset = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_IPSET)
self.fw_properties = dbus.Interface(
self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties')
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_property(self, prop):
return dbus_to_python(self.fw_properties.Get(
config.dbus.DBUS_INTERFACE_CONFIG_IPSET, prop))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_properties(self):
return dbus_to_python(self.fw_properties.GetAll(
config.dbus.DBUS_INTERFACE_CONFIG_IPSET))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def set_property(self, prop, value):
self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
prop, value)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSettings(self):
return FirewallClientIPSetSettings(list(dbus_to_python(\
self.fw_ipset.getSettings())))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def update(self, settings):
self.fw_ipset.update(tuple(settings.settings))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def loadDefaults(self):
self.fw_ipset.loadDefaults()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def remove(self):
self.fw_ipset.remove()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def rename(self, name):
self.fw_ipset.rename(name)
# version
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getVersion(self):
return self.fw_ipset.getVersion()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setVersion(self, version):
self.fw_ipset.setVersion(version)
# short
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getShort(self):
return self.fw_ipset.getShort()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setShort(self, short):
self.fw_ipset.setShort(short)
# description
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getDescription(self):
return self.fw_ipset.getDescription()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setDescription(self, description):
self.fw_ipset.setDescription(description)
# entry
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getEntries(self):
return self.fw_ipset.getEntries()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setEntries(self, entries):
self.fw_ipset.setEntries(entries)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addEntry(self, entry):
self.fw_ipset.addEntry(entry)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeEntry(self, entry):
self.fw_ipset.removeEntry(entry)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryEntry(self, entry):
return self.fw_ipset.queryEntry(entry)
# helper config settings
class FirewallClientHelperSettings(object):
@handle_exceptions
def __init__(self, settings=None):
if settings:
self.settings = settings
else:
self.settings = ["", "", "", "", "", [ ]]
@handle_exceptions
def __repr__(self):
return '%s(%r)' % (self.__class__, self.settings)
@handle_exceptions
def getVersion(self):
return self.settings[0]
@handle_exceptions
def setVersion(self, version):
self.settings[0] = version
@handle_exceptions
def getShort(self):
return self.settings[1]
@handle_exceptions
def setShort(self, short):
self.settings[1] = short
@handle_exceptions
def getDescription(self):
return self.settings[2]
@handle_exceptions
def setDescription(self, description):
self.settings[2] = description
@handle_exceptions
def getFamily(self):
return self.settings[3]
@handle_exceptions
def setFamily(self, ipv):
if ipv is None:
self.settings[3] = ""
self.settings[3] = ipv
@handle_exceptions
def getModule(self):
return self.settings[4]
@handle_exceptions
def setModule(self, module):
self.settings[4] = module
@handle_exceptions
def getPorts(self):
return self.settings[5]
@handle_exceptions
def setPorts(self, ports):
self.settings[5] = ports
@handle_exceptions
def addPort(self, port, protocol):
if (port,protocol) not in self.settings[5]:
self.settings[5].append((port,protocol))
else:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def removePort(self, port, protocol):
if (port,protocol) in self.settings[5]:
self.settings[5].remove((port,protocol))
else:
raise FirewallError(errors.NOT_ENABLED,
"'%s:%s'" % (port, protocol))
@handle_exceptions
def queryPort(self, port, protocol):
return (port,protocol) in self.settings[5]
# helper config
class FirewallClientConfigHelper(object):
@handle_exceptions
def __init__(self, bus, path):
self.bus = bus
self.path = path
self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path)
self.fw_helper = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_HELPER)
self.fw_properties = dbus.Interface(
self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties')
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_property(self, prop):
return dbus_to_python(self.fw_properties.Get(
config.dbus.DBUS_INTERFACE_CONFIG_HELPER, prop))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_properties(self):
return dbus_to_python(self.fw_properties.GetAll(
config.dbus.DBUS_INTERFACE_CONFIG_HELPER))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def set_property(self, prop, value):
self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
prop, value)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSettings(self):
return FirewallClientHelperSettings(list(dbus_to_python(\
self.fw_helper.getSettings())))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def update(self, settings):
self.fw_helper.update(tuple(settings.settings))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def loadDefaults(self):
self.fw_helper.loadDefaults()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def remove(self):
self.fw_helper.remove()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def rename(self, name):
self.fw_helper.rename(name)
# version
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getVersion(self):
return self.fw_helper.getVersion()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setVersion(self, version):
self.fw_helper.setVersion(version)
# short
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getShort(self):
return self.fw_helper.getShort()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setShort(self, short):
self.fw_helper.setShort(short)
# description
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getDescription(self):
return self.fw_helper.getDescription()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setDescription(self, description):
self.fw_helper.setDescription(description)
# port
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getPorts(self):
return self.fw_helper.getPorts()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setPorts(self, ports):
self.fw_helper.setPorts(ports)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addPort(self, port, protocol):
self.fw_helper.addPort(port, protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removePort(self, port, protocol):
self.fw_helper.removePort(port, protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryPort(self, port, protocol):
return self.fw_helper.queryPort(port, protocol)
# family
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getFamily(self):
return self.fw_helper.getFamily()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setFamily(self, ipv):
if ipv is None:
self.fw_helper.setFamily("")
self.fw_helper.setFamily(ipv)
# module
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getModule(self):
return self.fw_helper.getModule()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setModule(self, module):
self.fw_helper.setModule(module)
# service config
class FirewallClientConfigService(object):
@handle_exceptions
def __init__(self, bus, path):
self.bus = bus
self.path = path
self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path)
self.fw_service = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_SERVICE)
self.fw_properties = dbus.Interface(
self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties')
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_property(self, prop):
return dbus_to_python(self.fw_properties.Get(
config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, prop))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_properties(self):
return dbus_to_python(self.fw_properties.GetAll(
config.dbus.DBUS_INTERFACE_CONFIG_SERVICE))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def set_property(self, prop, value):
self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
prop, value)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSettings(self):
return FirewallClientServiceSettings(dbus_to_python(
self.fw_service.getSettings2()))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def update(self, settings):
self.fw_service.update2(settings.getSettingsDbusDict())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def loadDefaults(self):
self.fw_service.loadDefaults()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def remove(self):
self.fw_service.remove()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def rename(self, name):
self.fw_service.rename(name)
# version
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getVersion(self):
return self.fw_service.getVersion()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setVersion(self, version):
self.fw_service.setVersion(version)
# short
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getShort(self):
return self.fw_service.getShort()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setShort(self, short):
self.fw_service.setShort(short)
# description
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getDescription(self):
return self.fw_service.getDescription()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setDescription(self, description):
self.fw_service.setDescription(description)
# port
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getPorts(self):
return self.fw_service.getPorts()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setPorts(self, ports):
self.fw_service.setPorts(ports)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addPort(self, port, protocol):
self.fw_service.addPort(port, protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removePort(self, port, protocol):
self.fw_service.removePort(port, protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryPort(self, port, protocol):
return self.fw_service.queryPort(port, protocol)
# protocol
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getProtocols(self):
return self.fw_service.getProtocols()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setProtocols(self, protocols):
self.fw_service.setProtocols(protocols)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addProtocol(self, protocol):
self.fw_service.addProtocol(protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeProtocol(self, protocol):
self.fw_service.removeProtocol(protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryProtocol(self, protocol):
return self.fw_service.queryProtocol(protocol)
# source-port
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSourcePorts(self):
return self.fw_service.getSourcePorts()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setSourcePorts(self, ports):
self.fw_service.setSourcePorts(ports)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addSourcePort(self, port, protocol):
self.fw_service.addSourcePort(port, protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeSourcePort(self, port, protocol):
self.fw_service.removeSourcePort(port, protocol)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def querySourcePort(self, port, protocol):
return self.fw_service.querySourcePort(port, protocol)
# module
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getModules(self):
return self.fw_service.getModules()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setModules(self, modules):
self.fw_service.setModules(modules)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addModule(self, module):
self.fw_service.addModule(module)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeModule(self, module):
self.fw_service.removeModule(module)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryModule(self, module):
return self.fw_service.queryModule(module)
# destination
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getDestinations(self):
return self.fw_service.getDestinations()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setDestinations(self, destinations):
self.fw_service.setDestinations(destinations)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getDestination(self, destination):
return self.fw_service.getDestination(destination)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setDestination(self, destination, address):
self.fw_service.setDestination(destination, address)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeDestination(self, destination, address=None):
if address is not None and self.getDestination(destination) != address:
raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % \
(destination, address))
self.fw_service.removeDestination(destination)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryDestination(self, destination, address):
return self.fw_service.queryDestination(destination, address)
# include
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIncludes(self):
return self.fw_service.getIncludes()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setIncludes(self, includes):
self.fw_service.setIncludes(includes)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addInclude(self, include):
self.fw_service.addInclude(include)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeInclude(self, include):
self.fw_service.removeInclude(include)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryInclude(self, include):
return self.fw_service.queryInclude(include)
# icmptype config settings
class FirewallClientIcmpTypeSettings(object):
@handle_exceptions
def __init__(self, settings=None):
if settings:
self.settings = settings
else:
self.settings = ["", "", "", []]
@handle_exceptions
def __repr__(self):
return '%s(%r)' % (self.__class__, self.settings)
@handle_exceptions
def getVersion(self):
return self.settings[0]
@handle_exceptions
def setVersion(self, version):
self.settings[0] = version
@handle_exceptions
def getShort(self):
return self.settings[1]
@handle_exceptions
def setShort(self, short):
self.settings[1] = short
@handle_exceptions
def getDescription(self):
return self.settings[2]
@handle_exceptions
def setDescription(self, description):
self.settings[2] = description
@handle_exceptions
def getDestinations(self):
return self.settings[3]
@handle_exceptions
def setDestinations(self, destinations):
self.settings[3] = destinations
@handle_exceptions
def addDestination(self, destination):
# empty means all
if not self.settings[3]:
raise FirewallError(errors.ALREADY_ENABLED, destination)
elif destination not in self.settings[3]:
self.settings[3].append(destination)
else:
raise FirewallError(errors.ALREADY_ENABLED, destination)
@handle_exceptions
def removeDestination(self, destination):
if destination in self.settings[3]:
self.settings[3].remove(destination)
# empty means all
elif not self.settings[3]:
self.setDestinations(list(set(['ipv4','ipv6']) - \
set([destination])))
else:
raise FirewallError(errors.NOT_ENABLED, destination)
@handle_exceptions
def queryDestination(self, destination):
# empty means all
return not self.settings[3] or \
destination in self.settings[3]
# icmptype config
class FirewallClientConfigIcmpType(object):
@handle_exceptions
def __init__(self, bus, path):
self.bus = bus
self.path = path
self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path)
self.fw_icmptype = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE)
self.fw_properties = dbus.Interface(
self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties')
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_property(self, prop):
return dbus_to_python(self.fw_properties.Get(
config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, prop))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_properties(self):
return dbus_to_python(self.fw_properties.GetAll(
config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def set_property(self, prop, value):
self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
prop, value)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSettings(self):
return FirewallClientIcmpTypeSettings(list(dbus_to_python(\
self.fw_icmptype.getSettings())))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def update(self, settings):
self.fw_icmptype.update(tuple(settings.settings))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def loadDefaults(self):
self.fw_icmptype.loadDefaults()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def remove(self):
self.fw_icmptype.remove()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def rename(self, name):
self.fw_icmptype.rename(name)
# version
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getVersion(self):
return self.fw_icmptype.getVersion()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setVersion(self, version):
self.fw_icmptype.setVersion(version)
# short
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getShort(self):
return self.fw_icmptype.getShort()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setShort(self, short):
self.fw_icmptype.setShort(short)
# description
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getDescription(self):
return self.fw_icmptype.getDescription()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setDescription(self, description):
self.fw_icmptype.setDescription(description)
# destination
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getDestinations(self):
return self.fw_icmptype.getDestinations()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setDestinations(self, destinations):
self.fw_icmptype.setDestinations(destinations)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addDestination(self, destination):
self.fw_icmptype.addDestination(destination)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeDestination(self, destination):
self.fw_icmptype.removeDestination(destination)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryDestination(self, destination):
return self.fw_icmptype.queryDestination(destination)
# config.policies lockdown whitelist
class FirewallClientPoliciesLockdownWhitelist(object):
@handle_exceptions
def __init__(self, settings=None):
if settings:
self.settings = settings
else:
self.settings = [ [], [], [], [] ]
@handle_exceptions
def __repr__(self):
return '%s(%r)' % (self.__class__, self.settings)
@handle_exceptions
def getCommands(self):
return self.settings[0]
@handle_exceptions
def setCommands(self, commands):
self.settings[0] = commands
@handle_exceptions
def addCommand(self, command):
if command not in self.settings[0]:
self.settings[0].append(command)
@handle_exceptions
def removeCommand(self, command):
if command in self.settings[0]:
self.settings[0].remove(command)
@handle_exceptions
def queryCommand(self, command):
return command in self.settings[0]
@handle_exceptions
def getContexts(self):
return self.settings[1]
@handle_exceptions
def setContexts(self, contexts):
self.settings[1] = contexts
@handle_exceptions
def addContext(self, context):
if context not in self.settings[1]:
self.settings[1].append(context)
@handle_exceptions
def removeContext(self, context):
if context in self.settings[1]:
self.settings[1].remove(context)
@handle_exceptions
def queryContext(self, context):
return context in self.settings[1]
@handle_exceptions
def getUsers(self):
return self.settings[2]
@handle_exceptions
def setUsers(self, users):
self.settings[2] = users
@handle_exceptions
def addUser(self, user):
if user not in self.settings[2]:
self.settings[2].append(user)
@handle_exceptions
def removeUser(self, user):
if user in self.settings[2]:
self.settings[2].remove(user)
@handle_exceptions
def queryUser(self, user):
return user in self.settings[2]
@handle_exceptions
def getUids(self):
return self.settings[3]
@handle_exceptions
def setUids(self, uids):
self.settings[3] = uids
@handle_exceptions
def addUid(self, uid):
if uid not in self.settings[3]:
self.settings[3].append(uid)
@handle_exceptions
def removeUid(self, uid):
if uid in self.settings[3]:
self.settings[3].remove(uid)
@handle_exceptions
def queryUid(self, uid):
return uid in self.settings[3]
# config.policies
class FirewallClientConfigPolicies(object):
@handle_exceptions
def __init__(self, bus):
self.bus = bus
self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE,
config.dbus.DBUS_PATH_CONFIG)
self.fw_policies = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_POLICIES)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getLockdownWhitelist(self):
return FirewallClientPoliciesLockdownWhitelist( \
list(dbus_to_python(self.fw_policies.getLockdownWhitelist())))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setLockdownWhitelist(self, settings):
self.fw_policies.setLockdownWhitelist(tuple(settings.settings))
# command
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addLockdownWhitelistCommand(self, command):
self.fw_policies.addLockdownWhitelistCommand(command)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeLockdownWhitelistCommand(self, command):
self.fw_policies.removeLockdownWhitelistCommand(command)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryLockdownWhitelistCommand(self, command):
return dbus_to_python(self.fw_policies.queryLockdownWhitelistCommand(command))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getLockdownWhitelistCommands(self):
return dbus_to_python(self.fw_policies.getLockdownWhitelistCommands())
# context
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addLockdownWhitelistContext(self, context):
self.fw_policies.addLockdownWhitelistContext(context)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeLockdownWhitelistContext(self, context):
self.fw_policies.removeLockdownWhitelistContext(context)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryLockdownWhitelistContext(self, context):
return dbus_to_python(self.fw_policies.queryLockdownWhitelistContext(context))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getLockdownWhitelistContexts(self):
return dbus_to_python(self.fw_policies.getLockdownWhitelistContexts())
# user
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addLockdownWhitelistUser(self, user):
self.fw_policies.addLockdownWhitelistUser(user)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeLockdownWhitelistUser(self, user):
self.fw_policies.removeLockdownWhitelistUser(user)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryLockdownWhitelistUser(self, user):
return dbus_to_python(self.fw_policies.queryLockdownWhitelistUser(user))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getLockdownWhitelistUsers(self):
return dbus_to_python(self.fw_policies.getLockdownWhitelistUsers())
# uid
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getLockdownWhitelistUids(self):
return dbus_to_python(self.fw_policies.getLockdownWhitelistUids())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setLockdownWhitelistUids(self, uids):
self.fw_policies.setLockdownWhitelistUids(uids)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addLockdownWhitelistUid(self, uid):
self.fw_policies.addLockdownWhitelistUid(uid)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeLockdownWhitelistUid(self, uid):
self.fw_policies.removeLockdownWhitelistUid(uid)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryLockdownWhitelistUid(self, uid):
return dbus_to_python(self.fw_policies.queryLockdownWhitelistUid(uid))
# config.direct
class FirewallClientDirect(object):
@handle_exceptions
def __init__(self, settings=None):
if settings:
self.settings = settings
else:
self.settings = [ [], [], [], ]
@handle_exceptions
def __repr__(self):
return '%s(%r)' % (self.__class__, self.settings)
@handle_exceptions
def getAllChains(self):
return self.settings[0]
@handle_exceptions
def getChains(self, ipv, table):
return [ entry[2] for entry in self.settings[0] \
if entry[0] == ipv and entry[1] == table ]
@handle_exceptions
def setAllChains(self, chains):
self.settings[0] = chains
@handle_exceptions
def addChain(self, ipv, table, chain):
idx = (ipv, table, chain)
if idx not in self.settings[0]:
self.settings[0].append(idx)
@handle_exceptions
def removeChain(self, ipv, table, chain):
idx = (ipv, table, chain)
if idx in self.settings[0]:
self.settings[0].remove(idx)
@handle_exceptions
def queryChain(self, ipv, table, chain):
idx = (ipv, table, chain)
return idx in self.settings[0]
@handle_exceptions
def getAllRules(self):
return self.settings[1]
@handle_exceptions
def getRules(self, ipv, table, chain):
return [ entry[3:] for entry in self.settings[1] \
if entry[0] == ipv and entry[1] == table \
and entry[2] == chain ]
@handle_exceptions
def setAllRules(self, rules):
self.settings[1] = rules
@handle_exceptions
def addRule(self, ipv, table, chain, priority, args):
idx = (ipv, table, chain, priority, args)
if idx not in self.settings[1]:
self.settings[1].append(idx)
@handle_exceptions
def removeRule(self, ipv, table, chain, priority, args):
idx = (ipv, table, chain, priority, args)
if idx in self.settings[1]:
self.settings[1].remove(idx)
@handle_exceptions
def removeRules(self, ipv, table, chain):
for idx in list(self.settings[1]):
if idx[0] == ipv and idx[1] == table and idx[2] == chain:
self.settings[1].remove(idx)
@handle_exceptions
def queryRule(self, ipv, table, chain, priority, args):
idx = (ipv, table, chain, priority, args)
return idx in self.settings[1]
@handle_exceptions
def getAllPassthroughs(self):
return self.settings[2]
@handle_exceptions
def setAllPassthroughs(self, passthroughs):
self.settings[2] = passthroughs
@handle_exceptions
def removeAllPassthroughs(self):
self.settings[2] = []
@handle_exceptions
def getPassthroughs(self, ipv):
return [ entry[1] for entry in self.settings[2] \
if entry[0] == ipv ]
@handle_exceptions
def addPassthrough(self, ipv, args):
idx = (ipv, args)
if idx not in self.settings[2]:
self.settings[2].append(idx)
@handle_exceptions
def removePassthrough(self, ipv, args):
idx = (ipv, args)
if idx in self.settings[2]:
self.settings[2].remove(idx)
@handle_exceptions
def queryPassthrough(self, ipv, args):
idx = (ipv, args)
return idx in self.settings[2]
# config.direct
class FirewallClientConfigDirect(object):
@handle_exceptions
def __init__(self, bus):
self.bus = bus
self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE,
config.dbus.DBUS_PATH_CONFIG)
self.fw_direct = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_DIRECT)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSettings(self):
return FirewallClientDirect( \
list(dbus_to_python(self.fw_direct.getSettings())))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def update(self, settings):
self.fw_direct.update(tuple(settings.settings))
# direct chain
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addChain(self, ipv, table, chain):
self.fw_direct.addChain(ipv, table, chain)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeChain(self, ipv, table, chain):
self.fw_direct.removeChain(ipv, table, chain)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryChain(self, ipv, table, chain):
return dbus_to_python(self.fw_direct.queryChain(ipv, table, chain))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getChains(self, ipv, table):
return dbus_to_python(self.fw_direct.getChains(ipv, table))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getAllChains(self):
return dbus_to_python(self.fw_direct.getAllChains())
# direct rule
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addRule(self, ipv, table, chain, priority, args):
self.fw_direct.addRule(ipv, table, chain, priority, args)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeRule(self, ipv, table, chain, priority, args):
self.fw_direct.removeRule(ipv, table, chain, priority, args)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeRules(self, ipv, table, chain):
self.fw_direct.removeRules(ipv, table, chain)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryRule(self, ipv, table, chain, priority, args):
return dbus_to_python(self.fw_direct.queryRule(ipv, table, chain, priority, args))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getRules(self, ipv, table, chain):
return dbus_to_python(self.fw_direct.getRules(ipv, table, chain))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getAllRules(self):
return dbus_to_python(self.fw_direct.getAllRules())
# tracked passthrough
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addPassthrough(self, ipv, args):
self.fw_direct.addPassthrough(ipv, args)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removePassthrough(self, ipv, args):
self.fw_direct.removePassthrough(ipv, args)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryPassthrough(self, ipv, args):
return dbus_to_python(self.fw_direct.queryPassthrough(ipv, args))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getPassthroughs(self, ipv):
return dbus_to_python(self.fw_direct.getPassthroughs(ipv))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getAllPassthroughs(self):
return dbus_to_python(self.fw_direct.getAllPassthroughs())
# config
class FirewallClientConfig(object):
@handle_exceptions
def __init__(self, bus):
self.bus = bus
self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE,
config.dbus.DBUS_PATH_CONFIG)
self.fw_config = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG)
self.fw_properties = dbus.Interface(
self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties')
self._policies = FirewallClientConfigPolicies(self.bus)
self._direct = FirewallClientConfigDirect(self.bus)
# properties
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_property(self, prop):
return dbus_to_python(self.fw_properties.Get(
config.dbus.DBUS_INTERFACE_CONFIG, prop))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_properties(self):
return dbus_to_python(self.fw_properties.GetAll(
config.dbus.DBUS_INTERFACE_CONFIG))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def set_property(self, prop, value):
self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG, prop, value)
# ipset
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIPSetNames(self):
return dbus_to_python(self.fw_config.getIPSetNames())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def listIPSets(self):
return dbus_to_python(self.fw_config.listIPSets())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIPSet(self, path):
return FirewallClientConfigIPSet(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIPSetByName(self, name):
path = dbus_to_python(self.fw_config.getIPSetByName(name))
return FirewallClientConfigIPSet(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addIPSet(self, name, settings):
if isinstance(settings, FirewallClientIPSetSettings):
path = self.fw_config.addIPSet(name, tuple(settings.settings))
else:
path = self.fw_config.addIPSet(name, tuple(settings))
return FirewallClientConfigIPSet(self.bus, path)
# zone
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getZoneNames(self):
return dbus_to_python(self.fw_config.getZoneNames())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def listZones(self):
return dbus_to_python(self.fw_config.listZones())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getZone(self, path):
return FirewallClientConfigZone(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getZoneByName(self, name):
path = dbus_to_python(self.fw_config.getZoneByName(name))
return FirewallClientConfigZone(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getZoneOfInterface(self, iface):
return dbus_to_python(self.fw_config.getZoneOfInterface(iface))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getZoneOfSource(self, source):
return dbus_to_python(self.fw_config.getZoneOfSource(source))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addZone(self, name, settings):
if isinstance(settings, FirewallClientZoneSettings):
path = self.fw_config.addZone2(name, settings.getSettingsDbusDict())
elif isinstance(settings, dict):
path = self.fw_config.addZone2(name, settings)
else:
# tuple based dbus API has 16 elements. Slice what we're given down
# to the expected size.
path = self.fw_config.addZone(name, tuple(settings[:16]))
return FirewallClientConfigZone(self.bus, path)
# policy
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getPolicyNames(self):
return dbus_to_python(self.fw_config.getPolicyNames())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def listPolicies(self):
return dbus_to_python(self.fw_config.listPolicies())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getPolicy(self, path):
return FirewallClientConfigPolicy(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getPolicyByName(self, name):
path = dbus_to_python(self.fw_config.getPolicyByName(name))
return FirewallClientConfigPolicy(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addPolicy(self, name, settings):
if isinstance(settings, FirewallClientPolicySettings):
path = self.fw_config.addPolicy(name, settings.getSettingsDbusDict())
else: # dict
path = self.fw_config.addPolicy(name, settings)
return FirewallClientConfigPolicy(self.bus, path)
# service
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getServiceNames(self):
return dbus_to_python(self.fw_config.getServiceNames())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def listServices(self):
return dbus_to_python(self.fw_config.listServices())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getService(self, path):
return FirewallClientConfigService(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getServiceByName(self, name):
path = dbus_to_python(self.fw_config.getServiceByName(name))
return FirewallClientConfigService(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addService(self, name, settings):
if isinstance(settings, FirewallClientServiceSettings):
path = self.fw_config.addService2(name, settings.getSettingsDbusDict())
elif type(settings) is dict:
path = self.fw_config.addService2(name, settings)
else:
# tuple based dbus API has 8 elements. Slice what we're given down
# to the expected size.
path = self.fw_config.addService(name, tuple(settings[:8]))
return FirewallClientConfigService(self.bus, path)
# icmptype
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIcmpTypeNames(self):
return dbus_to_python(self.fw_config.getIcmpTypeNames())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def listIcmpTypes(self):
return dbus_to_python(self.fw_config.listIcmpTypes())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIcmpType(self, path):
return FirewallClientConfigIcmpType(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIcmpTypeByName(self, name):
path = dbus_to_python(self.fw_config.getIcmpTypeByName(name))
return FirewallClientConfigIcmpType(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addIcmpType(self, name, settings):
if isinstance(settings, FirewallClientIcmpTypeSettings):
path = self.fw_config.addIcmpType(name, tuple(settings.settings))
else:
path = self.fw_config.addIcmpType(name, tuple(settings))
return FirewallClientConfigIcmpType(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def policies(self):
return self._policies
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def direct(self):
return self._direct
# helper
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getHelperNames(self):
return dbus_to_python(self.fw_config.getHelperNames())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def listHelpers(self):
return dbus_to_python(self.fw_config.listHelpers())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getHelper(self, path):
return FirewallClientConfigHelper(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getHelperByName(self, name):
path = dbus_to_python(self.fw_config.getHelperByName(name))
return FirewallClientConfigHelper(self.bus, path)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addHelper(self, name, settings):
if isinstance(settings, FirewallClientHelperSettings):
path = self.fw_config.addHelper(name, tuple(settings.settings))
else:
path = self.fw_config.addHelper(name, tuple(settings))
return FirewallClientConfigHelper(self.bus, path)
#
class FirewallClient(object):
@handle_exceptions
def __init__(self, bus=None, wait=0, quiet=True):
if not bus:
dbus.mainloop.glib.DBusGMainLoop(set_as_default=True)
try:
self.bus = slip.dbus.SystemBus()
self.bus.default_timeout = None
except Exception:
try:
self.bus = dbus.SystemBus()
except dbus.exceptions.DBusException as e:
raise FirewallError(errors.DBUS_ERROR,
e.get_dbus_message())
else:
print("Not using slip.dbus")
else:
self.bus = bus
self.bus.add_signal_receiver(
handler_function=self._dbus_connection_changed,
signal_name="NameOwnerChanged",
dbus_interface="org.freedesktop.DBus",
arg0=config.dbus.DBUS_INTERFACE)
for interface in [ config.dbus.DBUS_INTERFACE,
config.dbus.DBUS_INTERFACE_IPSET,
config.dbus.DBUS_INTERFACE_ZONE,
config.dbus.DBUS_INTERFACE_POLICY,
config.dbus.DBUS_INTERFACE_DIRECT,
config.dbus.DBUS_INTERFACE_POLICIES,
config.dbus.DBUS_INTERFACE_CONFIG,
config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
config.dbus.DBUS_INTERFACE_CONFIG_POLICY,
config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]:
self.bus.add_signal_receiver(self._signal_receiver,
dbus_interface=interface,
interface_keyword='interface',
member_keyword='member',
path_keyword='path')
# callbacks
self._callback = { }
self._callbacks = {
# client callbacks
"connection-changed": "connection-changed",
"connection-established": "connection-established",
"connection-lost": "connection-lost",
# firewalld callbacks
"log-denied-changed": "LogDeniedChanged",
"default-zone-changed": "DefaultZoneChanged",
"panic-mode-enabled": "PanicModeEnabled",
"panic-mode-disabled": "PanicModeDisabled",
"reloaded": "Reloaded",
"service-added": "ServiceAdded",
"service-removed": "ServiceRemoved",
"port-added": "PortAdded",
"port-removed": "PortRemoved",
"source-port-added": "SourcePortAdded",
"source-port-removed": "SourcePortRemoved",
"protocol-added": "ProtocolAdded",
"protocol-removed": "ProtocolRemoved",
"masquerade-added": "MasqueradeAdded",
"masquerade-removed": "MasqueradeRemoved",
"forward-port-added": "ForwardPortAdded",
"forward-port-removed": "ForwardPortRemoved",
"icmp-block-added": "IcmpBlockAdded",
"icmp-block-removed": "IcmpBlockRemoved",
"icmp-block-inversion-added": "IcmpBlockInversionAdded",
"icmp-block-inversion-removed": "IcmpBlockInversionRemoved",
"richrule-added": "RichRuleAdded",
"richrule-removed": "RichRuleRemoved",
"interface-added": "InterfaceAdded",
"interface-removed": "InterfaceRemoved",
"zone-changed": "ZoneOfInterfaceChanged", # DEPRECATED, use zone-of-interface-changed instead
"zone-of-interface-changed": "ZoneOfInterfaceChanged",
"source-added": "SourceAdded",
"source-removed": "SourceRemoved",
"zone-of-source-changed": "ZoneOfSourceChanged",
"zone-updated": "ZoneUpdated",
"policy-updated": "PolicyUpdated",
# ipset callbacks
"ipset-entry-added": "EntryAdded",
"ipset-entry-removed": "EntryRemoved",
# direct callbacks
"direct:chain-added": "ChainAdded",
"direct:chain-removed": "ChainRemoved",
"direct:rule-added": "RuleAdded",
"direct:rule-removed": "RuleRemoved",
"direct:passthrough-added": "PassthroughAdded",
"direct:passthrough-removed": "PassthroughRemoved",
"config:direct:updated": "config:direct:Updated",
# policy callbacks
"lockdown-enabled": "LockdownEnabled",
"lockdown-disabled": "LockdownDisabled",
"lockdown-whitelist-command-added": "LockdownWhitelistCommandAdded",
"lockdown-whitelist-command-removed": "LockdownWhitelistCommandRemoved",
"lockdown-whitelist-context-added": "LockdownWhitelistContextAdded",
"lockdown-whitelist-context-removed": "LockdownWhitelistContextRemoved",
"lockdown-whitelist-uid-added": "LockdownWhitelistUidAdded",
"lockdown-whitelist-uid-removed": "LockdownWhitelistUidRemoved",
"lockdown-whitelist-user-added": "LockdownWhitelistUserAdded",
"lockdown-whitelist-user-removed": "LockdownWhitelistUserRemoved",
# firewalld.config callbacks
"config:policies:lockdown-whitelist-updated": "config:policies:LockdownWhitelistUpdated",
"config:ipset-added": "config:IPSetAdded",
"config:ipset-updated": "config:IPSetUpdated",
"config:ipset-removed": "config:IPSetRemoved",
"config:ipset-renamed": "config:IPSetRenamed",
"config:zone-added": "config:ZoneAdded",
"config:zone-updated": "config:ZoneUpdated",
"config:zone-removed": "config:ZoneRemoved",
"config:zone-renamed": "config:ZoneRenamed",
"config:policy-added": "config:PolicyAdded",
"config:policy-updated": "config:PolicyUpdated",
"config:policy-removed": "config:PolicyRemoved",
"config:policy-renamed": "config:PolicyRenamed",
"config:service-added": "config:ServiceAdded",
"config:service-updated": "config:ServiceUpdated",
"config:service-removed": "config:ServiceRemoved",
"config:service-renamed": "config:ServiceRenamed",
"config:icmptype-added": "config:IcmpTypeAdded",
"config:icmptype-updated": "config:IcmpTypeUpdated",
"config:icmptype-removed": "config:IcmpTypeRemoved",
"config:icmptype-renamed": "config:IcmpTypeRenamed",
"config:helper-added": "config:HelperAdded",
"config:helper-updated": "config:HelperUpdated",
"config:helper-removed": "config:HelperRemoved",
"config:helper-renamed": "config:HelperRenamed",
}
# initialize variables used for connection
self._init_vars()
self.quiet = quiet
if wait > 0:
# connect in one second
GLib.timeout_add_seconds(wait, self._connection_established)
else:
self._connection_established()
@handle_exceptions
def _init_vars(self):
self.fw = None
self.fw_ipset = None
self.fw_zone = None
self.fw_policy = None
self.fw_helper = None
self.fw_direct = None
self.fw_properties = None
self._config = None
self.connected = False
@handle_exceptions
def getExceptionHandler(self):
return exception_handler
@handle_exceptions
def setExceptionHandler(self, handler):
global exception_handler
exception_handler = handler
@handle_exceptions
def getNotAuthorizedLoop(self):
return not_authorized_loop
@handle_exceptions
def setNotAuthorizedLoop(self, enable):
global not_authorized_loop
not_authorized_loop = enable
@handle_exceptions
def connect(self, name, callback, *args):
if name in self._callbacks:
self._callback[self._callbacks[name]] = (callback, args)
else:
raise ValueError("Unknown callback name '%s'" % name)
@handle_exceptions
def _dbus_connection_changed(self, name, old_owner, new_owner):
if name != config.dbus.DBUS_INTERFACE:
return
if new_owner:
# connection established
self._connection_established()
else:
# connection lost
self._connection_lost()
@handle_exceptions
def _connection_established(self):
try:
self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE,
config.dbus.DBUS_PATH)
self.fw = dbus.Interface(self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE)
self.fw_ipset = dbus.Interface(
self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_IPSET)
self.fw_zone = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_ZONE)
self.fw_policy = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_POLICY)
self.fw_direct = dbus.Interface(
self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_DIRECT)
self.fw_policies = dbus.Interface(
self.dbus_obj,
dbus_interface=config.dbus.DBUS_INTERFACE_POLICIES)
self.fw_properties = dbus.Interface(
self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties')
except dbus.exceptions.DBusException as e:
# ignore dbus errors
if not self.quiet:
print ("DBusException", e.get_dbus_message())
return
except Exception as e:
if not self.quiet:
print ("Exception", e)
return
self._config = FirewallClientConfig(self.bus)
self.connected = True
self._signal_receiver(member="connection-established",
interface=config.dbus.DBUS_INTERFACE)
self._signal_receiver(member="connection-changed",
interface=config.dbus.DBUS_INTERFACE)
@handle_exceptions
def _connection_lost(self):
self._init_vars()
self._signal_receiver(member="connection-lost",
interface=config.dbus.DBUS_INTERFACE)
self._signal_receiver(member="connection-changed",
interface=config.dbus.DBUS_INTERFACE)
@handle_exceptions
def _signal_receiver(self, *args, **kwargs):
if "member" not in kwargs or "interface" not in kwargs:
return
signal = kwargs["member"]
interface = kwargs["interface"]
# config signals need special treatment
# pimp signal name
if interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_ZONE):
signal = "config:Zone" + signal
if interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_POLICY):
signal = "config:Policy" + signal
elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_IPSET):
signal = "config:IPSet" + signal
elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE):
signal = "config:Service" + signal
elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE):
signal = "config:IcmpType" + signal
elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_HELPER):
signal = "config:Helper" + signal
elif interface == config.dbus.DBUS_INTERFACE_CONFIG:
signal = "config:" + signal
elif interface == config.dbus.DBUS_INTERFACE_CONFIG_POLICIES:
signal = "config:policies:" + signal
elif interface == config.dbus.DBUS_INTERFACE_CONFIG_DIRECT:
signal = "config:direct:" + signal
cb = None
for callback in self._callbacks:
if self._callbacks[callback] == signal and \
self._callbacks[callback] in self._callback:
cb = self._callback[self._callbacks[callback]]
if cb is None:
return
# call back with args converted to python types ...
cb_args = [ dbus_to_python(arg) for arg in args ]
try:
if cb[1]:
# add call data
cb_args.extend(cb[1])
# call back
cb[0](*cb_args)
except Exception as msg:
print(msg)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def config(self):
return self._config
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def reload(self):
self.fw.reload()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def complete_reload(self):
self.fw.completeReload()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def runtimeToPermanent(self):
self.fw.runtimeToPermanent()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def checkPermanentConfig(self):
self.fw.checkPermanentConfig()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_property(self, prop):
return dbus_to_python(self.fw_properties.Get(
config.dbus.DBUS_INTERFACE, prop))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def get_properties(self):
return dbus_to_python(self.fw_properties.GetAll(
config.dbus.DBUS_INTERFACE))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def set_property(self, prop, value):
self.fw_properties.Set(config.dbus.DBUS_INTERFACE, prop, value)
# panic mode
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def enablePanicMode(self):
self.fw.enablePanicMode()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def disablePanicMode(self):
self.fw.disablePanicMode()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryPanicMode(self):
return dbus_to_python(self.fw.queryPanicMode())
# list functions
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getZoneSettings(self, zone):
return FirewallClientZoneSettings(dbus_to_python(self.fw_zone.getZoneSettings2(zone)))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIPSets(self):
return dbus_to_python(self.fw_ipset.getIPSets())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIPSetSettings(self, ipset):
return FirewallClientIPSetSettings(list(dbus_to_python(\
self.fw_ipset.getIPSetSettings(ipset))))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addEntry(self, ipset, entry):
self.fw_ipset.addEntry(ipset, entry)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getEntries(self, ipset):
return self.fw_ipset.getEntries(ipset)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setEntries(self, ipset, entries):
return self.fw_ipset.setEntries(ipset, entries)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeEntry(self, ipset, entry):
self.fw_ipset.removeEntry(ipset, entry)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryEntry(self, ipset, entry):
return dbus_to_python(self.fw_ipset.queryEntry(ipset, entry))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def listServices(self):
return dbus_to_python(self.fw.listServices())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getServiceSettings(self, service):
return FirewallClientServiceSettings(dbus_to_python(
self.fw.getServiceSettings2(service)))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def listIcmpTypes(self):
return dbus_to_python(self.fw.listIcmpTypes())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIcmpTypeSettings(self, icmptype):
return FirewallClientIcmpTypeSettings(list(dbus_to_python(\
self.fw.getIcmpTypeSettings(icmptype))))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getHelpers(self):
return dbus_to_python(self.fw.getHelpers())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getHelperSettings(self, helper):
return FirewallClientHelperSettings(list(dbus_to_python(\
self.fw.getHelperSettings(helper))))
# automatic helper setting
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getAutomaticHelpers(self):
return dbus_to_python(self.fw.getAutomaticHelpers())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setAutomaticHelpers(self, value):
self.fw.setAutomaticHelpers(value)
# log denied
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getLogDenied(self):
return dbus_to_python(self.fw.getLogDenied())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setLogDenied(self, value):
self.fw.setLogDenied(value)
# default zone
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getDefaultZone(self):
return dbus_to_python(self.fw.getDefaultZone())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setDefaultZone(self, zone):
self.fw.setDefaultZone(zone)
# zone
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setZoneSettings(self, zone, settings):
self.fw_zone.setZoneSettings2(zone, settings.getRuntimeSettingsDbusDict())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getZones(self):
return dbus_to_python(self.fw_zone.getZones())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getActiveZones(self):
return dbus_to_python(self.fw_zone.getActiveZones())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getZoneOfInterface(self, interface):
return dbus_to_python(self.fw_zone.getZoneOfInterface(interface))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getZoneOfSource(self, source):
return dbus_to_python(self.fw_zone.getZoneOfSource(source))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def isImmutable(self, zone):
return dbus_to_python(self.fw_zone.isImmutable(zone))
# policy
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getPolicySettings(self, policy):
return FirewallClientPolicySettings(dbus_to_python(self.fw_policy.getPolicySettings(policy)))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def setPolicySettings(self, policy, settings):
self.fw_policy.setPolicySettings(policy, settings.getRuntimeSettingsDbusDict())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getPolicies(self):
return dbus_to_python(self.fw_policy.getPolicies())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getActivePolicies(self):
return dbus_to_python(self.fw_policy.getActivePolicies())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def isPolicyImmutable(self, policy):
return dbus_to_python(self.fw_policy.isImmutable(policy))
# interfaces
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addInterface(self, zone, interface):
return dbus_to_python(self.fw_zone.addInterface(zone, interface))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def changeZone(self, zone, interface): # DEPRECATED
return dbus_to_python(self.fw_zone.changeZone(zone, interface))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def changeZoneOfInterface(self, zone, interface):
return dbus_to_python(self.fw_zone.changeZoneOfInterface(zone,
interface))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getInterfaces(self, zone):
return dbus_to_python(self.fw_zone.getInterfaces(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryInterface(self, zone, interface):
return dbus_to_python(self.fw_zone.queryInterface(zone, interface))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeInterface(self, zone, interface):
return dbus_to_python(self.fw_zone.removeInterface(zone, interface))
# sources
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addSource(self, zone, source):
return dbus_to_python(self.fw_zone.addSource(zone, source))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def changeZoneOfSource(self, zone, source):
return dbus_to_python(self.fw_zone.changeZoneOfSource(zone, source))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSources(self, zone):
return dbus_to_python(self.fw_zone.getSources(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def querySource(self, zone, source):
return dbus_to_python(self.fw_zone.querySource(zone, source))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeSource(self, zone, source):
return dbus_to_python(self.fw_zone.removeSource(zone, source))
# rich rules
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addRichRule(self, zone, rule, timeout=0):
return dbus_to_python(self.fw_zone.addRichRule(zone, rule, timeout))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getRichRules(self, zone):
return dbus_to_python(self.fw_zone.getRichRules(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryRichRule(self, zone, rule):
return dbus_to_python(self.fw_zone.queryRichRule(zone, rule))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeRichRule(self, zone, rule):
return dbus_to_python(self.fw_zone.removeRichRule(zone, rule))
# services
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addService(self, zone, service, timeout=0):
return dbus_to_python(self.fw_zone.addService(zone, service, timeout))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getServices(self, zone):
return dbus_to_python(self.fw_zone.getServices(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryService(self, zone, service):
return dbus_to_python(self.fw_zone.queryService(zone, service))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeService(self, zone, service):
return dbus_to_python(self.fw_zone.removeService(zone, service))
# ports
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addPort(self, zone, port, protocol, timeout=0):
return dbus_to_python(self.fw_zone.addPort(zone, port, protocol, timeout))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getPorts(self, zone):
return dbus_to_python(self.fw_zone.getPorts(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryPort(self, zone, port, protocol):
return dbus_to_python(self.fw_zone.queryPort(zone, port, protocol))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removePort(self, zone, port, protocol):
return dbus_to_python(self.fw_zone.removePort(zone, port, protocol))
# protocols
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addProtocol(self, zone, protocol, timeout=0):
return dbus_to_python(self.fw_zone.addProtocol(zone, protocol, timeout))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getProtocols(self, zone):
return dbus_to_python(self.fw_zone.getProtocols(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryProtocol(self, zone, protocol):
return dbus_to_python(self.fw_zone.queryProtocol(zone, protocol))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeProtocol(self, zone, protocol):
return dbus_to_python(self.fw_zone.removeProtocol(zone, protocol))
# forward
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addForward(self, zone):
self.fw_zone.setZoneSettings2(zone, {"forward": True})
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryForward(self, zone):
return dbus_to_python(self.fw_zone.getZoneSettings2(zone))["forward"]
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeForward(self, zone):
self.fw_zone.setZoneSettings2(zone, {"forward": False})
# masquerade
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addMasquerade(self, zone, timeout=0):
return dbus_to_python(self.fw_zone.addMasquerade(zone, timeout))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryMasquerade(self, zone):
return dbus_to_python(self.fw_zone.queryMasquerade(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeMasquerade(self, zone):
return dbus_to_python(self.fw_zone.removeMasquerade(zone))
# forward ports
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addForwardPort(self, zone, port, protocol, toport, toaddr,
timeout=0):
if toport is None:
toport = ""
if toaddr is None:
toaddr = ""
return dbus_to_python(self.fw_zone.addForwardPort(zone, port, protocol,
toport, toaddr,
timeout))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getForwardPorts(self, zone):
return dbus_to_python(self.fw_zone.getForwardPorts(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryForwardPort(self, zone, port, protocol, toport, toaddr):
if toport is None:
toport = ""
if toaddr is None:
toaddr = ""
return dbus_to_python(self.fw_zone.queryForwardPort(zone,
port, protocol,
toport, toaddr))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeForwardPort(self, zone, port, protocol, toport, toaddr):
if toport is None:
toport = ""
if toaddr is None:
toaddr = ""
return dbus_to_python(self.fw_zone.removeForwardPort(zone,
port, protocol,
toport, toaddr))
# source ports
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addSourcePort(self, zone, port, protocol, timeout=0):
return dbus_to_python(self.fw_zone.addSourcePort(zone, port, protocol,
timeout))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getSourcePorts(self, zone):
return dbus_to_python(self.fw_zone.getSourcePorts(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def querySourcePort(self, zone, port, protocol):
return dbus_to_python(self.fw_zone.querySourcePort(zone, port, protocol))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeSourcePort(self, zone, port, protocol):
return dbus_to_python(self.fw_zone.removeSourcePort(zone, port,
protocol))
# icmpblock
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addIcmpBlock(self, zone, icmp, timeout=0):
return dbus_to_python(self.fw_zone.addIcmpBlock(zone, icmp, timeout))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getIcmpBlocks(self, zone):
return dbus_to_python(self.fw_zone.getIcmpBlocks(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryIcmpBlock(self, zone, icmp):
return dbus_to_python(self.fw_zone.queryIcmpBlock(zone, icmp))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeIcmpBlock(self, zone, icmp):
return dbus_to_python(self.fw_zone.removeIcmpBlock(zone, icmp))
# icmp block inversion
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addIcmpBlockInversion(self, zone):
return dbus_to_python(self.fw_zone.addIcmpBlockInversion(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryIcmpBlockInversion(self, zone):
return dbus_to_python(self.fw_zone.queryIcmpBlockInversion(zone))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeIcmpBlockInversion(self, zone):
return dbus_to_python(self.fw_zone.removeIcmpBlockInversion(zone))
# direct chain
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addChain(self, ipv, table, chain):
self.fw_direct.addChain(ipv, table, chain)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeChain(self, ipv, table, chain):
self.fw_direct.removeChain(ipv, table, chain)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryChain(self, ipv, table, chain):
return dbus_to_python(self.fw_direct.queryChain(ipv, table, chain))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getChains(self, ipv, table):
return dbus_to_python(self.fw_direct.getChains(ipv, table))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getAllChains(self):
return dbus_to_python(self.fw_direct.getAllChains())
# direct rule
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addRule(self, ipv, table, chain, priority, args):
self.fw_direct.addRule(ipv, table, chain, priority, args)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeRule(self, ipv, table, chain, priority, args):
self.fw_direct.removeRule(ipv, table, chain, priority, args)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeRules(self, ipv, table, chain):
self.fw_direct.removeRules(ipv, table, chain)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryRule(self, ipv, table, chain, priority, args):
return dbus_to_python(self.fw_direct.queryRule(ipv, table, chain, priority, args))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getRules(self, ipv, table, chain):
return dbus_to_python(self.fw_direct.getRules(ipv, table, chain))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getAllRules(self):
return dbus_to_python(self.fw_direct.getAllRules())
# direct passthrough
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def passthrough(self, ipv, args):
return dbus_to_python(self.fw_direct.passthrough(ipv, args))
# tracked passthrough
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getAllPassthroughs(self):
return dbus_to_python(self.fw_direct.getAllPassthroughs())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeAllPassthroughs(self):
self.fw_direct.removeAllPassthroughs()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getPassthroughs(self, ipv):
return dbus_to_python(self.fw_direct.getPassthroughs(ipv))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addPassthrough(self, ipv, args):
self.fw_direct.addPassthrough(ipv, args)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removePassthrough(self, ipv, args):
self.fw_direct.removePassthrough(ipv, args)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryPassthrough(self, ipv, args):
return dbus_to_python(self.fw_direct.queryPassthrough(ipv, args))
# lockdown
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def enableLockdown(self):
self.fw_policies.enableLockdown()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def disableLockdown(self):
self.fw_policies.disableLockdown()
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryLockdown(self):
return dbus_to_python(self.fw_policies.queryLockdown())
# policies
# lockdown white list commands
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addLockdownWhitelistCommand(self, command):
self.fw_policies.addLockdownWhitelistCommand(command)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getLockdownWhitelistCommands(self):
return dbus_to_python(self.fw_policies.getLockdownWhitelistCommands())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryLockdownWhitelistCommand(self, command):
return dbus_to_python(self.fw_policies.queryLockdownWhitelistCommand(command))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeLockdownWhitelistCommand(self, command):
self.fw_policies.removeLockdownWhitelistCommand(command)
# lockdown white list contexts
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addLockdownWhitelistContext(self, context):
self.fw_policies.addLockdownWhitelistContext(context)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getLockdownWhitelistContexts(self):
return dbus_to_python(self.fw_policies.getLockdownWhitelistContexts())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryLockdownWhitelistContext(self, context):
return dbus_to_python(self.fw_policies.queryLockdownWhitelistContext(context))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeLockdownWhitelistContext(self, context):
self.fw_policies.removeLockdownWhitelistContext(context)
# lockdown white list uids
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addLockdownWhitelistUid(self, uid):
self.fw_policies.addLockdownWhitelistUid(uid)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getLockdownWhitelistUids(self):
return dbus_to_python(self.fw_policies.getLockdownWhitelistUids())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryLockdownWhitelistUid(self, uid):
return dbus_to_python(self.fw_policies.queryLockdownWhitelistUid(uid))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeLockdownWhitelistUid(self, uid):
self.fw_policies.removeLockdownWhitelistUid(uid)
# lockdown white list users
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def addLockdownWhitelistUser(self, user):
self.fw_policies.addLockdownWhitelistUser(user)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def getLockdownWhitelistUsers(self):
return dbus_to_python(self.fw_policies.getLockdownWhitelistUsers())
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def queryLockdownWhitelistUser(self, user):
return dbus_to_python(self.fw_policies.queryLockdownWhitelistUser(user))
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def removeLockdownWhitelistUser(self, user):
self.fw_policies.removeLockdownWhitelistUser(user)
@slip.dbus.polkit.enable_proxy
@handle_exceptions
def authorizeAll(self):
""" Authorize once for all polkit actions. """
self.fw.authorizeAll()
fw_types.py 0000644 00000004220 15035135171 0006755 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2013-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "LastUpdatedOrderedDict" ]
class LastUpdatedOrderedDict(object):
def __init__(self, x=None):
self._dict = { }
self._list = [ ]
if x:
self.update(x)
def clear(self):
del self._list[:]
self._dict.clear()
def update(self, x):
for key,value in x.items():
self[key] = value
def items(self):
return [(key, self[key]) for key in self._list]
def __delitem__(self, key):
if key in self._dict:
self._list.remove(key)
del self._dict[key]
def __repr__(self):
return '%s([%s])' % (self.__class__.__name__, ', '.join(
['(%r, %r)' % (key, self[key]) for key in self._list]))
def __setitem__(self, key, value):
if key not in self._dict:
self._list.append(key)
self._dict[key] = value
def __getitem__(self, key):
if type(key) == int:
return self._list[key]
else:
return self._dict[key]
def __len__(self):
return len(self._list)
def copy(self):
return LastUpdatedOrderedDict(self)
def keys(self):
return self._list[:]
def values(self):
return [ self[key] for key in self._list ]
def setdefault(self, key, value=None):
if key in self:
return self[key]
else:
self[key] = value
return value
dbus_utils.py 0000644 00000017512 15035135171 0007302 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "command_of_pid", "pid_of_sender", "uid_of_sender", "user_of_uid",
"context_of_sender", "command_of_sender", "user_of_sender",
"dbus_to_python", "dbus_signature",
"dbus_introspection_prepare_properties",
"dbus_introspection_add_properties" ]
import dbus
import pwd
import sys
from xml.dom import minidom
from firewall.core.logger import log
PY2 = sys.version < '3'
def command_of_pid(pid):
""" Get command for pid from /proc """
try:
with open("/proc/%d/cmdline" % pid, "r") as f:
cmd = f.readlines()[0].replace('\0', " ").strip()
except Exception:
return None
return cmd
def pid_of_sender(bus, sender):
""" Get pid from sender string using
org.freedesktop.DBus.GetConnectionUnixProcessID """
dbus_obj = bus.get_object('org.freedesktop.DBus', '/org/freedesktop/DBus')
dbus_iface = dbus.Interface(dbus_obj, 'org.freedesktop.DBus')
try:
pid = int(dbus_iface.GetConnectionUnixProcessID(sender))
except ValueError:
return None
return pid
def uid_of_sender(bus, sender):
""" Get user id from sender string using
org.freedesktop.DBus.GetConnectionUnixUser """
dbus_obj = bus.get_object('org.freedesktop.DBus', '/org/freedesktop/DBus')
dbus_iface = dbus.Interface(dbus_obj, 'org.freedesktop.DBus')
try:
uid = int(dbus_iface.GetConnectionUnixUser(sender))
except ValueError:
return None
return uid
def user_of_uid(uid):
""" Get user for uid from pwd """
try:
pws = pwd.getpwuid(uid)
except Exception:
return None
return pws[0]
def context_of_sender(bus, sender):
""" Get SELinux context from sender string using
org.freedesktop.DBus.GetConnectionSELinuxSecurityContext """
dbus_obj = bus.get_object('org.freedesktop.DBus', '/org/freedesktop/DBus')
dbus_iface = dbus.Interface(dbus_obj, 'org.freedesktop.DBus')
try:
context = dbus_iface.GetConnectionSELinuxSecurityContext(sender)
except Exception:
return None
return "".join(map(chr, dbus_to_python(context)))
def command_of_sender(bus, sender):
""" Return command of D-Bus sender """
return command_of_pid(pid_of_sender(bus, sender))
def user_of_sender(bus, sender):
return user_of_uid(uid_of_sender(bus, sender))
def dbus_to_python(obj, expected_type=None):
if obj is None:
python_obj = obj
elif isinstance(obj, dbus.Boolean):
python_obj = bool(obj)
elif isinstance(obj, dbus.String):
python_obj = obj.encode('utf-8') if PY2 else str(obj)
elif PY2 and isinstance(obj, dbus.UTF8String): # Python3 has no UTF8String
python_obj = str(obj)
elif isinstance(obj, dbus.ObjectPath):
python_obj = str(obj)
elif isinstance(obj, dbus.Byte) or \
isinstance(obj, dbus.Int16) or \
isinstance(obj, dbus.Int32) or \
isinstance(obj, dbus.Int64) or \
isinstance(obj, dbus.UInt16) or \
isinstance(obj, dbus.UInt32) or \
isinstance(obj, dbus.UInt64):
python_obj = int(obj)
elif isinstance(obj, dbus.Double):
python_obj = float(obj)
elif isinstance(obj, dbus.Array):
python_obj = [dbus_to_python(x) for x in obj]
elif isinstance(obj, dbus.Struct):
python_obj = tuple([dbus_to_python(x) for x in obj])
elif isinstance(obj, dbus.Dictionary):
python_obj = {dbus_to_python(k): dbus_to_python(v) for k, v in obj.items()}
elif isinstance(obj, bool) or \
isinstance(obj, str) or isinstance(obj, bytes) or \
isinstance(obj, int) or isinstance(obj, float) or \
isinstance(obj, list) or isinstance(obj, tuple) or \
isinstance(obj, dict):
python_obj = obj
else:
raise TypeError("Unhandled %s" % repr(obj))
if expected_type is not None:
if (expected_type == bool and not isinstance(python_obj, bool)) or \
(expected_type == str and not isinstance(python_obj, str)) or \
(expected_type == int and not isinstance(python_obj, int)) or \
(expected_type == float and not isinstance(python_obj, float)) or \
(expected_type == list and not isinstance(python_obj, list)) or \
(expected_type == tuple and not isinstance(python_obj, tuple)) or \
(expected_type == dict and not isinstance(python_obj, dict)):
raise TypeError("%s is %s, expected %s" % (python_obj, type(python_obj), expected_type))
return python_obj
def dbus_signature(obj):
if isinstance(obj, dbus.Boolean):
return 'b'
elif isinstance(obj, dbus.String):
return 's'
elif isinstance(obj, dbus.ObjectPath):
return 'o'
elif isinstance(obj, dbus.Byte):
return 'y'
elif isinstance(obj, dbus.Int16):
return 'n'
elif isinstance(obj, dbus.Int32):
return 'i'
elif isinstance(obj, dbus.Int64):
return 'x'
elif isinstance(obj, dbus.UInt16):
return 'q'
elif isinstance(obj, dbus.UInt32):
return 'u'
elif isinstance(obj, dbus.UInt64):
return 't'
elif isinstance(obj, dbus.Double):
return 'd'
elif isinstance(obj, dbus.Array):
if len(obj.signature) > 1:
return 'a(%s)' % obj.signature
else:
return 'a%s' % obj.signature
elif isinstance(obj, dbus.Struct):
return '(%s)' % obj.signature
elif isinstance(obj, dbus.Dictionary):
return 'a{%s}' % obj.signature
elif PY2 and isinstance(obj, dbus.UTF8String):
return 's'
else:
raise TypeError("Unhandled %s" % repr(obj))
def dbus_introspection_prepare_properties(obj, interface, access=None):
if access is None:
access = { }
if not hasattr(obj, "_fw_dbus_properties"):
setattr(obj, "_fw_dbus_properties", { })
dip = getattr(obj, "_fw_dbus_properties")
dip[interface] = { }
try:
_dict = obj.GetAll(interface)
except Exception:
_dict = { }
for key,value in _dict.items():
dip[interface][key] = { "type": dbus_signature(value) }
if key in access:
dip[interface][key]["access"] = access[key]
else:
dip[interface][key]["access"] = "read"
def dbus_introspection_add_properties(obj, data, interface):
doc = minidom.parseString(data)
if hasattr(obj, "_fw_dbus_properties"):
for node in doc.getElementsByTagName("interface"):
if node.hasAttribute("name") and \
node.getAttribute("name") == interface:
dip = { }
if getattr(obj, "_fw_dbus_properties"):
dip = getattr(obj, "_fw_dbus_properties")
if interface in dip:
for key,value in dip[interface].items():
prop = doc.createElement("property")
prop.setAttribute("name", key)
prop.setAttribute("type", value["type"])
prop.setAttribute("access", value["access"])
node.appendChild(prop)
log.debug10(doc.toxml())
new_data = doc.toxml()
doc.unlink()
return new_data
config/__init__.py 0000644 00000011404 15035135171 0010123 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2007-2016 Red Hat, Inc.
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from __future__ import absolute_import
# translation
import locale
try:
locale.setlocale(locale.LC_ALL, "")
except locale.Error:
import os
os.environ['LC_ALL'] = 'C'
locale.setlocale(locale.LC_ALL, "")
DOMAIN = 'firewalld'
import gettext
gettext.install(domain=DOMAIN)
from . import dbus # noqa: F401
# configuration
DAEMON_NAME = 'firewalld'
CONFIG_NAME = 'firewall-config'
APPLET_NAME = 'firewall-applet'
DATADIR = '/usr/share/' + DAEMON_NAME
CONFIG_GLADE_NAME = CONFIG_NAME + '.glade'
COPYRIGHT = '(C) 2010-2017 Red Hat, Inc.'
VERSION = '0.9.11'
AUTHORS = [
"Thomas Woerner <twoerner@redhat.com>",
"Jiri Popelka <jpopelka@redhat.com>",
"Eric Garver <e@erig.me>",
]
LICENSE = gettext.gettext(
"This program is free software; you can redistribute it and/or modify "
"it under the terms of the GNU General Public License as published by "
"the Free Software Foundation; either version 2 of the License, or "
"(at your option) any later version.\n"
"\n"
"This program is distributed in the hope that it will be useful, "
"but WITHOUT ANY WARRANTY; without even the implied warranty of "
"MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the "
"GNU General Public License for more details.\n"
"\n"
"You should have received a copy of the GNU General Public License "
"along with this program. If not, see <http://www.gnu.org/licenses/>.")
WEBSITE = 'http://www.firewalld.org'
def set_system_config_paths(path):
global ETC_FIREWALLD, FIREWALLD_CONF, ETC_FIREWALLD_ZONES, \
ETC_FIREWALLD_SERVICES, ETC_FIREWALLD_ICMPTYPES, \
ETC_FIREWALLD_IPSETS, ETC_FIREWALLD_HELPERS, \
FIREWALLD_DIRECT, LOCKDOWN_WHITELIST, ETC_FIREWALLD_POLICIES
ETC_FIREWALLD = path
FIREWALLD_CONF = path + '/firewalld.conf'
ETC_FIREWALLD_ZONES = path + '/zones'
ETC_FIREWALLD_SERVICES = path + '/services'
ETC_FIREWALLD_ICMPTYPES = path + '/icmptypes'
ETC_FIREWALLD_IPSETS = path + '/ipsets'
ETC_FIREWALLD_HELPERS = path + '/helpers'
ETC_FIREWALLD_POLICIES = path + '/policies'
FIREWALLD_DIRECT = path + '/direct.xml'
LOCKDOWN_WHITELIST = path + '/lockdown-whitelist.xml'
set_system_config_paths('/etc/firewalld')
def set_default_config_paths(path):
global USR_LIB_FIREWALLD, FIREWALLD_ZONES, FIREWALLD_SERVICES, \
FIREWALLD_ICMPTYPES, FIREWALLD_IPSETS, FIREWALLD_HELPERS, \
FIREWALLD_POLICIES
USR_LIB_FIREWALLD = path
FIREWALLD_ZONES = path + '/zones'
FIREWALLD_SERVICES = path + '/services'
FIREWALLD_ICMPTYPES = path + '/icmptypes'
FIREWALLD_IPSETS = path + '/ipsets'
FIREWALLD_HELPERS = path + '/helpers'
FIREWALLD_POLICIES = path + '/policies'
set_default_config_paths('/usr/lib/firewalld')
FIREWALLD_LOGFILE = '/var/log/firewalld'
FIREWALLD_PIDFILE = "/var/run/firewalld.pid"
FIREWALLD_TEMPDIR = '/run/firewalld'
SYSCONFIGDIR = '/etc/sysconfig'
IFCFGDIR = "/etc/sysconfig/network-scripts"
SYSCTL_CONFIG = '/etc/sysctl.conf'
# commands used by backends
COMMANDS = {
"ipv4": "/usr/sbin/iptables",
"ipv4-restore": "/usr/sbin/iptables-restore",
"ipv6": "/usr/sbin/ip6tables",
"ipv6-restore": "/usr/sbin/ip6tables-restore",
"eb": "/usr/sbin/ebtables",
"eb-restore": "/usr/sbin/ebtables-restore",
"ipset": "/usr/sbin/ipset",
"modprobe": "/sbin/modprobe",
"rmmod": "/sbin/rmmod",
}
LOG_DENIED_VALUES = [ "all", "unicast", "broadcast", "multicast", "off" ]
AUTOMATIC_HELPERS_VALUES = [ "yes", "no", "system" ]
FIREWALL_BACKEND_VALUES = [ "nftables", "iptables" ]
# fallbacks: will be overloaded by firewalld.conf
FALLBACK_ZONE = "public"
FALLBACK_MINIMAL_MARK = 100
FALLBACK_CLEANUP_ON_EXIT = True
FALLBACK_CLEANUP_MODULES_ON_EXIT = True
FALLBACK_LOCKDOWN = False
FALLBACK_IPV6_RPFILTER = True
FALLBACK_INDIVIDUAL_CALLS = False
FALLBACK_LOG_DENIED = "off"
FALLBACK_AUTOMATIC_HELPERS = "no"
FALLBACK_FIREWALL_BACKEND = "nftables"
FALLBACK_FLUSH_ALL_ON_RELOAD = True
FALLBACK_RFC3964_IPV4 = True
FALLBACK_ALLOW_ZONE_DRIFTING = True
config/dbus.py 0000644 00000005021 15035135171 0007317 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011,2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
DBUS_INTERFACE_VERSION = 1
DBUS_INTERFACE_REVISION = 15
DBUS_INTERFACE = "org.fedoraproject.FirewallD%d" % DBUS_INTERFACE_VERSION
DBUS_INTERFACE_ZONE = DBUS_INTERFACE+".zone"
DBUS_INTERFACE_POLICY = DBUS_INTERFACE+".policy"
DBUS_INTERFACE_DIRECT = DBUS_INTERFACE+".direct"
DBUS_INTERFACE_POLICIES = DBUS_INTERFACE+".policies"
DBUS_INTERFACE_IPSET = DBUS_INTERFACE+".ipset"
DBUS_INTERFACE_CONFIG = DBUS_INTERFACE+".config"
DBUS_INTERFACE_CONFIG_ZONE = DBUS_INTERFACE_CONFIG+".zone"
DBUS_INTERFACE_CONFIG_POLICY = DBUS_INTERFACE_CONFIG+".policy"
DBUS_INTERFACE_CONFIG_SERVICE = DBUS_INTERFACE_CONFIG+".service"
DBUS_INTERFACE_CONFIG_ICMPTYPE = DBUS_INTERFACE_CONFIG+".icmptype"
DBUS_INTERFACE_CONFIG_POLICIES = DBUS_INTERFACE_CONFIG+".policies"
DBUS_INTERFACE_CONFIG_DIRECT = DBUS_INTERFACE_CONFIG+".direct"
DBUS_INTERFACE_CONFIG_IPSET = DBUS_INTERFACE_CONFIG+".ipset"
DBUS_INTERFACE_CONFIG_HELPER = DBUS_INTERFACE_CONFIG+".helper"
DBUS_PATH = "/org/fedoraproject/FirewallD%d" % DBUS_INTERFACE_VERSION
DBUS_PATH_CONFIG = DBUS_PATH+"/config"
DBUS_PATH_CONFIG_ICMPTYPE = DBUS_PATH+"/config/icmptype"
DBUS_PATH_CONFIG_SERVICE = DBUS_PATH+"/config/service"
DBUS_PATH_CONFIG_ZONE = DBUS_PATH+"/config/zone"
DBUS_PATH_CONFIG_POLICY = DBUS_PATH+"/config/policy"
DBUS_PATH_CONFIG_IPSET = DBUS_PATH+"/config/ipset"
DBUS_PATH_CONFIG_HELPER = DBUS_PATH+"/config/helper"
# Polkit actions
_PK_ACTION = "org.fedoraproject.FirewallD%d" % DBUS_INTERFACE_VERSION
PK_ACTION_POLICIES = _PK_ACTION+".policies"
PK_ACTION_POLICIES_INFO = PK_ACTION_POLICIES+".info"
PK_ACTION_CONFIG = _PK_ACTION+".config"
PK_ACTION_CONFIG_INFO = PK_ACTION_CONFIG+".info"
PK_ACTION_DIRECT = _PK_ACTION+".direct"
PK_ACTION_DIRECT_INFO = PK_ACTION_DIRECT+".info"
PK_ACTION_INFO = _PK_ACTION+".info"
PK_ACTION_ALL = _PK_ACTION+".all" # implies all other actions
config/__pycache__/dbus.cpython-36.opt-1.pyc 0000644 00000002737 15035135171 0014555 0 ustar 00 3
��g
� @ s d Z dZde Zed Zed Zed Zed Zed Zed Zed Z ed Z
ed Z ed
Z ed Z
ed Zed Zed Zd e Zed
Zed Zed Zed Zed Zed Zed Zde Zed Zed Zed Z e d Z ed Z e d Z ed Z ed Z!dS )� � z org.fedoraproject.FirewallD%dz.zonez.policyz.directz .policiesz.ipsetz.configz.servicez .icmptypez.helperz /org/fedoraproject/FirewallD%dz/configz/config/icmptypez/config/servicez /config/zonez/config/policyz
/config/ipsetz/config/helperz.infoz.allN)"ZDBUS_INTERFACE_VERSIONZDBUS_INTERFACE_REVISIONZDBUS_INTERFACEZDBUS_INTERFACE_ZONEZDBUS_INTERFACE_POLICYZDBUS_INTERFACE_DIRECTZDBUS_INTERFACE_POLICIESZDBUS_INTERFACE_IPSETZDBUS_INTERFACE_CONFIGZDBUS_INTERFACE_CONFIG_ZONEZ DBUS_INTERFACE_CONFIG_POLICYZ DBUS_INTERFACE_CONFIG_SERVICEZ DBUS_INTERFACE_CONFIG_ICMPTYPEZ DBUS_INTERFACE_CONFIG_POLICIESZ DBUS_INTERFACE_CONFIG_DIRECTZDBUS_INTERFACE_CONFIG_IPSETZ DBUS_INTERFACE_CONFIG_HELPERZ DBUS_PATHZDBUS_PATH_CONFIGZDBUS_PATH_CONFIG_ICMPTYPEZDBUS_PATH_CONFIG_SERVICEZDBUS_PATH_CONFIG_ZONEZDBUS_PATH_CONFIG_POLICYZDBUS_PATH_CONFIG_IPSETZDBUS_PATH_CONFIG_HELPERZ
_PK_ACTIONZPK_ACTION_POLICIESZPK_ACTION_POLICIES_INFOZPK_ACTION_CONFIGZPK_ACTION_CONFIG_INFOZPK_ACTION_DIRECTZPK_ACTION_DIRECT_INFOZPK_ACTION_INFOZ
PK_ACTION_ALL� r r �/usr/lib/python3.6/dbus.py�<module> sB config/__pycache__/__init__.cpython-36.pyc 0000644 00000007036 15035135171 0014415 0 ustar 00 3
��g � @ sf d dl mZ d dlZyejejd� W n6 ejk
r\ d dlZdejd< ejejd� Y nX dZd dl Z e j
ed� dd l m Z dZ
d
Zd Zd e
Zed
ZdZdZdddgZe j d�ZdZdd� Zed� dd� Zed� dZd Zd Zd Z d Z d Z d!d"d#d$d%d&d'd(d)d*� Z d+d,d-d.d/gZ d0d1d2gZ!d3d4gZ"d5Z#d6Z$d7Z%d7Z&d8Z'd7Z(d8Z)d/Z*d1Z+d3Z,d7Z-d7Z.d7Z/dS )9� )�absolute_importN� �C�LC_ALLZ firewalld)Zdomain� )�dbuszfirewall-configzfirewall-appletz /usr/share/z.gladez(C) 2010-2017 Red Hat, Inc.z0.9.11z$Thomas Woerner <twoerner@redhat.com>z"Jiri Popelka <jpopelka@redhat.com>zEric Garver <e@erig.me>ac This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.zhttp://www.firewalld.orgc C sP | a | d a| d a| d a| d a| d a| d a| d a| d a| d a d S )
Nz/firewalld.confz/zonesz /servicesz
/icmptypesz/ipsetsz/helpersz /policiesz /direct.xmlz/lockdown-whitelist.xml)
Z
ETC_FIREWALLDZFIREWALLD_CONFZETC_FIREWALLD_ZONESZETC_FIREWALLD_SERVICESZETC_FIREWALLD_ICMPTYPESZETC_FIREWALLD_IPSETSZETC_FIREWALLD_HELPERSZETC_FIREWALLD_POLICIESZFIREWALLD_DIRECTZLOCKDOWN_WHITELIST)�path� r � /usr/lib/python3.6/__init__.py�set_system_config_pathsB s r z/etc/firewalldc C s8 | a | d a| d a| d a| d a| d a| d ad S )Nz/zonesz /servicesz
/icmptypesz/ipsetsz/helpersz /policies)ZUSR_LIB_FIREWALLDZFIREWALLD_ZONESZFIREWALLD_SERVICESZFIREWALLD_ICMPTYPESZFIREWALLD_IPSETSZFIREWALLD_HELPERSZFIREWALLD_POLICIES)r r r r
�set_default_config_pathsS s r z/usr/lib/firewalldz/var/log/firewalldz/var/run/firewalld.pidz/run/firewalldz/etc/sysconfigz /etc/sysconfig/network-scriptsz/etc/sysctl.confz/usr/sbin/iptablesz/usr/sbin/iptables-restorez/usr/sbin/ip6tablesz/usr/sbin/ip6tables-restorez/usr/sbin/ebtablesz/usr/sbin/ebtables-restorez/usr/sbin/ipsetz/sbin/modprobez /sbin/rmmod) Zipv4z ipv4-restoreZipv6z ipv6-restoreZebz
eb-restoreZipsetZmodprobeZrmmod�allZunicastZ broadcastZ multicastZoff�yes�no�systemZnftablesZiptablesZpublic�d TF)0Z
__future__r Zlocale� setlocaler �Error�os�environZDOMAIN�gettextZinstallr r Z DAEMON_NAMEZ CONFIG_NAMEZ APPLET_NAMEZDATADIRZCONFIG_GLADE_NAMEZ COPYRIGHT�VERSIONZAUTHORS�LICENSEZWEBSITEr r ZFIREWALLD_LOGFILEZFIREWALLD_PIDFILEZFIREWALLD_TEMPDIRZ SYSCONFIGDIRZIFCFGDIRZ
SYSCTL_CONFIGZCOMMANDSZLOG_DENIED_VALUESZAUTOMATIC_HELPERS_VALUESZFIREWALL_BACKEND_VALUESZ
FALLBACK_ZONEZFALLBACK_MINIMAL_MARKZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTINGr r r r
�<module> sv
config/__pycache__/__init__.cpython-36.opt-1.pyc 0000644 00000007036 15035135171 0015354 0 ustar 00 3
��g � @ sf d dl mZ d dlZyejejd� W n6 ejk
r\ d dlZdejd< ejejd� Y nX dZd dl Z e j
ed� dd l m Z dZ
d
Zd Zd e
Zed
ZdZdZdddgZe j d�ZdZdd� Zed� dd� Zed� dZd Zd Zd Z d Z d Z d!d"d#d$d%d&d'd(d)d*� Z d+d,d-d.d/gZ d0d1d2gZ!d3d4gZ"d5Z#d6Z$d7Z%d7Z&d8Z'd7Z(d8Z)d/Z*d1Z+d3Z,d7Z-d7Z.d7Z/dS )9� )�absolute_importN� �C�LC_ALLZ firewalld)Zdomain� )�dbuszfirewall-configzfirewall-appletz /usr/share/z.gladez(C) 2010-2017 Red Hat, Inc.z0.9.11z$Thomas Woerner <twoerner@redhat.com>z"Jiri Popelka <jpopelka@redhat.com>zEric Garver <e@erig.me>ac This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.zhttp://www.firewalld.orgc C sP | a | d a| d a| d a| d a| d a| d a| d a| d a| d a d S )
Nz/firewalld.confz/zonesz /servicesz
/icmptypesz/ipsetsz/helpersz /policiesz /direct.xmlz/lockdown-whitelist.xml)
Z
ETC_FIREWALLDZFIREWALLD_CONFZETC_FIREWALLD_ZONESZETC_FIREWALLD_SERVICESZETC_FIREWALLD_ICMPTYPESZETC_FIREWALLD_IPSETSZETC_FIREWALLD_HELPERSZETC_FIREWALLD_POLICIESZFIREWALLD_DIRECTZLOCKDOWN_WHITELIST)�path� r � /usr/lib/python3.6/__init__.py�set_system_config_pathsB s r z/etc/firewalldc C s8 | a | d a| d a| d a| d a| d a| d ad S )Nz/zonesz /servicesz
/icmptypesz/ipsetsz/helpersz /policies)ZUSR_LIB_FIREWALLDZFIREWALLD_ZONESZFIREWALLD_SERVICESZFIREWALLD_ICMPTYPESZFIREWALLD_IPSETSZFIREWALLD_HELPERSZFIREWALLD_POLICIES)r r r r
�set_default_config_pathsS s r z/usr/lib/firewalldz/var/log/firewalldz/var/run/firewalld.pidz/run/firewalldz/etc/sysconfigz /etc/sysconfig/network-scriptsz/etc/sysctl.confz/usr/sbin/iptablesz/usr/sbin/iptables-restorez/usr/sbin/ip6tablesz/usr/sbin/ip6tables-restorez/usr/sbin/ebtablesz/usr/sbin/ebtables-restorez/usr/sbin/ipsetz/sbin/modprobez /sbin/rmmod) Zipv4z ipv4-restoreZipv6z ipv6-restoreZebz
eb-restoreZipsetZmodprobeZrmmod�allZunicastZ broadcastZ multicastZoff�yes�no�systemZnftablesZiptablesZpublic�d TF)0Z
__future__r Zlocale� setlocaler �Error�os�environZDOMAIN�gettextZinstallr r Z DAEMON_NAMEZ CONFIG_NAMEZ APPLET_NAMEZDATADIRZCONFIG_GLADE_NAMEZ COPYRIGHT�VERSIONZAUTHORS�LICENSEZWEBSITEr r ZFIREWALLD_LOGFILEZFIREWALLD_PIDFILEZFIREWALLD_TEMPDIRZ SYSCONFIGDIRZIFCFGDIRZ
SYSCTL_CONFIGZCOMMANDSZLOG_DENIED_VALUESZAUTOMATIC_HELPERS_VALUESZFIREWALL_BACKEND_VALUESZ
FALLBACK_ZONEZFALLBACK_MINIMAL_MARKZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTINGr r r r
�<module> sv
config/__pycache__/dbus.cpython-36.pyc 0000644 00000002737 15035135171 0013616 0 ustar 00 3
��g
� @ s d Z dZde Zed Zed Zed Zed Zed Zed Zed Z ed Z
ed Z ed
Z ed Z
ed Zed Zed Zd e Zed
Zed Zed Zed Zed Zed Zed Zde Zed Zed Zed Z e d Z ed Z e d Z ed Z ed Z!dS )� � z org.fedoraproject.FirewallD%dz.zonez.policyz.directz .policiesz.ipsetz.configz.servicez .icmptypez.helperz /org/fedoraproject/FirewallD%dz/configz/config/icmptypez/config/servicez /config/zonez/config/policyz
/config/ipsetz/config/helperz.infoz.allN)"ZDBUS_INTERFACE_VERSIONZDBUS_INTERFACE_REVISIONZDBUS_INTERFACEZDBUS_INTERFACE_ZONEZDBUS_INTERFACE_POLICYZDBUS_INTERFACE_DIRECTZDBUS_INTERFACE_POLICIESZDBUS_INTERFACE_IPSETZDBUS_INTERFACE_CONFIGZDBUS_INTERFACE_CONFIG_ZONEZ DBUS_INTERFACE_CONFIG_POLICYZ DBUS_INTERFACE_CONFIG_SERVICEZ DBUS_INTERFACE_CONFIG_ICMPTYPEZ DBUS_INTERFACE_CONFIG_POLICIESZ DBUS_INTERFACE_CONFIG_DIRECTZDBUS_INTERFACE_CONFIG_IPSETZ DBUS_INTERFACE_CONFIG_HELPERZ DBUS_PATHZDBUS_PATH_CONFIGZDBUS_PATH_CONFIG_ICMPTYPEZDBUS_PATH_CONFIG_SERVICEZDBUS_PATH_CONFIG_ZONEZDBUS_PATH_CONFIG_POLICYZDBUS_PATH_CONFIG_IPSETZDBUS_PATH_CONFIG_HELPERZ
_PK_ACTIONZPK_ACTION_POLICIESZPK_ACTION_POLICIES_INFOZPK_ACTION_CONFIGZPK_ACTION_CONFIG_INFOZPK_ACTION_DIRECTZPK_ACTION_DIRECT_INFOZPK_ACTION_INFOZ
PK_ACTION_ALL� r r �/usr/lib/python3.6/dbus.py�<module> sB __pycache__/functions.cpython-36.opt-1.pyc 0000644 00000036460 15035135171 0014363 0 ustar 00 3
��g'K � # @ s d ddddddddd d
d d d
ddddddddddddddd d d d d d!d"g#Z d#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d%l m
Z
d#d&l m Z m
Z
ejd'k Zd(d)� ed#d*�D �Zd+d� Zd,d� ZdXd.d�Zd/d0� Zd1d2� Zd3d4� Zd5d� Zd6d� Zd7d8� Zd9d� Zd:d� Z d;d"� Z d<d� Z d=d � Z d>d
� Z d?d � Z!d@d � Z"dAd
� Z#dBd� Z$dCd� Z%dDd� Z&dEdF� Z'dGd� Z(dHd� Z)dId� Z*dJd� Z+dKd� Z,dLd� Z-dMd!� Z.dNd� Z/dOd� Z0dPd� Z1dQd� Z2dRd� Z3dSd � Z4dTd � Z5dUd � Z6dVd � Z7dWd � Z8d$S )Y�PY2� getPortID� getPortRange�portStr�getServiceName�checkIP�checkIP6� checkIPnMask�
checkIP6nMask�
checkProtocol�checkInterface� checkUINT32�firewalld_is_active�tempFile�readfile� writefile�enable_ip_forwarding�
check_port�
check_address�check_single_address� check_mac�uniqify� ppid_of_pid�max_zone_name_len� checkUser�checkUid� checkCommand� checkContext�joinArgs� splitArgs�b2u�u2b�
u2b_if_py2�max_policy_name_len�stripNonPrintableCharacters� N)�log)�FIREWALLD_TEMPDIR�FIREWALLD_PIDFILE�3c C s" i | ]}|d ko|dk sd|�qS )� � N� )�.0�ir+ r+ � /usr/lib/python3.6/functions.py�
<dictcomp>. s r/ � c C st t | t�r| }nT| r | j� } y t| �}W n: tk
rb ytj| �}W n tjk
r\ dS X Y nX |dkrpdS |S )z� Check and Get port id from port string or port id using socket.getservbyname
@param port port string or port id
@return Port id if valid, -1 if port can not be found and -2 if port is too big
� i�� � ������)�
isinstance�int�strip�
ValueError�socketZ
getservbyname�error)�portZ_idr+ r+ r. r 7 s
c C s� t | t�st | t�r| S t | t�s*| j� rDt| �}|dkr@|fS |S | jd�}t|�dkr�|d j� r�|d j� r�t|d �}t|d �}|dkr�|dkr�||k r�||fS ||kr�||fS |fS g }x�tt|�dd�D ]�}tdj |d|� ��}dj ||d� �}t|�dk�rnt|�}|dk�r�|dk�r�||k �rF|j
||f� n&||k�r`|j
||f� n |j
|f� q�|dkr�|j
|f� |t|�kr�P q�W t|�dk �r�dS t|�dk�r�dS |d S )aI Get port range for port range string or single port id
@param ports an integer or port string or port range string
@return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous.
r$ �-r2 r1 Nr3 r3 ) r5 �tuple�listr6 �isdigitr �split�len�range�join�append)ZportsZid1�splitsZid2Zmatchedr- Zport2r+ r+ r. r N sL
$
�:c C sX | dkr dS t | �}t|t�r*|dk r*dS t|�dkr>d| S d|d ||d f S dS )a Create port and port range string
@param port port or port range int or [int, int]
@param delimiter of the output string for port ranges, default ':'
@return Port or port range string, empty string if port isn't specified, None if port or port range is not valid
� r$ Nr1 z%sz%s%s%s)r r5 r6 rA )r; Z delimiter�_ranger+ r+ r. r � s c C s t | �}t |�}t|�dkr�t|�dkr@t|d �t|d �kS t|�dkr�t|d �t|d �kr�t|d �t|d �kr�dS n|t|�dkr�t|�dkr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�dS dS )Nr1 r$ r2 TF)r rA r )r; rB Z_portrH r+ r+ r. �portInPortRange� s 0 00rI c C sT t | �}t|�dkr$|d |d f}tt |�}ttdd� |�dd� d�}g }x�|D ]�}|d |d kr�|d |d kr�|j|� qR|d |d kr�|d |d k r�|d |d kr�|j|� |d |d f}qR|d |d ko�|d |d ko�|d |d krR|j|� |d |d f}qRW ttdd� |��}|d |d k�rJ|d f}|g|fS )z� Coalesce a port range with existing list of port ranges
@param new_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after coalescing, list of removed original ranges)
r1 r$ c S s t | �dkr | d | d fS | S )Nr1 r$ )rA )�xr+ r+ r. �<lambda>� s z#coalescePortRange.<locals>.<lambda>c S s | d S )Nr$ r+ )rJ r+ r+ r. rK � s )�keyc S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK � s )r rA �map�sortedrD r> )Z new_range�rangesZcoalesced_range�_ranges�removed_rangesrB r+ r+ r. �coalescePortRange� s*
rR c C s� t | �} t| �dkr$| d | d f} tt |�}ttdd� |�dd� d�}g }g }�xJ|D �]@}| d |d kr�| d |d kr�|j|� qX| d |d kr�| d |d k r�| d |d kr�|j|� |j| d d |d f� qX| d |d k�r<| d |d k�r<| d |d k�r<|j|� |j|d | d d f� qX| d |d krX| d |d k rX|j|� |j|d | d d f� |j| d d |d f� qXW ttdd� |��}ttdd� |��}||fS ) z� break a port range from existing list of port ranges
@param remove_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after breaking up, list of removed original ranges)
r1 r$ c S s t | �dkr | d | d fS | S )Nr1 r$ )rA )rJ r+ r+ r. rK � s z breakPortRange.<locals>.<lambda>c S s | d S )Nr$ r+ )rJ r+ r+ r. rK � s )rL c S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK � s c S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK � s )r rA rM rN rD r> )Z remove_rangerO rP rQ Z added_rangesrB r+ r+ r. �breakPortRange� s2
$
rS c C s0 yt jt| �|�}W n t jk
r* dS X |S )z� Check and Get service name from port and proto string combination using socket.getservbyport
@param port string or id
@param protocol string
@return Service name if port and protocol are valid, else None
N)r9 Z
getservbyportr6 r: )r; �proto�namer+ r+ r. r � s
c C s. yt jt j| � W n t jk
r( dS X dS )zl Check IPv4 address.
@param ip address string
@return True if address is valid, else False
FT)r9 � inet_ptonZAF_INETr: )�ipr+ r+ r. r s
c C s
| j d�S )z� Normalize the IPv6 address
This is mostly about converting URL-like IPv6 address to normal ones.
e.g. [1234::4321] --> 1234:4321
z[])r7 )rW r+ r+ r. � normalizeIP6 s rX c C s2 yt jt jt| �� W n t jk
r, dS X dS )zl Check IPv6 address.
@param ip address string
@return True if address is valid, else False
FT)r9 rV ZAF_INET6rX r: )rW r+ r+ r. r s
c C s� d| krN| d | j d�� }| | j d�d d � }t|�dk sHt|�dk rVdS n| }d }t|�sbdS |r�d|krvt|�S y t|�}W n tk
r� dS X |dk s�|dkr�dS dS )N�/r1 F�.r$ � T)�indexrA r r6 r8 )rW �addr�maskr- r+ r+ r. r - s& c C s
| j t�S )N)� translate�NOPRINT_TRANS_TABLE)Zrule_strr+ r+ r. r# D s c C s� d| krN| d | j d�� }| | j d�d d � }t|�dk sHt|�dk rVdS n| }d }t|�sbdS |r�y t|�}W n tk
r� dS X |dk s�|dkr�dS dS )NrY r1 Fr$ � T)r\ rA r r6 r8 )rW r] r^ r- r+ r+ r. r G s" c C s` y t | �}W n: tk
rF ytj| � W n tjk
r@ dS X Y nX |dk sX|dkr\dS dS )NFr$ � T)r6 r8 r9 Zgetprotobynamer: )Zprotocolr- r+ r+ r. r
\ s c C s4 | st | �dkrdS xdD ]}|| kr dS q W dS ) z� Check interface string
@param interface string
@return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False
� F� rY �!�*T)rd rY re rf )rA )Ziface�chr+ r+ r. r k s
c C s< yt | d�}W n tk
r" dS X |dkr8|dkr8dS dS )Nr$ Fl �� T)r6 r8 )�valrJ r+ r+ r. r ~ s c C s� t jjt�sdS y"ttd��} | j� }W dQ R X W n tk
rF dS X t jjd| �s\dS y&td| d��} | j� }W dQ R X W n tk
r� dS X d|kr�dS dS )zv Check if firewalld is active
@return True if there is a firewalld pid file and the pid is used by firewalld
F�rNz/proc/%sz/proc/%s/cmdlineZ firewalldT)�os�path�existsr' �open�readline� Exception)�fd�pidZcmdliner+ r+ r. r
� s" c C sb y*t jjt�st jtd� tjddtdd�S tk
r\ } ztj d| � � W Y d d } ~ X nX d S )Ni� Zwtztemp.F)�mode�prefix�dir�deletez#Failed to create temporary file: %s)
rj rk rl r& �mkdir�tempfileZNamedTemporaryFilero r% r: )�msgr+ r+ r. r � s
c C sX y t | d��
}|j� S Q R X W n4 tk
rR } ztjd| |f � W Y d d }~X nX d S )Nri z Failed to read file "%s": %s)rm � readlinesro r% r: )�filename�f�er+ r+ r. r � s $c C s\ y$t | d��}|j|� W d Q R X W n2 tk
rV } ztjd| |f � dS d }~X nX dS )N�wz Failed to write to file "%s": %sFT)rm �writero r% r: )rz �liner{ r| r+ r+ r. r � s c C s( | dkrt dd�S | dkr$t dd�S dS )N�ipv4z /proc/sys/net/ipv4/ip_forwardz1
�ipv6z&/proc/sys/net/ipv6/conf/all/forwardingF)r )�ipvr+ r+ r. r � s
c C s | j dd�j dd�S )N�_r< z
nf-conntrack-rG )�replace)�moduler+ r+ r. �get_nf_conntrack_short_name� s r� c C s� t | �}|d
ks<|d ks<|d ks<t|�dkr�|d |d kr�|d krTtjd| � nZ|d
krltjd| � nB|d kr�tjd| � n*t|�dkr�|d |d kr�tjd| � dS d S )Nr2 r1 r$ z'%s': port > 65535z'%s': port is invalidz'%s': port is ambiguousz'%s': range start >= endFTr4 r3 r4 r3 )r rA r% Zdebug2)r; rH r+ r+ r. r � s c C s( | dkrt |�S | dkr t|�S dS d S )Nr� r� F)r r )r� �sourcer+ r+ r. r � s
c C s( | dkrt |�S | dkr t|�S dS d S )Nr� r� F)r r )r� r� r+ r+ r. r � s
c C sR t | �dkrNx dD ]}| | dkrdS qW x dD ]}| | tjkr0dS q0W dS dS )N� � r2 � � � rF Fr$ r1 � � � � � �
�
� rc T� )r2 r� r� r� r� ) r$ r1 r� r� r� r� r� r� r� r� r� rc )rA �stringZ hexdigits)Zmacr- r+ r+ r. r � s
c C s( g }x | D ]}||kr
|j |� q
W |S )N)rD )Z_list�outputrJ r+ r+ r. r � s
c C sH y.t jd| �}t|j� d j� �} |j� W n tk
rB dS X | S )z Get parent for pid z ps -o ppid -h -p %d 2>/dev/nullr$ N)rj �popenr6 ry r7 �closero )rq r{ r+ r+ r. r � s c C sB ddl m} ddlm} ttt|j� ��}d|t| � td� S )z�
iptables limits length of chain to (currently) 28 chars.
The longest chain we create is POST_<policy>_allow,
which leaves 28 - 11 = 17 chars for <policy>.
r$ )�POLICY_CHAIN_PREFIX)� SHORTCUTS� Z_allow)Zfirewall.core.ipXtablesr� �firewall.core.baser� �maxrM rA �values)r� r� �longest_shortcutr+ r+ r. r" s c C s. ddl m} ttt| j� ��}d|td� S )z�
Netfilter limits length of chain to (currently) 28 chars.
The longest chain we create is FWDI_<zone>_allow,
which leaves 28 - 11 = 17 chars for <zone>.
r$ )r� r� Z__allow)r� r� r� rM rA r� )r� r� r+ r+ r. r s c C sT t | �dk s t | �tjd�kr"dS x,| D ]$}|tjkr(|tjkr(|d kr(dS q(W dS )
Nr1 �SC_LOGIN_NAME_MAXFrZ r< r� �$T)rZ r< r� r� )rA rj �sysconfr� Z
ascii_lettersZdigits)�user�cr+ r+ r. r s
c C sD t | t�r,y t| �} W n tk
r* dS X | dkr@| dkr@dS dS ) NFr$ r2 r) r1 Tl i���)r5 �strr6 r8 )Zuidr+ r+ r. r ( s
c C sJ t | �dk st | �dkr dS xd
D ]}|| kr"dS q"W | d dkrFdS d S ) Nr1 i F�|�
� r$ rY T)r� r� r� )rA )Zcommandrg r+ r+ r. r 2 s
c C s� | j d�}t|�dkrdS |d dkr>|d dd � dkr>dS |d dd � d
krVdS |d dd � d krndS t|d �d k r�dS d
S )NrF r� r� Fr$ �rootr2 Z_ur1 Z_rZ_tr� T)r� r� r4 r4 r4 )r@ rA )�contextrE r+ r+ r. r < s
c C s8 dt t�kr djdd� | D ��S djdd� | D ��S d S )N�quoterd c s s | ]}t j|�V qd S )N)�shlexr� )r, �ar+ r+ r. � <genexpr>P s zjoinArgs.<locals>.<genexpr>c s s | ]}t j|�V qd S )N)�pipesr� )r, r� r+ r+ r. r� R s )rt r� rC )�argsr+ r+ r. r N s c C s8 t r*t| t�r*t| �} tj| �}tt|�S tj| �S d S )N)r r5 �unicoder r� r@ rM r )�_stringrE r+ r+ r. r T s
c C s t | t�r| jdd�S | S )z bytes to unicode zUTF-8r� )r5 �bytes�decode)r� r+ r+ r. r ] s
c C s t | t�s| jdd�S | S )z unicode to bytes zUTF-8r� )r5 r� �encode)r� r+ r+ r. r c s
c C s t rt| t�r| jdd�S | S )z" unicode to bytes only if Python 2zUTF-8r� )r r5 r� r� )r� r+ r+ r. r! i s )rF )9�__all__r9 rj Zos.pathr� r� r� �sysrw Zfirewall.core.loggerr% Zfirewall.configr& r' �versionr rB r` r r r rI rR rS r r rX r r r# r r
r r r
r r r r r� r r r r r r r" r r r r r r r r r r! r+ r+ r+ r. �<module> sz
:
&+
__pycache__/dbus_utils.cpython-36.opt-1.pyc 0000644 00000013117 15035135171 0014522 0 ustar 00 3
��gJ � @ s� d ddddddddd d
g Z d d lZd d lZd d lZd d
lmZ d dlmZ ejdk Z dd � Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� Zddd�Zdd� Zd dd �Zdd
� Zd S ) �command_of_pid�
pid_of_sender�
uid_of_sender� user_of_uid�context_of_sender�command_of_sender�user_of_sender�dbus_to_python�dbus_signature�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties� N)�minidom)�log�3c C sP y6t d| d�� }|j� d jdd�j� }W dQ R X W n tk
rJ dS X |S )z Get command for pid from /proc z/proc/%d/cmdline�rr � � N)�open� readlines�replace�strip� Exception)�pid�f�cmd� r � /usr/lib/python3.6/dbus_utils.pyr % s &c C sD | j dd�}tj|d�}yt|j|��}W n tk
r> dS X |S )zW Get pid from sender string using
org.freedesktop.DBus.GetConnectionUnixProcessID zorg.freedesktop.DBusz/org/freedesktop/DBusN)�
get_object�dbus� Interface�intZGetConnectionUnixProcessID�
ValueError)�bus�sender�dbus_obj�
dbus_ifacer r r r r . s c C sD | j dd�}tj|d�}yt|j|��}W n tk
r> dS X |S )zV Get user id from sender string using
org.freedesktop.DBus.GetConnectionUnixUser zorg.freedesktop.DBusz/org/freedesktop/DBusN)r r r r ZGetConnectionUnixUserr! )r" r# r$ r% �uidr r r r ; s c C s, yt j| �}W n tk
r" dS X |d S )z Get user for uid from pwd Nr )�pwd�getpwuidr )r& Zpwsr r r r H s
c
C sP | j dd�}tj|d�}y|j|�}W n tk
r: dS X djttt|���S )zl Get SELinux context from sender string using
org.freedesktop.DBus.GetConnectionSELinuxSecurityContext zorg.freedesktop.DBusz/org/freedesktop/DBusN� ) r r r Z#GetConnectionSELinuxSecurityContextr �join�map�chrr )r" r# r$ r% �contextr r r r Q s c C s t t| |��S )z Return command of D-Bus sender )r r )r" r# r r r r _ s c C s t t| |��S )N)r r )r" r# r r r r d s c C s� | d kr| }�n�t | tj�r(t| �}�n�t | tj�rNtrB| jd�nt| �}�n�trjt | tj�rjt| �}�ndt | tj �r�t| �}�nLt | tj
�s�t | tj �s�t | tj �s�t | tj
�s�t | tj�s�t | tj�s�t | tj�r�t| �}n�t | tj�r�t| �}n�t | tj��rdd� | D �}n�t | tj��r6tdd� | D ��}n�t | tj��rXdd� | j� D �}nvt | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��r�| }nt dt | � ��|d k �r�|tk�r�t |t� �s�|tk�rt |t� �s�|tk�r t |t� �s�|tk�r8t |t� �s�|tk�rPt |t� �s�|tk�rht |t� �s�|tk�r�t |t� �r�t d|t |�|f ��|S ) Nzutf-8c S s g | ] }t |��qS r )r )�.0�xr r r �
<listcomp>} s z"dbus_to_python.<locals>.<listcomp>c S s g | ] }t |��qS r )r )r. r/ r r r r0 s c S s i | ]\}}t |�t |��qS r )r )r. �k�vr r r �
<dictcomp>� s z"dbus_to_python.<locals>.<dictcomp>z Unhandled %sz%s is %s, expected %s) �
isinstancer �Boolean�bool�String�PY2�encode�str�
UTF8String�
ObjectPath�Byte�Int16�Int32�Int64�UInt16�UInt32�UInt64r �Double�float�Array�Struct�tuple�
Dictionary�items�bytes�list�dict� TypeError�repr�type)�objZ
expected_typeZ
python_objr r r r g sV
c C s> t | tj�rdS t | tj�r dS t | tj�r0dS t | tj�r@dS t | tj�rPdS t | tj�r`dS t | tj�rpdS t | tj �r�dS t | tj
�r�d S t | tj �r�d
S t | tj �r�d S t | tj
�� r�t| j�d kr�d
| j S d| j S nXt | tj�� r�d| j S t | tj��rd| j S t�r*t | tj��r*dS tdt| � ��d S )N�b�s�o�y�n�ir/ �q�u�t�d� za(%s)za%sz(%s)za{%s}z Unhandled %s)r4 r r5 r7 r< r= r> r? r@ rA rB rC rD rF �lenZ signaturerG rI r8 r; rN rO )rQ r r r r � sB
c C s� |d kr i }t | d�s"t| di � t| d�}i ||< y| j|�}W n tk
rZ i }Y nX xV|j� D ]J\}}dt|�i|| |< ||kr�|| || | d< qfd|| | d< qfW d S )N�_fw_dbus_propertiesrP �access�read)�hasattr�setattr�getattrZGetAllr rJ r )rQ � interfacer_ �dipZ_dict�key�valuer r r r
� s
c
C s� t j|�}t| d�r�x�|jd�D ]�}|jd�r |jd�|kr i }t| d�rTt| d�}||kr xX|| j� D ]H\}}|jd�}|j d|� |j d|d � |j d|d � |j
|� qjW q W t j |j
� � |j
� } |j� | S )Nr^ rd �name�propertyrP r_ )r
Z parseStringra ZgetElementsByTagNameZ hasAttributeZ getAttributerc rJ Z
createElementZ setAttributeZ appendChildr Zdebug10Ztoxml�unlink)
rQ �datard �docZnodere rf rg ZpropZnew_datar r r r � s&
)N)N)�__all__r r' �sysZxml.domr
Zfirewall.core.loggerr �versionr8 r r r r r r r r r r
r r r r r �<module> s*
0%
__pycache__/errors.cpython-36.opt-1.pyc 0000644 00000007340 15035135171 0013662 0 ustar 00 3
��g� � @ s� d Z dZdZdZdZdZdZdZdZd Z d
Z
d Z d Z d
Z
dZdZdZdZdZdZdZdZdZdZdZdZdZdZd Z d Z d Z d Z d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)d*Z*d+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDZDdEZEdFZFdGZGdHZHdIZIdJZJdKZKdLZLdMZMdNZNdOZOdPZPdQdRlQZQG dSdT� dTeR�ZSeQjTeSjU ZVdUdV� eWeV�D �eS_XdWdV� eSjXD �eS_YdRS )X� � �
� � � � � � � � � � � � � � � � � � � �! �" �# �$ �% �& �d �e �f �g �h �i �j �k �l �m �n �o �p �q �r �s �t �u �v �w �x �y �z �{ �| �} �~ � � � � � � � � � � � � � � �� �� �� �� �� �� �� �� � � � � � Nc @ s6 e Zd Zd
dd�Zdd� Zdd� Zdd � Zee�ZdS ) �
FirewallErrorNc C sR || _ |d k rHtjdk rHy t|�}W n" tk
rF t|�jd�}Y nX || _d S )N�3Zunicode_escape)�code�sys�version�str�UnicodeEncodeErrorZunicode�encode�msg)�selfrU r[ �x� r^ � /usr/lib/python3.6/errors.py�__init__n s
zFirewallError.__init__c C s d| j | j| jf S )Nz
%s(%r, %r))� __class__rU r[ )r\ r^ r^ r_ �__repr__y s zFirewallError.__repr__c C s( | j r d| j| j | j f S | j| j S )Nz%s: %s)r[ �errorsrU )r\ r^ r^ r_ �__str__| s zFirewallError.__str__c C sP d| kr | j d�}| d |� }n| }ytj| }W n tk
rJ t}Y nX |S )N�:)�indexrS �codes�KeyError�
UNKNOWN_ERROR)r[ �idxZecoderU r^ r^ r_ �get_code� s
zFirewallError.get_code)N)�__name__�
__module__� __qualname__r` rb rd rk � staticmethodr^ r^ r^ r_ rS m s
rS c C s6 i | ].}|j d � rttt|��tkr|tt|��qS )�_)�
startswith�type�getattr�mod�int)�.0Zvarnamer^ r^ r_ �
<dictcomp>� s rw c C s i | ]}|t j| �qS r^ )rS rc )rv rU r^ r^ r_ rw � s )ZZALREADY_ENABLEDZ NOT_ENABLEDZCOMMAND_FAILEDZ NO_IPV6_NATZ
PANIC_MODEZZONE_ALREADY_SETZUNKNOWN_INTERFACEZ
ZONE_CONFLICTZ
BUILTIN_CHAINZEBTABLES_NO_REJECTZNOT_OVERLOADABLEZ NO_DEFAULTSZ BUILTIN_ZONEZBUILTIN_SERVICEZBUILTIN_ICMPTYPEZ
NAME_CONFLICTZ
NAME_MISMATCHZ PARSE_ERRORZ
ACCESS_DENIEDZUNKNOWN_SOURCEZRT_TO_PERM_FAILEDZIPSET_WITH_TIMEOUTZ
BUILTIN_IPSETZ ALREADY_SETZMISSING_IMPORTZ
DBUS_ERRORZBUILTIN_HELPERZ NOT_APPLIEDZINVALID_ACTIONZINVALID_SERVICEZ INVALID_PORTZINVALID_PROTOCOLZINVALID_INTERFACEZ INVALID_ADDRZINVALID_FORWARDZINVALID_ICMPTYPEZ
INVALID_TABLEZ
INVALID_CHAINZINVALID_TARGETZ INVALID_IPVZ INVALID_ZONEZINVALID_PROPERTYZ
INVALID_VALUEZINVALID_OBJECTZ INVALID_NAMEZINVALID_FILENAMEZINVALID_DIRECTORYZ INVALID_TYPEZINVALID_SETTINGZINVALID_DESTINATIONZ INVALID_RULEZ
INVALID_LIMITZINVALID_FAMILYZINVALID_LOG_LEVELZINVALID_AUDIT_TYPEZ INVALID_MARKZINVALID_CONTEXTZINVALID_COMMANDZ INVALID_USERZ INVALID_UIDZINVALID_MODULEZINVALID_PASSTHROUGHZ INVALID_MACZ
INVALID_IPSETZ
INVALID_ENTRYZINVALID_OPTIONZINVALID_HELPERZINVALID_PRIORITYZINVALID_POLICYZ
MISSING_TABLEZ
MISSING_CHAINZ MISSING_PORTZMISSING_PROTOCOLZ MISSING_ADDRZ MISSING_NAMEZMISSING_SETTINGZMISSING_FAMILYZRUNNING_BUT_FAILEDZ NOT_RUNNINGZNOT_AUTHORIZEDri rV � ExceptionrS �modulesrm rt �dirrc rg r^ r^ r^ r_ �<module> s� $ __pycache__/client.cpython-36.pyc 0000644 00000426232 15035135171 0012672 0 ustar 00 3
��g� � @ s� d dl mZmZ d dlZeejd< d dlZd dlZd dl m Z d dl
m Z d dl m
Z
mZmZ d dlmZ d dlmZ d d lmZ d d
lmZmZmZ d d l
mZ d d lm Z d dlZd dl Z da d
a e dd� �Z G dd� de!�Z"G dd� de!�Z#G dd� de!�Z$G dd� de!�Z%G dd� de!�Z&G dd� de!�Z'G d d � d e!�Z(G d d � d e!�Z)G d d!� d!e!�Z*G d"d#� d#e!�Z+G d$d%� d%e!�Z,G d&d'� d'e!�Z-G d(d)� d)e!�Z.G d*d+� d+e!�Z/G d,d-� d-e!�Z0G d.d/� d/e!�Z1G d0d1� d1e!�Z2G d2d3� d3e!�Z3dS )4� )�GLib�GObjectNZgobject)� decorator)�config)�DEFAULT_ZONE_TARGET�DEFAULT_POLICY_TARGET�DEFAULT_POLICY_PRIORITY)�dbus_to_python)�b2u)� Rich_Rule)�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�errors)�
FirewallErrorFc O s d}�x|�sy
| ||�S t jjk
r� } zb|j� }|j� }tsD� d|krVtd� n4d|krht|� n"d}|rzt|� nttt|��� W Y dd}~X nf tk
r� } z ts�� nttt|��� W Y dd}~X n. t k
� r� ts� nttt
j � �� Y nX t sP qW dS )z#Decorator to handle exceptions
FZNotAuthorizedExceptionzorg.freedesktop.DBus.ErrorTN)
�dbus�
exceptions�
DBusException�get_dbus_messageZ
get_dbus_name�exception_handlerr
�strr � Exception� traceback�
format_exc�not_authorized_loop)�func�args�kwargsZ
authorized�eZ dbus_messageZ dbus_name� r � /usr/lib/python3.6/client.py�handle_exceptions0 s6
r! c @ s� e Zd Zed�dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%edFdG� �Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-e.j/j0j1edVdW� ��Z2e.j/j0j1edXdY� ��Z3e.j/j0j1edZd[� ��Z4ed\d]� �Z5ed^d_� �Z6e.j/j0j1ed`da� ��Z7e.j/j0j1edbdc� ��Z8e.j/j0j1eddde� ��Z9edfdg� �Z:edhdi� �Z;e.j/j0j1edjdk� ��Z<e.j/j0j1edldm� ��Z=e.j/j0j1edndo� ��Z>edpdq� �Z?edrds� �Z@edtdu� �ZAedvdw� �ZBedxdy� �ZCedzd{� �ZDed|d}� �ZEed~d� �ZFed�d�� �ZGed�d�� �ZHed�d�� �ZIed�d�� �ZJed�d�� �ZKed�d�� �ZLed�d�� �ZMed�d�� �ZNed�d�� �ZOed�d�� �ZPed�d�� �ZQed�d�� �ZRdS )��FirewallClientZoneSettingsNc C s� ddddt g g g dg g g g g g ddg| _ddddddd d
d d d
ddddddg| _dddddddddddddddddg| _|r�t|t�r�x"t|�D ]\}}|| | j|< q�W t|t�r�| j|� d S )N� F�version�short� description�UNUSED�target�services�ports� icmp_blocks�
masquerade�
forward_ports�
interfaces�sourcesZ rules_str� protocols� source_portsZicmp_block_inversion�forward�s�bz(ss)z(ssss)) r �settings�
settings_name�settings_dbus_type�
isinstance�list� enumerate�dict�setSettingsDict)�selfr5 �i�vr r r �__init__X s(
z#FirewallClientZoneSettings.__init__c C s d| j | jf S )Nz%s(%r))� __class__r5 )r= r r r �__repr__o s z#FirewallClientZoneSettings.__repr__c C s6 i }x,t | j| j�D ]\}}|dkr&q|||< qW |S )Nr' )�zipr6 r5 )r= r5 �key�valuer r r �getSettingsDicts s z*FirewallClientZoneSettings.getSettingsDictc C s( x"|D ]}|| | j | jj|�< qW d S )N)r5 r6 �index)r= r5 rD r r r r< { s
z*FirewallClientZoneSettings.setSettingsDictc C s| i }xrt | j| j| j�D ]\\}}}|dkr,qt|�tkrLtj||d�||< qt|�tkrltj ||d�||< q|||< qW |S )Nr' )� signature)
rC r6 r5 r7 �typer9 r �Arrayr; �
Dictionary)r= r5 rD rE �sigr r r �getSettingsDbusDict s z.FirewallClientZoneSettings.getSettingsDbusDictc C s$ | j � }|d= |d= |d= |d= |S )Nr$ r% r& r( )rF )r= r5 r r r �getRuntimeSettingsDict� s z1FirewallClientZoneSettings.getRuntimeSettingsDictc C s$ | j � }|d= |d= |d= |d= |S )Nr$ r% r& r( )rM )r= r5 r r r �getRuntimeSettingsDbusDict� s z5FirewallClientZoneSettings.getRuntimeSettingsDbusDictc C s
| j d S )Nr )r5 )r= r r r �
getVersion� s z%FirewallClientZoneSettings.getVersionc C s || j d< d S )Nr )r5 )r= r$ r r r �
setVersion� s z%FirewallClientZoneSettings.setVersionc C s
| j d S )N� )r5 )r= r r r �getShort� s z#FirewallClientZoneSettings.getShortc C s || j d< d S )NrR )r5 )r= r% r r r �setShort� s z#FirewallClientZoneSettings.setShortc C s
| j d S )N� )r5 )r= r r r �getDescription� s z)FirewallClientZoneSettings.getDescriptionc C s || j d< d S )NrU )r5 )r= r& r r r �setDescription� s z)FirewallClientZoneSettings.setDescriptionc C s | j d tkr| j d S dS )N� �default)r5 r )r= r r r � getTarget� s z$FirewallClientZoneSettings.getTargetc C s |dkr |nt | jd< d S )NrY rX )r r5 )r= r( r r r � setTarget� s z$FirewallClientZoneSettings.setTargetc C s
| j d S )N� )r5 )r= r r r � getServices� s z&FirewallClientZoneSettings.getServicesc C s || j d< d S )Nr\ )r5 )r= r) r r r � setServices� s z&FirewallClientZoneSettings.setServicesc C s0 || j d kr | j d j|� n ttj|��d S )Nr\ )r5 �appendr r �ALREADY_ENABLED)r= �servicer r r �
addService� s z%FirewallClientZoneSettings.addServicec C s0 || j d kr | j d j|� n ttj|��d S )Nr\ )r5 �remover r � NOT_ENABLED)r= ra r r r �
removeService� s z(FirewallClientZoneSettings.removeServicec C s || j d kS )Nr\ )r5 )r= ra r r r � queryService� s z'FirewallClientZoneSettings.queryServicec C s
| j d S )N� )r5 )r= r r r �getPorts� s z#FirewallClientZoneSettings.getPortsc C s || j d< d S )Nrg )r5 )r= r* r r r �setPorts� s z#FirewallClientZoneSettings.setPortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nrg z'%s:%s')r5 r_ r r r` )r= �port�protocolr r r �addPort� s z"FirewallClientZoneSettings.addPortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nrg z'%s:%s')r5 rc r r rd )r= rj rk r r r �
removePort� s z%FirewallClientZoneSettings.removePortc C s ||f| j d kS )Nrg )r5 )r= rj rk r r r � queryPort� s z$FirewallClientZoneSettings.queryPortc C s
| j d S )N�
)r5 )r= r r r � getProtocols� s z'FirewallClientZoneSettings.getProtocolsc C s || j d< d S )Nro )r5 )r= r0 r r r � setProtocols� s z'FirewallClientZoneSettings.setProtocolsc C s0 || j d kr | j d j|� n ttj|��d S )Nro )r5 r_ r r r` )r= rk r r r � addProtocol� s z&FirewallClientZoneSettings.addProtocolc C s0 || j d kr | j d j|� n ttj|��d S )Nro )r5 rc r r rd )r= rk r r r �removeProtocol� s z)FirewallClientZoneSettings.removeProtocolc C s || j d kS )Nro )r5 )r= rk r r r �
queryProtocol� s z(FirewallClientZoneSettings.queryProtocolc C s
| j d S )N� )r5 )r= r r r �getSourcePorts s z)FirewallClientZoneSettings.getSourcePortsc C s || j d< d S )Nru )r5 )r= r* r r r �setSourcePorts s z)FirewallClientZoneSettings.setSourcePortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nru z'%s:%s')r5 r_ r r r` )r= rj rk r r r �
addSourcePort s z(FirewallClientZoneSettings.addSourcePortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nru z'%s:%s')r5 rc r r rd )r= rj rk r r r �removeSourcePort s z+FirewallClientZoneSettings.removeSourcePortc C s ||f| j d kS )Nru )r5 )r= rj rk r r r �querySourcePort s z*FirewallClientZoneSettings.querySourcePortc C s
| j d S )N� )r5 )r= r r r �
getIcmpBlocks s z(FirewallClientZoneSettings.getIcmpBlocksc C s || j d< d S )Nr{ )r5 )r= �
icmpblocksr r r �
setIcmpBlocks s z(FirewallClientZoneSettings.setIcmpBlocksc C s0 || j d kr | j d j|� n ttj|��d S )Nr{ )r5 r_ r r r` )r= �icmptyper r r � addIcmpBlock s z'FirewallClientZoneSettings.addIcmpBlockc C s0 || j d kr | j d j|� n ttj|��d S )Nr{ )r5 rc r r rd )r= r r r r �removeIcmpBlock& s z*FirewallClientZoneSettings.removeIcmpBlockc C s || j d kS )Nr{ )r5 )r= r r r r �queryIcmpBlock, s z)FirewallClientZoneSettings.queryIcmpBlockc C s
| j d S )N� )r5 )r= r r r �getIcmpBlockInversion0 s z0FirewallClientZoneSettings.getIcmpBlockInversionc C s || j d< d S )Nr� )r5 )r= �flagr r r �setIcmpBlockInversion3 s z0FirewallClientZoneSettings.setIcmpBlockInversionc C s& | j d sd| j d< n ttjd� d S )Nr� Tzicmp-block-inversion)r5 r r r` )r= r r r �addIcmpBlockInversion6 s
z0FirewallClientZoneSettings.addIcmpBlockInversionc C s& | j d rd| j d< n ttjd� d S )Nr� Fzicmp-block-inversion)r5 r r rd )r= r r r �removeIcmpBlockInversion= s
z3FirewallClientZoneSettings.removeIcmpBlockInversionc C s
| j d S )Nr� )r5 )r= r r r �queryIcmpBlockInversionD s z2FirewallClientZoneSettings.queryIcmpBlockInversionc C s
| j d S )N� )r5 )r= r r r �
getForwardI s z%FirewallClientZoneSettings.getForwardc C s || j d< d S )Nr� )r5 )r= r2 r r r �
setForwardL s z%FirewallClientZoneSettings.setForwardc C s& | j d sd| j d< n ttjd� d S )Nr� Tr2 )r5 r r r` )r= r r r �
addForwardO s
z%FirewallClientZoneSettings.addForwardc C s& | j d rd| j d< n ttjd� d S )Nr� Fr2 )r5 r r rd )r= r r r �
removeForwardV s
z(FirewallClientZoneSettings.removeForwardc C s
| j d S )Nr� )r5 )r= r r r � queryForward] s z'FirewallClientZoneSettings.queryForwardc C s
| j d S )N� )r5 )r= r r r �
getMasqueradeb s z(FirewallClientZoneSettings.getMasqueradec C s || j d< d S )Nr� )r5 )r= r, r r r �
setMasqueradee s z(FirewallClientZoneSettings.setMasqueradec C s& | j d sd| j d< n ttjd� d S )Nr� Tr, )r5 r r r` )r= r r r �
addMasqueradeh s
z(FirewallClientZoneSettings.addMasqueradec C s& | j d rd| j d< n ttjd� d S )Nr� Fr, )r5 r r rd )r= r r r �removeMasqueradeo s
z+FirewallClientZoneSettings.removeMasqueradec C s
| j d S )Nr� )r5 )r= r r r �queryMasqueradev s z*FirewallClientZoneSettings.queryMasqueradec C s
| j d S )N� )r5 )r= r r r �getForwardPorts{ s z*FirewallClientZoneSettings.getForwardPortsc C s || j d< d S )Nr� )r5 )r= r* r r r �setForwardPorts~ s z*FirewallClientZoneSettings.setForwardPortsc C sd |d kr d}|d krd}||||f| j d krH| j d j||||f� nttjd||||f ��d S )Nr# r� z
'%s:%s:%s:%s')r5 r_ r r r` )r= rj rk �to_port�to_addrr r r �addForwardPort� s z)FirewallClientZoneSettings.addForwardPortc C sd |d kr d}|d krd}||||f| j d krH| j d j||||f� nttjd||||f ��d S )Nr# r� z
'%s:%s:%s:%s')r5 rc r r rd )r= rj rk r� r� r r r �removeForwardPort� s z,FirewallClientZoneSettings.removeForwardPortc C s. |d kr d}|d krd}||||f| j d kS )Nr# r� )r5 )r= rj rk r� r� r r r �queryForwardPort� s
z+FirewallClientZoneSettings.queryForwardPortc C s
| j d S )N�
)r5 )r= r r r �
getInterfaces� s z(FirewallClientZoneSettings.getInterfacesc C s || j d< d S )Nr� )r5 )r= r. r r r �
setInterfaces� s z(FirewallClientZoneSettings.setInterfacesc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= � interfacer r r � addInterface� s z'FirewallClientZoneSettings.addInterfacec C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r� r r r �removeInterface� s z*FirewallClientZoneSettings.removeInterfacec C s || j d kS )Nr� )r5 )r= r� r r r �queryInterface� s z)FirewallClientZoneSettings.queryInterfacec C s
| j d S )N� )r5 )r= r r r �
getSources� s z%FirewallClientZoneSettings.getSourcesc C s || j d< d S )Nr� )r5 )r= r/ r r r �
setSources� s z%FirewallClientZoneSettings.setSourcesc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= �sourcer r r � addSource� s z$FirewallClientZoneSettings.addSourcec C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r� r r r � removeSource� s z'FirewallClientZoneSettings.removeSourcec C s || j d kS )Nr� )r5 )r= r� r r r � querySource� s z&FirewallClientZoneSettings.querySourcec C s
| j d S )N� )r5 )r= r r r � getRichRules� s z'FirewallClientZoneSettings.getRichRulesc C s dd� |D �}|| j d< d S )Nc S s g | ]}t t|d ���qS ))�rule_str)r r )�.0�rr r r �
<listcomp>� s z;FirewallClientZoneSettings.setRichRules.<locals>.<listcomp>r� )r5 )r= �rulesr r r � setRichRules� s z'FirewallClientZoneSettings.setRichRulesc C s> t t|d��}|| jd kr.| jd j|� n ttj|��d S )N)r� r� )r r r5 r_ r r r` )r= �ruler r r � addRichRule� s z&FirewallClientZoneSettings.addRichRulec C s> t t|d��}|| jd kr.| jd j|� n ttj|��d S )N)r� r� )r r r5 rc r r rd )r= r� r r r �removeRichRule� s z)FirewallClientZoneSettings.removeRichRulec C s t t|d��}|| jd kS )N)r� r� )r r r5 )r= r� r r r �
queryRichRule� s z(FirewallClientZoneSettings.queryRichRule)N)S�__name__�
__module__� __qualname__r! r@ rB rF r< rM rN rO rP rQ rS rT rV rW rZ r[ r] r^ rb re rf rh ri rl rm rn rp rq rr rs rt rv rw rx ry rz r| r~ r� r� r� r� r� �slipr �polkit� enable_proxyr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r" W s�
r" c @ s� e Zd Zdd� Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zejjjed)d*� ��Z ejjjed+d,� ��Z ejjjed-d.� ��Z ejjjed/d0� ��Z ejjjed1d2� ��Z ejjjed3d4� ��Z!ejjjed5d6� ��Z"ejjjed7d8� ��Z#ejjjed9d:� ��Z$ejjjed;d<� ��Z%ejjjed=d>� ��Z&ejjjed?d@� ��Z'ejjjedAdB� ��Z(ejjjedCdD� ��Z)ejjjedEdF� ��Z*ejjjedGdH� ��Z+ejjjedIdJ� ��Z,ejjjedKdL� ��Z-ejjjedMdN� ��Z.ejjjedOdP� ��Z/ejjjedQdR� ��Z0ejjjedSdT� ��Z1ejjjedUdV� ��Z2ejjjedWdX� ��Z3ejjjedYdZ� ��Z4ejjjed[d\� ��Z5ejjjed]d^� ��Z6ejjjed_d`� ��Z7ejjjedadb� ��Z8ejjjedcdd� ��Z9ejjjededf� ��Z:ejjjedgdh� ��Z;ejjjedidj� ��Z<ejjjedkdl� ��Z=ejjjedmdn� ��Z>ejjjedodp� ��Z?ejjjedqdr� ��Z@ejjjedsdt� ��ZAejjjedudv� ��ZBejjjedwdx� ��ZCejjjedydz� ��ZDejjjed{d|� ��ZEejjjed}d~� ��ZFejjjedd�� ��ZGejjjed�d�� ��ZHejjjed�d�� ��ZIejjjed�d�� ��ZJejjjed�d�� ��ZKejjjed�d�� ��ZLejjjed�d�� ��ZMejjjed�d�� ��ZNejjjed�d�� ��ZOejjjed�d�� ��ZPejjjed�d�� ��ZQejjjed�d�� ��ZRejjjed�d�� ��ZSejjjed�d�� ��ZTd�S )��FirewallClientConfigZonec C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)�dbus_interfacez org.freedesktop.DBus.Properties) �bus�path�
get_objectr r �DBUS_INTERFACE�dbus_obj� Interface�DBUS_INTERFACE_CONFIG_ZONE�fw_zone�
fw_properties)r= r� r� r r r r@ � s z!FirewallClientConfigZone.__init__c C s t | jjtjj|��S )N)r r� �Getr r r� )r= �propr r r � get_property� s z%FirewallClientConfigZone.get_propertyc C s t | jjtjj��S )N)r r� �GetAllr r r� )r= r r r �get_properties� s z'FirewallClientConfigZone.get_propertiesc C s | j jtjj||� d S )N)r� �Setr r r� )r= r� rE r r r � set_property s z%FirewallClientConfigZone.set_propertyc C s t t| jj� ��S )N)r" r r� � getSettings2)r= r r r � getSettings s z$FirewallClientConfigZone.getSettingsc C s | j j|j� � d S )N)r� �update2rM )r= r5 r r r �update s z FirewallClientConfigZone.updatec C s | j j� d S )N)r� � loadDefaults)r= r r r r� s z%FirewallClientConfigZone.loadDefaultsc C s | j j� d S )N)r� rc )r= r r r rc s z FirewallClientConfigZone.removec C s | j j|� d S )N)r� �rename)r= �namer r r r� s z FirewallClientConfigZone.renamec C s
| j j� S )N)r� rP )r= r r r rP " s z#FirewallClientConfigZone.getVersionc C s | j j|� d S )N)r� rQ )r= r$ r r r rQ ' s z#FirewallClientConfigZone.setVersionc C s
| j j� S )N)r� rS )r= r r r rS . s z!FirewallClientConfigZone.getShortc C s | j j|� d S )N)r� rT )r= r% r r r rT 3 s z!FirewallClientConfigZone.setShortc C s
| j j� S )N)r� rV )r= r r r rV : s z'FirewallClientConfigZone.getDescriptionc C s | j j|� d S )N)r� rW )r= r& r r r rW ? s z'FirewallClientConfigZone.setDescriptionc C s
| j j� S )N)r� rZ )r= r r r rZ F s z"FirewallClientConfigZone.getTargetc C s | j j|� d S )N)r� r[ )r= r( r r r r[ K s z"FirewallClientConfigZone.setTargetc C s
| j j� S )N)r� r] )r= r r r r] R s z$FirewallClientConfigZone.getServicesc C s | j j|� d S )N)r� r^ )r= r) r r r r^ W s z$FirewallClientConfigZone.setServicesc C s | j j|� d S )N)r� rb )r= ra r r r rb \ s z#FirewallClientConfigZone.addServicec C s | j j|� d S )N)r� re )r= ra r r r re a s z&FirewallClientConfigZone.removeServicec C s | j j|�S )N)r� rf )r= ra r r r rf f s z%FirewallClientConfigZone.queryServicec C s
| j j� S )N)r� rh )r= r r r rh m s z!FirewallClientConfigZone.getPortsc C s | j j|� d S )N)r� ri )r= r* r r r ri r s z!FirewallClientConfigZone.setPortsc C s | j j||� d S )N)r� rl )r= rj rk r r r rl w s z FirewallClientConfigZone.addPortc C s | j j||� d S )N)r� rm )r= rj rk r r r rm | s z#FirewallClientConfigZone.removePortc C s | j j||�S )N)r� rn )r= rj rk r r r rn � s z"FirewallClientConfigZone.queryPortc C s
| j j� S )N)r� rp )r= r r r rp � s z%FirewallClientConfigZone.getProtocolsc C s | j j|� d S )N)r� rq )r= r0 r r r rq � s z%FirewallClientConfigZone.setProtocolsc C s | j j|� d S )N)r� rr )r= rk r r r rr � s z$FirewallClientConfigZone.addProtocolc C s | j j|� d S )N)r� rs )r= rk r r r rs � s z'FirewallClientConfigZone.removeProtocolc C s | j j|�S )N)r� rt )r= rk r r r rt � s z&FirewallClientConfigZone.queryProtocolc C s
| j j� S )N)r� rv )r= r r r rv � s z'FirewallClientConfigZone.getSourcePortsc C s | j j|� d S )N)r� rw )r= r* r r r rw � s z'FirewallClientConfigZone.setSourcePortsc C s | j j||� d S )N)r� rx )r= rj rk r r r rx � s z&FirewallClientConfigZone.addSourcePortc C s | j j||� d S )N)r� ry )r= rj rk r r r ry � s z)FirewallClientConfigZone.removeSourcePortc C s | j j||�S )N)r� rz )r= rj rk r r r rz � s z(FirewallClientConfigZone.querySourcePortc C s
| j j� S )N)r� r| )r= r r r r| � s z&FirewallClientConfigZone.getIcmpBlocksc C s | j j|� d S )N)r� r~ )r= Z icmptypesr r r r~ � s z&FirewallClientConfigZone.setIcmpBlocksc C s | j j|� d S )N)r� r� )r= r r r r r� � s z%FirewallClientConfigZone.addIcmpBlockc C s | j j|� d S )N)r� r� )r= r r r r r� � s z(FirewallClientConfigZone.removeIcmpBlockc C s | j j|�S )N)r� r� )r= r r r r r� � s z'FirewallClientConfigZone.queryIcmpBlockc C s
| j j� S )N)r� r� )r= r r r r� � s z.FirewallClientConfigZone.getIcmpBlockInversionc C s | j j|� d S )N)r� r� )r= Z inversionr r r r� � s z.FirewallClientConfigZone.setIcmpBlockInversionc C s | j j� d S )N)r� r� )r= r r r r� � s z.FirewallClientConfigZone.addIcmpBlockInversionc C s | j j� d S )N)r� r� )r= r r r r� � s z1FirewallClientConfigZone.removeIcmpBlockInversionc C s
| j j� S )N)r� r� )r= r r r r� � s z0FirewallClientConfigZone.queryIcmpBlockInversionc C s | j j� d S )Nr2 )r� r� )r= r r r r� � s z#FirewallClientConfigZone.getForwardc C s | j jd|i� d S )Nr2 )r� r� )r= r2 r r r r� � s z#FirewallClientConfigZone.setForwardc C s | j jddi� d S )Nr2 T)r� r� )r= r r r r� � s z#FirewallClientConfigZone.addForwardc C s | j jddi� d S )Nr2 F)r� r� )r= r r r r� s z&FirewallClientConfigZone.removeForwardc C s | j j� d S )Nr2 )r� r� )r= r r r r� s z%FirewallClientConfigZone.queryForwardc C s
| j j� S )N)r� r� )r= r r r r� s z&FirewallClientConfigZone.getMasqueradec C s | j j|� d S )N)r� r� )r= r, r r r r� s z&FirewallClientConfigZone.setMasqueradec C s | j j� d S )N)r� r� )r= r r r r� s z&FirewallClientConfigZone.addMasqueradec C s | j j� d S )N)r� r� )r= r r r r� s z)FirewallClientConfigZone.removeMasqueradec C s
| j j� S )N)r� r� )r= r r r r� # s z(FirewallClientConfigZone.queryMasqueradec C s
| j j� S )N)r� r� )r= r r r r� * s z(FirewallClientConfigZone.getForwardPortsc C s | j j|� d S )N)r� r� )r= r* r r r r� / s z(FirewallClientConfigZone.setForwardPortsc C s. |d kr d}|d krd}| j j||||� d S )Nr# )r� r� )r= rj rk �toport�toaddrr r r r� 4 s
z'FirewallClientConfigZone.addForwardPortc C s. |d kr d}|d krd}| j j||||� d S )Nr# )r� r� )r= rj rk r� r� r r r r� = s
z*FirewallClientConfigZone.removeForwardPortc C s* |d kr d}|d krd}| j j||||�S )Nr# )r� r� )r= rj rk r� r� r r r r� F s
z)FirewallClientConfigZone.queryForwardPortc C s
| j j� S )N)r� r� )r= r r r r� Q s z&FirewallClientConfigZone.getInterfacesc C s | j j|� d S )N)r� r� )r= r. r r r r� V s z&FirewallClientConfigZone.setInterfacesc C s | j j|� d S )N)r� r� )r= r� r r r r� [ s z%FirewallClientConfigZone.addInterfacec C s | j j|� d S )N)r� r� )r= r� r r r r� ` s z(FirewallClientConfigZone.removeInterfacec C s | j j|�S )N)r� r� )r= r� r r r r� e s z'FirewallClientConfigZone.queryInterfacec C s
| j j� S )N)r� r� )r= r r r r� l s z#FirewallClientConfigZone.getSourcesc C s | j j|� d S )N)r� r� )r= r/ r r r r� q s z#FirewallClientConfigZone.setSourcesc C s | j j|� d S )N)r� r� )r= r� r r r r� v s z"FirewallClientConfigZone.addSourcec C s | j j|� d S )N)r� r� )r= r� r r r r� { s z%FirewallClientConfigZone.removeSourcec C s | j j|�S )N)r� r� )r= r� r r r r� � s z$FirewallClientConfigZone.querySourcec C s
| j j� S )N)r� r� )r= r r r r� � s z%FirewallClientConfigZone.getRichRulesc C s | j j|� d S )N)r� r� )r= r� r r r r� � s z%FirewallClientConfigZone.setRichRulesc C s | j j|� d S )N)r� r� )r= r� r r r r� � s z$FirewallClientConfigZone.addRichRulec C s | j j|� d S )N)r� r� )r= r� r r r r� � s z'FirewallClientConfigZone.removeRichRulec C s | j j|�S )N)r� r� )r= r� r r r r� � s z&FirewallClientConfigZone.queryRichRuleN)Ur� r� r� r@ r� r r� r� r! r� r� r� r� r� r� rc r� rP rQ rS rT rV rW rZ r[ r] r^ rb re rf rh ri rl rm rn rp rq rr rs rt rv rw rx ry rz r| r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� � s2
r� c @ s@ e Zd Zed�dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zd d
� Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%edFdG� �Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,e-j.j/j0edTdU� ��Z1e-j.j/j0edVdW� ��Z2e-j.j/j0edXdY� ��Z3edZd[� �Z4ed\d]� �Z5ed^d_� �Z6ed`da� �Z7edbdc� �Z8eddde� �Z9edfdg� �Z:edhdi� �Z;edjdk� �Z<edldm� �Z=edndo� �Z>edpdq� �Z?edrds� �Z@edtdu� �ZAedvdw� �ZBedxdy� �ZCedzd{� �ZDed|d}� �ZEed~d� �ZFed�d�� �ZGed�d�� �ZHed�d�� �ZIdS )�� FirewallClientPolicySettingsNc C s\ dg g g g dg t g g g dg tdd�| _dddddddddddddddg| _|rX| j|� d S ) Nr# F)r& � egress_zonesr- r+ �
ingress_zonesr, r* �priorityr0 �
rich_rulesr) r% r1 r( r$ r3 z(ssss)r4 z(ss)r> )r r r5 r7 r< )r= r5 r r r r@ � s,
z%FirewallClientPolicySettings.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB � s z%FirewallClientPolicySettings.__repr__c C s | j S )N)r5 )r= r r r rF � s z,FirewallClientPolicySettings.getSettingsDictc C s x|D ]}|| | j |< qW d S )N)r5 )r= r5 rD r r r r< � s
z,FirewallClientPolicySettings.setSettingsDictc C sv i }xlt | j| j�D ]Z\}}| j| }t|�tkrFtj||d�||< qt|�tkrftj||d�||< q|||< qW |S )N)rH ) rC r5 r7 rI r9 r rJ r; rK )r= r5 rD rL rE r r r rM � s
z0FirewallClientPolicySettings.getSettingsDbusDictc C s | j � }xdD ]
}||= qW |S )Nr$ r% r& r( )r$ r% r& r( )rM )r= r5 rD r r r rO � s
z7FirewallClientPolicySettings.getRuntimeSettingsDbusDictc C s
| j d S )Nr$ )r5 )r= r r r rP � s z'FirewallClientPolicySettings.getVersionc C s || j d< d S )Nr$ )r5 )r= r$ r r r rQ � s z'FirewallClientPolicySettings.setVersionc C s
| j d S )Nr% )r5 )r= r r r rS � s z%FirewallClientPolicySettings.getShortc C s || j d< d S )Nr% )r5 )r= r% r r r rT � s z%FirewallClientPolicySettings.setShortc C s
| j d S )Nr& )r5 )r= r r r rV � s z+FirewallClientPolicySettings.getDescriptionc C s || j d< d S )Nr& )r5 )r= r& r r r rW � s z+FirewallClientPolicySettings.setDescriptionc C s
| j d S )Nr( )r5 )r= r r r rZ � s z&FirewallClientPolicySettings.getTargetc C s || j d< d S )Nr( )r5 )r= r( r r r r[ � s z&FirewallClientPolicySettings.setTargetc C s
| j d S )Nr) )r5 )r= r r r r] � s z(FirewallClientPolicySettings.getServicesc C s || j d< d S )Nr) )r5 )r= r) r r r r^ � s z(FirewallClientPolicySettings.setServicesc C s0 || j d kr | j d j|� n ttj|��d S )Nr) )r5 r_ r r r` )r= ra r r r rb � s z'FirewallClientPolicySettings.addServicec C s0 || j d kr | j d j|� n ttj|��d S )Nr) )r5 rc r r rd )r= ra r r r re s z*FirewallClientPolicySettings.removeServicec C s || j d kS )Nr) )r5 )r= ra r r r rf s z)FirewallClientPolicySettings.queryServicec C s
| j d S )Nr* )r5 )r= r r r rh
s z%FirewallClientPolicySettings.getPortsc C s || j d< d S )Nr* )r5 )r= r* r r r ri
s z%FirewallClientPolicySettings.setPortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr* z'%s:%s')r5 r_ r r r` )r= rj rk r r r rl s z$FirewallClientPolicySettings.addPortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr* z'%s:%s')r5 rc r r rd )r= rj rk r r r rm s z'FirewallClientPolicySettings.removePortc C s ||f| j d kS )Nr* )r5 )r= rj rk r r r rn s z&FirewallClientPolicySettings.queryPortc C s
| j d S )Nr0 )r5 )r= r r r rp " s z)FirewallClientPolicySettings.getProtocolsc C s || j d< d S )Nr0 )r5 )r= r0 r r r rq % s z)FirewallClientPolicySettings.setProtocolsc C s0 || j d kr | j d j|� n ttj|��d S )Nr0 )r5 r_ r r r` )r= rk r r r rr ( s z(FirewallClientPolicySettings.addProtocolc C s0 || j d kr | j d j|� n ttj|��d S )Nr0 )r5 rc r r rd )r= rk r r r rs . s z+FirewallClientPolicySettings.removeProtocolc C s || j d kS )Nr0 )r5 )r= rk r r r rt 4 s z*FirewallClientPolicySettings.queryProtocolc C s
| j d S )Nr1 )r5 )r= r r r rv 8 s z+FirewallClientPolicySettings.getSourcePortsc C s || j d< d S )Nr1 )r5 )r= r* r r r rw ; s z+FirewallClientPolicySettings.setSourcePortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr1 z'%s:%s')r5 r_ r r r` )r= rj rk r r r rx > s z*FirewallClientPolicySettings.addSourcePortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr1 z'%s:%s')r5 rc r r rd )r= rj rk r r r ry E s z-FirewallClientPolicySettings.removeSourcePortc C s ||f| j d kS )Nr1 )r5 )r= rj rk r r r rz L s z,FirewallClientPolicySettings.querySourcePortc C s
| j d S )Nr+ )r5 )r= r r r r| P s z*FirewallClientPolicySettings.getIcmpBlocksc C s || j d< d S )Nr+ )r5 )r= r} r r r r~ S s z*FirewallClientPolicySettings.setIcmpBlocksc C s0 || j d kr | j d j|� n ttj|��d S )Nr+ )r5 r_ r r r` )r= r r r r r� V s z)FirewallClientPolicySettings.addIcmpBlockc C s0 || j d kr | j d j|� n ttj|��d S )Nr+ )r5 rc r r rd )r= r r r r r� \ s z,FirewallClientPolicySettings.removeIcmpBlockc C s || j d kS )Nr+ )r5 )r= r r r r r� b s z+FirewallClientPolicySettings.queryIcmpBlockc C s
| j d S )Nr, )r5 )r= r r r r� f s z*FirewallClientPolicySettings.getMasqueradec C s || j d< d S )Nr, )r5 )r= r, r r r r� i s z*FirewallClientPolicySettings.setMasqueradec C s& | j d sd| j d< n ttjd� d S )Nr, T)r5 r r r` )r= r r r r� l s
z*FirewallClientPolicySettings.addMasqueradec C s& | j d rd| j d< n ttjd� d S )Nr, F)r5 r r rd )r= r r r r� s s
z-FirewallClientPolicySettings.removeMasqueradec C s
| j d S )Nr, )r5 )r= r r r r� z s z,FirewallClientPolicySettings.queryMasqueradec C s
| j d S )Nr- )r5 )r= r r r r� s z,FirewallClientPolicySettings.getForwardPortsc C s || j d< d S )Nr- )r5 )r= r* r r r r� � s z,FirewallClientPolicySettings.setForwardPortsc C sd |d kr d}|d krd}||||f| j d krH| j d j||||f� nttjd||||f ��d S )Nr# r- z
'%s:%s:%s:%s')r5 r_ r r r` )r= rj rk r� r� r r r r� � s z+FirewallClientPolicySettings.addForwardPortc C sd |d kr d}|d krd}||||f| j d krH| j d j||||f� nttjd||||f ��d S )Nr# r- z
'%s:%s:%s:%s')r5 rc r r rd )r= rj rk r� r� r r r r� � s z.FirewallClientPolicySettings.removeForwardPortc C s. |d kr d}|d krd}||||f| j d kS )Nr# r- )r5 )r= rj rk r� r� r r r r� � s
z-FirewallClientPolicySettings.queryForwardPortc C s
| j d S )Nr� )r5 )r= r r r r� � s z)FirewallClientPolicySettings.getRichRulesc C s dd� |D �}|| j d< d S )Nc S s g | ]}t t|d ���qS ))r� )r r )r� r� r r r r� � s z=FirewallClientPolicySettings.setRichRules.<locals>.<listcomp>r� )r5 )r= r� r r r r� � s z)FirewallClientPolicySettings.setRichRulesc C s> t t|d��}|| jd kr.| jd j|� n ttj|��d S )N)r� r� )r r r5 r_ r r r` )r= r� r r r r� � s z(FirewallClientPolicySettings.addRichRulec C s> t t|d��}|| jd kr.| jd j|� n ttj|��d S )N)r� r� )r r r5 rc r r rd )r= r� r r r r� � s z+FirewallClientPolicySettings.removeRichRulec C s t t|d��}|| jd kS )N)r� r� )r r r5 )r= r� r r r r� � s z*FirewallClientPolicySettings.queryRichRulec C s
| j d S )Nr� )r5 )r= r r r �getIngressZones� s z,FirewallClientPolicySettings.getIngressZonesc C s || j d< d S )Nr� )r5 )r= r� r r r �setIngressZones� s z,FirewallClientPolicySettings.setIngressZonesc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= � ingress_zoner r r �addIngressZone� s z+FirewallClientPolicySettings.addIngressZonec C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r� r r r �removeIngressZone� s z.FirewallClientPolicySettings.removeIngressZonec C s || j d kS )Nr� )r5 )r= r� r r r �queryIngressZone� s z-FirewallClientPolicySettings.queryIngressZonec C s
| j d S )Nr� )r5 )r= r r r �getEgressZones� s z+FirewallClientPolicySettings.getEgressZonesc C s || j d< d S )Nr� )r5 )r= r� r r r �setEgressZones� s z+FirewallClientPolicySettings.setEgressZonesc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= � egress_zoner r r �
addEgressZone� s z*FirewallClientPolicySettings.addEgressZonec C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r� r r r �removeEgressZone� s z-FirewallClientPolicySettings.removeEgressZonec C s || j d kS )Nr� )r5 )r= r� r r r �queryEgressZone� s z,FirewallClientPolicySettings.queryEgressZonec C s
| j d S )Nr� )r5 )r= r r r � getPriority� s z(FirewallClientPolicySettings.getPriorityc C s t |�| jd< d S )Nr� )�intr5 )r= r� r r r � setPriority� s z(FirewallClientPolicySettings.setPriority)N)Jr� r� r� r! r@ rB rF r< rM rO rP rQ rS rT rV rW rZ r[ r] r^ rb re rf rh ri rl rm rn rp rq rr rs rt rv rw rx ry rz r| r~ r� r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� � s� r� c @ s� e Zd Zdd� Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��ZdS )�FirewallClientConfigPolicyc C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)r� z org.freedesktop.DBus.Properties) r� r� r� r r r� r� r� � DBUS_INTERFACE_CONFIG_POLICY� fw_policyr� )r= r� r� r r r r@ � s z#FirewallClientConfigPolicy.__init__c C s t | jjtjj|��S )N)r r� r� r r r� )r= r� r r r r� � s z'FirewallClientConfigPolicy.get_propertyc C s t | jjtjj��S )N)r r� r� r r r� )r= r r r r� s z)FirewallClientConfigPolicy.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r� )r= r� rE r r r r� s z'FirewallClientConfigPolicy.set_propertyc C s t t| jj� ��S )N)r� r r� r� )r= r r r r�
s z&FirewallClientConfigPolicy.getSettingsc C s | j j|j� � d S )N)r� r� rM )r= r5 r r r r� s z!FirewallClientConfigPolicy.updatec C s | j j� d S )N)r� r� )r= r r r r� s z'FirewallClientConfigPolicy.loadDefaultsc C s | j j� d S )N)r� rc )r= r r r rc s z!FirewallClientConfigPolicy.removec C s | j j|� d S )N)r� r� )r= r� r r r r� ! s z!FirewallClientConfigPolicy.renameN)r� r� r� r@ r� r r� r� r! r� r� r� r� r� r� rc r� r r r r r� � s"
r� c @ s8 e Zd Zed^dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%ed_dFdG��Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1dS )`� FirewallClientServiceSettingsNc
C s� dddg g i g g g g g
| _ dddddddd d
d g
| _d d d d
d dd d
d d g
| _|r�t|�tkr�x:t|�D ]\}}|| | j |< qhW nt|�tkr�| j|� d S )Nr# r$ r% r& r* �modules� destinationr0 r1 �includes�helpersr3 z(ss)Zss)r5 r6 r7 rI r9 r: r; r< )r= r5 r> r? r r r r@ ) s z&FirewallClientServiceSettings.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB 9 s z&FirewallClientServiceSettings.__repr__c C s, i }x"t | j| j�D ]\}}|||< qW |S )N)rC r6 r5 )r= r5 rD rE r r r rF = s z-FirewallClientServiceSettings.getSettingsDictc C s( x"|D ]}|| | j | jj|�< qW d S )N)r5 r6 rG )r= r5 rD r r r r< C s
z-FirewallClientServiceSettings.setSettingsDictc C sr i }xht | j| j| j�D ]R\}}}t|�tkrBtj||d�||< qt|�tkrbtj ||d�||< q|||< qW |S )N)rH )
rC r6 r5 r7 rI r9 r rJ r; rK )r= r5 rD rE rL r r r rM G s z1FirewallClientServiceSettings.getSettingsDbusDictc C s
| j d S )Nr )r5 )r= r r r rP S s z(FirewallClientServiceSettings.getVersionc C s || j d< d S )Nr )r5 )r= r$ r r r rQ V s z(FirewallClientServiceSettings.setVersionc C s
| j d S )NrR )r5 )r= r r r rS Z s z&FirewallClientServiceSettings.getShortc C s || j d< d S )NrR )r5 )r= r% r r r rT ] s z&FirewallClientServiceSettings.setShortc C s
| j d S )NrU )r5 )r= r r r rV a s z,FirewallClientServiceSettings.getDescriptionc C s || j d< d S )NrU )r5 )r= r& r r r rW d s z,FirewallClientServiceSettings.setDescriptionc C s
| j d S )N� )r5 )r= r r r rh h s z&FirewallClientServiceSettings.getPortsc C s || j d< d S )Nr� )r5 )r= r* r r r ri k s z&FirewallClientServiceSettings.setPortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr� z'%s:%s')r5 r_ r r r` )r= rj rk r r r rl n s z%FirewallClientServiceSettings.addPortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr� z'%s:%s')r5 rc r r rd )r= rj rk r r r rm u s z(FirewallClientServiceSettings.removePortc C s ||f| j d kS )Nr� )r5 )r= rj rk r r r rn | s z'FirewallClientServiceSettings.queryPortc C s
| j d S )Nrg )r5 )r= r r r rp � s z*FirewallClientServiceSettings.getProtocolsc C s || j d< d S )Nrg )r5 )r= r0 r r r rq � s z*FirewallClientServiceSettings.setProtocolsc C s0 || j d kr | j d j|� n ttj|��d S )Nrg )r5 r_ r r r` )r= rk r r r rr � s z)FirewallClientServiceSettings.addProtocolc C s0 || j d kr | j d j|� n ttj|��d S )Nrg )r5 rc r r rd )r= rk r r r rs � s z,FirewallClientServiceSettings.removeProtocolc C s || j d kS )Nrg )r5 )r= rk r r r rt � s z+FirewallClientServiceSettings.queryProtocolc C s
| j d S )Nr{ )r5 )r= r r r rv � s z,FirewallClientServiceSettings.getSourcePortsc C s || j d< d S )Nr{ )r5 )r= r* r r r rw � s z,FirewallClientServiceSettings.setSourcePortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr{ z'%s:%s')r5 r_ r r r` )r= rj rk r r r rx � s z+FirewallClientServiceSettings.addSourcePortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr{ z'%s:%s')r5 rc r r rd )r= rj rk r r r ry � s z.FirewallClientServiceSettings.removeSourcePortc C s ||f| j d kS )Nr{ )r5 )r= rj rk r r r rz � s z-FirewallClientServiceSettings.querySourcePortc C s
| j d S )NrX )r5 )r= r r r �
getModules� s z(FirewallClientServiceSettings.getModulesc C s || j d< d S )NrX )r5 )r= r� r r r �
setModules� s z(FirewallClientServiceSettings.setModulesc C s0 || j d kr | j d j|� n ttj|��d S )NrX )r5 r_ r r r` )r= �moduler r r � addModule� s z'FirewallClientServiceSettings.addModulec C s0 || j d kr | j d j|� n ttj|��d S )NrX )r5 rc r r rd )r= r� r r r � removeModule� s z*FirewallClientServiceSettings.removeModulec C s || j d kS )NrX )r5 )r= r� r r r � queryModule� s z)FirewallClientServiceSettings.queryModulec C s
| j d S )Nr\ )r5 )r= r r r �getDestinations� s z-FirewallClientServiceSettings.getDestinationsc C s || j d< d S )Nr\ )r5 )r= � destinationsr r r �setDestinations� s z-FirewallClientServiceSettings.setDestinationsc C sH || j d ks | j d | |kr0|| j d |< nttjd||f ��d S )Nr\ z'%s:%s')r5 r r r` )r= � dest_type�addressr r r �setDestination� s
z,FirewallClientServiceSettings.setDestinationc C s^ || j d krJ|d k r<| j d | |kr<ttjd||f ��| j d |= nttjd| ��d S )Nr\ z'%s:%s'z'%s')r5 r r rd )r= r� r r r r �removeDestination� s z/FirewallClientServiceSettings.removeDestinationc C s || j d ko || j d | kS )Nr\ )r5 )r= r� r r r r �queryDestination� s z.FirewallClientServiceSettings.queryDestinationc C s
| j d S )Nr� )r5 )r= r r r � getIncludes� s z)FirewallClientServiceSettings.getIncludesc C s || j d< d S )Nr� )r5 )r= r� r r r � setIncludes� s z)FirewallClientServiceSettings.setIncludesc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= �includer r r �
addInclude� s z(FirewallClientServiceSettings.addIncludec C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r r r r �
removeInclude� s z+FirewallClientServiceSettings.removeIncludec C s || j d kS )Nr� )r5 )r= r r r r � queryInclude� s z*FirewallClientServiceSettings.queryIncludec C s
| j d S )Nr� )r5 )r= r r r �
getHelpers� s z(FirewallClientServiceSettings.getHelpersc C s || j d< d S )Nr� )r5 )r= r� r r r �
setHelpers� s z(FirewallClientServiceSettings.setHelpersc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= �helperr r r � addHelper� s z'FirewallClientServiceSettings.addHelperc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r r r r � removeHelper s z*FirewallClientServiceSettings.removeHelperc C s || j d kS )Nr� )r5 )r= r r r r � queryHelper s z)FirewallClientServiceSettings.queryHelper)N)N)2r� r� r� r! r@ rB rF r< rM rP rQ rS rT rV rW rh ri rl rm rn rp rq rr rs rt rv rw rx ry rz r� r� r� r� r� r� r� r r r r r r r r r
r r
r r r r r r r� ( s` r� c @ s� e Zd Zed*dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �ZdS )+�FirewallClientIPSetSettingsNc C s" |r || _ nddddi g g| _ d S )Nr# )r5 )r= r5 r r r r@ s z$FirewallClientIPSetSettings.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB s z$FirewallClientIPSetSettings.__repr__c C s
| j d S )Nr )r5 )r= r r r rP s z&FirewallClientIPSetSettings.getVersionc C s || j d< d S )Nr )r5 )r= r$ r r r rQ s z&FirewallClientIPSetSettings.setVersionc C s
| j d S )NrR )r5 )r= r r r rS ! s z$FirewallClientIPSetSettings.getShortc C s || j d< d S )NrR )r5 )r= r% r r r rT $ s z$FirewallClientIPSetSettings.setShortc C s
| j d S )NrU )r5 )r= r r r rV ( s z*FirewallClientIPSetSettings.getDescriptionc C s || j d< d S )NrU )r5 )r= r& r r r rW + s z*FirewallClientIPSetSettings.setDescriptionc C s
| j d S )Nr� )r5 )r= r r r �getType/ s z#FirewallClientIPSetSettings.getTypec C s || j d< d S )Nr� )r5 )r= Z
ipset_typer r r �setType2 s z#FirewallClientIPSetSettings.setTypec C s
| j d S )NrX )r5 )r= r r r �
getOptions6 s z&FirewallClientIPSetSettings.getOptionsc C s || j d< d S )NrX )r5 )r= Zoptionsr r r �
setOptions9 s z&FirewallClientIPSetSettings.setOptionsc C sP || j d ks | j d | |kr0|| j d |< n ttj|rFd||f n|��d S )NrX z'%s=%s')r5 r r r` )r= rD rE r r r � addOption< s z%FirewallClientIPSetSettings.addOptionc C s, || j d kr | j d |= n ttj|��d S )NrX )r5 r r rd )r= rD r r r � removeOptionC s z(FirewallClientIPSetSettings.removeOptionc C s || j d ko | j d | |kS )NrX )r5 )r= rD rE r r r � queryOptionI s z'FirewallClientIPSetSettings.queryOptionc C s
| j d S )Nr\ )r5 )r= r r r �
getEntriesM s z&FirewallClientIPSetSettings.getEntriesc C s@ d| j d kr*| j d d dkr*ttj��t|� || j d< d S )N�timeoutrX �0r\ )r5 r r �IPSET_WITH_TIMEOUTr )r= �entriesr r r �
setEntriesP s
z&FirewallClientIPSetSettings.setEntriesc C sr d| j d kr*| j d d dkr*ttj��t|�}|| j d krbt|| j d � | j d j|� n ttj|��d S )Nr rX r r\ )r5 r r r r r
r_ r` )r= �entryr r r �addEntryW s
z$FirewallClientIPSetSettings.addEntryc C sb d| j d kr*| j d d dkr*ttj��t|�}|| j d krR| j d j|� n ttj|��d S )Nr rX r r\ )r5 r r r r rc rd )r= r r r r � removeEntryb s
z'FirewallClientIPSetSettings.removeEntryc C s@ d| j d kr*| j d d dkr*ttj��t|�}|| j d kS )Nr rX r r\ )r5 r r r r )r= r r r r �
queryEntryl s
z&FirewallClientIPSetSettings.queryEntry)N)r� r� r� r! r@ rB rP rQ rS rT rV rW r r r r r r r r r r r r! r r r r r s*
r c @ s� e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zd)S )*�FirewallClientConfigIPSetc C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)r� z org.freedesktop.DBus.Properties) r� r� r� r r r� r� r� �DBUS_INTERFACE_CONFIG_IPSET�fw_ipsetr� )r= r� r� r r r r@ w s z"FirewallClientConfigIPSet.__init__c C s t | jjtjj|��S )N)r r� r� r r r# )r= r� r r r r� � s z&FirewallClientConfigIPSet.get_propertyc C s t | jjtjj��S )N)r r� r� r r r# )r= r r r r� � s z(FirewallClientConfigIPSet.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r# )r= r� rE r r r r� � s z&FirewallClientConfigIPSet.set_propertyc C s t tt| jj� ���S )N)r r9 r r$ r� )r= r r r r� � s z%FirewallClientConfigIPSet.getSettingsc C s | j jt|j�� d S )N)r$ r� �tupler5 )r= r5 r r r r� � s z FirewallClientConfigIPSet.updatec C s | j j� d S )N)r$ r� )r= r r r r� � s z&FirewallClientConfigIPSet.loadDefaultsc C s | j j� d S )N)r$ rc )r= r r r rc � s z FirewallClientConfigIPSet.removec C s | j j|� d S )N)r$ r� )r= r� r r r r� � s z FirewallClientConfigIPSet.renamec C s
| j j� S )N)r$ rP )r= r r r rP � s z$FirewallClientConfigIPSet.getVersionc C s | j j|� d S )N)r$ rQ )r= r$ r r r rQ � s z$FirewallClientConfigIPSet.setVersionc C s
| j j� S )N)r$ rS )r= r r r rS � s z"FirewallClientConfigIPSet.getShortc C s | j j|� d S )N)r$ rT )r= r% r r r rT � s z"FirewallClientConfigIPSet.setShortc C s
| j j� S )N)r$ rV )r= r r r rV � s z(FirewallClientConfigIPSet.getDescriptionc C s | j j|� d S )N)r$ rW )r= r& r r r rW � s z(FirewallClientConfigIPSet.setDescriptionc C s
| j j� S )N)r$ r )r= r r r r � s z$FirewallClientConfigIPSet.getEntriesc C s | j j|� d S )N)r$ r )r= r r r r r � s z$FirewallClientConfigIPSet.setEntriesc C s | j j|� d S )N)r$ r )r= r r r r r � s z"FirewallClientConfigIPSet.addEntryc C s | j j|� d S )N)r$ r )r= r r r r r � s z%FirewallClientConfigIPSet.removeEntryc C s | j j|�S )N)r$ r! )r= r r r r r! � s z$FirewallClientConfigIPSet.queryEntryN) r� r� r� r! r@ r� r r� r� r� r� r� r� r� r� rc r� rP rQ rS rT rV rW r r r r r! r r r r r" v sN r" c @ s� e Zd Zed$dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �ZdS )%� FirewallClientHelperSettingsNc C s" |r || _ ndddddg g| _ d S )Nr# )r5 )r= r5 r r r r@ � s z%FirewallClientHelperSettings.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB � s z%FirewallClientHelperSettings.__repr__c C s
| j d S )Nr )r5 )r= r r r rP � s z'FirewallClientHelperSettings.getVersionc C s || j d< d S )Nr )r5 )r= r$ r r r rQ � s z'FirewallClientHelperSettings.setVersionc C s
| j d S )NrR )r5 )r= r r r rS s z%FirewallClientHelperSettings.getShortc C s || j d< d S )NrR )r5 )r= r% r r r rT s z%FirewallClientHelperSettings.setShortc C s
| j d S )NrU )r5 )r= r r r rV s z+FirewallClientHelperSettings.getDescriptionc C s || j d< d S )NrU )r5 )r= r& r r r rW s z+FirewallClientHelperSettings.setDescriptionc C s
| j d S )Nr� )r5 )r= r r r � getFamily s z&FirewallClientHelperSettings.getFamilyc C s |d krd| j d< || j d< d S )Nr# r� )r5 )r= �ipvr r r � setFamily s
z&FirewallClientHelperSettings.setFamilyc C s
| j d S )NrX )r5 )r= r r r � getModule s z&FirewallClientHelperSettings.getModulec C s || j d< d S )NrX )r5 )r= r� r r r � setModule s z&FirewallClientHelperSettings.setModulec C s
| j d S )Nr\ )r5 )r= r r r rh s z%FirewallClientHelperSettings.getPortsc C s || j d< d S )Nr\ )r5 )r= r* r r r ri # s z%FirewallClientHelperSettings.setPortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr\ z'%s:%s')r5 r_ r r r` )r= rj rk r r r rl & s z$FirewallClientHelperSettings.addPortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr\ z'%s:%s')r5 rc r r rd )r= rj rk r r r rm - s z'FirewallClientHelperSettings.removePortc C s ||f| j d kS )Nr\ )r5 )r= rj rk r r r rn 4 s z&FirewallClientHelperSettings.queryPort)N)r� r� r� r! r@ rB rP rQ rS rT rV rW r' r) r* r+ rh ri rl rm rn r r r r r& � s$ r& c @ s e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zejjjed)d*� ��Z ejjjed+d,� ��Z ejjjed-d.� ��Z ejjjed/d0� ��Z d1S )2�FirewallClientConfigHelperc C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)r� z org.freedesktop.DBus.Properties) r� r� r� r r r� r� r� � DBUS_INTERFACE_CONFIG_HELPER� fw_helperr� )r= r� r� r r r r@ ; s z#FirewallClientConfigHelper.__init__c C s t | jjtjj|��S )N)r r� r� r r r- )r= r� r r r r� F s z'FirewallClientConfigHelper.get_propertyc C s t | jjtjj��S )N)r r� r� r r r- )r= r r r r� L s z)FirewallClientConfigHelper.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r- )r= r� rE r r r r� R s z'FirewallClientConfigHelper.set_propertyc C s t tt| jj� ���S )N)r& r9 r r. r� )r= r r r r� X s z&FirewallClientConfigHelper.getSettingsc C s | j jt|j�� d S )N)r. r� r% r5 )r= r5 r r r r� ^ s z!FirewallClientConfigHelper.updatec C s | j j� d S )N)r. r� )r= r r r r� c s z'FirewallClientConfigHelper.loadDefaultsc C s | j j� d S )N)r. rc )r= r r r rc h s z!FirewallClientConfigHelper.removec C s | j j|� d S )N)r. r� )r= r� r r r r� m s z!FirewallClientConfigHelper.renamec C s
| j j� S )N)r. rP )r= r r r rP t s z%FirewallClientConfigHelper.getVersionc C s | j j|� d S )N)r. rQ )r= r$ r r r rQ y s z%FirewallClientConfigHelper.setVersionc C s
| j j� S )N)r. rS )r= r r r rS � s z#FirewallClientConfigHelper.getShortc C s | j j|� d S )N)r. rT )r= r% r r r rT � s z#FirewallClientConfigHelper.setShortc C s
| j j� S )N)r. rV )r= r r r rV � s z)FirewallClientConfigHelper.getDescriptionc C s | j j|� d S )N)r. rW )r= r& r r r rW � s z)FirewallClientConfigHelper.setDescriptionc C s
| j j� S )N)r. rh )r= r r r rh � s z#FirewallClientConfigHelper.getPortsc C s | j j|� d S )N)r. ri )r= r* r r r ri � s z#FirewallClientConfigHelper.setPortsc C s | j j||� d S )N)r. rl )r= rj rk r r r rl � s z"FirewallClientConfigHelper.addPortc C s | j j||� d S )N)r. rm )r= rj rk r r r rm � s z%FirewallClientConfigHelper.removePortc C s | j j||�S )N)r. rn )r= rj rk r r r rn � s z$FirewallClientConfigHelper.queryPortc C s
| j j� S )N)r. r' )r= r r r r' � s z$FirewallClientConfigHelper.getFamilyc C s$ |d kr| j jd� | j j|� d S )Nr# )r. r) )r= r( r r r r) � s z$FirewallClientConfigHelper.setFamilyc C s
| j j� S )N)r. r* )r= r r r r* � s z$FirewallClientConfigHelper.getModulec C s | j j|� d S )N)r. r+ )r= r� r r r r+ � s z$FirewallClientConfigHelper.setModuleN) r� r� r� r! r@ r� r r� r� r� r� r� r� r� r� rc r� rP rQ rS rT rV rW rh ri rl rm rn r' r) r* r+ r r r r r, : s^ r, c @ s� e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zejjjed)d*� ��Z ejjjed+d,� ��Z ejjjed-d.� ��Z ejjjed/d0� ��Z ejjjed1d2� ��Z ejjjed3d4� ��Z!ejjjed5d6� ��Z"ejjjed7d8� ��Z#ejjjed9d:� ��Z$ejjjed;d<� ��Z%ejjjed=d>� ��Z&ejjjed?d@� ��Z'ejjjedAdB� ��Z(ejjjedCdD� ��Z)ejjjedEdF� ��Z*ejjjedGdH� ��Z+ejjjedIdJ� ��Z,ejjjedKdL� ��Z-ejjjedMdN� ��Z.ejjjed^dPdQ���Z/ejjjedRdS� ��Z0ejjjedTdU� ��Z1ejjjedVdW� ��Z2ejjjedXdY� ��Z3ejjjedZd[� ��Z4ejjjed\d]� ��Z5dOS )_�FirewallClientConfigServicec C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)r� z org.freedesktop.DBus.Properties) r� r� r� r r r� r� r� � DBUS_INTERFACE_CONFIG_SERVICE�
fw_servicer� )r= r� r� r r r r@ � s z$FirewallClientConfigService.__init__c C s t | jjtjj|��S )N)r r� r� r r r0 )r= r� r r r r� � s z(FirewallClientConfigService.get_propertyc C s t | jjtjj��S )N)r r� r� r r r0 )r= r r r r� � s z*FirewallClientConfigService.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r0 )r= r� rE r r r r� � s z(FirewallClientConfigService.set_propertyc C s t t| jj� ��S )N)r� r r1 r� )r= r r r r� � s z'FirewallClientConfigService.getSettingsc C s | j j|j� � d S )N)r1 r� rM )r= r5 r r r r� � s z"FirewallClientConfigService.updatec C s | j j� d S )N)r1 r� )r= r r r r� � s z(FirewallClientConfigService.loadDefaultsc C s | j j� d S )N)r1 rc )r= r r r rc � s z"FirewallClientConfigService.removec C s | j j|� d S )N)r1 r� )r= r� r r r r� s z"FirewallClientConfigService.renamec C s
| j j� S )N)r1 rP )r= r r r rP s z&FirewallClientConfigService.getVersionc C s | j j|� d S )N)r1 rQ )r= r$ r r r rQ s z&FirewallClientConfigService.setVersionc C s
| j j� S )N)r1 rS )r= r r r rS s z$FirewallClientConfigService.getShortc C s | j j|� d S )N)r1 rT )r= r% r r r rT s z$FirewallClientConfigService.setShortc C s
| j j� S )N)r1 rV )r= r r r rV s z*FirewallClientConfigService.getDescriptionc C s | j j|� d S )N)r1 rW )r= r& r r r rW $ s z*FirewallClientConfigService.setDescriptionc C s
| j j� S )N)r1 rh )r= r r r rh + s z$FirewallClientConfigService.getPortsc C s | j j|� d S )N)r1 ri )r= r* r r r ri 0 s z$FirewallClientConfigService.setPortsc C s | j j||� d S )N)r1 rl )r= rj rk r r r rl 5 s z#FirewallClientConfigService.addPortc C s | j j||� d S )N)r1 rm )r= rj rk r r r rm : s z&FirewallClientConfigService.removePortc C s | j j||�S )N)r1 rn )r= rj rk r r r rn ? s z%FirewallClientConfigService.queryPortc C s
| j j� S )N)r1 rp )r= r r r rp F s z(FirewallClientConfigService.getProtocolsc C s | j j|� d S )N)r1 rq )r= r0 r r r rq K s z(FirewallClientConfigService.setProtocolsc C s | j j|� d S )N)r1 rr )r= rk r r r rr P s z'FirewallClientConfigService.addProtocolc C s | j j|� d S )N)r1 rs )r= rk r r r rs U s z*FirewallClientConfigService.removeProtocolc C s | j j|�S )N)r1 rt )r= rk r r r rt Z s z)FirewallClientConfigService.queryProtocolc C s
| j j� S )N)r1 rv )r= r r r rv a s z*FirewallClientConfigService.getSourcePortsc C s | j j|� d S )N)r1 rw )r= r* r r r rw f s z*FirewallClientConfigService.setSourcePortsc C s | j j||� d S )N)r1 rx )r= rj rk r r r rx k s z)FirewallClientConfigService.addSourcePortc C s | j j||� d S )N)r1 ry )r= rj rk r r r ry p s z,FirewallClientConfigService.removeSourcePortc C s | j j||�S )N)r1 rz )r= rj rk r r r rz u s z+FirewallClientConfigService.querySourcePortc C s
| j j� S )N)r1 r� )r= r r r r� | s z&FirewallClientConfigService.getModulesc C s | j j|� d S )N)r1 r� )r= r� r r r r� � s z&FirewallClientConfigService.setModulesc C s | j j|� d S )N)r1 r� )r= r� r r r r� � s z%FirewallClientConfigService.addModulec C s | j j|� d S )N)r1 r� )r= r� r r r r� � s z(FirewallClientConfigService.removeModulec C s | j j|�S )N)r1 r� )r= r� r r r r� � s z'FirewallClientConfigService.queryModulec C s
| j j� S )N)r1 r� )r= r r r r� � s z+FirewallClientConfigService.getDestinationsc C s | j j|� d S )N)r1 r� )r= r� r r r r� � s z+FirewallClientConfigService.setDestinationsc C s | j j|�S )N)r1 �getDestination)r= r� r r r r2 � s z*FirewallClientConfigService.getDestinationc C s | j j||� d S )N)r1 r )r= r� r r r r r � s z*FirewallClientConfigService.setDestinationNc C s: |d k r*| j |�|kr*ttjd||f ��| jj|� d S )Nz'%s:%s')r2 r r rd r1 r )r= r� r r r r r � s z-FirewallClientConfigService.removeDestinationc C s | j j||�S )N)r1 r )r= r� r r r r r � s z,FirewallClientConfigService.queryDestinationc C s
| j j� S )N)r1 r )r= r r r r � s z'FirewallClientConfigService.getIncludesc C s | j j|� d S )N)r1 r )r= r� r r r r � s z'FirewallClientConfigService.setIncludesc C s | j j|� d S )N)r1 r )r= r r r r r � s z&FirewallClientConfigService.addIncludec C s | j j|� d S )N)r1 r )r= r r r r r � s z)FirewallClientConfigService.removeIncludec C s | j j|�S )N)r1 r )r= r r r r r � s z(FirewallClientConfigService.queryInclude)N)6r� r� r� r! r@ r� r r� r� r� r� r� r� r� r� rc r� rP rQ rS rT rV rW rh ri rl rm rn rp rq rr rs rt rv rw rx ry rz r� r� r� r� r� r� r� r2 r r r r r r r r r r r r r/ � s� r/ c @ s� e Zd Zed dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �ZdS ) � FirewallClientIcmpTypeSettingsNc C s |r || _ ndddg g| _ d S )Nr# )r5 )r= r5 r r r r@ � s z'FirewallClientIcmpTypeSettings.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB � s z'FirewallClientIcmpTypeSettings.__repr__c C s
| j d S )Nr )r5 )r= r r r rP � s z)FirewallClientIcmpTypeSettings.getVersionc C s || j d< d S )Nr )r5 )r= r$ r r r rQ � s z)FirewallClientIcmpTypeSettings.setVersionc C s
| j d S )NrR )r5 )r= r r r rS � s z'FirewallClientIcmpTypeSettings.getShortc C s || j d< d S )NrR )r5 )r= r% r r r rT � s z'FirewallClientIcmpTypeSettings.setShortc C s
| j d S )NrU )r5 )r= r r r rV � s z-FirewallClientIcmpTypeSettings.getDescriptionc C s || j d< d S )NrU )r5 )r= r& r r r rW � s z-FirewallClientIcmpTypeSettings.setDescriptionc C s
| j d S )Nr� )r5 )r= r r r r� � s z.FirewallClientIcmpTypeSettings.getDestinationsc C s || j d< d S )Nr� )r5 )r= r� r r r r� � s z.FirewallClientIcmpTypeSettings.setDestinationsc C sH | j d sttj|��n,|| j d kr8| j d j|� n ttj|��d S )Nr� )r5 r r r` r_ )r= r� r r r �addDestination� s
z-FirewallClientIcmpTypeSettings.addDestinationc C s\ || j d kr | j d j|� n8| j d sL| jttddg�t|g� �� n ttj|��d S )Nr� Zipv4Zipv6)r5 rc r� r9 �setr r rd )r= r� r r r r s
z0FirewallClientIcmpTypeSettings.removeDestinationc C s | j d p|| j d kS )Nr� )r5 )r= r� r r r r s z/FirewallClientIcmpTypeSettings.queryDestination)N)r� r� r� r! r@ rB rP rQ rS rT rV rW r� r� r4 r r r r r r r3 � s r3 c @ s� e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zd)S )*� FirewallClientConfigIcmpTypec C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)r� z org.freedesktop.DBus.Properties) r� r� r� r r r� r� r� � DBUS_INTERFACE_CONFIG_ICMPTYPE� fw_icmptyper� )r= r� r� r r r r@ s z%FirewallClientConfigIcmpType.__init__c C s t | jjtjj|��S )N)r r� r� r r r7 )r= r� r r r r� % s z)FirewallClientConfigIcmpType.get_propertyc C s t | jjtjj��S )N)r r� r� r r r7 )r= r r r r� + s z+FirewallClientConfigIcmpType.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r7 )r= r� rE r r r r� 1 s z)FirewallClientConfigIcmpType.set_propertyc C s t tt| jj� ���S )N)r3 r9 r r8 r� )r= r r r r� 7 s z(FirewallClientConfigIcmpType.getSettingsc C s | j jt|j�� d S )N)r8 r� r% r5 )r= r5 r r r r� = s z#FirewallClientConfigIcmpType.updatec C s | j j� d S )N)r8 r� )r= r r r r� B s z)FirewallClientConfigIcmpType.loadDefaultsc C s | j j� d S )N)r8 rc )r= r r r rc G s z#FirewallClientConfigIcmpType.removec C s | j j|� d S )N)r8 r� )r= r� r r r r� L s z#FirewallClientConfigIcmpType.renamec C s
| j j� S )N)r8 rP )r= r r r rP S s z'FirewallClientConfigIcmpType.getVersionc C s | j j|� d S )N)r8 rQ )r= r$ r r r rQ X s z'FirewallClientConfigIcmpType.setVersionc C s
| j j� S )N)r8 rS )r= r r r rS _ s z%FirewallClientConfigIcmpType.getShortc C s | j j|� d S )N)r8 rT )r= r% r r r rT d s z%FirewallClientConfigIcmpType.setShortc C s
| j j� S )N)r8 rV )r= r r r rV k s z+FirewallClientConfigIcmpType.getDescriptionc C s | j j|� d S )N)r8 rW )r= r& r r r rW p s z+FirewallClientConfigIcmpType.setDescriptionc C s
| j j� S )N)r8 r� )r= r r r r� w s z,FirewallClientConfigIcmpType.getDestinationsc C s | j j|� d S )N)r8 r� )r= r� r r r r� | s z,FirewallClientConfigIcmpType.setDestinationsc C s | j j|� d S )N)r8 r4 )r= r� r r r r4 � s z+FirewallClientConfigIcmpType.addDestinationc C s | j j|� d S )N)r8 r )r= r� r r r r � s z.FirewallClientConfigIcmpType.removeDestinationc C s | j j|�S )N)r8 r )r= r� r r r r � s z-FirewallClientConfigIcmpType.queryDestinationN) r� r� r� r! r@ r� r r� r� r� r� r� r� r� r� rc r� rP rQ rS rT rV rW r� r� r4 r r r r r r r6 sN r6 c @ s e Zd Zed.dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �ZdS )/�'FirewallClientPoliciesLockdownWhitelistNc C s |r || _ ng g g g g| _ d S )N)r5 )r= r5 r r r r@ � s z0FirewallClientPoliciesLockdownWhitelist.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB � s z0FirewallClientPoliciesLockdownWhitelist.__repr__c C s
| j d S )Nr )r5 )r= r r r � getCommands� s z3FirewallClientPoliciesLockdownWhitelist.getCommandsc C s || j d< d S )Nr )r5 )r= Zcommandsr r r � setCommands� s z3FirewallClientPoliciesLockdownWhitelist.setCommandsc C s" || j d kr | j d j|� d S )Nr )r5 r_ )r= �commandr r r �
addCommand� s z2FirewallClientPoliciesLockdownWhitelist.addCommandc C s" || j d kr | j d j|� d S )Nr )r5 rc )r= r< r r r �
removeCommand� s z5FirewallClientPoliciesLockdownWhitelist.removeCommandc C s || j d kS )Nr )r5 )r= r< r r r � queryCommand� s z4FirewallClientPoliciesLockdownWhitelist.queryCommandc C s
| j d S )NrR )r5 )r= r r r � getContexts� s z3FirewallClientPoliciesLockdownWhitelist.getContextsc C s || j d< d S )NrR )r5 )r= Zcontextsr r r � setContexts� s z3FirewallClientPoliciesLockdownWhitelist.setContextsc C s" || j d kr | j d j|� d S )NrR )r5 r_ )r= �contextr r r �
addContext� s z2FirewallClientPoliciesLockdownWhitelist.addContextc C s" || j d kr | j d j|� d S )NrR )r5 rc )r= rB r r r �
removeContext� s z5FirewallClientPoliciesLockdownWhitelist.removeContextc C s || j d kS )NrR )r5 )r= rB r r r � queryContext� s z4FirewallClientPoliciesLockdownWhitelist.queryContextc C s
| j d S )NrU )r5 )r= r r r �getUsers� s z0FirewallClientPoliciesLockdownWhitelist.getUsersc C s || j d< d S )NrU )r5 )r= Zusersr r r �setUsers� s z0FirewallClientPoliciesLockdownWhitelist.setUsersc C s" || j d kr | j d j|� d S )NrU )r5 r_ )r= �userr r r �addUser� s z/FirewallClientPoliciesLockdownWhitelist.addUserc C s" || j d kr | j d j|� d S )NrU )r5 rc )r= rH r r r �
removeUser� s z2FirewallClientPoliciesLockdownWhitelist.removeUserc C s || j d kS )NrU )r5 )r= rH r r r � queryUser� s z1FirewallClientPoliciesLockdownWhitelist.queryUserc C s
| j d S )Nr� )r5 )r= r r r �getUids� s z/FirewallClientPoliciesLockdownWhitelist.getUidsc C s || j d< d S )Nr� )r5 )r= �uidsr r r �setUids� s z/FirewallClientPoliciesLockdownWhitelist.setUidsc C s" || j d kr | j d j|� d S )Nr� )r5 r_ )r= �uidr r r �addUid� s z.FirewallClientPoliciesLockdownWhitelist.addUidc C s" || j d kr | j d j|� d S )Nr� )r5 rc )r= rO r r r � removeUid� s z1FirewallClientPoliciesLockdownWhitelist.removeUidc C s || j d kS )Nr� )r5 )r= rO r r r �queryUid� s z0FirewallClientPoliciesLockdownWhitelist.queryUid)N)r� r� r� r! r@ rB r: r; r= r> r? r@ rA rC rD rE rF rG rI rJ rK rL rN rP rQ rR r r r r r9 � s. r9 c @ s� e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zd)S )*� FirewallClientConfigPoliciesc C s8 || _ | j jtjjtjj�| _tj| jtjjd�| _ d S )N)r� )
r� r� r r r� �DBUS_PATH_CONFIGr� r� � DBUS_INTERFACE_CONFIG_POLICIES� fw_policies)r= r� r r r r@ � s z%FirewallClientConfigPolicies.__init__c C s t tt| jj� ���S )N)r9 r9 r rV �getLockdownWhitelist)r= r r r rW � s z1FirewallClientConfigPolicies.getLockdownWhitelistc C s | j jt|j�� d S )N)rV �setLockdownWhitelistr% r5 )r= r5 r r r rX � s z1FirewallClientConfigPolicies.setLockdownWhitelistc C s | j j|� d S )N)rV �addLockdownWhitelistCommand)r= r< r r r rY
s z8FirewallClientConfigPolicies.addLockdownWhitelistCommandc C s | j j|� d S )N)rV � removeLockdownWhitelistCommand)r= r< r r r rZ
s z;FirewallClientConfigPolicies.removeLockdownWhitelistCommandc C s t | jj|��S )N)r rV � queryLockdownWhitelistCommand)r= r< r r r r[
s z:FirewallClientConfigPolicies.queryLockdownWhitelistCommandc C s t | jj� �S )N)r rV � getLockdownWhitelistCommands)r= r r r r\
s z9FirewallClientConfigPolicies.getLockdownWhitelistCommandsc C s | j j|� d S )N)rV �addLockdownWhitelistContext)r= rB r r r r]
s z8FirewallClientConfigPolicies.addLockdownWhitelistContextc C s | j j|� d S )N)rV � removeLockdownWhitelistContext)r= rB r r r r^
s z;FirewallClientConfigPolicies.removeLockdownWhitelistContextc C s t | jj|��S )N)r rV � queryLockdownWhitelistContext)r= rB r r r r_
s z:FirewallClientConfigPolicies.queryLockdownWhitelistContextc C s t | jj� �S )N)r rV � getLockdownWhitelistContexts)r= r r r r` %
s z9FirewallClientConfigPolicies.getLockdownWhitelistContextsc C s | j j|� d S )N)rV �addLockdownWhitelistUser)r= rH r r r ra ,
s z5FirewallClientConfigPolicies.addLockdownWhitelistUserc C s | j j|� d S )N)rV �removeLockdownWhitelistUser)r= rH r r r rb 1
s z8FirewallClientConfigPolicies.removeLockdownWhitelistUserc C s t | jj|��S )N)r rV �queryLockdownWhitelistUser)r= rH r r r rc 6
s z7FirewallClientConfigPolicies.queryLockdownWhitelistUserc C s t | jj� �S )N)r rV �getLockdownWhitelistUsers)r= r r r rd ;
s z6FirewallClientConfigPolicies.getLockdownWhitelistUsersc C s t | jj� �S )N)r rV �getLockdownWhitelistUids)r= r r r re B
s z5FirewallClientConfigPolicies.getLockdownWhitelistUidsc C s | j j|� d S )N)rV �setLockdownWhitelistUids)r= rM r r r rf G
s z5FirewallClientConfigPolicies.setLockdownWhitelistUidsc C s | j j|� d S )N)rV �addLockdownWhitelistUid)r= rO r r r rg L
s z4FirewallClientConfigPolicies.addLockdownWhitelistUidc C s | j j|� d S )N)rV �removeLockdownWhitelistUid)r= rO r r r rh Q
s z7FirewallClientConfigPolicies.removeLockdownWhitelistUidc C s t | jj|��S )N)r rV �queryLockdownWhitelistUid)r= rO r r r ri V
s z6FirewallClientConfigPolicies.queryLockdownWhitelistUidN) r� r� r� r! r@ r� r r� r� rW rX rY rZ r[ r\ r] r^ r_ r` ra rb rc rd re rf rg rh ri r r r r rS � sN rS c @ s e Zd Zed.dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �ZdS )/�FirewallClientDirectNc C s |r || _ n g g g g| _ d S )N)r5 )r= r5 r r r r@ ^
s z FirewallClientDirect.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB e
s z FirewallClientDirect.__repr__c C s
| j d S )Nr )r5 )r= r r r � getAllChainsi
s z!FirewallClientDirect.getAllChainsc s � �fdd�| j d D �S )Nc s, g | ]$}|d � kr|d �kr|d �qS )r rR rU r )r� r )r( �tabler r r� n
s z2FirewallClientDirect.getChains.<locals>.<listcomp>r )r5 )r= r( rl r )r( rl r � getChainsl
s z FirewallClientDirect.getChainsc C s || j d< d S )Nr )r5 )r= Zchainsr r r � setAllChainsp
s z!FirewallClientDirect.setAllChainsc C s, |||f}|| j d kr(| j d j|� d S )Nr )r5 r_ )r= r( rl �chain�idxr r r �addChains
s
z FirewallClientDirect.addChainc C s, |||f}|| j d kr(| j d j|� d S )Nr )r5 rc )r= r( rl ro rp r r r � removeChainx
s
z FirewallClientDirect.removeChainc C s |||f}|| j d kS )Nr )r5 )r= r( rl ro rp r r r �
queryChain}
s
z FirewallClientDirect.queryChainc C s
| j d S )NrR )r5 )r= r r r � getAllRules�
s z FirewallClientDirect.getAllRulesc s � ��fdd�| j d D �S )Nc s< g | ]4}|d �kr|d �kr|d � kr|dd� �qS )r rR rU r� Nr )r� r )ro r( rl r r r� �
s z1FirewallClientDirect.getRules.<locals>.<listcomp>rR )r5 )r= r( rl ro r )ro r( rl r �getRules�
s z FirewallClientDirect.getRulesc C s || j d< d S )NrR )r5 )r= r� r r r � setAllRules�
s z FirewallClientDirect.setAllRulesc C s0 |||||f}|| j d kr,| j d j|� d S )NrR )r5 r_ )r= r( rl ro r� r rp r r r �addRule�
s z FirewallClientDirect.addRulec C s0 |||||f}|| j d kr,| j d j|� d S )NrR )r5 rc )r= r( rl ro r� r rp r r r �
removeRule�
s z FirewallClientDirect.removeRulec C sP xJt | jd �D ]8}|d |kr|d |kr|d |kr| jd j|� qW d S )NrR r rU )r9 r5 rc )r= r( rl ro rp r r r � removeRules�
s $z FirewallClientDirect.removeRulesc C s |||||f}|| j d kS )NrR )r5 )r= r( rl ro r� r rp r r r � queryRule�
s z FirewallClientDirect.queryRulec C s
| j d S )NrU )r5 )r= r r r �getAllPassthroughs�
s z'FirewallClientDirect.getAllPassthroughsc C s || j d< d S )NrU )r5 )r= Z passthroughsr r r �setAllPassthroughs�
s z'FirewallClientDirect.setAllPassthroughsc C s g | j d< d S )NrU )r5 )r= r r r �removeAllPassthroughs�
s z*FirewallClientDirect.removeAllPassthroughsc s � fdd�| j d D �S )Nc s g | ]}|d � kr|d �qS )r rR r )r� r )r( r r r� �
s z8FirewallClientDirect.getPassthroughs.<locals>.<listcomp>rU )r5 )r= r( r )r( r �getPassthroughs�
s z$FirewallClientDirect.getPassthroughsc C s* ||f}|| j d kr&| j d j|� d S )NrU )r5 r_ )r= r( r rp r r r �addPassthrough�
s z#FirewallClientDirect.addPassthroughc C s* ||f}|| j d kr&| j d j|� d S )NrU )r5 rc )r= r( r rp r r r �removePassthrough�
s z&FirewallClientDirect.removePassthroughc C s ||f}|| j d kS )NrU )r5 )r= r( r rp r r r �queryPassthrough�
s z%FirewallClientDirect.queryPassthrough)N)r� r� r� r! r@ rB rk rm rn rq rr rs rt ru rv rw rx ry rz r{ r| r} r~ r r� r� r r r r rj ]
s. rj c @ s� e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zd'S )(�FirewallClientConfigDirectc C s8 || _ | j jtjjtjj�| _tj| jtjjd�| _ d S )N)r� )
r� r� r r r� rT r� r� � DBUS_INTERFACE_CONFIG_DIRECT� fw_direct)r= r� r r r r@ �
s z#FirewallClientConfigDirect.__init__c C s t tt| jj� ���S )N)rj r9 r r� r� )r= r r r r� �
s z&FirewallClientConfigDirect.getSettingsc C s | j jt|j�� d S )N)r� r� r% r5 )r= r5 r r r r� �
s z!FirewallClientConfigDirect.updatec C s | j j|||� d S )N)r� rq )r= r( rl ro r r r rq �
s z#FirewallClientConfigDirect.addChainc C s | j j|||� d S )N)r� rr )r= r( rl ro r r r rr �
s z&FirewallClientConfigDirect.removeChainc C s t | jj|||��S )N)r r� rs )r= r( rl ro r r r rs �
s z%FirewallClientConfigDirect.queryChainc C s t | jj||��S )N)r r� rm )r= r( rl r r r rm �
s z$FirewallClientConfigDirect.getChainsc C s t | jj� �S )N)r r� rk )r= r r r rk �
s z'FirewallClientConfigDirect.getAllChainsc C s | j j|||||� d S )N)r� rw )r= r( rl ro r� r r r r rw �
s z"FirewallClientConfigDirect.addRulec C s | j j|||||� d S )N)r� rx )r= r( rl ro r� r r r r rx �
s z%FirewallClientConfigDirect.removeRulec C s | j j|||� d S )N)r� ry )r= r( rl ro r r r ry �
s z&FirewallClientConfigDirect.removeRulesc C s t | jj|||||��S )N)r r� rz )r= r( rl ro r� r r r r rz s z$FirewallClientConfigDirect.queryRulec C s t | jj|||��S )N)r r� ru )r= r( rl ro r r r ru s z#FirewallClientConfigDirect.getRulesc C s t | jj� �S )N)r r� rt )r= r r r rt
s z&FirewallClientConfigDirect.getAllRulesc C s | j j||� d S )N)r� r )r= r( r r r r r s z)FirewallClientConfigDirect.addPassthroughc C s | j j||� d S )N)r� r� )r= r( r r r r r� s z,FirewallClientConfigDirect.removePassthroughc C s t | jj||��S )N)r r� r� )r= r( r r r r r� s z+FirewallClientConfigDirect.queryPassthroughc C s t | jj|��S )N)r r� r~ )r= r( r r r r~ s z*FirewallClientConfigDirect.getPassthroughsc C s t | jj� �S )N)r r� r{ )r= r r r r{ % s z-FirewallClientConfigDirect.getAllPassthroughsN)r� r� r� r! r@ r� r r� r� r� r� rq rr rs rm rk rw rx ry rz ru rt r r� r� r~ r{ r r r r r� �
sJ r� c @ sF e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zejjjed)d*� ��Z ejjjed+d,� ��Z ejjjed-d.� ��Z ejjjed/d0� ��Z ejjjed1d2� ��Z ejjjed3d4� ��Z!ejjjed5d6� ��Z"ejjjed7d8� ��Z#ejjjed9d:� ��Z$ejjjed;d<� ��Z%ejjjed=d>� ��Z&ejjjed?d@� ��Z'ejjjedAdB� ��Z(ejjjedCdD� ��Z)ejjjedEdF� ��Z*ejjjedGdH� ��Z+ejjjedIdJ� ��Z,ejjjedKdL� ��Z-dMS )N�FirewallClientConfigc C sb || _ | j jtjjtjj�| _tj| jtjjd�| _ tj| jdd�| _
t | j �| _ t
| j �| _d S )N)r� z org.freedesktop.DBus.Properties)r� r� r r r� rT r� r� �DBUS_INTERFACE_CONFIG� fw_configr� rS � _policiesr� �_direct)r= r� r r r r@ - s z FirewallClientConfig.__init__c C s t | jjtjj|��S )N)r r� r� r r r� )r= r� r r r r� < s z!FirewallClientConfig.get_propertyc C s t | jjtjj��S )N)r r� r� r r r� )r= r r r r� B s z#FirewallClientConfig.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r� )r= r� rE r r r r� H s z!FirewallClientConfig.set_propertyc C s t | jj� �S )N)r r� �
getIPSetNames)r= r r r r� O s z"FirewallClientConfig.getIPSetNamesc C s t | jj� �S )N)r r� �
listIPSets)r= r r r r� T s z FirewallClientConfig.listIPSetsc C s t | j|�S )N)r" r� )r= r� r r r �getIPSetY s z FirewallClientConfig.getIPSetc C s t | jj|��}t| j|�S )N)r r� �getIPSetByNamer" r� )r= r� r� r r r r� ^ s z#FirewallClientConfig.getIPSetByNamec C s> t |t�r | jj|t|j��}n| jj|t|��}t| j|�S )N)r8 r r� �addIPSetr% r5 r" r� )r= r� r5 r� r r r r� d s
z FirewallClientConfig.addIPSetc C s t | jj� �S )N)r r� � getZoneNames)r= r r r r� o s z!FirewallClientConfig.getZoneNamesc C s t | jj� �S )N)r r� � listZones)r= r r r r� t s z FirewallClientConfig.listZonesc C s t | j|�S )N)r� r� )r= r� r r r �getZoney s z FirewallClientConfig.getZonec C s t | jj|��}t| j|�S )N)r r� �
getZoneByNamer� r� )r= r� r� r r r r� ~ s z"FirewallClientConfig.getZoneByNamec C s t | jj|��S )N)r r� �getZoneOfInterface)r= Zifacer r r r� � s z'FirewallClientConfig.getZoneOfInterfacec C s t | jj|��S )N)r r� �getZoneOfSource)r= r� r r r r� � s z$FirewallClientConfig.getZoneOfSourcec C s^ t |t�r | jj||j� �}n4t |t�r8| jj||�}n| jj|t|d d� ��}t| j |�S )Nr� )
r8 r" r� ZaddZone2rM r; �addZoner% r� r� )r= r� r5 r� r r r r� � s
z FirewallClientConfig.addZonec C s t | jj� �S )N)r r� �getPolicyNames)r= r r r r� � s z#FirewallClientConfig.getPolicyNamesc C s t | jj� �S )N)r r� � listPolicies)r= r r r r� � s z!FirewallClientConfig.listPoliciesc C s t | j|�S )N)r� r� )r= r� r r r � getPolicy� s z FirewallClientConfig.getPolicyc C s t | jj|��}t| j|�S )N)r r� �getPolicyByNamer� r� )r= r� r� r r r r� � s z$FirewallClientConfig.getPolicyByNamec C s8 t |t�r | jj||j� �}n| jj||�}t| j|�S )N)r8 r� r� � addPolicyrM r� r� )r= r� r5 r� r r r r� � s
z FirewallClientConfig.addPolicyc C s t | jj� �S )N)r r� �getServiceNames)r= r r r r� � s z$FirewallClientConfig.getServiceNamesc C s t | jj� �S )N)r r� � listServices)r= r r r r� � s z!FirewallClientConfig.listServicesc C s t | j|�S )N)r/ r� )r= r� r r r �
getService� s z FirewallClientConfig.getServicec C s t | jj|��}t| j|�S )N)r r� �getServiceByNamer/ r� )r= r� r� r r r r� � s z%FirewallClientConfig.getServiceByNamec C s` t |t�r | jj||j� �}n6t|�tkr:| jj||�}n| jj|t|d d� ��}t | j
|�S )Nr� ) r8 r� r� Z addService2rM rI r; rb r% r/ r� )r= r� r5 r� r r r rb � s
z FirewallClientConfig.addServicec C s t | jj� �S )N)r r� �getIcmpTypeNames)r= r r r r� � s z%FirewallClientConfig.getIcmpTypeNamesc C s t | jj� �S )N)r r� �
listIcmpTypes)r= r r r r� � s z"FirewallClientConfig.listIcmpTypesc C s t | j|�S )N)r6 r� )r= r� r r r � getIcmpType� s z FirewallClientConfig.getIcmpTypec C s t | jj|��}t| j|�S )N)r r� �getIcmpTypeByNamer6 r� )r= r� r� r r r r� � s z&FirewallClientConfig.getIcmpTypeByNamec C s> t |t�r | jj|t|j��}n| jj|t|��}t| j|�S )N)r8 r3 r� � addIcmpTyper% r5 r6 r� )r= r� r5 r� r r r r� � s
z FirewallClientConfig.addIcmpTypec C s | j S )N)r� )r= r r r �policies� s z FirewallClientConfig.policiesc C s | j S )N)r� )r= r r r �direct s zFirewallClientConfig.directc C s t | jj� �S )N)r r� �getHelperNames)r= r r r r� s z#FirewallClientConfig.getHelperNamesc C s t | jj� �S )N)r r� � listHelpers)r= r r r r� s z FirewallClientConfig.listHelpersc C s t | j|�S )N)r, r� )r= r� r r r � getHelper s z FirewallClientConfig.getHelperc C s t | jj|��}t| j|�S )N)r r� �getHelperByNamer, r� )r= r� r� r r r r� s z$FirewallClientConfig.getHelperByNamec C s> t |t�r | jj|t|j��}n| jj|t|��}t| j|�S )N)r8 r& r� r
r% r5 r, r� )r= r� r5 r� r r r r
s
z FirewallClientConfig.addHelperN).r� r� r� r! r@ r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rb r� r� r� r� r� r� r� r� r� r� r� r
r r r r r� , s�
r� c @ s� e Zd Ze�ddd��Zedd� �Zedd � �Zed
d � �Zed d
� �Zedd� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zejjjedd� ��Zejjjed d � ��Zejjjed d � ��Zejjjed d!� ��Zejjjed"d#� ��Zejjjed$d%� ��Zejjjed&d'� ��Zejjjed(d)� ��Zejjjed*d+� ��Zejjjed,d-� ��Z ejjjed.d/� ��Z ejjjed0d1� ��Z ejjjed2d3� ��Z ejjjed4d5� ��Z ejjjed6d7� ��Z!ejjjed8d9� ��Z"ejjjed:d;� ��Z#ejjjed<d=� ��Z$ejjjed>d?� ��Z%ejjjed@dA� ��Z&ejjjedBdC� ��Z'ejjjedDdE� ��Z(ejjjedFdG� ��Z)ejjjedHdI� ��Z*ejjjedJdK� ��Z+ejjjedLdM� ��Z,ejjjedNdO� ��Z-ejjjedPdQ� ��Z.ejjjedRdS� ��Z/ejjjedTdU� ��Z0ejjjedVdW� ��Z1ejjjedXdY� ��Z2ejjjedZd[� ��Z3ejjjed\d]� ��Z4ejjjed^d_� ��Z5ejjjed`da� ��Z6ejjjedbdc� ��Z7ejjjeddde� ��Z8ejjjedfdg� ��Z9ejjjedhdi� ��Z:ejjjedjdk� ��Z;ejjjedldm� ��Z<ejjjedndo� ��Z=ejjjedpdq� ��Z>ejjjedrds� ��Z?ejjjedtdu� ��Z@ejjjedvdw� ��ZAejjjedxdy� ��ZBejjjedzd{� ��ZCejjjed|d}� ��ZDejjjed~d� ��ZEejjjed�d�� ��ZFejjjed�d�� ��ZGejjje�dd�d����ZHejjjed�d�� ��ZIejjjed�d�� ��ZJejjjed�d�� ��ZKejjje�d d�d����ZLejjjed�d�� ��ZMejjjed�d�� ��ZNejjjed�d�� ��ZOejjje�d d�d����ZPejjjed�d�� ��ZQejjjed�d�� ��ZRejjjed�d�� ��ZSejjje�d d�d����ZTejjjed�d�� ��ZUejjjed�d�� ��ZVejjjed�d�� ��ZWejjjed�d�� ��ZXejjjed�d�� ��ZYejjjed�d�� ��ZZejjje�d d�d����Z[ejjjed�d�� ��Z\ejjjed�d�� ��Z]ejjje�d d�d����Z^ejjjed�d�� ��Z_ejjjed�d�� ��Z`ejjjed�d�� ��Zaejjje�d!d�d����Zbejjjed�d�� ��Zcejjjed�d�� ��Zdejjjed�d�� ��Zeejjje�d"d�d����Zfejjjed�dÄ ��Zgejjjed�dń ��Zhejjjed�dDŽ ��Ziejjjed�dɄ ��Zjejjjed�d˄ ��Zkejjjed�d̈́ ��Zlejjjed�dτ ��Zmejjjed�dф ��Znejjjed�dӄ ��Zoejjjed�dՄ ��Zpejjjed�dׄ ��Zqejjjed�dل ��Zrejjjed�dۄ ��Zsejjjed�d݄ ��Ztejjjed�d߄ ��Zuejjjed�d� ��Zvejjjed�d� ��Zwejjjed�d� ��Zxejjjed�d� ��Zyejjjed�d� ��Zzejjjed�d� ��Z{ejjjed�d� ��Z|ejjjed�d� ��Z}ejjjed�d� ��Z~ejjjed�d� ��Zejjjed�d�� ��Z�ejjjed�d�� ��Z�ejjjed�d�� ��Z�ejjjed�d�� ��Z�ejjjed�d�� ��Z�ejjjed�d�� ��Z�ejjje�d �d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d � ��Z�ejjje�d
�d � ��Z�ejjje�d �d
� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�dS (# �FirewallClientNr Tc d C s |s�t jjjdd� ytj j� | _d | j_W q� tk
r� yt j� | _W n6 t j j
k
r� } zt t j
|j� ��W Y d d }~X n
X td� Y q�X n|| _| jj| jddtj jd� x�tj jtj jtj jtj jtj jtj jtj jtj jtj jtj j tj j tj j tj j tj j tj j!gD ] }| jj| j"|ddd d
� �qW i | _#d d d
ddddddddddddddd d d d d d!d"d#d$d%d&d'd'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdY�O| _$| j%� || _&|dZk�rt'j(|| j)� n| j)� d S )[NT)Zset_as_defaultzNot using slip.dbusZNameOwnerChangedzorg.freedesktop.DBus)Zhandler_functionZ signal_namer� Zarg0r� �memberr� )r� Zinterface_keywordZmember_keywordZ path_keywordzconnection-changedzconnection-establishedzconnection-lostZLogDeniedChangedZDefaultZoneChangedZPanicModeEnabledZPanicModeDisabledZReloadedZ ServiceAddedZServiceRemovedZ PortAddedZ PortRemovedZSourcePortAddedZSourcePortRemovedZ
ProtocolAddedZProtocolRemovedZMasqueradeAddedZMasqueradeRemovedZForwardPortAddedZForwardPortRemovedZIcmpBlockAddedZIcmpBlockRemovedZIcmpBlockInversionAddedZIcmpBlockInversionRemovedZ
RichRuleAddedZRichRuleRemovedZInterfaceAddedZInterfaceRemovedZZoneOfInterfaceChangedZ SourceAddedZ
SourceRemovedZZoneOfSourceChangedZ ZoneUpdatedZ
PolicyUpdatedZ
EntryAddedZ EntryRemovedZ
ChainAddedZ ChainRemovedZ RuleAddedZ RuleRemovedZPassthroughAddedZPassthroughRemovedzconfig:direct:UpdatedZLockdownEnabledZLockdownDisabledZ LockdownWhitelistCommandAddedZ LockdownWhitelistCommandRemovedZ LockdownWhitelistContextAddedZ LockdownWhitelistContextRemovedZLockdownWhitelistUidAddedZLockdownWhitelistUidRemovedZLockdownWhitelistUserAddedZ LockdownWhitelistUserRemovedz(config:policies:LockdownWhitelistUpdatedzconfig:IPSetAddedzconfig:IPSetUpdatedzconfig:IPSetRemovedzconfig:IPSetRenamedzconfig:ZoneAddedzconfig:ZoneUpdatedzconfig:ZoneRemovedzconfig:ZoneRenamedzconfig:PolicyAddedzconfig:PolicyUpdatedzconfig:PolicyRemovedzconfig:PolicyRenamedzconfig:ServiceAddedzconfig:ServiceUpdatedzconfig:ServiceRemovedzconfig:ServiceRenamedzconfig:IcmpTypeAddedzconfig:IcmpTypeUpdatedzconfig:IcmpTypeRemovedzconfig:IcmpTypeRenamedzconfig:HelperAddedzconfig:HelperUpdatedzconfig:HelperRemovedzconfig:HelperRenamed)Ozconnection-changedzconnection-establishedzconnection-lostzlog-denied-changedzdefault-zone-changedzpanic-mode-enabledzpanic-mode-disabledZreloadedz
service-addedzservice-removedz
port-addedz port-removedzsource-port-addedzsource-port-removedzprotocol-addedzprotocol-removedzmasquerade-addedzmasquerade-removedzforward-port-addedzforward-port-removedzicmp-block-addedzicmp-block-removedzicmp-block-inversion-addedz icmp-block-inversion-removedzrichrule-addedzrichrule-removedzinterface-addedzinterface-removedz zone-changedzzone-of-interface-changedz source-addedzsource-removedzzone-of-source-changedz zone-updatedzpolicy-updatedzipset-entry-addedzipset-entry-removedzdirect:chain-addedzdirect:chain-removedzdirect:rule-addedzdirect:rule-removedzdirect:passthrough-addedzdirect:passthrough-removedzconfig:direct:updatedzlockdown-enabledzlockdown-disabledz lockdown-whitelist-command-addedz"lockdown-whitelist-command-removedz lockdown-whitelist-context-addedz"lockdown-whitelist-context-removedz lockdown-whitelist-uid-addedz lockdown-whitelist-uid-removedz lockdown-whitelist-user-addedz lockdown-whitelist-user-removedz*config:policies:lockdown-whitelist-updatedzconfig:ipset-addedzconfig:ipset-updatedzconfig:ipset-removedzconfig:ipset-renamedzconfig:zone-addedzconfig:zone-updatedzconfig:zone-removedzconfig:zone-renamedzconfig:policy-addedzconfig:policy-updatedzconfig:policy-removedzconfig:policy-renamedzconfig:service-addedzconfig:service-updatedzconfig:service-removedzconfig:service-renamedzconfig:icmptype-addedzconfig:icmptype-updatedzconfig:icmptype-removedzconfig:icmptype-renamedzconfig:helper-addedzconfig:helper-updatedzconfig:helper-removedzconfig:helper-renamedr )*r ZmainloopZglibZ
DBusGMainLoopr� Z SystemBusr� Zdefault_timeoutr r r r r Z
DBUS_ERRORr �printZadd_signal_receiver�_dbus_connection_changedr r� �DBUS_INTERFACE_IPSET�DBUS_INTERFACE_ZONE�DBUS_INTERFACE_POLICY�DBUS_INTERFACE_DIRECT�DBUS_INTERFACE_POLICIESr� r# r� r� r0 r- r� r7 rU �_signal_receiver� _callback�
_callbacks�
_init_vars�quietr Ztimeout_add_seconds�_connection_established)r= r� �waitr� r r� r r r r@ , s�
zFirewallClient.__init__c C s: d | _ d | _d | _d | _d | _d | _d | _d | _d| _d S )NF) �fwr$ r� r� r. r� r� �_config� connected)r= r r r r� � s zFirewallClient._init_varsc C s t S )N)r )r= r r r �getExceptionHandler� s z"FirewallClient.getExceptionHandlerc C s |a d S )N)r )r= Zhandlerr r r �setExceptionHandler� s z"FirewallClient.setExceptionHandlerc C s t S )N)r )r= r r r �getNotAuthorizedLoop� s z#FirewallClient.getNotAuthorizedLoopc C s |a d S )N)r )r= �enabler r r �setNotAuthorizedLoop� s z#FirewallClient.setNotAuthorizedLoopc G s0 || j kr ||f| j| j | < n td| ��d S )NzUnknown callback name '%s')r� r� �
ValueError)r= r� �callbackr r r r �connect� s
zFirewallClient.connectc C s* |t jjkrd S |r | j� n| j� d S )N)r r r� r� �_connection_lost)r= r� Z old_ownerZ new_ownerr r r r� � s
z'FirewallClient._dbus_connection_changedc C sX y�| j jtjjtjj�| _tj| jtjjd�| _tj| jtjj d�| _
tj| jtjj d�| _ tj| jtjj
d�| _tj| jtjjd�| _tj| jtjjd�| _tj| jdd�| _W nj tjjk
r� } z| js�td|j� � d S d }~X n4 tk
�r } z| j�std|� d S d }~X nX t| j �| _d| _ | j dtjjd� | j dtjjd� d S ) N)r� z org.freedesktop.DBus.Propertiesr r Tzconnection-established)r� r� zconnection-changed) r� r� r r r� Z DBUS_PATHr� r� r� r� r$ r� r� r� r� r� r� r� rV r� r r r� r� r r r� r� r� r� )r= r r r r r� � sD
z&FirewallClient._connection_establishedc C s0 | j � | jdtjjd� | jdtjjd� d S )Nzconnection-lost)r� r� zconnection-changed)r� r� r r r� )r= r r r r�
s
z FirewallClient._connection_lostc O s� d|ksd|krd S |d }|d }|j tjj�r:d| }|j tjj�rRd| }n�|j tjj�rjd| }n�|j tjj�r�d| }np|j tjj�r�d| }nX|j tjj�r�d| }n@|tjj kr�d | }n*|tjj
kr�d
| }n|tjj kr�d | }d }x<| j D ]2}| j | |kr�| j | | j
kr�| j
| j | }q�W |d k�rBd S d d
� |D �}y(|d �rj|j|d � |d |� W n, tk
�r� } zt|� W Y d d }~X nX d S )Nr� r� z config:Zonez
config:Policyz config:IPSetzconfig:Servicezconfig:IcmpTypez
config:Helperzconfig:zconfig:policies:zconfig:direct:c S s g | ] }t |��qS r )r )r� �argr r r r� C
s z3FirewallClient._signal_receiver.<locals>.<listcomp>rR r )�
startswithr r r� r� r# r0 r7 r- r� rU r� r� r� �extendr r� ) r= r r �signalr� �cbr� Zcb_args�msgr r r r�
sH
z FirewallClient._signal_receiverc C s | j S )N)r� )r= r r r r M
s zFirewallClient.configc C s | j j� d S )N)r� �reload)r= r r r r� R
s zFirewallClient.reloadc C s | j j� d S )N)r� ZcompleteReload)r= r r r �complete_reloadW
s z FirewallClient.complete_reloadc C s | j j� d S )N)r� �runtimeToPermanent)r= r r r r� \
s z!FirewallClient.runtimeToPermanentc C s | j j� d S )N)r� �checkPermanentConfig)r= r r r r� a
s z#FirewallClient.checkPermanentConfigc C s t | jjtjj|��S )N)r r� r� r r r� )r= r� r r r r� f
s zFirewallClient.get_propertyc C s t | jjtjj��S )N)r r� r� r r r� )r= r r r r� l
s z FirewallClient.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r� )r= r� rE r r r r� r
s zFirewallClient.set_propertyc C s | j j� d S )N)r� �enablePanicMode)r= r r r r� y
s z FirewallClient.enablePanicModec C s | j j� d S )N)r� �disablePanicMode)r= r r r r� ~
s z FirewallClient.disablePanicModec C s t | jj� �S )N)r r� �queryPanicMode)r= r r r r� �
s z FirewallClient.queryPanicModec C s t t| jj|���S )N)r" r r� �getZoneSettings2)r= �zoner r r �getZoneSettings�
s z FirewallClient.getZoneSettingsc C s t | jj� �S )N)r r$ � getIPSets)r= r r r r� �
s zFirewallClient.getIPSetsc C s t tt| jj|����S )N)r r9 r r$ �getIPSetSettings)r= �ipsetr r r r� �
s z FirewallClient.getIPSetSettingsc C s | j j||� d S )N)r$ r )r= r� r r r r r �
s zFirewallClient.addEntryc C s | j j|�S )N)r$ r )r= r� r r r r �
s zFirewallClient.getEntriesc C s | j j||�S )N)r$ r )r= r� r r r r r �
s zFirewallClient.setEntriesc C s | j j||� d S )N)r$ r )r= r� r r r r r �
s zFirewallClient.removeEntryc C s t | jj||��S )N)r r$ r! )r= r� r r r r r! �
s zFirewallClient.queryEntryc C s t | jj� �S )N)r r� r� )r= r r r r� �
s zFirewallClient.listServicesc C s t t| jj|���S )N)r� r r� ZgetServiceSettings2)r= ra r r r �getServiceSettings�
s z!FirewallClient.getServiceSettingsc C s t | jj� �S )N)r r� r� )r= r r r r� �
s z FirewallClient.listIcmpTypesc C s t tt| jj|����S )N)r3 r9 r r� �getIcmpTypeSettings)r= r r r r r� �
s z"FirewallClient.getIcmpTypeSettingsc C s t | jj� �S )N)r r� r
)r= r r r r
�
s zFirewallClient.getHelpersc C s t tt| jj|����S )N)r& r9 r r� �getHelperSettings)r= r r r r r� �
s z FirewallClient.getHelperSettingsc C s t | jj� �S )N)r r� �getAutomaticHelpers)r= r r r r� �
s z"FirewallClient.getAutomaticHelpersc C s | j j|� d S )N)r� �setAutomaticHelpers)r= rE r r r r� �
s z"FirewallClient.setAutomaticHelpersc C s t | jj� �S )N)r r� � getLogDenied)r= r r r r� �
s zFirewallClient.getLogDeniedc C s | j j|� d S )N)r� � setLogDenied)r= rE r r r r� �
s zFirewallClient.setLogDeniedc C s t | jj� �S )N)r r� �getDefaultZone)r= r r r r� �
s z FirewallClient.getDefaultZonec C s | j j|� d S )N)r� �setDefaultZone)r= r� r r r r� �
s z FirewallClient.setDefaultZonec C s | j j||j� � d S )N)r� �setZoneSettings2rO )r= r� r5 r r r �setZoneSettings�
s z FirewallClient.setZoneSettingsc C s t | jj� �S )N)r r� �getZones)r= r r r r� �
s zFirewallClient.getZonesc C s t | jj� �S )N)r r� �getActiveZones)r= r r r r� s z FirewallClient.getActiveZonesc C s t | jj|��S )N)r r� r� )r= r� r r r r� s z!FirewallClient.getZoneOfInterfacec C s t | jj|��S )N)r r� r� )r= r� r r r r� s z FirewallClient.getZoneOfSourcec C s t | jj|��S )N)r r� � isImmutable)r= r� r r r r� s zFirewallClient.isImmutablec C s t t| jj|���S )N)r� r r� �getPolicySettings)r= �policyr r r r� s z FirewallClient.getPolicySettingsc C s | j j||j� � d S )N)r� �setPolicySettingsrO )r= r� r5 r r r r� s z FirewallClient.setPolicySettingsc C s t | jj� �S )N)r r� � getPolicies)r= r r r r� $ s zFirewallClient.getPoliciesc C s t | jj� �S )N)r r� �getActivePolicies)r= r r r r� ) s z FirewallClient.getActivePoliciesc C s t | jj|��S )N)r r� r� )r= r� r r r �isPolicyImmutable. s z FirewallClient.isPolicyImmutablec C s t | jj||��S )N)r r� r� )r= r� r� r r r r� 5 s zFirewallClient.addInterfacec C s t | jj||��S )N)r r� �
changeZone)r= r� r� r r r r� : s zFirewallClient.changeZonec C s t | jj||��S )N)r r� �changeZoneOfInterface)r= r� r� r r r r� ? s
z$FirewallClient.changeZoneOfInterfacec C s t | jj|��S )N)r r� r� )r= r� r r r r� E s z FirewallClient.getInterfacesc C s t | jj||��S )N)r r� r� )r= r� r� r r r r� J s z FirewallClient.queryInterfacec C s t | jj||��S )N)r r� r� )r= r� r� r r r r� O s z FirewallClient.removeInterfacec C s t | jj||��S )N)r r� r� )r= r� r� r r r r� V s zFirewallClient.addSourcec C s t | jj||��S )N)r r� �changeZoneOfSource)r= r� r� r r r r� [ s z!FirewallClient.changeZoneOfSourcec C s t | jj|��S )N)r r� r� )r= r� r r r r� ` s zFirewallClient.getSourcesc C s t | jj||��S )N)r r� r� )r= r� r� r r r r� e s zFirewallClient.querySourcec C s t | jj||��S )N)r r� r� )r= r� r� r r r r� j s zFirewallClient.removeSourcec C s t | jj|||��S )N)r r� r� )r= r� r� r r r r r� q s zFirewallClient.addRichRulec C s t | jj|��S )N)r r� r� )r= r� r r r r� v s zFirewallClient.getRichRulesc C s t | jj||��S )N)r r� r� )r= r� r� r r r r� { s z FirewallClient.queryRichRulec C s t | jj||��S )N)r r� r� )r= r� r� r r r r� � s z FirewallClient.removeRichRulec C s t | jj|||��S )N)r r� rb )r= r� ra r r r r rb � s zFirewallClient.addServicec C s t | jj|��S )N)r r� r] )r= r� r r r r] � s zFirewallClient.getServicesc C s t | jj||��S )N)r r� rf )r= r� ra r r r rf � s zFirewallClient.queryServicec C s t | jj||��S )N)r r� re )r= r� ra r r r re � s z FirewallClient.removeServicec C s t | jj||||��S )N)r r� rl )r= r� rj rk r r r r rl � s zFirewallClient.addPortc C s t | jj|��S )N)r r� rh )r= r� r r r rh � s zFirewallClient.getPortsc C s t | jj|||��S )N)r r� rn )r= r� rj rk r r r rn � s zFirewallClient.queryPortc C s t | jj|||��S )N)r r� rm )r= r� rj rk r r r rm � s zFirewallClient.removePortc C s t | jj|||��S )N)r r� rr )r= r� rk r r r r rr � s zFirewallClient.addProtocolc C s t | jj|��S )N)r r� rp )r= r� r r r rp � s zFirewallClient.getProtocolsc C s t | jj||��S )N)r r� rt )r= r� rk r r r rt � s z FirewallClient.queryProtocolc C s t | jj||��S )N)r r� rs )r= r� rk r r r rs � s z FirewallClient.removeProtocolc C s | j j|ddi� d S )Nr2 T)r� r� )r= r� r r r r� � s zFirewallClient.addForwardc C s t | jj|��d S )Nr2 )r r� r� )r= r� r r r r� � s zFirewallClient.queryForwardc C s | j j|ddi� d S )Nr2 F)r� r� )r= r� r r r r� � s z FirewallClient.removeForwardc C s t | jj||��S )N)r r� r� )r= r� r r r r r� � s z FirewallClient.addMasqueradec C s t | jj|��S )N)r r� r� )r= r� r r r r� � s z FirewallClient.queryMasqueradec C s t | jj|��S )N)r r� r� )r= r� r r r r� � s z FirewallClient.removeMasqueradec C s2 |d kr d}|d krd}t | jj||||||��S )Nr# )r r� r� )r= r� rj rk r� r� r r r r r� � s z FirewallClient.addForwardPortc C s t | jj|��S )N)r r� r� )r= r� r r r r� � s z FirewallClient.getForwardPortsc C s0 |d kr d}|d krd}t | jj|||||��S )Nr# )r r� r� )r= r� rj rk r� r� r r r r� � s
z FirewallClient.queryForwardPortc C s0 |d kr d}|d krd}t | jj|||||��S )Nr# )r r� r� )r= r� rj rk r� r� r r r r� s
z FirewallClient.removeForwardPortc C s t | jj||||��S )N)r r� rx )r= r� rj rk r r r r rx s z FirewallClient.addSourcePortc C s t | jj|��S )N)r r� rv )r= r� r r r rv s z FirewallClient.getSourcePortsc C s t | jj|||��S )N)r r� rz )r= r� rj rk r r r rz s z FirewallClient.querySourcePortc C s t | jj|||��S )N)r r� ry )r= r� rj rk r r r ry $ s z FirewallClient.removeSourcePortc C s t | jj|||��S )N)r r� r� )r= r� �icmpr r r r r� , s zFirewallClient.addIcmpBlockc C s t | jj|��S )N)r r� r| )r= r� r r r r| 1 s z FirewallClient.getIcmpBlocksc C s t | jj||��S )N)r r� r� )r= r� r� r r r r� 6 s z FirewallClient.queryIcmpBlockc C s t | jj||��S )N)r r� r� )r= r� r� r r r r� ; s z FirewallClient.removeIcmpBlockc C s t | jj|��S )N)r r� r� )r= r� r r r r� B s z$FirewallClient.addIcmpBlockInversionc C s t | jj|��S )N)r r� r� )r= r� r r r r� G s z&FirewallClient.queryIcmpBlockInversionc C s t | jj|��S )N)r r� r� )r= r� r r r r� L s z'FirewallClient.removeIcmpBlockInversionc C s | j j|||� d S )N)r� rq )r= r( rl ro r r r rq S s zFirewallClient.addChainc C s | j j|||� d S )N)r� rr )r= r( rl ro r r r rr X s zFirewallClient.removeChainc C s t | jj|||��S )N)r r� rs )r= r( rl ro r r r rs ] s zFirewallClient.queryChainc C s t | jj||��S )N)r r� rm )r= r( rl r r r rm b s zFirewallClient.getChainsc C s t | jj� �S )N)r r� rk )r= r r r rk g s zFirewallClient.getAllChainsc C s | j j|||||� d S )N)r� rw )r= r( rl ro r� r r r r rw n s zFirewallClient.addRulec C s | j j|||||� d S )N)r� rx )r= r( rl ro r� r r r r rx s s zFirewallClient.removeRulec C s | j j|||� d S )N)r� ry )r= r( rl ro r r r ry x s zFirewallClient.removeRulesc C s t | jj|||||��S )N)r r� rz )r= r( rl ro r� r r r r rz } s zFirewallClient.queryRulec C s t | jj|||��S )N)r r� ru )r= r( rl ro r r r ru � s zFirewallClient.getRulesc C s t | jj� �S )N)r r� rt )r= r r r rt � s zFirewallClient.getAllRulesc C s t | jj||��S )N)r r� � passthrough)r= r( r r r r r� � s zFirewallClient.passthroughc C s t | jj� �S )N)r r� r{ )r= r r r r{ � s z!FirewallClient.getAllPassthroughsc C s | j j� d S )N)r� r} )r= r r r r} � s z$FirewallClient.removeAllPassthroughsc C s t | jj|��S )N)r r� r~ )r= r( r r r r~ � s z FirewallClient.getPassthroughsc C s | j j||� d S )N)r� r )r= r( r r r r r � s z FirewallClient.addPassthroughc C s | j j||� d S )N)r� r� )r= r( r r r r r� � s z FirewallClient.removePassthroughc C s t | jj||��S )N)r r� r� )r= r( r r r r r� � s z FirewallClient.queryPassthroughc C s | j j� d S )N)rV �enableLockdown)r= r r r r� � s z FirewallClient.enableLockdownc C s | j j� d S )N)rV �disableLockdown)r= r r r r� � s z FirewallClient.disableLockdownc C s t | jj� �S )N)r rV �
queryLockdown)r= r r r r� � s z FirewallClient.queryLockdownc C s | j j|� d S )N)rV rY )r= r< r r r rY � s z*FirewallClient.addLockdownWhitelistCommandc C s t | jj� �S )N)r rV r\ )r= r r r r\ � s z+FirewallClient.getLockdownWhitelistCommandsc C s t | jj|��S )N)r rV r[ )r= r< r r r r[ � s z,FirewallClient.queryLockdownWhitelistCommandc C s | j j|� d S )N)rV rZ )r= r< r r r rZ � s z-FirewallClient.removeLockdownWhitelistCommandc C s | j j|� d S )N)rV r] )r= rB r r r r] � s z*FirewallClient.addLockdownWhitelistContextc C s t | jj� �S )N)r rV r` )r= r r r r` � s z+FirewallClient.getLockdownWhitelistContextsc C s t | jj|��S )N)r rV r_ )r= rB r r r r_ � s z,FirewallClient.queryLockdownWhitelistContextc C s | j j|� d S )N)rV r^ )r= rB r r r r^ � s z-FirewallClient.removeLockdownWhitelistContextc C s | j j|� d S )N)rV rg )r= rO r r r rg � s z&FirewallClient.addLockdownWhitelistUidc C s t | jj� �S )N)r rV re )r= r r r re � s z'FirewallClient.getLockdownWhitelistUidsc C s t | jj|��S )N)r rV ri )r= rO r r r ri � s z(FirewallClient.queryLockdownWhitelistUidc C s | j j|� d S )N)rV rh )r= rO r r r rh s z)FirewallClient.removeLockdownWhitelistUidc C s | j j|� d S )N)rV ra )r= rH r r r ra
s z'FirewallClient.addLockdownWhitelistUserc C s t | jj� �S )N)r rV rd )r= r r r rd s z(FirewallClient.getLockdownWhitelistUsersc C s t | jj|��S )N)r rV rc )r= rH r r r rc s z)FirewallClient.queryLockdownWhitelistUserc C s | j j|� d S )N)rV rb )r= rH r r r rb s z*FirewallClient.removeLockdownWhitelistUserc C s | j j� dS )z( Authorize once for all polkit actions. N)r� � authorizeAll)r= r r r r� s zFirewallClient.authorizeAll)Nr T)r )r )r )r )r )r )r )r )�r� r� r� r! r@ r� r� r� r� r� r� r� r� r� r� r� r r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r! r� r� r� r� r
r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rb r] rf re rl rh rn rm rr rp rt rs r� r� r� r� r� r� r� r� r� r� rx rv rz ry r� r| r� r� r� r� r� rq rr rs rm rk rw rx ry rz ru rt r� r{ r} r~ r r� r� r� r� r� rY r\ r[ rZ r] r` r_ r^ rg re ri rh ra rd rc rb r� r r r r r� + s* & 0
r� )4Z
gi.repositoryr r �sysr� Zdbus.mainloop.glibr Z slip.dbusr� r Zfirewallr Zfirewall.core.baser r r Zfirewall.dbus_utilsr Zfirewall.functionsr
Zfirewall.core.richr Zfirewall.core.ipsetr r
r r Zfirewall.errorsr r r r r! �objectr" r� r� r� r� r r" r& r, r/ r3 r6 r9 rS rj r� r� r� r r r r �<module> sd
' ; R8 ghyK CzVtbm __pycache__/fw_types.cpython-36.pyc 0000644 00000005613 15035135171 0013250 0 ustar 00 3
��g� � @ s d gZ G dd � d e�ZdS )�LastUpdatedOrderedDictc @ sx e Zd Zd dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zd dd�ZdS ) r Nc C s i | _ g | _|r| j|� d S )N)�_dict�_list�update)�self�x� r � /usr/lib/python3.6/fw_types.py�__init__ s z LastUpdatedOrderedDict.__init__c C s | j d d �= | jj� d S )N)r r �clear)r r r r r
s z LastUpdatedOrderedDict.clearc C s" x |j � D ]\}}|| |< q
W d S )N)�items)r r �key�valuer r r r # s z LastUpdatedOrderedDict.updatec s � fdd�� j D �S )Nc s g | ]}|� | f�qS r r )�.0r )r r r �
<listcomp>( s z0LastUpdatedOrderedDict.items.<locals>.<listcomp>)r )r r )r r r ' s z LastUpdatedOrderedDict.itemsc C s" || j kr | jj|� | j |= d S )N)r r �remove)r r r r r � __delitem__* s
z"LastUpdatedOrderedDict.__delitem__c s& d� j jdj� fdd�� jD ��f S )Nz%s([%s])z, c s g | ]}d |� | f �qS )z(%r, %r)r )r r )r r r r 1 s z3LastUpdatedOrderedDict.__repr__.<locals>.<listcomp>)� __class__�__name__�joinr )r r )r r �__repr__/ s z LastUpdatedOrderedDict.__repr__c C s$ || j kr| jj|� || j |< d S )N)r r �append)r r r
r r r � __setitem__3 s
z"LastUpdatedOrderedDict.__setitem__c C s$ t |�tkr| j| S | j| S d S )N)�type�intr r )r r r r r � __getitem__8 s
z"LastUpdatedOrderedDict.__getitem__c C s
t | j�S )N)�lenr )r r r r �__len__> s z LastUpdatedOrderedDict.__len__c C s t | �S )N)r )r r r r �copyA s zLastUpdatedOrderedDict.copyc C s | j d d � S )N)r )r r r r �keysD s zLastUpdatedOrderedDict.keysc s � fdd�� j D �S )Nc s g | ] }� | �qS r r )r r )r r r r H s z1LastUpdatedOrderedDict.values.<locals>.<listcomp>)r )r r )r r �valuesG s z LastUpdatedOrderedDict.valuesc C s || kr| | S || |< |S d S )Nr )r r r
r r r �
setdefaultJ s z!LastUpdatedOrderedDict.setdefault)N)N)r �
__module__� __qualname__r r
r r r r r r r r r r r r r r r r s
N)�__all__�objectr r r r r �<module> s __pycache__/client.cpython-36.opt-1.pyc 0000644 00000426232 15035135171 0013631 0 ustar 00 3
��g� � @ s� d dl mZmZ d dlZeejd< d dlZd dlZd dl m Z d dl
m Z d dl m
Z
mZmZ d dlmZ d dlmZ d d lmZ d d
lmZmZmZ d d l
mZ d d lm Z d dlZd dl Z da d
a e dd� �Z G dd� de!�Z"G dd� de!�Z#G dd� de!�Z$G dd� de!�Z%G dd� de!�Z&G dd� de!�Z'G d d � d e!�Z(G d d � d e!�Z)G d d!� d!e!�Z*G d"d#� d#e!�Z+G d$d%� d%e!�Z,G d&d'� d'e!�Z-G d(d)� d)e!�Z.G d*d+� d+e!�Z/G d,d-� d-e!�Z0G d.d/� d/e!�Z1G d0d1� d1e!�Z2G d2d3� d3e!�Z3dS )4� )�GLib�GObjectNZgobject)� decorator)�config)�DEFAULT_ZONE_TARGET�DEFAULT_POLICY_TARGET�DEFAULT_POLICY_PRIORITY)�dbus_to_python)�b2u)� Rich_Rule)�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�errors)�
FirewallErrorFc O s d}�x|�sy
| ||�S t jjk
r� } zb|j� }|j� }tsD� d|krVtd� n4d|krht|� n"d}|rzt|� nttt|��� W Y dd}~X nf tk
r� } z ts�� nttt|��� W Y dd}~X n. t k
� r� ts� nttt
j � �� Y nX t sP qW dS )z#Decorator to handle exceptions
FZNotAuthorizedExceptionzorg.freedesktop.DBus.ErrorTN)
�dbus�
exceptions�
DBusException�get_dbus_messageZ
get_dbus_name�exception_handlerr
�strr � Exception� traceback�
format_exc�not_authorized_loop)�func�args�kwargsZ
authorized�eZ dbus_messageZ dbus_name� r � /usr/lib/python3.6/client.py�handle_exceptions0 s6
r! c @ s� e Zd Zed�dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%edFdG� �Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-e.j/j0j1edVdW� ��Z2e.j/j0j1edXdY� ��Z3e.j/j0j1edZd[� ��Z4ed\d]� �Z5ed^d_� �Z6e.j/j0j1ed`da� ��Z7e.j/j0j1edbdc� ��Z8e.j/j0j1eddde� ��Z9edfdg� �Z:edhdi� �Z;e.j/j0j1edjdk� ��Z<e.j/j0j1edldm� ��Z=e.j/j0j1edndo� ��Z>edpdq� �Z?edrds� �Z@edtdu� �ZAedvdw� �ZBedxdy� �ZCedzd{� �ZDed|d}� �ZEed~d� �ZFed�d�� �ZGed�d�� �ZHed�d�� �ZIed�d�� �ZJed�d�� �ZKed�d�� �ZLed�d�� �ZMed�d�� �ZNed�d�� �ZOed�d�� �ZPed�d�� �ZQed�d�� �ZRdS )��FirewallClientZoneSettingsNc C s� ddddt g g g dg g g g g g ddg| _ddddddd d
d d d
ddddddg| _dddddddddddddddddg| _|r�t|t�r�x"t|�D ]\}}|| | j|< q�W t|t�r�| j|� d S )N� F�version�short� description�UNUSED�target�services�ports� icmp_blocks�
masquerade�
forward_ports�
interfaces�sourcesZ rules_str� protocols� source_portsZicmp_block_inversion�forward�s�bz(ss)z(ssss)) r �settings�
settings_name�settings_dbus_type�
isinstance�list� enumerate�dict�setSettingsDict)�selfr5 �i�vr r r �__init__X s(
z#FirewallClientZoneSettings.__init__c C s d| j | jf S )Nz%s(%r))� __class__r5 )r= r r r �__repr__o s z#FirewallClientZoneSettings.__repr__c C s6 i }x,t | j| j�D ]\}}|dkr&q|||< qW |S )Nr' )�zipr6 r5 )r= r5 �key�valuer r r �getSettingsDicts s z*FirewallClientZoneSettings.getSettingsDictc C s( x"|D ]}|| | j | jj|�< qW d S )N)r5 r6 �index)r= r5 rD r r r r< { s
z*FirewallClientZoneSettings.setSettingsDictc C s| i }xrt | j| j| j�D ]\\}}}|dkr,qt|�tkrLtj||d�||< qt|�tkrltj ||d�||< q|||< qW |S )Nr' )� signature)
rC r6 r5 r7 �typer9 r �Arrayr; �
Dictionary)r= r5 rD rE �sigr r r �getSettingsDbusDict s z.FirewallClientZoneSettings.getSettingsDbusDictc C s$ | j � }|d= |d= |d= |d= |S )Nr$ r% r& r( )rF )r= r5 r r r �getRuntimeSettingsDict� s z1FirewallClientZoneSettings.getRuntimeSettingsDictc C s$ | j � }|d= |d= |d= |d= |S )Nr$ r% r& r( )rM )r= r5 r r r �getRuntimeSettingsDbusDict� s z5FirewallClientZoneSettings.getRuntimeSettingsDbusDictc C s
| j d S )Nr )r5 )r= r r r �
getVersion� s z%FirewallClientZoneSettings.getVersionc C s || j d< d S )Nr )r5 )r= r$ r r r �
setVersion� s z%FirewallClientZoneSettings.setVersionc C s
| j d S )N� )r5 )r= r r r �getShort� s z#FirewallClientZoneSettings.getShortc C s || j d< d S )NrR )r5 )r= r% r r r �setShort� s z#FirewallClientZoneSettings.setShortc C s
| j d S )N� )r5 )r= r r r �getDescription� s z)FirewallClientZoneSettings.getDescriptionc C s || j d< d S )NrU )r5 )r= r& r r r �setDescription� s z)FirewallClientZoneSettings.setDescriptionc C s | j d tkr| j d S dS )N� �default)r5 r )r= r r r � getTarget� s z$FirewallClientZoneSettings.getTargetc C s |dkr |nt | jd< d S )NrY rX )r r5 )r= r( r r r � setTarget� s z$FirewallClientZoneSettings.setTargetc C s
| j d S )N� )r5 )r= r r r � getServices� s z&FirewallClientZoneSettings.getServicesc C s || j d< d S )Nr\ )r5 )r= r) r r r � setServices� s z&FirewallClientZoneSettings.setServicesc C s0 || j d kr | j d j|� n ttj|��d S )Nr\ )r5 �appendr r �ALREADY_ENABLED)r= �servicer r r �
addService� s z%FirewallClientZoneSettings.addServicec C s0 || j d kr | j d j|� n ttj|��d S )Nr\ )r5 �remover r � NOT_ENABLED)r= ra r r r �
removeService� s z(FirewallClientZoneSettings.removeServicec C s || j d kS )Nr\ )r5 )r= ra r r r � queryService� s z'FirewallClientZoneSettings.queryServicec C s
| j d S )N� )r5 )r= r r r �getPorts� s z#FirewallClientZoneSettings.getPortsc C s || j d< d S )Nrg )r5 )r= r* r r r �setPorts� s z#FirewallClientZoneSettings.setPortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nrg z'%s:%s')r5 r_ r r r` )r= �port�protocolr r r �addPort� s z"FirewallClientZoneSettings.addPortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nrg z'%s:%s')r5 rc r r rd )r= rj rk r r r �
removePort� s z%FirewallClientZoneSettings.removePortc C s ||f| j d kS )Nrg )r5 )r= rj rk r r r � queryPort� s z$FirewallClientZoneSettings.queryPortc C s
| j d S )N�
)r5 )r= r r r � getProtocols� s z'FirewallClientZoneSettings.getProtocolsc C s || j d< d S )Nro )r5 )r= r0 r r r � setProtocols� s z'FirewallClientZoneSettings.setProtocolsc C s0 || j d kr | j d j|� n ttj|��d S )Nro )r5 r_ r r r` )r= rk r r r � addProtocol� s z&FirewallClientZoneSettings.addProtocolc C s0 || j d kr | j d j|� n ttj|��d S )Nro )r5 rc r r rd )r= rk r r r �removeProtocol� s z)FirewallClientZoneSettings.removeProtocolc C s || j d kS )Nro )r5 )r= rk r r r �
queryProtocol� s z(FirewallClientZoneSettings.queryProtocolc C s
| j d S )N� )r5 )r= r r r �getSourcePorts s z)FirewallClientZoneSettings.getSourcePortsc C s || j d< d S )Nru )r5 )r= r* r r r �setSourcePorts s z)FirewallClientZoneSettings.setSourcePortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nru z'%s:%s')r5 r_ r r r` )r= rj rk r r r �
addSourcePort s z(FirewallClientZoneSettings.addSourcePortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nru z'%s:%s')r5 rc r r rd )r= rj rk r r r �removeSourcePort s z+FirewallClientZoneSettings.removeSourcePortc C s ||f| j d kS )Nru )r5 )r= rj rk r r r �querySourcePort s z*FirewallClientZoneSettings.querySourcePortc C s
| j d S )N� )r5 )r= r r r �
getIcmpBlocks s z(FirewallClientZoneSettings.getIcmpBlocksc C s || j d< d S )Nr{ )r5 )r= �
icmpblocksr r r �
setIcmpBlocks s z(FirewallClientZoneSettings.setIcmpBlocksc C s0 || j d kr | j d j|� n ttj|��d S )Nr{ )r5 r_ r r r` )r= �icmptyper r r � addIcmpBlock s z'FirewallClientZoneSettings.addIcmpBlockc C s0 || j d kr | j d j|� n ttj|��d S )Nr{ )r5 rc r r rd )r= r r r r �removeIcmpBlock& s z*FirewallClientZoneSettings.removeIcmpBlockc C s || j d kS )Nr{ )r5 )r= r r r r �queryIcmpBlock, s z)FirewallClientZoneSettings.queryIcmpBlockc C s
| j d S )N� )r5 )r= r r r �getIcmpBlockInversion0 s z0FirewallClientZoneSettings.getIcmpBlockInversionc C s || j d< d S )Nr� )r5 )r= �flagr r r �setIcmpBlockInversion3 s z0FirewallClientZoneSettings.setIcmpBlockInversionc C s& | j d sd| j d< n ttjd� d S )Nr� Tzicmp-block-inversion)r5 r r r` )r= r r r �addIcmpBlockInversion6 s
z0FirewallClientZoneSettings.addIcmpBlockInversionc C s& | j d rd| j d< n ttjd� d S )Nr� Fzicmp-block-inversion)r5 r r rd )r= r r r �removeIcmpBlockInversion= s
z3FirewallClientZoneSettings.removeIcmpBlockInversionc C s
| j d S )Nr� )r5 )r= r r r �queryIcmpBlockInversionD s z2FirewallClientZoneSettings.queryIcmpBlockInversionc C s
| j d S )N� )r5 )r= r r r �
getForwardI s z%FirewallClientZoneSettings.getForwardc C s || j d< d S )Nr� )r5 )r= r2 r r r �
setForwardL s z%FirewallClientZoneSettings.setForwardc C s& | j d sd| j d< n ttjd� d S )Nr� Tr2 )r5 r r r` )r= r r r �
addForwardO s
z%FirewallClientZoneSettings.addForwardc C s& | j d rd| j d< n ttjd� d S )Nr� Fr2 )r5 r r rd )r= r r r �
removeForwardV s
z(FirewallClientZoneSettings.removeForwardc C s
| j d S )Nr� )r5 )r= r r r � queryForward] s z'FirewallClientZoneSettings.queryForwardc C s
| j d S )N� )r5 )r= r r r �
getMasqueradeb s z(FirewallClientZoneSettings.getMasqueradec C s || j d< d S )Nr� )r5 )r= r, r r r �
setMasqueradee s z(FirewallClientZoneSettings.setMasqueradec C s& | j d sd| j d< n ttjd� d S )Nr� Tr, )r5 r r r` )r= r r r �
addMasqueradeh s
z(FirewallClientZoneSettings.addMasqueradec C s& | j d rd| j d< n ttjd� d S )Nr� Fr, )r5 r r rd )r= r r r �removeMasqueradeo s
z+FirewallClientZoneSettings.removeMasqueradec C s
| j d S )Nr� )r5 )r= r r r �queryMasqueradev s z*FirewallClientZoneSettings.queryMasqueradec C s
| j d S )N� )r5 )r= r r r �getForwardPorts{ s z*FirewallClientZoneSettings.getForwardPortsc C s || j d< d S )Nr� )r5 )r= r* r r r �setForwardPorts~ s z*FirewallClientZoneSettings.setForwardPortsc C sd |d kr d}|d krd}||||f| j d krH| j d j||||f� nttjd||||f ��d S )Nr# r� z
'%s:%s:%s:%s')r5 r_ r r r` )r= rj rk �to_port�to_addrr r r �addForwardPort� s z)FirewallClientZoneSettings.addForwardPortc C sd |d kr d}|d krd}||||f| j d krH| j d j||||f� nttjd||||f ��d S )Nr# r� z
'%s:%s:%s:%s')r5 rc r r rd )r= rj rk r� r� r r r �removeForwardPort� s z,FirewallClientZoneSettings.removeForwardPortc C s. |d kr d}|d krd}||||f| j d kS )Nr# r� )r5 )r= rj rk r� r� r r r �queryForwardPort� s
z+FirewallClientZoneSettings.queryForwardPortc C s
| j d S )N�
)r5 )r= r r r �
getInterfaces� s z(FirewallClientZoneSettings.getInterfacesc C s || j d< d S )Nr� )r5 )r= r. r r r �
setInterfaces� s z(FirewallClientZoneSettings.setInterfacesc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= � interfacer r r � addInterface� s z'FirewallClientZoneSettings.addInterfacec C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r� r r r �removeInterface� s z*FirewallClientZoneSettings.removeInterfacec C s || j d kS )Nr� )r5 )r= r� r r r �queryInterface� s z)FirewallClientZoneSettings.queryInterfacec C s
| j d S )N� )r5 )r= r r r �
getSources� s z%FirewallClientZoneSettings.getSourcesc C s || j d< d S )Nr� )r5 )r= r/ r r r �
setSources� s z%FirewallClientZoneSettings.setSourcesc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= �sourcer r r � addSource� s z$FirewallClientZoneSettings.addSourcec C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r� r r r � removeSource� s z'FirewallClientZoneSettings.removeSourcec C s || j d kS )Nr� )r5 )r= r� r r r � querySource� s z&FirewallClientZoneSettings.querySourcec C s
| j d S )N� )r5 )r= r r r � getRichRules� s z'FirewallClientZoneSettings.getRichRulesc C s dd� |D �}|| j d< d S )Nc S s g | ]}t t|d ���qS ))�rule_str)r r )�.0�rr r r �
<listcomp>� s z;FirewallClientZoneSettings.setRichRules.<locals>.<listcomp>r� )r5 )r= �rulesr r r � setRichRules� s z'FirewallClientZoneSettings.setRichRulesc C s> t t|d��}|| jd kr.| jd j|� n ttj|��d S )N)r� r� )r r r5 r_ r r r` )r= �ruler r r � addRichRule� s z&FirewallClientZoneSettings.addRichRulec C s> t t|d��}|| jd kr.| jd j|� n ttj|��d S )N)r� r� )r r r5 rc r r rd )r= r� r r r �removeRichRule� s z)FirewallClientZoneSettings.removeRichRulec C s t t|d��}|| jd kS )N)r� r� )r r r5 )r= r� r r r �
queryRichRule� s z(FirewallClientZoneSettings.queryRichRule)N)S�__name__�
__module__� __qualname__r! r@ rB rF r< rM rN rO rP rQ rS rT rV rW rZ r[ r] r^ rb re rf rh ri rl rm rn rp rq rr rs rt rv rw rx ry rz r| r~ r� r� r� r� r� �slipr �polkit� enable_proxyr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r" W s�
r" c @ s� e Zd Zdd� Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zejjjed)d*� ��Z ejjjed+d,� ��Z ejjjed-d.� ��Z ejjjed/d0� ��Z ejjjed1d2� ��Z ejjjed3d4� ��Z!ejjjed5d6� ��Z"ejjjed7d8� ��Z#ejjjed9d:� ��Z$ejjjed;d<� ��Z%ejjjed=d>� ��Z&ejjjed?d@� ��Z'ejjjedAdB� ��Z(ejjjedCdD� ��Z)ejjjedEdF� ��Z*ejjjedGdH� ��Z+ejjjedIdJ� ��Z,ejjjedKdL� ��Z-ejjjedMdN� ��Z.ejjjedOdP� ��Z/ejjjedQdR� ��Z0ejjjedSdT� ��Z1ejjjedUdV� ��Z2ejjjedWdX� ��Z3ejjjedYdZ� ��Z4ejjjed[d\� ��Z5ejjjed]d^� ��Z6ejjjed_d`� ��Z7ejjjedadb� ��Z8ejjjedcdd� ��Z9ejjjededf� ��Z:ejjjedgdh� ��Z;ejjjedidj� ��Z<ejjjedkdl� ��Z=ejjjedmdn� ��Z>ejjjedodp� ��Z?ejjjedqdr� ��Z@ejjjedsdt� ��ZAejjjedudv� ��ZBejjjedwdx� ��ZCejjjedydz� ��ZDejjjed{d|� ��ZEejjjed}d~� ��ZFejjjedd�� ��ZGejjjed�d�� ��ZHejjjed�d�� ��ZIejjjed�d�� ��ZJejjjed�d�� ��ZKejjjed�d�� ��ZLejjjed�d�� ��ZMejjjed�d�� ��ZNejjjed�d�� ��ZOejjjed�d�� ��ZPejjjed�d�� ��ZQejjjed�d�� ��ZRejjjed�d�� ��ZSejjjed�d�� ��ZTd�S )��FirewallClientConfigZonec C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)�dbus_interfacez org.freedesktop.DBus.Properties) �bus�path�
get_objectr r �DBUS_INTERFACE�dbus_obj� Interface�DBUS_INTERFACE_CONFIG_ZONE�fw_zone�
fw_properties)r= r� r� r r r r@ � s z!FirewallClientConfigZone.__init__c C s t | jjtjj|��S )N)r r� �Getr r r� )r= �propr r r � get_property� s z%FirewallClientConfigZone.get_propertyc C s t | jjtjj��S )N)r r� �GetAllr r r� )r= r r r �get_properties� s z'FirewallClientConfigZone.get_propertiesc C s | j jtjj||� d S )N)r� �Setr r r� )r= r� rE r r r � set_property s z%FirewallClientConfigZone.set_propertyc C s t t| jj� ��S )N)r" r r� � getSettings2)r= r r r � getSettings s z$FirewallClientConfigZone.getSettingsc C s | j j|j� � d S )N)r� �update2rM )r= r5 r r r �update s z FirewallClientConfigZone.updatec C s | j j� d S )N)r� � loadDefaults)r= r r r r� s z%FirewallClientConfigZone.loadDefaultsc C s | j j� d S )N)r� rc )r= r r r rc s z FirewallClientConfigZone.removec C s | j j|� d S )N)r� �rename)r= �namer r r r� s z FirewallClientConfigZone.renamec C s
| j j� S )N)r� rP )r= r r r rP " s z#FirewallClientConfigZone.getVersionc C s | j j|� d S )N)r� rQ )r= r$ r r r rQ ' s z#FirewallClientConfigZone.setVersionc C s
| j j� S )N)r� rS )r= r r r rS . s z!FirewallClientConfigZone.getShortc C s | j j|� d S )N)r� rT )r= r% r r r rT 3 s z!FirewallClientConfigZone.setShortc C s
| j j� S )N)r� rV )r= r r r rV : s z'FirewallClientConfigZone.getDescriptionc C s | j j|� d S )N)r� rW )r= r& r r r rW ? s z'FirewallClientConfigZone.setDescriptionc C s
| j j� S )N)r� rZ )r= r r r rZ F s z"FirewallClientConfigZone.getTargetc C s | j j|� d S )N)r� r[ )r= r( r r r r[ K s z"FirewallClientConfigZone.setTargetc C s
| j j� S )N)r� r] )r= r r r r] R s z$FirewallClientConfigZone.getServicesc C s | j j|� d S )N)r� r^ )r= r) r r r r^ W s z$FirewallClientConfigZone.setServicesc C s | j j|� d S )N)r� rb )r= ra r r r rb \ s z#FirewallClientConfigZone.addServicec C s | j j|� d S )N)r� re )r= ra r r r re a s z&FirewallClientConfigZone.removeServicec C s | j j|�S )N)r� rf )r= ra r r r rf f s z%FirewallClientConfigZone.queryServicec C s
| j j� S )N)r� rh )r= r r r rh m s z!FirewallClientConfigZone.getPortsc C s | j j|� d S )N)r� ri )r= r* r r r ri r s z!FirewallClientConfigZone.setPortsc C s | j j||� d S )N)r� rl )r= rj rk r r r rl w s z FirewallClientConfigZone.addPortc C s | j j||� d S )N)r� rm )r= rj rk r r r rm | s z#FirewallClientConfigZone.removePortc C s | j j||�S )N)r� rn )r= rj rk r r r rn � s z"FirewallClientConfigZone.queryPortc C s
| j j� S )N)r� rp )r= r r r rp � s z%FirewallClientConfigZone.getProtocolsc C s | j j|� d S )N)r� rq )r= r0 r r r rq � s z%FirewallClientConfigZone.setProtocolsc C s | j j|� d S )N)r� rr )r= rk r r r rr � s z$FirewallClientConfigZone.addProtocolc C s | j j|� d S )N)r� rs )r= rk r r r rs � s z'FirewallClientConfigZone.removeProtocolc C s | j j|�S )N)r� rt )r= rk r r r rt � s z&FirewallClientConfigZone.queryProtocolc C s
| j j� S )N)r� rv )r= r r r rv � s z'FirewallClientConfigZone.getSourcePortsc C s | j j|� d S )N)r� rw )r= r* r r r rw � s z'FirewallClientConfigZone.setSourcePortsc C s | j j||� d S )N)r� rx )r= rj rk r r r rx � s z&FirewallClientConfigZone.addSourcePortc C s | j j||� d S )N)r� ry )r= rj rk r r r ry � s z)FirewallClientConfigZone.removeSourcePortc C s | j j||�S )N)r� rz )r= rj rk r r r rz � s z(FirewallClientConfigZone.querySourcePortc C s
| j j� S )N)r� r| )r= r r r r| � s z&FirewallClientConfigZone.getIcmpBlocksc C s | j j|� d S )N)r� r~ )r= Z icmptypesr r r r~ � s z&FirewallClientConfigZone.setIcmpBlocksc C s | j j|� d S )N)r� r� )r= r r r r r� � s z%FirewallClientConfigZone.addIcmpBlockc C s | j j|� d S )N)r� r� )r= r r r r r� � s z(FirewallClientConfigZone.removeIcmpBlockc C s | j j|�S )N)r� r� )r= r r r r r� � s z'FirewallClientConfigZone.queryIcmpBlockc C s
| j j� S )N)r� r� )r= r r r r� � s z.FirewallClientConfigZone.getIcmpBlockInversionc C s | j j|� d S )N)r� r� )r= Z inversionr r r r� � s z.FirewallClientConfigZone.setIcmpBlockInversionc C s | j j� d S )N)r� r� )r= r r r r� � s z.FirewallClientConfigZone.addIcmpBlockInversionc C s | j j� d S )N)r� r� )r= r r r r� � s z1FirewallClientConfigZone.removeIcmpBlockInversionc C s
| j j� S )N)r� r� )r= r r r r� � s z0FirewallClientConfigZone.queryIcmpBlockInversionc C s | j j� d S )Nr2 )r� r� )r= r r r r� � s z#FirewallClientConfigZone.getForwardc C s | j jd|i� d S )Nr2 )r� r� )r= r2 r r r r� � s z#FirewallClientConfigZone.setForwardc C s | j jddi� d S )Nr2 T)r� r� )r= r r r r� � s z#FirewallClientConfigZone.addForwardc C s | j jddi� d S )Nr2 F)r� r� )r= r r r r� s z&FirewallClientConfigZone.removeForwardc C s | j j� d S )Nr2 )r� r� )r= r r r r� s z%FirewallClientConfigZone.queryForwardc C s
| j j� S )N)r� r� )r= r r r r� s z&FirewallClientConfigZone.getMasqueradec C s | j j|� d S )N)r� r� )r= r, r r r r� s z&FirewallClientConfigZone.setMasqueradec C s | j j� d S )N)r� r� )r= r r r r� s z&FirewallClientConfigZone.addMasqueradec C s | j j� d S )N)r� r� )r= r r r r� s z)FirewallClientConfigZone.removeMasqueradec C s
| j j� S )N)r� r� )r= r r r r� # s z(FirewallClientConfigZone.queryMasqueradec C s
| j j� S )N)r� r� )r= r r r r� * s z(FirewallClientConfigZone.getForwardPortsc C s | j j|� d S )N)r� r� )r= r* r r r r� / s z(FirewallClientConfigZone.setForwardPortsc C s. |d kr d}|d krd}| j j||||� d S )Nr# )r� r� )r= rj rk �toport�toaddrr r r r� 4 s
z'FirewallClientConfigZone.addForwardPortc C s. |d kr d}|d krd}| j j||||� d S )Nr# )r� r� )r= rj rk r� r� r r r r� = s
z*FirewallClientConfigZone.removeForwardPortc C s* |d kr d}|d krd}| j j||||�S )Nr# )r� r� )r= rj rk r� r� r r r r� F s
z)FirewallClientConfigZone.queryForwardPortc C s
| j j� S )N)r� r� )r= r r r r� Q s z&FirewallClientConfigZone.getInterfacesc C s | j j|� d S )N)r� r� )r= r. r r r r� V s z&FirewallClientConfigZone.setInterfacesc C s | j j|� d S )N)r� r� )r= r� r r r r� [ s z%FirewallClientConfigZone.addInterfacec C s | j j|� d S )N)r� r� )r= r� r r r r� ` s z(FirewallClientConfigZone.removeInterfacec C s | j j|�S )N)r� r� )r= r� r r r r� e s z'FirewallClientConfigZone.queryInterfacec C s
| j j� S )N)r� r� )r= r r r r� l s z#FirewallClientConfigZone.getSourcesc C s | j j|� d S )N)r� r� )r= r/ r r r r� q s z#FirewallClientConfigZone.setSourcesc C s | j j|� d S )N)r� r� )r= r� r r r r� v s z"FirewallClientConfigZone.addSourcec C s | j j|� d S )N)r� r� )r= r� r r r r� { s z%FirewallClientConfigZone.removeSourcec C s | j j|�S )N)r� r� )r= r� r r r r� � s z$FirewallClientConfigZone.querySourcec C s
| j j� S )N)r� r� )r= r r r r� � s z%FirewallClientConfigZone.getRichRulesc C s | j j|� d S )N)r� r� )r= r� r r r r� � s z%FirewallClientConfigZone.setRichRulesc C s | j j|� d S )N)r� r� )r= r� r r r r� � s z$FirewallClientConfigZone.addRichRulec C s | j j|� d S )N)r� r� )r= r� r r r r� � s z'FirewallClientConfigZone.removeRichRulec C s | j j|�S )N)r� r� )r= r� r r r r� � s z&FirewallClientConfigZone.queryRichRuleN)Ur� r� r� r@ r� r r� r� r! r� r� r� r� r� r� rc r� rP rQ rS rT rV rW rZ r[ r] r^ rb re rf rh ri rl rm rn rp rq rr rs rt rv rw rx ry rz r| r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� � s2
r� c @ s@ e Zd Zed�dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zd d
� Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%edFdG� �Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,e-j.j/j0edTdU� ��Z1e-j.j/j0edVdW� ��Z2e-j.j/j0edXdY� ��Z3edZd[� �Z4ed\d]� �Z5ed^d_� �Z6ed`da� �Z7edbdc� �Z8eddde� �Z9edfdg� �Z:edhdi� �Z;edjdk� �Z<edldm� �Z=edndo� �Z>edpdq� �Z?edrds� �Z@edtdu� �ZAedvdw� �ZBedxdy� �ZCedzd{� �ZDed|d}� �ZEed~d� �ZFed�d�� �ZGed�d�� �ZHed�d�� �ZIdS )�� FirewallClientPolicySettingsNc C s\ dg g g g dg t g g g dg tdd�| _dddddddddddddddg| _|rX| j|� d S ) Nr# F)r& � egress_zonesr- r+ �
ingress_zonesr, r* �priorityr0 �
rich_rulesr) r% r1 r( r$ r3 z(ssss)r4 z(ss)r> )r r r5 r7 r< )r= r5 r r r r@ � s,
z%FirewallClientPolicySettings.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB � s z%FirewallClientPolicySettings.__repr__c C s | j S )N)r5 )r= r r r rF � s z,FirewallClientPolicySettings.getSettingsDictc C s x|D ]}|| | j |< qW d S )N)r5 )r= r5 rD r r r r< � s
z,FirewallClientPolicySettings.setSettingsDictc C sv i }xlt | j| j�D ]Z\}}| j| }t|�tkrFtj||d�||< qt|�tkrftj||d�||< q|||< qW |S )N)rH ) rC r5 r7 rI r9 r rJ r; rK )r= r5 rD rL rE r r r rM � s
z0FirewallClientPolicySettings.getSettingsDbusDictc C s | j � }xdD ]
}||= qW |S )Nr$ r% r& r( )r$ r% r& r( )rM )r= r5 rD r r r rO � s
z7FirewallClientPolicySettings.getRuntimeSettingsDbusDictc C s
| j d S )Nr$ )r5 )r= r r r rP � s z'FirewallClientPolicySettings.getVersionc C s || j d< d S )Nr$ )r5 )r= r$ r r r rQ � s z'FirewallClientPolicySettings.setVersionc C s
| j d S )Nr% )r5 )r= r r r rS � s z%FirewallClientPolicySettings.getShortc C s || j d< d S )Nr% )r5 )r= r% r r r rT � s z%FirewallClientPolicySettings.setShortc C s
| j d S )Nr& )r5 )r= r r r rV � s z+FirewallClientPolicySettings.getDescriptionc C s || j d< d S )Nr& )r5 )r= r& r r r rW � s z+FirewallClientPolicySettings.setDescriptionc C s
| j d S )Nr( )r5 )r= r r r rZ � s z&FirewallClientPolicySettings.getTargetc C s || j d< d S )Nr( )r5 )r= r( r r r r[ � s z&FirewallClientPolicySettings.setTargetc C s
| j d S )Nr) )r5 )r= r r r r] � s z(FirewallClientPolicySettings.getServicesc C s || j d< d S )Nr) )r5 )r= r) r r r r^ � s z(FirewallClientPolicySettings.setServicesc C s0 || j d kr | j d j|� n ttj|��d S )Nr) )r5 r_ r r r` )r= ra r r r rb � s z'FirewallClientPolicySettings.addServicec C s0 || j d kr | j d j|� n ttj|��d S )Nr) )r5 rc r r rd )r= ra r r r re s z*FirewallClientPolicySettings.removeServicec C s || j d kS )Nr) )r5 )r= ra r r r rf s z)FirewallClientPolicySettings.queryServicec C s
| j d S )Nr* )r5 )r= r r r rh
s z%FirewallClientPolicySettings.getPortsc C s || j d< d S )Nr* )r5 )r= r* r r r ri
s z%FirewallClientPolicySettings.setPortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr* z'%s:%s')r5 r_ r r r` )r= rj rk r r r rl s z$FirewallClientPolicySettings.addPortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr* z'%s:%s')r5 rc r r rd )r= rj rk r r r rm s z'FirewallClientPolicySettings.removePortc C s ||f| j d kS )Nr* )r5 )r= rj rk r r r rn s z&FirewallClientPolicySettings.queryPortc C s
| j d S )Nr0 )r5 )r= r r r rp " s z)FirewallClientPolicySettings.getProtocolsc C s || j d< d S )Nr0 )r5 )r= r0 r r r rq % s z)FirewallClientPolicySettings.setProtocolsc C s0 || j d kr | j d j|� n ttj|��d S )Nr0 )r5 r_ r r r` )r= rk r r r rr ( s z(FirewallClientPolicySettings.addProtocolc C s0 || j d kr | j d j|� n ttj|��d S )Nr0 )r5 rc r r rd )r= rk r r r rs . s z+FirewallClientPolicySettings.removeProtocolc C s || j d kS )Nr0 )r5 )r= rk r r r rt 4 s z*FirewallClientPolicySettings.queryProtocolc C s
| j d S )Nr1 )r5 )r= r r r rv 8 s z+FirewallClientPolicySettings.getSourcePortsc C s || j d< d S )Nr1 )r5 )r= r* r r r rw ; s z+FirewallClientPolicySettings.setSourcePortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr1 z'%s:%s')r5 r_ r r r` )r= rj rk r r r rx > s z*FirewallClientPolicySettings.addSourcePortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr1 z'%s:%s')r5 rc r r rd )r= rj rk r r r ry E s z-FirewallClientPolicySettings.removeSourcePortc C s ||f| j d kS )Nr1 )r5 )r= rj rk r r r rz L s z,FirewallClientPolicySettings.querySourcePortc C s
| j d S )Nr+ )r5 )r= r r r r| P s z*FirewallClientPolicySettings.getIcmpBlocksc C s || j d< d S )Nr+ )r5 )r= r} r r r r~ S s z*FirewallClientPolicySettings.setIcmpBlocksc C s0 || j d kr | j d j|� n ttj|��d S )Nr+ )r5 r_ r r r` )r= r r r r r� V s z)FirewallClientPolicySettings.addIcmpBlockc C s0 || j d kr | j d j|� n ttj|��d S )Nr+ )r5 rc r r rd )r= r r r r r� \ s z,FirewallClientPolicySettings.removeIcmpBlockc C s || j d kS )Nr+ )r5 )r= r r r r r� b s z+FirewallClientPolicySettings.queryIcmpBlockc C s
| j d S )Nr, )r5 )r= r r r r� f s z*FirewallClientPolicySettings.getMasqueradec C s || j d< d S )Nr, )r5 )r= r, r r r r� i s z*FirewallClientPolicySettings.setMasqueradec C s& | j d sd| j d< n ttjd� d S )Nr, T)r5 r r r` )r= r r r r� l s
z*FirewallClientPolicySettings.addMasqueradec C s& | j d rd| j d< n ttjd� d S )Nr, F)r5 r r rd )r= r r r r� s s
z-FirewallClientPolicySettings.removeMasqueradec C s
| j d S )Nr, )r5 )r= r r r r� z s z,FirewallClientPolicySettings.queryMasqueradec C s
| j d S )Nr- )r5 )r= r r r r� s z,FirewallClientPolicySettings.getForwardPortsc C s || j d< d S )Nr- )r5 )r= r* r r r r� � s z,FirewallClientPolicySettings.setForwardPortsc C sd |d kr d}|d krd}||||f| j d krH| j d j||||f� nttjd||||f ��d S )Nr# r- z
'%s:%s:%s:%s')r5 r_ r r r` )r= rj rk r� r� r r r r� � s z+FirewallClientPolicySettings.addForwardPortc C sd |d kr d}|d krd}||||f| j d krH| j d j||||f� nttjd||||f ��d S )Nr# r- z
'%s:%s:%s:%s')r5 rc r r rd )r= rj rk r� r� r r r r� � s z.FirewallClientPolicySettings.removeForwardPortc C s. |d kr d}|d krd}||||f| j d kS )Nr# r- )r5 )r= rj rk r� r� r r r r� � s
z-FirewallClientPolicySettings.queryForwardPortc C s
| j d S )Nr� )r5 )r= r r r r� � s z)FirewallClientPolicySettings.getRichRulesc C s dd� |D �}|| j d< d S )Nc S s g | ]}t t|d ���qS ))r� )r r )r� r� r r r r� � s z=FirewallClientPolicySettings.setRichRules.<locals>.<listcomp>r� )r5 )r= r� r r r r� � s z)FirewallClientPolicySettings.setRichRulesc C s> t t|d��}|| jd kr.| jd j|� n ttj|��d S )N)r� r� )r r r5 r_ r r r` )r= r� r r r r� � s z(FirewallClientPolicySettings.addRichRulec C s> t t|d��}|| jd kr.| jd j|� n ttj|��d S )N)r� r� )r r r5 rc r r rd )r= r� r r r r� � s z+FirewallClientPolicySettings.removeRichRulec C s t t|d��}|| jd kS )N)r� r� )r r r5 )r= r� r r r r� � s z*FirewallClientPolicySettings.queryRichRulec C s
| j d S )Nr� )r5 )r= r r r �getIngressZones� s z,FirewallClientPolicySettings.getIngressZonesc C s || j d< d S )Nr� )r5 )r= r� r r r �setIngressZones� s z,FirewallClientPolicySettings.setIngressZonesc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= � ingress_zoner r r �addIngressZone� s z+FirewallClientPolicySettings.addIngressZonec C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r� r r r �removeIngressZone� s z.FirewallClientPolicySettings.removeIngressZonec C s || j d kS )Nr� )r5 )r= r� r r r �queryIngressZone� s z-FirewallClientPolicySettings.queryIngressZonec C s
| j d S )Nr� )r5 )r= r r r �getEgressZones� s z+FirewallClientPolicySettings.getEgressZonesc C s || j d< d S )Nr� )r5 )r= r� r r r �setEgressZones� s z+FirewallClientPolicySettings.setEgressZonesc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= � egress_zoner r r �
addEgressZone� s z*FirewallClientPolicySettings.addEgressZonec C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r� r r r �removeEgressZone� s z-FirewallClientPolicySettings.removeEgressZonec C s || j d kS )Nr� )r5 )r= r� r r r �queryEgressZone� s z,FirewallClientPolicySettings.queryEgressZonec C s
| j d S )Nr� )r5 )r= r r r � getPriority� s z(FirewallClientPolicySettings.getPriorityc C s t |�| jd< d S )Nr� )�intr5 )r= r� r r r � setPriority� s z(FirewallClientPolicySettings.setPriority)N)Jr� r� r� r! r@ rB rF r< rM rO rP rQ rS rT rV rW rZ r[ r] r^ rb re rf rh ri rl rm rn rp rq rr rs rt rv rw rx ry rz r| r~ r� r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� � s� r� c @ s� e Zd Zdd� Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��ZdS )�FirewallClientConfigPolicyc C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)r� z org.freedesktop.DBus.Properties) r� r� r� r r r� r� r� � DBUS_INTERFACE_CONFIG_POLICY� fw_policyr� )r= r� r� r r r r@ � s z#FirewallClientConfigPolicy.__init__c C s t | jjtjj|��S )N)r r� r� r r r� )r= r� r r r r� � s z'FirewallClientConfigPolicy.get_propertyc C s t | jjtjj��S )N)r r� r� r r r� )r= r r r r� s z)FirewallClientConfigPolicy.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r� )r= r� rE r r r r� s z'FirewallClientConfigPolicy.set_propertyc C s t t| jj� ��S )N)r� r r� r� )r= r r r r�
s z&FirewallClientConfigPolicy.getSettingsc C s | j j|j� � d S )N)r� r� rM )r= r5 r r r r� s z!FirewallClientConfigPolicy.updatec C s | j j� d S )N)r� r� )r= r r r r� s z'FirewallClientConfigPolicy.loadDefaultsc C s | j j� d S )N)r� rc )r= r r r rc s z!FirewallClientConfigPolicy.removec C s | j j|� d S )N)r� r� )r= r� r r r r� ! s z!FirewallClientConfigPolicy.renameN)r� r� r� r@ r� r r� r� r! r� r� r� r� r� r� rc r� r r r r r� � s"
r� c @ s8 e Zd Zed^dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%ed_dFdG��Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1dS )`� FirewallClientServiceSettingsNc
C s� dddg g i g g g g g
| _ dddddddd d
d g
| _d d d d
d dd d
d d g
| _|r�t|�tkr�x:t|�D ]\}}|| | j |< qhW nt|�tkr�| j|� d S )Nr# r$ r% r& r* �modules� destinationr0 r1 �includes�helpersr3 z(ss)Zss)r5 r6 r7 rI r9 r: r; r< )r= r5 r> r? r r r r@ ) s z&FirewallClientServiceSettings.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB 9 s z&FirewallClientServiceSettings.__repr__c C s, i }x"t | j| j�D ]\}}|||< qW |S )N)rC r6 r5 )r= r5 rD rE r r r rF = s z-FirewallClientServiceSettings.getSettingsDictc C s( x"|D ]}|| | j | jj|�< qW d S )N)r5 r6 rG )r= r5 rD r r r r< C s
z-FirewallClientServiceSettings.setSettingsDictc C sr i }xht | j| j| j�D ]R\}}}t|�tkrBtj||d�||< qt|�tkrbtj ||d�||< q|||< qW |S )N)rH )
rC r6 r5 r7 rI r9 r rJ r; rK )r= r5 rD rE rL r r r rM G s z1FirewallClientServiceSettings.getSettingsDbusDictc C s
| j d S )Nr )r5 )r= r r r rP S s z(FirewallClientServiceSettings.getVersionc C s || j d< d S )Nr )r5 )r= r$ r r r rQ V s z(FirewallClientServiceSettings.setVersionc C s
| j d S )NrR )r5 )r= r r r rS Z s z&FirewallClientServiceSettings.getShortc C s || j d< d S )NrR )r5 )r= r% r r r rT ] s z&FirewallClientServiceSettings.setShortc C s
| j d S )NrU )r5 )r= r r r rV a s z,FirewallClientServiceSettings.getDescriptionc C s || j d< d S )NrU )r5 )r= r& r r r rW d s z,FirewallClientServiceSettings.setDescriptionc C s
| j d S )N� )r5 )r= r r r rh h s z&FirewallClientServiceSettings.getPortsc C s || j d< d S )Nr� )r5 )r= r* r r r ri k s z&FirewallClientServiceSettings.setPortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr� z'%s:%s')r5 r_ r r r` )r= rj rk r r r rl n s z%FirewallClientServiceSettings.addPortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr� z'%s:%s')r5 rc r r rd )r= rj rk r r r rm u s z(FirewallClientServiceSettings.removePortc C s ||f| j d kS )Nr� )r5 )r= rj rk r r r rn | s z'FirewallClientServiceSettings.queryPortc C s
| j d S )Nrg )r5 )r= r r r rp � s z*FirewallClientServiceSettings.getProtocolsc C s || j d< d S )Nrg )r5 )r= r0 r r r rq � s z*FirewallClientServiceSettings.setProtocolsc C s0 || j d kr | j d j|� n ttj|��d S )Nrg )r5 r_ r r r` )r= rk r r r rr � s z)FirewallClientServiceSettings.addProtocolc C s0 || j d kr | j d j|� n ttj|��d S )Nrg )r5 rc r r rd )r= rk r r r rs � s z,FirewallClientServiceSettings.removeProtocolc C s || j d kS )Nrg )r5 )r= rk r r r rt � s z+FirewallClientServiceSettings.queryProtocolc C s
| j d S )Nr{ )r5 )r= r r r rv � s z,FirewallClientServiceSettings.getSourcePortsc C s || j d< d S )Nr{ )r5 )r= r* r r r rw � s z,FirewallClientServiceSettings.setSourcePortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr{ z'%s:%s')r5 r_ r r r` )r= rj rk r r r rx � s z+FirewallClientServiceSettings.addSourcePortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr{ z'%s:%s')r5 rc r r rd )r= rj rk r r r ry � s z.FirewallClientServiceSettings.removeSourcePortc C s ||f| j d kS )Nr{ )r5 )r= rj rk r r r rz � s z-FirewallClientServiceSettings.querySourcePortc C s
| j d S )NrX )r5 )r= r r r �
getModules� s z(FirewallClientServiceSettings.getModulesc C s || j d< d S )NrX )r5 )r= r� r r r �
setModules� s z(FirewallClientServiceSettings.setModulesc C s0 || j d kr | j d j|� n ttj|��d S )NrX )r5 r_ r r r` )r= �moduler r r � addModule� s z'FirewallClientServiceSettings.addModulec C s0 || j d kr | j d j|� n ttj|��d S )NrX )r5 rc r r rd )r= r� r r r � removeModule� s z*FirewallClientServiceSettings.removeModulec C s || j d kS )NrX )r5 )r= r� r r r � queryModule� s z)FirewallClientServiceSettings.queryModulec C s
| j d S )Nr\ )r5 )r= r r r �getDestinations� s z-FirewallClientServiceSettings.getDestinationsc C s || j d< d S )Nr\ )r5 )r= � destinationsr r r �setDestinations� s z-FirewallClientServiceSettings.setDestinationsc C sH || j d ks | j d | |kr0|| j d |< nttjd||f ��d S )Nr\ z'%s:%s')r5 r r r` )r= � dest_type�addressr r r �setDestination� s
z,FirewallClientServiceSettings.setDestinationc C s^ || j d krJ|d k r<| j d | |kr<ttjd||f ��| j d |= nttjd| ��d S )Nr\ z'%s:%s'z'%s')r5 r r rd )r= r� r r r r �removeDestination� s z/FirewallClientServiceSettings.removeDestinationc C s || j d ko || j d | kS )Nr\ )r5 )r= r� r r r r �queryDestination� s z.FirewallClientServiceSettings.queryDestinationc C s
| j d S )Nr� )r5 )r= r r r � getIncludes� s z)FirewallClientServiceSettings.getIncludesc C s || j d< d S )Nr� )r5 )r= r� r r r � setIncludes� s z)FirewallClientServiceSettings.setIncludesc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= �includer r r �
addInclude� s z(FirewallClientServiceSettings.addIncludec C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r r r r �
removeInclude� s z+FirewallClientServiceSettings.removeIncludec C s || j d kS )Nr� )r5 )r= r r r r � queryInclude� s z*FirewallClientServiceSettings.queryIncludec C s
| j d S )Nr� )r5 )r= r r r �
getHelpers� s z(FirewallClientServiceSettings.getHelpersc C s || j d< d S )Nr� )r5 )r= r� r r r �
setHelpers� s z(FirewallClientServiceSettings.setHelpersc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 r_ r r r` )r= �helperr r r � addHelper� s z'FirewallClientServiceSettings.addHelperc C s0 || j d kr | j d j|� n ttj|��d S )Nr� )r5 rc r r rd )r= r r r r � removeHelper s z*FirewallClientServiceSettings.removeHelperc C s || j d kS )Nr� )r5 )r= r r r r � queryHelper s z)FirewallClientServiceSettings.queryHelper)N)N)2r� r� r� r! r@ rB rF r< rM rP rQ rS rT rV rW rh ri rl rm rn rp rq rr rs rt rv rw rx ry rz r� r� r� r� r� r� r� r r r r r r r r r
r r
r r r r r r r� ( s` r� c @ s� e Zd Zed*dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �ZdS )+�FirewallClientIPSetSettingsNc C s" |r || _ nddddi g g| _ d S )Nr# )r5 )r= r5 r r r r@ s z$FirewallClientIPSetSettings.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB s z$FirewallClientIPSetSettings.__repr__c C s
| j d S )Nr )r5 )r= r r r rP s z&FirewallClientIPSetSettings.getVersionc C s || j d< d S )Nr )r5 )r= r$ r r r rQ s z&FirewallClientIPSetSettings.setVersionc C s
| j d S )NrR )r5 )r= r r r rS ! s z$FirewallClientIPSetSettings.getShortc C s || j d< d S )NrR )r5 )r= r% r r r rT $ s z$FirewallClientIPSetSettings.setShortc C s
| j d S )NrU )r5 )r= r r r rV ( s z*FirewallClientIPSetSettings.getDescriptionc C s || j d< d S )NrU )r5 )r= r& r r r rW + s z*FirewallClientIPSetSettings.setDescriptionc C s
| j d S )Nr� )r5 )r= r r r �getType/ s z#FirewallClientIPSetSettings.getTypec C s || j d< d S )Nr� )r5 )r= Z
ipset_typer r r �setType2 s z#FirewallClientIPSetSettings.setTypec C s
| j d S )NrX )r5 )r= r r r �
getOptions6 s z&FirewallClientIPSetSettings.getOptionsc C s || j d< d S )NrX )r5 )r= Zoptionsr r r �
setOptions9 s z&FirewallClientIPSetSettings.setOptionsc C sP || j d ks | j d | |kr0|| j d |< n ttj|rFd||f n|��d S )NrX z'%s=%s')r5 r r r` )r= rD rE r r r � addOption< s z%FirewallClientIPSetSettings.addOptionc C s, || j d kr | j d |= n ttj|��d S )NrX )r5 r r rd )r= rD r r r � removeOptionC s z(FirewallClientIPSetSettings.removeOptionc C s || j d ko | j d | |kS )NrX )r5 )r= rD rE r r r � queryOptionI s z'FirewallClientIPSetSettings.queryOptionc C s
| j d S )Nr\ )r5 )r= r r r �
getEntriesM s z&FirewallClientIPSetSettings.getEntriesc C s@ d| j d kr*| j d d dkr*ttj��t|� || j d< d S )N�timeoutrX �0r\ )r5 r r �IPSET_WITH_TIMEOUTr )r= �entriesr r r �
setEntriesP s
z&FirewallClientIPSetSettings.setEntriesc C sr d| j d kr*| j d d dkr*ttj��t|�}|| j d krbt|| j d � | j d j|� n ttj|��d S )Nr rX r r\ )r5 r r r r r
r_ r` )r= �entryr r r �addEntryW s
z$FirewallClientIPSetSettings.addEntryc C sb d| j d kr*| j d d dkr*ttj��t|�}|| j d krR| j d j|� n ttj|��d S )Nr rX r r\ )r5 r r r r rc rd )r= r r r r � removeEntryb s
z'FirewallClientIPSetSettings.removeEntryc C s@ d| j d kr*| j d d dkr*ttj��t|�}|| j d kS )Nr rX r r\ )r5 r r r r )r= r r r r �
queryEntryl s
z&FirewallClientIPSetSettings.queryEntry)N)r� r� r� r! r@ rB rP rQ rS rT rV rW r r r r r r r r r r r r! r r r r r s*
r c @ s� e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zd)S )*�FirewallClientConfigIPSetc C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)r� z org.freedesktop.DBus.Properties) r� r� r� r r r� r� r� �DBUS_INTERFACE_CONFIG_IPSET�fw_ipsetr� )r= r� r� r r r r@ w s z"FirewallClientConfigIPSet.__init__c C s t | jjtjj|��S )N)r r� r� r r r# )r= r� r r r r� � s z&FirewallClientConfigIPSet.get_propertyc C s t | jjtjj��S )N)r r� r� r r r# )r= r r r r� � s z(FirewallClientConfigIPSet.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r# )r= r� rE r r r r� � s z&FirewallClientConfigIPSet.set_propertyc C s t tt| jj� ���S )N)r r9 r r$ r� )r= r r r r� � s z%FirewallClientConfigIPSet.getSettingsc C s | j jt|j�� d S )N)r$ r� �tupler5 )r= r5 r r r r� � s z FirewallClientConfigIPSet.updatec C s | j j� d S )N)r$ r� )r= r r r r� � s z&FirewallClientConfigIPSet.loadDefaultsc C s | j j� d S )N)r$ rc )r= r r r rc � s z FirewallClientConfigIPSet.removec C s | j j|� d S )N)r$ r� )r= r� r r r r� � s z FirewallClientConfigIPSet.renamec C s
| j j� S )N)r$ rP )r= r r r rP � s z$FirewallClientConfigIPSet.getVersionc C s | j j|� d S )N)r$ rQ )r= r$ r r r rQ � s z$FirewallClientConfigIPSet.setVersionc C s
| j j� S )N)r$ rS )r= r r r rS � s z"FirewallClientConfigIPSet.getShortc C s | j j|� d S )N)r$ rT )r= r% r r r rT � s z"FirewallClientConfigIPSet.setShortc C s
| j j� S )N)r$ rV )r= r r r rV � s z(FirewallClientConfigIPSet.getDescriptionc C s | j j|� d S )N)r$ rW )r= r& r r r rW � s z(FirewallClientConfigIPSet.setDescriptionc C s
| j j� S )N)r$ r )r= r r r r � s z$FirewallClientConfigIPSet.getEntriesc C s | j j|� d S )N)r$ r )r= r r r r r � s z$FirewallClientConfigIPSet.setEntriesc C s | j j|� d S )N)r$ r )r= r r r r r � s z"FirewallClientConfigIPSet.addEntryc C s | j j|� d S )N)r$ r )r= r r r r r � s z%FirewallClientConfigIPSet.removeEntryc C s | j j|�S )N)r$ r! )r= r r r r r! � s z$FirewallClientConfigIPSet.queryEntryN) r� r� r� r! r@ r� r r� r� r� r� r� r� r� r� rc r� rP rQ rS rT rV rW r r r r r! r r r r r" v sN r" c @ s� e Zd Zed$dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �ZdS )%� FirewallClientHelperSettingsNc C s" |r || _ ndddddg g| _ d S )Nr# )r5 )r= r5 r r r r@ � s z%FirewallClientHelperSettings.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB � s z%FirewallClientHelperSettings.__repr__c C s
| j d S )Nr )r5 )r= r r r rP � s z'FirewallClientHelperSettings.getVersionc C s || j d< d S )Nr )r5 )r= r$ r r r rQ � s z'FirewallClientHelperSettings.setVersionc C s
| j d S )NrR )r5 )r= r r r rS s z%FirewallClientHelperSettings.getShortc C s || j d< d S )NrR )r5 )r= r% r r r rT s z%FirewallClientHelperSettings.setShortc C s
| j d S )NrU )r5 )r= r r r rV s z+FirewallClientHelperSettings.getDescriptionc C s || j d< d S )NrU )r5 )r= r& r r r rW s z+FirewallClientHelperSettings.setDescriptionc C s
| j d S )Nr� )r5 )r= r r r � getFamily s z&FirewallClientHelperSettings.getFamilyc C s |d krd| j d< || j d< d S )Nr# r� )r5 )r= �ipvr r r � setFamily s
z&FirewallClientHelperSettings.setFamilyc C s
| j d S )NrX )r5 )r= r r r � getModule s z&FirewallClientHelperSettings.getModulec C s || j d< d S )NrX )r5 )r= r� r r r � setModule s z&FirewallClientHelperSettings.setModulec C s
| j d S )Nr\ )r5 )r= r r r rh s z%FirewallClientHelperSettings.getPortsc C s || j d< d S )Nr\ )r5 )r= r* r r r ri # s z%FirewallClientHelperSettings.setPortsc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr\ z'%s:%s')r5 r_ r r r` )r= rj rk r r r rl & s z$FirewallClientHelperSettings.addPortc C s@ ||f| j d kr(| j d j||f� nttjd||f ��d S )Nr\ z'%s:%s')r5 rc r r rd )r= rj rk r r r rm - s z'FirewallClientHelperSettings.removePortc C s ||f| j d kS )Nr\ )r5 )r= rj rk r r r rn 4 s z&FirewallClientHelperSettings.queryPort)N)r� r� r� r! r@ rB rP rQ rS rT rV rW r' r) r* r+ rh ri rl rm rn r r r r r& � s$ r& c @ s e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zejjjed)d*� ��Z ejjjed+d,� ��Z ejjjed-d.� ��Z ejjjed/d0� ��Z d1S )2�FirewallClientConfigHelperc C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)r� z org.freedesktop.DBus.Properties) r� r� r� r r r� r� r� � DBUS_INTERFACE_CONFIG_HELPER� fw_helperr� )r= r� r� r r r r@ ; s z#FirewallClientConfigHelper.__init__c C s t | jjtjj|��S )N)r r� r� r r r- )r= r� r r r r� F s z'FirewallClientConfigHelper.get_propertyc C s t | jjtjj��S )N)r r� r� r r r- )r= r r r r� L s z)FirewallClientConfigHelper.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r- )r= r� rE r r r r� R s z'FirewallClientConfigHelper.set_propertyc C s t tt| jj� ���S )N)r& r9 r r. r� )r= r r r r� X s z&FirewallClientConfigHelper.getSettingsc C s | j jt|j�� d S )N)r. r� r% r5 )r= r5 r r r r� ^ s z!FirewallClientConfigHelper.updatec C s | j j� d S )N)r. r� )r= r r r r� c s z'FirewallClientConfigHelper.loadDefaultsc C s | j j� d S )N)r. rc )r= r r r rc h s z!FirewallClientConfigHelper.removec C s | j j|� d S )N)r. r� )r= r� r r r r� m s z!FirewallClientConfigHelper.renamec C s
| j j� S )N)r. rP )r= r r r rP t s z%FirewallClientConfigHelper.getVersionc C s | j j|� d S )N)r. rQ )r= r$ r r r rQ y s z%FirewallClientConfigHelper.setVersionc C s
| j j� S )N)r. rS )r= r r r rS � s z#FirewallClientConfigHelper.getShortc C s | j j|� d S )N)r. rT )r= r% r r r rT � s z#FirewallClientConfigHelper.setShortc C s
| j j� S )N)r. rV )r= r r r rV � s z)FirewallClientConfigHelper.getDescriptionc C s | j j|� d S )N)r. rW )r= r& r r r rW � s z)FirewallClientConfigHelper.setDescriptionc C s
| j j� S )N)r. rh )r= r r r rh � s z#FirewallClientConfigHelper.getPortsc C s | j j|� d S )N)r. ri )r= r* r r r ri � s z#FirewallClientConfigHelper.setPortsc C s | j j||� d S )N)r. rl )r= rj rk r r r rl � s z"FirewallClientConfigHelper.addPortc C s | j j||� d S )N)r. rm )r= rj rk r r r rm � s z%FirewallClientConfigHelper.removePortc C s | j j||�S )N)r. rn )r= rj rk r r r rn � s z$FirewallClientConfigHelper.queryPortc C s
| j j� S )N)r. r' )r= r r r r' � s z$FirewallClientConfigHelper.getFamilyc C s$ |d kr| j jd� | j j|� d S )Nr# )r. r) )r= r( r r r r) � s z$FirewallClientConfigHelper.setFamilyc C s
| j j� S )N)r. r* )r= r r r r* � s z$FirewallClientConfigHelper.getModulec C s | j j|� d S )N)r. r+ )r= r� r r r r+ � s z$FirewallClientConfigHelper.setModuleN) r� r� r� r! r@ r� r r� r� r� r� r� r� r� r� rc r� rP rQ rS rT rV rW rh ri rl rm rn r' r) r* r+ r r r r r, : s^ r, c @ s� e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zejjjed)d*� ��Z ejjjed+d,� ��Z ejjjed-d.� ��Z ejjjed/d0� ��Z ejjjed1d2� ��Z ejjjed3d4� ��Z!ejjjed5d6� ��Z"ejjjed7d8� ��Z#ejjjed9d:� ��Z$ejjjed;d<� ��Z%ejjjed=d>� ��Z&ejjjed?d@� ��Z'ejjjedAdB� ��Z(ejjjedCdD� ��Z)ejjjedEdF� ��Z*ejjjedGdH� ��Z+ejjjedIdJ� ��Z,ejjjedKdL� ��Z-ejjjedMdN� ��Z.ejjjed^dPdQ���Z/ejjjedRdS� ��Z0ejjjedTdU� ��Z1ejjjedVdW� ��Z2ejjjedXdY� ��Z3ejjjedZd[� ��Z4ejjjed\d]� ��Z5dOS )_�FirewallClientConfigServicec C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)r� z org.freedesktop.DBus.Properties) r� r� r� r r r� r� r� � DBUS_INTERFACE_CONFIG_SERVICE�
fw_servicer� )r= r� r� r r r r@ � s z$FirewallClientConfigService.__init__c C s t | jjtjj|��S )N)r r� r� r r r0 )r= r� r r r r� � s z(FirewallClientConfigService.get_propertyc C s t | jjtjj��S )N)r r� r� r r r0 )r= r r r r� � s z*FirewallClientConfigService.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r0 )r= r� rE r r r r� � s z(FirewallClientConfigService.set_propertyc C s t t| jj� ��S )N)r� r r1 r� )r= r r r r� � s z'FirewallClientConfigService.getSettingsc C s | j j|j� � d S )N)r1 r� rM )r= r5 r r r r� � s z"FirewallClientConfigService.updatec C s | j j� d S )N)r1 r� )r= r r r r� � s z(FirewallClientConfigService.loadDefaultsc C s | j j� d S )N)r1 rc )r= r r r rc � s z"FirewallClientConfigService.removec C s | j j|� d S )N)r1 r� )r= r� r r r r� s z"FirewallClientConfigService.renamec C s
| j j� S )N)r1 rP )r= r r r rP s z&FirewallClientConfigService.getVersionc C s | j j|� d S )N)r1 rQ )r= r$ r r r rQ s z&FirewallClientConfigService.setVersionc C s
| j j� S )N)r1 rS )r= r r r rS s z$FirewallClientConfigService.getShortc C s | j j|� d S )N)r1 rT )r= r% r r r rT s z$FirewallClientConfigService.setShortc C s
| j j� S )N)r1 rV )r= r r r rV s z*FirewallClientConfigService.getDescriptionc C s | j j|� d S )N)r1 rW )r= r& r r r rW $ s z*FirewallClientConfigService.setDescriptionc C s
| j j� S )N)r1 rh )r= r r r rh + s z$FirewallClientConfigService.getPortsc C s | j j|� d S )N)r1 ri )r= r* r r r ri 0 s z$FirewallClientConfigService.setPortsc C s | j j||� d S )N)r1 rl )r= rj rk r r r rl 5 s z#FirewallClientConfigService.addPortc C s | j j||� d S )N)r1 rm )r= rj rk r r r rm : s z&FirewallClientConfigService.removePortc C s | j j||�S )N)r1 rn )r= rj rk r r r rn ? s z%FirewallClientConfigService.queryPortc C s
| j j� S )N)r1 rp )r= r r r rp F s z(FirewallClientConfigService.getProtocolsc C s | j j|� d S )N)r1 rq )r= r0 r r r rq K s z(FirewallClientConfigService.setProtocolsc C s | j j|� d S )N)r1 rr )r= rk r r r rr P s z'FirewallClientConfigService.addProtocolc C s | j j|� d S )N)r1 rs )r= rk r r r rs U s z*FirewallClientConfigService.removeProtocolc C s | j j|�S )N)r1 rt )r= rk r r r rt Z s z)FirewallClientConfigService.queryProtocolc C s
| j j� S )N)r1 rv )r= r r r rv a s z*FirewallClientConfigService.getSourcePortsc C s | j j|� d S )N)r1 rw )r= r* r r r rw f s z*FirewallClientConfigService.setSourcePortsc C s | j j||� d S )N)r1 rx )r= rj rk r r r rx k s z)FirewallClientConfigService.addSourcePortc C s | j j||� d S )N)r1 ry )r= rj rk r r r ry p s z,FirewallClientConfigService.removeSourcePortc C s | j j||�S )N)r1 rz )r= rj rk r r r rz u s z+FirewallClientConfigService.querySourcePortc C s
| j j� S )N)r1 r� )r= r r r r� | s z&FirewallClientConfigService.getModulesc C s | j j|� d S )N)r1 r� )r= r� r r r r� � s z&FirewallClientConfigService.setModulesc C s | j j|� d S )N)r1 r� )r= r� r r r r� � s z%FirewallClientConfigService.addModulec C s | j j|� d S )N)r1 r� )r= r� r r r r� � s z(FirewallClientConfigService.removeModulec C s | j j|�S )N)r1 r� )r= r� r r r r� � s z'FirewallClientConfigService.queryModulec C s
| j j� S )N)r1 r� )r= r r r r� � s z+FirewallClientConfigService.getDestinationsc C s | j j|� d S )N)r1 r� )r= r� r r r r� � s z+FirewallClientConfigService.setDestinationsc C s | j j|�S )N)r1 �getDestination)r= r� r r r r2 � s z*FirewallClientConfigService.getDestinationc C s | j j||� d S )N)r1 r )r= r� r r r r r � s z*FirewallClientConfigService.setDestinationNc C s: |d k r*| j |�|kr*ttjd||f ��| jj|� d S )Nz'%s:%s')r2 r r rd r1 r )r= r� r r r r r � s z-FirewallClientConfigService.removeDestinationc C s | j j||�S )N)r1 r )r= r� r r r r r � s z,FirewallClientConfigService.queryDestinationc C s
| j j� S )N)r1 r )r= r r r r � s z'FirewallClientConfigService.getIncludesc C s | j j|� d S )N)r1 r )r= r� r r r r � s z'FirewallClientConfigService.setIncludesc C s | j j|� d S )N)r1 r )r= r r r r r � s z&FirewallClientConfigService.addIncludec C s | j j|� d S )N)r1 r )r= r r r r r � s z)FirewallClientConfigService.removeIncludec C s | j j|�S )N)r1 r )r= r r r r r � s z(FirewallClientConfigService.queryInclude)N)6r� r� r� r! r@ r� r r� r� r� r� r� r� r� r� rc r� rP rQ rS rT rV rW rh ri rl rm rn rp rq rr rs rt rv rw rx ry rz r� r� r� r� r� r� r� r2 r r r r r r r r r r r r r/ � s� r/ c @ s� e Zd Zed dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �ZdS ) � FirewallClientIcmpTypeSettingsNc C s |r || _ ndddg g| _ d S )Nr# )r5 )r= r5 r r r r@ � s z'FirewallClientIcmpTypeSettings.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB � s z'FirewallClientIcmpTypeSettings.__repr__c C s
| j d S )Nr )r5 )r= r r r rP � s z)FirewallClientIcmpTypeSettings.getVersionc C s || j d< d S )Nr )r5 )r= r$ r r r rQ � s z)FirewallClientIcmpTypeSettings.setVersionc C s
| j d S )NrR )r5 )r= r r r rS � s z'FirewallClientIcmpTypeSettings.getShortc C s || j d< d S )NrR )r5 )r= r% r r r rT � s z'FirewallClientIcmpTypeSettings.setShortc C s
| j d S )NrU )r5 )r= r r r rV � s z-FirewallClientIcmpTypeSettings.getDescriptionc C s || j d< d S )NrU )r5 )r= r& r r r rW � s z-FirewallClientIcmpTypeSettings.setDescriptionc C s
| j d S )Nr� )r5 )r= r r r r� � s z.FirewallClientIcmpTypeSettings.getDestinationsc C s || j d< d S )Nr� )r5 )r= r� r r r r� � s z.FirewallClientIcmpTypeSettings.setDestinationsc C sH | j d sttj|��n,|| j d kr8| j d j|� n ttj|��d S )Nr� )r5 r r r` r_ )r= r� r r r �addDestination� s
z-FirewallClientIcmpTypeSettings.addDestinationc C s\ || j d kr | j d j|� n8| j d sL| jttddg�t|g� �� n ttj|��d S )Nr� Zipv4Zipv6)r5 rc r� r9 �setr r rd )r= r� r r r r s
z0FirewallClientIcmpTypeSettings.removeDestinationc C s | j d p|| j d kS )Nr� )r5 )r= r� r r r r s z/FirewallClientIcmpTypeSettings.queryDestination)N)r� r� r� r! r@ rB rP rQ rS rT rV rW r� r� r4 r r r r r r r3 � s r3 c @ s� e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zd)S )*� FirewallClientConfigIcmpTypec C sL || _ || _| j jtjj|�| _tj| jtjjd�| _ tj| jdd�| _
d S )N)r� z org.freedesktop.DBus.Properties) r� r� r� r r r� r� r� � DBUS_INTERFACE_CONFIG_ICMPTYPE� fw_icmptyper� )r= r� r� r r r r@ s z%FirewallClientConfigIcmpType.__init__c C s t | jjtjj|��S )N)r r� r� r r r7 )r= r� r r r r� % s z)FirewallClientConfigIcmpType.get_propertyc C s t | jjtjj��S )N)r r� r� r r r7 )r= r r r r� + s z+FirewallClientConfigIcmpType.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r7 )r= r� rE r r r r� 1 s z)FirewallClientConfigIcmpType.set_propertyc C s t tt| jj� ���S )N)r3 r9 r r8 r� )r= r r r r� 7 s z(FirewallClientConfigIcmpType.getSettingsc C s | j jt|j�� d S )N)r8 r� r% r5 )r= r5 r r r r� = s z#FirewallClientConfigIcmpType.updatec C s | j j� d S )N)r8 r� )r= r r r r� B s z)FirewallClientConfigIcmpType.loadDefaultsc C s | j j� d S )N)r8 rc )r= r r r rc G s z#FirewallClientConfigIcmpType.removec C s | j j|� d S )N)r8 r� )r= r� r r r r� L s z#FirewallClientConfigIcmpType.renamec C s
| j j� S )N)r8 rP )r= r r r rP S s z'FirewallClientConfigIcmpType.getVersionc C s | j j|� d S )N)r8 rQ )r= r$ r r r rQ X s z'FirewallClientConfigIcmpType.setVersionc C s
| j j� S )N)r8 rS )r= r r r rS _ s z%FirewallClientConfigIcmpType.getShortc C s | j j|� d S )N)r8 rT )r= r% r r r rT d s z%FirewallClientConfigIcmpType.setShortc C s
| j j� S )N)r8 rV )r= r r r rV k s z+FirewallClientConfigIcmpType.getDescriptionc C s | j j|� d S )N)r8 rW )r= r& r r r rW p s z+FirewallClientConfigIcmpType.setDescriptionc C s
| j j� S )N)r8 r� )r= r r r r� w s z,FirewallClientConfigIcmpType.getDestinationsc C s | j j|� d S )N)r8 r� )r= r� r r r r� | s z,FirewallClientConfigIcmpType.setDestinationsc C s | j j|� d S )N)r8 r4 )r= r� r r r r4 � s z+FirewallClientConfigIcmpType.addDestinationc C s | j j|� d S )N)r8 r )r= r� r r r r � s z.FirewallClientConfigIcmpType.removeDestinationc C s | j j|�S )N)r8 r )r= r� r r r r � s z-FirewallClientConfigIcmpType.queryDestinationN) r� r� r� r! r@ r� r r� r� r� r� r� r� r� r� rc r� rP rQ rS rT rV rW r� r� r4 r r r r r r r6 sN r6 c @ s e Zd Zed.dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �ZdS )/�'FirewallClientPoliciesLockdownWhitelistNc C s |r || _ ng g g g g| _ d S )N)r5 )r= r5 r r r r@ � s z0FirewallClientPoliciesLockdownWhitelist.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB � s z0FirewallClientPoliciesLockdownWhitelist.__repr__c C s
| j d S )Nr )r5 )r= r r r � getCommands� s z3FirewallClientPoliciesLockdownWhitelist.getCommandsc C s || j d< d S )Nr )r5 )r= Zcommandsr r r � setCommands� s z3FirewallClientPoliciesLockdownWhitelist.setCommandsc C s" || j d kr | j d j|� d S )Nr )r5 r_ )r= �commandr r r �
addCommand� s z2FirewallClientPoliciesLockdownWhitelist.addCommandc C s" || j d kr | j d j|� d S )Nr )r5 rc )r= r< r r r �
removeCommand� s z5FirewallClientPoliciesLockdownWhitelist.removeCommandc C s || j d kS )Nr )r5 )r= r< r r r � queryCommand� s z4FirewallClientPoliciesLockdownWhitelist.queryCommandc C s
| j d S )NrR )r5 )r= r r r � getContexts� s z3FirewallClientPoliciesLockdownWhitelist.getContextsc C s || j d< d S )NrR )r5 )r= Zcontextsr r r � setContexts� s z3FirewallClientPoliciesLockdownWhitelist.setContextsc C s" || j d kr | j d j|� d S )NrR )r5 r_ )r= �contextr r r �
addContext� s z2FirewallClientPoliciesLockdownWhitelist.addContextc C s" || j d kr | j d j|� d S )NrR )r5 rc )r= rB r r r �
removeContext� s z5FirewallClientPoliciesLockdownWhitelist.removeContextc C s || j d kS )NrR )r5 )r= rB r r r � queryContext� s z4FirewallClientPoliciesLockdownWhitelist.queryContextc C s
| j d S )NrU )r5 )r= r r r �getUsers� s z0FirewallClientPoliciesLockdownWhitelist.getUsersc C s || j d< d S )NrU )r5 )r= Zusersr r r �setUsers� s z0FirewallClientPoliciesLockdownWhitelist.setUsersc C s" || j d kr | j d j|� d S )NrU )r5 r_ )r= �userr r r �addUser� s z/FirewallClientPoliciesLockdownWhitelist.addUserc C s" || j d kr | j d j|� d S )NrU )r5 rc )r= rH r r r �
removeUser� s z2FirewallClientPoliciesLockdownWhitelist.removeUserc C s || j d kS )NrU )r5 )r= rH r r r � queryUser� s z1FirewallClientPoliciesLockdownWhitelist.queryUserc C s
| j d S )Nr� )r5 )r= r r r �getUids� s z/FirewallClientPoliciesLockdownWhitelist.getUidsc C s || j d< d S )Nr� )r5 )r= �uidsr r r �setUids� s z/FirewallClientPoliciesLockdownWhitelist.setUidsc C s" || j d kr | j d j|� d S )Nr� )r5 r_ )r= �uidr r r �addUid� s z.FirewallClientPoliciesLockdownWhitelist.addUidc C s" || j d kr | j d j|� d S )Nr� )r5 rc )r= rO r r r � removeUid� s z1FirewallClientPoliciesLockdownWhitelist.removeUidc C s || j d kS )Nr� )r5 )r= rO r r r �queryUid� s z0FirewallClientPoliciesLockdownWhitelist.queryUid)N)r� r� r� r! r@ rB r: r; r= r> r? r@ rA rC rD rE rF rG rI rJ rK rL rN rP rQ rR r r r r r9 � s. r9 c @ s� e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zd)S )*� FirewallClientConfigPoliciesc C s8 || _ | j jtjjtjj�| _tj| jtjjd�| _ d S )N)r� )
r� r� r r r� �DBUS_PATH_CONFIGr� r� � DBUS_INTERFACE_CONFIG_POLICIES� fw_policies)r= r� r r r r@ � s z%FirewallClientConfigPolicies.__init__c C s t tt| jj� ���S )N)r9 r9 r rV �getLockdownWhitelist)r= r r r rW � s z1FirewallClientConfigPolicies.getLockdownWhitelistc C s | j jt|j�� d S )N)rV �setLockdownWhitelistr% r5 )r= r5 r r r rX � s z1FirewallClientConfigPolicies.setLockdownWhitelistc C s | j j|� d S )N)rV �addLockdownWhitelistCommand)r= r< r r r rY
s z8FirewallClientConfigPolicies.addLockdownWhitelistCommandc C s | j j|� d S )N)rV � removeLockdownWhitelistCommand)r= r< r r r rZ
s z;FirewallClientConfigPolicies.removeLockdownWhitelistCommandc C s t | jj|��S )N)r rV � queryLockdownWhitelistCommand)r= r< r r r r[
s z:FirewallClientConfigPolicies.queryLockdownWhitelistCommandc C s t | jj� �S )N)r rV � getLockdownWhitelistCommands)r= r r r r\
s z9FirewallClientConfigPolicies.getLockdownWhitelistCommandsc C s | j j|� d S )N)rV �addLockdownWhitelistContext)r= rB r r r r]
s z8FirewallClientConfigPolicies.addLockdownWhitelistContextc C s | j j|� d S )N)rV � removeLockdownWhitelistContext)r= rB r r r r^
s z;FirewallClientConfigPolicies.removeLockdownWhitelistContextc C s t | jj|��S )N)r rV � queryLockdownWhitelistContext)r= rB r r r r_
s z:FirewallClientConfigPolicies.queryLockdownWhitelistContextc C s t | jj� �S )N)r rV � getLockdownWhitelistContexts)r= r r r r` %
s z9FirewallClientConfigPolicies.getLockdownWhitelistContextsc C s | j j|� d S )N)rV �addLockdownWhitelistUser)r= rH r r r ra ,
s z5FirewallClientConfigPolicies.addLockdownWhitelistUserc C s | j j|� d S )N)rV �removeLockdownWhitelistUser)r= rH r r r rb 1
s z8FirewallClientConfigPolicies.removeLockdownWhitelistUserc C s t | jj|��S )N)r rV �queryLockdownWhitelistUser)r= rH r r r rc 6
s z7FirewallClientConfigPolicies.queryLockdownWhitelistUserc C s t | jj� �S )N)r rV �getLockdownWhitelistUsers)r= r r r rd ;
s z6FirewallClientConfigPolicies.getLockdownWhitelistUsersc C s t | jj� �S )N)r rV �getLockdownWhitelistUids)r= r r r re B
s z5FirewallClientConfigPolicies.getLockdownWhitelistUidsc C s | j j|� d S )N)rV �setLockdownWhitelistUids)r= rM r r r rf G
s z5FirewallClientConfigPolicies.setLockdownWhitelistUidsc C s | j j|� d S )N)rV �addLockdownWhitelistUid)r= rO r r r rg L
s z4FirewallClientConfigPolicies.addLockdownWhitelistUidc C s | j j|� d S )N)rV �removeLockdownWhitelistUid)r= rO r r r rh Q
s z7FirewallClientConfigPolicies.removeLockdownWhitelistUidc C s t | jj|��S )N)r rV �queryLockdownWhitelistUid)r= rO r r r ri V
s z6FirewallClientConfigPolicies.queryLockdownWhitelistUidN) r� r� r� r! r@ r� r r� r� rW rX rY rZ r[ r\ r] r^ r_ r` ra rb rc rd re rf rg rh ri r r r r rS � sN rS c @ s e Zd Zed.dd��Zedd� �Zedd� �Zedd � �Zed
d � �Zed d
� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �ZdS )/�FirewallClientDirectNc C s |r || _ n g g g g| _ d S )N)r5 )r= r5 r r r r@ ^
s z FirewallClientDirect.__init__c C s d| j | jf S )Nz%s(%r))rA r5 )r= r r r rB e
s z FirewallClientDirect.__repr__c C s
| j d S )Nr )r5 )r= r r r � getAllChainsi
s z!FirewallClientDirect.getAllChainsc s � �fdd�| j d D �S )Nc s, g | ]$}|d � kr|d �kr|d �qS )r rR rU r )r� r )r( �tabler r r� n
s z2FirewallClientDirect.getChains.<locals>.<listcomp>r )r5 )r= r( rl r )r( rl r � getChainsl
s z FirewallClientDirect.getChainsc C s || j d< d S )Nr )r5 )r= Zchainsr r r � setAllChainsp
s z!FirewallClientDirect.setAllChainsc C s, |||f}|| j d kr(| j d j|� d S )Nr )r5 r_ )r= r( rl �chain�idxr r r �addChains
s
z FirewallClientDirect.addChainc C s, |||f}|| j d kr(| j d j|� d S )Nr )r5 rc )r= r( rl ro rp r r r � removeChainx
s
z FirewallClientDirect.removeChainc C s |||f}|| j d kS )Nr )r5 )r= r( rl ro rp r r r �
queryChain}
s
z FirewallClientDirect.queryChainc C s
| j d S )NrR )r5 )r= r r r � getAllRules�
s z FirewallClientDirect.getAllRulesc s � ��fdd�| j d D �S )Nc s< g | ]4}|d �kr|d �kr|d � kr|dd� �qS )r rR rU r� Nr )r� r )ro r( rl r r r� �
s z1FirewallClientDirect.getRules.<locals>.<listcomp>rR )r5 )r= r( rl ro r )ro r( rl r �getRules�
s z FirewallClientDirect.getRulesc C s || j d< d S )NrR )r5 )r= r� r r r � setAllRules�
s z FirewallClientDirect.setAllRulesc C s0 |||||f}|| j d kr,| j d j|� d S )NrR )r5 r_ )r= r( rl ro r� r rp r r r �addRule�
s z FirewallClientDirect.addRulec C s0 |||||f}|| j d kr,| j d j|� d S )NrR )r5 rc )r= r( rl ro r� r rp r r r �
removeRule�
s z FirewallClientDirect.removeRulec C sP xJt | jd �D ]8}|d |kr|d |kr|d |kr| jd j|� qW d S )NrR r rU )r9 r5 rc )r= r( rl ro rp r r r � removeRules�
s $z FirewallClientDirect.removeRulesc C s |||||f}|| j d kS )NrR )r5 )r= r( rl ro r� r rp r r r � queryRule�
s z FirewallClientDirect.queryRulec C s
| j d S )NrU )r5 )r= r r r �getAllPassthroughs�
s z'FirewallClientDirect.getAllPassthroughsc C s || j d< d S )NrU )r5 )r= Z passthroughsr r r �setAllPassthroughs�
s z'FirewallClientDirect.setAllPassthroughsc C s g | j d< d S )NrU )r5 )r= r r r �removeAllPassthroughs�
s z*FirewallClientDirect.removeAllPassthroughsc s � fdd�| j d D �S )Nc s g | ]}|d � kr|d �qS )r rR r )r� r )r( r r r� �
s z8FirewallClientDirect.getPassthroughs.<locals>.<listcomp>rU )r5 )r= r( r )r( r �getPassthroughs�
s z$FirewallClientDirect.getPassthroughsc C s* ||f}|| j d kr&| j d j|� d S )NrU )r5 r_ )r= r( r rp r r r �addPassthrough�
s z#FirewallClientDirect.addPassthroughc C s* ||f}|| j d kr&| j d j|� d S )NrU )r5 rc )r= r( r rp r r r �removePassthrough�
s z&FirewallClientDirect.removePassthroughc C s ||f}|| j d kS )NrU )r5 )r= r( r rp r r r �queryPassthrough�
s z%FirewallClientDirect.queryPassthrough)N)r� r� r� r! r@ rB rk rm rn rq rr rs rt ru rv rw rx ry rz r{ r| r} r~ r r� r� r r r r rj ]
s. rj c @ s� e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zd'S )(�FirewallClientConfigDirectc C s8 || _ | j jtjjtjj�| _tj| jtjjd�| _ d S )N)r� )
r� r� r r r� rT r� r� � DBUS_INTERFACE_CONFIG_DIRECT� fw_direct)r= r� r r r r@ �
s z#FirewallClientConfigDirect.__init__c C s t tt| jj� ���S )N)rj r9 r r� r� )r= r r r r� �
s z&FirewallClientConfigDirect.getSettingsc C s | j jt|j�� d S )N)r� r� r% r5 )r= r5 r r r r� �
s z!FirewallClientConfigDirect.updatec C s | j j|||� d S )N)r� rq )r= r( rl ro r r r rq �
s z#FirewallClientConfigDirect.addChainc C s | j j|||� d S )N)r� rr )r= r( rl ro r r r rr �
s z&FirewallClientConfigDirect.removeChainc C s t | jj|||��S )N)r r� rs )r= r( rl ro r r r rs �
s z%FirewallClientConfigDirect.queryChainc C s t | jj||��S )N)r r� rm )r= r( rl r r r rm �
s z$FirewallClientConfigDirect.getChainsc C s t | jj� �S )N)r r� rk )r= r r r rk �
s z'FirewallClientConfigDirect.getAllChainsc C s | j j|||||� d S )N)r� rw )r= r( rl ro r� r r r r rw �
s z"FirewallClientConfigDirect.addRulec C s | j j|||||� d S )N)r� rx )r= r( rl ro r� r r r r rx �
s z%FirewallClientConfigDirect.removeRulec C s | j j|||� d S )N)r� ry )r= r( rl ro r r r ry �
s z&FirewallClientConfigDirect.removeRulesc C s t | jj|||||��S )N)r r� rz )r= r( rl ro r� r r r r rz s z$FirewallClientConfigDirect.queryRulec C s t | jj|||��S )N)r r� ru )r= r( rl ro r r r ru s z#FirewallClientConfigDirect.getRulesc C s t | jj� �S )N)r r� rt )r= r r r rt
s z&FirewallClientConfigDirect.getAllRulesc C s | j j||� d S )N)r� r )r= r( r r r r r s z)FirewallClientConfigDirect.addPassthroughc C s | j j||� d S )N)r� r� )r= r( r r r r r� s z,FirewallClientConfigDirect.removePassthroughc C s t | jj||��S )N)r r� r� )r= r( r r r r r� s z+FirewallClientConfigDirect.queryPassthroughc C s t | jj|��S )N)r r� r~ )r= r( r r r r~ s z*FirewallClientConfigDirect.getPassthroughsc C s t | jj� �S )N)r r� r{ )r= r r r r{ % s z-FirewallClientConfigDirect.getAllPassthroughsN)r� r� r� r! r@ r� r r� r� r� r� rq rr rs rm rk rw rx ry rz ru rt r r� r� r~ r{ r r r r r� �
sJ r� c @ sF e Zd Zedd� �Zejjjedd� ��Z ejjjedd� ��Z
ejjjedd� ��Z ejjjed d
� ��Z ejjjed d � ��Z
ejjjed
d� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd� ��Zejjjedd � ��Zejjjed d � ��Zejjjed d � ��Zejjjed!d"� ��Zejjjed#d$� ��Zejjjed%d&� ��Zejjjed'd(� ��Zejjjed)d*� ��Z ejjjed+d,� ��Z ejjjed-d.� ��Z ejjjed/d0� ��Z ejjjed1d2� ��Z ejjjed3d4� ��Z!ejjjed5d6� ��Z"ejjjed7d8� ��Z#ejjjed9d:� ��Z$ejjjed;d<� ��Z%ejjjed=d>� ��Z&ejjjed?d@� ��Z'ejjjedAdB� ��Z(ejjjedCdD� ��Z)ejjjedEdF� ��Z*ejjjedGdH� ��Z+ejjjedIdJ� ��Z,ejjjedKdL� ��Z-dMS )N�FirewallClientConfigc C sb || _ | j jtjjtjj�| _tj| jtjjd�| _ tj| jdd�| _
t | j �| _ t
| j �| _d S )N)r� z org.freedesktop.DBus.Properties)r� r� r r r� rT r� r� �DBUS_INTERFACE_CONFIG� fw_configr� rS � _policiesr� �_direct)r= r� r r r r@ - s z FirewallClientConfig.__init__c C s t | jjtjj|��S )N)r r� r� r r r� )r= r� r r r r� < s z!FirewallClientConfig.get_propertyc C s t | jjtjj��S )N)r r� r� r r r� )r= r r r r� B s z#FirewallClientConfig.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r� )r= r� rE r r r r� H s z!FirewallClientConfig.set_propertyc C s t | jj� �S )N)r r� �
getIPSetNames)r= r r r r� O s z"FirewallClientConfig.getIPSetNamesc C s t | jj� �S )N)r r� �
listIPSets)r= r r r r� T s z FirewallClientConfig.listIPSetsc C s t | j|�S )N)r" r� )r= r� r r r �getIPSetY s z FirewallClientConfig.getIPSetc C s t | jj|��}t| j|�S )N)r r� �getIPSetByNamer" r� )r= r� r� r r r r� ^ s z#FirewallClientConfig.getIPSetByNamec C s> t |t�r | jj|t|j��}n| jj|t|��}t| j|�S )N)r8 r r� �addIPSetr% r5 r" r� )r= r� r5 r� r r r r� d s
z FirewallClientConfig.addIPSetc C s t | jj� �S )N)r r� � getZoneNames)r= r r r r� o s z!FirewallClientConfig.getZoneNamesc C s t | jj� �S )N)r r� � listZones)r= r r r r� t s z FirewallClientConfig.listZonesc C s t | j|�S )N)r� r� )r= r� r r r �getZoney s z FirewallClientConfig.getZonec C s t | jj|��}t| j|�S )N)r r� �
getZoneByNamer� r� )r= r� r� r r r r� ~ s z"FirewallClientConfig.getZoneByNamec C s t | jj|��S )N)r r� �getZoneOfInterface)r= Zifacer r r r� � s z'FirewallClientConfig.getZoneOfInterfacec C s t | jj|��S )N)r r� �getZoneOfSource)r= r� r r r r� � s z$FirewallClientConfig.getZoneOfSourcec C s^ t |t�r | jj||j� �}n4t |t�r8| jj||�}n| jj|t|d d� ��}t| j |�S )Nr� )
r8 r" r� ZaddZone2rM r; �addZoner% r� r� )r= r� r5 r� r r r r� � s
z FirewallClientConfig.addZonec C s t | jj� �S )N)r r� �getPolicyNames)r= r r r r� � s z#FirewallClientConfig.getPolicyNamesc C s t | jj� �S )N)r r� � listPolicies)r= r r r r� � s z!FirewallClientConfig.listPoliciesc C s t | j|�S )N)r� r� )r= r� r r r � getPolicy� s z FirewallClientConfig.getPolicyc C s t | jj|��}t| j|�S )N)r r� �getPolicyByNamer� r� )r= r� r� r r r r� � s z$FirewallClientConfig.getPolicyByNamec C s8 t |t�r | jj||j� �}n| jj||�}t| j|�S )N)r8 r� r� � addPolicyrM r� r� )r= r� r5 r� r r r r� � s
z FirewallClientConfig.addPolicyc C s t | jj� �S )N)r r� �getServiceNames)r= r r r r� � s z$FirewallClientConfig.getServiceNamesc C s t | jj� �S )N)r r� � listServices)r= r r r r� � s z!FirewallClientConfig.listServicesc C s t | j|�S )N)r/ r� )r= r� r r r �
getService� s z FirewallClientConfig.getServicec C s t | jj|��}t| j|�S )N)r r� �getServiceByNamer/ r� )r= r� r� r r r r� � s z%FirewallClientConfig.getServiceByNamec C s` t |t�r | jj||j� �}n6t|�tkr:| jj||�}n| jj|t|d d� ��}t | j
|�S )Nr� ) r8 r� r� Z addService2rM rI r; rb r% r/ r� )r= r� r5 r� r r r rb � s
z FirewallClientConfig.addServicec C s t | jj� �S )N)r r� �getIcmpTypeNames)r= r r r r� � s z%FirewallClientConfig.getIcmpTypeNamesc C s t | jj� �S )N)r r� �
listIcmpTypes)r= r r r r� � s z"FirewallClientConfig.listIcmpTypesc C s t | j|�S )N)r6 r� )r= r� r r r � getIcmpType� s z FirewallClientConfig.getIcmpTypec C s t | jj|��}t| j|�S )N)r r� �getIcmpTypeByNamer6 r� )r= r� r� r r r r� � s z&FirewallClientConfig.getIcmpTypeByNamec C s> t |t�r | jj|t|j��}n| jj|t|��}t| j|�S )N)r8 r3 r� � addIcmpTyper% r5 r6 r� )r= r� r5 r� r r r r� � s
z FirewallClientConfig.addIcmpTypec C s | j S )N)r� )r= r r r �policies� s z FirewallClientConfig.policiesc C s | j S )N)r� )r= r r r �direct s zFirewallClientConfig.directc C s t | jj� �S )N)r r� �getHelperNames)r= r r r r� s z#FirewallClientConfig.getHelperNamesc C s t | jj� �S )N)r r� � listHelpers)r= r r r r� s z FirewallClientConfig.listHelpersc C s t | j|�S )N)r, r� )r= r� r r r � getHelper s z FirewallClientConfig.getHelperc C s t | jj|��}t| j|�S )N)r r� �getHelperByNamer, r� )r= r� r� r r r r� s z$FirewallClientConfig.getHelperByNamec C s> t |t�r | jj|t|j��}n| jj|t|��}t| j|�S )N)r8 r& r� r
r% r5 r, r� )r= r� r5 r� r r r r
s
z FirewallClientConfig.addHelperN).r� r� r� r! r@ r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rb r� r� r� r� r� r� r� r� r� r� r� r
r r r r r� , s�
r� c @ s� e Zd Ze�ddd��Zedd� �Zedd � �Zed
d � �Zed d
� �Zedd� �Z edd� �Z
edd� �Z edd� �Z edd� �Z
edd� �Zejjjedd� ��Zejjjed d � ��Zejjjed d � ��Zejjjed d!� ��Zejjjed"d#� ��Zejjjed$d%� ��Zejjjed&d'� ��Zejjjed(d)� ��Zejjjed*d+� ��Zejjjed,d-� ��Z ejjjed.d/� ��Z ejjjed0d1� ��Z ejjjed2d3� ��Z ejjjed4d5� ��Z ejjjed6d7� ��Z!ejjjed8d9� ��Z"ejjjed:d;� ��Z#ejjjed<d=� ��Z$ejjjed>d?� ��Z%ejjjed@dA� ��Z&ejjjedBdC� ��Z'ejjjedDdE� ��Z(ejjjedFdG� ��Z)ejjjedHdI� ��Z*ejjjedJdK� ��Z+ejjjedLdM� ��Z,ejjjedNdO� ��Z-ejjjedPdQ� ��Z.ejjjedRdS� ��Z/ejjjedTdU� ��Z0ejjjedVdW� ��Z1ejjjedXdY� ��Z2ejjjedZd[� ��Z3ejjjed\d]� ��Z4ejjjed^d_� ��Z5ejjjed`da� ��Z6ejjjedbdc� ��Z7ejjjeddde� ��Z8ejjjedfdg� ��Z9ejjjedhdi� ��Z:ejjjedjdk� ��Z;ejjjedldm� ��Z<ejjjedndo� ��Z=ejjjedpdq� ��Z>ejjjedrds� ��Z?ejjjedtdu� ��Z@ejjjedvdw� ��ZAejjjedxdy� ��ZBejjjedzd{� ��ZCejjjed|d}� ��ZDejjjed~d� ��ZEejjjed�d�� ��ZFejjjed�d�� ��ZGejjje�dd�d����ZHejjjed�d�� ��ZIejjjed�d�� ��ZJejjjed�d�� ��ZKejjje�d d�d����ZLejjjed�d�� ��ZMejjjed�d�� ��ZNejjjed�d�� ��ZOejjje�d d�d����ZPejjjed�d�� ��ZQejjjed�d�� ��ZRejjjed�d�� ��ZSejjje�d d�d����ZTejjjed�d�� ��ZUejjjed�d�� ��ZVejjjed�d�� ��ZWejjjed�d�� ��ZXejjjed�d�� ��ZYejjjed�d�� ��ZZejjje�d d�d����Z[ejjjed�d�� ��Z\ejjjed�d�� ��Z]ejjje�d d�d����Z^ejjjed�d�� ��Z_ejjjed�d�� ��Z`ejjjed�d�� ��Zaejjje�d!d�d����Zbejjjed�d�� ��Zcejjjed�d�� ��Zdejjjed�d�� ��Zeejjje�d"d�d����Zfejjjed�dÄ ��Zgejjjed�dń ��Zhejjjed�dDŽ ��Ziejjjed�dɄ ��Zjejjjed�d˄ ��Zkejjjed�d̈́ ��Zlejjjed�dτ ��Zmejjjed�dф ��Znejjjed�dӄ ��Zoejjjed�dՄ ��Zpejjjed�dׄ ��Zqejjjed�dل ��Zrejjjed�dۄ ��Zsejjjed�d݄ ��Ztejjjed�d߄ ��Zuejjjed�d� ��Zvejjjed�d� ��Zwejjjed�d� ��Zxejjjed�d� ��Zyejjjed�d� ��Zzejjjed�d� ��Z{ejjjed�d� ��Z|ejjjed�d� ��Z}ejjjed�d� ��Z~ejjjed�d� ��Zejjjed�d�� ��Z�ejjjed�d�� ��Z�ejjjed�d�� ��Z�ejjjed�d�� ��Z�ejjjed�d�� ��Z�ejjjed�d�� ��Z�ejjje�d �d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d � ��Z�ejjje�d
�d � ��Z�ejjje�d �d
� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�ejjje�d�d� ��Z�dS (# �FirewallClientNr Tc d C s |s�t jjjdd� ytj j� | _d | j_W q� tk
r� yt j� | _W n6 t j j
k
r� } zt t j
|j� ��W Y d d }~X n
X td� Y q�X n|| _| jj| jddtj jd� x�tj jtj jtj jtj jtj jtj jtj jtj jtj jtj j tj j tj j tj j tj j tj j!gD ] }| jj| j"|ddd d
� �qW i | _#d d d
ddddddddddddddd d d d d d!d"d#d$d%d&d'd'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdY�O| _$| j%� || _&|dZk�rt'j(|| j)� n| j)� d S )[NT)Zset_as_defaultzNot using slip.dbusZNameOwnerChangedzorg.freedesktop.DBus)Zhandler_functionZ signal_namer� Zarg0r� �memberr� )r� Zinterface_keywordZmember_keywordZ path_keywordzconnection-changedzconnection-establishedzconnection-lostZLogDeniedChangedZDefaultZoneChangedZPanicModeEnabledZPanicModeDisabledZReloadedZ ServiceAddedZServiceRemovedZ PortAddedZ PortRemovedZSourcePortAddedZSourcePortRemovedZ
ProtocolAddedZProtocolRemovedZMasqueradeAddedZMasqueradeRemovedZForwardPortAddedZForwardPortRemovedZIcmpBlockAddedZIcmpBlockRemovedZIcmpBlockInversionAddedZIcmpBlockInversionRemovedZ
RichRuleAddedZRichRuleRemovedZInterfaceAddedZInterfaceRemovedZZoneOfInterfaceChangedZ SourceAddedZ
SourceRemovedZZoneOfSourceChangedZ ZoneUpdatedZ
PolicyUpdatedZ
EntryAddedZ EntryRemovedZ
ChainAddedZ ChainRemovedZ RuleAddedZ RuleRemovedZPassthroughAddedZPassthroughRemovedzconfig:direct:UpdatedZLockdownEnabledZLockdownDisabledZ LockdownWhitelistCommandAddedZ LockdownWhitelistCommandRemovedZ LockdownWhitelistContextAddedZ LockdownWhitelistContextRemovedZLockdownWhitelistUidAddedZLockdownWhitelistUidRemovedZLockdownWhitelistUserAddedZ LockdownWhitelistUserRemovedz(config:policies:LockdownWhitelistUpdatedzconfig:IPSetAddedzconfig:IPSetUpdatedzconfig:IPSetRemovedzconfig:IPSetRenamedzconfig:ZoneAddedzconfig:ZoneUpdatedzconfig:ZoneRemovedzconfig:ZoneRenamedzconfig:PolicyAddedzconfig:PolicyUpdatedzconfig:PolicyRemovedzconfig:PolicyRenamedzconfig:ServiceAddedzconfig:ServiceUpdatedzconfig:ServiceRemovedzconfig:ServiceRenamedzconfig:IcmpTypeAddedzconfig:IcmpTypeUpdatedzconfig:IcmpTypeRemovedzconfig:IcmpTypeRenamedzconfig:HelperAddedzconfig:HelperUpdatedzconfig:HelperRemovedzconfig:HelperRenamed)Ozconnection-changedzconnection-establishedzconnection-lostzlog-denied-changedzdefault-zone-changedzpanic-mode-enabledzpanic-mode-disabledZreloadedz
service-addedzservice-removedz
port-addedz port-removedzsource-port-addedzsource-port-removedzprotocol-addedzprotocol-removedzmasquerade-addedzmasquerade-removedzforward-port-addedzforward-port-removedzicmp-block-addedzicmp-block-removedzicmp-block-inversion-addedz icmp-block-inversion-removedzrichrule-addedzrichrule-removedzinterface-addedzinterface-removedz zone-changedzzone-of-interface-changedz source-addedzsource-removedzzone-of-source-changedz zone-updatedzpolicy-updatedzipset-entry-addedzipset-entry-removedzdirect:chain-addedzdirect:chain-removedzdirect:rule-addedzdirect:rule-removedzdirect:passthrough-addedzdirect:passthrough-removedzconfig:direct:updatedzlockdown-enabledzlockdown-disabledz lockdown-whitelist-command-addedz"lockdown-whitelist-command-removedz lockdown-whitelist-context-addedz"lockdown-whitelist-context-removedz lockdown-whitelist-uid-addedz lockdown-whitelist-uid-removedz lockdown-whitelist-user-addedz lockdown-whitelist-user-removedz*config:policies:lockdown-whitelist-updatedzconfig:ipset-addedzconfig:ipset-updatedzconfig:ipset-removedzconfig:ipset-renamedzconfig:zone-addedzconfig:zone-updatedzconfig:zone-removedzconfig:zone-renamedzconfig:policy-addedzconfig:policy-updatedzconfig:policy-removedzconfig:policy-renamedzconfig:service-addedzconfig:service-updatedzconfig:service-removedzconfig:service-renamedzconfig:icmptype-addedzconfig:icmptype-updatedzconfig:icmptype-removedzconfig:icmptype-renamedzconfig:helper-addedzconfig:helper-updatedzconfig:helper-removedzconfig:helper-renamedr )*r ZmainloopZglibZ
DBusGMainLoopr� Z SystemBusr� Zdefault_timeoutr r r r r Z
DBUS_ERRORr �printZadd_signal_receiver�_dbus_connection_changedr r� �DBUS_INTERFACE_IPSET�DBUS_INTERFACE_ZONE�DBUS_INTERFACE_POLICY�DBUS_INTERFACE_DIRECT�DBUS_INTERFACE_POLICIESr� r# r� r� r0 r- r� r7 rU �_signal_receiver� _callback�
_callbacks�
_init_vars�quietr Ztimeout_add_seconds�_connection_established)r= r� �waitr� r r� r r r r@ , s�
zFirewallClient.__init__c C s: d | _ d | _d | _d | _d | _d | _d | _d | _d| _d S )NF) �fwr$ r� r� r. r� r� �_config� connected)r= r r r r� � s zFirewallClient._init_varsc C s t S )N)r )r= r r r �getExceptionHandler� s z"FirewallClient.getExceptionHandlerc C s |a d S )N)r )r= Zhandlerr r r �setExceptionHandler� s z"FirewallClient.setExceptionHandlerc C s t S )N)r )r= r r r �getNotAuthorizedLoop� s z#FirewallClient.getNotAuthorizedLoopc C s |a d S )N)r )r= �enabler r r �setNotAuthorizedLoop� s z#FirewallClient.setNotAuthorizedLoopc G s0 || j kr ||f| j| j | < n td| ��d S )NzUnknown callback name '%s')r� r� �
ValueError)r= r� �callbackr r r r �connect� s
zFirewallClient.connectc C s* |t jjkrd S |r | j� n| j� d S )N)r r r� r� �_connection_lost)r= r� Z old_ownerZ new_ownerr r r r� � s
z'FirewallClient._dbus_connection_changedc C sX y�| j jtjjtjj�| _tj| jtjjd�| _tj| jtjj d�| _
tj| jtjj d�| _ tj| jtjj
d�| _tj| jtjjd�| _tj| jtjjd�| _tj| jdd�| _W nj tjjk
r� } z| js�td|j� � d S d }~X n4 tk
�r } z| j�std|� d S d }~X nX t| j �| _d| _ | j dtjjd� | j dtjjd� d S ) N)r� z org.freedesktop.DBus.Propertiesr r Tzconnection-established)r� r� zconnection-changed) r� r� r r r� Z DBUS_PATHr� r� r� r� r$ r� r� r� r� r� r� r� rV r� r r r� r� r r r� r� r� r� )r= r r r r r� � sD
z&FirewallClient._connection_establishedc C s0 | j � | jdtjjd� | jdtjjd� d S )Nzconnection-lost)r� r� zconnection-changed)r� r� r r r� )r= r r r r�
s
z FirewallClient._connection_lostc O s� d|ksd|krd S |d }|d }|j tjj�r:d| }|j tjj�rRd| }n�|j tjj�rjd| }n�|j tjj�r�d| }np|j tjj�r�d| }nX|j tjj�r�d| }n@|tjj kr�d | }n*|tjj
kr�d
| }n|tjj kr�d | }d }x<| j D ]2}| j | |kr�| j | | j
kr�| j
| j | }q�W |d k�rBd S d d
� |D �}y(|d �rj|j|d � |d |� W n, tk
�r� } zt|� W Y d d }~X nX d S )Nr� r� z config:Zonez
config:Policyz config:IPSetzconfig:Servicezconfig:IcmpTypez
config:Helperzconfig:zconfig:policies:zconfig:direct:c S s g | ] }t |��qS r )r )r� �argr r r r� C
s z3FirewallClient._signal_receiver.<locals>.<listcomp>rR r )�
startswithr r r� r� r# r0 r7 r- r� rU r� r� r� �extendr r� ) r= r r �signalr� �cbr� Zcb_args�msgr r r r�
sH
z FirewallClient._signal_receiverc C s | j S )N)r� )r= r r r r M
s zFirewallClient.configc C s | j j� d S )N)r� �reload)r= r r r r� R
s zFirewallClient.reloadc C s | j j� d S )N)r� ZcompleteReload)r= r r r �complete_reloadW
s z FirewallClient.complete_reloadc C s | j j� d S )N)r� �runtimeToPermanent)r= r r r r� \
s z!FirewallClient.runtimeToPermanentc C s | j j� d S )N)r� �checkPermanentConfig)r= r r r r� a
s z#FirewallClient.checkPermanentConfigc C s t | jjtjj|��S )N)r r� r� r r r� )r= r� r r r r� f
s zFirewallClient.get_propertyc C s t | jjtjj��S )N)r r� r� r r r� )r= r r r r� l
s z FirewallClient.get_propertiesc C s | j jtjj||� d S )N)r� r� r r r� )r= r� rE r r r r� r
s zFirewallClient.set_propertyc C s | j j� d S )N)r� �enablePanicMode)r= r r r r� y
s z FirewallClient.enablePanicModec C s | j j� d S )N)r� �disablePanicMode)r= r r r r� ~
s z FirewallClient.disablePanicModec C s t | jj� �S )N)r r� �queryPanicMode)r= r r r r� �
s z FirewallClient.queryPanicModec C s t t| jj|���S )N)r" r r� �getZoneSettings2)r= �zoner r r �getZoneSettings�
s z FirewallClient.getZoneSettingsc C s t | jj� �S )N)r r$ � getIPSets)r= r r r r� �
s zFirewallClient.getIPSetsc C s t tt| jj|����S )N)r r9 r r$ �getIPSetSettings)r= �ipsetr r r r� �
s z FirewallClient.getIPSetSettingsc C s | j j||� d S )N)r$ r )r= r� r r r r r �
s zFirewallClient.addEntryc C s | j j|�S )N)r$ r )r= r� r r r r �
s zFirewallClient.getEntriesc C s | j j||�S )N)r$ r )r= r� r r r r r �
s zFirewallClient.setEntriesc C s | j j||� d S )N)r$ r )r= r� r r r r r �
s zFirewallClient.removeEntryc C s t | jj||��S )N)r r$ r! )r= r� r r r r r! �
s zFirewallClient.queryEntryc C s t | jj� �S )N)r r� r� )r= r r r r� �
s zFirewallClient.listServicesc C s t t| jj|���S )N)r� r r� ZgetServiceSettings2)r= ra r r r �getServiceSettings�
s z!FirewallClient.getServiceSettingsc C s t | jj� �S )N)r r� r� )r= r r r r� �
s z FirewallClient.listIcmpTypesc C s t tt| jj|����S )N)r3 r9 r r� �getIcmpTypeSettings)r= r r r r r� �
s z"FirewallClient.getIcmpTypeSettingsc C s t | jj� �S )N)r r� r
)r= r r r r
�
s zFirewallClient.getHelpersc C s t tt| jj|����S )N)r& r9 r r� �getHelperSettings)r= r r r r r� �
s z FirewallClient.getHelperSettingsc C s t | jj� �S )N)r r� �getAutomaticHelpers)r= r r r r� �
s z"FirewallClient.getAutomaticHelpersc C s | j j|� d S )N)r� �setAutomaticHelpers)r= rE r r r r� �
s z"FirewallClient.setAutomaticHelpersc C s t | jj� �S )N)r r� � getLogDenied)r= r r r r� �
s zFirewallClient.getLogDeniedc C s | j j|� d S )N)r� � setLogDenied)r= rE r r r r� �
s zFirewallClient.setLogDeniedc C s t | jj� �S )N)r r� �getDefaultZone)r= r r r r� �
s z FirewallClient.getDefaultZonec C s | j j|� d S )N)r� �setDefaultZone)r= r� r r r r� �
s z FirewallClient.setDefaultZonec C s | j j||j� � d S )N)r� �setZoneSettings2rO )r= r� r5 r r r �setZoneSettings�
s z FirewallClient.setZoneSettingsc C s t | jj� �S )N)r r� �getZones)r= r r r r� �
s zFirewallClient.getZonesc C s t | jj� �S )N)r r� �getActiveZones)r= r r r r� s z FirewallClient.getActiveZonesc C s t | jj|��S )N)r r� r� )r= r� r r r r� s z!FirewallClient.getZoneOfInterfacec C s t | jj|��S )N)r r� r� )r= r� r r r r� s z FirewallClient.getZoneOfSourcec C s t | jj|��S )N)r r� � isImmutable)r= r� r r r r� s zFirewallClient.isImmutablec C s t t| jj|���S )N)r� r r� �getPolicySettings)r= �policyr r r r� s z FirewallClient.getPolicySettingsc C s | j j||j� � d S )N)r� �setPolicySettingsrO )r= r� r5 r r r r� s z FirewallClient.setPolicySettingsc C s t | jj� �S )N)r r� � getPolicies)r= r r r r� $ s zFirewallClient.getPoliciesc C s t | jj� �S )N)r r� �getActivePolicies)r= r r r r� ) s z FirewallClient.getActivePoliciesc C s t | jj|��S )N)r r� r� )r= r� r r r �isPolicyImmutable. s z FirewallClient.isPolicyImmutablec C s t | jj||��S )N)r r� r� )r= r� r� r r r r� 5 s zFirewallClient.addInterfacec C s t | jj||��S )N)r r� �
changeZone)r= r� r� r r r r� : s zFirewallClient.changeZonec C s t | jj||��S )N)r r� �changeZoneOfInterface)r= r� r� r r r r� ? s
z$FirewallClient.changeZoneOfInterfacec C s t | jj|��S )N)r r� r� )r= r� r r r r� E s z FirewallClient.getInterfacesc C s t | jj||��S )N)r r� r� )r= r� r� r r r r� J s z FirewallClient.queryInterfacec C s t | jj||��S )N)r r� r� )r= r� r� r r r r� O s z FirewallClient.removeInterfacec C s t | jj||��S )N)r r� r� )r= r� r� r r r r� V s zFirewallClient.addSourcec C s t | jj||��S )N)r r� �changeZoneOfSource)r= r� r� r r r r� [ s z!FirewallClient.changeZoneOfSourcec C s t | jj|��S )N)r r� r� )r= r� r r r r� ` s zFirewallClient.getSourcesc C s t | jj||��S )N)r r� r� )r= r� r� r r r r� e s zFirewallClient.querySourcec C s t | jj||��S )N)r r� r� )r= r� r� r r r r� j s zFirewallClient.removeSourcec C s t | jj|||��S )N)r r� r� )r= r� r� r r r r r� q s zFirewallClient.addRichRulec C s t | jj|��S )N)r r� r� )r= r� r r r r� v s zFirewallClient.getRichRulesc C s t | jj||��S )N)r r� r� )r= r� r� r r r r� { s z FirewallClient.queryRichRulec C s t | jj||��S )N)r r� r� )r= r� r� r r r r� � s z FirewallClient.removeRichRulec C s t | jj|||��S )N)r r� rb )r= r� ra r r r r rb � s zFirewallClient.addServicec C s t | jj|��S )N)r r� r] )r= r� r r r r] � s zFirewallClient.getServicesc C s t | jj||��S )N)r r� rf )r= r� ra r r r rf � s zFirewallClient.queryServicec C s t | jj||��S )N)r r� re )r= r� ra r r r re � s z FirewallClient.removeServicec C s t | jj||||��S )N)r r� rl )r= r� rj rk r r r r rl � s zFirewallClient.addPortc C s t | jj|��S )N)r r� rh )r= r� r r r rh � s zFirewallClient.getPortsc C s t | jj|||��S )N)r r� rn )r= r� rj rk r r r rn � s zFirewallClient.queryPortc C s t | jj|||��S )N)r r� rm )r= r� rj rk r r r rm � s zFirewallClient.removePortc C s t | jj|||��S )N)r r� rr )r= r� rk r r r r rr � s zFirewallClient.addProtocolc C s t | jj|��S )N)r r� rp )r= r� r r r rp � s zFirewallClient.getProtocolsc C s t | jj||��S )N)r r� rt )r= r� rk r r r rt � s z FirewallClient.queryProtocolc C s t | jj||��S )N)r r� rs )r= r� rk r r r rs � s z FirewallClient.removeProtocolc C s | j j|ddi� d S )Nr2 T)r� r� )r= r� r r r r� � s zFirewallClient.addForwardc C s t | jj|��d S )Nr2 )r r� r� )r= r� r r r r� � s zFirewallClient.queryForwardc C s | j j|ddi� d S )Nr2 F)r� r� )r= r� r r r r� � s z FirewallClient.removeForwardc C s t | jj||��S )N)r r� r� )r= r� r r r r r� � s z FirewallClient.addMasqueradec C s t | jj|��S )N)r r� r� )r= r� r r r r� � s z FirewallClient.queryMasqueradec C s t | jj|��S )N)r r� r� )r= r� r r r r� � s z FirewallClient.removeMasqueradec C s2 |d kr d}|d krd}t | jj||||||��S )Nr# )r r� r� )r= r� rj rk r� r� r r r r r� � s z FirewallClient.addForwardPortc C s t | jj|��S )N)r r� r� )r= r� r r r r� � s z FirewallClient.getForwardPortsc C s0 |d kr d}|d krd}t | jj|||||��S )Nr# )r r� r� )r= r� rj rk r� r� r r r r� � s
z FirewallClient.queryForwardPortc C s0 |d kr d}|d krd}t | jj|||||��S )Nr# )r r� r� )r= r� rj rk r� r� r r r r� s
z FirewallClient.removeForwardPortc C s t | jj||||��S )N)r r� rx )r= r� rj rk r r r r rx s z FirewallClient.addSourcePortc C s t | jj|��S )N)r r� rv )r= r� r r r rv s z FirewallClient.getSourcePortsc C s t | jj|||��S )N)r r� rz )r= r� rj rk r r r rz s z FirewallClient.querySourcePortc C s t | jj|||��S )N)r r� ry )r= r� rj rk r r r ry $ s z FirewallClient.removeSourcePortc C s t | jj|||��S )N)r r� r� )r= r� �icmpr r r r r� , s zFirewallClient.addIcmpBlockc C s t | jj|��S )N)r r� r| )r= r� r r r r| 1 s z FirewallClient.getIcmpBlocksc C s t | jj||��S )N)r r� r� )r= r� r� r r r r� 6 s z FirewallClient.queryIcmpBlockc C s t | jj||��S )N)r r� r� )r= r� r� r r r r� ; s z FirewallClient.removeIcmpBlockc C s t | jj|��S )N)r r� r� )r= r� r r r r� B s z$FirewallClient.addIcmpBlockInversionc C s t | jj|��S )N)r r� r� )r= r� r r r r� G s z&FirewallClient.queryIcmpBlockInversionc C s t | jj|��S )N)r r� r� )r= r� r r r r� L s z'FirewallClient.removeIcmpBlockInversionc C s | j j|||� d S )N)r� rq )r= r( rl ro r r r rq S s zFirewallClient.addChainc C s | j j|||� d S )N)r� rr )r= r( rl ro r r r rr X s zFirewallClient.removeChainc C s t | jj|||��S )N)r r� rs )r= r( rl ro r r r rs ] s zFirewallClient.queryChainc C s t | jj||��S )N)r r� rm )r= r( rl r r r rm b s zFirewallClient.getChainsc C s t | jj� �S )N)r r� rk )r= r r r rk g s zFirewallClient.getAllChainsc C s | j j|||||� d S )N)r� rw )r= r( rl ro r� r r r r rw n s zFirewallClient.addRulec C s | j j|||||� d S )N)r� rx )r= r( rl ro r� r r r r rx s s zFirewallClient.removeRulec C s | j j|||� d S )N)r� ry )r= r( rl ro r r r ry x s zFirewallClient.removeRulesc C s t | jj|||||��S )N)r r� rz )r= r( rl ro r� r r r r rz } s zFirewallClient.queryRulec C s t | jj|||��S )N)r r� ru )r= r( rl ro r r r ru � s zFirewallClient.getRulesc C s t | jj� �S )N)r r� rt )r= r r r rt � s zFirewallClient.getAllRulesc C s t | jj||��S )N)r r� � passthrough)r= r( r r r r r� � s zFirewallClient.passthroughc C s t | jj� �S )N)r r� r{ )r= r r r r{ � s z!FirewallClient.getAllPassthroughsc C s | j j� d S )N)r� r} )r= r r r r} � s z$FirewallClient.removeAllPassthroughsc C s t | jj|��S )N)r r� r~ )r= r( r r r r~ � s z FirewallClient.getPassthroughsc C s | j j||� d S )N)r� r )r= r( r r r r r � s z FirewallClient.addPassthroughc C s | j j||� d S )N)r� r� )r= r( r r r r r� � s z FirewallClient.removePassthroughc C s t | jj||��S )N)r r� r� )r= r( r r r r r� � s z FirewallClient.queryPassthroughc C s | j j� d S )N)rV �enableLockdown)r= r r r r� � s z FirewallClient.enableLockdownc C s | j j� d S )N)rV �disableLockdown)r= r r r r� � s z FirewallClient.disableLockdownc C s t | jj� �S )N)r rV �
queryLockdown)r= r r r r� � s z FirewallClient.queryLockdownc C s | j j|� d S )N)rV rY )r= r< r r r rY � s z*FirewallClient.addLockdownWhitelistCommandc C s t | jj� �S )N)r rV r\ )r= r r r r\ � s z+FirewallClient.getLockdownWhitelistCommandsc C s t | jj|��S )N)r rV r[ )r= r< r r r r[ � s z,FirewallClient.queryLockdownWhitelistCommandc C s | j j|� d S )N)rV rZ )r= r< r r r rZ � s z-FirewallClient.removeLockdownWhitelistCommandc C s | j j|� d S )N)rV r] )r= rB r r r r] � s z*FirewallClient.addLockdownWhitelistContextc C s t | jj� �S )N)r rV r` )r= r r r r` � s z+FirewallClient.getLockdownWhitelistContextsc C s t | jj|��S )N)r rV r_ )r= rB r r r r_ � s z,FirewallClient.queryLockdownWhitelistContextc C s | j j|� d S )N)rV r^ )r= rB r r r r^ � s z-FirewallClient.removeLockdownWhitelistContextc C s | j j|� d S )N)rV rg )r= rO r r r rg � s z&FirewallClient.addLockdownWhitelistUidc C s t | jj� �S )N)r rV re )r= r r r re � s z'FirewallClient.getLockdownWhitelistUidsc C s t | jj|��S )N)r rV ri )r= rO r r r ri � s z(FirewallClient.queryLockdownWhitelistUidc C s | j j|� d S )N)rV rh )r= rO r r r rh s z)FirewallClient.removeLockdownWhitelistUidc C s | j j|� d S )N)rV ra )r= rH r r r ra
s z'FirewallClient.addLockdownWhitelistUserc C s t | jj� �S )N)r rV rd )r= r r r rd s z(FirewallClient.getLockdownWhitelistUsersc C s t | jj|��S )N)r rV rc )r= rH r r r rc s z)FirewallClient.queryLockdownWhitelistUserc C s | j j|� d S )N)rV rb )r= rH r r r rb s z*FirewallClient.removeLockdownWhitelistUserc C s | j j� dS )z( Authorize once for all polkit actions. N)r� � authorizeAll)r= r r r r� s zFirewallClient.authorizeAll)Nr T)r )r )r )r )r )r )r )r )�r� r� r� r! r@ r� r� r� r� r� r� r� r� r� r� r� r r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r! r� r� r� r� r
r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rb r] rf re rl rh rn rm rr rp rt rs r� r� r� r� r� r� r� r� r� r� rx rv rz ry r� r| r� r� r� r� r� rq rr rs rm rk rw rx ry rz ru rt r� r{ r} r~ r r� r� r� r� r� rY r\ r[ rZ r] r` r_ r^ rg re ri rh ra rd rc rb r� r r r r r� + s* & 0
r� )4Z
gi.repositoryr r �sysr� Zdbus.mainloop.glibr Z slip.dbusr� r Zfirewallr Zfirewall.core.baser r r Zfirewall.dbus_utilsr Zfirewall.functionsr
Zfirewall.core.richr Zfirewall.core.ipsetr r
r r Zfirewall.errorsr r r r r! �objectr" r� r� r� r� r r" r& r, r/ r3 r6 r9 rS rj r� r� r� r r r r �<module> sd
' ; R8 ghyK CzVtbm __pycache__/dbus_utils.cpython-36.pyc 0000644 00000013117 15035135171 0013563 0 ustar 00 3
��gJ � @ s� d ddddddddd d
g Z d d lZd d lZd d lZd d
lmZ d dlmZ ejdk Z dd � Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� Zddd�Zdd� Zd dd �Zdd
� Zd S ) �command_of_pid�
pid_of_sender�
uid_of_sender� user_of_uid�context_of_sender�command_of_sender�user_of_sender�dbus_to_python�dbus_signature�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties� N)�minidom)�log�3c C sP y6t d| d�� }|j� d jdd�j� }W dQ R X W n tk
rJ dS X |S )z Get command for pid from /proc z/proc/%d/cmdline�rr � � N)�open� readlines�replace�strip� Exception)�pid�f�cmd� r � /usr/lib/python3.6/dbus_utils.pyr % s &c C sD | j dd�}tj|d�}yt|j|��}W n tk
r> dS X |S )zW Get pid from sender string using
org.freedesktop.DBus.GetConnectionUnixProcessID zorg.freedesktop.DBusz/org/freedesktop/DBusN)�
get_object�dbus� Interface�intZGetConnectionUnixProcessID�
ValueError)�bus�sender�dbus_obj�
dbus_ifacer r r r r . s c C sD | j dd�}tj|d�}yt|j|��}W n tk
r> dS X |S )zV Get user id from sender string using
org.freedesktop.DBus.GetConnectionUnixUser zorg.freedesktop.DBusz/org/freedesktop/DBusN)r r r r ZGetConnectionUnixUserr! )r" r# r$ r% �uidr r r r ; s c C s, yt j| �}W n tk
r" dS X |d S )z Get user for uid from pwd Nr )�pwd�getpwuidr )r& Zpwsr r r r H s
c
C sP | j dd�}tj|d�}y|j|�}W n tk
r: dS X djttt|���S )zl Get SELinux context from sender string using
org.freedesktop.DBus.GetConnectionSELinuxSecurityContext zorg.freedesktop.DBusz/org/freedesktop/DBusN� ) r r r Z#GetConnectionSELinuxSecurityContextr �join�map�chrr )r" r# r$ r% �contextr r r r Q s c C s t t| |��S )z Return command of D-Bus sender )r r )r" r# r r r r _ s c C s t t| |��S )N)r r )r" r# r r r r d s c C s� | d kr| }�n�t | tj�r(t| �}�n�t | tj�rNtrB| jd�nt| �}�n�trjt | tj�rjt| �}�ndt | tj �r�t| �}�nLt | tj
�s�t | tj �s�t | tj �s�t | tj
�s�t | tj�s�t | tj�s�t | tj�r�t| �}n�t | tj�r�t| �}n�t | tj��rdd� | D �}n�t | tj��r6tdd� | D ��}n�t | tj��rXdd� | j� D �}nvt | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��r�| }nt dt | � ��|d k �r�|tk�r�t |t� �s�|tk�rt |t� �s�|tk�r t |t� �s�|tk�r8t |t� �s�|tk�rPt |t� �s�|tk�rht |t� �s�|tk�r�t |t� �r�t d|t |�|f ��|S ) Nzutf-8c S s g | ] }t |��qS r )r )�.0�xr r r �
<listcomp>} s z"dbus_to_python.<locals>.<listcomp>c S s g | ] }t |��qS r )r )r. r/ r r r r0 s c S s i | ]\}}t |�t |��qS r )r )r. �k�vr r r �
<dictcomp>� s z"dbus_to_python.<locals>.<dictcomp>z Unhandled %sz%s is %s, expected %s) �
isinstancer �Boolean�bool�String�PY2�encode�str�
UTF8String�
ObjectPath�Byte�Int16�Int32�Int64�UInt16�UInt32�UInt64r �Double�float�Array�Struct�tuple�
Dictionary�items�bytes�list�dict� TypeError�repr�type)�objZ
expected_typeZ
python_objr r r r g sV
c C s> t | tj�rdS t | tj�r dS t | tj�r0dS t | tj�r@dS t | tj�rPdS t | tj�r`dS t | tj�rpdS t | tj �r�dS t | tj
�r�d S t | tj �r�d
S t | tj �r�d S t | tj
�� r�t| j�d kr�d
| j S d| j S nXt | tj�� r�d| j S t | tj��rd| j S t�r*t | tj��r*dS tdt| � ��d S )N�b�s�o�y�n�ir/ �q�u�t�d� za(%s)za%sz(%s)za{%s}z Unhandled %s)r4 r r5 r7 r< r= r> r? r@ rA rB rC rD rF �lenZ signaturerG rI r8 r; rN rO )rQ r r r r � sB
c C s� |d kr i }t | d�s"t| di � t| d�}i ||< y| j|�}W n tk
rZ i }Y nX xV|j� D ]J\}}dt|�i|| |< ||kr�|| || | d< qfd|| | d< qfW d S )N�_fw_dbus_propertiesrP �access�read)�hasattr�setattr�getattrZGetAllr rJ r )rQ � interfacer_ �dipZ_dict�key�valuer r r r
� s
c
C s� t j|�}t| d�r�x�|jd�D ]�}|jd�r |jd�|kr i }t| d�rTt| d�}||kr xX|| j� D ]H\}}|jd�}|j d|� |j d|d � |j d|d � |j
|� qjW q W t j |j
� � |j
� } |j� | S )Nr^ rd �name�propertyrP r_ )r
Z parseStringra ZgetElementsByTagNameZ hasAttributeZ getAttributerc rJ Z
createElementZ setAttributeZ appendChildr Zdebug10Ztoxml�unlink)
rQ �datard �docZnodere rf rg ZpropZnew_datar r r r � s&
)N)N)�__all__r r' �sysZxml.domr
Zfirewall.core.loggerr �versionr8 r r r r r r r r r r
r r r r r �<module> s*
0%
__pycache__/command.cpython-36.pyc 0000644 00000043416 15035135171 0013031 0 ustar 00 3
��g�^ � @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m
Z
m Z m Z m
Z
mZ G dd� de�ZdS ) z<FirewallCommand class for command line client simplification�FirewallCommand� N)�errors)�
FirewallError)�
DBusException)� checkIPnMask�
checkIP6nMask� check_mac�
check_port�check_single_addressc @ s� e Zd Zd\dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zd]dd�Z d^dd�Z
d_dd�Z d`dd�Z dadd�Z
dbdd�Zdcd d �Zddd d �Zded d!�Zdfd"d#�Zdgd$d%�Zdhd&d'�Zdid(d)�Zdjd*d+�Zdkd,d-�Zd.d/� Zdld1d2�Zdmd3d4�Zd5d6� Zd7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z dg dAfdBdC�Z!dg fdDdE�Z"dg fdFdG�Z#dHdI� Z$dJdK� Z%dLdM� Z&dNdO� Z'dPdQ� Z(dRdS� Z)dTdU� Z*dVdW� Z+dXdY� Z,dZd[� Z-dS )nr Fc C s || _ || _d| _d | _d S )NT)�quiet�verbose�'_FirewallCommand__use_exception_handler�fw)�selfr r � r � /usr/lib/python3.6/command.py�__init__# s zFirewallCommand.__init__c C s
|| _ d S )N)r )r r r r r �set_fw) s zFirewallCommand.set_fwc C s
|| _ d S )N)r )r �flagr r r � set_quiet, s zFirewallCommand.set_quietc C s | j S )N)r )r r r r � get_quiet/ s zFirewallCommand.get_quietc C s
|| _ d S )N)r )r r r r r � set_verbose2 s zFirewallCommand.set_verbosec C s | j S )N)r )r r r r � get_verbose5 s zFirewallCommand.get_verboseNc C s$ |d k r | j r tjj|d � d S )N�
)r �sys�stdout�write)r �msgr r r � print_msg8 s zFirewallCommand.print_msgc C s$ |d k r | j r tjj|d � d S )Nr )r r �stderrr )r r r r r �print_error_msg< s z FirewallCommand.print_error_msgc C s, d}d}t jj� r || | }| j|� d S )Nz[91mz[00m)r r �isattyr )r r ZFAILZENDr r r �
print_warning@ s
z FirewallCommand.print_warningr c C s, |dkr| j |� n
| j|� tj|� d S )N� )r" r r �exit)r r Z exit_coder r r �print_and_exitG s
z FirewallCommand.print_and_exitc C s | j |d� d S )N� )r% )r r r r r �failR s zFirewallCommand.failc C s" |d k r | j r tjj|d � d S )Nr )r r r r )r r r r r �print_if_verboseU s z FirewallCommand.print_if_verbosec
C s� | j d k r| j j� g }
d} g } x�|D ]�}
|d k r�y ||
�}
W nx tk
r� } z\tjt|��}t|�dkrz| jd| � n| jd| |� || kr�| j |� | d7 } w&W Y d d }~X nX |
j |
� q&W �xb|
D �]X}
g }|d k r�||7 }t
|
t � o�t
|
t � �r|j |
� n||
7 }|d k �r(||7 }| j
� y ||� W n� ttfk
�r } z�t
|t��rx| j|j� � |j� }nt|�}tj|�}|tjtjtjtjgk�r�d}t|�dk�r�| jd| � n,|dk�r�| jd| � d S | jd| |� || k�r| j |� | d7 } W Y d d }~X nX | j� q�W | �s�t|�| k�sJd| k�rNd S t| �dk�rltj| d � nt| �dk�r�tjtj� d S )Nr r# z Warning: %sz Error: %s)r Z authorizeAll� Exceptionr �get_code�str�lenr" r% �append�
isinstance�list�tuple� deactivate_exception_handlerr �fail_if_not_authorized�
get_dbus_name�get_dbus_messager �ALREADY_ENABLED� NOT_ENABLED�ZONE_ALREADY_SET� ALREADY_SET�activate_exception_handlerr r$ Z
UNKNOWN_ERROR)r Zcmd_type�option�
action_method� query_method� parse_method�message�
start_args�end_args�no_exit�itemsZ_errorsZ _error_codes�itemr �code� call_itemr r r Z__cmd_sequenceY sr
z FirewallCommand.__cmd_sequencec C s | j d||||||d� d S )N�add)rA )� _FirewallCommand__cmd_sequence)r r: r; r< r= r> rA r r r � add_sequence� s z FirewallCommand.add_sequencec
C s | j d||||||g|d� d S )NrF )r? rA )rG )r �xr: r; r< r= r> rA r r r �x_add_sequence� s z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d� d S )NrF )r? r@ rA )rG ) r �zoner: r; r< r= r> ZtimeoutrA r r r �zone_add_timeout_sequence� s z)FirewallCommand.zone_add_timeout_sequencec C s | j d||||||d� d S )N�remove)rA )rG )r r: r; r< r= r> rA r r r �remove_sequence� s z FirewallCommand.remove_sequencec
C s | j d||||||g|d� d S )NrM )r? rA )rG )r rI r: r; r< r= r> rA r r r �x_remove_sequence� s z!FirewallCommand.x_remove_sequencec
C s g }x�|D ]�}|d k r�y ||�}W n^ t k
r� } zBt|�dkrR| jd| � w
n tjt| ��}
| jd| |
� W Y d d } ~ X nX |j|� q
W �xv|D �]l}g } |d k r�| |7 } t|t � r�t|t
� r�| j|� n| |7 } | j � y || � } W n� t k
�rj } zZ| j
| j� � tj| j� �}
t|�dk�rF| jd| j� � w�n| jd| j� |
� W Y d d } ~ X n` t k
�r� } zBtjt| ��}
t|�dk�r�| jd| � n| jd| |
� W Y d d } ~ X nX | j� t|�dk�r�| jd|| d| f � q�| j| � q�W |�stjd� d S ) Nr# z Warning: %sz Error: %sz%s: %s�no�yesr )rP rQ )r) r, r" r r* r+ r% r- r. r/ r0 r1 r r2 r3 r4 r9 r �print_query_resultr r$ )
r r: r< r= r> r? rA rB rC r rD rE �resr r r Z__query_sequence� sR
" " z FirewallCommand.__query_sequencec C s | j |||||d� d S )N)rA )� _FirewallCommand__query_sequence)r r: r< r= r> rA r r r �query_sequence� s
z FirewallCommand.query_sequencec C s | j |||||g|d� d S )N)r? rA )rT )r rI r: r< r= r> rA r r r �x_query_sequence� s
z FirewallCommand.x_query_sequencec C sJ t |� rFt|� rFt|� rF|jd�o2t|�dk rFttjd| ��|S )Nzipset:� z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r �
startswithr, r r � INVALID_ADDR)r �valuer r r � parse_source� s
z FirewallCommand.parse_source�/c
C sl y|j |�\}}W n$ tk
r6 ttjd| ��Y nX t|�sLttj|��|dkrdttjd| ��||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocol�tcp�udp�sctp�dccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r] r^ r_ r` )�split�
ValueErrorr r � INVALID_PORTr �INVALID_PROTOCOL)r rZ Z separator�port�protor r r �
parse_port s zFirewallCommand.parse_portc
C s� d }d }d }d }d}x�d||d � kr�||d � j dd�d }|t|�d 7 }d||d � krx||d � j dd�d } n ||d � } |t| �d 7 }|dkr�| }q|dkr�| }q|dkr�| }q|dkr�| }q|d kr�|r�qttjd
| ��qW |�s ttjd ��|�sttjd ��|�p|�s*ttjd
��t|��s@ttj|��|dk�rZttjd| ��|�rxt|� �rxttj|��|�r�td|� �r�|�s�td|� �r�ttj |��||||fS )Nr �=r# �:re rf �toport�toaddr�ifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationr] r^ r_ r` z''%s' not in {'tcp'|'udp'|'sctp'|'dccp'}�ipv4�ipv6)r] r^ r_ r` )
ra r, r r ZINVALID_FORWARDr rc rd r
rY )
r rZ �compatre Zprotocolrj rk �i�opt�valr r r �parse_forward_port sT
z"FirewallCommand.parse_forward_portc C sF |j d�}t|�dkr"|d dfS t|�dkr2|S ttjd| ��d S )Nrh r# r � r& zinvalid ipset option '%s')ra r, r r ZINVALID_OPTION)r rZ �argsr r r �parse_ipset_optionH s
z"FirewallCommand.parse_ipset_optionc C s. ddg}||kr*t tjd|dj|�f ��|S )Nrm rn z'invalid argument: %s (choose from '%s')z', ')r r � INVALID_IPV�join)r rZ �ipvsr r r �check_destination_ipvR s z%FirewallCommand.check_destination_ipvc C sD y|j dd�\}}W n tk
r4 ttjd��Y nX | j|�|fS )Nri r# z(destination syntax is ipv:address[/mask])ra rb r r ZINVALID_DESTINATIONrz )r rZ ZipvZ destinationr r r �parse_service_destinationZ s z)FirewallCommand.parse_service_destinationc C s0 dddg}||kr,t tjd|dj|�f ��|S )Nrm rn Zebz'invalid argument: %s (choose from '%s')z', ')r r rw rx )r rZ ry r r r � check_ipvb s
zFirewallCommand.check_ipvc C s0 dddg}||kr,t tjd|dj|�f ��|S )Nrt rm rn z'invalid argument: %s (choose from '%s')z', ')r r rw rx )r rZ ry r r r �check_helper_familyj s
z#FirewallCommand.check_helper_familyc C sB |j d�sttjd| ��t|jdd��dk r>ttjd| ��|S )NZ
nf_conntrack_z('%s' does not start with 'nf_conntrack_'rt r# zModule name '%s' too short)rX r r ZINVALID_MODULEr, �replace)r rZ r r r � check_moduler s
z FirewallCommand.check_moduleTc C s� |j � }|j� }|j� }|j� } |j� }
|j� } |j� } |j� }
|j� }|j � }|j
� }|rv|j � }|j � }|j
� }n,|j� }tt|j� | ��}|j� }|j� }dd� }g }|d k r�||kr�|jd� | r�|s�|s�|r�|r�|r�|jd� |�r|ddj|� }| j|� | j�r2| jd| � | jd| � |�rJ| jd t|� � | jd
| � |�sv| jd |�rnd nd
� |�r�| jddj|� � | jddj|� � n(| jddj|� � | jddj|� � | jddjt|�� � | jddjdd� |D �� � | jddjt| �� � |�s:| jd|�r2d nd
� | jd|
�rJd nd
� | jd| �rbdnd djd d� | D �� � | jd djd d� | D �� � | jd dj|
� � | jd!|�r�dnd djt||d"�� � d S )#Nc S sf d}d}y| j |�}W n tk
r* Y n8X |t|�7 }t| ||| |d � j d� � jdd��}|S )Nr z priority=� �"rt )�indexrb r, �intr~ )Zrule�priorityZ
search_strrp r r r �rich_rule_sorted_key� s *zDFirewallCommand.print_zone_policy_info.<locals>.rich_rule_sorted_key�defaultZactivez (%s)z, z summary: z description: z priority: z
target: z icmp-block-inversion: %srQ rP z ingress-zones: r� z egress-zones: z interfaces: z sources: z services: z ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )�.0re r r r �
<listcomp>� s z:FirewallCommand.print_zone_policy_info.<locals>.<listcomp>z
protocols: z
forward: %sz masquerade: %sz forward-ports: z
rt c S s$ g | ] \}}}}d ||||f �qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r� re rf rj rk r r r r� � s z source-ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z icmp-blocks: z rich rules: )�key)Z getTargetZ getServices�getPorts� getProtocolsZ
getMasqueradeZgetForwardPorts�getSourcePortsZ
getIcmpBlocksZ getRichRules�getDescription�getShortZgetIngressZonesZgetEgressZonesZ getPriorityZgetIcmpBlockInversion�sorted�setZ
getInterfacesZ
getSourcesZ
getForwardr- rx r r r+ )r rK �settings� default_zone�extra_interfaces�isPolicy�targetZservices�ports� protocolsZ
masqueradeZ
forward_ports� source_portsZ icmp_blocksZrules� description�short_descriptionZ
ingress_zonesZ egress_zonesr� Zicmp_block_inversionZ
interfacesZsourcesZforwardr� Z
attributesr r r �print_zone_policy_info| sx
z&FirewallCommand.print_zone_policy_infoc C s | j ||||dd� d S )NF)r� r� r� )r� )r rK r� r� r� r r r �print_zone_info� s z FirewallCommand.print_zone_infoc C s | j ||||dd� d S )NT)r� r� r� )r� )r Zpolicyr� r� r� r r r �print_policy_info� s z!FirewallCommand.print_policy_infoc C s. |j � }|j� }|j� }|j� }|j� }|j� }|j� } |j� }
|j� } | j |� | j
rt| j d| � | j d| � | j ddj dd� |D �� � | j ddj |� � | j ddj d d� |D �� � | j d
dj |� � | j d dj d d� |j � D �� � | j d
dj t
|
�� � | j ddj t
| �� � d S )Nz summary: z description: z ports: r� c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z6FirewallCommand.print_service_info.<locals>.<listcomp>z
protocols: z source-ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z modules: z destination: c S s g | ]\}}d ||f �qS )z%s:%sr )r� �k�vr r r r� � s z includes: z helpers: )r� r� r� Z
getModulesr� �getDestinationsr� Z getIncludesZ
getHelpersr r rx rB r� ) r Zservicer� r� r� r� �modulesr� � destinationsr� ZincludesZhelpersr r r �print_service_info� s2
z"FirewallCommand.print_service_infoc C sp |j � }|j� }|j� }t|�dkr,ddg}| j|� | jrX| jd| � | jd| � | jddj|� � d S )Nr rm rn z summary: z description: z destination: r� )r� r� r� r, r r rx )r Zicmptyper� r� r� r� r r r �print_icmptype_info� s
z#FirewallCommand.print_icmptype_infoc C s� |j � }|j� }|j� }|j� }|j� }| j|� | jrT| jd| � | jd| � | jd| � | jddjdd� |j� D �� � | jddj|� � d S ) Nz summary: z description: z type: z options: r� c S s$ g | ] \}}|r d ||f n|�qS )z%s=%sr )r� r� r� r r r r� s z4FirewallCommand.print_ipset_info.<locals>.<listcomp>z entries: ) ZgetTypeZ
getOptionsZ
getEntriesr� r� r r rx rB )r Zipsetr� Z
ipset_typeZoptions�entriesr� r� r r r �print_ipset_info� s
z FirewallCommand.print_ipset_infoc C s� |j � }|j� }|j� }|j� }|j� }| j|� | jrT| jd| � | jd| � | jd| � | jd| � | jddjdd� |D �� � d S ) Nz summary: z description: z
family: z
module: z ports: r� c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� s z5FirewallCommand.print_helper_info.<locals>.<listcomp>)r� Z getModuleZ getFamilyr� r� r r rx )r �helperr� r� �moduleZfamilyr� r� r r r �print_helper_info s
z!FirewallCommand.print_helper_infoc C s |r| j d� n | j dd� d S )NrQ rP r# )r% )r rZ r r r rR s z"FirewallCommand.print_query_resultc C s\ | j s� | j|� tjt|��}|tjtjtjtj gkrH| j
d| � n| j d| |� d S )Nz Warning: %sz Error: %s) r
r2 r r* r+ r r5 r6 r7 r8 r" r% )r �exception_messagerD r r r �exception_handler s
z!FirewallCommand.exception_handlerc C s d|krd}| j |tj� d S )NZNotAuthorizedExceptionz`Authorization failed.
Make sure polkit agent is running or run the application as superuser.)r% r ZNOT_AUTHORIZED)r r� r r r r r2 ' s z&FirewallCommand.fail_if_not_authorizedc C s
d| _ d S )NF)r
)r r r r r1 - s z,FirewallCommand.deactivate_exception_handlerc C s
d| _ d S )NT)r
)r r r r r9 0 s z*FirewallCommand.activate_exception_handlerc C sp g }t � }t|�}xP|D ]H}|s"P |j� }t|�dk s|d dkrDq||kr|j|� |j|� qW |j� |S )Nr# r �#�;)r� r� )r� �open�stripr, r- rF �close)r �filenamer� Z entries_set�f�liner r r �get_ipset_entries_from_file3 s
z+FirewallCommand.get_ipset_entries_from_file)FF)N)N)N)Nr )N)N)NNF)F)F)F)F)F)NF)F)F)r\ )F).�__name__�
__module__� __qualname__r r r r r r r r r" r% r' r( rG rH rJ rL rN rO rT rU rV r[ rg rs rv rz r{ r| r} r r� r� r� r� r� r� r� rR r� r2 r1 r9 r� r r r r r " sX
J
2
2
O )�__doc__�__all__r Zfirewallr Zfirewall.errorsr Zdbus.exceptionsr Zfirewall.functionsr r r r r
�objectr r r r r �<module> s __pycache__/functions.cpython-36.pyc 0000644 00000036460 15035135171 0013424 0 ustar 00 3
��g'K � # @ s d ddddddddd d
d d d
ddddddddddddddd d d d d d!d"g#Z d#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d%l m
Z
d#d&l m Z m
Z
ejd'k Zd(d)� ed#d*�D �Zd+d� Zd,d� ZdXd.d�Zd/d0� Zd1d2� Zd3d4� Zd5d� Zd6d� Zd7d8� Zd9d� Zd:d� Z d;d"� Z d<d� Z d=d � Z d>d
� Z d?d � Z!d@d � Z"dAd
� Z#dBd� Z$dCd� Z%dDd� Z&dEdF� Z'dGd� Z(dHd� Z)dId� Z*dJd� Z+dKd� Z,dLd� Z-dMd!� Z.dNd� Z/dOd� Z0dPd� Z1dQd� Z2dRd� Z3dSd � Z4dTd � Z5dUd � Z6dVd � Z7dWd � Z8d$S )Y�PY2� getPortID� getPortRange�portStr�getServiceName�checkIP�checkIP6� checkIPnMask�
checkIP6nMask�
checkProtocol�checkInterface� checkUINT32�firewalld_is_active�tempFile�readfile� writefile�enable_ip_forwarding�
check_port�
check_address�check_single_address� check_mac�uniqify� ppid_of_pid�max_zone_name_len� checkUser�checkUid� checkCommand� checkContext�joinArgs� splitArgs�b2u�u2b�
u2b_if_py2�max_policy_name_len�stripNonPrintableCharacters� N)�log)�FIREWALLD_TEMPDIR�FIREWALLD_PIDFILE�3c C s" i | ]}|d ko|dk sd|�qS )� � N� )�.0�ir+ r+ � /usr/lib/python3.6/functions.py�
<dictcomp>. s r/ � c C st t | t�r| }nT| r | j� } y t| �}W n: tk
rb ytj| �}W n tjk
r\ dS X Y nX |dkrpdS |S )z� Check and Get port id from port string or port id using socket.getservbyname
@param port port string or port id
@return Port id if valid, -1 if port can not be found and -2 if port is too big
� i�� � ������)�
isinstance�int�strip�
ValueError�socketZ
getservbyname�error)�portZ_idr+ r+ r. r 7 s
c C s� t | t�st | t�r| S t | t�s*| j� rDt| �}|dkr@|fS |S | jd�}t|�dkr�|d j� r�|d j� r�t|d �}t|d �}|dkr�|dkr�||k r�||fS ||kr�||fS |fS g }x�tt|�dd�D ]�}tdj |d|� ��}dj ||d� �}t|�dk�rnt|�}|dk�r�|dk�r�||k �rF|j
||f� n&||k�r`|j
||f� n |j
|f� q�|dkr�|j
|f� |t|�kr�P q�W t|�dk �r�dS t|�dk�r�dS |d S )aI Get port range for port range string or single port id
@param ports an integer or port string or port range string
@return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous.
r$ �-r2 r1 Nr3 r3 ) r5 �tuple�listr6 �isdigitr �split�len�range�join�append)ZportsZid1�splitsZid2Zmatchedr- Zport2r+ r+ r. r N sL
$
�:c C sX | dkr dS t | �}t|t�r*|dk r*dS t|�dkr>d| S d|d ||d f S dS )a Create port and port range string
@param port port or port range int or [int, int]
@param delimiter of the output string for port ranges, default ':'
@return Port or port range string, empty string if port isn't specified, None if port or port range is not valid
� r$ Nr1 z%sz%s%s%s)r r5 r6 rA )r; Z delimiter�_ranger+ r+ r. r � s c C s t | �}t |�}t|�dkr�t|�dkr@t|d �t|d �kS t|�dkr�t|d �t|d �kr�t|d �t|d �kr�dS n|t|�dkr�t|�dkr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�dS dS )Nr1 r$ r2 TF)r rA r )r; rB Z_portrH r+ r+ r. �portInPortRange� s 0 00rI c C sT t | �}t|�dkr$|d |d f}tt |�}ttdd� |�dd� d�}g }x�|D ]�}|d |d kr�|d |d kr�|j|� qR|d |d kr�|d |d k r�|d |d kr�|j|� |d |d f}qR|d |d ko�|d |d ko�|d |d krR|j|� |d |d f}qRW ttdd� |��}|d |d k�rJ|d f}|g|fS )z� Coalesce a port range with existing list of port ranges
@param new_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after coalescing, list of removed original ranges)
r1 r$ c S s t | �dkr | d | d fS | S )Nr1 r$ )rA )�xr+ r+ r. �<lambda>� s z#coalescePortRange.<locals>.<lambda>c S s | d S )Nr$ r+ )rJ r+ r+ r. rK � s )�keyc S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK � s )r rA �map�sortedrD r> )Z new_range�rangesZcoalesced_range�_ranges�removed_rangesrB r+ r+ r. �coalescePortRange� s*
rR c C s� t | �} t| �dkr$| d | d f} tt |�}ttdd� |�dd� d�}g }g }�xJ|D �]@}| d |d kr�| d |d kr�|j|� qX| d |d kr�| d |d k r�| d |d kr�|j|� |j| d d |d f� qX| d |d k�r<| d |d k�r<| d |d k�r<|j|� |j|d | d d f� qX| d |d krX| d |d k rX|j|� |j|d | d d f� |j| d d |d f� qXW ttdd� |��}ttdd� |��}||fS ) z� break a port range from existing list of port ranges
@param remove_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after breaking up, list of removed original ranges)
r1 r$ c S s t | �dkr | d | d fS | S )Nr1 r$ )rA )rJ r+ r+ r. rK � s z breakPortRange.<locals>.<lambda>c S s | d S )Nr$ r+ )rJ r+ r+ r. rK � s )rL c S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK � s c S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK � s )r rA rM rN rD r> )Z remove_rangerO rP rQ Z added_rangesrB r+ r+ r. �breakPortRange� s2
$
rS c C s0 yt jt| �|�}W n t jk
r* dS X |S )z� Check and Get service name from port and proto string combination using socket.getservbyport
@param port string or id
@param protocol string
@return Service name if port and protocol are valid, else None
N)r9 Z
getservbyportr6 r: )r; �proto�namer+ r+ r. r � s
c C s. yt jt j| � W n t jk
r( dS X dS )zl Check IPv4 address.
@param ip address string
@return True if address is valid, else False
FT)r9 � inet_ptonZAF_INETr: )�ipr+ r+ r. r s
c C s
| j d�S )z� Normalize the IPv6 address
This is mostly about converting URL-like IPv6 address to normal ones.
e.g. [1234::4321] --> 1234:4321
z[])r7 )rW r+ r+ r. � normalizeIP6 s rX c C s2 yt jt jt| �� W n t jk
r, dS X dS )zl Check IPv6 address.
@param ip address string
@return True if address is valid, else False
FT)r9 rV ZAF_INET6rX r: )rW r+ r+ r. r s
c C s� d| krN| d | j d�� }| | j d�d d � }t|�dk sHt|�dk rVdS n| }d }t|�sbdS |r�d|krvt|�S y t|�}W n tk
r� dS X |dk s�|dkr�dS dS )N�/r1 F�.r$ � T)�indexrA r r6 r8 )rW �addr�maskr- r+ r+ r. r - s& c C s
| j t�S )N)� translate�NOPRINT_TRANS_TABLE)Zrule_strr+ r+ r. r# D s c C s� d| krN| d | j d�� }| | j d�d d � }t|�dk sHt|�dk rVdS n| }d }t|�sbdS |r�y t|�}W n tk
r� dS X |dk s�|dkr�dS dS )NrY r1 Fr$ � T)r\ rA r r6 r8 )rW r] r^ r- r+ r+ r. r G s" c C s` y t | �}W n: tk
rF ytj| � W n tjk
r@ dS X Y nX |dk sX|dkr\dS dS )NFr$ � T)r6 r8 r9 Zgetprotobynamer: )Zprotocolr- r+ r+ r. r
\ s c C s4 | st | �dkrdS xdD ]}|| kr dS q W dS ) z� Check interface string
@param interface string
@return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False
� F� rY �!�*T)rd rY re rf )rA )Ziface�chr+ r+ r. r k s
c C s< yt | d�}W n tk
r" dS X |dkr8|dkr8dS dS )Nr$ Fl �� T)r6 r8 )�valrJ r+ r+ r. r ~ s c C s� t jjt�sdS y"ttd��} | j� }W dQ R X W n tk
rF dS X t jjd| �s\dS y&td| d��} | j� }W dQ R X W n tk
r� dS X d|kr�dS dS )zv Check if firewalld is active
@return True if there is a firewalld pid file and the pid is used by firewalld
F�rNz/proc/%sz/proc/%s/cmdlineZ firewalldT)�os�path�existsr' �open�readline� Exception)�fd�pidZcmdliner+ r+ r. r
� s" c C sb y*t jjt�st jtd� tjddtdd�S tk
r\ } ztj d| � � W Y d d } ~ X nX d S )Ni� Zwtztemp.F)�mode�prefix�dir�deletez#Failed to create temporary file: %s)
rj rk rl r& �mkdir�tempfileZNamedTemporaryFilero r% r: )�msgr+ r+ r. r � s
c C sX y t | d��
}|j� S Q R X W n4 tk
rR } ztjd| |f � W Y d d }~X nX d S )Nri z Failed to read file "%s": %s)rm � readlinesro r% r: )�filename�f�er+ r+ r. r � s $c C s\ y$t | d��}|j|� W d Q R X W n2 tk
rV } ztjd| |f � dS d }~X nX dS )N�wz Failed to write to file "%s": %sFT)rm �writero r% r: )rz �liner{ r| r+ r+ r. r � s c C s( | dkrt dd�S | dkr$t dd�S dS )N�ipv4z /proc/sys/net/ipv4/ip_forwardz1
�ipv6z&/proc/sys/net/ipv6/conf/all/forwardingF)r )�ipvr+ r+ r. r � s
c C s | j dd�j dd�S )N�_r< z
nf-conntrack-rG )�replace)�moduler+ r+ r. �get_nf_conntrack_short_name� s r� c C s� t | �}|d
ks<|d ks<|d ks<t|�dkr�|d |d kr�|d krTtjd| � nZ|d
krltjd| � nB|d kr�tjd| � n*t|�dkr�|d |d kr�tjd| � dS d S )Nr2 r1 r$ z'%s': port > 65535z'%s': port is invalidz'%s': port is ambiguousz'%s': range start >= endFTr4 r3 r4 r3 )r rA r% Zdebug2)r; rH r+ r+ r. r � s c C s( | dkrt |�S | dkr t|�S dS d S )Nr� r� F)r r )r� �sourcer+ r+ r. r � s
c C s( | dkrt |�S | dkr t|�S dS d S )Nr� r� F)r r )r� r� r+ r+ r. r � s
c C sR t | �dkrNx dD ]}| | dkrdS qW x dD ]}| | tjkr0dS q0W dS dS )N� � r2 � � � rF Fr$ r1 � � � � � �
�
� rc T� )r2 r� r� r� r� ) r$ r1 r� r� r� r� r� r� r� r� r� rc )rA �stringZ hexdigits)Zmacr- r+ r+ r. r � s
c C s( g }x | D ]}||kr
|j |� q
W |S )N)rD )Z_list�outputrJ r+ r+ r. r � s
c C sH y.t jd| �}t|j� d j� �} |j� W n tk
rB dS X | S )z Get parent for pid z ps -o ppid -h -p %d 2>/dev/nullr$ N)rj �popenr6 ry r7 �closero )rq r{ r+ r+ r. r � s c C sB ddl m} ddlm} ttt|j� ��}d|t| � td� S )z�
iptables limits length of chain to (currently) 28 chars.
The longest chain we create is POST_<policy>_allow,
which leaves 28 - 11 = 17 chars for <policy>.
r$ )�POLICY_CHAIN_PREFIX)� SHORTCUTS� Z_allow)Zfirewall.core.ipXtablesr� �firewall.core.baser� �maxrM rA �values)r� r� �longest_shortcutr+ r+ r. r" s c C s. ddl m} ttt| j� ��}d|td� S )z�
Netfilter limits length of chain to (currently) 28 chars.
The longest chain we create is FWDI_<zone>_allow,
which leaves 28 - 11 = 17 chars for <zone>.
r$ )r� r� Z__allow)r� r� r� rM rA r� )r� r� r+ r+ r. r s c C sT t | �dk s t | �tjd�kr"dS x,| D ]$}|tjkr(|tjkr(|d kr(dS q(W dS )
Nr1 �SC_LOGIN_NAME_MAXFrZ r< r� �$T)rZ r< r� r� )rA rj �sysconfr� Z
ascii_lettersZdigits)�user�cr+ r+ r. r s
c C sD t | t�r,y t| �} W n tk
r* dS X | dkr@| dkr@dS dS ) NFr$ r2 r) r1 Tl i���)r5 �strr6 r8 )Zuidr+ r+ r. r ( s
c C sJ t | �dk st | �dkr dS xd
D ]}|| kr"dS q"W | d dkrFdS d S ) Nr1 i F�|�
� r$ rY T)r� r� r� )rA )Zcommandrg r+ r+ r. r 2 s
c C s� | j d�}t|�dkrdS |d dkr>|d dd � dkr>dS |d dd � d
krVdS |d dd � d krndS t|d �d k r�dS d
S )NrF r� r� Fr$ �rootr2 Z_ur1 Z_rZ_tr� T)r� r� r4 r4 r4 )r@ rA )�contextrE r+ r+ r. r < s
c C s8 dt t�kr djdd� | D ��S djdd� | D ��S d S )N�quoterd c s s | ]}t j|�V qd S )N)�shlexr� )r, �ar+ r+ r. � <genexpr>P s zjoinArgs.<locals>.<genexpr>c s s | ]}t j|�V qd S )N)�pipesr� )r, r� r+ r+ r. r� R s )rt r� rC )�argsr+ r+ r. r N s c C s8 t r*t| t�r*t| �} tj| �}tt|�S tj| �S d S )N)r r5 �unicoder r� r@ rM r )�_stringrE r+ r+ r. r T s
c C s t | t�r| jdd�S | S )z bytes to unicode zUTF-8r� )r5 �bytes�decode)r� r+ r+ r. r ] s
c C s t | t�s| jdd�S | S )z unicode to bytes zUTF-8r� )r5 r� �encode)r� r+ r+ r. r c s
c C s t rt| t�r| jdd�S | S )z" unicode to bytes only if Python 2zUTF-8r� )r r5 r� r� )r� r+ r+ r. r! i s )rF )9�__all__r9 rj Zos.pathr� r� r� �sysrw Zfirewall.core.loggerr% Zfirewall.configr& r' �versionr rB r` r r r rI rR rS r r rX r r r# r r
r r r
r r r r r� r r r r r r r" r r r r r r r r r r! r+ r+ r+ r. �<module> sz
:
&+
__pycache__/command.cpython-36.opt-1.pyc 0000644 00000043416 15035135171 0013770 0 ustar 00 3
��g�^ � @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m
Z
m Z m Z m
Z
mZ G dd� de�ZdS ) z<FirewallCommand class for command line client simplification�FirewallCommand� N)�errors)�
FirewallError)�
DBusException)� checkIPnMask�
checkIP6nMask� check_mac�
check_port�check_single_addressc @ s� e Zd Zd\dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zd]dd�Z d^dd�Z
d_dd�Z d`dd�Z dadd�Z
dbdd�Zdcd d �Zddd d �Zded d!�Zdfd"d#�Zdgd$d%�Zdhd&d'�Zdid(d)�Zdjd*d+�Zdkd,d-�Zd.d/� Zdld1d2�Zdmd3d4�Zd5d6� Zd7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z dg dAfdBdC�Z!dg fdDdE�Z"dg fdFdG�Z#dHdI� Z$dJdK� Z%dLdM� Z&dNdO� Z'dPdQ� Z(dRdS� Z)dTdU� Z*dVdW� Z+dXdY� Z,dZd[� Z-dS )nr Fc C s || _ || _d| _d | _d S )NT)�quiet�verbose�'_FirewallCommand__use_exception_handler�fw)�selfr r � r � /usr/lib/python3.6/command.py�__init__# s zFirewallCommand.__init__c C s
|| _ d S )N)r )r r r r r �set_fw) s zFirewallCommand.set_fwc C s
|| _ d S )N)r )r �flagr r r � set_quiet, s zFirewallCommand.set_quietc C s | j S )N)r )r r r r � get_quiet/ s zFirewallCommand.get_quietc C s
|| _ d S )N)r )r r r r r � set_verbose2 s zFirewallCommand.set_verbosec C s | j S )N)r )r r r r � get_verbose5 s zFirewallCommand.get_verboseNc C s$ |d k r | j r tjj|d � d S )N�
)r �sys�stdout�write)r �msgr r r � print_msg8 s zFirewallCommand.print_msgc C s$ |d k r | j r tjj|d � d S )Nr )r r �stderrr )r r r r r �print_error_msg< s z FirewallCommand.print_error_msgc C s, d}d}t jj� r || | }| j|� d S )Nz[91mz[00m)r r �isattyr )r r ZFAILZENDr r r �
print_warning@ s
z FirewallCommand.print_warningr c C s, |dkr| j |� n
| j|� tj|� d S )N� )r" r r �exit)r r Z exit_coder r r �print_and_exitG s
z FirewallCommand.print_and_exitc C s | j |d� d S )N� )r% )r r r r r �failR s zFirewallCommand.failc C s" |d k r | j r tjj|d � d S )Nr )r r r r )r r r r r �print_if_verboseU s z FirewallCommand.print_if_verbosec
C s� | j d k r| j j� g }
d} g } x�|D ]�}
|d k r�y ||
�}
W nx tk
r� } z\tjt|��}t|�dkrz| jd| � n| jd| |� || kr�| j |� | d7 } w&W Y d d }~X nX |
j |
� q&W �xb|
D �]X}
g }|d k r�||7 }t
|
t � o�t
|
t � �r|j |
� n||
7 }|d k �r(||7 }| j
� y ||� W n� ttfk
�r } z�t
|t��rx| j|j� � |j� }nt|�}tj|�}|tjtjtjtjgk�r�d}t|�dk�r�| jd| � n,|dk�r�| jd| � d S | jd| |� || k�r| j |� | d7 } W Y d d }~X nX | j� q�W | �s�t|�| k�sJd| k�rNd S t| �dk�rltj| d � nt| �dk�r�tjtj� d S )Nr r# z Warning: %sz Error: %s)r Z authorizeAll� Exceptionr �get_code�str�lenr" r% �append�
isinstance�list�tuple� deactivate_exception_handlerr �fail_if_not_authorized�
get_dbus_name�get_dbus_messager �ALREADY_ENABLED� NOT_ENABLED�ZONE_ALREADY_SET� ALREADY_SET�activate_exception_handlerr r$ Z
UNKNOWN_ERROR)r Zcmd_type�option�
action_method� query_method� parse_method�message�
start_args�end_args�no_exit�itemsZ_errorsZ _error_codes�itemr �code� call_itemr r r Z__cmd_sequenceY sr
z FirewallCommand.__cmd_sequencec C s | j d||||||d� d S )N�add)rA )� _FirewallCommand__cmd_sequence)r r: r; r< r= r> rA r r r � add_sequence� s z FirewallCommand.add_sequencec
C s | j d||||||g|d� d S )NrF )r? rA )rG )r �xr: r; r< r= r> rA r r r �x_add_sequence� s z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d� d S )NrF )r? r@ rA )rG ) r �zoner: r; r< r= r> ZtimeoutrA r r r �zone_add_timeout_sequence� s z)FirewallCommand.zone_add_timeout_sequencec C s | j d||||||d� d S )N�remove)rA )rG )r r: r; r< r= r> rA r r r �remove_sequence� s z FirewallCommand.remove_sequencec
C s | j d||||||g|d� d S )NrM )r? rA )rG )r rI r: r; r< r= r> rA r r r �x_remove_sequence� s z!FirewallCommand.x_remove_sequencec
C s g }x�|D ]�}|d k r�y ||�}W n^ t k
r� } zBt|�dkrR| jd| � w
n tjt| ��}
| jd| |
� W Y d d } ~ X nX |j|� q
W �xv|D �]l}g } |d k r�| |7 } t|t � r�t|t
� r�| j|� n| |7 } | j � y || � } W n� t k
�rj } zZ| j
| j� � tj| j� �}
t|�dk�rF| jd| j� � w�n| jd| j� |
� W Y d d } ~ X n` t k
�r� } zBtjt| ��}
t|�dk�r�| jd| � n| jd| |
� W Y d d } ~ X nX | j� t|�dk�r�| jd|| d| f � q�| j| � q�W |�stjd� d S ) Nr# z Warning: %sz Error: %sz%s: %s�no�yesr )rP rQ )r) r, r" r r* r+ r% r- r. r/ r0 r1 r r2 r3 r4 r9 r �print_query_resultr r$ )
r r: r< r= r> r? rA rB rC r rD rE �resr r r Z__query_sequence� sR
" " z FirewallCommand.__query_sequencec C s | j |||||d� d S )N)rA )� _FirewallCommand__query_sequence)r r: r< r= r> rA r r r �query_sequence� s
z FirewallCommand.query_sequencec C s | j |||||g|d� d S )N)r? rA )rT )r rI r: r< r= r> rA r r r �x_query_sequence� s
z FirewallCommand.x_query_sequencec C sJ t |� rFt|� rFt|� rF|jd�o2t|�dk rFttjd| ��|S )Nzipset:� z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r �
startswithr, r r � INVALID_ADDR)r �valuer r r � parse_source� s
z FirewallCommand.parse_source�/c
C sl y|j |�\}}W n$ tk
r6 ttjd| ��Y nX t|�sLttj|��|dkrdttjd| ��||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocol�tcp�udp�sctp�dccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r] r^ r_ r` )�split�
ValueErrorr r � INVALID_PORTr �INVALID_PROTOCOL)r rZ Z separator�port�protor r r �
parse_port s zFirewallCommand.parse_portc
C s� d }d }d }d }d}x�d||d � kr�||d � j dd�d }|t|�d 7 }d||d � krx||d � j dd�d } n ||d � } |t| �d 7 }|dkr�| }q|dkr�| }q|dkr�| }q|dkr�| }q|d kr�|r�qttjd
| ��qW |�s ttjd ��|�sttjd ��|�p|�s*ttjd
��t|��s@ttj|��|dk�rZttjd| ��|�rxt|� �rxttj|��|�r�td|� �r�|�s�td|� �r�ttj |��||||fS )Nr �=r# �:re rf �toport�toaddr�ifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationr] r^ r_ r` z''%s' not in {'tcp'|'udp'|'sctp'|'dccp'}�ipv4�ipv6)r] r^ r_ r` )
ra r, r r ZINVALID_FORWARDr rc rd r
rY )
r rZ �compatre Zprotocolrj rk �i�opt�valr r r �parse_forward_port sT
z"FirewallCommand.parse_forward_portc C sF |j d�}t|�dkr"|d dfS t|�dkr2|S ttjd| ��d S )Nrh r# r � r& zinvalid ipset option '%s')ra r, r r ZINVALID_OPTION)r rZ �argsr r r �parse_ipset_optionH s
z"FirewallCommand.parse_ipset_optionc C s. ddg}||kr*t tjd|dj|�f ��|S )Nrm rn z'invalid argument: %s (choose from '%s')z', ')r r � INVALID_IPV�join)r rZ �ipvsr r r �check_destination_ipvR s z%FirewallCommand.check_destination_ipvc C sD y|j dd�\}}W n tk
r4 ttjd��Y nX | j|�|fS )Nri r# z(destination syntax is ipv:address[/mask])ra rb r r ZINVALID_DESTINATIONrz )r rZ ZipvZ destinationr r r �parse_service_destinationZ s z)FirewallCommand.parse_service_destinationc C s0 dddg}||kr,t tjd|dj|�f ��|S )Nrm rn Zebz'invalid argument: %s (choose from '%s')z', ')r r rw rx )r rZ ry r r r � check_ipvb s
zFirewallCommand.check_ipvc C s0 dddg}||kr,t tjd|dj|�f ��|S )Nrt rm rn z'invalid argument: %s (choose from '%s')z', ')r r rw rx )r rZ ry r r r �check_helper_familyj s
z#FirewallCommand.check_helper_familyc C sB |j d�sttjd| ��t|jdd��dk r>ttjd| ��|S )NZ
nf_conntrack_z('%s' does not start with 'nf_conntrack_'rt r# zModule name '%s' too short)rX r r ZINVALID_MODULEr, �replace)r rZ r r r � check_moduler s
z FirewallCommand.check_moduleTc C s� |j � }|j� }|j� }|j� } |j� }
|j� } |j� } |j� }
|j� }|j � }|j
� }|rv|j � }|j � }|j
� }n,|j� }tt|j� | ��}|j� }|j� }dd� }g }|d k r�||kr�|jd� | r�|s�|s�|r�|r�|r�|jd� |�r|ddj|� }| j|� | j�r2| jd| � | jd| � |�rJ| jd t|� � | jd
| � |�sv| jd |�rnd nd
� |�r�| jddj|� � | jddj|� � n(| jddj|� � | jddj|� � | jddjt|�� � | jddjdd� |D �� � | jddjt| �� � |�s:| jd|�r2d nd
� | jd|
�rJd nd
� | jd| �rbdnd djd d� | D �� � | jd djd d� | D �� � | jd dj|
� � | jd!|�r�dnd djt||d"�� � d S )#Nc S sf d}d}y| j |�}W n tk
r* Y n8X |t|�7 }t| ||| |d � j d� � jdd��}|S )Nr z priority=� �"rt )�indexrb r, �intr~ )Zrule�priorityZ
search_strrp r r r �rich_rule_sorted_key� s *zDFirewallCommand.print_zone_policy_info.<locals>.rich_rule_sorted_key�defaultZactivez (%s)z, z summary: z description: z priority: z
target: z icmp-block-inversion: %srQ rP z ingress-zones: r� z egress-zones: z interfaces: z sources: z services: z ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )�.0re r r r �
<listcomp>� s z:FirewallCommand.print_zone_policy_info.<locals>.<listcomp>z
protocols: z
forward: %sz masquerade: %sz forward-ports: z
rt c S s$ g | ] \}}}}d ||||f �qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r� re rf rj rk r r r r� � s z source-ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z icmp-blocks: z rich rules: )�key)Z getTargetZ getServices�getPorts� getProtocolsZ
getMasqueradeZgetForwardPorts�getSourcePortsZ
getIcmpBlocksZ getRichRules�getDescription�getShortZgetIngressZonesZgetEgressZonesZ getPriorityZgetIcmpBlockInversion�sorted�setZ
getInterfacesZ
getSourcesZ
getForwardr- rx r r r+ )r rK �settings� default_zone�extra_interfaces�isPolicy�targetZservices�ports� protocolsZ
masqueradeZ
forward_ports� source_portsZ icmp_blocksZrules� description�short_descriptionZ
ingress_zonesZ egress_zonesr� Zicmp_block_inversionZ
interfacesZsourcesZforwardr� Z
attributesr r r �print_zone_policy_info| sx
z&FirewallCommand.print_zone_policy_infoc C s | j ||||dd� d S )NF)r� r� r� )r� )r rK r� r� r� r r r �print_zone_info� s z FirewallCommand.print_zone_infoc C s | j ||||dd� d S )NT)r� r� r� )r� )r Zpolicyr� r� r� r r r �print_policy_info� s z!FirewallCommand.print_policy_infoc C s. |j � }|j� }|j� }|j� }|j� }|j� }|j� } |j� }
|j� } | j |� | j
rt| j d| � | j d| � | j ddj dd� |D �� � | j ddj |� � | j ddj d d� |D �� � | j d
dj |� � | j d dj d d� |j � D �� � | j d
dj t
|
�� � | j ddj t
| �� � d S )Nz summary: z description: z ports: r� c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z6FirewallCommand.print_service_info.<locals>.<listcomp>z
protocols: z source-ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z modules: z destination: c S s g | ]\}}d ||f �qS )z%s:%sr )r� �k�vr r r r� � s z includes: z helpers: )r� r� r� Z
getModulesr� �getDestinationsr� Z getIncludesZ
getHelpersr r rx rB r� ) r Zservicer� r� r� r� �modulesr� � destinationsr� ZincludesZhelpersr r r �print_service_info� s2
z"FirewallCommand.print_service_infoc C sp |j � }|j� }|j� }t|�dkr,ddg}| j|� | jrX| jd| � | jd| � | jddj|� � d S )Nr rm rn z summary: z description: z destination: r� )r� r� r� r, r r rx )r Zicmptyper� r� r� r� r r r �print_icmptype_info� s
z#FirewallCommand.print_icmptype_infoc C s� |j � }|j� }|j� }|j� }|j� }| j|� | jrT| jd| � | jd| � | jd| � | jddjdd� |j� D �� � | jddj|� � d S ) Nz summary: z description: z type: z options: r� c S s$ g | ] \}}|r d ||f n|�qS )z%s=%sr )r� r� r� r r r r� s z4FirewallCommand.print_ipset_info.<locals>.<listcomp>z entries: ) ZgetTypeZ
getOptionsZ
getEntriesr� r� r r rx rB )r Zipsetr� Z
ipset_typeZoptions�entriesr� r� r r r �print_ipset_info� s
z FirewallCommand.print_ipset_infoc C s� |j � }|j� }|j� }|j� }|j� }| j|� | jrT| jd| � | jd| � | jd| � | jd| � | jddjdd� |D �� � d S ) Nz summary: z description: z
family: z
module: z ports: r� c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� s z5FirewallCommand.print_helper_info.<locals>.<listcomp>)r� Z getModuleZ getFamilyr� r� r r rx )r �helperr� r� �moduleZfamilyr� r� r r r �print_helper_info s
z!FirewallCommand.print_helper_infoc C s |r| j d� n | j dd� d S )NrQ rP r# )r% )r rZ r r r rR s z"FirewallCommand.print_query_resultc C s\ | j s� | j|� tjt|��}|tjtjtjtj gkrH| j
d| � n| j d| |� d S )Nz Warning: %sz Error: %s) r
r2 r r* r+ r r5 r6 r7 r8 r" r% )r �exception_messagerD r r r �exception_handler s
z!FirewallCommand.exception_handlerc C s d|krd}| j |tj� d S )NZNotAuthorizedExceptionz`Authorization failed.
Make sure polkit agent is running or run the application as superuser.)r% r ZNOT_AUTHORIZED)r r� r r r r r2 ' s z&FirewallCommand.fail_if_not_authorizedc C s
d| _ d S )NF)r
)r r r r r1 - s z,FirewallCommand.deactivate_exception_handlerc C s
d| _ d S )NT)r
)r r r r r9 0 s z*FirewallCommand.activate_exception_handlerc C sp g }t � }t|�}xP|D ]H}|s"P |j� }t|�dk s|d dkrDq||kr|j|� |j|� qW |j� |S )Nr# r �#�;)r� r� )r� �open�stripr, r- rF �close)r �filenamer� Z entries_set�f�liner r r �get_ipset_entries_from_file3 s
z+FirewallCommand.get_ipset_entries_from_file)FF)N)N)N)Nr )N)N)NNF)F)F)F)F)F)NF)F)F)r\ )F).�__name__�
__module__� __qualname__r r r r r r r r r" r% r' r( rG rH rJ rL rN rO rT rU rV r[ rg rs rv rz r{ r| r} r r� r� r� r� r� r� r� rR r� r2 r1 r9 r� r r r r r " sX
J
2
2
O )�__doc__�__all__r Zfirewallr Zfirewall.errorsr Zdbus.exceptionsr Zfirewall.functionsr r r r r
�objectr r r r r �<module> s __pycache__/fw_types.cpython-36.opt-1.pyc 0000644 00000005613 15035135171 0014207 0 ustar 00 3
��g� � @ s d gZ G dd � d e�ZdS )�LastUpdatedOrderedDictc @ sx e Zd Zd dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zd dd�ZdS ) r Nc C s i | _ g | _|r| j|� d S )N)�_dict�_list�update)�self�x� r � /usr/lib/python3.6/fw_types.py�__init__ s z LastUpdatedOrderedDict.__init__c C s | j d d �= | jj� d S )N)r r �clear)r r r r r
s z LastUpdatedOrderedDict.clearc C s" x |j � D ]\}}|| |< q
W d S )N)�items)r r �key�valuer r r r # s z LastUpdatedOrderedDict.updatec s � fdd�� j D �S )Nc s g | ]}|� | f�qS r r )�.0r )r r r �
<listcomp>( s z0LastUpdatedOrderedDict.items.<locals>.<listcomp>)r )r r )r r r ' s z LastUpdatedOrderedDict.itemsc C s" || j kr | jj|� | j |= d S )N)r r �remove)r r r r r � __delitem__* s
z"LastUpdatedOrderedDict.__delitem__c s& d� j jdj� fdd�� jD ��f S )Nz%s([%s])z, c s g | ]}d |� | f �qS )z(%r, %r)r )r r )r r r r 1 s z3LastUpdatedOrderedDict.__repr__.<locals>.<listcomp>)� __class__�__name__�joinr )r r )r r �__repr__/ s z LastUpdatedOrderedDict.__repr__c C s$ || j kr| jj|� || j |< d S )N)r r �append)r r r
r r r � __setitem__3 s
z"LastUpdatedOrderedDict.__setitem__c C s$ t |�tkr| j| S | j| S d S )N)�type�intr r )r r r r r � __getitem__8 s
z"LastUpdatedOrderedDict.__getitem__c C s
t | j�S )N)�lenr )r r r r �__len__> s z LastUpdatedOrderedDict.__len__c C s t | �S )N)r )r r r r �copyA s zLastUpdatedOrderedDict.copyc C s | j d d � S )N)r )r r r r �keysD s zLastUpdatedOrderedDict.keysc s � fdd�� j D �S )Nc s g | ] }� | �qS r r )r r )r r r r H s z1LastUpdatedOrderedDict.values.<locals>.<listcomp>)r )r r )r r �valuesG s z LastUpdatedOrderedDict.valuesc C s || kr| | S || |< |S d S )Nr )r r r
r r r �
setdefaultJ s z!LastUpdatedOrderedDict.setdefault)N)N)r �
__module__� __qualname__r r
r r r r r r r r r r r r r r r r s
N)�__all__�objectr r r r r �<module> s __pycache__/__init__.cpython-36.pyc 0000644 00000000161 15035135171 0013140 0 ustar 00 3
��g � @ s d S )N� r r r � /usr/lib/python3.6/__init__.py�<module> s __pycache__/__init__.cpython-36.opt-1.pyc 0000644 00000000161 15035135171 0014077 0 ustar 00 3
��g � @ s d S )N� r r r � /usr/lib/python3.6/__init__.py�<module> s __pycache__/errors.cpython-36.pyc 0000644 00000007340 15035135171 0012723 0 ustar 00 3
��g� � @ s� d Z dZdZdZdZdZdZdZdZd Z d
Z
d Z d Z d
Z
dZdZdZdZdZdZdZdZdZdZdZdZdZdZd Z d Z d Z d Z d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)d*Z*d+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDZDdEZEdFZFdGZGdHZHdIZIdJZJdKZKdLZLdMZMdNZNdOZOdPZPdQdRlQZQG dSdT� dTeR�ZSeQjTeSjU ZVdUdV� eWeV�D �eS_XdWdV� eSjXD �eS_YdRS )X� � �
� � � � � � � � � � � � � � � � � � � �! �" �# �$ �% �& �d �e �f �g �h �i �j �k �l �m �n �o �p �q �r �s �t �u �v �w �x �y �z �{ �| �} �~ � � � � � � � � � � � � � � �� �� �� �� �� �� �� �� � � � � � Nc @ s6 e Zd Zd
dd�Zdd� Zdd� Zdd � Zee�ZdS ) �
FirewallErrorNc C sR || _ |d k rHtjdk rHy t|�}W n" tk
rF t|�jd�}Y nX || _d S )N�3Zunicode_escape)�code�sys�version�str�UnicodeEncodeErrorZunicode�encode�msg)�selfrU r[ �x� r^ � /usr/lib/python3.6/errors.py�__init__n s
zFirewallError.__init__c C s d| j | j| jf S )Nz
%s(%r, %r))� __class__rU r[ )r\ r^ r^ r_ �__repr__y s zFirewallError.__repr__c C s( | j r d| j| j | j f S | j| j S )Nz%s: %s)r[ �errorsrU )r\ r^ r^ r_ �__str__| s zFirewallError.__str__c C sP d| kr | j d�}| d |� }n| }ytj| }W n tk
rJ t}Y nX |S )N�:)�indexrS �codes�KeyError�
UNKNOWN_ERROR)r[ �idxZecoderU r^ r^ r_ �get_code� s
zFirewallError.get_code)N)�__name__�
__module__� __qualname__r` rb rd rk � staticmethodr^ r^ r^ r_ rS m s
rS c C s6 i | ].}|j d � rttt|��tkr|tt|��qS )�_)�
startswith�type�getattr�mod�int)�.0Zvarnamer^ r^ r_ �
<dictcomp>� s rw c C s i | ]}|t j| �qS r^ )rS rc )rv rU r^ r^ r_ rw � s )ZZALREADY_ENABLEDZ NOT_ENABLEDZCOMMAND_FAILEDZ NO_IPV6_NATZ
PANIC_MODEZZONE_ALREADY_SETZUNKNOWN_INTERFACEZ
ZONE_CONFLICTZ
BUILTIN_CHAINZEBTABLES_NO_REJECTZNOT_OVERLOADABLEZ NO_DEFAULTSZ BUILTIN_ZONEZBUILTIN_SERVICEZBUILTIN_ICMPTYPEZ
NAME_CONFLICTZ
NAME_MISMATCHZ PARSE_ERRORZ
ACCESS_DENIEDZUNKNOWN_SOURCEZRT_TO_PERM_FAILEDZIPSET_WITH_TIMEOUTZ
BUILTIN_IPSETZ ALREADY_SETZMISSING_IMPORTZ
DBUS_ERRORZBUILTIN_HELPERZ NOT_APPLIEDZINVALID_ACTIONZINVALID_SERVICEZ INVALID_PORTZINVALID_PROTOCOLZINVALID_INTERFACEZ INVALID_ADDRZINVALID_FORWARDZINVALID_ICMPTYPEZ
INVALID_TABLEZ
INVALID_CHAINZINVALID_TARGETZ INVALID_IPVZ INVALID_ZONEZINVALID_PROPERTYZ
INVALID_VALUEZINVALID_OBJECTZ INVALID_NAMEZINVALID_FILENAMEZINVALID_DIRECTORYZ INVALID_TYPEZINVALID_SETTINGZINVALID_DESTINATIONZ INVALID_RULEZ
INVALID_LIMITZINVALID_FAMILYZINVALID_LOG_LEVELZINVALID_AUDIT_TYPEZ INVALID_MARKZINVALID_CONTEXTZINVALID_COMMANDZ INVALID_USERZ INVALID_UIDZINVALID_MODULEZINVALID_PASSTHROUGHZ INVALID_MACZ
INVALID_IPSETZ
INVALID_ENTRYZINVALID_OPTIONZINVALID_HELPERZINVALID_PRIORITYZINVALID_POLICYZ
MISSING_TABLEZ
MISSING_CHAINZ MISSING_PORTZMISSING_PROTOCOLZ MISSING_ADDRZ MISSING_NAMEZMISSING_SETTINGZMISSING_FAMILYZRUNNING_BUT_FAILEDZ NOT_RUNNINGZNOT_AUTHORIZEDri rV � ExceptionrS �modulesrm rt �dirrc rg r^ r^ r^ r_ �<module> s� $ server/config_zone.py 0000644 00000132127 15035135171 0010733 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
# force use of pygobject3 in python-slip
from gi.repository import GObject
import sys
sys.modules['gobject'] = GObject
import dbus
import dbus.service
import slip.dbus
import slip.dbus.service
from firewall import config
from firewall.dbus_utils import dbus_to_python, \
dbus_introspection_prepare_properties, \
dbus_introspection_add_properties
from firewall.core.io.zone import Zone
from firewall.core.fw_ifcfg import ifcfg_set_zone_of_interface
from firewall.core.base import DEFAULT_ZONE_TARGET
from firewall.core.rich import Rich_Rule
from firewall.core.logger import log
from firewall.server.decorators import handle_exceptions, \
dbus_handle_exceptions, dbus_service_method
from firewall import errors
from firewall.errors import FirewallError
from firewall.functions import portStr, portInPortRange, coalescePortRange, \
breakPortRange
############################################################################
#
# class FirewallDConfig
#
############################################################################
class FirewallDConfigZone(slip.dbus.service.Object):
"""FirewallD main class"""
persistent = True
""" Make FirewallD persistent. """
default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG
""" Use PK_ACTION_INFO as a default """
@handle_exceptions
def __init__(self, parent, conf, zone, item_id, *args, **kwargs):
super(FirewallDConfigZone, self).__init__(*args, **kwargs)
self.parent = parent
self.config = conf
self.obj = zone
self.item_id = item_id
self.busname = args[0]
self.path = args[1]
self._log_prefix = "config.zone.%d" % self.item_id
dbus_introspection_prepare_properties(
self, config.dbus.DBUS_INTERFACE_CONFIG_ZONE)
@dbus_handle_exceptions
def __del__(self):
pass
@dbus_handle_exceptions
def unregister(self):
self.remove_from_connection()
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# P R O P E R T I E S
@dbus_handle_exceptions
def _get_property(self, property_name):
if property_name == "name":
return dbus.String(self.obj.name)
elif property_name == "filename":
return dbus.String(self.obj.filename)
elif property_name == "path":
return dbus.String(self.obj.path)
elif property_name == "default":
return dbus.Boolean(self.obj.default)
elif property_name == "builtin":
return dbus.Boolean(self.obj.builtin)
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss',
out_signature='v')
@dbus_handle_exceptions
def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613
# get a property
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
log.debug1("%s.Get('%s', '%s')", self._log_prefix,
interface_name, property_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ZONE:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
return self._get_property(property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s',
out_signature='a{sv}')
@dbus_handle_exceptions
def GetAll(self, interface_name, sender=None): # pylint: disable=W0613
interface_name = dbus_to_python(interface_name, str)
log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ZONE:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
ret = { }
for x in [ "name", "filename", "path", "default", "builtin" ]:
ret[x] = self._get_property(x)
return dbus.Dictionary(ret, signature="sv")
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv')
@dbus_handle_exceptions
def Set(self, interface_name, property_name, new_value, sender=None):
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
new_value = dbus_to_python(new_value)
log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix,
interface_name, property_name, new_value)
self.parent.accessCheck(sender)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ZONE:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.PropertyReadOnly: "
"Property '%s' is read-only" % property_name)
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as')
def PropertiesChanged(self, interface_name, changed_properties,
invalidated_properties):
interface_name = dbus_to_python(interface_name, str)
changed_properties = dbus_to_python(changed_properties)
invalidated_properties = dbus_to_python(invalidated_properties)
log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix,
interface_name, changed_properties, invalidated_properties)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s')
@dbus_handle_exceptions
def Introspect(self, sender=None): # pylint: disable=W0613
log.debug2("%s.Introspect()", self._log_prefix)
data = super(FirewallDConfigZone, self).Introspect(
self.path, self.busname.get_bus())
return dbus_introspection_add_properties(
self, data, config.dbus.DBUS_INTERFACE_CONFIG_ZONE)
# S E T T I N G S
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature="(sssbsasa(ss)asba(ssss)asasasasa(ss)b)")
@dbus_handle_exceptions
def getSettings(self, sender=None): # pylint: disable=W0613
"""get settings for zone
"""
log.debug1("%s.getSettings()", self._log_prefix)
settings = self.config.get_zone_config(self.obj)
if settings[4] == DEFAULT_ZONE_TARGET:
# convert to list, fix target, convert back to tuple
_settings = list(settings)
_settings[4] = "default"
settings = tuple(_settings)
return settings
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature="a{sv}")
@dbus_handle_exceptions
def getSettings2(self, sender=None):
"""get settings for zone
"""
log.debug1("%s.getSettings2()", self._log_prefix)
settings = self.config.get_zone_config_dict(self.obj)
if settings["target"] == DEFAULT_ZONE_TARGET:
settings["target"] = "default"
return settings
def _checkDuplicateInterfacesSources(self, settings):
"""Assignment of interfaces/sources to zones is different from other
zone settings in the sense that particular interface/zone can be
part of only one zone. So make sure added interfaces/sources have
not already been bound to another zone."""
old_settings = self.config.get_zone_config_dict(self.obj)
old_ifaces = set(old_settings["interfaces"]) if "interfaces" in old_settings else set()
old_sources = set(old_settings["sources"]) if "sources" in old_settings else set()
if isinstance(settings, tuple):
added_ifaces = set(settings[Zone.index_of("interfaces")]) - old_ifaces
added_sources = set(settings[Zone.index_of("sources")]) - old_sources
else: # dict
new_ifaces = set(settings["interfaces"]) if "interfaces" in settings else set()
new_sources = set(settings["sources"]) if "sources" in settings else set()
added_ifaces = new_ifaces - old_ifaces
added_sources = new_sources - old_sources
for iface in added_ifaces:
if self.parent.getZoneOfInterface(iface):
raise FirewallError(errors.ZONE_CONFLICT, iface) # or move to new zone ?
for source in added_sources:
if self.parent.getZoneOfSource(source):
raise FirewallError(errors.ZONE_CONFLICT, source) # or move to new zone ?
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature="(sssbsasa(ss)asba(ssss)asasasasa(ss)b)")
@dbus_handle_exceptions
def update(self, settings, sender=None):
"""update settings for zone
"""
settings = dbus_to_python(settings)
log.debug1("%s.update('...')", self._log_prefix)
self.parent.accessCheck(sender)
if settings[4] == "default":
# convert to list, fix target, convert back to tuple
_settings = list(settings)
_settings[4] = DEFAULT_ZONE_TARGET
settings = tuple(_settings)
self._checkDuplicateInterfacesSources(settings)
self.obj = self.config.set_zone_config(self.obj, settings)
self.Updated(self.obj.name)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature="a{sv}")
@dbus_handle_exceptions
def update2(self, settings, sender=None):
"""update settings for zone
"""
settings = dbus_to_python(settings)
log.debug1("%s.update2('...')", self._log_prefix)
self.parent.accessCheck(sender)
if "target" in settings and settings["target"] == "default":
settings["target"] = DEFAULT_ZONE_TARGET
self._checkDuplicateInterfacesSources(settings)
self.obj = self.config.set_zone_config_dict(self.obj, settings)
self.Updated(self.obj.name)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE)
@dbus_handle_exceptions
def loadDefaults(self, sender=None):
"""load default settings for builtin zone
"""
log.debug1("%s.loadDefaults()", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.load_zone_defaults(self.obj)
self.Updated(self.obj.name)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, signature='s')
@dbus_handle_exceptions
def Updated(self, name):
log.debug1("%s.Updated('%s')" % (self._log_prefix, name))
# R E M O V E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE)
@dbus_handle_exceptions
def remove(self, sender=None):
"""remove zone
"""
log.debug1("%s.removeZone()", self._log_prefix)
self.parent.accessCheck(sender)
self.config.remove_zone(self.obj)
self.parent.removeZone(self.obj)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, signature='s')
@dbus_handle_exceptions
def Removed(self, name):
log.debug1("%s.Removed('%s')" % (self._log_prefix, name))
# R E N A M E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def rename(self, name, sender=None):
"""rename zone
"""
name = dbus_to_python(name, str)
log.debug1("%s.rename('%s')", self._log_prefix, name)
self.parent.accessCheck(sender)
self.obj = self.config.rename_zone(self.obj, name)
self.Renamed(name)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, signature='s')
@dbus_handle_exceptions
def Renamed(self, name):
log.debug1("%s.Renamed('%s')" % (self._log_prefix, name))
# version
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='s')
@dbus_handle_exceptions
def getVersion(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getVersion()", self._log_prefix)
return self.getSettings()[0]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def setVersion(self, version, sender=None):
version = dbus_to_python(version, str)
log.debug1("%s.setVersion('%s')", self._log_prefix, version)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[0] = version
self.update(settings)
# short
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='s')
@dbus_handle_exceptions
def getShort(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getShort()", self._log_prefix)
return self.getSettings()[1]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def setShort(self, short, sender=None):
short = dbus_to_python(short, str)
log.debug1("%s.setShort('%s')", self._log_prefix, short)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[1] = short
self.update(settings)
# description
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='s')
@dbus_handle_exceptions
def getDescription(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getDescription()", self._log_prefix)
return self.getSettings()[2]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def setDescription(self, description, sender=None):
description = dbus_to_python(description, str)
log.debug1("%s.setDescription('%s')", self._log_prefix, description)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[2] = description
self.update(settings)
# immutable (deprecated)
# settings[3] was used for 'immutable'
# target
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='s')
@dbus_handle_exceptions
def getTarget(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getTarget()", self._log_prefix)
settings = self.getSettings()
return settings[4] if settings[4] != DEFAULT_ZONE_TARGET else "default"
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def setTarget(self, target, sender=None):
target = dbus_to_python(target, str)
log.debug1("%s.setTarget('%s')", self._log_prefix, target)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[4] = target if target != "default" else DEFAULT_ZONE_TARGET
self.update(settings)
# service
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='as')
@dbus_handle_exceptions
def getServices(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getServices()", self._log_prefix)
return self.getSettings()[5]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='as')
@dbus_handle_exceptions
def setServices(self, services, sender=None):
services = dbus_to_python(services, list)
log.debug1("%s.setServices('[%s]')", self._log_prefix,
",".join(services))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[5] = services
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def addService(self, service, sender=None):
service = dbus_to_python(service, str)
log.debug1("%s.addService('%s')", self._log_prefix, service)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if service in settings[5]:
raise FirewallError(errors.ALREADY_ENABLED, service)
settings[5].append(service)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def removeService(self, service, sender=None):
service = dbus_to_python(service, str)
log.debug1("%s.removeService('%s')", self._log_prefix, service)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if service not in settings[5]:
raise FirewallError(errors.NOT_ENABLED, service)
settings[5].remove(service)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryService(self, service, sender=None): # pylint: disable=W0613
service = dbus_to_python(service, str)
log.debug1("%s.queryService('%s')", self._log_prefix, service)
return service in self.getSettings()[5]
# port
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='a(ss)')
@dbus_handle_exceptions
def getPorts(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getPorts()", self._log_prefix)
return self.getSettings()[6]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='a(ss)')
@dbus_handle_exceptions
def setPorts(self, ports, sender=None):
_ports = [ ]
# convert embedded lists to tuples
for port in dbus_to_python(ports, list):
if isinstance(port, list):
_ports.append(tuple(port))
else:
_ports.append(port)
ports = _ports
log.debug1("%s.setPorts('[%s]')", self._log_prefix,
",".join("('%s, '%s')" % (port[0], port[1]) for port in ports))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[6] = ports
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='ss')
@dbus_handle_exceptions
def addPort(self, port, protocol, sender=None):
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.addPort('%s', '%s')", self._log_prefix, port,
protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[6]))
for port_id in existing_port_ids:
if portInPortRange(port, port_id[0]):
raise FirewallError(errors.ALREADY_ENABLED,
"%s:%s" % (port, protocol))
added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids])
for range in removed_ranges:
settings[6].remove((portStr(range, "-"), protocol))
for range in added_ranges:
settings[6].append((portStr(range, "-"), protocol))
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='ss')
@dbus_handle_exceptions
def removePort(self, port, protocol, sender=None):
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.removePort('%s', '%s')", self._log_prefix, port,
protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[6]))
for port_id in existing_port_ids:
if portInPortRange(port, port_id[0]):
break
else:
raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol))
added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids])
for range in removed_ranges:
settings[6].remove((portStr(range, "-"), protocol))
for range in added_ranges:
settings[6].append((portStr(range, "-"), protocol))
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='ss', out_signature='b')
@dbus_handle_exceptions
def queryPort(self, port, protocol, sender=None): # pylint: disable=W0613
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.queryPort('%s', '%s')", self._log_prefix, port,
protocol)
for (_port, _protocol) in self.getSettings()[6]:
if portInPortRange(port, _port) and protocol == _protocol:
return True
return False
# protocol
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='as')
@dbus_handle_exceptions
def getProtocols(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getProtocols()", self._log_prefix)
return self.getSettings()[13]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='as')
@dbus_handle_exceptions
def setProtocols(self, protocols, sender=None):
protocols = dbus_to_python(protocols, list)
log.debug1("%s.setProtocols('[%s]')", self._log_prefix,
",".join(protocols))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[13] = protocols
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def addProtocol(self, protocol, sender=None):
protocol = dbus_to_python(protocol, str)
log.debug1("%s.addProtocol('%s')", self._log_prefix, protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if protocol in settings[13]:
raise FirewallError(errors.ALREADY_ENABLED, protocol)
settings[13].append(protocol)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def removeProtocol(self, protocol, sender=None):
protocol = dbus_to_python(protocol, str)
log.debug1("%s.removeProtocol('%s')", self._log_prefix, protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if protocol not in settings[13]:
raise FirewallError(errors.NOT_ENABLED, protocol)
settings[13].remove(protocol)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryProtocol(self, protocol, sender=None): # pylint: disable=W0613
protocol = dbus_to_python(protocol, str)
log.debug1("%s.queryProtocol('%s')", self._log_prefix, protocol)
return protocol in self.getSettings()[13]
# source port
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='a(ss)')
@dbus_handle_exceptions
def getSourcePorts(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getSourcePorts()", self._log_prefix)
return self.getSettings()[14]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='a(ss)')
@dbus_handle_exceptions
def setSourcePorts(self, ports, sender=None):
_ports = [ ]
# convert embedded lists to tuples
for port in dbus_to_python(ports, list):
if isinstance(port, list):
_ports.append(tuple(port))
else:
_ports.append(port)
ports = _ports
log.debug1("%s.setSourcePorts('[%s]')", self._log_prefix,
",".join("('%s, '%s')" % (port[0], port[1]) for port in ports))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[14] = ports
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='ss')
@dbus_handle_exceptions
def addSourcePort(self, port, protocol, sender=None):
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.addSourcePort('%s', '%s')", self._log_prefix, port,
protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[14]))
for port_id in existing_port_ids:
if portInPortRange(port, port_id[0]):
raise FirewallError(errors.ALREADY_ENABLED,
"%s:%s" % (port, protocol))
added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids])
for range in removed_ranges:
settings[14].remove((portStr(range, "-"), protocol))
for range in added_ranges:
settings[14].append((portStr(range, "-"), protocol))
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='ss')
@dbus_handle_exceptions
def removeSourcePort(self, port, protocol, sender=None):
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.removeSourcePort('%s', '%s')", self._log_prefix, port,
protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[14]))
for port_id in existing_port_ids:
if portInPortRange(port, port_id[0]):
break
else:
raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol))
added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids])
for range in removed_ranges:
settings[14].remove((portStr(range, "-"), protocol))
for range in added_ranges:
settings[14].append((portStr(range, "-"), protocol))
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='ss', out_signature='b')
@dbus_handle_exceptions
def querySourcePort(self, port, protocol, sender=None): # pylint: disable=W0613
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.querySourcePort('%s', '%s')", self._log_prefix, port,
protocol)
for (_port, _protocol) in self.getSettings()[14]:
if portInPortRange(port, _port) and protocol == _protocol:
return True
return False
# icmp block
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='as')
@dbus_handle_exceptions
def getIcmpBlocks(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getIcmpBlocks()", self._log_prefix)
return self.getSettings()[7]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='as')
@dbus_handle_exceptions
def setIcmpBlocks(self, icmptypes, sender=None):
icmptypes = dbus_to_python(icmptypes, list)
log.debug1("%s.setIcmpBlocks('[%s]')", self._log_prefix,
",".join(icmptypes))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[7] = icmptypes
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def addIcmpBlock(self, icmptype, sender=None):
icmptype = dbus_to_python(icmptype, str)
log.debug1("%s.addIcmpBlock('%s')", self._log_prefix, icmptype)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if icmptype in settings[7]:
raise FirewallError(errors.ALREADY_ENABLED, icmptype)
settings[7].append(icmptype)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def removeIcmpBlock(self, icmptype, sender=None):
icmptype = dbus_to_python(icmptype, str)
log.debug1("%s.removeIcmpBlock('%s')", self._log_prefix, icmptype)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if icmptype not in settings[7]:
raise FirewallError(errors.NOT_ENABLED, icmptype)
settings[7].remove(icmptype)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryIcmpBlock(self, icmptype, sender=None): # pylint: disable=W0613
icmptype = dbus_to_python(icmptype, str)
log.debug1("%s.queryIcmpBlock('%s')", self._log_prefix, icmptype)
return icmptype in self.getSettings()[7]
# icmp block inversion
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='b')
@dbus_handle_exceptions
def getIcmpBlockInversion(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getIcmpBlockInversion()", self._log_prefix)
return self.getSettings()[15]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='b')
@dbus_handle_exceptions
def setIcmpBlockInversion(self, flag, sender=None):
flag = dbus_to_python(flag, bool)
log.debug1("%s.setIcmpBlockInversion('%s')", self._log_prefix, flag)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[15] = flag
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE)
@dbus_handle_exceptions
def addIcmpBlockInversion(self, sender=None):
log.debug1("%s.addIcmpBlockInversion()", self._log_prefix)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if settings[15]:
raise FirewallError(errors.ALREADY_ENABLED, "icmp-block-inversion")
settings[15] = True
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE)
@dbus_handle_exceptions
def removeIcmpBlockInversion(self, sender=None):
log.debug1("%s.removeIcmpBlockInversion()", self._log_prefix)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if not settings[15]:
raise FirewallError(errors.NOT_ENABLED, "icmp-block-inversion")
settings[15] = False
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='b')
@dbus_handle_exceptions
def queryIcmpBlockInversion(self, sender=None): # pylint: disable=W0613
log.debug1("%s.queryIcmpBlockInversion()", self._log_prefix)
return self.getSettings()[15]
# masquerade
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='b')
@dbus_handle_exceptions
def getMasquerade(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getMasquerade()", self._log_prefix)
return self.getSettings()[8]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='b')
@dbus_handle_exceptions
def setMasquerade(self, masquerade, sender=None):
masquerade = dbus_to_python(masquerade, bool)
log.debug1("%s.setMasquerade('%s')", self._log_prefix, masquerade)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[8] = masquerade
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE)
@dbus_handle_exceptions
def addMasquerade(self, sender=None):
log.debug1("%s.addMasquerade()", self._log_prefix)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if settings[8]:
raise FirewallError(errors.ALREADY_ENABLED, "masquerade")
settings[8] = True
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE)
@dbus_handle_exceptions
def removeMasquerade(self, sender=None):
log.debug1("%s.removeMasquerade()", self._log_prefix)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if not settings[8]:
raise FirewallError(errors.NOT_ENABLED, "masquerade")
settings[8] = False
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='b')
@dbus_handle_exceptions
def queryMasquerade(self, sender=None): # pylint: disable=W0613
log.debug1("%s.queryMasquerade()", self._log_prefix)
return self.getSettings()[8]
# forward port
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='a(ssss)')
@dbus_handle_exceptions
def getForwardPorts(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getForwardPorts()", self._log_prefix)
return self.getSettings()[9]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='a(ssss)')
@dbus_handle_exceptions
def setForwardPorts(self, ports, sender=None):
_ports = [ ]
# convert embedded lists to tuples
for port in dbus_to_python(ports, list):
if isinstance(port, list):
_ports.append(tuple(port))
else:
_ports.append(port)
ports = _ports
log.debug1("%s.setForwardPorts('[%s]')", self._log_prefix,
",".join("('%s, '%s', '%s', '%s')" % (port[0], port[1], \
port[2], port[3]) for port in ports))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[9] = ports
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='ssss')
@dbus_handle_exceptions
def addForwardPort(self, port, protocol, toport, toaddr, sender=None): # pylint: disable=R0913
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
toport = dbus_to_python(toport, str)
toaddr = dbus_to_python(toaddr, str)
log.debug1("%s.addForwardPort('%s', '%s', '%s', '%s')",
self._log_prefix, port, protocol, toport, toaddr)
self.parent.accessCheck(sender)
fwp_id = (port, protocol, str(toport), str(toaddr))
settings = list(self.getSettings())
if fwp_id in settings[9]:
raise FirewallError(errors.ALREADY_ENABLED,
"%s:%s:%s:%s" % (port, protocol, toport,
toaddr))
settings[9].append(fwp_id)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='ssss')
@dbus_handle_exceptions
def removeForwardPort(self, port, protocol, toport, toaddr, sender=None): # pylint: disable=R0913
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
toport = dbus_to_python(toport, str)
toaddr = dbus_to_python(toaddr, str)
log.debug1("%s.removeForwardPort('%s', '%s', '%s', '%s')",
self._log_prefix, port, protocol, toport, toaddr)
self.parent.accessCheck(sender)
fwp_id = (port, protocol, str(toport), str(toaddr))
settings = list(self.getSettings())
if fwp_id not in settings[9]:
raise FirewallError(errors.NOT_ENABLED,
"%s:%s:%s:%s" % (port, protocol, toport,
toaddr))
settings[9].remove(fwp_id)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='ssss',
out_signature='b')
@dbus_handle_exceptions
def queryForwardPort(self, port, protocol, toport, toaddr, sender=None): # pylint: disable=W0613, R0913
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
toport = dbus_to_python(toport, str)
toaddr = dbus_to_python(toaddr, str)
log.debug1("%s.queryForwardPort('%s', '%s', '%s', '%s')",
self._log_prefix, port, protocol, toport, toaddr)
fwp_id = (port, protocol, str(toport), str(toaddr))
return fwp_id in self.getSettings()[9]
# interface
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='as')
@dbus_handle_exceptions
def getInterfaces(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getInterfaces()", self._log_prefix)
return self.getSettings()[10]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='as')
@dbus_handle_exceptions
def setInterfaces(self, interfaces, sender=None):
interfaces = dbus_to_python(interfaces, list)
log.debug1("%s.setInterfaces('[%s]')", self._log_prefix,
",".join(interfaces))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[10] = interfaces
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def addInterface(self, interface, sender=None):
interface = dbus_to_python(interface, str)
log.debug1("%s.addInterface('%s')", self._log_prefix, interface)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if interface in settings[10]:
raise FirewallError(errors.ALREADY_ENABLED, interface)
settings[10].append(interface)
self.update(settings)
ifcfg_set_zone_of_interface(self.obj.name, interface)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def removeInterface(self, interface, sender=None):
interface = dbus_to_python(interface, str)
log.debug1("%s.removeInterface('%s')", self._log_prefix, interface)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if interface not in settings[10]:
raise FirewallError(errors.NOT_ENABLED, interface)
settings[10].remove(interface)
self.update(settings)
ifcfg_set_zone_of_interface("", interface)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s',
out_signature='b')
@dbus_handle_exceptions
def queryInterface(self, interface, sender=None): # pylint: disable=W0613
interface = dbus_to_python(interface, str)
log.debug1("%s.queryInterface('%s')", self._log_prefix, interface)
return interface in self.getSettings()[10]
# source
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='as')
@dbus_handle_exceptions
def getSources(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getSources()", self._log_prefix)
return self.getSettings()[11]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='as')
@dbus_handle_exceptions
def setSources(self, sources, sender=None):
sources = dbus_to_python(sources, list)
log.debug1("%s.setSources('[%s]')", self._log_prefix,
",".join(sources))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[11] = sources
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def addSource(self, source, sender=None):
source = dbus_to_python(source, str)
log.debug1("%s.addSource('%s')", self._log_prefix, source)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if source in settings[11]:
raise FirewallError(errors.ALREADY_ENABLED, source)
settings[11].append(source)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def removeSource(self, source, sender=None):
source = dbus_to_python(source, str)
log.debug1("%s.removeSource('%s')", self._log_prefix, source)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if source not in settings[11]:
raise FirewallError(errors.NOT_ENABLED, source)
settings[11].remove(source)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def querySource(self, source, sender=None): # pylint: disable=W0613
source = dbus_to_python(source, str)
log.debug1("%s.querySource('%s')", self._log_prefix, source)
return source in self.getSettings()[11]
# rich rule
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
out_signature='as')
@dbus_handle_exceptions
def getRichRules(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getRichRules()", self._log_prefix)
return self.getSettings()[12]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='as')
@dbus_handle_exceptions
def setRichRules(self, rules, sender=None):
rules = dbus_to_python(rules, list)
log.debug1("%s.setRichRules('[%s]')", self._log_prefix,
",".join(rules))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
rules = [ str(Rich_Rule(rule_str=r)) for r in rules ]
settings[12] = rules
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def addRichRule(self, rule, sender=None):
rule = dbus_to_python(rule, str)
log.debug1("%s.addRichRule('%s')", self._log_prefix, rule)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
rule_str = str(Rich_Rule(rule_str=rule))
if rule_str in settings[12]:
raise FirewallError(errors.ALREADY_ENABLED, rule)
settings[12].append(rule_str)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s')
@dbus_handle_exceptions
def removeRichRule(self, rule, sender=None):
rule = dbus_to_python(rule, str)
log.debug1("%s.removeRichRule('%s')", self._log_prefix, rule)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
rule_str = str(Rich_Rule(rule_str=rule))
if rule_str not in settings[12]:
raise FirewallError(errors.NOT_ENABLED, rule)
settings[12].remove(rule_str)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryRichRule(self, rule, sender=None): # pylint: disable=W0613
rule = dbus_to_python(rule, str)
log.debug1("%s.queryRichRule('%s')", self._log_prefix, rule)
rule_str = str(Rich_Rule(rule_str=rule))
return rule_str in self.getSettings()[12]
server/__init__.py 0000644 00000000000 15035135171 0010152 0 ustar 00 server/firewalld.py 0000644 00000340142 15035135171 0010402 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
__all__ = [ "FirewallD" ]
from gi.repository import GLib, GObject
# force use of pygobject3 in python-slip
import sys
sys.modules['gobject'] = GObject
import copy
import dbus
import dbus.service
import slip.dbus
import slip.dbus.service
from firewall import config
from firewall.core.fw import Firewall
from firewall.core.rich import Rich_Rule
from firewall.core.logger import log
from firewall.client import FirewallClientZoneSettings
from firewall.server.decorators import dbus_handle_exceptions, \
dbus_service_method, \
handle_exceptions, \
FirewallDBusException
from firewall.server.config import FirewallDConfig
from firewall.dbus_utils import dbus_to_python, \
command_of_sender, context_of_sender, uid_of_sender, user_of_uid, \
dbus_introspection_prepare_properties, \
dbus_introspection_add_properties
from firewall.core.io.functions import check_config
from firewall.core.io.ipset import IPSet
from firewall.core.io.icmptype import IcmpType
from firewall.core.io.helper import Helper
from firewall.core.fw_nm import nm_get_bus_name, nm_get_connection_of_interface, \
nm_set_zone_of_connection
from firewall.core.fw_ifcfg import ifcfg_set_zone_of_interface
from firewall import errors
from firewall.errors import FirewallError
############################################################################
#
# class FirewallD
#
############################################################################
class FirewallD(slip.dbus.service.Object):
"""FirewallD main class"""
persistent = True
""" Make FirewallD persistent. """
default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG
""" Use config.dbus.PK_ACTION_CONFIG as a default """
@handle_exceptions
def __init__(self, *args, **kwargs):
super(FirewallD, self).__init__(*args, **kwargs)
self.fw = Firewall()
self.busname = args[0]
self.path = args[1]
self.start()
dbus_introspection_prepare_properties(self, config.dbus.DBUS_INTERFACE)
self.config = FirewallDConfig(self.fw.config, self.busname,
config.dbus.DBUS_PATH_CONFIG)
def __del__(self):
self.stop()
@handle_exceptions
def start(self):
# tests if iptables and ip6tables are usable using test functions
# loads default firewall rules for iptables and ip6tables
log.debug1("start()")
self._timeouts = { }
return self.fw.start()
@handle_exceptions
def stop(self):
# stops firewall: unloads firewall modules, flushes chains and tables,
# resets policies
log.debug1("stop()")
return self.fw.stop()
# lockdown functions
@dbus_handle_exceptions
def accessCheck(self, sender):
if self.fw.policies.query_lockdown():
if sender is None:
log.error("Lockdown not possible, sender not set.")
return
bus = dbus.SystemBus()
context = context_of_sender(bus, sender)
if self.fw.policies.access_check("context", context):
return
uid = uid_of_sender(bus, sender)
if self.fw.policies.access_check("uid", uid):
return
user = user_of_uid(uid)
if self.fw.policies.access_check("user", user):
return
command = command_of_sender(bus, sender)
if self.fw.policies.access_check("command", command):
return
raise FirewallError(errors.ACCESS_DENIED, "lockdown is enabled")
# timeout functions
@dbus_handle_exceptions
def addTimeout(self, zone, x, tag):
if zone not in self._timeouts:
self._timeouts[zone] = { }
self._timeouts[zone][x] = tag
@dbus_handle_exceptions
def removeTimeout(self, zone, x):
if zone in self._timeouts and x in self._timeouts[zone]:
GLib.source_remove(self._timeouts[zone][x])
del self._timeouts[zone][x]
@dbus_handle_exceptions
def cleanup_timeouts(self):
# cleanup timeouts
for zone in self._timeouts:
for x in self._timeouts[zone]:
GLib.source_remove(self._timeouts[zone][x])
self._timeouts[zone].clear()
self._timeouts.clear()
# property handling
@dbus_handle_exceptions
def _get_property(self, prop):
if prop == "version":
return dbus.String(config.VERSION)
elif prop == "interface_version":
return dbus.String("%d.%d" % (config.dbus.DBUS_INTERFACE_VERSION,
config.dbus.DBUS_INTERFACE_REVISION))
elif prop == "state":
return dbus.String(self.fw.get_state())
elif prop == "IPv4":
return dbus.Boolean(self.fw.is_ipv_enabled("ipv4"))
elif prop == "IPv4ICMPTypes":
return dbus.Array(self.fw.ipv4_supported_icmp_types, "s")
elif prop == "IPv6":
return dbus.Boolean(self.fw.is_ipv_enabled("ipv6"))
elif prop == "IPv6_rpfilter":
return dbus.Boolean(self.fw.ipv6_rpfilter_enabled)
elif prop == "IPv6ICMPTypes":
return dbus.Array(self.fw.ipv6_supported_icmp_types, "s")
elif prop == "BRIDGE":
return dbus.Boolean(self.fw.ebtables_enabled)
elif prop == "IPSet":
return dbus.Boolean(self.fw.ipset_enabled)
elif prop == "IPSetTypes":
return dbus.Array(self.fw.ipset_supported_types, "s")
elif prop == "nf_conntrack_helper_setting":
return dbus.Boolean(False)
elif prop == "nf_conntrack_helpers":
return dbus.Dictionary({}, "sas")
elif prop == "nf_nat_helpers":
return dbus.Dictionary({}, "sas")
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % prop)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss',
out_signature='v')
@dbus_handle_exceptions
def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613
# get a property
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
log.debug1("Get('%s', '%s')", interface_name, property_name)
if interface_name == config.dbus.DBUS_INTERFACE:
return self._get_property(property_name)
elif interface_name in [ config.dbus.DBUS_INTERFACE_ZONE,
config.dbus.DBUS_INTERFACE_DIRECT,
config.dbus.DBUS_INTERFACE_POLICIES,
config.dbus.DBUS_INTERFACE_IPSET ]:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s',
out_signature='a{sv}')
@dbus_handle_exceptions
def GetAll(self, interface_name, sender=None): # pylint: disable=W0613
interface_name = dbus_to_python(interface_name, str)
log.debug1("GetAll('%s')", interface_name)
ret = { }
if interface_name == config.dbus.DBUS_INTERFACE:
for x in [ "version", "interface_version", "state",
"IPv4", "IPv6", "IPv6_rpfilter", "BRIDGE",
"IPSet", "IPSetTypes", "nf_conntrack_helper_setting",
"nf_conntrack_helpers", "nf_nat_helpers",
"IPv4ICMPTypes", "IPv6ICMPTypes" ]:
ret[x] = self._get_property(x)
elif interface_name in [ config.dbus.DBUS_INTERFACE_ZONE,
config.dbus.DBUS_INTERFACE_DIRECT,
config.dbus.DBUS_INTERFACE_POLICIES,
config.dbus.DBUS_INTERFACE_IPSET ]:
pass
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
return dbus.Dictionary(ret, signature="sv")
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv')
@dbus_handle_exceptions
def Set(self, interface_name, property_name, new_value, sender=None):
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
new_value = dbus_to_python(new_value)
log.debug1("Set('%s', '%s', '%s')", interface_name, property_name,
new_value)
self.accessCheck(sender)
if interface_name == config.dbus.DBUS_INTERFACE:
if property_name in [ "version", "interface_version", "state",
"IPv4", "IPv6", "IPv6_rpfilter", "BRIDGE",
"IPSet", "IPSetTypes",
"nf_conntrack_helper_setting",
"nf_conntrack_helpers", "nf_nat_helpers",
"IPv4ICMPTypes", "IPv6ICMPTypes" ]:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.PropertyReadOnly: "
"Property '%s' is read-only" % property_name)
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
elif interface_name in [ config.dbus.DBUS_INTERFACE_ZONE,
config.dbus.DBUS_INTERFACE_DIRECT,
config.dbus.DBUS_INTERFACE_POLICIES,
config.dbus.DBUS_INTERFACE_IPSET ]:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as')
def PropertiesChanged(self, interface_name, changed_properties,
invalidated_properties):
interface_name = dbus_to_python(interface_name, str)
changed_properties = dbus_to_python(changed_properties)
invalidated_properties = dbus_to_python(invalidated_properties)
log.debug1("PropertiesChanged('%s', '%s', '%s')",
interface_name, changed_properties, invalidated_properties)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s')
@dbus_handle_exceptions
def Introspect(self, sender=None): # pylint: disable=W0613
log.debug2("Introspect()")
data = super(FirewallD, self).Introspect(self.path,
self.busname.get_bus())
return dbus_introspection_add_properties(self, data,
config.dbus.DBUS_INTERFACE)
# reload
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='')
@dbus_handle_exceptions
def reload(self, sender=None): # pylint: disable=W0613
"""Reload the firewall rules.
"""
log.debug1("reload()")
self.fw.reload()
self.config.reload()
self.Reloaded()
# complete_reload
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='')
@dbus_handle_exceptions
def completeReload(self, sender=None): # pylint: disable=W0613
"""Completely reload the firewall.
Completely reload the firewall: Stops firewall, unloads modules and
starts the firewall again.
"""
log.debug1("completeReload()")
self.fw.reload(True)
self.config.reload()
self.Reloaded()
@dbus.service.signal(config.dbus.DBUS_INTERFACE)
@dbus_handle_exceptions
def Reloaded(self):
log.debug1("Reloaded()")
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='')
@dbus_handle_exceptions
def checkPermanentConfig(self, sender=None): # pylint: disable=W0613
"""Check permanent configuration
"""
log.debug1("checkPermanentConfig()")
check_config(self.fw)
# runtime to permanent
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='')
@dbus_handle_exceptions
def runtimeToPermanent(self, sender=None): # pylint: disable=W0613
"""Make runtime configuration permanent
"""
log.debug1("copyRuntimeToPermanent()")
error = False
# Services or icmptypes can not be modified in runtime, but they can
# be removed or modified in permanent environment. Therefore copying
# of services and icmptypes to permanent is also needed.
# services
config_names = self.config.getServiceNames()
for name in self.fw.service.get_services():
conf = self.getServiceSettings(name)
try:
if name in config_names:
conf_obj = self.config.getServiceByName(name)
if conf_obj.getSettings() != conf:
log.debug1("Copying service '%s' settings" % name)
conf_obj.update(conf)
else:
log.debug1("Service '%s' is identical, ignoring." % name)
else:
log.debug1("Creating service '%s'" % name)
self.config.addService(name, conf)
except Exception as e:
log.warning(
"Runtime To Permanent failed on service '%s': %s" % \
(name, e))
error = True
# icmptypes
config_names = self.config.getIcmpTypeNames()
for name in self.fw.icmptype.get_icmptypes():
conf = self.getIcmpTypeSettings(name)
try:
if name in config_names:
conf_obj = self.config.getIcmpTypeByName(name)
if conf_obj.getSettings() != conf:
log.debug1("Copying icmptype '%s' settings" % name)
conf_obj.update(conf)
else:
log.debug1("IcmpType '%s' is identical, ignoring." % name)
else:
log.debug1("Creating icmptype '%s'" % name)
self.config.addIcmpType(name, conf)
except Exception as e:
log.warning(
"Runtime To Permanent failed on icmptype '%s': %s" % \
(name, e))
error = True
# ipsets
config_names = self.config.getIPSetNames()
for name in self.fw.ipset.get_ipsets():
try:
conf = self.getIPSetSettings(name)
if name in config_names:
conf_obj = self.config.getIPSetByName(name)
if conf_obj.getSettings() != conf:
log.debug1("Copying ipset '%s' settings" % name)
conf_obj.update(conf)
else:
log.debug1("IPSet '%s' is identical, ignoring." % name)
else:
log.debug1("Creating ipset '%s'" % name)
self.config.addIPSet(name, conf)
except Exception as e:
log.warning(
"Runtime To Permanent failed on ipset '%s': %s" % \
(name, e))
error = True
# zones
config_names = self.config.getZoneNames()
nm_bus_name = nm_get_bus_name()
for name in self.fw.zone.get_zones():
conf = self.getZoneSettings2(name)
settings = FirewallClientZoneSettings(conf)
if nm_bus_name is not None:
changed = False
for interface in settings.getInterfaces():
if self.fw.zone.interface_get_sender(name, interface) == nm_bus_name:
log.debug1("Zone '%s': interface binding for '%s' has been added by NM, ignoring." % (name, interface))
settings.removeInterface(interface)
changed = True
# For the remaining interfaces, attempt to let NM manage them
for interface in settings.getInterfaces():
try:
connection = nm_get_connection_of_interface(interface)
if connection and nm_set_zone_of_connection(name, connection):
settings.removeInterface(interface)
changed = True
except Exception:
pass
if changed:
del conf
conf = settings.getSettingsDict()
# For the remaining try to update the ifcfg files
for interface in settings.getInterfaces():
ifcfg_set_zone_of_interface(name, interface)
try:
if name in config_names:
conf_obj = self.config.getZoneByName(name)
log.debug1("Copying zone '%s' settings" % name)
conf_obj.update2(conf)
else:
log.debug1("Creating zone '%s'" % name)
self.config.addZone2(name, conf)
except Exception as e:
log.warning(
"Runtime To Permanent failed on zone '%s': %s" % \
(name, e))
error = True
# policies
config_names = self.config.getPolicyNames()
for name in self.fw.policy.get_policies_not_derived_from_zone():
conf = self.getPolicySettings(name)
try:
if name in config_names:
conf_obj = self.config.getPolicyByName(name)
conf_obj.update(conf)
else:
log.debug1("Creating policy '%s'" % name)
self.config.addPolicy(name, conf)
except Exception as e:
log.warning(
"Runtime To Permanent failed on policy '%s': %s" % \
(name, e))
error = True
# helpers
config_names = self.config.getHelperNames()
for name in self.fw.helper.get_helpers():
conf = self.getHelperSettings(name)
try:
if name in config_names:
conf_obj = self.config.getHelperByName(name)
if conf_obj.getSettings() != conf:
log.debug1("Copying helper '%s' settings" % name)
conf_obj.update(conf)
else:
log.debug1("Helper '%s' is identical, ignoring." % name)
else:
log.debug1("Creating helper '%s'" % name)
self.config.addHelper(name, conf)
except Exception as e:
log.warning(
"Runtime To Permanent failed on helper '%s': %s" % \
(name, e))
error = True
# direct
# rt_config = self.fw.direct.get_config()
conf = ( self.fw.direct.get_all_chains(),
self.fw.direct.get_all_rules(),
self.fw.direct.get_all_passthroughs() )
try:
if self.config.getSettings() != conf:
log.debug1("Copying direct configuration")
self.config.update(conf)
else:
log.debug1("Direct configuration is identical, ignoring.")
except Exception as e:
log.warning(
"Runtime To Permanent failed on direct configuration: %s" % e)
error = True
# policies
conf = self.fw.policies.lockdown_whitelist.export_config()
try:
if self.config.getSettings() != conf:
log.debug1("Copying policies configuration")
self.config.setLockdownWhitelist(conf)
else:
log.debug1("Policies configuration is identical, ignoring.")
except Exception as e:
log.warning(
"Runtime To Permanent failed on policies configuration: %s" % \
e)
error = True
if error:
raise FirewallError(errors.RT_TO_PERM_FAILED)
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# POLICIES
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# lockdown
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='',
out_signature='')
@dbus_handle_exceptions
def enableLockdown(self, sender=None):
"""Enable lockdown policies
"""
log.debug1("policies.enableLockdown()")
self.accessCheck(sender)
self.fw.policies.enable_lockdown()
self.LockdownEnabled()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='',
out_signature='')
@dbus_handle_exceptions
def disableLockdown(self, sender=None):
"""Disable lockdown policies
"""
log.debug1("policies.disableLockdown()")
self.accessCheck(sender)
self.fw.policies.disable_lockdown()
self.LockdownDisabled()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='',
out_signature='b')
@dbus_handle_exceptions
def queryLockdown(self, sender=None): # pylint: disable=W0613
"""Retuns True if lockdown is enabled
"""
log.debug1("policies.queryLockdown()")
# no access check here
return self.fw.policies.query_lockdown()
@dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='')
@dbus_handle_exceptions
def LockdownEnabled(self):
log.debug1("LockdownEnabled()")
@dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='')
@dbus_handle_exceptions
def LockdownDisabled(self):
log.debug1("LockdownDisabled()")
# lockdown whitelist
# command
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s',
out_signature='')
@dbus_handle_exceptions
def addLockdownWhitelistCommand(self, command, sender=None):
"""Add lockdown command
"""
command = dbus_to_python(command, str)
log.debug1("policies.addLockdownWhitelistCommand('%s')" % command)
self.accessCheck(sender)
self.fw.policies.lockdown_whitelist.add_command(command)
self.LockdownWhitelistCommandAdded(command)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s',
out_signature='')
@dbus_handle_exceptions
def removeLockdownWhitelistCommand(self, command, sender=None):
"""Remove lockdown command
"""
command = dbus_to_python(command, str)
log.debug1("policies.removeLockdownWhitelistCommand('%s')" % command)
self.accessCheck(sender)
self.fw.policies.lockdown_whitelist.remove_command(command)
self.LockdownWhitelistCommandRemoved(command)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s',
out_signature='b')
@dbus_handle_exceptions
def queryLockdownWhitelistCommand(self, command, sender=None): # pylint: disable=W0613
"""Query lockdown command
"""
command = dbus_to_python(command, str)
log.debug1("policies.queryLockdownWhitelistCommand('%s')" % command)
# no access check here
return self.fw.policies.lockdown_whitelist.has_command(command)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='',
out_signature='as')
@dbus_handle_exceptions
def getLockdownWhitelistCommands(self, sender=None): # pylint: disable=W0613
"""Add lockdown command
"""
log.debug1("policies.getLockdownWhitelistCommands()")
# no access check here
return self.fw.policies.lockdown_whitelist.get_commands()
@dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s')
@dbus_handle_exceptions
def LockdownWhitelistCommandAdded(self, command):
log.debug1("LockdownWhitelistCommandAdded('%s')" % command)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s')
@dbus_handle_exceptions
def LockdownWhitelistCommandRemoved(self, command):
log.debug1("LockdownWhitelistCommandRemoved('%s')" % command)
# uid
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='i',
out_signature='')
@dbus_handle_exceptions
def addLockdownWhitelistUid(self, uid, sender=None):
"""Add lockdown uid
"""
uid = dbus_to_python(uid, int)
log.debug1("policies.addLockdownWhitelistUid('%s')" % uid)
self.accessCheck(sender)
self.fw.policies.lockdown_whitelist.add_uid(uid)
self.LockdownWhitelistUidAdded(uid)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='i',
out_signature='')
@dbus_handle_exceptions
def removeLockdownWhitelistUid(self, uid, sender=None):
"""Remove lockdown uid
"""
uid = dbus_to_python(uid, int)
log.debug1("policies.removeLockdownWhitelistUid('%s')" % uid)
self.accessCheck(sender)
self.fw.policies.lockdown_whitelist.remove_uid(uid)
self.LockdownWhitelistUidRemoved(uid)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='i',
out_signature='b')
@dbus_handle_exceptions
def queryLockdownWhitelistUid(self, uid, sender=None): # pylint: disable=W0613
"""Query lockdown uid
"""
uid = dbus_to_python(uid, int)
log.debug1("policies.queryLockdownWhitelistUid('%s')" % uid)
# no access check here
return self.fw.policies.lockdown_whitelist.has_uid(uid)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='',
out_signature='ai')
@dbus_handle_exceptions
def getLockdownWhitelistUids(self, sender=None): # pylint: disable=W0613
"""Add lockdown uid
"""
log.debug1("policies.getLockdownWhitelistUids()")
# no access check here
return self.fw.policies.lockdown_whitelist.get_uids()
@dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='i')
@dbus_handle_exceptions
def LockdownWhitelistUidAdded(self, uid):
log.debug1("LockdownWhitelistUidAdded(%d)" % uid)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='i')
@dbus_handle_exceptions
def LockdownWhitelistUidRemoved(self, uid):
log.debug1("LockdownWhitelistUidRemoved(%d)" % uid)
# user
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s',
out_signature='')
@dbus_handle_exceptions
def addLockdownWhitelistUser(self, user, sender=None):
"""Add lockdown user
"""
user = dbus_to_python(user, str)
log.debug1("policies.addLockdownWhitelistUser('%s')" % user)
self.accessCheck(sender)
self.fw.policies.lockdown_whitelist.add_user(user)
self.LockdownWhitelistUserAdded(user)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s',
out_signature='')
@dbus_handle_exceptions
def removeLockdownWhitelistUser(self, user, sender=None):
"""Remove lockdown user
"""
user = dbus_to_python(user, str)
log.debug1("policies.removeLockdownWhitelistUser('%s')" % user)
self.accessCheck(sender)
self.fw.policies.lockdown_whitelist.remove_user(user)
self.LockdownWhitelistUserRemoved(user)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s',
out_signature='b')
@dbus_handle_exceptions
def queryLockdownWhitelistUser(self, user, sender=None): # pylint: disable=W0613
"""Query lockdown user
"""
user = dbus_to_python(user, str)
log.debug1("policies.queryLockdownWhitelistUser('%s')" % user)
# no access check here
return self.fw.policies.lockdown_whitelist.has_user(user)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='',
out_signature='as')
@dbus_handle_exceptions
def getLockdownWhitelistUsers(self, sender=None): # pylint: disable=W0613
"""Add lockdown user
"""
log.debug1("policies.getLockdownWhitelistUsers()")
# no access check here
return self.fw.policies.lockdown_whitelist.get_users()
@dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s')
@dbus_handle_exceptions
def LockdownWhitelistUserAdded(self, user):
log.debug1("LockdownWhitelistUserAdded('%s')" % user)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s')
@dbus_handle_exceptions
def LockdownWhitelistUserRemoved(self, user):
log.debug1("LockdownWhitelistUserRemoved('%s')" % user)
# context
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s',
out_signature='')
@dbus_handle_exceptions
def addLockdownWhitelistContext(self, context, sender=None):
"""Add lockdown context
"""
context = dbus_to_python(context, str)
log.debug1("policies.addLockdownWhitelistContext('%s')" % context)
self.accessCheck(sender)
self.fw.policies.lockdown_whitelist.add_context(context)
self.LockdownWhitelistContextAdded(context)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s',
out_signature='')
@dbus_handle_exceptions
def removeLockdownWhitelistContext(self, context, sender=None):
"""Remove lockdown context
"""
context = dbus_to_python(context, str)
log.debug1("policies.removeLockdownWhitelistContext('%s')" % context)
self.accessCheck(sender)
self.fw.policies.lockdown_whitelist.remove_context(context)
self.LockdownWhitelistContextRemoved(context)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s',
out_signature='b')
@dbus_handle_exceptions
def queryLockdownWhitelistContext(self, context, sender=None): # pylint: disable=W0613
"""Query lockdown context
"""
context = dbus_to_python(context, str)
log.debug1("policies.queryLockdownWhitelistContext('%s')" % context)
# no access check here
return self.fw.policies.lockdown_whitelist.has_context(context)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_POLICIES_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='',
out_signature='as')
@dbus_handle_exceptions
def getLockdownWhitelistContexts(self, sender=None): # pylint: disable=W0613
"""Add lockdown context
"""
log.debug1("policies.getLockdownWhitelistContexts()")
# no access check here
return self.fw.policies.lockdown_whitelist.get_contexts()
@dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s')
@dbus_handle_exceptions
def LockdownWhitelistContextAdded(self, context):
log.debug1("LockdownWhitelistContextAdded('%s')" % context)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s')
@dbus_handle_exceptions
def LockdownWhitelistContextRemoved(self, context):
log.debug1("LockdownWhitelistContextRemoved('%s')" % context)
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# PANIC
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='')
@dbus_handle_exceptions
def enablePanicMode(self, sender=None):
"""Enable panic mode.
All ingoing and outgoing connections and packets will be blocked.
"""
log.debug1("enablePanicMode()")
self.accessCheck(sender)
self.fw.enable_panic_mode()
self.PanicModeEnabled()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='')
@dbus_handle_exceptions
def disablePanicMode(self, sender=None):
"""Disable panic mode.
Enables normal mode: Allowed ingoing and outgoing connections
will not be blocked anymore
"""
log.debug1("disablePanicMode()")
self.accessCheck(sender)
self.fw.disable_panic_mode()
self.PanicModeDisabled()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='b')
@dbus_handle_exceptions
def queryPanicMode(self, sender=None): # pylint: disable=W0613
# returns True if in panic mode
log.debug1("queryPanicMode()")
return self.fw.query_panic_mode()
@dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='')
@dbus_handle_exceptions
def PanicModeEnabled(self):
log.debug1("PanicModeEnabled()")
@dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='')
@dbus_handle_exceptions
def PanicModeDisabled(self):
log.debug1("PanicModeDisabled()")
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# list functions
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s',
out_signature="(sssbsasa(ss)asba(ssss)asasasasa(ss)b)")
@dbus_handle_exceptions
def getZoneSettings(self, zone, sender=None): # pylint: disable=W0613
# returns zone settings for zone
zone = dbus_to_python(zone, str)
log.debug1("getZoneSettings(%s)", zone)
return self.fw.zone.get_config_with_settings(zone)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature="a{sv}")
@dbus_handle_exceptions
def getZoneSettings2(self, zone, sender=None):
zone = dbus_to_python(zone, str)
log.debug1("getZoneSettings2(%s)", zone)
return self.fw.zone.get_config_with_settings_dict(zone)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sa{sv}')
@dbus_handle_exceptions
def setZoneSettings2(self, zone, settings, sender=None):
zone = dbus_to_python(zone, str)
log.debug1("setZoneSettings2(%s)", zone)
self.accessCheck(sender)
self.fw.zone.set_config_with_settings_dict(zone, settings, sender)
self.ZoneUpdated(zone, settings)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sa{sv}')
@dbus_handle_exceptions
def ZoneUpdated(self, zone, settings):
log.debug1("zone.ZoneUpdated('%s', '%s')" % (zone, settings))
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='s',
out_signature="a{sv}")
@dbus_handle_exceptions
def getPolicySettings(self, policy, sender=None):
policy = dbus_to_python(policy, str)
log.debug1("policy.getPolicySettings(%s)", policy)
return self.fw.policy.get_config_with_settings_dict(policy)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='sa{sv}')
@dbus_handle_exceptions
def setPolicySettings(self, policy, settings, sender=None):
policy = dbus_to_python(policy, str)
log.debug1("policy.setPolicySettings(%s)", policy)
self.accessCheck(sender)
self.fw.policy.set_config_with_settings_dict(policy, settings, sender)
self.PolicyUpdated(policy, settings)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICY, signature='sa{sv}')
@dbus_handle_exceptions
def PolicyUpdated(self, policy, settings):
log.debug1("policy.PolicyUpdated('%s', '%s')" % (policy, settings))
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='as')
@dbus_handle_exceptions
def listServices(self, sender=None): # pylint: disable=W0613
# returns the list of services
# TODO: should be renamed to getServices()
# because is called by firewall-cmd --get-services
log.debug1("listServices()")
return self.fw.service.get_services()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s',
out_signature='(sssa(ss)asa{ss}asa(ss))')
@dbus_handle_exceptions
def getServiceSettings(self, service, sender=None): # pylint: disable=W0613
# returns service settings for service
service = dbus_to_python(service, str)
log.debug1("getServiceSettings(%s)", service)
obj = self.fw.service.get_service(service)
conf_dict = obj.export_config_dict()
conf_list = []
for i in range(8): # tuple based dbus API has 8 elements
if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict:
# old API needs the empty elements as well. Grab it from the
# object otherwise we don't know the type.
conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0])))
else:
conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]])
return tuple(conf_list)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s',
out_signature='a{sv}')
@dbus_handle_exceptions
def getServiceSettings2(self, service, sender=None): # pylint: disable=W0613
service = dbus_to_python(service, str)
log.debug1("getServiceSettings2(%s)", service)
obj = self.fw.service.get_service(service)
return obj.export_config_dict()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='as')
@dbus_handle_exceptions
def listIcmpTypes(self, sender=None): # pylint: disable=W0613
# returns the list of services
# TODO: should be renamed to getIcmptypes()
# because is called by firewall-cmd --get-icmptypes
log.debug1("listIcmpTypes()")
return self.fw.icmptype.get_icmptypes()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s',
out_signature=IcmpType.DBUS_SIGNATURE)
@dbus_handle_exceptions
def getIcmpTypeSettings(self, icmptype, sender=None): # pylint: disable=W0613
# returns icmptype settings for icmptype
icmptype = dbus_to_python(icmptype, str)
log.debug1("getIcmpTypeSettings(%s)", icmptype)
return self.fw.icmptype.get_icmptype(icmptype).export_config()
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# LOG DENIED
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='s')
@dbus_handle_exceptions
def getLogDenied(self, sender=None): # pylint: disable=W0613
# returns the log denied value
log.debug1("getLogDenied()")
return self.fw.get_log_denied()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s',
out_signature='')
@dbus_handle_exceptions
def setLogDenied(self, value, sender=None):
# set the log denied value
value = dbus_to_python(value, str)
log.debug1("setLogDenied('%s')" % value)
self.accessCheck(sender)
self.fw.set_log_denied(value)
self.LogDeniedChanged(value)
# must reload the firewall as well
self.fw.reload()
self.config.reload()
self.Reloaded()
@dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='s')
@dbus_handle_exceptions
def LogDeniedChanged(self, value):
log.debug1("LogDeniedChanged('%s')" % (value))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# AUTOMATIC HELPER ASSIGNMENT
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='s')
@dbus_handle_exceptions
def getAutomaticHelpers(self, sender=None): # pylint: disable=W0613
# returns the automatic helpers value
log.debug1("getAutomaticHelpers()")
# NOTE: This feature was removed and is now a noop. We retain the dbus
# call to keep API.
return "no"
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s',
out_signature='')
@dbus_handle_exceptions
def setAutomaticHelpers(self, value, sender=None):
# set the automatic helpers value
value = dbus_to_python(value, str)
log.debug1("setAutomaticHelpers('%s')" % value)
self.accessCheck(sender)
# NOTE: This feature was removed and is now a noop. We retain the dbus
# call to keep API.
@dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='s')
@dbus_handle_exceptions
def AutomaticHelpersChanged(self, value):
log.debug1("AutomaticHelpersChanged('%s')" % (value))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# DEFAULT ZONE
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='s')
@dbus_handle_exceptions
def getDefaultZone(self, sender=None): # pylint: disable=W0613
# returns the system default zone
log.debug1("getDefaultZone()")
return self.fw.get_default_zone()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s',
out_signature='')
@dbus_handle_exceptions
def setDefaultZone(self, zone, sender=None):
# set the system default zone
zone = dbus_to_python(zone, str)
log.debug1("setDefaultZone('%s')" % zone)
self.accessCheck(sender)
self.fw.set_default_zone(zone)
self.DefaultZoneChanged(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='s')
@dbus_handle_exceptions
def DefaultZoneChanged(self, zone):
log.debug1("DefaultZoneChanged('%s')" % (zone))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# POLICY INTERFACE
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# POLICIES
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='',
out_signature='as')
@dbus_handle_exceptions
def getPolicies(self, sender=None):
log.debug1("policy.getPolicies()")
return self.fw.policy.get_policies_not_derived_from_zone()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='',
out_signature='a{sa{sas}}')
@dbus_handle_exceptions
def getActivePolicies(self, sender=None):
log.debug1("policy.getActivePolicies()")
policies = { }
for policy in self.fw.policy.get_active_policies_not_derived_from_zone():
policies[policy] = { }
policies[policy]["ingress_zones"] = self.fw.policy.list_ingress_zones(policy)
policies[policy]["egress_zones"] = self.fw.policy.list_egress_zones(policy)
return policies
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# ZONE INTERFACE
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# ZONES
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
# TODO: shouldn't this be in DBUS_INTERFACE instead of DBUS_INTERFACE_ZONE ?
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='',
out_signature='as')
@dbus_handle_exceptions
def getZones(self, sender=None): # pylint: disable=W0613
# returns the list of zones
log.debug1("zone.getZones()")
return self.fw.zone.get_zones()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='',
out_signature='a{sa{sas}}')
@dbus_handle_exceptions
def getActiveZones(self, sender=None): # pylint: disable=W0613
# returns the list of active zones
log.debug1("zone.getActiveZones()")
zones = { }
for zone in self.fw.zone.get_zones():
interfaces = self.fw.zone.list_interfaces(zone)
sources = self.fw.zone.list_sources(zone)
if len(interfaces) + len(sources) > 0:
zones[zone] = { }
if len(interfaces) > 0:
zones[zone]["interfaces"] = interfaces
if len(sources) > 0:
zones[zone]["sources"] = sources
return zones
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='s')
@dbus_handle_exceptions
def getZoneOfInterface(self, interface, sender=None): # pylint: disable=W0613
"""Return the zone an interface belongs to.
:Parameters:
`interface` : str
Name of the interface
:Returns: str. The name of the zone.
"""
interface = dbus_to_python(interface, str)
log.debug1("zone.getZoneOfInterface('%s')" % interface)
zone = self.fw.zone.get_zone_of_interface(interface)
if zone:
return zone
return ""
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='s')
@dbus_handle_exceptions
def getZoneOfSource(self, source, sender=None): # pylint: disable=W0613
#Return the zone an source belongs to.
source = dbus_to_python(source, str)
log.debug1("zone.getZoneOfSource('%s')" % source)
zone = self.fw.zone.get_zone_of_source(source)
if zone:
return zone
return ""
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='b')
@dbus_handle_exceptions
def isImmutable(self, zone, sender=None): # pylint: disable=W0613
# no immutable zones anymore
return False
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# INTERFACES
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
def addInterface(self, zone, interface, sender=None):
"""Add an interface to a zone.
If zone is empty, use default zone.
"""
zone = dbus_to_python(zone, str)
interface = dbus_to_python(interface, str)
log.debug1("zone.addInterface('%s', '%s')" % (zone, interface))
self.accessCheck(sender)
_zone = self.fw.zone.add_interface(zone, interface, sender)
self.InterfaceAdded(_zone, interface)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
def changeZone(self, zone, interface, sender=None):
"""Change a zone an interface is part of.
If zone is empty, use default zone.
This function is deprecated, use changeZoneOfInterface instead
"""
zone = dbus_to_python(zone, str)
interface = dbus_to_python(interface, str)
return self.changeZoneOfInterface(zone, interface, sender)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
def changeZoneOfInterface(self, zone, interface, sender=None):
"""Change a zone an interface is part of.
If zone is empty, use default zone.
"""
zone = dbus_to_python(zone, str)
interface = dbus_to_python(interface, str)
log.debug1("zone.changeZoneOfInterface('%s', '%s')" % (zone, interface))
self.accessCheck(sender)
_zone = self.fw.zone.change_zone_of_interface(zone, interface, sender)
self.ZoneOfInterfaceChanged(_zone, interface)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
def removeInterface(self, zone, interface, sender=None):
"""Remove interface from a zone.
If zone is empty, remove from zone the interface belongs to.
"""
zone = dbus_to_python(zone, str)
interface = dbus_to_python(interface, str)
log.debug1("zone.removeInterface('%s', '%s')" % (zone, interface))
self.accessCheck(sender)
_zone = self.fw.zone.remove_interface(zone, interface)
self.InterfaceRemoved(_zone, interface)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='b')
@dbus_handle_exceptions
def queryInterface(self, zone, interface, sender=None): # pylint: disable=W0613
"""Return true if an interface is in a zone.
If zone is empty, use default zone.
"""
zone = dbus_to_python(zone, str)
interface = dbus_to_python(interface, str)
log.debug1("zone.queryInterface('%s', '%s')" % (zone, interface))
return self.fw.zone.query_interface(zone, interface)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='as')
@dbus_handle_exceptions
def getInterfaces(self, zone, sender=None): # pylint: disable=W0613
"""Return the list of interfaces of a zone.
If zone is empty, use default zone.
"""
# TODO: should be renamed to listInterfaces()
# because is called by firewall-cmd --zone --list-interfaces
zone = dbus_to_python(zone, str)
log.debug1("zone.getInterfaces('%s')" % (zone))
return self.fw.zone.list_interfaces(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
def InterfaceAdded(self, zone, interface):
log.debug1("zone.InterfaceAdded('%s', '%s')" % (zone, interface))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
def ZoneChanged(self, zone, interface):
"""
This signal is deprecated.
"""
log.debug1("zone.ZoneChanged('%s', '%s')" % (zone, interface))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
def ZoneOfInterfaceChanged(self, zone, interface):
log.debug1("zone.ZoneOfInterfaceChanged('%s', '%s')" % (zone,
interface))
self.ZoneChanged(zone, interface)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
def InterfaceRemoved(self, zone, interface):
log.debug1("zone.InterfaceRemoved('%s', '%s')" % (zone, interface))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# SOURCES
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
def addSource(self, zone, source, sender=None):
"""Add a source to a zone.
If zone is empty, use default zone.
"""
zone = dbus_to_python(zone, str)
source = dbus_to_python(source, str)
log.debug1("zone.addSource('%s', '%s')" % (zone, source))
self.accessCheck(sender)
_zone = self.fw.zone.add_source(zone, source, sender)
self.SourceAdded(_zone, source)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
def changeZoneOfSource(self, zone, source, sender=None):
"""Change a zone an source is part of.
If zone is empty, use default zone.
"""
zone = dbus_to_python(zone, str)
source = dbus_to_python(source, str)
log.debug1("zone.changeZoneOfSource('%s', '%s')" % (zone, source))
self.accessCheck(sender)
_zone = self.fw.zone.change_zone_of_source(zone, source, sender)
self.ZoneOfSourceChanged(_zone, source)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
def removeSource(self, zone, source, sender=None):
"""Remove source from a zone.
If zone is empty, remove from zone the source belongs to.
"""
zone = dbus_to_python(zone, str)
source = dbus_to_python(source, str)
log.debug1("zone.removeSource('%s', '%s')" % (zone, source))
self.accessCheck(sender)
_zone = self.fw.zone.remove_source(zone, source)
self.SourceRemoved(_zone, source)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='b')
@dbus_handle_exceptions
def querySource(self, zone, source, sender=None): # pylint: disable=W0613
"""Return true if an source is in a zone.
If zone is empty, use default zone.
"""
zone = dbus_to_python(zone, str)
source = dbus_to_python(source, str)
log.debug1("zone.querySource('%s', '%s')" % (zone, source))
return self.fw.zone.query_source(zone, source)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='as')
@dbus_handle_exceptions
def getSources(self, zone, sender=None): # pylint: disable=W0613
"""Return the list of sources of a zone.
If zone is empty, use default zone.
"""
# TODO: should be renamed to listSources()
# because is called by firewall-cmd --zone --list-sources
zone = dbus_to_python(zone, str)
log.debug1("zone.getSources('%s')" % (zone))
return self.fw.zone.list_sources(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
def SourceAdded(self, zone, source):
log.debug1("zone.SourceAdded('%s', '%s')" % (zone, source))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
def ZoneOfSourceChanged(self, zone, source):
log.debug1("zone.ZoneOfSourceChanged('%s', '%s')" % (zone, source))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
def SourceRemoved(self, zone, source):
log.debug1("zone.SourceRemoved('%s', '%s')" % (zone, source))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# RICH RULES
@dbus_handle_exceptions
def disableTimedRichRule(self, zone, rule):
log.debug1("zone.disableTimedRichRule('%s', '%s')" % (zone, rule))
del self._timeouts[zone][rule]
obj = Rich_Rule(rule_str=rule)
self.fw.zone.remove_rule(zone, obj)
self.RichRuleRemoved(zone, rule)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi',
out_signature='s')
@dbus_handle_exceptions
def addRichRule(self, zone, rule, timeout, sender=None): # pylint: disable=W0613
zone = dbus_to_python(zone, str)
rule = dbus_to_python(rule, str)
timeout = dbus_to_python(timeout, int)
log.debug1("zone.addRichRule('%s', '%s')" % (zone, rule))
obj = Rich_Rule(rule_str=rule)
_zone = self.fw.zone.add_rule(zone, obj, timeout)
if timeout > 0:
tag = GLib.timeout_add_seconds(timeout, self.disableTimedRichRule,
_zone, rule)
self.addTimeout(_zone, rule, tag)
self.RichRuleAdded(_zone, rule, timeout)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
def removeRichRule(self, zone, rule, sender=None): # pylint: disable=W0613
zone = dbus_to_python(zone, str)
rule = dbus_to_python(rule, str)
log.debug1("zone.removeRichRule('%s', '%s')" % (zone, rule))
obj = Rich_Rule(rule_str=rule)
_zone = self.fw.zone.remove_rule(zone, obj)
self.removeTimeout(_zone, rule)
self.RichRuleRemoved(_zone, rule)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='b')
@dbus_handle_exceptions
def queryRichRule(self, zone, rule, sender=None): # pylint: disable=W0613
zone = dbus_to_python(zone, str)
rule = dbus_to_python(rule, str)
log.debug1("zone.queryRichRule('%s', '%s')" % (zone, rule))
obj = Rich_Rule(rule_str=rule)
return self.fw.zone.query_rule(zone, obj)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='as')
@dbus_handle_exceptions
def getRichRules(self, zone, sender=None): # pylint: disable=W0613
# returns the list of enabled rich rules for zone
# TODO: should be renamed to listRichRules()
# because is called by firewall-cmd --zone --list-rich-rules
zone = dbus_to_python(zone, str)
log.debug1("zone.getRichRules('%s')" % (zone))
return self.fw.zone.list_rules(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi')
@dbus_handle_exceptions
def RichRuleAdded(self, zone, rule, timeout):
log.debug1("zone.RichRuleAdded('%s', '%s', %d)" % (zone, rule, timeout))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
def RichRuleRemoved(self, zone, rule):
log.debug1("zone.RichRuleRemoved('%s', '%s')" % (zone, rule))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# SERVICES
@dbus_handle_exceptions
def disableTimedService(self, zone, service):
log.debug1("zone.disableTimedService('%s', '%s')" % (zone, service))
del self._timeouts[zone][service]
self.fw.zone.remove_service(zone, service)
self.ServiceRemoved(zone, service)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi',
out_signature='s')
@dbus_handle_exceptions
def addService(self, zone, service, timeout, sender=None):
# enables service <service> if not enabled already for zone
zone = dbus_to_python(zone, str)
service = dbus_to_python(service, str)
timeout = dbus_to_python(timeout, int)
log.debug1("zone.addService('%s', '%s', %d)" % (zone, service, timeout))
self.accessCheck(sender)
_zone = self.fw.zone.add_service(zone, service, timeout, sender)
if timeout > 0:
tag = GLib.timeout_add_seconds(timeout, self.disableTimedService,
_zone, service)
self.addTimeout(_zone, service, tag)
self.ServiceAdded(_zone, service, timeout)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
def removeService(self, zone, service, sender=None):
# disables service for zone
zone = dbus_to_python(zone, str)
service = dbus_to_python(service, str)
log.debug1("zone.removeService('%s', '%s')" % (zone, service))
self.accessCheck(sender)
_zone = self.fw.zone.remove_service(zone, service)
self.removeTimeout(_zone, service)
self.ServiceRemoved(_zone, service)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='b')
@dbus_handle_exceptions
def queryService(self, zone, service, sender=None): # pylint: disable=W0613
# returns true if a service is enabled for zone
zone = dbus_to_python(zone, str)
service = dbus_to_python(service, str)
log.debug1("zone.queryService('%s', '%s')" % (zone, service))
return self.fw.zone.query_service(zone, service)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='as')
@dbus_handle_exceptions
def getServices(self, zone, sender=None): # pylint: disable=W0613
# returns the list of enabled services for zone
# TODO: should be renamed to listServices()
# because is called by firewall-cmd --zone --list-services
zone = dbus_to_python(zone, str)
log.debug1("zone.getServices('%s')" % (zone))
return self.fw.zone.list_services(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi')
@dbus_handle_exceptions
def ServiceAdded(self, zone, service, timeout):
log.debug1("zone.ServiceAdded('%s', '%s', %d)" % \
(zone, service, timeout))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
def ServiceRemoved(self, zone, service):
log.debug1("zone.ServiceRemoved('%s', '%s')" % (zone, service))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# PORTS
@dbus_handle_exceptions
def disableTimedPort(self, zone, port, protocol):
log.debug1("zone.disableTimedPort('%s', '%s', '%s')" % \
(zone, port, protocol))
del self._timeouts[zone][(port, protocol)]
self.fw.zone.remove_port(zone, port, protocol)
self.PortRemoved(zone, port, protocol)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssi',
out_signature='s')
@dbus_handle_exceptions
def addPort(self, zone, port, protocol, timeout, sender=None): # pylint: disable=R0913
# adds port <port> <protocol> if not enabled already to zone
zone = dbus_to_python(zone, str)
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
timeout = dbus_to_python(timeout, int)
log.debug1("zone.addPort('%s', '%s', '%s')" % \
(zone, port, protocol))
self.accessCheck(sender)
_zone = self.fw.zone.add_port(zone, port, protocol, timeout, sender)
if timeout > 0:
tag = GLib.timeout_add_seconds(timeout, self.disableTimedPort,
_zone, port, protocol)
self.addTimeout(_zone, (port, protocol), tag)
self.PortAdded(_zone, port, protocol, timeout)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss',
out_signature='s')
@dbus_handle_exceptions
def removePort(self, zone, port, protocol, sender=None): # pylint: disable=R0913
# removes port<port> <protocol> if enabled from zone
zone = dbus_to_python(zone, str)
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("zone.removePort('%s', '%s', '%s')" % \
(zone, port, protocol))
self.accessCheck(sender)
_zone= self.fw.zone.remove_port(zone, port, protocol)
self.removeTimeout(_zone, (port, protocol))
self.PortRemoved(_zone, port, protocol)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss',
out_signature='b')
@dbus_handle_exceptions
def queryPort(self, zone, port, protocol, sender=None): # pylint: disable=W0613, R0913
# returns true if a port is enabled for zone
zone = dbus_to_python(zone, str)
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("zone.queryPort('%s', '%s', '%s')" % (zone, port, protocol))
return self.fw.zone.query_port(zone, port, protocol)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='aas')
@dbus_handle_exceptions
def getPorts(self, zone, sender=None): # pylint: disable=W0613
# returns the list of enabled ports
# TODO: should be renamed to listPorts()
# because is called by firewall-cmd --zone --list-ports
zone = dbus_to_python(zone, str)
log.debug1("zone.getPorts('%s')" % (zone))
return self.fw.zone.list_ports(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssi')
@dbus_handle_exceptions
def PortAdded(self, zone, port, protocol, timeout=0):
log.debug1("zone.PortAdded('%s', '%s', '%s', %d)" % \
(zone, port, protocol, timeout))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sss')
@dbus_handle_exceptions
def PortRemoved(self, zone, port, protocol):
log.debug1("zone.PortRemoved('%s', '%s', '%s')" % \
(zone, port, protocol))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# PROTOCOLS
@dbus_handle_exceptions
def disableTimedProtocol(self, zone, protocol):
log.debug1("zone.disableTimedProtocol('%s', '%s')" % (zone, protocol))
del self._timeouts[zone][(protocol)]
self.fw.zone.remove_protocol(zone, protocol)
self.ProtocolRemoved(zone, protocol)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi',
out_signature='s')
@dbus_handle_exceptions
def addProtocol(self, zone, protocol, timeout, sender=None):
# adds protocol <protocol> if not enabled already to zone
zone = dbus_to_python(zone, str)
protocol = dbus_to_python(protocol, str)
timeout = dbus_to_python(timeout, int)
log.debug1("zone.enableProtocol('%s', '%s')" % (zone, protocol))
self.accessCheck(sender)
_zone = self.fw.zone.add_protocol(zone, protocol, timeout, sender)
if timeout > 0:
tag = GLib.timeout_add_seconds(timeout, self.disableTimedProtocol,
_zone, protocol)
self.addTimeout(_zone, protocol, tag)
self.ProtocolAdded(_zone, protocol, timeout)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
def removeProtocol(self, zone, protocol, sender=None):
# removes protocol<protocol> if enabled from zone
zone = dbus_to_python(zone, str)
protocol = dbus_to_python(protocol, str)
log.debug1("zone.removeProtocol('%s', '%s')" % (zone, protocol))
self.accessCheck(sender)
_zone= self.fw.zone.remove_protocol(zone, protocol)
self.removeTimeout(_zone, protocol)
self.ProtocolRemoved(_zone, protocol)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='b')
@dbus_handle_exceptions
def queryProtocol(self, zone, protocol, sender=None): # pylint: disable=W0613
# returns true if a protocol is enabled for zone
zone = dbus_to_python(zone, str)
protocol = dbus_to_python(protocol, str)
log.debug1("zone.queryProtocol('%s', '%s')" % (zone, protocol))
return self.fw.zone.query_protocol(zone, protocol)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='as')
@dbus_handle_exceptions
def getProtocols(self, zone, sender=None): # pylint: disable=W0613
# returns the list of enabled protocols
# TODO: should be renamed to listProtocols()
# because is called by firewall-cmd --zone --list-protocols
zone = dbus_to_python(zone, str)
log.debug1("zone.getProtocols('%s')" % (zone))
return self.fw.zone.list_protocols(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi')
@dbus_handle_exceptions
def ProtocolAdded(self, zone, protocol, timeout=0):
log.debug1("zone.ProtocolAdded('%s', '%s', %d)" % \
(zone, protocol, timeout))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
def ProtocolRemoved(self, zone, protocol):
log.debug1("zone.ProtocolRemoved('%s', '%s')" % (zone, protocol))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# SOURCE PORTS
@dbus_handle_exceptions
def disableTimedSourcePort(self, zone, port, protocol):
log.debug1("zone.disableTimedSourcePort('%s', '%s', '%s')" % \
(zone, port, protocol))
del self._timeouts[zone][("sport", port, protocol)]
self.fw.zone.remove_source_port(zone, port, protocol)
self.SourcePortRemoved(zone, port, protocol)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssi',
out_signature='s')
@dbus_handle_exceptions
def addSourcePort(self, zone, port, protocol, timeout, sender=None): # pylint: disable=R0913
# adds source port <port> <protocol> if not enabled already to zone
zone = dbus_to_python(zone, str)
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
timeout = dbus_to_python(timeout, int)
log.debug1("zone.addSourcePort('%s', '%s', '%s')" % (zone, port,
protocol))
self.accessCheck(sender)
_zone = self.fw.zone.add_source_port(zone, port, protocol, timeout,
sender)
if timeout > 0:
tag = GLib.timeout_add_seconds(timeout, self.disableTimedSourcePort,
_zone, port, protocol)
self.addTimeout(_zone, ("sport", port, protocol), tag)
self.SourcePortAdded(_zone, port, protocol, timeout)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss',
out_signature='s')
@dbus_handle_exceptions
def removeSourcePort(self, zone, port, protocol, sender=None): # pylint: disable=R0913
# removes source port<port> <protocol> if enabled from zone
zone = dbus_to_python(zone, str)
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("zone.removeSourcePort('%s', '%s', '%s')" % (zone, port,
protocol))
self.accessCheck(sender)
_zone= self.fw.zone.remove_source_port(zone, port, protocol)
self.removeTimeout(_zone, ("sport", port, protocol))
self.SourcePortRemoved(_zone, port, protocol)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss',
out_signature='b')
@dbus_handle_exceptions
def querySourcePort(self, zone, port, protocol, sender=None): # pylint: disable=W0613, R0913
# returns true if a source port is enabled for zone
zone = dbus_to_python(zone, str)
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("zone.querySourcePort('%s', '%s', '%s')" % (zone, port,
protocol))
return self.fw.zone.query_source_port(zone, port, protocol)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='aas')
@dbus_handle_exceptions
def getSourcePorts(self, zone, sender=None): # pylint: disable=W0613
# returns the list of enabled source ports
# TODO: should be renamed to listSourcePorts()
# because is called by firewall-cmd --zone --list-source-ports
zone = dbus_to_python(zone, str)
log.debug1("zone.getSourcePorts('%s')" % (zone))
return self.fw.zone.list_source_ports(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssi')
@dbus_handle_exceptions
def SourcePortAdded(self, zone, port, protocol, timeout=0):
log.debug1("zone.SourcePortAdded('%s', '%s', '%s', %d)" % \
(zone, port, protocol, timeout))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sss')
@dbus_handle_exceptions
def SourcePortRemoved(self, zone, port, protocol):
log.debug1("zone.SourcePortRemoved('%s', '%s', '%s')" % (zone, port,
protocol))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# MASQUERADE
@dbus_handle_exceptions
def disableTimedMasquerade(self, zone):
del self._timeouts[zone]["masquerade"]
self.fw.zone.remove_masquerade(zone)
self.MasqueradeRemoved(zone)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='si',
out_signature='s')
@dbus_handle_exceptions
def addMasquerade(self, zone, timeout, sender=None):
# adds masquerade if not added already
zone = dbus_to_python(zone, str)
timeout = dbus_to_python(timeout, int)
log.debug1("zone.addMasquerade('%s')" % (zone))
self.accessCheck(sender)
_zone = self.fw.zone.add_masquerade(zone, timeout, sender)
if timeout > 0:
tag = GLib.timeout_add_seconds(timeout, self.disableTimedMasquerade,
_zone)
self.addTimeout(_zone, "masquerade", tag)
self.MasqueradeAdded(_zone, timeout)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='s')
@dbus_handle_exceptions
def removeMasquerade(self, zone, sender=None):
# removes masquerade
zone = dbus_to_python(zone, str)
log.debug1("zone.removeMasquerade('%s')" % (zone))
self.accessCheck(sender)
_zone = self.fw.zone.remove_masquerade(zone)
self.removeTimeout(_zone, "masquerade")
self.MasqueradeRemoved(_zone)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='b')
@dbus_handle_exceptions
def queryMasquerade(self, zone, sender=None): # pylint: disable=W0613
# returns true if a masquerade is added
zone = dbus_to_python(zone, str)
log.debug1("zone.queryMasquerade('%s')" % (zone))
return self.fw.zone.query_masquerade(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='si')
@dbus_handle_exceptions
def MasqueradeAdded(self, zone, timeout=0):
log.debug1("zone.MasqueradeAdded('%s', %d)" % (zone, timeout))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='s')
@dbus_handle_exceptions
def MasqueradeRemoved(self, zone):
log.debug1("zone.MasqueradeRemoved('%s')" % (zone))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# FORWARD PORT
@dbus_handle_exceptions
def disable_forward_port(self, zone, port, protocol, toport, toaddr): # pylint: disable=R0913
del self._timeouts[zone][(port, protocol, toport, toaddr)]
self.fw.zone.remove_forward_port(zone, port, protocol, toport, toaddr)
self.ForwardPortRemoved(zone, port, protocol, toport, toaddr)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssssi',
out_signature='s')
@dbus_handle_exceptions
def addForwardPort(self, zone, port, protocol, toport, toaddr, timeout,
sender=None): # pylint: disable=R0913
# add forward port if not enabled already for zone
zone = dbus_to_python(zone, str)
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
toport = dbus_to_python(toport, str)
toaddr = dbus_to_python(toaddr, str)
timeout = dbus_to_python(timeout, int)
log.debug1("zone.addForwardPort('%s', '%s', '%s', '%s', '%s')" % \
(zone, port, protocol, toport, toaddr))
self.accessCheck(sender)
_zone = self.fw.zone.add_forward_port(zone, port, protocol, toport,
toaddr, timeout, sender)
if timeout > 0:
tag = GLib.timeout_add_seconds(timeout,
self.disable_forward_port,
_zone, port, protocol, toport,
toaddr)
self.addTimeout(_zone, (port, protocol, toport, toaddr), tag)
self.ForwardPortAdded(_zone, port, protocol, toport, toaddr, timeout)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssss',
out_signature='s')
@dbus_handle_exceptions
def removeForwardPort(self, zone, port, protocol, toport, toaddr,
sender=None): # pylint: disable=R0913
# remove forward port from zone
zone = dbus_to_python(zone, str)
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
toport = dbus_to_python(toport, str)
toaddr = dbus_to_python(toaddr, str)
log.debug1("zone.removeForwardPort('%s', '%s', '%s', '%s', '%s')" % \
(zone, port, protocol, toport, toaddr))
self.accessCheck(sender)
_zone = self.fw.zone.remove_forward_port(zone, port, protocol, toport,
toaddr)
self.removeTimeout(_zone, (port, protocol, toport, toaddr))
self.ForwardPortRemoved(_zone, port, protocol, toport, toaddr)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssss',
out_signature='b')
@dbus_handle_exceptions
def queryForwardPort(self, zone, port, protocol, toport, toaddr,
sender=None): # pylint: disable=W0613, R0913
# returns true if a forward port is enabled for zone
zone = dbus_to_python(zone, str)
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
toport = dbus_to_python(toport, str)
toaddr = dbus_to_python(toaddr, str)
log.debug1("zone.queryForwardPort('%s', '%s', '%s', '%s', '%s')" % \
(zone, port, protocol, toport, toaddr))
return self.fw.zone.query_forward_port(zone, port, protocol, toport,
toaddr)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='aas')
@dbus_handle_exceptions
def getForwardPorts(self, zone, sender=None): # pylint: disable=W0613
# returns the list of enabled ports for zone
# TODO: should be renamed to listForwardPorts()
# because is called by firewall-cmd --zone --list-forward-ports
zone = dbus_to_python(zone, str)
log.debug1("zone.getForwardPorts('%s')" % (zone))
return self.fw.zone.list_forward_ports(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssssi')
@dbus_handle_exceptions
def ForwardPortAdded(self, zone, port, protocol, toport, toaddr,
timeout=0): # pylint: disable=R0913
log.debug1("zone.ForwardPortAdded('%s', '%s', '%s', '%s', '%s', %d)" % \
(zone, port, protocol, toport, toaddr, timeout))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssss')
@dbus_handle_exceptions
def ForwardPortRemoved(self, zone, port, protocol, toport, toaddr): # pylint: disable=R0913
log.debug1("zone.ForwardPortRemoved('%s', '%s', '%s', '%s', '%s')" % \
(zone, port, protocol, toport, toaddr))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# ICMP BLOCK
@dbus_handle_exceptions
def disableTimedIcmpBlock(self, zone, icmp, sender): # pylint: disable=W0613
log.debug1("zone.disableTimedIcmpBlock('%s', '%s')" % (zone, icmp))
del self._timeouts[zone][icmp]
self.fw.zone.remove_icmp_block(zone, icmp)
self.IcmpBlockRemoved(zone, icmp)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi',
out_signature='s')
@dbus_handle_exceptions
def addIcmpBlock(self, zone, icmp, timeout, sender=None):
# add icmpblock <icmp> if not enabled already for zone
zone = dbus_to_python(zone, str)
icmp = dbus_to_python(icmp, str)
timeout = dbus_to_python(timeout, int)
log.debug1("zone.enableIcmpBlock('%s', '%s')" % (zone, icmp))
self.accessCheck(sender)
_zone = self.fw.zone.add_icmp_block(zone, icmp, timeout, sender)
if timeout > 0:
tag = GLib.timeout_add_seconds(timeout, self.disableTimedIcmpBlock,
_zone, icmp, sender)
self.addTimeout(_zone, icmp, tag)
self.IcmpBlockAdded(_zone, icmp, timeout)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='s')
@dbus_handle_exceptions
def removeIcmpBlock(self, zone, icmp, sender=None):
# removes icmpBlock from zone
zone = dbus_to_python(zone, str)
icmp = dbus_to_python(icmp, str)
log.debug1("zone.removeIcmpBlock('%s', '%s')" % (zone, icmp))
self.accessCheck(sender)
_zone = self.fw.zone.remove_icmp_block(zone, icmp)
self.removeTimeout(_zone, icmp)
self.IcmpBlockRemoved(_zone, icmp)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss',
out_signature='b')
@dbus_handle_exceptions
def queryIcmpBlock(self, zone, icmp, sender=None): # pylint: disable=W0613
# returns true if a icmp is enabled for zone
zone = dbus_to_python(zone, str)
icmp = dbus_to_python(icmp, str)
log.debug1("zone.queryIcmpBlock('%s', '%s')" % (zone, icmp))
return self.fw.zone.query_icmp_block(zone, icmp)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='as')
@dbus_handle_exceptions
def getIcmpBlocks(self, zone, sender=None): # pylint: disable=W0613
# returns the list of enabled icmpblocks
# TODO: should be renamed to listIcmpBlocks()
# because is called by firewall-cmd --zone --list-icmp-blocks
zone = dbus_to_python(zone, str)
log.debug1("zone.getIcmpBlocks('%s')" % (zone))
return self.fw.zone.list_icmp_blocks(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi')
@dbus_handle_exceptions
def IcmpBlockAdded(self, zone, icmp, timeout=0):
log.debug1("zone.IcmpBlockAdded('%s', '%s', %d)" % \
(zone, icmp, timeout))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss')
@dbus_handle_exceptions
def IcmpBlockRemoved(self, zone, icmp):
log.debug1("zone.IcmpBlockRemoved('%s', '%s')" % (zone, icmp))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# ICMP BLOCK INVERSION
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='s')
@dbus_handle_exceptions
def addIcmpBlockInversion(self, zone, sender=None):
# adds icmpBlockInversion if not added already
zone = dbus_to_python(zone, str)
log.debug1("zone.addIcmpBlockInversion('%s')" % (zone))
self.accessCheck(sender)
_zone = self.fw.zone.add_icmp_block_inversion(zone, sender)
self.IcmpBlockInversionAdded(_zone)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='s')
@dbus_handle_exceptions
def removeIcmpBlockInversion(self, zone, sender=None):
# removes icmpBlockInversion
zone = dbus_to_python(zone, str)
log.debug1("zone.removeIcmpBlockInversion('%s')" % (zone))
self.accessCheck(sender)
_zone = self.fw.zone.remove_icmp_block_inversion(zone)
self.IcmpBlockInversionRemoved(_zone)
return _zone
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s',
out_signature='b')
@dbus_handle_exceptions
def queryIcmpBlockInversion(self, zone, sender=None): # pylint: disable=W0613
# returns true if a icmpBlockInversion is added
zone = dbus_to_python(zone, str)
log.debug1("zone.queryIcmpBlockInversion('%s')" % (zone))
return self.fw.zone.query_icmp_block_inversion(zone)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='s')
@dbus_handle_exceptions
def IcmpBlockInversionAdded(self, zone):
log.debug1("zone.IcmpBlockInversionAdded('%s')" % (zone))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='s')
@dbus_handle_exceptions
def IcmpBlockInversionRemoved(self, zone):
log.debug1("zone.IcmpBlockInversionRemoved('%s')" % (zone))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# DIRECT INTERFACE
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# DIRECT CHAIN
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss',
out_signature='')
@dbus_handle_exceptions
def addChain(self, ipv, table, chain, sender=None):
# inserts direct chain
ipv = dbus_to_python(ipv, str)
table = dbus_to_python(table, str)
chain = dbus_to_python(chain, str)
log.debug1("direct.addChain('%s', '%s', '%s')" % (ipv, table, chain))
self.accessCheck(sender)
self.fw.direct.add_chain(ipv, table, chain)
self.ChainAdded(ipv, table, chain)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss',
out_signature='')
@dbus_handle_exceptions
def removeChain(self, ipv, table, chain, sender=None):
# removes direct chain
ipv = dbus_to_python(ipv, str)
table = dbus_to_python(table, str)
chain = dbus_to_python(chain, str)
log.debug1("direct.removeChain('%s', '%s', '%s')" % (ipv, table, chain))
self.accessCheck(sender)
self.fw.direct.remove_chain(ipv, table, chain)
self.ChainRemoved(ipv, table, chain)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss',
out_signature='b')
@dbus_handle_exceptions
def queryChain(self, ipv, table, chain, sender=None): # pylint: disable=W0613
# returns true if a chain is enabled
ipv = dbus_to_python(ipv, str)
table = dbus_to_python(table, str)
chain = dbus_to_python(chain, str)
log.debug1("direct.queryChain('%s', '%s', '%s')" % (ipv, table, chain))
return self.fw.direct.query_chain(ipv, table, chain)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='ss',
out_signature='as')
@dbus_handle_exceptions
def getChains(self, ipv, table, sender=None): # pylint: disable=W0613
# returns list of added chains
ipv = dbus_to_python(ipv, str)
table = dbus_to_python(table, str)
log.debug1("direct.getChains('%s', '%s')" % (ipv, table))
return self.fw.direct.get_chains(ipv, table)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='',
out_signature='a(sss)')
@dbus_handle_exceptions
def getAllChains(self, sender=None): # pylint: disable=W0613
# returns list of added chains
log.debug1("direct.getAllChains()")
return self.fw.direct.get_all_chains()
@dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sss')
@dbus_handle_exceptions
def ChainAdded(self, ipv, table, chain):
log.debug1("direct.ChainAdded('%s', '%s', '%s')" % (ipv, table, chain))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sss')
@dbus_handle_exceptions
def ChainRemoved(self, ipv, table, chain):
log.debug1("direct.ChainRemoved('%s', '%s', '%s')" % (ipv, table,
chain))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# DIRECT RULE
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT,
in_signature='sssias', out_signature='')
@dbus_handle_exceptions
def addRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913
# inserts direct rule
ipv = dbus_to_python(ipv, str)
table = dbus_to_python(table, str)
chain = dbus_to_python(chain, str)
priority = dbus_to_python(priority, int)
args = tuple( dbus_to_python(i, str) for i in args )
log.debug1("direct.addRule('%s', '%s', '%s', %d, '%s')" % \
(ipv, table, chain, priority, "','".join(args)))
self.accessCheck(sender)
self.fw.direct.add_rule(ipv, table, chain, priority, args)
self.RuleAdded(ipv, table, chain, priority, args)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT,
in_signature='sssias', out_signature='')
@dbus_handle_exceptions
def removeRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913
# removes direct rule
ipv = dbus_to_python(ipv, str)
table = dbus_to_python(table, str)
chain = dbus_to_python(chain, str)
priority = dbus_to_python(priority, int)
args = tuple( dbus_to_python(i, str) for i in args )
log.debug1("direct.removeRule('%s', '%s', '%s', %d, '%s')" % \
(ipv, table, chain, priority, "','".join(args)))
self.accessCheck(sender)
self.fw.direct.remove_rule(ipv, table, chain, priority, args)
self.RuleRemoved(ipv, table, chain, priority, args)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss',
out_signature='')
@dbus_handle_exceptions
def removeRules(self, ipv, table, chain, sender=None):
# removes direct rule
ipv = dbus_to_python(ipv, str)
table = dbus_to_python(table, str)
chain = dbus_to_python(chain, str)
log.debug1("direct.removeRules('%s', '%s', '%s')" % (ipv, table, chain))
self.accessCheck(sender)
for (priority, args) in self.fw.direct.get_rules(ipv, table, chain):
self.fw.direct.remove_rule(ipv, table, chain, priority, args)
self.RuleRemoved(ipv, table, chain, priority, args)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT,
in_signature='sssias', out_signature='b')
@dbus_handle_exceptions
def queryRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=W0613, R0913
# returns true if a rule is enabled
ipv = dbus_to_python(ipv, str)
table = dbus_to_python(table, str)
chain = dbus_to_python(chain, str)
priority = dbus_to_python(priority, int)
args = tuple( dbus_to_python(i, str) for i in args )
log.debug1("direct.queryRule('%s', '%s', '%s', %d, '%s')" % \
(ipv, table, chain, priority, "','".join(args)))
return self.fw.direct.query_rule(ipv, table, chain, priority, args)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss',
out_signature='a(ias)')
@dbus_handle_exceptions
def getRules(self, ipv, table, chain, sender=None): # pylint: disable=W0613
# returns list of added rules
ipv = dbus_to_python(ipv, str)
table = dbus_to_python(table, str)
chain = dbus_to_python(chain, str)
log.debug1("direct.getRules('%s', '%s', '%s')" % (ipv, table, chain))
return self.fw.direct.get_rules(ipv, table, chain)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='',
out_signature='a(sssias)')
@dbus_handle_exceptions
def getAllRules(self, sender=None): # pylint: disable=W0613
# returns list of added rules
log.debug1("direct.getAllRules()")
return self.fw.direct.get_all_rules()
@dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sssias')
@dbus_handle_exceptions
def RuleAdded(self, ipv, table, chain, priority, args): # pylint: disable=R0913
log.debug1("direct.RuleAdded('%s', '%s', '%s', %d, '%s')" % \
(ipv, table, chain, priority, "','".join(args)))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sssias')
@dbus_handle_exceptions
def RuleRemoved(self, ipv, table, chain, priority, args): # pylint: disable=R0913
log.debug1("direct.RuleRemoved('%s', '%s', '%s', %d, '%s')" % \
(ipv, table, chain, priority, "','".join(args)))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# DIRECT PASSTHROUGH (untracked)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas',
out_signature='s')
@dbus_handle_exceptions
def passthrough(self, ipv, args, sender=None):
# inserts direct rule
ipv = dbus_to_python(ipv, str)
args = tuple( dbus_to_python(i, str) for i in args )
log.debug1("direct.passthrough('%s', '%s')" % (ipv, "','".join(args)))
self.accessCheck(sender)
try:
return self.fw.direct.passthrough(ipv, args)
except FirewallError as error:
if ipv in ["ipv4", "ipv6"]:
query_args = set(["-C", "--check",
"-L", "--list"])
else:
query_args = set(["-L", "--list"])
msg = str(error)
if error.code == errors.COMMAND_FAILED:
if len(set(args) & query_args) <= 0:
log.warning(msg)
raise FirewallDBusException(msg)
raise
# DIRECT PASSTHROUGH (tracked)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas',
out_signature='')
@dbus_handle_exceptions
def addPassthrough(self, ipv, args, sender=None):
# inserts direct passthrough
ipv = dbus_to_python(ipv)
args = tuple( dbus_to_python(i) for i in args )
log.debug1("direct.addPassthrough('%s', '%s')" % \
(ipv, "','".join(args)))
self.accessCheck(sender)
self.fw.direct.add_passthrough(ipv, args)
self.PassthroughAdded(ipv, args)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas',
out_signature='')
@dbus_handle_exceptions
def removePassthrough(self, ipv, args, sender=None):
# removes direct passthrough
ipv = dbus_to_python(ipv)
args = tuple( dbus_to_python(i) for i in args )
log.debug1("direct.removePassthrough('%s', '%s')" % \
(ipv, "','".join(args)))
self.accessCheck(sender)
self.fw.direct.remove_passthrough(ipv, args)
self.PassthroughRemoved(ipv, args)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas',
out_signature='b')
@dbus_handle_exceptions
def queryPassthrough(self, ipv, args, sender=None): # pylint: disable=W0613
# returns true if a passthrough is enabled
ipv = dbus_to_python(ipv)
args = tuple( dbus_to_python(i) for i in args )
log.debug1("direct.queryPassthrough('%s', '%s')" % \
(ipv, "','".join(args)))
return self.fw.direct.query_passthrough(ipv, args)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='',
out_signature='a(sas)')
@dbus_handle_exceptions
def getAllPassthroughs(self, sender=None): # pylint: disable=W0613
# returns list of all added passthroughs
log.debug1("direct.getAllPassthroughs()")
return self.fw.direct.get_all_passthroughs()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='',
out_signature='')
@dbus_handle_exceptions
def removeAllPassthroughs(self, sender=None): # pylint: disable=W0613
# remove all passhroughs
log.debug1("direct.removeAllPassthroughs()")
# remove in reverse order to avoid removing non-empty chains
for passthrough in reversed(self.getAllPassthroughs()):
self.removePassthrough(*passthrough)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='s',
out_signature='aas')
@dbus_handle_exceptions
def getPassthroughs(self, ipv, sender=None): # pylint: disable=W0613
# returns list of all added passthroughs with ipv
ipv = dbus_to_python(ipv)
log.debug1("direct.getPassthroughs('%s')", ipv)
return self.fw.direct.get_passthroughs(ipv)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sas')
@dbus_handle_exceptions
def PassthroughAdded(self, ipv, args):
log.debug1("direct.PassthroughAdded('%s', '%s')" % \
(ipv, "','".join(args)))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sas')
@dbus_handle_exceptions
def PassthroughRemoved(self, ipv, args):
log.debug1("direct.PassthroughRemoved('%s', '%s')" % \
(ipv, "','".join(args)))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_ALL)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='')
@dbus_handle_exceptions
def authorizeAll(self, sender=None): # pylint: disable=W0613
""" PK_ACTION_ALL implies all other actions, i.e. once a subject is
authorized for PK_ACTION_ALL it's also authorized for any other action.
Use-case is GUI (RHBZ#994729).
"""
pass
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# IPSETS
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='s',
out_signature='b')
@dbus_handle_exceptions
def queryIPSet(self, ipset, sender=None): # pylint: disable=W0613
# returns true if a set with the name exists
ipset = dbus_to_python(ipset)
log.debug1("ipset.queryIPSet('%s')" % (ipset))
return self.fw.ipset.query_ipset(ipset)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='',
out_signature='as')
@dbus_handle_exceptions
def getIPSets(self, sender=None): # pylint: disable=W0613
# returns list of added sets
log.debug1("ipsets.getIPSets()")
return self.fw.ipset.get_ipsets()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='s',
out_signature=IPSet.DBUS_SIGNATURE)
@dbus_handle_exceptions
def getIPSetSettings(self, ipset, sender=None): # pylint: disable=W0613
# returns ipset settings for ipset
ipset = dbus_to_python(ipset, str)
log.debug1("getIPSetSettings(%s)", ipset)
return self.fw.ipset.get_ipset(ipset).export_config()
# set entries # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='ss',
out_signature='')
@dbus_handle_exceptions
def addEntry(self, ipset, entry, sender=None):
# adds ipset entry
ipset = dbus_to_python(ipset)
entry = dbus_to_python(entry)
log.debug1("ipset.addEntry('%s', '%s')" % (ipset, entry))
self.accessCheck(sender)
self.fw.ipset.add_entry(ipset, entry)
self.EntryAdded(ipset, entry)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='ss',
out_signature='')
@dbus_handle_exceptions
def removeEntry(self, ipset, entry, sender=None):
# removes ipset entry
ipset = dbus_to_python(ipset)
entry = dbus_to_python(entry)
log.debug1("ipset.removeEntry('%s', '%s')" % (ipset, entry))
self.accessCheck(sender)
self.fw.ipset.remove_entry(ipset, entry)
self.EntryRemoved(ipset, entry)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='ss',
out_signature='b')
@dbus_handle_exceptions
def queryEntry(self, ipset, entry, sender=None): # pylint: disable=W0613
# returns true if the entry exists in the ipset
ipset = dbus_to_python(ipset)
entry = dbus_to_python(entry)
log.debug1("ipset.queryEntry('%s', '%s')" % (ipset, entry))
return self.fw.ipset.query_entry(ipset, entry)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='s',
out_signature='as')
@dbus_handle_exceptions
def getEntries(self, ipset, sender=None): # pylint: disable=W0613
# returns list of added entries for the ipset
ipset = dbus_to_python(ipset)
log.debug1("ipset.getEntries('%s')" % ipset)
return self.fw.ipset.get_entries(ipset)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='sas')
@dbus_handle_exceptions
def setEntries(self, ipset, entries, sender=None): # pylint: disable=W0613
# returns list of added entries for the ipset
ipset = dbus_to_python(ipset)
entries = dbus_to_python(entries, list)
log.debug1("ipset.setEntries('%s', '[%s]')", ipset, ",".join(entries))
old_entries = self.fw.ipset.get_entries(ipset)
self.fw.ipset.set_entries(ipset, entries)
old_entries_set = set(old_entries)
entries_set = set(entries)
for entry in entries_set - old_entries_set:
self.EntryAdded(ipset, entry)
for entry in old_entries_set - entries_set:
self.EntryRemoved(ipset, entry)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_IPSET, signature='ss')
@dbus_handle_exceptions
def EntryAdded(self, ipset, entry):
ipset = dbus_to_python(ipset)
entry = dbus_to_python(entry)
log.debug1("ipset.EntryAdded('%s', '%s')" % (ipset, entry))
@dbus.service.signal(config.dbus.DBUS_INTERFACE_IPSET, signature='ss')
@dbus_handle_exceptions
def EntryRemoved(self, ipset, entry):
ipset = dbus_to_python(ipset)
entry = dbus_to_python(entry)
log.debug1("ipset.EntryRemoved('%s', '%s')" % (ipset, entry))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# HELPERS
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='',
out_signature='as')
@dbus_handle_exceptions
def getHelpers(self, sender=None): # pylint: disable=W0613
# returns list of added sets
log.debug1("helpers.getHelpers()")
return self.fw.helper.get_helpers()
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
@dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s',
out_signature=Helper.DBUS_SIGNATURE)
@dbus_handle_exceptions
def getHelperSettings(self, helper, sender=None): # pylint: disable=W0613
# returns helper settings for helper
helper = dbus_to_python(helper, str)
log.debug1("getHelperSettings(%s)", helper)
return self.fw.helper.get_helper(helper).export_config()
server/config_policy.py 0000644 00000020455 15035135171 0011257 0 ustar 00 # -*- coding: utf-8 -*-
#
# SPDX-License-Identifier: GPL-2.0-or-later
# force use of pygobject3 in python-slip
from gi.repository import GObject
import sys
sys.modules['gobject'] = GObject
import dbus
import dbus.service
import slip.dbus
import slip.dbus.service
from firewall import config
from firewall.dbus_utils import dbus_to_python, \
dbus_introspection_prepare_properties, \
dbus_introspection_add_properties
from firewall.core.logger import log
from firewall.server.decorators import handle_exceptions, \
dbus_handle_exceptions, dbus_service_method
class FirewallDConfigPolicy(slip.dbus.service.Object):
persistent = True
default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG
@handle_exceptions
def __init__(self, parent, conf, policy, item_id, *args, **kwargs):
super(FirewallDConfigPolicy, self).__init__(*args, **kwargs)
self.parent = parent
self.config = conf
self.obj = policy
self.item_id = item_id
self.busname = args[0]
self.path = args[1]
self._log_prefix = "config.policy.%d" % self.item_id
dbus_introspection_prepare_properties(
self, config.dbus.DBUS_INTERFACE_CONFIG_POLICY)
@dbus_handle_exceptions
def __del__(self):
pass
@dbus_handle_exceptions
def unregister(self):
self.remove_from_connection()
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# P R O P E R T I E S
@dbus_handle_exceptions
def _get_property(self, property_name):
if property_name == "name":
return dbus.String(self.obj.name)
elif property_name == "filename":
return dbus.String(self.obj.filename)
elif property_name == "path":
return dbus.String(self.obj.path)
elif property_name == "default":
return dbus.Boolean(self.obj.default)
elif property_name == "builtin":
return dbus.Boolean(self.obj.builtin)
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss',
out_signature='v')
@dbus_handle_exceptions
def Get(self, interface_name, property_name, sender=None):
# get a property
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
log.debug1("%s.Get('%s', '%s')", self._log_prefix,
interface_name, property_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_POLICY:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
return self._get_property(property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s',
out_signature='a{sv}')
@dbus_handle_exceptions
def GetAll(self, interface_name, sender=None):
interface_name = dbus_to_python(interface_name, str)
log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_POLICY:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
ret = { }
for x in [ "name", "filename", "path", "default", "builtin" ]:
ret[x] = self._get_property(x)
return dbus.Dictionary(ret, signature="sv")
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv')
@dbus_handle_exceptions
def Set(self, interface_name, property_name, new_value, sender=None):
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
new_value = dbus_to_python(new_value)
log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix,
interface_name, property_name, new_value)
self.parent.accessCheck(sender)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_POLICY:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.PropertyReadOnly: "
"Property '%s' is read-only" % property_name)
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as')
def PropertiesChanged(self, interface_name, changed_properties,
invalidated_properties):
interface_name = dbus_to_python(interface_name, str)
changed_properties = dbus_to_python(changed_properties)
invalidated_properties = dbus_to_python(invalidated_properties)
log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix,
interface_name, changed_properties, invalidated_properties)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s')
@dbus_handle_exceptions
def Introspect(self, sender=None):
log.debug2("%s.Introspect()", self._log_prefix)
data = super(FirewallDConfigPolicy, self).Introspect(
self.path, self.busname.get_bus())
return dbus_introspection_add_properties(
self, data, config.dbus.DBUS_INTERFACE_CONFIG_POLICY)
# S E T T I N G S
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY,
out_signature="a{sv}")
@dbus_handle_exceptions
def getSettings(self, sender=None):
"""get settings for policy
"""
log.debug1("%s.getSettings()", self._log_prefix)
settings = self.config.get_policy_object_config_dict(self.obj)
return settings
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY,
in_signature="a{sv}")
@dbus_handle_exceptions
def update(self, settings, sender=None):
"""update settings for policy
"""
settings = dbus_to_python(settings)
log.debug1("%s.update('...')", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.set_policy_object_config_dict(self.obj, settings)
self.Updated(self.obj.name)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY)
@dbus_handle_exceptions
def loadDefaults(self, sender=None):
"""load default settings for builtin policy
"""
log.debug1("%s.loadDefaults()", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.load_policy_object_defaults(self.obj)
self.Updated(self.obj.name)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, signature='s')
@dbus_handle_exceptions
def Updated(self, name):
log.debug1("%s.Updated('%s')" % (self._log_prefix, name))
# R E M O V E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY)
@dbus_handle_exceptions
def remove(self, sender=None):
"""remove policy
"""
log.debug1("%s.removePolicy()", self._log_prefix)
self.parent.accessCheck(sender)
self.config.remove_policy_object(self.obj)
self.parent.removePolicy(self.obj)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, signature='s')
@dbus_handle_exceptions
def Removed(self, name):
log.debug1("%s.Removed('%s')" % (self._log_prefix, name))
# R E N A M E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY,
in_signature='s')
@dbus_handle_exceptions
def rename(self, name, sender=None):
"""rename policy
"""
name = dbus_to_python(name, str)
log.debug1("%s.rename('%s')", self._log_prefix, name)
self.parent.accessCheck(sender)
self.obj = self.config.rename_policy_object(self.obj, name)
self.Renamed(name)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, signature='s')
@dbus_handle_exceptions
def Renamed(self, name):
log.debug1("%s.Renamed('%s')" % (self._log_prefix, name))
server/config_helper.py 0000644 00000042212 15035135171 0011232 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
# force use of pygobject3 in python-slip
from gi.repository import GObject
import sys
sys.modules['gobject'] = GObject
import dbus
import dbus.service
import slip.dbus
import slip.dbus.service
from firewall import config
from firewall.dbus_utils import dbus_to_python, \
dbus_introspection_prepare_properties, \
dbus_introspection_add_properties
from firewall.core.io.helper import Helper
from firewall.core.logger import log
from firewall.server.decorators import handle_exceptions, \
dbus_handle_exceptions, dbus_service_method
from firewall import errors
from firewall.errors import FirewallError
############################################################################
#
# class FirewallDConfig
#
############################################################################
class FirewallDConfigHelper(slip.dbus.service.Object):
"""FirewallD main class"""
persistent = True
""" Make FirewallD persistent. """
default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG
""" Use PK_ACTION_INFO as a default """
@handle_exceptions
def __init__(self, parent, conf, helper, item_id, *args, **kwargs):
super(FirewallDConfigHelper, self).__init__(*args, **kwargs)
self.parent = parent
self.config = conf
self.obj = helper
self.item_id = item_id
self.busname = args[0]
self.path = args[1]
self._log_prefix = "config.helper.%d" % self.item_id
dbus_introspection_prepare_properties(
self, config.dbus.DBUS_INTERFACE_CONFIG_HELPER)
@dbus_handle_exceptions
def __del__(self):
pass
@dbus_handle_exceptions
def unregister(self):
self.remove_from_connection()
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# P R O P E R T I E S
@dbus_handle_exceptions
def _get_property(self, property_name):
if property_name == "name":
return dbus.String(self.obj.name)
elif property_name == "filename":
return dbus.String(self.obj.filename)
elif property_name == "path":
return dbus.String(self.obj.path)
elif property_name == "default":
return dbus.Boolean(self.obj.default)
elif property_name == "builtin":
return dbus.Boolean(self.obj.builtin)
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss',
out_signature='v')
@dbus_handle_exceptions
def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613
# get a property
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
log.debug1("%s.Get('%s', '%s')", self._log_prefix,
interface_name, property_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_HELPER:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
return self._get_property(property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s',
out_signature='a{sv}')
@dbus_handle_exceptions
def GetAll(self, interface_name, sender=None): # pylint: disable=W0613
interface_name = dbus_to_python(interface_name, str)
log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_HELPER:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
ret = { }
for x in [ "name", "filename", "path", "default", "builtin" ]:
ret[x] = self._get_property(x)
return dbus.Dictionary(ret, signature="sv")
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv')
@dbus_handle_exceptions
def Set(self, interface_name, property_name, new_value, sender=None):
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
new_value = dbus_to_python(new_value)
log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix,
interface_name, property_name, new_value)
self.parent.accessCheck(sender)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_HELPER:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.PropertyReadOnly: "
"Property '%s' is read-only" % property_name)
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as')
def PropertiesChanged(self, interface_name, changed_properties,
invalidated_properties):
interface_name = dbus_to_python(interface_name, str)
changed_properties = dbus_to_python(changed_properties)
invalidated_properties = dbus_to_python(invalidated_properties)
log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix,
interface_name, changed_properties, invalidated_properties)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s')
@dbus_handle_exceptions
def Introspect(self, sender=None): # pylint: disable=W0613
log.debug2("%s.Introspect()", self._log_prefix)
data = super(FirewallDConfigHelper, self).Introspect(
self.path, self.busname.get_bus())
return dbus_introspection_add_properties(
self, data, config.dbus.DBUS_INTERFACE_CONFIG_HELPER)
# S E T T I N G S
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
out_signature=Helper.DBUS_SIGNATURE)
@dbus_handle_exceptions
def getSettings(self, sender=None): # pylint: disable=W0613
"""get settings for helper
"""
log.debug1("%s.getSettings()", self._log_prefix)
return self.config.get_helper_config(self.obj)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature=Helper.DBUS_SIGNATURE)
@dbus_handle_exceptions
def update(self, settings, sender=None):
"""update settings for helper
"""
settings = dbus_to_python(settings)
log.debug1("%s.update('...')", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.set_helper_config(self.obj, settings)
self.Updated(self.obj.name)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER)
@dbus_handle_exceptions
def loadDefaults(self, sender=None):
"""load default settings for builtin helper
"""
log.debug1("%s.loadDefaults()", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.load_helper_defaults(self.obj)
self.Updated(self.obj.name)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
signature='s')
@dbus_handle_exceptions
def Updated(self, name):
log.debug1("%s.Updated('%s')" % (self._log_prefix, name))
# R E M O V E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER)
@dbus_handle_exceptions
def remove(self, sender=None):
"""remove helper
"""
log.debug1("%s.removeHelper()", self._log_prefix)
self.parent.accessCheck(sender)
self.config.remove_helper(self.obj)
self.parent.removeHelper(self.obj)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
signature='s')
@dbus_handle_exceptions
def Removed(self, name):
log.debug1("%s.Removed('%s')" % (self._log_prefix, name))
# R E N A M E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='s')
@dbus_handle_exceptions
def rename(self, name, sender=None):
"""rename helper
"""
name = dbus_to_python(name, str)
log.debug1("%s.rename('%s')", self._log_prefix, name)
self.parent.accessCheck(sender)
self.obj = self.config.rename_helper(self.obj, name)
self.Renamed(name)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
signature='s')
@dbus_handle_exceptions
def Renamed(self, name):
log.debug1("%s.Renamed('%s')" % (self._log_prefix, name))
# version
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
out_signature='s')
@dbus_handle_exceptions
def getVersion(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getVersion()", self._log_prefix)
return self.getSettings()[0]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='s')
@dbus_handle_exceptions
def setVersion(self, version, sender=None):
version = dbus_to_python(version, str)
log.debug1("%s.setVersion('%s')", self._log_prefix, version)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[0] = version
self.update(settings)
# short
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
out_signature='s')
@dbus_handle_exceptions
def getShort(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getShort()", self._log_prefix)
return self.getSettings()[1]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='s')
@dbus_handle_exceptions
def setShort(self, short, sender=None):
short = dbus_to_python(short, str)
log.debug1("%s.setShort('%s')", self._log_prefix, short)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[1] = short
self.update(settings)
# description
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
out_signature='s')
@dbus_handle_exceptions
def getDescription(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getDescription()", self._log_prefix)
return self.getSettings()[2]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='s')
@dbus_handle_exceptions
def setDescription(self, description, sender=None):
description = dbus_to_python(description, str)
log.debug1("%s.setDescription('%s')", self._log_prefix,
description)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[2] = description
self.update(settings)
# family
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
out_signature='s')
@dbus_handle_exceptions
def getFamily(self, sender=None):
log.debug1("%s.getFamily()", self._log_prefix)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
return settings[3]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='s')
@dbus_handle_exceptions
def setFamily(self, ipv, sender=None):
ipv = dbus_to_python(ipv, str)
log.debug1("%s.setFamily('%s')", self._log_prefix, ipv)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if settings[3] == ipv:
raise FirewallError(errors.ALREADY_ENABLED, "'%s'" % ipv)
settings[3] = ipv
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryFamily(self, ipv, sender=None): # pylint: disable=W0613
ipv = dbus_to_python(ipv, str)
log.debug1("%s.queryFamily('%s')", self._log_prefix, ipv)
settings = self.getSettings()
return (settings[3] == ipv)
# module
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
out_signature='s')
@dbus_handle_exceptions
def getModule(self, sender=None):
log.debug1("%s.getModule()", self._log_prefix)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
return settings[4]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='s')
@dbus_handle_exceptions
def setModule(self, module, sender=None):
module = dbus_to_python(module, str)
log.debug1("%s.setModule('%s')", self._log_prefix, module)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if settings[4] == module:
raise FirewallError(errors.ALREADY_ENABLED, "'%s'" % module)
settings[4] = module
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryModule(self, module, sender=None): # pylint: disable=W0613
module = dbus_to_python(module, str)
log.debug1("%s.queryModule('%s')", self._log_prefix, module)
settings = self.getSettings()
return (settings[4] == module)
# port
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
out_signature='a(ss)')
@dbus_handle_exceptions
def getPorts(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getPorts()", self._log_prefix)
return self.getSettings()[5]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='a(ss)')
@dbus_handle_exceptions
def setPorts(self, ports, sender=None):
_ports = [ ]
# convert embedded lists to tuples
for port in dbus_to_python(ports, list):
if isinstance(port, list):
_ports.append(tuple(port))
else:
_ports.append(port)
ports = _ports
log.debug1("%s.setPorts('[%s]')", self._log_prefix,
",".join("('%s, '%s')" % (port[0], port[1]) for port in ports))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[5] = ports
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='ss')
@dbus_handle_exceptions
def addPort(self, port, protocol, sender=None):
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.addPort('%s', '%s')", self._log_prefix, port,
protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if (port,protocol) in settings[5]:
raise FirewallError(errors.ALREADY_ENABLED,
"%s:%s" % (port, protocol))
settings[5].append((port,protocol))
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='ss')
@dbus_handle_exceptions
def removePort(self, port, protocol, sender=None):
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.removePort('%s', '%s')", self._log_prefix, port,
protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if (port,protocol) not in settings[5]:
raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol))
settings[5].remove((port,protocol))
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER,
in_signature='ss', out_signature='b')
@dbus_handle_exceptions
def queryPort(self, port, protocol, sender=None): # pylint: disable=W0613
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.queryPort('%s', '%s')", self._log_prefix, port,
protocol)
return (port,protocol) in self.getSettings()[5]
server/__pycache__/config_ipset.cpython-36.pyc 0000644 00000031650 15035135172 0015370 0 ustar 00 3
��gzI � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZmZmZmZ d dlmZ d d lmZmZmZ d d
l m Z d d l m Z G d d
� d
ejj j �Z!dS )� )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�IPSet)� IPSET_TYPES�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�errors)�
FirewallErrorc s e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z
e d d
� �Zeejd d d
�e dWdd���Zeejddd
�e dXdd���Zejjjejj�eejdd�e dYdd����Zejjejdd�dd � �Zejjjejj�eejdd �e dZ� fd d � ���Z eejj e j d �e d[d d!���Z eejj e j d�e d\d"d#���Z!eejj �e d]d$d%���Z"ejjejj dd�e d&d'� ��Z#eejj �e d^d(d)���Z$ejjejj dd�e d*d+� ��Z%eejj dd�e d_d,d-���Z&ejjejj dd�e d.d/� ��Z'eejj dd �e d`d0d1���Z(eejj dd�e dad2d3���Z)eejj dd �e dbd4d5���Z*eejj dd�e dcd6d7���Z+eejj dd �e ddd8d9���Z,eejj dd�e ded:d;���Z-eejj dd �e dfd<d=���Z.eejj dd�e dgd>d?���Z/eejj d@d �e dhdAdB���Z0eejj d@d�e didCdD���Z1eejj d d�e djdEdF���Z2eejj dd�e dkdGdH���Z3eejj d dId
�e dldJdK���Z4eejj dLd �e dmdMdN���Z5eejj dLd�e dndOdP���Z6eejj dd�e dodQdR���Z7eejj dd�e dpdSdT���Z8eejj ddId
�e dqdUdV���Z9� Z:S )r�FirewallDConfigIPSetzFirewallD main classTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.ipset.%d)
�superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus�DBUS_INTERFACE_CONFIG_IPSET)�selfr ZconfZipsetr �args�kwargs)� __class__� �"/usr/lib/python3.6/config_ipset.pyr ; s
z FirewallDConfigIPSet.__init__c C s d S )Nr" )r r" r" r# �__del__H s z FirewallDConfigIPSet.__del__c C s | j � d S )N)Zremove_from_connection)r r" r" r# �
unregisterL s z FirewallDConfigIPSet.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r& r' r ZBooleanr( r) �
exceptions�
DBusException)r �
property_namer" r" r# �
_get_propertyT s z"FirewallDConfigIPSet._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r+ r, r. )r �interface_namer- �senderr" r" r# �Gete s
zFirewallDConfigIPSet.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr& r' r r( r) Zsv)� signature)r& r' r r( r) ) r r2 r r3 r r r r r+ r, r. Z
Dictionary)r r4 r5 �ret�xr" r" r# �GetAllv s
zFirewallDConfigIPSet.GetAllZssv)r0 c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r2 r r3 r r � accessCheckr r r r+ r, )r r4 r- Z new_valuer5 r" r" r# �Set� s
zFirewallDConfigIPSet.Setzsa{sv}as)r8 c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r2 r r3 r )r r4 Zchanged_propertiesZinvalidated_propertiesr" r" r# �PropertiesChanged� s
z&FirewallDConfigIPSet.PropertiesChanged)r1 c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r r �
Introspectr r Zget_busr r r r )r r5 �data)r! r" r# r? � s
z FirewallDConfigIPSet.Introspectc C s t jd| j� | jj| j�S )z get settings for ipset
z%s.getSettings())r r3 r r Zget_ipset_configr )r r5 r" r" r# � getSettings� s z FirewallDConfigIPSet.getSettingsc C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� dS )z"update settings for ipset
z%s.update('...')N) r r r3 r r r< r Zset_ipset_configr �Updatedr& )r �settingsr5 r" r" r# �update� s
zFirewallDConfigIPSet.updatec C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z0load default settings for builtin ipset
z%s.loadDefaults()N)
r r3 r r r< r Zload_ipset_defaultsr rB r& )r r5 r" r" r# � loadDefaults� s z!FirewallDConfigIPSet.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r3 r )r r& r" r" r# rB � s z FirewallDConfigIPSet.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove ipset
z %s.remove()N) r r3 r r r< r Z remove_ipsetr Z removeIPSet)r r5 r" r" r# �remove� s zFirewallDConfigIPSet.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r3 r )r r& r" r" r# �Removed� s z FirewallDConfigIPSet.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename ipset
z%s.rename('%s')N) r r2 r r3 r r r< r Z rename_ipsetr �Renamed)r r& r5 r" r" r# �rename� s
zFirewallDConfigIPSet.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r3 r )r r& r" r" r# rH � s z FirewallDConfigIPSet.Renamedc C s t jd| j� | j� d S )Nz%s.getVersion()r )r r3 r rA )r r5 r" r" r# �
getVersion s z FirewallDConfigIPSet.getVersionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setVersion('%s')r )
r r2 r r3 r r r< �listrA rD )r �versionr5 rC r" r" r# �
setVersion s
z FirewallDConfigIPSet.setVersionc C s t jd| j� | j� d S )Nz
%s.getShort()r )r r3 r rA )r r5 r" r" r# �getShort s z FirewallDConfigIPSet.getShortc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setShort('%s')r )
r r2 r r3 r r r< rK rA rD )r Zshortr5 rC r" r" r# �setShort s
z FirewallDConfigIPSet.setShortc C s t jd| j� | j� d S )Nz%s.getDescription()� )r r3 r rA )r r5 r" r" r# �getDescription( s z#FirewallDConfigIPSet.getDescriptionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDescription('%s')rP )
r r2 r r3 r r r< rK rA rD )r � descriptionr5 rC r" r" r# �setDescription/ s
z#FirewallDConfigIPSet.setDescriptionc C s t jd| j� | j� d S )Nz %s.getType()� )r r3 r rA )r r5 r" r" r# �getType= s z FirewallDConfigIPSet.getTypec C s\ t |t�}tjd| j|� | jj|� |tkr:tt j
|��t | j � �}||d< | j
|� d S )Nz%s.setType('%s')rT )r r2 r r3 r r r< r r r Z INVALID_TYPErK rA rD )r Z
ipset_typer5 rC r" r" r# �setTypeD s
z FirewallDConfigIPSet.setTypeza{ss}c C s t jd| j� | j� d S )Nz%s.getOptions()� )r r3 r rA )r r5 r" r" r# �
getOptionsS s z FirewallDConfigIPSet.getOptionsc C sL t |t�}tjd| jt|�� | jj|� t| j � �}||d< | j
|� d S )Nz%s.setOptions('[%s]')rW ) r �dictr r3 r �reprr r< rK rA rD )r Zoptionsr5 rC r" r" r# �
setOptionsZ s
z FirewallDConfigIPSet.setOptionsc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||d krn|d | |krnt t
j d||f ��||d |< | j |� d S )Nz%s.addOption('%s', '%s')rW z
'%s': '%s')
r r2 r r3 r r r< rK rA r r �ALREADY_ENABLEDrD )r �key�valuer5 rC r" r" r# � addOptionf s
z FirewallDConfigIPSet.addOptionc C sb t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d |= | j |� d S )Nz%s.removeOption('%s')rW )
r r2 r r3 r r r< rK rA r r � NOT_ENABLEDrD )r r] r5 rC r" r" r# � removeOptionu s
z!FirewallDConfigIPSet.removeOption�bc C sN t |t�}t |t�}tjd| j||� t| j� �}||d koL|d | |kS )Nz%s.queryOption('%s', '%s')rW )r r2 r r3 r rK rA )r r] r^ r5 rC r" r" r# � queryOption� s
z FirewallDConfigIPSet.queryOption�asc C s t jd| j� | j� d S )Nz%s.getEntries()� )r r3 r rA )r r5 r" r" r# �
getEntries� s z FirewallDConfigIPSet.getEntriesc C s| t |t�}t|� tjd| jdj|�� | jj|� t| j � �}d|d krf|d d dkrft
t j ��||d< | j
|� d S )Nz%s.setEntries('[%s]')�,�timeoutrW �0re )r rK r r r3 r �joinr r< rA r r �IPSET_WITH_TIMEOUTrD )r Zentriesr5 rC r" r" r# �
setEntries� s
z FirewallDConfigIPSet.setEntriesc C s� t |t�}t|�}tjd| j|� | jj|� t| j � �}d|d kr`|d d dkr`t
t j ��||d krxt
t j
|��t||d � |d j|� | j|� d S )Nz%s.addEntry('%s')rh rW ri re )r r2 r r r3 r r r< rK rA r r rk r\ r
�appendrD )r �entryr5 rC r" r" r# �addEntry� s
z FirewallDConfigIPSet.addEntryc C s� t |t�}t|�}tjd| j|� | jj|� t| j � �}d|d kr`|d d dkr`t
t j ��||d krxt
t j
|��|d j|� | j|� d S )Nz%s.removeEntry('%s')rh rW ri re )r r2 r r r3 r r r< rK rA r r rk r` rF rD )r rn r5 rC r" r" r# � removeEntry� s
z FirewallDConfigIPSet.removeEntryc C s` t |t�}t|�}tjd| j|� t| j� �}d|d krT|d d dkrTtt j
��||d kS )Nz%s.queryEntry('%s')rh rW ri re ) r r2 r r r3 r rK rA r r rk )r rn r5 rC r" r" r# �
queryEntry� s
z FirewallDConfigIPSet.queryEntry)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N);�__name__�
__module__� __qualname__�__doc__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr
r r r$ r% r. r ZPROPERTIES_IFACEr6 r; �slipZpolkitZ require_authr= �service�signalr> ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr? r r ZDBUS_SIGNATURErA rD rE rB rF rG rI rH rJ rM rN rO rQ rS rU rV rX r[ r_ ra rc rf rl ro rp rq �
__classcell__r" r" )r! r# r 3 s�
r )"Z
gi.repositoryr �sys�modulesr Z dbus.serviceZ slip.dbusrv Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr r r
r Zfirewall.core.loggerr Zfirewall.server.decoratorsr
r r r Zfirewall.errorsr rw ZObjectr r" r" r" r# �<module> s
server/__pycache__/config_ipset.cpython-36.opt-1.pyc 0000644 00000031650 15035135172 0016327 0 ustar 00 3
��gzI � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZmZmZmZ d dlmZ d d lmZmZmZ d d
l m Z d d l m Z G d d
� d
ejj j �Z!dS )� )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�IPSet)� IPSET_TYPES�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�errors)�
FirewallErrorc s e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z
e d d
� �Zeejd d d
�e dWdd���Zeejddd
�e dXdd���Zejjjejj�eejdd�e dYdd����Zejjejdd�dd � �Zejjjejj�eejdd �e dZ� fd d � ���Z eejj e j d �e d[d d!���Z eejj e j d�e d\d"d#���Z!eejj �e d]d$d%���Z"ejjejj dd�e d&d'� ��Z#eejj �e d^d(d)���Z$ejjejj dd�e d*d+� ��Z%eejj dd�e d_d,d-���Z&ejjejj dd�e d.d/� ��Z'eejj dd �e d`d0d1���Z(eejj dd�e dad2d3���Z)eejj dd �e dbd4d5���Z*eejj dd�e dcd6d7���Z+eejj dd �e ddd8d9���Z,eejj dd�e ded:d;���Z-eejj dd �e dfd<d=���Z.eejj dd�e dgd>d?���Z/eejj d@d �e dhdAdB���Z0eejj d@d�e didCdD���Z1eejj d d�e djdEdF���Z2eejj dd�e dkdGdH���Z3eejj d dId
�e dldJdK���Z4eejj dLd �e dmdMdN���Z5eejj dLd�e dndOdP���Z6eejj dd�e dodQdR���Z7eejj dd�e dpdSdT���Z8eejj ddId
�e dqdUdV���Z9� Z:S )r�FirewallDConfigIPSetzFirewallD main classTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.ipset.%d)
�superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus�DBUS_INTERFACE_CONFIG_IPSET)�selfr ZconfZipsetr �args�kwargs)� __class__� �"/usr/lib/python3.6/config_ipset.pyr ; s
z FirewallDConfigIPSet.__init__c C s d S )Nr" )r r" r" r# �__del__H s z FirewallDConfigIPSet.__del__c C s | j � d S )N)Zremove_from_connection)r r" r" r# �
unregisterL s z FirewallDConfigIPSet.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r& r' r ZBooleanr( r) �
exceptions�
DBusException)r �
property_namer" r" r# �
_get_propertyT s z"FirewallDConfigIPSet._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r+ r, r. )r �interface_namer- �senderr" r" r# �Gete s
zFirewallDConfigIPSet.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr& r' r r( r) Zsv)� signature)r& r' r r( r) ) r r2 r r3 r r r r r+ r, r. Z
Dictionary)r r4 r5 �ret�xr" r" r# �GetAllv s
zFirewallDConfigIPSet.GetAllZssv)r0 c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r2 r r3 r r � accessCheckr r r r+ r, )r r4 r- Z new_valuer5 r" r" r# �Set� s
zFirewallDConfigIPSet.Setzsa{sv}as)r8 c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r2 r r3 r )r r4 Zchanged_propertiesZinvalidated_propertiesr" r" r# �PropertiesChanged� s
z&FirewallDConfigIPSet.PropertiesChanged)r1 c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r r �
Introspectr r Zget_busr r r r )r r5 �data)r! r" r# r? � s
z FirewallDConfigIPSet.Introspectc C s t jd| j� | jj| j�S )z get settings for ipset
z%s.getSettings())r r3 r r Zget_ipset_configr )r r5 r" r" r# � getSettings� s z FirewallDConfigIPSet.getSettingsc C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� dS )z"update settings for ipset
z%s.update('...')N) r r r3 r r r< r Zset_ipset_configr �Updatedr& )r �settingsr5 r" r" r# �update� s
zFirewallDConfigIPSet.updatec C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z0load default settings for builtin ipset
z%s.loadDefaults()N)
r r3 r r r< r Zload_ipset_defaultsr rB r& )r r5 r" r" r# � loadDefaults� s z!FirewallDConfigIPSet.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r3 r )r r& r" r" r# rB � s z FirewallDConfigIPSet.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove ipset
z %s.remove()N) r r3 r r r< r Z remove_ipsetr Z removeIPSet)r r5 r" r" r# �remove� s zFirewallDConfigIPSet.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r3 r )r r& r" r" r# �Removed� s z FirewallDConfigIPSet.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename ipset
z%s.rename('%s')N) r r2 r r3 r r r< r Z rename_ipsetr �Renamed)r r& r5 r" r" r# �rename� s
zFirewallDConfigIPSet.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r3 r )r r& r" r" r# rH � s z FirewallDConfigIPSet.Renamedc C s t jd| j� | j� d S )Nz%s.getVersion()r )r r3 r rA )r r5 r" r" r# �
getVersion s z FirewallDConfigIPSet.getVersionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setVersion('%s')r )
r r2 r r3 r r r< �listrA rD )r �versionr5 rC r" r" r# �
setVersion s
z FirewallDConfigIPSet.setVersionc C s t jd| j� | j� d S )Nz
%s.getShort()r )r r3 r rA )r r5 r" r" r# �getShort s z FirewallDConfigIPSet.getShortc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setShort('%s')r )
r r2 r r3 r r r< rK rA rD )r Zshortr5 rC r" r" r# �setShort s
z FirewallDConfigIPSet.setShortc C s t jd| j� | j� d S )Nz%s.getDescription()� )r r3 r rA )r r5 r" r" r# �getDescription( s z#FirewallDConfigIPSet.getDescriptionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDescription('%s')rP )
r r2 r r3 r r r< rK rA rD )r � descriptionr5 rC r" r" r# �setDescription/ s
z#FirewallDConfigIPSet.setDescriptionc C s t jd| j� | j� d S )Nz %s.getType()� )r r3 r rA )r r5 r" r" r# �getType= s z FirewallDConfigIPSet.getTypec C s\ t |t�}tjd| j|� | jj|� |tkr:tt j
|��t | j � �}||d< | j
|� d S )Nz%s.setType('%s')rT )r r2 r r3 r r r< r r r Z INVALID_TYPErK rA rD )r Z
ipset_typer5 rC r" r" r# �setTypeD s
z FirewallDConfigIPSet.setTypeza{ss}c C s t jd| j� | j� d S )Nz%s.getOptions()� )r r3 r rA )r r5 r" r" r# �
getOptionsS s z FirewallDConfigIPSet.getOptionsc C sL t |t�}tjd| jt|�� | jj|� t| j � �}||d< | j
|� d S )Nz%s.setOptions('[%s]')rW ) r �dictr r3 r �reprr r< rK rA rD )r Zoptionsr5 rC r" r" r# �
setOptionsZ s
z FirewallDConfigIPSet.setOptionsc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||d krn|d | |krnt t
j d||f ��||d |< | j |� d S )Nz%s.addOption('%s', '%s')rW z
'%s': '%s')
r r2 r r3 r r r< rK rA r r �ALREADY_ENABLEDrD )r �key�valuer5 rC r" r" r# � addOptionf s
z FirewallDConfigIPSet.addOptionc C sb t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d |= | j |� d S )Nz%s.removeOption('%s')rW )
r r2 r r3 r r r< rK rA r r � NOT_ENABLEDrD )r r] r5 rC r" r" r# � removeOptionu s
z!FirewallDConfigIPSet.removeOption�bc C sN t |t�}t |t�}tjd| j||� t| j� �}||d koL|d | |kS )Nz%s.queryOption('%s', '%s')rW )r r2 r r3 r rK rA )r r] r^ r5 rC r" r" r# � queryOption� s
z FirewallDConfigIPSet.queryOption�asc C s t jd| j� | j� d S )Nz%s.getEntries()� )r r3 r rA )r r5 r" r" r# �
getEntries� s z FirewallDConfigIPSet.getEntriesc C s| t |t�}t|� tjd| jdj|�� | jj|� t| j � �}d|d krf|d d dkrft
t j ��||d< | j
|� d S )Nz%s.setEntries('[%s]')�,�timeoutrW �0re )r rK r r r3 r �joinr r< rA r r �IPSET_WITH_TIMEOUTrD )r Zentriesr5 rC r" r" r# �
setEntries� s
z FirewallDConfigIPSet.setEntriesc C s� t |t�}t|�}tjd| j|� | jj|� t| j � �}d|d kr`|d d dkr`t
t j ��||d krxt
t j
|��t||d � |d j|� | j|� d S )Nz%s.addEntry('%s')rh rW ri re )r r2 r r r3 r r r< rK rA r r rk r\ r
�appendrD )r �entryr5 rC r" r" r# �addEntry� s
z FirewallDConfigIPSet.addEntryc C s� t |t�}t|�}tjd| j|� | jj|� t| j � �}d|d kr`|d d dkr`t
t j ��||d krxt
t j
|��|d j|� | j|� d S )Nz%s.removeEntry('%s')rh rW ri re )r r2 r r r3 r r r< rK rA r r rk r` rF rD )r rn r5 rC r" r" r# � removeEntry� s
z FirewallDConfigIPSet.removeEntryc C s` t |t�}t|�}tjd| j|� t| j� �}d|d krT|d d dkrTtt j
��||d kS )Nz%s.queryEntry('%s')rh rW ri re ) r r2 r r r3 r rK rA r r rk )r rn r5 rC r" r" r# �
queryEntry� s
z FirewallDConfigIPSet.queryEntry)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N);�__name__�
__module__� __qualname__�__doc__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr
r r r$ r% r. r ZPROPERTIES_IFACEr6 r; �slipZpolkitZ require_authr= �service�signalr> ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr? r r ZDBUS_SIGNATURErA rD rE rB rF rG rI rH rJ rM rN rO rQ rS rU rV rX r[ r_ ra rc rf rl ro rp rq �
__classcell__r" r" )r! r# r 3 s�
r )"Z
gi.repositoryr �sys�modulesr Z dbus.serviceZ slip.dbusrv Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr r r
r Zfirewall.core.loggerr Zfirewall.server.decoratorsr
r r r Zfirewall.errorsr rw ZObjectr r" r" r" r# �<module> s
server/__pycache__/config.cpython-36.opt-1.pyc 0000644 00000127767 15035135172 0015142 0 ustar 00 3
��g� � @ sd d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl Zd dl
m Z d dl m
Z
d dlmZ d dlmZ d dlmZmZmZ d d lmZ d d
lmZ d d lmZ d d l m Z d d
l m Z d dl m!Z! d dl"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z+ d dl,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3 d dl
m4Z4 d dl5m6Z6 G dd� dejj7j8�Z9dS )� )�GObjectNZgobject)�config)�DEFAULT_ZONE_TARGET)�Watcher)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�FirewallDConfigIcmpType)�FirewallDConfigService)�FirewallDConfigZone)�FirewallDConfigPolicy)�FirewallDConfigIPSet)�FirewallDConfigHelper)�IcmpType)�IPSet)�Helper)�LockdownWhitelist)�Direct)�dbus_to_python�command_of_sender�context_of_sender�
uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�errors)�
FirewallErrorc s@ e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z e d d
� �Z
e d d � �Ze d
d� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd � �Ze d d � �Ze d d � �Ze d!d"� �Ze d#d$� �Ze d%d&� �Ze d'd(� �Z e d)d*� �Z e d+d,� �Z e d-d.� �Z e d/d0� �Z e!d1d2� �Z"e!d3d4� �Z#e!d5d6� �Z$e%ej&d7d8d9�e!d�d;d<���Z'e%ej&d=d>d9�e!d�d?d@���Z(e)jj*j+ejj�e%ej&dAdB�e!d�dCdD����Z,ej-j.ej&dEdF�dGdH� �Z/e)jj*j+ejj0�e%ej1d=dI�e!d� fdJdK� ���Z2e%ejj3e4j5dI�e!d�dLdM���Z6e%ejj3e4j5dB�e!d�dNdO���Z7ej-j.ejj3�e!dPdQ� ��Z8e%ejj3d=dB�e!d�dRdS���Z9e%ejj3d=dB�e!d�dTdU���Z:e%ejj3d=dVd9�e!d�dWdX���Z;e%ejj3dYdI�e!d�dZd[���Z<e%ejj3d=dB�e!d�d\d]���Z=e%ejj3d=dB�e!d�d^d_���Z>e%ejj3d=dVd9�e!d�d`da���Z?e%ejj3dYdI�e!d�dbdc���Z@e%ejj3d=dB�e!d�ddde���ZAe%ejj3d=dB�e!d�dfdg���ZBe%ejj3d=dVd9�e!d�dhdi���ZCe%ejj3dYdI�e!d�djdk���ZDe%ejj3dldB�e!�d dmdn���ZEe%ejj3dldB�e!�ddodp���ZFe%ejj3dldVd9�e!�ddqdr���ZGe%ejj3dsdI�e!�ddtdu���ZHe%ejjIdvdI�e!�ddwdx���ZJe%ejjIdYdI�e!�ddydz���ZKe%ejjId=d{d9�e!�dd|d}���ZLe%ejjId=eMj5 d{d9�e!�dd~d���ZNej-j.ejjId=dF�e!d�d�� ��ZOe%ejjIdvdI�e!�dd�d����ZPe%ejjIdYdI�e!�d d�d����ZQe%ejjId=d{d9�e!�d
d�d����ZRe%ejjId=eSj5 d{d9�e!�d d�d����ZTej-j.ejjId=dF�e!d�d�� ��ZUe%ejjIdvdI�e!�d d�d����ZVe%ejjIdYdI�e!�d
d�d����ZWe%ejjId=d{d9�e!�dd�d����ZXe%ejjId�d{d9�e!�dd�d����ZYe%ejjId�d{d9�e!�dd�d����ZZej-j.ejjId=dF�e!d�d�� ��Z[e%ejjIdvdI�e!�dd�d����Z\e%ejjIdYdI�e!�dd�d����Z]e%ejjId=d{d9�e!�dd�d����Z^e%ejjId=d=d9�e!�dd�d����Z_e%ejjId=d=d9�e!�dd�d����Z`e%ejjId�d{d9�e!�dd�d����Zae%ejjId�d{d9�e!�dd�d����Zbej-j.ejjId=dF�e!d�d�� ��Zce%ejjIdvdI�e!�dd�d����Zde%ejjIdYdI�e!�dd�d����Zee%ejjId=d{d9�e!�dd�d����Zfe%ejjId�d{d9�e!�dd�d����Zgej-j.ejjId=dF�e!d�d�� ��Zhe%ejjIdvdI�e!�d d�d����Zie%ejjIdYdI�e!�d d�d����Zje%ejjId=d{d9�e!�d d�d����Zke%ejjId=elj5 d{d9�e!�d d�d����Zmej-j.ejjId=dF�e!d�d�� ��Zne%ejjoepj5dI�e!�d d�d����Zqe%ejjoepj5dB�e!�d!d�d��Zrej-j.ejjo�e!d�dĄ ��Zse%ejjod�dB�e!�d"d�dDŽ��Zte%ejjod�dB�e!�d#d�dɄ��Zue%ejjod�dVd9�e!�d$d�d˄��Zve%ejjod7dYd9�e!�d%d�d̈́��Zwe%ejjod�d�d9�e!�d&d�dф��Zxe%ejjod�dB�e!�d'd�dԄ��Zye%ejjod�dB�e!�d(d�dք��Zze%ejjod�dVd9�e!�d)d�d��Z{e%ejjod�dB�e!�d*d�dڄ��Z|e%ejjod�d�d9�e!�d+d�d݄��Z}e%ejjod�d�d9�e!�d,d�d���Z~e%ejjod�dB�e!�d-d�d���Ze%ejjod�dB�e!�d.d�d���Z�e%ejjod�dVd9�e!�d/d�d���Z�e%ejjod=d�d9�e!�d0d�d���Z�e%ejjod�dI�e!�d1d�d���Z�� Z�S (2 �FirewallDConfigzFirewallD main classTc s� t t| �j||� || _|d | _|d | _| j� t| jd�| _ | j j
tj � | j j
tj � | j j
tj
� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� tjjtj��r>xBttjtj��D ].}dtj|f }tjj|��r | j j
|� �q W | j j tj � | j j tj � | j j tj � t | tj!j"ddddddddddddd� � d S )Nr � � z%s/%sZ readwrite) �
CleanupOnExit�CleanupModulesOnExit�
IPv6_rpfilter�Lockdown� MinimalMark�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDrifting)#�superr �__init__r �busname�path�
_init_varsr �
watch_updater�watcher�
add_watch_dir�FIREWALLD_IPSETS�ETC_FIREWALLD_IPSETS�FIREWALLD_ICMPTYPES�ETC_FIREWALLD_ICMPTYPES�FIREWALLD_HELPERS�ETC_FIREWALLD_HELPERS�FIREWALLD_SERVICES�ETC_FIREWALLD_SERVICES�FIREWALLD_ZONES�ETC_FIREWALLD_ZONES�FIREWALLD_POLICIES�ETC_FIREWALLD_POLICIES�os�exists�sorted�listdir�isdirZadd_watch_file�LOCKDOWN_WHITELIST�FIREWALLD_DIRECT�FIREWALLD_CONFr �dbus�DBUS_INTERFACE_CONFIG)�selfZconf�args�kwargs�filenamer0 )� __class__� � /usr/lib/python3.6/config.pyr. F sP
zFirewallDConfig.__init__c C s2 g | _ d| _g | _d| _g | _d| _g | _d| _g | _d| _ g | _
d| _ x$| j j
� D ]}| j| j j|�� qTW x$| j j� D ]}| j| j j|�� qzW x$| j j� D ]}| j| j j|�� q�W x$| j j� D ]}| j| j j|�� q�W x$| j j� D ]}| j| j j|�� q�W x&| j j � D ]}| j | j j |�� �qW d S )Nr ) �ipsets� ipset_idx� icmptypes� icmptype_idx�services� service_idx�zones�zone_idx�helpers�
helper_idx�policy_objects�policy_object_idxr Z
get_ipsets� _addIPSetZ get_ipsetZ
get_icmptypes� _addIcmpTypeZ get_icmptypeZ get_services� _addServiceZ get_serviceZ get_zones�_addZoneZget_zoneZ get_helpers�
_addHelperZ
get_helperZget_policy_objects�
_addPolicyZget_policy_object)rK �ipset�icmptype�service�zone�helper�policyrP rP rQ r1 t s0 zFirewallDConfig._init_varsc C s d S )NrP )rK rP rP rQ �__del__� s zFirewallDConfig.__del__c C s� x&t | j�dkr&| jj� }|j� ~qW x&t | j�dkrN| jj� }|j� ~q*W x&t | j�dkrv| jj� }|j� ~qRW x&t | j�dkr�| jj� }|j� ~qzW x&t | j�dkr�| jj� }|j� ~q�W x&t | j�dkr�| jj� }|j� ~q�W | j � d S )Nr )
�lenrR �pop�
unregisterrT rV rX rZ r\ r1 )rK �itemrP rP rQ �reload� s2
zFirewallDConfig.reloadc C sJ |t jkr�| jt jj�}tjdt j� y| j j� W n2 tk
rf } ztj d||f � d S d }~X nX | jt jj�j
� }x2t |j � �D ]"}||kr�|| || kr�||= q�W t
|�dkr�| jt jj|g � d S |jt j�s�|jt j�o�|jd��r�y| j j|�\}}W n4 tk
�r< } ztj d||f � d S d }~X nX |dk�rT| j|� n*|dk�rj| j|� n|dk�rF| j|� �n�|jt j��s�|jt j��r8|jd��r8y| j j|�\}}W n4 tk
�r� } ztj d ||f � d S d }~X nX |dk�r
| j|� n*|dk�r | j|� n|dk�rF| j |� �n|jt j ��sT|jt j ��rr|jd��r�y| j j |�\}}W n4 tk
�r� } ztj d
||f � d S d }~X nX |dk�r�| j |� n*|dk�r�| j!|� n|dk�rn| j"|� n�|jt j ��rF|j#t j d �j$d �}t
|�d
k �s&d |k�r*d S t%j&j'|��rT| j(j)|��sn| j(j*|� n| j(j)|��rF| j(j+|� �n�|jt j,��s�|jt j-��r(|jd��r(y| j j.|�\}}W n4 tk
�r� } ztj d||f � d S d }~X nX |dk�r�| j/|� n*|dk�r| j0|� n|dk�rF| j1|� �n |jt j2��sD|jt j3��r�|jd��r�y| j j4|�\}}W n4 tk
�r� } ztj d||f � d S d }~X nX |dk�r�| j5|� n*|dk�r�| j6|� n|dk�rF| j7|� �nh|t j8k�r:y| j j9� W n4 tk
�r, } ztj d||f � d S d }~X nX | j:� �n |t j;k�r�y| j j<� W n4 tk
�r� } ztj d||f � d S d }~X nX | j=� n�|jt j>��s�|jt j?��rF|jd��rFy| j j@|�\}}W n4 tk
�r } ztj d||f � d S d }~X nX |dk�r | jA|� n*|dk�r2| jB|� n|dk�rF| jC|� d S )Nz,config: Reloading firewalld config file '%s'z+Failed to load firewalld.conf file '%s': %sr z.xmlz%Failed to load icmptype file '%s': %s�new�remove�updatez$Failed to load service file '%s': %sz!Failed to load zone file '%s': %s� �/r z"Failed to load ipset file '%s': %sz#Failed to load helper file '%s': %sz/Failed to load lockdown whitelist file '%s': %sz)Failed to load direct rules file '%s': %sz#Failed to load policy file '%s': %s)Dr rH �GetAllrI rJ r �debug1Zupdate_firewalld_conf� Exception�error�copy�list�keysrk �PropertiesChanged�
startswithr7 r8 �endswithZupdate_icmptype_from_pathr_ �removeIcmpType�_updateIcmpTyper; r< Zupdate_service_from_pathr` �
removeService�_updateServicer= r> Zupdate_zone_from_pathra �
removeZone� _updateZone�replace�striprA r0 rE r3 Z has_watchr4 Z remove_watchr5 r6 Zupdate_ipset_from_pathr^ � removeIPSet� _updateIPSetr9 r: Zupdate_helper_from_pathrb � removeHelper�
_updateHelperrF Zupdate_lockdown_whitelist�LockdownWhitelistUpdatedrG Z
update_direct�Updatedr? r@ Z update_policy_object_from_pathrc � removePolicy�
_updatePolicy) rK �nameZ old_props�msgZprops�keyZwhat�obj�_namerP rP rQ r2 � s
z FirewallDConfig.watch_updaterc C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r
r rU r/ rI ZDBUS_PATH_CONFIG_ICMPTYPErT �append�
IcmpTypeAddedr� )rK r� �config_icmptyperP rP rQ r_ A s z FirewallDConfig._addIcmpTypec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rT r� r� r0 rN r� )rK r� re rP rP rQ r� M s z FirewallDConfig._updateIcmpTypec C s� d}xT| j D ]J}|j� }|j|| kr || j|j� | jj|j|�|_|j|jj� q W x\| jD ]R}|j� }d|krb|j|d krb|d j|j� | jj |j|�|_|j|jj� qbW x:| j
D ]0}|j|kr�|j |j� |j � | j
j|� ~q�W d S )N� Z icmp_blocks)
rX � getSettingsr� rq r �set_zone_configr� r� r\ � set_policy_object_config_dictrT �Removedrm )rK r� �indexrg �settingsri re rP rP rQ r V s&
z FirewallDConfig.removeIcmpTypec C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r rW r/ rI ZDBUS_PATH_CONFIG_SERVICErV r� � ServiceAddedr� )rK r� �config_servicerP rP rQ r` p s zFirewallDConfig._addServicec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rV r� r� r0 rN r� )rK r� rf rP rP rQ r� { s z FirewallDConfig._updateServicec C s� d}xT| j D ]J}|j� }|j|| kr || j|j� | jj|j|�|_|j|jj� q W x\| jD ]R}|j� }d|krb|j|d krb|d j|j� | jj |j|�|_|j|jj� qbW x:| j
D ]0}|j|kr�|j |j� |j � | j
j|� ~q�W d S )Nr rV )
rX r� r� rq r r� r� r� r\ r� rV r� rm )rK r� r� rg r� ri rf rP rP rQ r� � s&
z FirewallDConfig.removeServicec C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r rY r/ rI ZDBUS_PATH_CONFIG_ZONErX r� � ZoneAddedr� )rK r� � config_zonerP rP rQ ra � s zFirewallDConfig._addZonec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rX r� r� r0 rN r� )rK r� rg rP rP rQ r� � s
zFirewallDConfig._updateZonec C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)rX r� r� r� rm rq )rK r� rg rP rP rQ r� � s
zFirewallDConfig.removeZonec C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r
r r] r/ rI ZDBUS_PATH_CONFIG_POLICYr\ r� � PolicyAddedr� )rK r� �
config_policyrP rP rQ rc � s zFirewallDConfig._addPolicyc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)r\ r� r� r0 rN r� )rK r� ri rP rP rQ r� � s
z FirewallDConfig._updatePolicyc C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)r\ r� r� r� rm rq )rK r� ri rP rP rQ r� � s
z FirewallDConfig.removePolicyc C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r rS r/ rI ZDBUS_PATH_CONFIG_IPSETrR r� �
IPSetAddedr� )rK r� � config_ipsetrP rP rQ r^ � s zFirewallDConfig._addIPSetc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rR r� r� r0 rN r� )rK r� rd rP rP rQ r� � s
z FirewallDConfig._updateIPSetc C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)rR r� r� r� rm rq )rK r� rd rP rP rQ r� � s
zFirewallDConfig.removeIPSetc C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r r[ r/ rI ZDBUS_PATH_CONFIG_HELPERrZ r� � HelperAddedr� )rK r� �
config_helperrP rP rQ rb � s zFirewallDConfig._addHelperc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rZ r� r� r0 rN r� )rK r� rh rP rP rQ r� � s
z FirewallDConfig._updateHelperc C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)rZ r� r� r� rm rq )rK r� rh rP rP rQ r� s
z FirewallDConfig.removeHelperc C s� | j j� r�|d kr tjd� d S tj� }t||�}| j jd|�rDd S t||�}| j jd|�r`d S t |�}| j jd|�rzd S t
||�}| j jd|�r�d S t t j
d��d S )Nz&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r Zlockdown_enabledr rx rI Z SystemBusr Z access_checkr r r r r Z
ACCESS_DENIED)rK �senderZbusr� r� r� r� rP rP rQ � accessCheck s$
zFirewallDConfig.accessCheckc C sF |dkrt jjd| ��| jj� j|�}|dkrH|d kr>tj}t j|�S |dkrr|d kr`tj}nt |�}t j
|�S |dkr�|d kr�tj r�dnd}t j|�S |dkr�|d kr�tj r�dnd}t j|�S |dk� r�|d k� r�tj
� r�dnd}t j|�S |dk�r |d k�rtj�rdnd}t j|�S |dk�rL|d k�rBtj�r>dnd}t j|�S |dk�rp|d k�rftj}t j|�S |d k�r�|d k�r�tj}t j|�S |d
k�r�|d k�r�tj}t j|�S |d k�r�|d k�r�tj�r�dnd}t j|�S |d k�r|d k�r
tj�rdnd}t j|�S |d
k�rB|d k�r8tj�r4dnd}t j|�S d S )N� DefaultZoner% r! r" r$ r# r& r' r( r) r* r+ r, zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist�yes�no)
r� r% r! r" r$ r# r& r' r( r) r* r+ r, )rI �
exceptions�
DBusExceptionr �get_firewalld_conf�getZ
FALLBACK_ZONE�StringZFALLBACK_MINIMAL_MARK�int�Int32ZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTING)rK �prop�valuerP rP rQ �
_get_property+ s|
z FirewallDConfig._get_propertyc C sT |dkrt j| j|��S |dkr0t j| j|��S |dkrHt j| j|��S |dkr`t j| j|��S |dkrxt j| j|��S |dkr�t j| j|��S |dkr�t j| j|��S |dkr�t j| j|��S |d kr�t j| j|��S |d
k� r�t j| j|��S |d k�r t j| j|��S |d k�r&t j| j|��S |d
k�r@t j| j|��S t jjd| ��d S )Nr� r% r! r" r$ r# r& r' r( r) r* r+ r, zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist)rI r� r� r� r� r� )rK r� rP rP rQ �_get_dbus_propertyo s:
z"FirewallDConfig._get_dbus_propertyZss�v)� in_signature�
out_signatureNc C sx t |t�}t |t�}tjd||� |tjjkr8| j|�S |tjjtjj gkr^tj
j d| ��ntj
j d| ��| j|�S )Nzconfig.Get('%s', '%s')zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr rv r rI rJ r� � DBUS_INTERFACE_CONFIG_DIRECT� DBUS_INTERFACE_CONFIG_POLICIESr� r� )rK �interface_name�
property_namer� rP rP rQ �Get� s
zFirewallDConfig.Get�sza{sv}c
C sx t |t�}tjd|� i }|tjjkrDxBdD ]}| j|�||< q,W n&|tjjtjj gkrZntj
j d| ��tj |dd�S )Nzconfig.GetAll('%s')r� r% r! r" r$ r# r& r' r( r) r* r+ r, zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existZsv)� signature)
r� r% r! r" r$ r# r& r' r( r) r* r+ r, )
r r� r rv r rI rJ r� r� r� r� r� Z
Dictionary)rK r� r� �ret�xrP rP rQ ru � s"
zFirewallDConfig.GetAllZssv)r� c C s� t |t�}t |t�}t |�}tjd|||� | j|� |tjjk�r�|dk�rz|dkrv|j� dkrvt t
j d||f ��|dkr�|tj kr�t t
j d||f ��|dkr�|tj
kr�t t
j d||f ��|d k� r�|j� dk� r�t t
j d||f ��|d
k�r|j� dk�rt t
j d||f ��|d k�rF|j� dk�rFt t
j d||f ��| jj� j||� | jj� j� | j|||ig � n |dk�r�ntjjd| ��n8|tjjtjjgk�r�tjjd| ��ntjjd| ��d S ) Nz config.Set('%s', '%s', '%s')r! r$ r" r# r& r' r) r* r+ r, r� r� �true�falsez '%s' for %sr% r( zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)
r! r$ r" r# r& r' r) r* r+ r, )r! r$ r" r# r& )r� r� r� r� )r� r� r� r� )r� r� r� r� )r� r� r� r� )r% r( )r r� r rv r� r rI rJ �lowerr r Z
INVALID_VALUEZLOG_DENIED_VALUESZFIREWALL_BACKEND_VALUESr� �set�writer| r� r� r� r� )rK r� r� Z new_valuer� rP rP rQ �Set� sz
zFirewallDConfig.Setzsa{sv}as)r� c C s. t |t�}t |�}t |�}tjd|||� d S )Nz*config.PropertiesChanged('%s', '%s', '%s'))r r� r rv )rK r� Zchanged_propertiesZinvalidated_propertiesrP rP rQ r| s
z!FirewallDConfig.PropertiesChanged)r� c s4 t jd� tt| �j| j| jj� �}t| |t j
j �S )Nzconfig.Introspect()) r Zdebug2r- r �
Introspectr0 r/ Zget_busr r rI rJ )rK r� �data)rO rP rQ r� s
zFirewallDConfig.Introspectc C s t jd� | jj� jj� S )Nz&config.policies.getLockdownWhitelist())r rv r � get_policies�lockdown_whitelist�
export_config)rK r� rP rP rQ �getLockdownWhitelist s
z$FirewallDConfig.getLockdownWhitelistc C s@ t jd� t|�}| jj� jj|� | jj� jj� | j� d S )Nz)config.policies.setLockdownWhitelist(...)) r rv r r r� r� �
import_configr� r� )rK r� r� rP rP rQ �setLockdownWhitelist& s
z$FirewallDConfig.setLockdownWhitelistc C s t jd� d S )Nz*config.policies.LockdownWhitelistUpdated())r rv )rK rP rP rQ r� 0 s z(FirewallDConfig.LockdownWhitelistUpdatedc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz1config.policies.addLockdownWhitelistCommand('%s')r ) r r rv r� rz r� r r �ALREADY_ENABLEDr� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistCommand7 s
z+FirewallDConfig.addLockdownWhitelistCommandc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz4config.policies.removeLockdownWhitelistCommand('%s')r ) r r rv r� rz r� r r � NOT_ENABLEDrq r� )rK r� r� r� rP rP rQ � removeLockdownWhitelistCommandD s
z.FirewallDConfig.removeLockdownWhitelistCommand�bc C s$ t |�}tjd|� || j� d kS )Nz3config.policies.queryLockdownWhitelistCommand('%s')r )r r rv r� )rK r� r� rP rP rQ � queryLockdownWhitelistCommandR s z-FirewallDConfig.queryLockdownWhitelistCommand�asc C s t jd� | j� d S )Nz.config.policies.getLockdownWhitelistCommands()r )r rv r� )rK r� rP rP rQ � getLockdownWhitelistCommands[ s
z,FirewallDConfig.getLockdownWhitelistCommandsc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz1config.policies.addLockdownWhitelistContext('%s')r ) r r rv r� rz r� r r r� r� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistContextd s
z+FirewallDConfig.addLockdownWhitelistContextc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz4config.policies.removeLockdownWhitelistContext('%s')r ) r r rv r� rz r� r r r� rq r� )rK r� r� r� rP rP rQ � removeLockdownWhitelistContextq s
z.FirewallDConfig.removeLockdownWhitelistContextc C s$ t |�}tjd|� || j� d kS )Nz3config.policies.queryLockdownWhitelistContext('%s')r )r r rv r� )rK r� r� rP rP rQ � queryLockdownWhitelistContext s z-FirewallDConfig.queryLockdownWhitelistContextc C s t jd� | j� d S )Nz.config.policies.getLockdownWhitelistContexts()r )r rv r� )rK r� rP rP rQ � getLockdownWhitelistContexts� s
z,FirewallDConfig.getLockdownWhitelistContextsc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz.config.policies.addLockdownWhitelistUser('%s')� ) r r rv r� rz r� r r r� r� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistUser� s
z(FirewallDConfig.addLockdownWhitelistUserc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz1config.policies.removeLockdownWhitelistUser('%s')r� ) r r rv r� rz r� r r r� rq r� )rK r� r� r� rP rP rQ �removeLockdownWhitelistUser� s
z+FirewallDConfig.removeLockdownWhitelistUserc C s$ t |�}tjd|� || j� d kS )Nz0config.policies.queryLockdownWhitelistUser('%s')r� )r r rv r� )rK r� r� rP rP rQ �queryLockdownWhitelistUser� s z*FirewallDConfig.queryLockdownWhitelistUserc C s t jd� | j� d S )Nz+config.policies.getLockdownWhitelistUsers()r� )r rv r� )rK r� rP rP rQ �getLockdownWhitelistUsers� s
z)FirewallDConfig.getLockdownWhitelistUsers�ic C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz+config.policies.addLockdownWhitelistUid(%d)� ) r r rv r� rz r� r r r� r� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistUid� s
z'FirewallDConfig.addLockdownWhitelistUidc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz.config.policies.removeLockdownWhitelistUid(%d)r� ) r r rv r� rz r� r r r� rq r� )rK r� r� r� rP rP rQ �removeLockdownWhitelistUid� s
z*FirewallDConfig.removeLockdownWhitelistUidc C s$ t |�}tjd|� || j� d kS )Nz-config.policies.queryLockdownWhitelistUid(%d)r� )r r rv r� )rK r� r� rP rP rQ �queryLockdownWhitelistUid� s z)FirewallDConfig.queryLockdownWhitelistUidZaic C s t jd� | j� d S )Nz*config.policies.getLockdownWhitelistUids()r� )r rv r� )rK r� rP rP rQ �getLockdownWhitelistUids� s
z(FirewallDConfig.getLockdownWhitelistUidsZaoc C s t jd� | jS )z"list ipsets objects paths
zconfig.listIPSets())r rv rR )rK r� rP rP rQ �
listIPSets� s
zFirewallDConfig.listIPSetsc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget ipset names
zconfig.getIPSetNames())r rv rR r� r� r� rC )rK r� rR r� rP rP rQ �
getIPSetNames� s
z FirewallDConfig.getIPSetNames�oc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z-object path of ipset with given name
zconfig.getIPSetByName('%s')N)
r r� r rv rR r� r� r r Z
INVALID_IPSET)rK rd r� r� rP rP rQ �getIPSetByName� s
z FirewallDConfig.getIPSetByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z/add ipset with given name and settings
zconfig.addIPSet('%s'))r r� r rv r� r Z new_ipsetr^ )rK rd r� r� r� r� rP rP rQ �addIPSet s
zFirewallDConfig.addIPSetc C s t |t�}tjd| � d S )Nzconfig.IPSetAdded('%s'))r r� r rv )rK rd rP rP rQ r� s
zFirewallDConfig.IPSetAddedc C s t jd� | jS )z%list icmptypes objects paths
zconfig.listIcmpTypes())r rv rT )rK r� rP rP rQ �
listIcmpTypes s
z FirewallDConfig.listIcmpTypesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget icmptype names
zconfig.getIcmpTypeNames())r rv rT r� r� r� rC )rK r� rT r� rP rP rQ �getIcmpTypeNames( s
z FirewallDConfig.getIcmpTypeNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z0object path of icmptype with given name
z config.getIcmpTypeByName('%s')N)
r r� r rv rT r� r� r r ZINVALID_ICMPTYPE)rK re r� r� rP rP rQ �getIcmpTypeByName3 s
z!FirewallDConfig.getIcmpTypeByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z2add icmptype with given name and settings
zconfig.addIcmpType('%s'))r r� r rv r� r Z new_icmptyper_ )rK re r� r� r� r� rP rP rQ � addIcmpType@ s
zFirewallDConfig.addIcmpTypec C s t jd| � d S )Nzconfig.IcmpTypeAdded('%s'))r rv )rK re rP rP rQ r� O s z FirewallDConfig.IcmpTypeAddedc C s t jd� | jS )z$list services objects paths
zconfig.listServices())r rv rV )rK r� rP rP rQ � listServicesV s
z FirewallDConfig.listServicesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget service names
zconfig.getServiceNames())r rv rV r� r� r� rC )rK r� rV r� rP rP rQ �getServiceNames^ s
z FirewallDConfig.getServiceNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z/object path of service with given name
z config.getServiceByName('%s')N)
r r� r rv rV r� r� r r ZINVALID_SERVICE)rK rf r� r� rP rP rQ �getServiceByNamei s
z FirewallDConfig.getServiceByNamezs(sssa(ss)asa{ss}asa(ss))c C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z1add service with given name and settings
zconfig.addService('%s'))r r� r rv r� r Z new_servicer` )rK rf r� r� r� r� rP rP rQ �
addServicev s
zFirewallDConfig.addServicezsa{sv}c C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z1add service with given name and settings
zconfig.addService2('%s'))r r� r rv r� r Znew_service_dictr` )rK rf r� r� r� r� rP rP rQ � addService2� s
zFirewallDConfig.addService2c C s t jd| � d S )Nzconfig.ServiceAdded('%s'))r rv )rK rf rP rP rQ r� � s z FirewallDConfig.ServiceAddedc C s t jd� | jS )z!list zones objects paths
zconfig.listZones())r rv rX )rK r� rP rP rQ � listZones� s
zFirewallDConfig.listZonesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget zone names
zconfig.getZoneNames())r rv rX r� r� r� rC )rK r� rX r� rP rP rQ � getZoneNames� s
z FirewallDConfig.getZoneNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z,object path of zone with given name
zconfig.getZoneByName('%s')N)
r r� r rv rX r� r� r r Z INVALID_ZONE)rK rg r� r� rP rP rQ �
getZoneByName� s
z FirewallDConfig.getZoneByNamec C sz t |t�}tjd|� g }x(| jD ] }||jjkr"|j|jj� q"W t |�dkrjdj
|�d|t |�f S |rv|d S dS )z4name of zone the given interface belongs to
z config.getZoneOfInterface('%s')r � zE (ERROR: interface '%s' is in %s zone XML files, can be only in one)r rs ) r r� r rv rX r� Z
interfacesr� r� rk �join)rK Zifacer� r� r� rP rP rQ �getZoneOfInterface� s
z"FirewallDConfig.getZoneOfInterfacec C sz t |t�}tjd|� g }x(| jD ] }||jjkr"|j|jj� q"W t |�dkrjdj
|�d|t |�f S |rv|d S dS )z1name of zone the given source belongs to
z config.getZoneOfSource('%s')r r� zB (ERROR: source '%s' is in %s zone XML files, can be only in one)r rs ) r r� r rv rX r� Zsourcesr� r� rk r )rK �sourcer� r� r� rP rP rQ �getZoneOfSource� s
z FirewallDConfig.getZoneOfSourcez's(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sh t |t�}t |�}tjd|� | j|� |d dkrLt|�}t|d< t|�}| jj ||�}| j
|�}|S )z.add zone with given name and settings
zconfig.addZone('%s')� �default) r r� r rv r� rz r �tupler Znew_zonera )rK rg r� r� Z _settingsr� r� rP rP rQ �addZone� s
zFirewallDConfig.addZonec C s` t |t�}t |�}tjd|� | j|� d|krD|d dkrDt|d< | jj||�}| j|�}|S )z.add zone with given name and settings
zconfig.addZone('%s')�targetr ) r r� r rv r� r r Z
new_zone_dictra )rK rg r� r� r� r� rP rP rQ �addZone2� s
zFirewallDConfig.addZone2c C s t jd| � d S )Nzconfig.ZoneAdded('%s'))r rv )rK rg rP rP rQ r� s zFirewallDConfig.ZoneAddedc C s t jd� | jS )z$list policies objects paths
zconfig.listPolicies())r rv r\ )rK r� rP rP rQ � listPolicies s
z FirewallDConfig.listPoliciesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget policy names
zconfig.getPolicyNames())r rv r\ r� r� r� rC )rK r� Zpoliciesr� rP rP rQ �getPolicyNames s
z FirewallDConfig.getPolicyNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z.object path of policy with given name
z config.getPolicyByName('%s')N)
r r� r rv r\ r� r� r r ZINVALID_POLICY)rK ri r� r� rP rP rQ �getPolicyByName" s
z FirewallDConfig.getPolicyByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z0add policy with given name and settings
zconfig.addPolicy('%s'))r r� r rv r� r Znew_policy_object_dictrc )rK ri r� r� r� r� rP rP rQ � addPolicy/ s
zFirewallDConfig.addPolicyc C s t jd| � d S )Nzconfig.PolicyAdded('%s'))r rv )rK ri rP rP rQ r� > s zFirewallDConfig.PolicyAddedc C s t jd� | jS )z#list helpers objects paths
zconfig.listHelpers())r rv rZ )rK r� rP rP rQ � listHelpersG s
zFirewallDConfig.listHelpersc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget helper names
zconfig.getHelperNames())r rv rZ r� r� r� rC )rK r� rZ r� rP rP rQ �getHelperNamesO s
z FirewallDConfig.getHelperNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z.object path of helper with given name
z config.getHelperByName('%s')N)
r r� r rv rZ r� r� r r ZINVALID_HELPER)rK rh r� r� rP rP rQ �getHelperByNameZ s
z FirewallDConfig.getHelperByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z0add helper with given name and settings
zconfig.addHelper('%s'))r r� r rv r� r Z
new_helperrb )rK rh r� r� r� r� rP rP rQ � addHelperg s
zFirewallDConfig.addHelperc C s t |t�}tjd| � d S )Nzconfig.HelperAdded('%s'))r r� r rv )rK rh rP rP rQ r� v s
zFirewallDConfig.HelperAddedc C s t jd� | jj� j� S )Nzconfig.direct.getSettings())r rv r �
get_directr� )rK r� rP rP rQ r� s
zFirewallDConfig.getSettingsc C s< t jd� t|�}| jj� j|� | jj� j� | j� d S )Nzconfig.direct.update())r rv r r r r� r� r� )rK r� r� rP rP rQ rr � s
zFirewallDConfig.updatec C s t jd� d S )Nzconfig.direct.Updated())r rv )rK rP rP rQ r� � s zFirewallDConfig.UpdatedZsssc C s� t |�}t |�}t |�}tjd|||f � | j|� t|||f�}t| j� �}||d krrttj d|||f ��|d j
|� | j |� d S )Nz(config.direct.addChain('%s', '%s', '%s')r z chain '%s' already is in '%s:%s') r r rv r� r rz r� r r r� r� rr )rK �ipv�table�chainr� �idxr� rP rP rQ �addChain� s
zFirewallDConfig.addChainc C s� t |�}t |�}t |�}tjd|||f � | j|� t|||f�}t| j� �}||d krrttj d|||f ��|d j
|� | j |� d S )Nz+config.direct.removeChain('%s', '%s', '%s')r z chain '%s' is not in '%s:%s') r r rv r� r rz r� r r r� rq rr )rK r r r r� r r� rP rP rQ � removeChain� s
zFirewallDConfig.removeChainc C sJ t |�}t |�}t |�}tjd|||f � t|||f�}|| j� d kS )Nz*config.direct.queryChain('%s', '%s', '%s')r )r r rv r r� )rK r r r r� r rP rP rQ �
queryChain� s zFirewallDConfig.queryChainc C sf t |�}t |�}tjd||f � g }x:| j� d D ]*}|d |kr4|d |kr4|j|d � q4W |S )Nz#config.direct.getChains('%s', '%s')r r r� )r r rv r� r� )rK r r r� r� r rP rP rQ � getChains� s zFirewallDConfig.getChainsrs za(sss)c C s t jd� | j� d S )Nz config.direct.getAllChains()r )r rv r� )rK r� rP rP rQ � getAllChains� s
z FirewallDConfig.getAllChainsZsssiasc C s� t |�}t |�}t |�}t |�}t |�}tjd||||dj|�f � | j|� |||||f}t| j� �}||d kr�ttj d||||f ��|d j
|� | j t |�� d S )Nz1config.direct.addRule('%s', '%s', '%s', %d, '%s')z','r z"rule '%s' already is in '%s:%s:%s')
r r rv r r� rz r� r r r� r� rr r ) rK r r r �priorityrL r� r r� rP rP rQ �addRule� s
zFirewallDConfig.addRulec C s� t |�}t |�}t |�}t |�}t |�}tjd||||dj|�f � | j|� |||||f}t| j� �}||d kr�ttj d||||f ��|d j
|� | j t |�� d S )Nz4config.direct.removeRule('%s', '%s', '%s', %d, '%s')z','r z rule '%s' is not in '%s:%s:%s')
r r rv r r� rz r� r r r� rq rr r ) rK r r r r rL r� r r� rP rP rQ �
removeRule� s
zFirewallDConfig.removeRulec C sd t |�}t |�}t |�}t |�}t |�}tjd||||dj|�f � |||||f}|| j� d kS )Nz3config.direct.queryRule('%s', '%s', '%s', %d, '%s')z','r )r r rv r r� )rK r r r r rL r� r rP rP rQ � queryRule s zFirewallDConfig.queryRulec C s� t |�}t |�}t |�}tjd|||f � | j|� t| j� �}xF|d d d � D ]2}|||f|d |d |d fkrT|d j|� qTW | jt|�� d S )Nz+config.direct.removeRules('%s', '%s', '%s')r r r� ) r r rv r� rz r� rq rr r )rK r r r r� r� ZrulerP rP rQ � removeRules s
zFirewallDConfig.removeRulesza(ias)c C s� t |�}t |�}t |�}tjd|||f � g }xN| j� d D ]>}|d |kr>|d |kr>|d |kr>|j|d |d f� q>W |S )Nz(config.direct.getRules('%s', '%s', '%s')r r r� r� r )r r rv r� r� )rK r r r r� r� r rP rP rQ �getRules) s $zFirewallDConfig.getRulesz a(sssias)c C s t jd� | j� d S )Nzconfig.direct.getAllRules()r )r rv r� )rK r� rP rP rQ � getAllRules8 s
zFirewallDConfig.getAllRulesZsasc C s� t |�}t |�}tjd|dj|�f � | j|� ||f}t| j� �}||d krfttj d||f ��|d j
|� | j |� d S )Nz(config.direct.addPassthrough('%s', '%s')z','r� zpassthrough '%s', '%s') r r rv r r� rz r� r r r� r� rr )rK r rL r� r r� rP rP rQ �addPassthroughA s
z FirewallDConfig.addPassthroughc C s� t |�}t |�}tjd|dj|�f � | j|� ||f}t| j� �}||d krfttj d||f ��|d j
|� | j |� d S )Nz+config.direct.removePassthrough('%s', '%s')z','r� zpassthrough '%s', '%s') r r rv r r� rz r� r r r� rq rr )rK r rL r� r r� rP rP rQ �removePassthroughS s
z!FirewallDConfig.removePassthroughc C s@ t |�}t |�}tjd|dj|�f � ||f}|| j� d kS )Nz*config.direct.queryPassthrough('%s', '%s')z','r� )r r rv r r� )rK r rL r� r rP rP rQ �queryPassthroughd s z FirewallDConfig.queryPassthroughZaasc C sN t |�}tjd| � g }x.| j� d D ] }|d |kr(|j|d � q(W |S )Nz#config.direct.getPassthroughs('%s')r� r r )r r rv r� r� )rK r r� r� r rP rP rQ �getPassthroughso s z FirewallDConfig.getPassthroughsza(sas)c C s t jd� | j� d S )Nz"config.direct.getAllPassthroughs()r� )r rv r� )rK r� rP rP rQ �getAllPassthroughs{ s
z"FirewallDConfig.getAllPassthroughs)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)��__name__�
__module__� __qualname__�__doc__Z
persistentr rI ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r. r1 rj ro r2 r_ r� r r` r� r� ra r� r� rc r� r� r^ r� r� rb r� r� r r� r� r� r ZPROPERTIES_IFACEr� ru �slipZpolkitZ require_authr� rf �signalr| ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr� r� r ZDBUS_SIGNATUREr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rJ r� r� r� r r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r r r r r� r
r r r
r� r r r r r r� r� r r� rr r� r r r r r r r r r r! r" r# r$ r% r& r' �
__classcell__rP rP )rO rQ r > sv . D ! D
r ):Z
gi.repositoryr �sys�modulesrA rI Z dbus.serviceZ slip.dbusr, Zslip.dbus.serviceZfirewallr Zfirewall.core.baser Zfirewall.core.watcherr Zfirewall.core.loggerr Zfirewall.server.decoratorsr r r Z firewall.server.config_icmptyper
Z firewall.server.config_servicer Zfirewall.server.config_zoner Z firewall.server.config_policyr
Z firewall.server.config_ipsetr Z firewall.server.config_helperr Zfirewall.core.io.icmptyper Zfirewall.core.io.ipsetr Zfirewall.core.io.helperr Z#firewall.core.io.lockdown_whitelistr Zfirewall.core.io.directr Zfirewall.dbus_utilsr r r r r r r r Zfirewall.errorsr rf ZObjectr rP rP rP rQ �<module> s6
$ server/__pycache__/config_helper.cpython-36.pyc 0000644 00000030613 15035135172 0015521 0 ustar 00 3
��g�D � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZ d dlmZmZmZ d d l mZ d d
lmZ G d d � d ejjj�Z dS )
� )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�Helper)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�errors)�
FirewallErrorc s e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z
e d d
� �Zeejd d d
�e dTdd���Zeejddd
�e dUdd���Zejjjejj�eejdd�e dVdd����Zejjejdd�dd � �Zejjjejj�eejdd �e dW� fd d � ���Z eejj e j d �e dXd d!���Z eejj e j d�e dYd"d#���Z!eejj �e dZd$d%���Z"ejjejj dd�e d&d'� ��Z#eejj �e d[d(d)���Z$ejjejj dd�e d*d+� ��Z%eejj dd�e d\d,d-���Z&ejjejj dd�e d.d/� ��Z'eejj dd �e d]d0d1���Z(eejj dd�e d^d2d3���Z)eejj dd �e d_d4d5���Z*eejj dd�e d`d6d7���Z+eejj dd �e dad8d9���Z,eejj dd�e dbd:d;���Z-eejj dd �e dcd<d=���Z.eejj dd�e ddd>d?���Z/eejj dd@d
�e dedAdB���Z0eejj dd �e dfdCdD���Z1eejj dd�e dgdEdF���Z2eejj dd@d
�e dhdGdH���Z3eejj dId �e didJdK���Z4eejj dId�e djdLdM���Z5eejj d d�e dkdNdO���Z6eejj d d�e dldPdQ���Z7eejj d d@d
�e dmdRdS���Z8� Z9S )n�FirewallDConfigHelperzFirewallD main classTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.helper.%d)
�superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_HELPER)�selfr Zconf�helperr �args�kwargs)� __class__� �#/usr/lib/python3.6/config_helper.pyr 8 s
z FirewallDConfigHelper.__init__c C s d S )Nr )r r r r �__del__E s z FirewallDConfigHelper.__del__c C s | j � d S )N)Zremove_from_connection)r r r r �
unregisterI s z FirewallDConfigHelper.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r# r$ r ZBooleanr% r& �
exceptions�
DBusException)r �
property_namer r r �
_get_propertyQ s z#FirewallDConfigHelper._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r( r) r+ )r �interface_namer* �senderr r r �Getb s
zFirewallDConfigHelper.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr# r$ r r% r& Zsv)� signature)r# r$ r r% r& ) r r/ r r0 r r r r r( r) r+ Z
Dictionary)r r1 r2 �ret�xr r r �GetAlls s
z FirewallDConfigHelper.GetAllZssv)r- c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r/ r r0 r r � accessCheckr r r r( r) )r r1 r* Z new_valuer2 r r r �Set� s
zFirewallDConfigHelper.Setzsa{sv}as)r5 c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r/ r r0 r )r r1 Zchanged_propertiesZinvalidated_propertiesr r r �PropertiesChanged� s
z'FirewallDConfigHelper.PropertiesChanged)r. c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r r �
Introspectr r Zget_busr r r r )r r2 �data)r r r r< � s
z FirewallDConfigHelper.Introspectc C s t jd| j� | jj| j�S )z get settings for helper
z%s.getSettings())r r0 r r Zget_helper_configr )r r2 r r r � getSettings� s z!FirewallDConfigHelper.getSettingsc C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� dS )z#update settings for helper
z%s.update('...')N) r r r0 r r r9 r Zset_helper_configr �Updatedr# )r �settingsr2 r r r �update� s
z FirewallDConfigHelper.updatec C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z1load default settings for builtin helper
z%s.loadDefaults()N)
r r0 r r r9 r Zload_helper_defaultsr r? r# )r r2 r r r � loadDefaults� s z"FirewallDConfigHelper.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r0 r )r r# r r r r? � s z FirewallDConfigHelper.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove helper
z%s.removeHelper()N) r r0 r r r9 r Z
remove_helperr Z removeHelper)r r2 r r r �remove� s z FirewallDConfigHelper.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r0 r )r r# r r r �Removed� s z FirewallDConfigHelper.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename helper
z%s.rename('%s')N) r r/ r r0 r r r9 r Z
rename_helperr �Renamed)r r# r2 r r r �rename� s
z FirewallDConfigHelper.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r0 r )r r# r r r rE � s z FirewallDConfigHelper.Renamedc C s t jd| j� | j� d S )Nz%s.getVersion()r )r r0 r r> )r r2 r r r �
getVersion� s z FirewallDConfigHelper.getVersionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setVersion('%s')r )
r r/ r r0 r r r9 �listr> rA )r �versionr2 r@ r r r �
setVersion s
z FirewallDConfigHelper.setVersionc C s t jd| j� | j� d S )Nz
%s.getShort()r )r r0 r r> )r r2 r r r �getShort s z FirewallDConfigHelper.getShortc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setShort('%s')r )
r r/ r r0 r r r9 rH r> rA )r Zshortr2 r@ r r r �setShort s
z FirewallDConfigHelper.setShortc C s t jd| j� | j� d S )Nz%s.getDescription()� )r r0 r r> )r r2 r r r �getDescription$ s z$FirewallDConfigHelper.getDescriptionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDescription('%s')rM )
r r/ r r0 r r r9 rH r> rA )r � descriptionr2 r@ r r r �setDescription+ s
z$FirewallDConfigHelper.setDescriptionc C s. t jd| j� | jj|� t| j� �}|d S )Nz%s.getFamily()� )r r0 r r r9 rH r> )r r2 r@ r r r � getFamily9 s z FirewallDConfigHelper.getFamilyc C sd t |t�}tjd| j|� | jj|� t| j� �}|d |krNt t
j d| ��||d< | j |� d S )Nz%s.setFamily('%s')rQ z'%s')
r r/ r r0 r r r9 rH r> r
r �ALREADY_ENABLEDrA )r �ipvr2 r@ r r r � setFamilyB s
z FirewallDConfigHelper.setFamily�bc C s. t |t�}tjd| j|� | j� }|d |kS )Nz%s.queryFamily('%s')rQ )r r/ r r0 r r> )r rT r2 r@ r r r � queryFamilyO s
z!FirewallDConfigHelper.queryFamilyc C s. t jd| j� | jj|� t| j� �}|d S )Nz%s.getModule()� )r r0 r r r9 rH r> )r r2 r@ r r r � getModuleZ s z FirewallDConfigHelper.getModulec C sd t |t�}tjd| j|� | jj|� t| j� �}|d |krNt t
j d| ��||d< | j |� d S )Nz%s.setModule('%s')rX z'%s')
r r/ r r0 r r r9 rH r> r
r rS rA )r �moduler2 r@ r r r � setModulec s
z FirewallDConfigHelper.setModulec C s. t |t�}tjd| j|� | j� }|d |kS )Nz%s.queryModule('%s')rX )r r/ r r0 r r> )r rZ r2 r@ r r r � queryModulep s
z!FirewallDConfigHelper.queryModuleza(ss)c C s t jd| j� | j� d S )Nz
%s.getPorts()� )r r0 r r> )r r2 r r r �getPorts{ s z FirewallDConfigHelper.getPortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setPorts('[%s]')�,c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr )�.0�portr r r � <genexpr>� s z1FirewallDConfigHelper.setPorts.<locals>.<genexpr>r] )
r rH �
isinstance�append�tupler r0 r �joinr r9 r> rA )r Zportsr2 Z_portsra r@ r r r �setPorts� s
z FirewallDConfigHelper.setPortsc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz%s.addPort('%s', '%s')r] z%s:%s)r r/ r r0 r r r9 rH r> r
r rS rd rA )r ra �protocolr2 r@ r r r �addPort� s
z FirewallDConfigHelper.addPortc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz%s.removePort('%s', '%s')r] z%s:%s)r r/ r r0 r r r9 rH r> r
r Z NOT_ENABLEDrC rA )r ra rh r2 r@ r r r �
removePort� s
z FirewallDConfigHelper.removePortc C s: t |t�}t |t�}tjd| j||� ||f| j� d kS )Nz%s.queryPort('%s', '%s')r] )r r/ r r0 r r> )r ra rh r2 r r r � queryPort� s
z FirewallDConfigHelper.queryPort)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N):�__name__�
__module__� __qualname__�__doc__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r
r! r" r+ r ZPROPERTIES_IFACEr3 r8 �slipZpolkitZ require_authr: �service�signalr; ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr< r r ZDBUS_SIGNATUREr> rA rB r? rC rD rF rE rG rJ rK rL rN rP rR rU rW rY r[ r\ r^ rg ri rj rk �
__classcell__r r )r r r 0 s�
r ) Z
gi.repositoryr �sys�modulesr Z dbus.serviceZ slip.dbusrp Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.helperr Zfirewall.core.loggerr Zfirewall.server.decoratorsr r
r r Zfirewall.errorsr
rq ZObjectr r r r r �<module> s
server/__pycache__/server.cpython-36.pyc 0000644 00000004547 15035135172 0014232 0 ustar 00 3
��g� � @ s� d gZ ddlZddlZddlmZmZ eejd< ddlZddlZddl Zddl
Z ddl m
Z
ddlmZ ddlmZ dd � Zd
d � Zdd
d �ZdS )�
run_server� N)�GObject�GLibZgobject)�config)�log)� FirewallDc C s | j � dS )NT)�reload)�service� r
� /usr/lib/python3.6/server.py�sighup4 s r c C s | j � d S )N)�quit)�mainloopr
r
r �sigterm8 s r Fc sx d}| rFddl m� ddl� � j� � j� j� d�� ���fdd��y�tjjj dd� tj
� }tj j t
jj|d �}t|t
jj�}tj� }tjj j|� | r�tj��� ttd
�r�tj}ntj}|tjtjt |� |tjtj t |� |j � W nv t k
�r t!j"d � Y nX t#k
�r, t!j$d � Y n: t%k
�rd } z t!j$d
|j&j't(|�� W Y dd}~X nX |�rt|j)� dS )zI Main function for firewall server. Handles D-Bus and GLib mainloop.
Nr )�pformat�
c sr � j � t� j�dkrbtd� tdt� j� � x(� jD ] } tt| �d� t�| �� q8W td� tj��� d S )Nr zP
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
zGARBAGE OBJECTS (%d):
z
zP
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
)Zcollect�lenZgarbage�print�typer �timeout_add_seconds)�x)�gc�
gc_collect�
gc_timeoutr r
r r L s z run_server.<locals>.gc_collectT)Zset_as_default)�bus�unix_signal_addz
Stopping..z Raising SystemExit in run_serverzException %s: %s)*�pprintr r �enableZ set_debugZ
DEBUG_LEAK�dbusr ZglibZ
DBusGMainLoopZ SystemBusr ZBusNamer ZDBUS_INTERFACEr Z DBUS_PATHr ZMainLoop�slipZ set_mainloopr �hasattrr Zunix_signal_add_fullZ
PRIORITY_HIGH�signal�SIGHUPr �SIGTERMr Zrun�KeyboardInterruptr Zdebug1�
SystemExit�error� Exception� __class__�__name__�str�stop)Zdebug_gcr r �namer r �er
)r r r r r r A sB
()F)�__all__�sysr! Z
gi.repositoryr r �modulesr Z dbus.serviceZdbus.mainloop.glibZ slip.dbusr Zfirewallr Zfirewall.core.loggerr Zfirewall.server.firewalldr r r r r
r
r
r �<module> s
server/__pycache__/server.cpython-36.opt-1.pyc 0000644 00000004547 15035135172 0015171 0 ustar 00 3
��g� � @ s� d gZ ddlZddlZddlmZmZ eejd< ddlZddlZddl Zddl
Z ddl m
Z
ddlmZ ddlmZ dd � Zd
d � Zdd
d �ZdS )�
run_server� N)�GObject�GLibZgobject)�config)�log)� FirewallDc C s | j � dS )NT)�reload)�service� r
� /usr/lib/python3.6/server.py�sighup4 s r c C s | j � d S )N)�quit)�mainloopr
r
r �sigterm8 s r Fc sx d}| rFddl m� ddl� � j� � j� j� d�� ���fdd��y�tjjj dd� tj
� }tj j t
jj|d �}t|t
jj�}tj� }tjj j|� | r�tj��� ttd
�r�tj}ntj}|tjtjt |� |tjtj t |� |j � W nv t k
�r t!j"d � Y nX t#k
�r, t!j$d � Y n: t%k
�rd } z t!j$d
|j&j't(|�� W Y dd}~X nX |�rt|j)� dS )zI Main function for firewall server. Handles D-Bus and GLib mainloop.
Nr )�pformat�
c sr � j � t� j�dkrbtd� tdt� j� � x(� jD ] } tt| �d� t�| �� q8W td� tj��� d S )Nr zP
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
zGARBAGE OBJECTS (%d):
z
zP
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
)Zcollect�lenZgarbage�print�typer �timeout_add_seconds)�x)�gc�
gc_collect�
gc_timeoutr r
r r L s z run_server.<locals>.gc_collectT)Zset_as_default)�bus�unix_signal_addz
Stopping..z Raising SystemExit in run_serverzException %s: %s)*�pprintr r �enableZ set_debugZ
DEBUG_LEAK�dbusr ZglibZ
DBusGMainLoopZ SystemBusr ZBusNamer ZDBUS_INTERFACEr Z DBUS_PATHr ZMainLoop�slipZ set_mainloopr �hasattrr Zunix_signal_add_fullZ
PRIORITY_HIGH�signal�SIGHUPr �SIGTERMr Zrun�KeyboardInterruptr Zdebug1�
SystemExit�error� Exception� __class__�__name__�str�stop)Zdebug_gcr r �namer r �er
)r r r r r r A sB
()F)�__all__�sysr! Z
gi.repositoryr r �modulesr Z dbus.serviceZdbus.mainloop.glibZ slip.dbusr Zfirewallr Zfirewall.core.loggerr Zfirewall.server.firewalldr r r r r
r
r
r �<module> s
server/__pycache__/config.cpython-36.pyc 0000644 00000127767 15035135172 0014203 0 ustar 00 3
��g� � @ sd d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl Zd dl
m Z d dl m
Z
d dlmZ d dlmZ d dlmZmZmZ d d lmZ d d
lmZ d d lmZ d d l m Z d d
l m Z d dl m!Z! d dl"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z+ d dl,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3 d dl
m4Z4 d dl5m6Z6 G dd� dejj7j8�Z9dS )� )�GObjectNZgobject)�config)�DEFAULT_ZONE_TARGET)�Watcher)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�FirewallDConfigIcmpType)�FirewallDConfigService)�FirewallDConfigZone)�FirewallDConfigPolicy)�FirewallDConfigIPSet)�FirewallDConfigHelper)�IcmpType)�IPSet)�Helper)�LockdownWhitelist)�Direct)�dbus_to_python�command_of_sender�context_of_sender�
uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�errors)�
FirewallErrorc s@ e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z e d d
� �Z
e d d � �Ze d
d� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd � �Ze d d � �Ze d d � �Ze d!d"� �Ze d#d$� �Ze d%d&� �Ze d'd(� �Z e d)d*� �Z e d+d,� �Z e d-d.� �Z e d/d0� �Z e!d1d2� �Z"e!d3d4� �Z#e!d5d6� �Z$e%ej&d7d8d9�e!d�d;d<���Z'e%ej&d=d>d9�e!d�d?d@���Z(e)jj*j+ejj�e%ej&dAdB�e!d�dCdD����Z,ej-j.ej&dEdF�dGdH� �Z/e)jj*j+ejj0�e%ej1d=dI�e!d� fdJdK� ���Z2e%ejj3e4j5dI�e!d�dLdM���Z6e%ejj3e4j5dB�e!d�dNdO���Z7ej-j.ejj3�e!dPdQ� ��Z8e%ejj3d=dB�e!d�dRdS���Z9e%ejj3d=dB�e!d�dTdU���Z:e%ejj3d=dVd9�e!d�dWdX���Z;e%ejj3dYdI�e!d�dZd[���Z<e%ejj3d=dB�e!d�d\d]���Z=e%ejj3d=dB�e!d�d^d_���Z>e%ejj3d=dVd9�e!d�d`da���Z?e%ejj3dYdI�e!d�dbdc���Z@e%ejj3d=dB�e!d�ddde���ZAe%ejj3d=dB�e!d�dfdg���ZBe%ejj3d=dVd9�e!d�dhdi���ZCe%ejj3dYdI�e!d�djdk���ZDe%ejj3dldB�e!�d dmdn���ZEe%ejj3dldB�e!�ddodp���ZFe%ejj3dldVd9�e!�ddqdr���ZGe%ejj3dsdI�e!�ddtdu���ZHe%ejjIdvdI�e!�ddwdx���ZJe%ejjIdYdI�e!�ddydz���ZKe%ejjId=d{d9�e!�dd|d}���ZLe%ejjId=eMj5 d{d9�e!�dd~d���ZNej-j.ejjId=dF�e!d�d�� ��ZOe%ejjIdvdI�e!�dd�d����ZPe%ejjIdYdI�e!�d d�d����ZQe%ejjId=d{d9�e!�d
d�d����ZRe%ejjId=eSj5 d{d9�e!�d d�d����ZTej-j.ejjId=dF�e!d�d�� ��ZUe%ejjIdvdI�e!�d d�d����ZVe%ejjIdYdI�e!�d
d�d����ZWe%ejjId=d{d9�e!�dd�d����ZXe%ejjId�d{d9�e!�dd�d����ZYe%ejjId�d{d9�e!�dd�d����ZZej-j.ejjId=dF�e!d�d�� ��Z[e%ejjIdvdI�e!�dd�d����Z\e%ejjIdYdI�e!�dd�d����Z]e%ejjId=d{d9�e!�dd�d����Z^e%ejjId=d=d9�e!�dd�d����Z_e%ejjId=d=d9�e!�dd�d����Z`e%ejjId�d{d9�e!�dd�d����Zae%ejjId�d{d9�e!�dd�d����Zbej-j.ejjId=dF�e!d�d�� ��Zce%ejjIdvdI�e!�dd�d����Zde%ejjIdYdI�e!�dd�d����Zee%ejjId=d{d9�e!�dd�d����Zfe%ejjId�d{d9�e!�dd�d����Zgej-j.ejjId=dF�e!d�d�� ��Zhe%ejjIdvdI�e!�d d�d����Zie%ejjIdYdI�e!�d d�d����Zje%ejjId=d{d9�e!�d d�d����Zke%ejjId=elj5 d{d9�e!�d d�d����Zmej-j.ejjId=dF�e!d�d�� ��Zne%ejjoepj5dI�e!�d d�d����Zqe%ejjoepj5dB�e!�d!d�d��Zrej-j.ejjo�e!d�dĄ ��Zse%ejjod�dB�e!�d"d�dDŽ��Zte%ejjod�dB�e!�d#d�dɄ��Zue%ejjod�dVd9�e!�d$d�d˄��Zve%ejjod7dYd9�e!�d%d�d̈́��Zwe%ejjod�d�d9�e!�d&d�dф��Zxe%ejjod�dB�e!�d'd�dԄ��Zye%ejjod�dB�e!�d(d�dք��Zze%ejjod�dVd9�e!�d)d�d��Z{e%ejjod�dB�e!�d*d�dڄ��Z|e%ejjod�d�d9�e!�d+d�d݄��Z}e%ejjod�d�d9�e!�d,d�d���Z~e%ejjod�dB�e!�d-d�d���Ze%ejjod�dB�e!�d.d�d���Z�e%ejjod�dVd9�e!�d/d�d���Z�e%ejjod=d�d9�e!�d0d�d���Z�e%ejjod�dI�e!�d1d�d���Z�� Z�S (2 �FirewallDConfigzFirewallD main classTc s� t t| �j||� || _|d | _|d | _| j� t| jd�| _ | j j
tj � | j j
tj � | j j
tj
� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� tjjtj��r>xBttjtj��D ].}dtj|f }tjj|��r | j j
|� �q W | j j tj � | j j tj � | j j tj � t | tj!j"ddddddddddddd� � d S )Nr � � z%s/%sZ readwrite) �
CleanupOnExit�CleanupModulesOnExit�
IPv6_rpfilter�Lockdown� MinimalMark�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDrifting)#�superr �__init__r �busname�path�
_init_varsr �
watch_updater�watcher�
add_watch_dir�FIREWALLD_IPSETS�ETC_FIREWALLD_IPSETS�FIREWALLD_ICMPTYPES�ETC_FIREWALLD_ICMPTYPES�FIREWALLD_HELPERS�ETC_FIREWALLD_HELPERS�FIREWALLD_SERVICES�ETC_FIREWALLD_SERVICES�FIREWALLD_ZONES�ETC_FIREWALLD_ZONES�FIREWALLD_POLICIES�ETC_FIREWALLD_POLICIES�os�exists�sorted�listdir�isdirZadd_watch_file�LOCKDOWN_WHITELIST�FIREWALLD_DIRECT�FIREWALLD_CONFr �dbus�DBUS_INTERFACE_CONFIG)�selfZconf�args�kwargs�filenamer0 )� __class__� � /usr/lib/python3.6/config.pyr. F sP
zFirewallDConfig.__init__c C s2 g | _ d| _g | _d| _g | _d| _g | _d| _g | _d| _ g | _
d| _ x$| j j
� D ]}| j| j j|�� qTW x$| j j� D ]}| j| j j|�� qzW x$| j j� D ]}| j| j j|�� q�W x$| j j� D ]}| j| j j|�� q�W x$| j j� D ]}| j| j j|�� q�W x&| j j � D ]}| j | j j |�� �qW d S )Nr ) �ipsets� ipset_idx� icmptypes� icmptype_idx�services� service_idx�zones�zone_idx�helpers�
helper_idx�policy_objects�policy_object_idxr Z
get_ipsets� _addIPSetZ get_ipsetZ
get_icmptypes� _addIcmpTypeZ get_icmptypeZ get_services� _addServiceZ get_serviceZ get_zones�_addZoneZget_zoneZ get_helpers�
_addHelperZ
get_helperZget_policy_objects�
_addPolicyZget_policy_object)rK �ipset�icmptype�service�zone�helper�policyrP rP rQ r1 t s0 zFirewallDConfig._init_varsc C s d S )NrP )rK rP rP rQ �__del__� s zFirewallDConfig.__del__c C s� x&t | j�dkr&| jj� }|j� ~qW x&t | j�dkrN| jj� }|j� ~q*W x&t | j�dkrv| jj� }|j� ~qRW x&t | j�dkr�| jj� }|j� ~qzW x&t | j�dkr�| jj� }|j� ~q�W x&t | j�dkr�| jj� }|j� ~q�W | j � d S )Nr )
�lenrR �pop�
unregisterrT rV rX rZ r\ r1 )rK �itemrP rP rQ �reload� s2
zFirewallDConfig.reloadc C sJ |t jkr�| jt jj�}tjdt j� y| j j� W n2 tk
rf } ztj d||f � d S d }~X nX | jt jj�j
� }x2t |j � �D ]"}||kr�|| || kr�||= q�W t
|�dkr�| jt jj|g � d S |jt j�s�|jt j�o�|jd��r�y| j j|�\}}W n4 tk
�r< } ztj d||f � d S d }~X nX |dk�rT| j|� n*|dk�rj| j|� n|dk�rF| j|� �n�|jt j��s�|jt j��r8|jd��r8y| j j|�\}}W n4 tk
�r� } ztj d ||f � d S d }~X nX |dk�r
| j|� n*|dk�r | j|� n|dk�rF| j |� �n|jt j ��sT|jt j ��rr|jd��r�y| j j |�\}}W n4 tk
�r� } ztj d
||f � d S d }~X nX |dk�r�| j |� n*|dk�r�| j!|� n|dk�rn| j"|� n�|jt j ��rF|j#t j d �j$d �}t
|�d
k �s&d |k�r*d S t%j&j'|��rT| j(j)|��sn| j(j*|� n| j(j)|��rF| j(j+|� �n�|jt j,��s�|jt j-��r(|jd��r(y| j j.|�\}}W n4 tk
�r� } ztj d||f � d S d }~X nX |dk�r�| j/|� n*|dk�r| j0|� n|dk�rF| j1|� �n |jt j2��sD|jt j3��r�|jd��r�y| j j4|�\}}W n4 tk
�r� } ztj d||f � d S d }~X nX |dk�r�| j5|� n*|dk�r�| j6|� n|dk�rF| j7|� �nh|t j8k�r:y| j j9� W n4 tk
�r, } ztj d||f � d S d }~X nX | j:� �n |t j;k�r�y| j j<� W n4 tk
�r� } ztj d||f � d S d }~X nX | j=� n�|jt j>��s�|jt j?��rF|jd��rFy| j j@|�\}}W n4 tk
�r } ztj d||f � d S d }~X nX |dk�r | jA|� n*|dk�r2| jB|� n|dk�rF| jC|� d S )Nz,config: Reloading firewalld config file '%s'z+Failed to load firewalld.conf file '%s': %sr z.xmlz%Failed to load icmptype file '%s': %s�new�remove�updatez$Failed to load service file '%s': %sz!Failed to load zone file '%s': %s� �/r z"Failed to load ipset file '%s': %sz#Failed to load helper file '%s': %sz/Failed to load lockdown whitelist file '%s': %sz)Failed to load direct rules file '%s': %sz#Failed to load policy file '%s': %s)Dr rH �GetAllrI rJ r �debug1Zupdate_firewalld_conf� Exception�error�copy�list�keysrk �PropertiesChanged�
startswithr7 r8 �endswithZupdate_icmptype_from_pathr_ �removeIcmpType�_updateIcmpTyper; r< Zupdate_service_from_pathr` �
removeService�_updateServicer= r> Zupdate_zone_from_pathra �
removeZone� _updateZone�replace�striprA r0 rE r3 Z has_watchr4 Z remove_watchr5 r6 Zupdate_ipset_from_pathr^ � removeIPSet� _updateIPSetr9 r: Zupdate_helper_from_pathrb � removeHelper�
_updateHelperrF Zupdate_lockdown_whitelist�LockdownWhitelistUpdatedrG Z
update_direct�Updatedr? r@ Z update_policy_object_from_pathrc � removePolicy�
_updatePolicy) rK �nameZ old_props�msgZprops�keyZwhat�obj�_namerP rP rQ r2 � s
z FirewallDConfig.watch_updaterc C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r
r rU r/ rI ZDBUS_PATH_CONFIG_ICMPTYPErT �append�
IcmpTypeAddedr� )rK r� �config_icmptyperP rP rQ r_ A s z FirewallDConfig._addIcmpTypec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rT r� r� r0 rN r� )rK r� re rP rP rQ r� M s z FirewallDConfig._updateIcmpTypec C s� d}xT| j D ]J}|j� }|j|| kr || j|j� | jj|j|�|_|j|jj� q W x\| jD ]R}|j� }d|krb|j|d krb|d j|j� | jj |j|�|_|j|jj� qbW x:| j
D ]0}|j|kr�|j |j� |j � | j
j|� ~q�W d S )N� Z icmp_blocks)
rX � getSettingsr� rq r �set_zone_configr� r� r\ � set_policy_object_config_dictrT �Removedrm )rK r� �indexrg �settingsri re rP rP rQ r V s&
z FirewallDConfig.removeIcmpTypec C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r rW r/ rI ZDBUS_PATH_CONFIG_SERVICErV r� � ServiceAddedr� )rK r� �config_servicerP rP rQ r` p s zFirewallDConfig._addServicec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rV r� r� r0 rN r� )rK r� rf rP rP rQ r� { s z FirewallDConfig._updateServicec C s� d}xT| j D ]J}|j� }|j|| kr || j|j� | jj|j|�|_|j|jj� q W x\| jD ]R}|j� }d|krb|j|d krb|d j|j� | jj |j|�|_|j|jj� qbW x:| j
D ]0}|j|kr�|j |j� |j � | j
j|� ~q�W d S )Nr rV )
rX r� r� rq r r� r� r� r\ r� rV r� rm )rK r� r� rg r� ri rf rP rP rQ r� � s&
z FirewallDConfig.removeServicec C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r rY r/ rI ZDBUS_PATH_CONFIG_ZONErX r� � ZoneAddedr� )rK r� � config_zonerP rP rQ ra � s zFirewallDConfig._addZonec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rX r� r� r0 rN r� )rK r� rg rP rP rQ r� � s
zFirewallDConfig._updateZonec C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)rX r� r� r� rm rq )rK r� rg rP rP rQ r� � s
zFirewallDConfig.removeZonec C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r
r r] r/ rI ZDBUS_PATH_CONFIG_POLICYr\ r� � PolicyAddedr� )rK r� �
config_policyrP rP rQ rc � s zFirewallDConfig._addPolicyc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)r\ r� r� r0 rN r� )rK r� ri rP rP rQ r� � s
z FirewallDConfig._updatePolicyc C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)r\ r� r� r� rm rq )rK r� ri rP rP rQ r� � s
z FirewallDConfig.removePolicyc C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r rS r/ rI ZDBUS_PATH_CONFIG_IPSETrR r� �
IPSetAddedr� )rK r� � config_ipsetrP rP rQ r^ � s zFirewallDConfig._addIPSetc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rR r� r� r0 rN r� )rK r� rd rP rP rQ r� � s
z FirewallDConfig._updateIPSetc C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)rR r� r� r� rm rq )rK r� rd rP rP rQ r� � s
zFirewallDConfig.removeIPSetc C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r r[ r/ rI ZDBUS_PATH_CONFIG_HELPERrZ r� � HelperAddedr� )rK r� �
config_helperrP rP rQ rb � s zFirewallDConfig._addHelperc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rZ r� r� r0 rN r� )rK r� rh rP rP rQ r� � s
z FirewallDConfig._updateHelperc C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)rZ r� r� r� rm rq )rK r� rh rP rP rQ r� s
z FirewallDConfig.removeHelperc C s� | j j� r�|d kr tjd� d S tj� }t||�}| j jd|�rDd S t||�}| j jd|�r`d S t |�}| j jd|�rzd S t
||�}| j jd|�r�d S t t j
d��d S )Nz&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r Zlockdown_enabledr rx rI Z SystemBusr Z access_checkr r r r r Z
ACCESS_DENIED)rK �senderZbusr� r� r� r� rP rP rQ � accessCheck s$
zFirewallDConfig.accessCheckc C sF |dkrt jjd| ��| jj� j|�}|dkrH|d kr>tj}t j|�S |dkrr|d kr`tj}nt |�}t j
|�S |dkr�|d kr�tj r�dnd}t j|�S |dkr�|d kr�tj r�dnd}t j|�S |dk� r�|d k� r�tj
� r�dnd}t j|�S |dk�r |d k�rtj�rdnd}t j|�S |dk�rL|d k�rBtj�r>dnd}t j|�S |dk�rp|d k�rftj}t j|�S |d k�r�|d k�r�tj}t j|�S |d
k�r�|d k�r�tj}t j|�S |d k�r�|d k�r�tj�r�dnd}t j|�S |d k�r|d k�r
tj�rdnd}t j|�S |d
k�rB|d k�r8tj�r4dnd}t j|�S d S )N� DefaultZoner% r! r" r$ r# r& r' r( r) r* r+ r, zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist�yes�no)
r� r% r! r" r$ r# r& r' r( r) r* r+ r, )rI �
exceptions�
DBusExceptionr �get_firewalld_conf�getZ
FALLBACK_ZONE�StringZFALLBACK_MINIMAL_MARK�int�Int32ZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTING)rK �prop�valuerP rP rQ �
_get_property+ s|
z FirewallDConfig._get_propertyc C sT |dkrt j| j|��S |dkr0t j| j|��S |dkrHt j| j|��S |dkr`t j| j|��S |dkrxt j| j|��S |dkr�t j| j|��S |dkr�t j| j|��S |dkr�t j| j|��S |d kr�t j| j|��S |d
k� r�t j| j|��S |d k�r t j| j|��S |d k�r&t j| j|��S |d
k�r@t j| j|��S t jjd| ��d S )Nr� r% r! r" r$ r# r& r' r( r) r* r+ r, zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist)rI r� r� r� r� r� )rK r� rP rP rQ �_get_dbus_propertyo s:
z"FirewallDConfig._get_dbus_propertyZss�v)� in_signature�
out_signatureNc C sx t |t�}t |t�}tjd||� |tjjkr8| j|�S |tjjtjj gkr^tj
j d| ��ntj
j d| ��| j|�S )Nzconfig.Get('%s', '%s')zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr rv r rI rJ r� � DBUS_INTERFACE_CONFIG_DIRECT� DBUS_INTERFACE_CONFIG_POLICIESr� r� )rK �interface_name�
property_namer� rP rP rQ �Get� s
zFirewallDConfig.Get�sza{sv}c
C sx t |t�}tjd|� i }|tjjkrDxBdD ]}| j|�||< q,W n&|tjjtjj gkrZntj
j d| ��tj |dd�S )Nzconfig.GetAll('%s')r� r% r! r" r$ r# r& r' r( r) r* r+ r, zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existZsv)� signature)
r� r% r! r" r$ r# r& r' r( r) r* r+ r, )
r r� r rv r rI rJ r� r� r� r� r� Z
Dictionary)rK r� r� �ret�xrP rP rQ ru � s"
zFirewallDConfig.GetAllZssv)r� c C s� t |t�}t |t�}t |�}tjd|||� | j|� |tjjk�r�|dk�rz|dkrv|j� dkrvt t
j d||f ��|dkr�|tj kr�t t
j d||f ��|dkr�|tj
kr�t t
j d||f ��|d k� r�|j� dk� r�t t
j d||f ��|d
k�r|j� dk�rt t
j d||f ��|d k�rF|j� dk�rFt t
j d||f ��| jj� j||� | jj� j� | j|||ig � n |dk�r�ntjjd| ��n8|tjjtjjgk�r�tjjd| ��ntjjd| ��d S ) Nz config.Set('%s', '%s', '%s')r! r$ r" r# r& r' r) r* r+ r, r� r� �true�falsez '%s' for %sr% r( zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)
r! r$ r" r# r& r' r) r* r+ r, )r! r$ r" r# r& )r� r� r� r� )r� r� r� r� )r� r� r� r� )r� r� r� r� )r% r( )r r� r rv r� r rI rJ �lowerr r Z
INVALID_VALUEZLOG_DENIED_VALUESZFIREWALL_BACKEND_VALUESr� �set�writer| r� r� r� r� )rK r� r� Z new_valuer� rP rP rQ �Set� sz
zFirewallDConfig.Setzsa{sv}as)r� c C s. t |t�}t |�}t |�}tjd|||� d S )Nz*config.PropertiesChanged('%s', '%s', '%s'))r r� r rv )rK r� Zchanged_propertiesZinvalidated_propertiesrP rP rQ r| s
z!FirewallDConfig.PropertiesChanged)r� c s4 t jd� tt| �j| j| jj� �}t| |t j
j �S )Nzconfig.Introspect()) r Zdebug2r- r �
Introspectr0 r/ Zget_busr r rI rJ )rK r� �data)rO rP rQ r� s
zFirewallDConfig.Introspectc C s t jd� | jj� jj� S )Nz&config.policies.getLockdownWhitelist())r rv r � get_policies�lockdown_whitelist�
export_config)rK r� rP rP rQ �getLockdownWhitelist s
z$FirewallDConfig.getLockdownWhitelistc C s@ t jd� t|�}| jj� jj|� | jj� jj� | j� d S )Nz)config.policies.setLockdownWhitelist(...)) r rv r r r� r� �
import_configr� r� )rK r� r� rP rP rQ �setLockdownWhitelist& s
z$FirewallDConfig.setLockdownWhitelistc C s t jd� d S )Nz*config.policies.LockdownWhitelistUpdated())r rv )rK rP rP rQ r� 0 s z(FirewallDConfig.LockdownWhitelistUpdatedc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz1config.policies.addLockdownWhitelistCommand('%s')r ) r r rv r� rz r� r r �ALREADY_ENABLEDr� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistCommand7 s
z+FirewallDConfig.addLockdownWhitelistCommandc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz4config.policies.removeLockdownWhitelistCommand('%s')r ) r r rv r� rz r� r r � NOT_ENABLEDrq r� )rK r� r� r� rP rP rQ � removeLockdownWhitelistCommandD s
z.FirewallDConfig.removeLockdownWhitelistCommand�bc C s$ t |�}tjd|� || j� d kS )Nz3config.policies.queryLockdownWhitelistCommand('%s')r )r r rv r� )rK r� r� rP rP rQ � queryLockdownWhitelistCommandR s z-FirewallDConfig.queryLockdownWhitelistCommand�asc C s t jd� | j� d S )Nz.config.policies.getLockdownWhitelistCommands()r )r rv r� )rK r� rP rP rQ � getLockdownWhitelistCommands[ s
z,FirewallDConfig.getLockdownWhitelistCommandsc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz1config.policies.addLockdownWhitelistContext('%s')r ) r r rv r� rz r� r r r� r� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistContextd s
z+FirewallDConfig.addLockdownWhitelistContextc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz4config.policies.removeLockdownWhitelistContext('%s')r ) r r rv r� rz r� r r r� rq r� )rK r� r� r� rP rP rQ � removeLockdownWhitelistContextq s
z.FirewallDConfig.removeLockdownWhitelistContextc C s$ t |�}tjd|� || j� d kS )Nz3config.policies.queryLockdownWhitelistContext('%s')r )r r rv r� )rK r� r� rP rP rQ � queryLockdownWhitelistContext s z-FirewallDConfig.queryLockdownWhitelistContextc C s t jd� | j� d S )Nz.config.policies.getLockdownWhitelistContexts()r )r rv r� )rK r� rP rP rQ � getLockdownWhitelistContexts� s
z,FirewallDConfig.getLockdownWhitelistContextsc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz.config.policies.addLockdownWhitelistUser('%s')� ) r r rv r� rz r� r r r� r� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistUser� s
z(FirewallDConfig.addLockdownWhitelistUserc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz1config.policies.removeLockdownWhitelistUser('%s')r� ) r r rv r� rz r� r r r� rq r� )rK r� r� r� rP rP rQ �removeLockdownWhitelistUser� s
z+FirewallDConfig.removeLockdownWhitelistUserc C s$ t |�}tjd|� || j� d kS )Nz0config.policies.queryLockdownWhitelistUser('%s')r� )r r rv r� )rK r� r� rP rP rQ �queryLockdownWhitelistUser� s z*FirewallDConfig.queryLockdownWhitelistUserc C s t jd� | j� d S )Nz+config.policies.getLockdownWhitelistUsers()r� )r rv r� )rK r� rP rP rQ �getLockdownWhitelistUsers� s
z)FirewallDConfig.getLockdownWhitelistUsers�ic C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz+config.policies.addLockdownWhitelistUid(%d)� ) r r rv r� rz r� r r r� r� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistUid� s
z'FirewallDConfig.addLockdownWhitelistUidc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz.config.policies.removeLockdownWhitelistUid(%d)r� ) r r rv r� rz r� r r r� rq r� )rK r� r� r� rP rP rQ �removeLockdownWhitelistUid� s
z*FirewallDConfig.removeLockdownWhitelistUidc C s$ t |�}tjd|� || j� d kS )Nz-config.policies.queryLockdownWhitelistUid(%d)r� )r r rv r� )rK r� r� rP rP rQ �queryLockdownWhitelistUid� s z)FirewallDConfig.queryLockdownWhitelistUidZaic C s t jd� | j� d S )Nz*config.policies.getLockdownWhitelistUids()r� )r rv r� )rK r� rP rP rQ �getLockdownWhitelistUids� s
z(FirewallDConfig.getLockdownWhitelistUidsZaoc C s t jd� | jS )z"list ipsets objects paths
zconfig.listIPSets())r rv rR )rK r� rP rP rQ �
listIPSets� s
zFirewallDConfig.listIPSetsc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget ipset names
zconfig.getIPSetNames())r rv rR r� r� r� rC )rK r� rR r� rP rP rQ �
getIPSetNames� s
z FirewallDConfig.getIPSetNames�oc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z-object path of ipset with given name
zconfig.getIPSetByName('%s')N)
r r� r rv rR r� r� r r Z
INVALID_IPSET)rK rd r� r� rP rP rQ �getIPSetByName� s
z FirewallDConfig.getIPSetByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z/add ipset with given name and settings
zconfig.addIPSet('%s'))r r� r rv r� r Z new_ipsetr^ )rK rd r� r� r� r� rP rP rQ �addIPSet s
zFirewallDConfig.addIPSetc C s t |t�}tjd| � d S )Nzconfig.IPSetAdded('%s'))r r� r rv )rK rd rP rP rQ r� s
zFirewallDConfig.IPSetAddedc C s t jd� | jS )z%list icmptypes objects paths
zconfig.listIcmpTypes())r rv rT )rK r� rP rP rQ �
listIcmpTypes s
z FirewallDConfig.listIcmpTypesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget icmptype names
zconfig.getIcmpTypeNames())r rv rT r� r� r� rC )rK r� rT r� rP rP rQ �getIcmpTypeNames( s
z FirewallDConfig.getIcmpTypeNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z0object path of icmptype with given name
z config.getIcmpTypeByName('%s')N)
r r� r rv rT r� r� r r ZINVALID_ICMPTYPE)rK re r� r� rP rP rQ �getIcmpTypeByName3 s
z!FirewallDConfig.getIcmpTypeByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z2add icmptype with given name and settings
zconfig.addIcmpType('%s'))r r� r rv r� r Z new_icmptyper_ )rK re r� r� r� r� rP rP rQ � addIcmpType@ s
zFirewallDConfig.addIcmpTypec C s t jd| � d S )Nzconfig.IcmpTypeAdded('%s'))r rv )rK re rP rP rQ r� O s z FirewallDConfig.IcmpTypeAddedc C s t jd� | jS )z$list services objects paths
zconfig.listServices())r rv rV )rK r� rP rP rQ � listServicesV s
z FirewallDConfig.listServicesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget service names
zconfig.getServiceNames())r rv rV r� r� r� rC )rK r� rV r� rP rP rQ �getServiceNames^ s
z FirewallDConfig.getServiceNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z/object path of service with given name
z config.getServiceByName('%s')N)
r r� r rv rV r� r� r r ZINVALID_SERVICE)rK rf r� r� rP rP rQ �getServiceByNamei s
z FirewallDConfig.getServiceByNamezs(sssa(ss)asa{ss}asa(ss))c C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z1add service with given name and settings
zconfig.addService('%s'))r r� r rv r� r Z new_servicer` )rK rf r� r� r� r� rP rP rQ �
addServicev s
zFirewallDConfig.addServicezsa{sv}c C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z1add service with given name and settings
zconfig.addService2('%s'))r r� r rv r� r Znew_service_dictr` )rK rf r� r� r� r� rP rP rQ � addService2� s
zFirewallDConfig.addService2c C s t jd| � d S )Nzconfig.ServiceAdded('%s'))r rv )rK rf rP rP rQ r� � s z FirewallDConfig.ServiceAddedc C s t jd� | jS )z!list zones objects paths
zconfig.listZones())r rv rX )rK r� rP rP rQ � listZones� s
zFirewallDConfig.listZonesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget zone names
zconfig.getZoneNames())r rv rX r� r� r� rC )rK r� rX r� rP rP rQ � getZoneNames� s
z FirewallDConfig.getZoneNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z,object path of zone with given name
zconfig.getZoneByName('%s')N)
r r� r rv rX r� r� r r Z INVALID_ZONE)rK rg r� r� rP rP rQ �
getZoneByName� s
z FirewallDConfig.getZoneByNamec C sz t |t�}tjd|� g }x(| jD ] }||jjkr"|j|jj� q"W t |�dkrjdj
|�d|t |�f S |rv|d S dS )z4name of zone the given interface belongs to
z config.getZoneOfInterface('%s')r � zE (ERROR: interface '%s' is in %s zone XML files, can be only in one)r rs ) r r� r rv rX r� Z
interfacesr� r� rk �join)rK Zifacer� r� r� rP rP rQ �getZoneOfInterface� s
z"FirewallDConfig.getZoneOfInterfacec C sz t |t�}tjd|� g }x(| jD ] }||jjkr"|j|jj� q"W t |�dkrjdj
|�d|t |�f S |rv|d S dS )z1name of zone the given source belongs to
z config.getZoneOfSource('%s')r r� zB (ERROR: source '%s' is in %s zone XML files, can be only in one)r rs ) r r� r rv rX r� Zsourcesr� r� rk r )rK �sourcer� r� r� rP rP rQ �getZoneOfSource� s
z FirewallDConfig.getZoneOfSourcez's(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sh t |t�}t |�}tjd|� | j|� |d dkrLt|�}t|d< t|�}| jj ||�}| j
|�}|S )z.add zone with given name and settings
zconfig.addZone('%s')� �default) r r� r rv r� rz r �tupler Znew_zonera )rK rg r� r� Z _settingsr� r� rP rP rQ �addZone� s
zFirewallDConfig.addZonec C s` t |t�}t |�}tjd|� | j|� d|krD|d dkrDt|d< | jj||�}| j|�}|S )z.add zone with given name and settings
zconfig.addZone('%s')�targetr ) r r� r rv r� r r Z
new_zone_dictra )rK rg r� r� r� r� rP rP rQ �addZone2� s
zFirewallDConfig.addZone2c C s t jd| � d S )Nzconfig.ZoneAdded('%s'))r rv )rK rg rP rP rQ r� s zFirewallDConfig.ZoneAddedc C s t jd� | jS )z$list policies objects paths
zconfig.listPolicies())r rv r\ )rK r� rP rP rQ � listPolicies s
z FirewallDConfig.listPoliciesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget policy names
zconfig.getPolicyNames())r rv r\ r� r� r� rC )rK r� Zpoliciesr� rP rP rQ �getPolicyNames s
z FirewallDConfig.getPolicyNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z.object path of policy with given name
z config.getPolicyByName('%s')N)
r r� r rv r\ r� r� r r ZINVALID_POLICY)rK ri r� r� rP rP rQ �getPolicyByName" s
z FirewallDConfig.getPolicyByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z0add policy with given name and settings
zconfig.addPolicy('%s'))r r� r rv r� r Znew_policy_object_dictrc )rK ri r� r� r� r� rP rP rQ � addPolicy/ s
zFirewallDConfig.addPolicyc C s t jd| � d S )Nzconfig.PolicyAdded('%s'))r rv )rK ri rP rP rQ r� > s zFirewallDConfig.PolicyAddedc C s t jd� | jS )z#list helpers objects paths
zconfig.listHelpers())r rv rZ )rK r� rP rP rQ � listHelpersG s
zFirewallDConfig.listHelpersc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget helper names
zconfig.getHelperNames())r rv rZ r� r� r� rC )rK r� rZ r� rP rP rQ �getHelperNamesO s
z FirewallDConfig.getHelperNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z.object path of helper with given name
z config.getHelperByName('%s')N)
r r� r rv rZ r� r� r r ZINVALID_HELPER)rK rh r� r� rP rP rQ �getHelperByNameZ s
z FirewallDConfig.getHelperByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z0add helper with given name and settings
zconfig.addHelper('%s'))r r� r rv r� r Z
new_helperrb )rK rh r� r� r� r� rP rP rQ � addHelperg s
zFirewallDConfig.addHelperc C s t |t�}tjd| � d S )Nzconfig.HelperAdded('%s'))r r� r rv )rK rh rP rP rQ r� v s
zFirewallDConfig.HelperAddedc C s t jd� | jj� j� S )Nzconfig.direct.getSettings())r rv r �
get_directr� )rK r� rP rP rQ r� s
zFirewallDConfig.getSettingsc C s< t jd� t|�}| jj� j|� | jj� j� | j� d S )Nzconfig.direct.update())r rv r r r r� r� r� )rK r� r� rP rP rQ rr � s
zFirewallDConfig.updatec C s t jd� d S )Nzconfig.direct.Updated())r rv )rK rP rP rQ r� � s zFirewallDConfig.UpdatedZsssc C s� t |�}t |�}t |�}tjd|||f � | j|� t|||f�}t| j� �}||d krrttj d|||f ��|d j
|� | j |� d S )Nz(config.direct.addChain('%s', '%s', '%s')r z chain '%s' already is in '%s:%s') r r rv r� r rz r� r r r� r� rr )rK �ipv�table�chainr� �idxr� rP rP rQ �addChain� s
zFirewallDConfig.addChainc C s� t |�}t |�}t |�}tjd|||f � | j|� t|||f�}t| j� �}||d krrttj d|||f ��|d j
|� | j |� d S )Nz+config.direct.removeChain('%s', '%s', '%s')r z chain '%s' is not in '%s:%s') r r rv r� r rz r� r r r� rq rr )rK r r r r� r r� rP rP rQ � removeChain� s
zFirewallDConfig.removeChainc C sJ t |�}t |�}t |�}tjd|||f � t|||f�}|| j� d kS )Nz*config.direct.queryChain('%s', '%s', '%s')r )r r rv r r� )rK r r r r� r rP rP rQ �
queryChain� s zFirewallDConfig.queryChainc C sf t |�}t |�}tjd||f � g }x:| j� d D ]*}|d |kr4|d |kr4|j|d � q4W |S )Nz#config.direct.getChains('%s', '%s')r r r� )r r rv r� r� )rK r r r� r� r rP rP rQ � getChains� s zFirewallDConfig.getChainsrs za(sss)c C s t jd� | j� d S )Nz config.direct.getAllChains()r )r rv r� )rK r� rP rP rQ � getAllChains� s
z FirewallDConfig.getAllChainsZsssiasc C s� t |�}t |�}t |�}t |�}t |�}tjd||||dj|�f � | j|� |||||f}t| j� �}||d kr�ttj d||||f ��|d j
|� | j t |�� d S )Nz1config.direct.addRule('%s', '%s', '%s', %d, '%s')z','r z"rule '%s' already is in '%s:%s:%s')
r r rv r r� rz r� r r r� r� rr r ) rK r r r �priorityrL r� r r� rP rP rQ �addRule� s
zFirewallDConfig.addRulec C s� t |�}t |�}t |�}t |�}t |�}tjd||||dj|�f � | j|� |||||f}t| j� �}||d kr�ttj d||||f ��|d j
|� | j t |�� d S )Nz4config.direct.removeRule('%s', '%s', '%s', %d, '%s')z','r z rule '%s' is not in '%s:%s:%s')
r r rv r r� rz r� r r r� rq rr r ) rK r r r r rL r� r r� rP rP rQ �
removeRule� s
zFirewallDConfig.removeRulec C sd t |�}t |�}t |�}t |�}t |�}tjd||||dj|�f � |||||f}|| j� d kS )Nz3config.direct.queryRule('%s', '%s', '%s', %d, '%s')z','r )r r rv r r� )rK r r r r rL r� r rP rP rQ � queryRule s zFirewallDConfig.queryRulec C s� t |�}t |�}t |�}tjd|||f � | j|� t| j� �}xF|d d d � D ]2}|||f|d |d |d fkrT|d j|� qTW | jt|�� d S )Nz+config.direct.removeRules('%s', '%s', '%s')r r r� ) r r rv r� rz r� rq rr r )rK r r r r� r� ZrulerP rP rQ � removeRules s
zFirewallDConfig.removeRulesza(ias)c C s� t |�}t |�}t |�}tjd|||f � g }xN| j� d D ]>}|d |kr>|d |kr>|d |kr>|j|d |d f� q>W |S )Nz(config.direct.getRules('%s', '%s', '%s')r r r� r� r )r r rv r� r� )rK r r r r� r� r rP rP rQ �getRules) s $zFirewallDConfig.getRulesz a(sssias)c C s t jd� | j� d S )Nzconfig.direct.getAllRules()r )r rv r� )rK r� rP rP rQ � getAllRules8 s
zFirewallDConfig.getAllRulesZsasc C s� t |�}t |�}tjd|dj|�f � | j|� ||f}t| j� �}||d krfttj d||f ��|d j
|� | j |� d S )Nz(config.direct.addPassthrough('%s', '%s')z','r� zpassthrough '%s', '%s') r r rv r r� rz r� r r r� r� rr )rK r rL r� r r� rP rP rQ �addPassthroughA s
z FirewallDConfig.addPassthroughc C s� t |�}t |�}tjd|dj|�f � | j|� ||f}t| j� �}||d krfttj d||f ��|d j
|� | j |� d S )Nz+config.direct.removePassthrough('%s', '%s')z','r� zpassthrough '%s', '%s') r r rv r r� rz r� r r r� rq rr )rK r rL r� r r� rP rP rQ �removePassthroughS s
z!FirewallDConfig.removePassthroughc C s@ t |�}t |�}tjd|dj|�f � ||f}|| j� d kS )Nz*config.direct.queryPassthrough('%s', '%s')z','r� )r r rv r r� )rK r rL r� r rP rP rQ �queryPassthroughd s z FirewallDConfig.queryPassthroughZaasc C sN t |�}tjd| � g }x.| j� d D ] }|d |kr(|j|d � q(W |S )Nz#config.direct.getPassthroughs('%s')r� r r )r r rv r� r� )rK r r� r� r rP rP rQ �getPassthroughso s z FirewallDConfig.getPassthroughsza(sas)c C s t jd� | j� d S )Nz"config.direct.getAllPassthroughs()r� )r rv r� )rK r� rP rP rQ �getAllPassthroughs{ s
z"FirewallDConfig.getAllPassthroughs)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)��__name__�
__module__� __qualname__�__doc__Z
persistentr rI ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r. r1 rj ro r2 r_ r� r r` r� r� ra r� r� rc r� r� r^ r� r� rb r� r� r r� r� r� r ZPROPERTIES_IFACEr� ru �slipZpolkitZ require_authr� rf �signalr| ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr� r� r ZDBUS_SIGNATUREr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rJ r� r� r� r r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r r r r r� r
r r r
r� r r r r r r� r� r r� rr r� r r r r r r r r r r! r" r# r$ r% r& r' �
__classcell__rP rP )rO rQ r > sv . D ! D
r ):Z
gi.repositoryr �sys�modulesrA rI Z dbus.serviceZ slip.dbusr, Zslip.dbus.serviceZfirewallr Zfirewall.core.baser Zfirewall.core.watcherr Zfirewall.core.loggerr Zfirewall.server.decoratorsr r r Z firewall.server.config_icmptyper
Z firewall.server.config_servicer Zfirewall.server.config_zoner Z firewall.server.config_policyr
Z firewall.server.config_ipsetr Z firewall.server.config_helperr Zfirewall.core.io.icmptyper Zfirewall.core.io.ipsetr Zfirewall.core.io.helperr Z#firewall.core.io.lockdown_whitelistr Zfirewall.core.io.directr Zfirewall.dbus_utilsr r r r r r r r Zfirewall.errorsr rf ZObjectr rP rP rP rQ �<module> s6
$ server/__pycache__/config_policy.cpython-36.opt-1.pyc 0000644 00000015354 15035135172 0016505 0 ustar 00 3
��g-! � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZmZmZ G dd � d ejjj�ZdS )
� )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_methodc s� e Zd ZdZejjZe� fdd��Z e
dd� �Z e
dd� �Z e
dd � �Z
eejd
d d �e
d/dd���Zeejddd �e
d0dd���Zejjjejj�eejdd�e
d1dd����Zejjejdd�dd� �Zejjjejj�eejdd �e
d2� fd d � ���Zeejj dd �e
d3d d ���Z eejj dd�e
d4d!d"���Z eejj �e
d5d#d$���Z ejjejj dd�e
d%d&� ��Z eejj �e
d6d'd(���Z!ejjejj dd�e
d)d*� ��Z"eejj dd�e
d7d+d,���Z#ejjejj dd�e
d-d.� ��Z$� Z%S )8�FirewallDConfigPolicyTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.policy.%d)
�superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_POLICY)�selfr ZconfZpolicyr �args�kwargs)� __class__� �#/usr/lib/python3.6/config_policy.pyr s
z FirewallDConfigPolicy.__init__c C s d S )Nr )r r r r �__del__( s z FirewallDConfigPolicy.__del__c C s | j � d S )N)Zremove_from_connection)r r r r �
unregister, s z FirewallDConfigPolicy.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r r r ZBooleanr! r" �
exceptions�
DBusException)r �
property_namer r r �
_get_property4 s z#FirewallDConfigPolicy._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r$ r% r' )r �interface_namer& �senderr r r �GetE s
zFirewallDConfigPolicy.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr r r r! r" Zsv)� signature)r r r r! r" ) r r+ r r, r r r r r$ r% r' Z
Dictionary)r r- r. �ret�xr r r �GetAllV s
z FirewallDConfigPolicy.GetAllZssv)r) c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r+ r r, r r � accessCheckr r r r$ r% )r r- r& Z new_valuer. r r r �Setg s
zFirewallDConfigPolicy.Setzsa{sv}as)r1 c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r+ r r, r )r r- Zchanged_propertiesZinvalidated_propertiesr r r �PropertiesChanged{ s
z'FirewallDConfigPolicy.PropertiesChanged)r* c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r
r �
Introspectr r Zget_busr r r r )r r. �data)r r r r8 � s
z FirewallDConfigPolicy.Introspectc C s t jd| j� | jj| j�}|S )z get settings for policy
z%s.getSettings())r r, r r Z get_policy_object_config_dictr )r r. �settingsr r r � getSettings� s z!FirewallDConfigPolicy.getSettingsc C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� dS )z#update settings for policy
z%s.update('...')N) r r r, r r r5 r Z set_policy_object_config_dictr �Updatedr )r r: r. r r r �update� s
z FirewallDConfigPolicy.updatec C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z1load default settings for builtin policy
z%s.loadDefaults()N)
r r, r r r5 r Zload_policy_object_defaultsr r< r )r r. r r r � loadDefaults� s z"FirewallDConfigPolicy.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r, r )r r r r r r< � s z FirewallDConfigPolicy.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove policy
z%s.removePolicy()N) r r, r r r5 r Zremove_policy_objectr Z removePolicy)r r. r r r �remove� s z FirewallDConfigPolicy.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r, r )r r r r r �Removed� s z FirewallDConfigPolicy.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename policy
z%s.rename('%s')N) r r+ r r, r r r5 r Zrename_policy_objectr �Renamed)r r r. r r r �rename� s
z FirewallDConfigPolicy.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r, r )r r r r r rA � s z FirewallDConfigPolicy.Renamed)N)N)N)N)N)N)N)N)N)&�__name__�
__module__� __qualname__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r r r' r
ZPROPERTIES_IFACEr/ r4 �slipZpolkitZ require_authr6 �service�signalr7 ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr8 r r; r= r> r< r? r@ rB rA �
__classcell__r r )r r r s^
r )Z
gi.repositoryr �sys�modulesr Z dbus.serviceZ slip.dbusrF Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.loggerr Zfirewall.server.decoratorsr r r
rG ZObjectr r r r r �<module> s
server/__pycache__/config_zone.cpython-36.opt-1.pyc 0000644 00000101501 15035135172 0016147 0 ustar 00 3
��gW� � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZ d d lmZmZm Z d d l m Z d d
l m Z d dl m!Z!m"Z"m#Z#m$Z$ G dd� dejj%j&�Z'dS )� )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�Zone)�ifcfg_set_zone_of_interface)�DEFAULT_ZONE_TARGET)� Rich_Rule)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�errors)�
FirewallError)�portStr�portInPortRange�coalescePortRange�breakPortRangec s� e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z
e d d
� �Zeejd d d
�e d�dd���Zeejddd
�e d�dd���Zejjjejj�eejdd�e d�dd����Zejjejdd�dd � �Zejjjejj�eejdd �e d�� fd d � ���Z eejj d d �e d�d!d"���Z eejj dd �e d�d#d$���Z d%d&� Z eejj d d�e d�d'd(���Z!eejj dd�e d�d)d*���Z"eejj �e d�d+d,���Z#ejjejj dd�e d-d.� ��Z$eejj �e d�d/d0���Z%ejjejj dd�e d1d2� ��Z&eejj dd�e d�d3d4���Z'ejjejj dd�e d5d6� ��Z(eejj dd �e d�d7d8���Z)eejj dd�e d�d9d:���Z*eejj dd �e d�d;d<���Z+eejj dd�e d�d=d>���Z,eejj dd �e d�d?d@���Z-eejj dd�e d�dAdB���Z.eejj dd �e d�dCdD���Z/eejj dd�e d�dEdF���Z0eejj dGd �e d�dHdI���Z1eejj dGd�e d�dJdK���Z2eejj dd�e d�dLdM���Z3eejj dd�e d�dNdO���Z4eejj ddPd
�e d�dQdR���Z5eejj dSd �e d�dTdU���Z6eejj dSd�e d�dVdW���Z7eejj d d�e d�dXdY���Z8eejj d d�e d�dZd[���Z9eejj d dPd
�e d�d\d]���Z:eejj dGd �e d�d^d_���Z;eejj dGd�e d�d`da���Z<eejj dd�e d�dbdc���Z=eejj dd�e d�ddde���Z>eejj ddPd
�e d�dfdg���Z?eejj dSd �e d�dhdi���Z@eejj dSd�e d�djdk���ZAeejj d d�e d�dldm���ZBeejj d d�e d�dndo���ZCeejj d dPd
�e d�dpdq���ZDeejj dGd �e d�drds���ZEeejj dGd�e d�dtdu���ZFeejj dd�e d�dvdw���ZGeejj dd�e d�dxdy���ZHeejj ddPd
�e d�dzd{���ZIeejj dPd �e d�d|d}���ZJeejj dPd�e d�d~d���ZKeejj �e d�d�d����ZLeejj �e d�d�d����ZMeejj dPd �e d�d�d����ZNeejj dPd �e d�d�d����ZOeejj dPd�e d�d�d����ZPeejj �e d�d�d����ZQeejj �e d�d�d����ZReejj dPd �e d�d�d����ZSeejj d�d �e d�d�d����ZTeejj d�d�e d�d�d����ZUeejj d�d�e d�d�d����ZVeejj d�d�e d�d�d����ZWeejj d�dPd
�e d�d�d����ZXeejj dGd �e d�d�d����ZYeejj dGd�e d�d�d����ZZeejj dd�e d�d�d����Z[eejj dd�e d�d�d����Z\eejj ddPd
�e d�d�d����Z]eejj dGd �e d�d�d����Z^eejj dGd�e d�d�d����Z_eejj dd�e d�d�d����Z`eejj dd�e d�d�d����Zaeejj ddPd
�e d�d�d����Zbeejj dGd �e d�d�d����Zceejj dGd�e �d d�d����Zdeejj dd�e �dd�d����Zeeejj dd�e �dd�d����Zfeejj ddPd
�e �dd�d����Zg� ZhS ( �FirewallDConfigZonezFirewallD main classTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.zone.%d)
�superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus�DBUS_INTERFACE_CONFIG_ZONE)�selfr ZconfZzoner �args�kwargs)� __class__� �!/usr/lib/python3.6/config_zone.pyr = s
z FirewallDConfigZone.__init__c C s d S )Nr% )r! r% r% r& �__del__J s zFirewallDConfigZone.__del__c C s | j � d S )N)Zremove_from_connection)r! r% r% r& �
unregisterN s z FirewallDConfigZone.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r) r* r ZBooleanr+ r, �
exceptions�
DBusException)r! �
property_namer% r% r& �
_get_propertyV s z!FirewallDConfigZone._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r. r/ r1 )r! �interface_namer0 �senderr% r% r& �Getg s
zFirewallDConfigZone.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr) r* r r+ r, Zsv)� signature)r) r* r r+ r, ) r r5 r r6 r r r r r. r/ r1 Z
Dictionary)r! r7 r8 �ret�xr% r% r& �GetAllx s
zFirewallDConfigZone.GetAllZssv)r3 c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r5 r r6 r r � accessCheckr r r r. r/ )r! r7 r0 Z new_valuer8 r% r% r& �Set� s
zFirewallDConfigZone.Setzsa{sv}as)r; c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r5 r r6 r )r! r7 Zchanged_propertiesZinvalidated_propertiesr% r% r& �PropertiesChanged� s
z%FirewallDConfigZone.PropertiesChanged)r4 c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r r �
Introspectr r Zget_busr r r r )r! r8 �data)r$ r% r& rB � s
z FirewallDConfigZone.Introspectz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sD t jd| j� | jj| j�}|d tkr@t|�}d|d< t|�}|S )z get settings for zone
z%s.getSettings()� r+ ) r r6 r r Zget_zone_configr r �list�tuple)r! r8 �settings� _settingsr% r% r& � getSettings� s z FirewallDConfigZone.getSettingsc C s4 t jd| j� | jj| j�}|d tkr0d|d< |S )z get settings for zone
z%s.getSettings2()�targetr+ )r r6 r r �get_zone_config_dictr r )r! r8 rG r% r% r& � getSettings2� s
z FirewallDConfigZone.getSettings2c C s | j j| j�}d|kr"t|d �nt� }d|kr<t|d �nt� }t|t�rzt|tjd� �| }t|tjd� �| }nDd|kr�t|d �nt� }d|kr�t|d �nt� }|| }|| }x$|D ] } | jj | �r�t
t j | ��q�W x$|D ] }
| jj
|
�r�t
t j |
��q�W dS )a
Assignment of interfaces/sources to zones is different from other
zone settings in the sense that particular interface/zone can be
part of only one zone. So make sure added interfaces/sources have
not already been bound to another zone.�
interfaces�sourcesN)r rK r �set�
isinstancerF r Zindex_ofr ZgetZoneOfInterfacer r Z
ZONE_CONFLICTZgetZoneOfSource) r! rG Z old_settingsZ
old_ifacesZ old_sourcesZ added_ifacesZ
added_sourcesZ
new_ifacesZ new_sourcesZiface�sourcer% r% r& � _checkDuplicateInterfacesSources� s
z4FirewallDConfigZone._checkDuplicateInterfacesSourcesc C st t |�}tjd| j� | jj|� |d dkrFt|�}t|d< t|�}| j |� | j
j | j |�| _ | j
| j j� dS )z!update settings for zone
z%s.update('...')rD r+ N)r r r6 r r r? rE r rF rR r Zset_zone_configr �Updatedr) )r! rG r8 rH r% r% r& �update� s
zFirewallDConfigZone.updatec C sl t |�}tjd| j� | jj|� d|kr>|d dkr>t|d< | j|� | jj | j
|�| _
| j | j
j � dS )z!update settings for zone
z%s.update2('...')rJ r+ N)
r r r6 r r r? r rR r Zset_zone_config_dictr rS r) )r! rG r8 r% r% r& �update2� s
zFirewallDConfigZone.update2c C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z/load default settings for builtin zone
z%s.loadDefaults()N)
r r6 r r r? r Zload_zone_defaultsr rS r) )r! r8 r% r% r& � loadDefaults s z FirewallDConfigZone.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r6 r )r! r) r% r% r& rS s zFirewallDConfigZone.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove zone
z%s.removeZone()N) r r6 r r r? r Z remove_zoner Z
removeZone)r! r8 r% r% r& �remove s zFirewallDConfigZone.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r6 r )r! r) r% r% r& �Removed# s zFirewallDConfigZone.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename zone
z%s.rename('%s')N) r r5 r r6 r r r? r Z rename_zoner �Renamed)r! r) r8 r% r% r& �rename* s
zFirewallDConfigZone.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r6 r )r! r) r% r% r& rY 6 s zFirewallDConfigZone.Renamedc C s t jd| j� | j� d S )Nz%s.getVersion()r )r r6 r rI )r! r8 r% r% r& �
getVersion= s z FirewallDConfigZone.getVersionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setVersion('%s')r )
r r5 r r6 r r r? rE rI rT )r! �versionr8 rG r% r% r& �
setVersionD s
z FirewallDConfigZone.setVersionc C s t jd| j� | j� d S )Nz
%s.getShort()r )r r6 r rI )r! r8 r% r% r& �getShortQ s z FirewallDConfigZone.getShortc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setShort('%s')r )
r r5 r r6 r r r? rE rI rT )r! Zshortr8 rG r% r% r& �setShortX s
z FirewallDConfigZone.setShortc C s t jd| j� | j� d S )Nz%s.getDescription()� )r r6 r rI )r! r8 r% r% r& �getDescriptione s z"FirewallDConfigZone.getDescriptionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDescription('%s')r` )
r r5 r r6 r r r? rE rI rT )r! � descriptionr8 rG r% r% r& �setDescriptionl s
z"FirewallDConfigZone.setDescriptionc C s. t jd| j� | j� }|d tkr*|d S dS )Nz%s.getTarget()rD r+ )r r6 r rI r )r! r8 rG r% r% r& � getTarget| s z FirewallDConfigZone.getTargetc C sT t |t�}tjd| j|� | jj|� t| j� �}|dkr>|nt |d< | j
|� d S )Nz%s.setTarget('%s')r+ rD ) r r5 r r6 r r r? rE rI r rT )r! rJ r8 rG r% r% r& � setTarget� s
z FirewallDConfigZone.setTarget�asc C s t jd| j� | j� d S )Nz%s.getServices()� )r r6 r rI )r! r8 r% r% r& � getServices� s z FirewallDConfigZone.getServicesc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setServices('[%s]')�,rg )
r rE r r6 r �joinr r? rI rT )r! Zservicesr8 rG r% r% r& � setServices� s
z FirewallDConfigZone.setServicesc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addService('%s')rg )r r5 r r6 r r r? rE rI r r �ALREADY_ENABLED�appendrT )r! �servicer8 rG r% r% r& �
addService� s
z FirewallDConfigZone.addServicec C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.removeService('%s')rg )r r5 r r6 r r r? rE rI r r � NOT_ENABLEDrW rT )r! rn r8 rG r% r% r& �
removeService� s
z!FirewallDConfigZone.removeService�bc C s* t |t�}tjd| j|� || j� d kS )Nz%s.queryService('%s')rg )r r5 r r6 r rI )r! rn r8 r% r% r& � queryService� s
z FirewallDConfigZone.queryServiceza(ss)c C s t jd| j� | j� d S )Nz
%s.getPorts()� )r r6 r rI )r! r8 r% r% r& �getPorts� s z FirewallDConfigZone.getPortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setPorts('[%s]')ri c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr% )�.0�portr% r% r& � <genexpr>� s z/FirewallDConfigZone.setPorts.<locals>.<genexpr>rt )
r rE rP rm rF r r6 r rj r r? rI rT )r! �portsr8 �_portsrw rG r% r% r& �setPorts� s
z FirewallDConfigZone.setPortsc
s� t |t�}t � t�� tjd| j|� � | jj|� t| j� �}tt � fdd�|d ��}x.|D ]&}t
||d �r^t t j
d|� f ��q^W t|dd� |D ��\}}x$|D ] } |d jt| d �� f� q�W x$|D ] } |d jt| d �� f� q�W | j|� d S )
Nz%s.addPort('%s', '%s')c s | d � kS )Nr r% )r= )�protocolr% r& �<lambda>� s z-FirewallDConfigZone.addPort.<locals>.<lambda>rt r z%s:%sc S s g | ] \}}|�qS r% r% )rv �_port� _protocolr% r% r& �
<listcomp>� s z/FirewallDConfigZone.addPort.<locals>.<listcomp>�-)r r5 r r6 r r r? rE rI �filterr r r rl r rW r rm rT )
r! rw r| r8 rG �existing_port_ids�port_id� added_ranges�removed_ranges�ranger% )r| r& �addPort� s"
zFirewallDConfigZone.addPortc
s� t |t�}t � t�� tjd| j|� � | jj|� t| j� �}tt � fdd�|d ��}x0|D ]}t
||d �r^P q^W t t j
d|� f ��t|dd� |D ��\}}x$|D ] } |d jt| d �� f� q�W x$|D ] } |d jt| d �� f� q�W | j|� d S )
Nz%s.removePort('%s', '%s')c s | d � kS )Nr r% )r= )r| r% r& r} s z0FirewallDConfigZone.removePort.<locals>.<lambda>rt r z%s:%sc S s g | ] \}}|�qS r% r% )rv r~ r r% r% r& r� s z2FirewallDConfigZone.removePort.<locals>.<listcomp>r� )r r5 r r6 r r r? rE rI r� r r r rp r rW r rm rT )
r! rw r| r8 rG r� r� r� r� r� r% )r| r& �
removePort� s"
z FirewallDConfigZone.removePortc C sZ t |t�}t |t�}tjd| j||� x.| j� d D ] \}}t||�r4||kr4dS q4W dS )Nz%s.queryPort('%s', '%s')rt TF)r r5 r r6 r rI r )r! rw r| r8 r~ r r% r% r& � queryPort s
z FirewallDConfigZone.queryPortc C s t jd| j� | j� d S )Nz%s.getProtocols()�
)r r6 r rI )r! r8 r% r% r& � getProtocols s z FirewallDConfigZone.getProtocolsc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setProtocols('[%s]')ri r� )
r rE r r6 r rj r r? rI rT )r! Z protocolsr8 rG r% r% r& � setProtocols& s
z FirewallDConfigZone.setProtocolsc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addProtocol('%s')r� )r r5 r r6 r r r? rE rI r r rl rm rT )r! r| r8 rG r% r% r& � addProtocol2 s
z FirewallDConfigZone.addProtocolc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.removeProtocol('%s')r� )r r5 r r6 r r r? rE rI r r rp rW rT )r! r| r8 rG r% r% r& �removeProtocol? s
z"FirewallDConfigZone.removeProtocolc C s* t |t�}tjd| j|� || j� d kS )Nz%s.queryProtocol('%s')r� )r r5 r r6 r rI )r! r| r8 r% r% r& �
queryProtocolL s
z!FirewallDConfigZone.queryProtocolc C s t jd| j� | j� d S )Nz%s.getSourcePorts()� )r r6 r rI )r! r8 r% r% r& �getSourcePortsV s z"FirewallDConfigZone.getSourcePortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setSourcePorts('[%s]')ri c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr% )rv rw r% r% r& rx j s z5FirewallDConfigZone.setSourcePorts.<locals>.<genexpr>r� )
r rE rP rm rF r r6 r rj r r? rI rT )r! ry r8 rz rw rG r% r% r& �setSourcePorts] s
z"FirewallDConfigZone.setSourcePortsc
s� t |t�}t � t�� tjd| j|� � | jj|� t| j� �}tt � fdd�|d ��}x.|D ]&}t
||d �r^t t j
d|� f ��q^W t|dd� |D ��\}}x$|D ] } |d jt| d �� f� q�W x$|D ] } |d jt| d �� f� q�W | j|� d S )
Nz %s.addSourcePort('%s', '%s')c s | d � kS )Nr r% )r= )r| r% r& r} z s z3FirewallDConfigZone.addSourcePort.<locals>.<lambda>r� r z%s:%sc S s g | ] \}}|�qS r% r% )rv r~ r r% r% r& r� s z5FirewallDConfigZone.addSourcePort.<locals>.<listcomp>r� )r r5 r r6 r r r? rE rI r� r r r rl r rW r rm rT )
r! rw r| r8 rG r� r� r� r� r� r% )r| r& �
addSourcePortp s"
z!FirewallDConfigZone.addSourcePortc
s� t |t�}t � t�� tjd| j|� � | jj|� t| j� �}tt � fdd�|d ��}x0|D ]}t
||d �r^P q^W t t j
d|� f ��t|dd� |D ��\}}x$|D ] } |d jt| d �� f� q�W x$|D ] } |d jt| d �� f� q�W | j|� d S )
Nz %s.removeSourcePort('%s', '%s')c s | d � kS )Nr r% )r= )r| r% r& r} � s z6FirewallDConfigZone.removeSourcePort.<locals>.<lambda>r� r z%s:%sc S s g | ] \}}|�qS r% r% )rv r~ r r% r% r& r� � s z8FirewallDConfigZone.removeSourcePort.<locals>.<listcomp>r� )r r5 r r6 r r r? rE rI r� r r r rp r rW r rm rT )
r! rw r| r8 rG r� r� r� r� r� r% )r| r& �removeSourcePort� s"
z$FirewallDConfigZone.removeSourcePortc C sZ t |t�}t |t�}tjd| j||� x.| j� d D ] \}}t||�r4||kr4dS q4W dS )Nz %s.querySourcePort('%s', '%s')r� TF)r r5 r r6 r rI r )r! rw r| r8 r~ r r% r% r& �querySourcePort� s
z#FirewallDConfigZone.querySourcePortc C s t jd| j� | j� d S )Nz%s.getIcmpBlocks()� )r r6 r rI )r! r8 r% r% r& �
getIcmpBlocks� s z!FirewallDConfigZone.getIcmpBlocksc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setIcmpBlocks('[%s]')ri r� )
r rE r r6 r rj r r? rI rT )r! Z icmptypesr8 rG r% r% r& �
setIcmpBlocks� s
z!FirewallDConfigZone.setIcmpBlocksc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addIcmpBlock('%s')r� )r r5 r r6 r r r? rE rI r r rl rm rT )r! �icmptyper8 rG r% r% r& � addIcmpBlock� s
z FirewallDConfigZone.addIcmpBlockc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.removeIcmpBlock('%s')r� )r r5 r r6 r r r? rE rI r r rp rW rT )r! r� r8 rG r% r% r& �removeIcmpBlock� s
z#FirewallDConfigZone.removeIcmpBlockc C s* t |t�}tjd| j|� || j� d kS )Nz%s.queryIcmpBlock('%s')r� )r r5 r r6 r rI )r! r� r8 r% r% r& �queryIcmpBlock� s
z"FirewallDConfigZone.queryIcmpBlockc C s t jd| j� | j� d S )Nz%s.getIcmpBlockInversion()� )r r6 r rI )r! r8 r% r% r& �getIcmpBlockInversion� s z)FirewallDConfigZone.getIcmpBlockInversionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz %s.setIcmpBlockInversion('%s')r� )
r �boolr r6 r r r? rE rI rT )r! �flagr8 rG r% r% r& �setIcmpBlockInversion� s
z)FirewallDConfigZone.setIcmpBlockInversionc C sP t jd| j� | jj|� t| j� �}|d r:ttj d��d|d< | j
|� d S )Nz%s.addIcmpBlockInversion()r� zicmp-block-inversionT) r r6 r r r? rE rI r r rl rT )r! r8 rG r% r% r& �addIcmpBlockInversion� s z)FirewallDConfigZone.addIcmpBlockInversionc C sP t jd| j� | jj|� t| j� �}|d s:ttj d��d|d< | j
|� d S )Nz %s.removeIcmpBlockInversion()r� zicmp-block-inversionF) r r6 r r r? rE rI r r rp rT )r! r8 rG r% r% r& �removeIcmpBlockInversion s z,FirewallDConfigZone.removeIcmpBlockInversionc C s t jd| j� | j� d S )Nz %s.queryIcmpBlockInversion()r� )r r6 r rI )r! r8 r% r% r& �queryIcmpBlockInversion s z+FirewallDConfigZone.queryIcmpBlockInversionc C s t jd| j� | j� d S )Nz%s.getMasquerade()� )r r6 r rI )r! r8 r% r% r& �
getMasquerade s z!FirewallDConfigZone.getMasqueradec C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setMasquerade('%s')r� )
r r� r r6 r r r? rE rI rT )r! �
masquerader8 rG r% r% r& �
setMasquerade s
z!FirewallDConfigZone.setMasqueradec C sP t jd| j� | jj|� t| j� �}|d r:ttj d��d|d< | j
|� d S )Nz%s.addMasquerade()r� r� T) r r6 r r r? rE rI r r rl rT )r! r8 rG r% r% r& �
addMasquerade' s z!FirewallDConfigZone.addMasqueradec C sP t jd| j� | jj|� t| j� �}|d s:ttj d��d|d< | j
|� d S )Nz%s.removeMasquerade()r� r� F) r r6 r r r? rE rI r r rp rT )r! r8 rG r% r% r& �removeMasquerade2 s z$FirewallDConfigZone.removeMasqueradec C s t jd| j� | j� d S )Nz%s.queryMasquerade()r� )r r6 r rI )r! r8 r% r% r& �queryMasquerade= s z#FirewallDConfigZone.queryMasqueradeza(ssss)c C s t jd| j� | j� d S )Nz%s.getForwardPorts()� )r r6 r rI )r! r8 r% r% r& �getForwardPortsF s z#FirewallDConfigZone.getForwardPortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setForwardPorts('[%s]')ri c s s. | ]&}d |d |d |d |d f V qdS )z('%s, '%s', '%s', '%s')r r r` � Nr% )rv rw r% r% r& rx Z s z6FirewallDConfigZone.setForwardPorts.<locals>.<genexpr>r� )
r rE rP rm rF r r6 r rj r r? rI rT )r! ry r8 rz rw rG r% r% r& �setForwardPortsM s
z#FirewallDConfigZone.setForwardPortsZssssc C s� t |t�}t |t�}t |t�}t |t�}tjd| j||||� | jj|� ||t|�t|�f}t| j� �}||d kr�t t
j d||||f ��|d j |� | j
|� d S )Nz)%s.addForwardPort('%s', '%s', '%s', '%s')r� z %s:%s:%s:%s)r r5 r r6 r r r? rE rI r r rl rm rT )r! rw r| �toport�toaddrr8 �fwp_idrG r% r% r& �addForwardPorta s
z"FirewallDConfigZone.addForwardPortc C s� t |t�}t |t�}t |t�}t |t�}tjd| j||||� | jj|� ||t|�t|�f}t| j� �}||d kr�t t
j d||||f ��|d j |� | j
|� d S )Nz,%s.removeForwardPort('%s', '%s', '%s', '%s')r� z %s:%s:%s:%s)r r5 r r6 r r r? rE rI r r rp rW rT )r! rw r| r� r� r8 r� rG r% r% r& �removeForwardPortu s
z%FirewallDConfigZone.removeForwardPortc C sb t |t�}t |t�}t |t�}t |t�}tjd| j||||� ||t|�t|�f}|| j� d kS )Nz+%s.queryForwardPort('%s', '%s', '%s', '%s')r� )r r5 r r6 r rI )r! rw r| r� r� r8 r� r% r% r& �queryForwardPort� s
z$FirewallDConfigZone.queryForwardPortc C s t jd| j� | j� d S )Nz%s.getInterfaces()�
)r r6 r rI )r! r8 r% r% r& �
getInterfaces� s z!FirewallDConfigZone.getInterfacesc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setInterfaces('[%s]')ri r� )
r rE r r6 r rj r r? rI rT )r! rM r8 rG r% r% r& �
setInterfaces� s
z!FirewallDConfigZone.setInterfacesc C st t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� t| jj|� d S )Nz%s.addInterface('%s')r� )r r5 r r6 r r r? rE rI r r rl rm rT r r r) )r! � interfacer8 rG r% r% r& � addInterface� s
z FirewallDConfigZone.addInterfacec C sp t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� td|� d S )Nz%s.removeInterface('%s')r� � )r r5 r r6 r r r? rE rI r r rp rW rT r )r! r� r8 rG r% r% r& �removeInterface� s
z#FirewallDConfigZone.removeInterfacec C s* t |t�}tjd| j|� || j� d kS )Nz%s.queryInterface('%s')r� )r r5 r r6 r rI )r! r� r8 r% r% r& �queryInterface� s
z"FirewallDConfigZone.queryInterfacec C s t jd| j� | j� d S )Nz%s.getSources()� )r r6 r rI )r! r8 r% r% r& �
getSources� s z FirewallDConfigZone.getSourcesc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setSources('[%s]')ri r� )
r rE r r6 r rj r r? rI rT )r! rN r8 rG r% r% r& �
setSources� s
z FirewallDConfigZone.setSourcesc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addSource('%s')r� )r r5 r r6 r r r? rE rI r r rl rm rT )r! rQ r8 rG r% r% r& � addSource� s
z FirewallDConfigZone.addSourcec C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.removeSource('%s')r� )r r5 r r6 r r r? rE rI r r rp rW rT )r! rQ r8 rG r% r% r& � removeSource� s
z FirewallDConfigZone.removeSourcec C s* t |t�}tjd| j|� || j� d kS )Nz%s.querySource('%s')r� )r r5 r r6 r rI )r! rQ r8 r% r% r& � querySource s
z FirewallDConfigZone.querySourcec C s t jd| j� | j� d S )Nz%s.getRichRules()� )r r6 r rI )r! r8 r% r% r& � getRichRules s z FirewallDConfigZone.getRichRulesc C s\ t |t�}tjd| jdj|�� | jj|� t| j� �}dd� |D �}||d< | j |� d S )Nz%s.setRichRules('[%s]')ri c S s g | ]}t t|d ���qS ))�rule_str)r5 r
)rv �rr% r% r& r� s z4FirewallDConfigZone.setRichRules.<locals>.<listcomp>r� )
r rE r r6 r rj r r? rI rT )r! Zrulesr8 rG r% r% r& � setRichRules s
z FirewallDConfigZone.setRichRulesc C st t |t�}tjd| j|� | jj|� t| j� �}tt |d��}||d krXt
t j |��|d j
|� | j|� d S )Nz%s.addRichRule('%s'))r� r� )r r5 r r6 r r r? rE rI r
r r rl rm rT )r! �ruler8 rG r� r% r% r& � addRichRule s
z FirewallDConfigZone.addRichRulec C st t |t�}tjd| j|� | jj|� t| j� �}tt |d��}||d krXt
t j |��|d j
|� | j|� d S )Nz%s.removeRichRule('%s'))r� r� )r r5 r r6 r r r? rE rI r
r r rp rW rT )r! r� r8 rG r� r% r% r& �removeRichRule. s
z"FirewallDConfigZone.removeRichRulec C s8 t |t�}tjd| j|� tt|d��}|| j� d kS )Nz%s.queryRichRule('%s'))r� r� )r r5 r r6 r r
rI )r! r� r8 r� r% r% r& �
queryRichRule< s
z!FirewallDConfigZone.queryRichRule)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)i�__name__�
__module__� __qualname__�__doc__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r
r' r( r1 r ZPROPERTIES_IFACEr9 r> �slipZpolkitZ require_authr@ rn �signalrA ZPK_ACTION_INFOZINTROSPECTABLE_IFACErB r rI rL rR rT rU rV rS rW rX rZ rY r[ r] r^ r_ ra rc rd re rh rk ro rq rs ru r{ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� �
__classcell__r% r% )r$ r& r 5 sf
r )(Z
gi.repositoryr �sys�modulesr Z dbus.serviceZ slip.dbusr� Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.zoner Zfirewall.core.fw_ifcfgr Zfirewall.core.baser Zfirewall.core.richr
Zfirewall.core.loggerr Zfirewall.server.decoratorsr r
r r Zfirewall.errorsr Zfirewall.functionsr r r r rn ZObjectr r% r% r% r& �<module> s$
server/__pycache__/config_helper.cpython-36.opt-1.pyc 0000644 00000030613 15035135172 0016460 0 ustar 00 3
��g�D � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZ d dlmZmZmZ d d l mZ d d
lmZ G d d � d ejjj�Z dS )
� )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�Helper)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�errors)�
FirewallErrorc s e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z
e d d
� �Zeejd d d
�e dTdd���Zeejddd
�e dUdd���Zejjjejj�eejdd�e dVdd����Zejjejdd�dd � �Zejjjejj�eejdd �e dW� fd d � ���Z eejj e j d �e dXd d!���Z eejj e j d�e dYd"d#���Z!eejj �e dZd$d%���Z"ejjejj dd�e d&d'� ��Z#eejj �e d[d(d)���Z$ejjejj dd�e d*d+� ��Z%eejj dd�e d\d,d-���Z&ejjejj dd�e d.d/� ��Z'eejj dd �e d]d0d1���Z(eejj dd�e d^d2d3���Z)eejj dd �e d_d4d5���Z*eejj dd�e d`d6d7���Z+eejj dd �e dad8d9���Z,eejj dd�e dbd:d;���Z-eejj dd �e dcd<d=���Z.eejj dd�e ddd>d?���Z/eejj dd@d
�e dedAdB���Z0eejj dd �e dfdCdD���Z1eejj dd�e dgdEdF���Z2eejj dd@d
�e dhdGdH���Z3eejj dId �e didJdK���Z4eejj dId�e djdLdM���Z5eejj d d�e dkdNdO���Z6eejj d d�e dldPdQ���Z7eejj d d@d
�e dmdRdS���Z8� Z9S )n�FirewallDConfigHelperzFirewallD main classTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.helper.%d)
�superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_HELPER)�selfr Zconf�helperr �args�kwargs)� __class__� �#/usr/lib/python3.6/config_helper.pyr 8 s
z FirewallDConfigHelper.__init__c C s d S )Nr )r r r r �__del__E s z FirewallDConfigHelper.__del__c C s | j � d S )N)Zremove_from_connection)r r r r �
unregisterI s z FirewallDConfigHelper.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r# r$ r ZBooleanr% r& �
exceptions�
DBusException)r �
property_namer r r �
_get_propertyQ s z#FirewallDConfigHelper._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r( r) r+ )r �interface_namer* �senderr r r �Getb s
zFirewallDConfigHelper.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr# r$ r r% r& Zsv)� signature)r# r$ r r% r& ) r r/ r r0 r r r r r( r) r+ Z
Dictionary)r r1 r2 �ret�xr r r �GetAlls s
z FirewallDConfigHelper.GetAllZssv)r- c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r/ r r0 r r � accessCheckr r r r( r) )r r1 r* Z new_valuer2 r r r �Set� s
zFirewallDConfigHelper.Setzsa{sv}as)r5 c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r/ r r0 r )r r1 Zchanged_propertiesZinvalidated_propertiesr r r �PropertiesChanged� s
z'FirewallDConfigHelper.PropertiesChanged)r. c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r r �
Introspectr r Zget_busr r r r )r r2 �data)r r r r< � s
z FirewallDConfigHelper.Introspectc C s t jd| j� | jj| j�S )z get settings for helper
z%s.getSettings())r r0 r r Zget_helper_configr )r r2 r r r � getSettings� s z!FirewallDConfigHelper.getSettingsc C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� dS )z#update settings for helper
z%s.update('...')N) r r r0 r r r9 r Zset_helper_configr �Updatedr# )r �settingsr2 r r r �update� s
z FirewallDConfigHelper.updatec C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z1load default settings for builtin helper
z%s.loadDefaults()N)
r r0 r r r9 r Zload_helper_defaultsr r? r# )r r2 r r r � loadDefaults� s z"FirewallDConfigHelper.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r0 r )r r# r r r r? � s z FirewallDConfigHelper.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove helper
z%s.removeHelper()N) r r0 r r r9 r Z
remove_helperr Z removeHelper)r r2 r r r �remove� s z FirewallDConfigHelper.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r0 r )r r# r r r �Removed� s z FirewallDConfigHelper.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename helper
z%s.rename('%s')N) r r/ r r0 r r r9 r Z
rename_helperr �Renamed)r r# r2 r r r �rename� s
z FirewallDConfigHelper.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r0 r )r r# r r r rE � s z FirewallDConfigHelper.Renamedc C s t jd| j� | j� d S )Nz%s.getVersion()r )r r0 r r> )r r2 r r r �
getVersion� s z FirewallDConfigHelper.getVersionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setVersion('%s')r )
r r/ r r0 r r r9 �listr> rA )r �versionr2 r@ r r r �
setVersion s
z FirewallDConfigHelper.setVersionc C s t jd| j� | j� d S )Nz
%s.getShort()r )r r0 r r> )r r2 r r r �getShort s z FirewallDConfigHelper.getShortc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setShort('%s')r )
r r/ r r0 r r r9 rH r> rA )r Zshortr2 r@ r r r �setShort s
z FirewallDConfigHelper.setShortc C s t jd| j� | j� d S )Nz%s.getDescription()� )r r0 r r> )r r2 r r r �getDescription$ s z$FirewallDConfigHelper.getDescriptionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDescription('%s')rM )
r r/ r r0 r r r9 rH r> rA )r � descriptionr2 r@ r r r �setDescription+ s
z$FirewallDConfigHelper.setDescriptionc C s. t jd| j� | jj|� t| j� �}|d S )Nz%s.getFamily()� )r r0 r r r9 rH r> )r r2 r@ r r r � getFamily9 s z FirewallDConfigHelper.getFamilyc C sd t |t�}tjd| j|� | jj|� t| j� �}|d |krNt t
j d| ��||d< | j |� d S )Nz%s.setFamily('%s')rQ z'%s')
r r/ r r0 r r r9 rH r> r
r �ALREADY_ENABLEDrA )r �ipvr2 r@ r r r � setFamilyB s
z FirewallDConfigHelper.setFamily�bc C s. t |t�}tjd| j|� | j� }|d |kS )Nz%s.queryFamily('%s')rQ )r r/ r r0 r r> )r rT r2 r@ r r r � queryFamilyO s
z!FirewallDConfigHelper.queryFamilyc C s. t jd| j� | jj|� t| j� �}|d S )Nz%s.getModule()� )r r0 r r r9 rH r> )r r2 r@ r r r � getModuleZ s z FirewallDConfigHelper.getModulec C sd t |t�}tjd| j|� | jj|� t| j� �}|d |krNt t
j d| ��||d< | j |� d S )Nz%s.setModule('%s')rX z'%s')
r r/ r r0 r r r9 rH r> r
r rS rA )r �moduler2 r@ r r r � setModulec s
z FirewallDConfigHelper.setModulec C s. t |t�}tjd| j|� | j� }|d |kS )Nz%s.queryModule('%s')rX )r r/ r r0 r r> )r rZ r2 r@ r r r � queryModulep s
z!FirewallDConfigHelper.queryModuleza(ss)c C s t jd| j� | j� d S )Nz
%s.getPorts()� )r r0 r r> )r r2 r r r �getPorts{ s z FirewallDConfigHelper.getPortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setPorts('[%s]')�,c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr )�.0�portr r r � <genexpr>� s z1FirewallDConfigHelper.setPorts.<locals>.<genexpr>r] )
r rH �
isinstance�append�tupler r0 r �joinr r9 r> rA )r Zportsr2 Z_portsra r@ r r r �setPorts� s
z FirewallDConfigHelper.setPortsc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz%s.addPort('%s', '%s')r] z%s:%s)r r/ r r0 r r r9 rH r> r
r rS rd rA )r ra �protocolr2 r@ r r r �addPort� s
z FirewallDConfigHelper.addPortc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz%s.removePort('%s', '%s')r] z%s:%s)r r/ r r0 r r r9 rH r> r
r Z NOT_ENABLEDrC rA )r ra rh r2 r@ r r r �
removePort� s
z FirewallDConfigHelper.removePortc C s: t |t�}t |t�}tjd| j||� ||f| j� d kS )Nz%s.queryPort('%s', '%s')r] )r r/ r r0 r r> )r ra rh r2 r r r � queryPort� s
z FirewallDConfigHelper.queryPort)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N):�__name__�
__module__� __qualname__�__doc__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r
r! r" r+ r ZPROPERTIES_IFACEr3 r8 �slipZpolkitZ require_authr: �service�signalr; ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr< r r ZDBUS_SIGNATUREr> rA rB r? rC rD rF rE rG rJ rK rL rN rP rR rU rW rY r[ r\ r^ rg ri rj rk �
__classcell__r r )r r r 0 s�
r ) Z
gi.repositoryr �sys�modulesr Z dbus.serviceZ slip.dbusrp Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.helperr Zfirewall.core.loggerr Zfirewall.server.decoratorsr r
r r Zfirewall.errorsr
rq ZObjectr r r r r �<module> s
server/__pycache__/config_policy.cpython-36.pyc 0000644 00000015354 15035135172 0015546 0 ustar 00 3
��g-! � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZmZmZ G dd � d ejjj�ZdS )
� )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_methodc s� e Zd ZdZejjZe� fdd��Z e
dd� �Z e
dd� �Z e
dd � �Z
eejd
d d �e
d/dd���Zeejddd �e
d0dd���Zejjjejj�eejdd�e
d1dd����Zejjejdd�dd� �Zejjjejj�eejdd �e
d2� fd d � ���Zeejj dd �e
d3d d ���Z eejj dd�e
d4d!d"���Z eejj �e
d5d#d$���Z ejjejj dd�e
d%d&� ��Z eejj �e
d6d'd(���Z!ejjejj dd�e
d)d*� ��Z"eejj dd�e
d7d+d,���Z#ejjejj dd�e
d-d.� ��Z$� Z%S )8�FirewallDConfigPolicyTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.policy.%d)
�superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_POLICY)�selfr ZconfZpolicyr �args�kwargs)� __class__� �#/usr/lib/python3.6/config_policy.pyr s
z FirewallDConfigPolicy.__init__c C s d S )Nr )r r r r �__del__( s z FirewallDConfigPolicy.__del__c C s | j � d S )N)Zremove_from_connection)r r r r �
unregister, s z FirewallDConfigPolicy.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r r r ZBooleanr! r" �
exceptions�
DBusException)r �
property_namer r r �
_get_property4 s z#FirewallDConfigPolicy._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r$ r% r' )r �interface_namer& �senderr r r �GetE s
zFirewallDConfigPolicy.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr r r r! r" Zsv)� signature)r r r r! r" ) r r+ r r, r r r r r$ r% r' Z
Dictionary)r r- r. �ret�xr r r �GetAllV s
z FirewallDConfigPolicy.GetAllZssv)r) c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r+ r r, r r � accessCheckr r r r$ r% )r r- r& Z new_valuer. r r r �Setg s
zFirewallDConfigPolicy.Setzsa{sv}as)r1 c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r+ r r, r )r r- Zchanged_propertiesZinvalidated_propertiesr r r �PropertiesChanged{ s
z'FirewallDConfigPolicy.PropertiesChanged)r* c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r
r �
Introspectr r Zget_busr r r r )r r. �data)r r r r8 � s
z FirewallDConfigPolicy.Introspectc C s t jd| j� | jj| j�}|S )z get settings for policy
z%s.getSettings())r r, r r Z get_policy_object_config_dictr )r r. �settingsr r r � getSettings� s z!FirewallDConfigPolicy.getSettingsc C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� dS )z#update settings for policy
z%s.update('...')N) r r r, r r r5 r Z set_policy_object_config_dictr �Updatedr )r r: r. r r r �update� s
z FirewallDConfigPolicy.updatec C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z1load default settings for builtin policy
z%s.loadDefaults()N)
r r, r r r5 r Zload_policy_object_defaultsr r< r )r r. r r r � loadDefaults� s z"FirewallDConfigPolicy.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r, r )r r r r r r< � s z FirewallDConfigPolicy.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove policy
z%s.removePolicy()N) r r, r r r5 r Zremove_policy_objectr Z removePolicy)r r. r r r �remove� s z FirewallDConfigPolicy.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r, r )r r r r r �Removed� s z FirewallDConfigPolicy.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename policy
z%s.rename('%s')N) r r+ r r, r r r5 r Zrename_policy_objectr �Renamed)r r r. r r r �rename� s
z FirewallDConfigPolicy.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r, r )r r r r r rA � s z FirewallDConfigPolicy.Renamed)N)N)N)N)N)N)N)N)N)&�__name__�
__module__� __qualname__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r r r' r
ZPROPERTIES_IFACEr/ r4 �slipZpolkitZ require_authr6 �service�signalr7 ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr8 r r; r= r> r< r? r@ rB rA �
__classcell__r r )r r r s^
r )Z
gi.repositoryr �sys�modulesr Z dbus.serviceZ slip.dbusrF Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.loggerr Zfirewall.server.decoratorsr r r
rG ZObjectr r r r r �<module> s
server/__pycache__/decorators.cpython-36.opt-1.pyc 0000644 00000004023 15035135172 0016015 0 ustar 00 3
��go � @ s� d Z ddddgZddlZddlZddlZddlmZ ddlmZ dd lm Z dd
l
m Z dd lm Z dd l
mZ G d
d� dej�Zedd� �Zedd� �Zdd� ZdS )z>This module contains decorators for use with and without D-Bus�FirewallDBusException�handle_exceptions�dbus_handle_exceptions�dbus_service_method� N)�
DBusException)� decorator)�config)�
FirewallError)�errors)�logc @ s e Zd Zd Zdejj ZdS )r z %s.ExceptionN)�__name__�
__module__� __qualname__�__doc__r �dbusZDBUS_INTERFACEZ_dbus_error_name� r r � /usr/lib/python3.6/decorators.pyr + s c O sd y
| ||�S t k
rD } z tjtj� � tj|� W Y dd}~X n tk
r^ tj� Y nX dS )zTDecorator to handle exceptions and log them. Used if not conneced
to D-Bus.
N)r r �debug1� traceback�
format_exc�error� Exception� exception)�func�args�kwargsr r r r r / s
c O s� y
| ||�S t k
r� } zdt jt|��}|tjtjtjtjgkrRtj t|�� n tj
t j � � tj
t|�� tt|���W Y dd}~X nZ tk
r� } z
|�W Y dd}~X n6 tk
r� } ztj� tt|���W Y dd}~X nX dS )z�Decorator to handle exceptions, log and report them into D-Bus
:Raises DBusException: on a firewall error code problems.
N)r �get_code�strr
ZALREADY_ENABLEDZ NOT_ENABLEDZZONE_ALREADY_SETZ ALREADY_SETr Zwarningr r r r r r r r )r r r r �codeZexr r r r < s
c O s |j dd� tjj| |�S )z Add sender argument for D-BusZsender_keywordZsender)�
setdefaultr Zservice�method)r r r r r r T s )r �__all__r Z dbus.servicer Zdbus.exceptionsr r Zfirewallr Zfirewall.errorsr r
Zfirewall.core.loggerr r r r r r r r r �<module> s
server/__pycache__/config_icmptype.cpython-36.opt-1.pyc 0000644 00000024677 15035135172 0017050 0 ustar 00 3
��gS: � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZ d dlmZmZmZ d d l mZ d d
lmZ G d d � d ejjj�Z dS )
� )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�IcmpType)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�errors)�
FirewallErrorc sH e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z
e d d
� �Zeejd d d
�e dHdd���Zeejddd
�e dIdd���Zejjjejj�eejdd�e dJdd����Zejjejdd�dd � �Zejjjejj�eejdd �e dK� fd d � ���Z eejj e j d �e dLd d!���Z eejj e j d�e dMd"d#���Z!eejj �e dNd$d%���Z"ejjejj dd�e d&d'� ��Z#eejj �e dOd(d)���Z$ejjejj dd�e d*d+� ��Z%eejj dd�e dPd,d-���Z&ejjejj dd�e d.d/� ��Z'eejj dd �e dQd0d1���Z(eejj dd�e dRd2d3���Z)eejj dd �e dSd4d5���Z*eejj dd�e dTd6d7���Z+eejj dd �e dUd8d9���Z,eejj dd�e dVd:d;���Z-eejj d<d �e dWd=d>���Z.eejj d<d�e dXd?d@���Z/eejj dd�e dYdAdB���Z0eejj dd�e dZdCdD���Z1eejj ddEd
�e d[dFdG���Z2� Z3S )\�FirewallDConfigIcmpTypezFirewallD main classTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.icmptype.%d)
�superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_ICMPTYPE)�selfr ZconfZicmptyper �args�kwargs)� __class__� �%/usr/lib/python3.6/config_icmptype.pyr 8 s
z FirewallDConfigIcmpType.__init__c C s d S )Nr )r r r r �__del__E s z FirewallDConfigIcmpType.__del__c C s | j � d S )N)Zremove_from_connection)r r r r �
unregisterI s z"FirewallDConfigIcmpType.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r" r# r ZBooleanr$ r% �
exceptions�
DBusException)r �
property_namer r r �
_get_propertyQ s z%FirewallDConfigIcmpType._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r' r( r* )r �interface_namer) �senderr r r �Getb s
zFirewallDConfigIcmpType.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr" r# r r$ r% Zsv)� signature)r" r# r r$ r% ) r r. r r/ r r r r r' r( r* Z
Dictionary)r r0 r1 �ret�xr r r �GetAlls s
z FirewallDConfigIcmpType.GetAllZssv)r, c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r. r r/ r r � accessCheckr r r r' r( )r r0 r) Z new_valuer1 r r r �Set� s
zFirewallDConfigIcmpType.Setzsa{sv}as)r4 c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r. r r/ r )r r0 Zchanged_propertiesZinvalidated_propertiesr r r �PropertiesChanged� s
z)FirewallDConfigIcmpType.PropertiesChanged)r- c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r r �
Introspectr r Zget_busr r r r )r r1 �data)r r r r; � s
z"FirewallDConfigIcmpType.Introspectc C s t jd| j� | jj| j�S )z"get settings for icmptype
z%s.getSettings())r r/ r r Zget_icmptype_configr )r r1 r r r � getSettings� s z#FirewallDConfigIcmpType.getSettingsc C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� dS )z%update settings for icmptype
z%s.update('...')N) r r r/ r r r8 r Zset_icmptype_configr �Updatedr" )r �settingsr1 r r r �update� s
z FirewallDConfigIcmpType.updatec C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z3load default settings for builtin icmptype
z%s.loadDefaults()N)
r r/ r r r8 r Zload_icmptype_defaultsr r> r" )r r1 r r r � loadDefaults� s z$FirewallDConfigIcmpType.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r/ r )r r" r r r r> � s z FirewallDConfigIcmpType.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove icmptype
z%s.removeIcmpType()N) r r/ r r r8 r Zremove_icmptyper ZremoveIcmpType)r r1 r r r �remove� s z FirewallDConfigIcmpType.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r/ r )r r" r r r �Removed� s z FirewallDConfigIcmpType.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename icmptype
z%s.rename('%s')N) r r. r r/ r r r8 r Zrename_icmptyper �Renamed)r r" r1 r r r �rename� s
z FirewallDConfigIcmpType.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r/ r )r r" r r r rD � s z FirewallDConfigIcmpType.Renamedc C s t jd| j� | j� d S )Nz%s.getVersion()r )r r/ r r= )r r1 r r r �
getVersion� s z"FirewallDConfigIcmpType.getVersionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setVersion('%s')r )
r r. r r/ r r r8 �listr= r@ )r �versionr1 r? r r r �
setVersion s
z"FirewallDConfigIcmpType.setVersionc C s t jd| j� | j� d S )Nz
%s.getShort()r )r r/ r r= )r r1 r r r �getShort s z FirewallDConfigIcmpType.getShortc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setShort('%s')r )
r r. r r/ r r r8 rG r= r@ )r Zshortr1 r? r r r �setShort s
z FirewallDConfigIcmpType.setShortc C s t jd| j� | j� d S )Nz%s.getDescription()� )r r/ r r= )r r1 r r r �getDescription$ s z&FirewallDConfigIcmpType.getDescriptionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDescription('%s')rL )
r r. r r/ r r r8 rG r= r@ )r � descriptionr1 r? r r r �setDescription+ s
z&FirewallDConfigIcmpType.setDescription�asc C s t jd| j� t| j� d �S )Nz%s.getDestinations()� )r r/ r �sortedr= )r r1 r r r �getDestinations9 s z'FirewallDConfigIcmpType.getDestinationsc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDestinations('[%s]')�,rQ )
r rG r r/ r �joinr r8 r= r@ )r Z destinationsr1 r? r r r �setDestinations@ s
z'FirewallDConfigIcmpType.setDestinationsc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addDestination('%s')rQ )r r. r r/ r r r8 rG r= r
r ZALREADY_ENABLED�appendr@ )r � destinationr1 r? r r r �addDestinationL s
z&FirewallDConfigIcmpType.addDestinationc C s� t |t�}tjd| j|� | jj|� t| j� �}|d rd||d krTt t
j |��q�|d j |� n tt
ddg�t
|g� �|d< | j|� d S )Nz%s.removeDestination('%s')rQ Zipv4Zipv6)r r. r r/ r r r8 rG r= r
r Z NOT_ENABLEDrB �setr@ )r rX r1 r? r r r �removeDestinationZ s
z)FirewallDConfigIcmpType.removeDestination�bc C s8 t |t�}tjd| j|� | j� }|d p6||d kS )Nz%s.queryDestination('%s')rQ )r r. r r/ r r= )r rX r1 r? r r r �queryDestinationm s
z(FirewallDConfigIcmpType.queryDestination)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)4�__name__�
__module__� __qualname__�__doc__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r
r r! r* r ZPROPERTIES_IFACEr2 r7 �slipZpolkitZ require_authr9 �service�signalr: ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr; r r ZDBUS_SIGNATUREr= r@ rA r> rB rC rE rD rF rI rJ rK rM rO rS rV rY r[ r] �
__classcell__r r )r r r 0 s�
r ) Z
gi.repositoryr �sys�modulesr Z dbus.serviceZ slip.dbusrb Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.icmptyper Zfirewall.core.loggerr Zfirewall.server.decoratorsr r
r r Zfirewall.errorsr
rc ZObjectr r r r r �<module> s
server/__pycache__/firewalld.cpython-36.opt-1.pyc 0000644 00000217455 15035135172 0015640 0 ustar 00 3
��gb� � @ sV d gZ ddlmZmZ ddlZeejd< ddlZddlZddlZddl Z
ddl Z
ddl m
Z
ddlmZ ddlmZ ddlmZ dd lmZ dd
lmZmZmZmZ dd lm Z dd l m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ dd
l%m&Z& ddl'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z.m/Z/m0Z0 ddl1m2Z2 ddl m3Z3 ddl4m5Z5 G dd � d e
jj6j7�Z8dS )� FirewallD� )�GLib�GObjectNZgobject)�config)�Firewall)� Rich_Rule)�log)�FirewallClientZoneSettings)�dbus_handle_exceptions�dbus_service_method�handle_exceptions�FirewallDBusException)�FirewallDConfig)�dbus_to_python�command_of_sender�context_of_sender�
uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)� check_config)�IPSet)�IcmpType)�Helper)�nm_get_bus_name� nm_get_connection_of_interface�nm_set_zone_of_connection)�ifcfg_set_zone_of_interface)�errors)�
FirewallErrorc s�" e Zd ZdZdZejjZe � fdd��Z
dd� Z e dd� �Z e d d
� �Z
ed d � �Zed
d� �Zedd� �Zedd� �Zedd� �Zeejddd�e�d�dd���Zeejdd d�e�d�d d ���Zejjjejj�eejd d �e�d�d!d"����Zej j ejd#d$�d%d&� �Z ejjjejj �eej dd'�e�d�� fd(d)� ���Z!ejjjejj�eejj"d*d*d�e�d�d+d,����Z#ejjjejj�eejj"d*d*d�e�d�d-d.����Z$ej j ejj"�ed/d0� ��Z%ejjjejj�eejj"d*d*d�e�d�d1d2����Z&ejjjejj�eejj"d*d*d�e�d�d3d4����Z'ejjjejj(�eejj)d*d*d�e�d�d5d6����Z*ejjjejj(�eejj)d*d*d�e�d�d7d8����Z+ejjjejj,�eejj)d*d9d�e�d�d:d;����Z-ej j ejj)d*d$�ed<d=� ��Z.ej j ejj)d*d$�ed>d?� ��Z/ejjjejj(�eejj)dd*d�e�d�d@dA����Z0ejjjejj(�eejj)dd*d�e�d�dBdC����Z1ejjjejj,�eejj)dd9d�e�d�dDdE����Z2ejjjejj,�eejj)d*dFd�e�d�dGdH����Z3ej j ejj)dd$�edIdJ� ��Z4ej j ejj)dd$�edKdL� ��Z5ejjjejj(�eejj)dMd*d�e�d�dNdO����Z6ejjjejj(�eejj)dMd*d�e�d�dPdQ����Z7ejjjejj,�eejj)dMd9d�e�d�dRdS����Z8ejjjejj,�eejj)d*dTd�e�d�dUdV����Z9ej j ejj)dMd$�edWdX� ��Z:ej j ejj)dMd$�edYdZ� ��Z;ejjjejj(�eejj)dd*d�e�d�d[d\����Z<ejjjejj(�eejj)dd*d�e�d�d]d^����Z=ejjjejj,�eejj)dd9d�e�d�d_d`����Z>ejjjejj,�eejj)d*dFd�e�d�dadb����Z?ej j ejj)dd$�edcdd� ��Z@ej j ejj)dd$�ededf� ��ZAejjjejj(�eejj)dd*d�e�d�dgdh����ZBejjjejj(�eejj)dd*d�e�d�didj����ZCejjjejj,�eejj)dd9d�e�d�dkdl����ZDejjjejj,�eejj)d*dFd�e�d�dmdn����ZEej j ejj)dd$�edodp� ��ZFej j ejj)dd$�edqdr� ��ZGejjjejj�eejj"d*d*d�e�d�dsdt����ZHejjjejj�eejj"d*d*d�e�d�dudv����ZIejjjejj �eejj"d*d9d�e�d�dwdx����ZJej j ejj"d*d$�edydz� ��ZKej j ejj"d*d$�ed{d|� ��ZLejjjejjM�eejj"dd}d�e�d�d~d����ZNejjjejjM�eejjOdd d�e�d�d�d�����ZPejjjejjM�eejjOd�d �e�d�d�d�����ZQej j ejjOd�d$�ed�d�� ��ZRejjjejjM�eejjSdd d�e�d�d�d�����ZTejjjejjM�eejjSd�d �e�d�d�d�����ZUej j ejjSd�d$�ed�d�� ��ZVejjjejj �eejj"d*dFd�e�d�d�d�����ZWejjjejjM�eejj"dd�d�e�d�d�d�����ZXejjjejjM�eejj"dd d�e�d�d�d�����ZYejjjejj �eejj"d*dFd�e�d�d�d�����ZZejjjejjM�eejj"de[j\d�e�d�d�d�����Z]ejjjejjM�eejj"d*dd�e�d�d�d�����Z^ejjjejj�eejj"dd*d�e�d�d�d�����Z_ej j ejj"dd$�ed�d�� ��Z`ejjjejjM�eejj"d*dd�e�d�d�d�����Zaejjjejj�eejj"dd*d�e�d�d�d�����Zbej j ejj"dd$�ed�d�� ��Zcejjjejj �eejj"d*dd�e�d�d�d�����Zdejjjejj�eejj"dd*d�e�d�d�d�����Zeej j ejj"dd$�ed�d�� ��Zfejjjejj �eejjSd*dFd�e�d�d�d�����Zgejjjejj �eejjSd*d�d�e�d�d�d�����Zhejjjejj �eejjOd*dFd�e�d�d�d�����Ziejjjejj �eejjOd*d�d�e�d�d�d�����Zjejjjejj �eejjOddd�e�d�d�d�����Zkejjjejj �eejjOddd�e�d�d�d�����ZlejjjejjM�eejjOdd9d�e�d�d�d�����Zmejjjejj�eejjOddd�e�d�d�d�����Znejjjejj�eejjOddd�e�d�d�d�����Zoejjjejj�eejjOddd�e�d�d�d�����Zpejjjejj�eejjOddd�e�d�d�d�����ZqejjjejjM�eejjOdd9d�e�d�d�d���ZrejjjejjM�eejjOddFd�e�d�d�dĄ���Zsej j ejjOdd$�ed�dƄ ��Ztej j ejjOdd$�ed�dȄ ��Zuej j ejjOdd$�ed�dʄ ��Zvej j ejjOdd$�ed�d̄ ��Zwejjjejj�eejjOddd�e�d�d�d΄���Zxejjjejj�eejjOddd�e�d�d�dЄ���Zyejjjejj�eejjOddd�e�d�d�d҄���ZzejjjejjM�eejjOdd9d�e�d�d�dԄ���Z{ejjjejjM�eejjOddFd�e�d�d�dք���Z|ej j ejjOdd$�ed�d ��Z}ej j ejjOdd$�ed�dڄ ��Z~ej j ejjOdd$�ed�d܄ ��Zed�dބ �Z�ejjjejj�eejjOd�dd�e�d�d�d����Z�ejjjejj�eejjOddd�e�d�d�d����Z�ejjjejjM�eejjOdd9d�e�d�d�d����Z�ejjjejjM�eejjOddFd�e�d�d�d����Z�ej j ejjOd�d$�ed�d� ��Z�ej j ejjOdd$�ed�d� ��Z�ed�d� �Z�ejjjejj�eejjOd�dd�e�d�d�d����Z�ejjjejj�eejjOddd�e�d�d�d����Z�ejjjejjM�eejjOdd9d�e�d�d�d����Z�ejjjejjM�eejjOddFd�e�d�d�d�����Z�ej j ejjOd�d$�ed�d�� ��Z�ej j ejjOdd$�ed�d�� ��Z�ed�d�� �Z�ejjjejj�eejjOd�dd�e�d�d�d�����Z�ejjjejj�eejjOd�dd�e�d��d �d����Z�ejjjejjM�eejjOd�d9d�e�d��d�d����Z�ejjjejjM�eejjOd�dd�e�d��d�d����Z�ej j ejjOd�d$�e�d��d�d ���Z�ej j ejjOd�d$�e�d
�d � ��Z�e�d �d
� �Z�ejjjejj�eejjOd�dd�e�d��d�d����Z�ejjjejj�eejjOddd�e�d��d�d����Z�ejjjejjM�eejjOdd9d�e�d��d�d����Z�ejjjejjM�eejjOddFd�e�d��d�d����Z�ej j ejjOd�d$�e�d��d�d���Z�ej j ejjOdd$�e�d�d� ��Z�e�d�d� �Z�ejjjejj�eejjOd�dd�e�d��d �d ����Z�ejjjejj�eejjOd�dd�e�d �d �d ����Z�ejjjejjM�eejjOd�d9d�e�d�d �d!����Z�ejjjejjM�eejjOd�dd�e�d�d"�d#����Z�ej j ejjOd�d$�e�d�d$�d%���Z�ej j ejjOd�d$�e�d&�d'� ��Z�e�d(�d)� �Z�ejjjejj�eejjO�d*dd�e�d�d+�d,����Z�ejjjejj�eejjOddd�e�d�d-�d.����Z�ejjjejjM�eejjOdd9d�e�d�d/�d0����Z�ej j ejjO�d*d$�e�d�d1�d2���Z�ej j ejjOdd$�e�d3�d4� ��Z�e�d5�d6� �Z�ejjjejj�eejjO�d7dd�e�d�d8�d9����Z�ejjjejj�eejjO�d:dd�e�d �d;�d<����Z�ejjjejjM�eejjO�d:d9d�e�d
�d=�d>����Z�ejjjejjM�eejjOd�dd�e�d �d?�d@����Z�ej j ejjO�d7d$�e�d �dA�dB���Z�ej j ejjO�d:d$�e�dC�dD� ��Z�e�dE�dF� �Z�ejjjejj�eejjOd�dd�e�d
�dG�dH����Z�ejjjejj�eejjOddd�e�d�dI�dJ����Z�ejjjejjM�eejjOdd9d�e�d�dK�dL����Z�ejjjejjM�eejjOddFd�e�d�dM�dN����Z�ej j ejjOd�d$�e�d�dO�dP���Z�ej j ejjOdd$�e�dQ�dR� ��Z�ejjjejj�eejjOddd�e�d�dS�dT����Z�ejjjejj�eejjOddd�e�d�dU�dV����Z�ejjjejjM�eejjOdd9d�e�d�dW�dX����Z�ej j ejjOdd$�e�dY�dZ� ��Z�ej j ejjOdd$�e�d[�d\� ��Z�ejjjejj��eejj�d�d*d�e�d�d]�d^����Z�ejjjejj��eejj�d�d*d�e�d�d_�d`����Z�ejjjejj��eejj�d�d9d�e�d�da�db����Z�ejjjejj��eejj�ddFd�e�d�dc�dd����Z�ejjjejj��eejj�d*�ded�e�d�df�dg����Z�ej j ejj�d�d$�e�dh�di� ��Z�ej j ejj�d�d$�e�dj�dk� ��Z�ejjjejj��eejj��dld*d�e�d�dm�dn����Z�ejjjejj��eejj��dld*d�e�d�do�dp����Z�ejjjejj��eejj�d�d*d�e�d �dq�dr����Z�ejjjejj��eejj��dld9d�e�d �ds�dt����Z�ejjjejj��eejj�d��dud�e�d �dv�dw����Z�ejjjejj��eejj�d*�dxd�e�d �dy�dz����Z�ej j ejj��dld$�e�d{�d|� ��Z�ej j ejj��dld$�e�d}�d~� ��Z�ejjjejj��eejj��ddd�e�d �d��d�����Z�ejjjejj��eejj��dd*d�e�d!�d��d�����Z�ejjjejj��eejj��dd*d�e�d"�d��d�����Z�ejjjejj��eejj��dd9d�e�d#�d��d�����Z�ejjjejj��eejj�d*�d�d�e�d$�d��d�����Z�ejjjejj��eejj�d*d*d�e�d%�d��d�����Z�ejjjejj��eejj�d�dd�e�d&�d��d�����Z�ej j ejj��dd$�e�d��d�� ��Z�ej j ejj��dd$�e�d��d�� ��Z�ejjjejj׃eejj"d*d*d�e�d'�d��d�����Z�ejjjejj �eejj�dd9d�e�d(�d��d�����Z�ejjjejj �eejj�d*dFd�e�d)�d��d�����Z�ejjjejjM�eejj�de�j\d�e�d*�d��d�����Z�ejjjejj�eejj�dd*d�e�d+�d��d�����Z�ejjjejj�eejj�dd*d�e�d,�d��d�����Z�ejjjejj �eejj�dd9d�e�d-�d��d�����Z�ejjjejj �eejj�ddFd�e�d.�d��d�����Z�ejjjejj�eejjِdd �e�d/�d��d�����Z�ej j ejj�dd$�e�d��d�� ��Z�ej j ejj�dd$�e�d��d�� ��Z�ejjjejj �eejj"d*dFd�e�d0�d��d�����Z�ejjjejjM�eejj"de�j\d�e�d1�d��d�����Z� Z�S (2 r zFirewallD main classTc s` t t| �j||� t� | _|d | _|d | _| j� t| t j
j � t | jj | jt j
j
�| _ d S )Nr � )�superr �__init__r �fw�busname�path�startr r �dbus�DBUS_INTERFACEr ZDBUS_PATH_CONFIG)�self�args�kwargs)� __class__� � /usr/lib/python3.6/firewalld.pyr" I s
zFirewallD.__init__c C s | j � d S )N)�stop)r) r- r- r. �__del__T s zFirewallD.__del__c C s t jd� i | _| jj� S )Nzstart())r �debug1� _timeoutsr# r& )r) r- r- r. r& W s
zFirewallD.startc C s t jd� | jj� S )Nzstop())r r1 r# r/ )r) r- r- r. r/ _ s
zFirewallD.stopc C s� | j jj� r�|d kr"tjd� d S tj� }t||�}| j jjd|�rHd S t ||�}| j jjd|�rfd S t
|�}| j jjd|�r�d S t ||�}| j jjd|�r�d S t t
jd��d S )Nz&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r# �policies�query_lockdownr �errorr' Z SystemBusr Z access_checkr r r r r Z
ACCESS_DENIED)r) �senderZbusr3 r4 r5 r6 r- r- r. � accessCheckh s$
zFirewallD.accessCheckc C s& || j kri | j |< || j | |< d S )N)r2 )r) �zone�x�tagr- r- r. �
addTimeout s
zFirewallD.addTimeoutc C s< || j kr8|| j | kr8tj| j | | � | j | |= d S )N)r2 r �
source_remove)r) r< r= r- r- r. �
removeTimeout� s zFirewallD.removeTimeoutc C sT xD| j D ]:}x&| j | D ]}tj| j | | � qW | j | j� qW | j j� d S )N)r2 r r@ �clear)r) r< r= r- r- r. �cleanup_timeouts� s
zFirewallD.cleanup_timeoutsc C sd |dkrt jtj�S |dkr6t jdtj jtj jf �S |dkrNt j| jj� �S |dkrht j| jj d��S |dkr�t j
| jj d�S |d kr�t j| jj d
��S |d kr�t j| jj �S |d kr�t j
| jj
d�S |d
kr�t j| jj�S |dk� r�t j| jj�S |dk�rt j
| jjd�S |dk�r$t jd�S |dk�r:t ji d�S |dk�rPt ji d�S t jjd| ��d S )N�version�interface_versionz%d.%d�state�IPv4�ipv4�
IPv4ICMPTypes�s�IPv6�ipv6�
IPv6_rpfilter�
IPv6ICMPTypes�BRIDGEr �
IPSetTypes�nf_conntrack_helper_settingF�nf_conntrack_helpers�sas�nf_nat_helperszDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist)r' �Stringr �VERSIONZDBUS_INTERFACE_VERSIONZDBUS_INTERFACE_REVISIONr# Z get_stateZBooleanZis_ipv_enabledZArrayZipv4_supported_icmp_typesZipv6_rpfilter_enabledZipv6_supported_icmp_typesZebtables_enabledZ
ipset_enabledZipset_supported_types�
Dictionary�
exceptions�
DBusException)r) Zpropr- r- r. �
_get_property� s@
zFirewallD._get_propertyZss�v)� in_signature�
out_signatureNc C s~ t |t�}t |t�}tjd||� |tjjkr8| j|�S |tjjtjj tjj
tjj gkrjtj j
d| ��ntj j
d| ��d S )NzGet('%s', '%s')zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)r �strr r1 r r' r( rZ �DBUS_INTERFACE_ZONE�DBUS_INTERFACE_DIRECT�DBUS_INTERFACE_POLICIES�DBUS_INTERFACE_IPSETrX rY )r) �interface_name�
property_namer: r- r- r. �Get� s
z
FirewallD.GetrJ za{sv}c C s� t |t�}tjd|� i }|tjjkrDxNdD ]}| j|�||< q,W n2|tjjtjj tjj
tjj gkrfntj j
d| ��tj|dd�S )Nz GetAll('%s')rD rE rF rG rK rM rO r rP rQ rR rT rI rN zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existZsv)� signature)rD rE rF rG rK rM rO r rP rQ rR rT rI rN )r r^ r r1 r r' r( rZ r_ r` ra rb rX rY rW )r) rc r: �retr= r- r- r. �GetAll� s&
zFirewallD.GetAllZssv)r\ c C s� t |t�}t |t�}t |�}tjd|||� | j|� |tjjkrn|dkr\tjj d| ��q�tjj d| ��nB|tjj
tjj tjj tjj
gkr�tjj d| ��ntjj d| ��d S )NzSet('%s', '%s', '%s')rD rE rF rG rK rM rO r rP rQ rR rT rI rN zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-onlyzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)rD rE rF rG rK rM rO r rP rQ rR rT rI rN )r r^ r r1 r; r r' r( rX rY r_ r` ra rb )r) rc rd Z new_valuer: r- r- r. �Set� s:
z
FirewallD.Setzsa{sv}as)rf c C s. t |t�}t |�}t |�}tjd|||� d S )Nz#PropertiesChanged('%s', '%s', '%s'))r r^ r r1 )r) rc Zchanged_propertiesZinvalidated_propertiesr- r- r. �PropertiesChanged s
zFirewallD.PropertiesChanged)r] c s4 t jd� tt| �j| j| jj� �}t| |t j
j �S )Nz Introspect()) r Zdebug2r! r �
Introspectr% r$ Zget_busr r r' r( )r) r: �data)r, r- r. rk & s
zFirewallD.Introspect� c C s* t jd� | jj� | jj� | j� dS )z#Reload the firewall rules.
zreload()N)r r1 r# �reloadr �Reloaded)r) r: r- r- r. rn 4 s
zFirewallD.reloadc C s, t jd� | jjd� | jj� | j� dS )z�Completely reload the firewall.
Completely reload the firewall: Stops firewall, unloads modules and
starts the firewall again.
zcompleteReload()TN)r r1 r# rn r ro )r) r: r- r- r. �completeReloadC s
zFirewallD.completeReloadc C s t jd� d S )Nz
Reloaded())r r1 )r) r- r- r. ro S s zFirewallD.Reloadedc C s t jd� t| j� dS )z&Check permanent configuration
zcheckPermanentConfig()N)r r1 r r# )r) r: r- r- r. �checkPermanentConfigX s
z FirewallD.checkPermanentConfigc
C s� t jd� d}| jj� }x�| jjj� D ]�}| j|�}yj||kr�| jj|�}|j � |krpt jd| � |j
|� q�t jd| � n t jd| � | jj ||� W q& t k
r� } z t j
d||f � d}W Y dd}~X q&X q&W | jj� }x�| jjj� D ]�}| j|�}yn||k�rR| jj|�}|j � |k�rBt jd | � |j
|� nt jd
| � n t jd | � | jj||� W q� t k
�r� } z t j
d ||f � d}W Y dd}~X q�X q�W | jj� }x�| jjj� D ]�}yx| j|�}||k�r&| jj|�}|j � |k�rt jd
| � |j
|� nt jd| � n t jd| � | jj||� W n: t k
�r~ } z t j
d||f � d}W Y dd}~X nX �q�W | jj� }t� }�x�| jj j � D �]�}| j |�}t |�} |dk �r~d}
xH| j � D ]<} | jj j!|| �|k�r�t jd|| f � | j"| � d}
�q�W xV| j � D ]J} y,t#| �} | �rNt$|| ��rN| j"| � d}
W n t k
�rf Y nX �q W |
�r~~| j%� }x | j � D ]} t&|| � �q�W yP||k�r�| jj'|�}t jd| � |j(|� n t jd| � | jj)||� W n: t k
�r& } z t j
d||f � d}W Y dd}~X nX �q�W | jj*� }x�| jj+j,� D ]�}| j-|�}yB||k�rx| jj.|�}|j
|� n t jd| � | jj/||� W n: t k
�r� } z t j
d||f � d}W Y dd}~X nX �qFW | jj0� }x�| jj1j2� D ]�}| j3|�}yn||k�rN| jj4|�}|j � |k�r>t jd| � |j
|� nt jd| � n t jd| � | jj5||� W n: t k
�r� } z t j
d||f � d}W Y dd}~X nX �q�W | jj6j7� | jj6j8� | jj6j9� f}y6| jj � |k�r�t jd� | jj
|� n
t jd � W n6 t k
�r< } zt j
d | � d}W Y dd}~X nX | jj:j;j<� }y6| jj � |k�rvt jd � | jj=|� n
t jd � W n6 t k
�r� } zt j
d | � d}W Y dd}~X nX |�r�t>t?j@��dS )!z-Make runtime configuration permanent
zcopyRuntimeToPermanent()Fz Copying service '%s' settingsz$Service '%s' is identical, ignoring.zCreating service '%s'z/Runtime To Permanent failed on service '%s': %sTNz Copying icmptype '%s' settingsz%IcmpType '%s' is identical, ignoring.zCreating icmptype '%s'z0Runtime To Permanent failed on icmptype '%s': %szCopying ipset '%s' settingsz"IPSet '%s' is identical, ignoring.zCreating ipset '%s'z-Runtime To Permanent failed on ipset '%s': %szEZone '%s': interface binding for '%s' has been added by NM, ignoring.zCopying zone '%s' settingszCreating zone '%s'z,Runtime To Permanent failed on zone '%s': %szCreating policy '%s'z.Runtime To Permanent failed on policy '%s': %sz Copying helper '%s' settingsz#Helper '%s' is identical, ignoring.zCreating helper '%s'z.Runtime To Permanent failed on helper '%s': %sz Copying direct configurationz,Direct configuration is identical, ignoring.z7Runtime To Permanent failed on direct configuration: %sz Copying policies configurationz.Policies configuration is identical, ignoring.z9Runtime To Permanent failed on policies configuration: %s)Ar r1 r ZgetServiceNamesr# �service� get_services�getServiceSettingsZgetServiceByNameZ getSettings�update�
addService� Exception�warningZgetIcmpTypeNames�icmptype�
get_icmptypes�getIcmpTypeSettingsZgetIcmpTypeByNameZ addIcmpTypeZ
getIPSetNames�ipset�
get_ipsets�getIPSetSettingsZgetIPSetByNameZaddIPSetZ getZoneNamesr r< � get_zones�getZoneSettings2r �
getInterfacesZinterface_get_sender�removeInterfacer r ZgetSettingsDictr Z
getZoneByNameZupdate2ZaddZone2ZgetPolicyNames�policy�"get_policies_not_derived_from_zone�getPolicySettingsZgetPolicyByNameZ addPolicyZgetHelperNames�helper� get_helpers�getHelperSettingsZgetHelperByNameZ addHelper�direct�get_all_chains�
get_all_rules�get_all_passthroughsr7 �lockdown_whitelist�
export_configZsetLockdownWhitelistr r ZRT_TO_PERM_FAILED)
r) r: r9 Z config_names�nameZconfZconf_obj�eZ nm_bus_name�settingsZchanged� interfaceZ
connectionr- r- r. �runtimeToPermanentd s$
z FirewallD.runtimeToPermanentc C s, t jd� | j|� | jjj� | j� dS )z!Enable lockdown policies
zpolicies.enableLockdown()N)r r1 r; r# r7 Zenable_lockdown�LockdownEnabled)r) r: r- r- r. �enableLockdown2 s
zFirewallD.enableLockdownc C s, t jd� | j|� | jjj� | j� dS )z"Disable lockdown policies
zpolicies.disableLockdown()N)r r1 r; r# r7 Zdisable_lockdown�LockdownDisabled)r) r: r- r- r. �disableLockdown> s
zFirewallD.disableLockdown�bc C s t jd� | jjj� S )z+Retuns True if lockdown is enabled
zpolicies.queryLockdown())r r1 r# r7 r8 )r) r: r- r- r. �
queryLockdownJ s
zFirewallD.queryLockdownc C s t jd� d S )NzLockdownEnabled())r r1 )r) r- r- r. r� U s zFirewallD.LockdownEnabledc C s t jd� d S )NzLockdownDisabled())r r1 )r) r- r- r. r� Z s zFirewallD.LockdownDisabledc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Add lockdown command
z*policies.addLockdownWhitelistCommand('%s')N)
r r^ r r1 r; r# r7 r� Z add_command� LockdownWhitelistCommandAdded)r) r6 r: r- r- r. �addLockdownWhitelistCommandc s
z%FirewallD.addLockdownWhitelistCommandc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Remove lockdown command
z-policies.removeLockdownWhitelistCommand('%s')N)
r r^ r r1 r; r# r7 r� Zremove_command� LockdownWhitelistCommandRemoved)r) r6 r: r- r- r. � removeLockdownWhitelistCommandp s
z(FirewallD.removeLockdownWhitelistCommandc C s( t |t�}tjd| � | jjjj|�S )z Query lockdown command
z,policies.queryLockdownWhitelistCommand('%s'))r r^ r r1 r# r7 r� Z has_command)r) r6 r: r- r- r. � queryLockdownWhitelistCommand} s
z'FirewallD.queryLockdownWhitelistCommand�asc C s t jd� | jjjj� S )z Add lockdown command
z'policies.getLockdownWhitelistCommands())r r1 r# r7 r� Z get_commands)r) r: r- r- r. � getLockdownWhitelistCommands� s
z&FirewallD.getLockdownWhitelistCommandsc C s t jd| � d S )Nz#LockdownWhitelistCommandAdded('%s'))r r1 )r) r6 r- r- r. r� � s z'FirewallD.LockdownWhitelistCommandAddedc C s t jd| � d S )Nz%LockdownWhitelistCommandRemoved('%s'))r r1 )r) r6 r- r- r. r� � s z)FirewallD.LockdownWhitelistCommandRemoved�ic C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )zAdd lockdown uid
z&policies.addLockdownWhitelistUid('%s')N)
r �intr r1 r; r# r7 r� Zadd_uid�LockdownWhitelistUidAdded)r) r4 r: r- r- r. �addLockdownWhitelistUid� s
z!FirewallD.addLockdownWhitelistUidc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Remove lockdown uid
z)policies.removeLockdownWhitelistUid('%s')N)
r r� r r1 r; r# r7 r� Z
remove_uid�LockdownWhitelistUidRemoved)r) r4 r: r- r- r. �removeLockdownWhitelistUid� s
z$FirewallD.removeLockdownWhitelistUidc C s( t |t�}tjd| � | jjjj|�S )zQuery lockdown uid
z(policies.queryLockdownWhitelistUid('%s'))r r� r r1 r# r7 r� Zhas_uid)r) r4 r: r- r- r. �queryLockdownWhitelistUid� s
z#FirewallD.queryLockdownWhitelistUidZaic C s t jd� | jjjj� S )zAdd lockdown uid
z#policies.getLockdownWhitelistUids())r r1 r# r7 r� Zget_uids)r) r: r- r- r. �getLockdownWhitelistUids� s
z"FirewallD.getLockdownWhitelistUidsc C s t jd| � d S )Nz LockdownWhitelistUidAdded(%d))r r1 )r) r4 r- r- r. r� � s z#FirewallD.LockdownWhitelistUidAddedc C s t jd| � d S )Nz LockdownWhitelistUidRemoved(%d))r r1 )r) r4 r- r- r. r� � s z%FirewallD.LockdownWhitelistUidRemovedc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )zAdd lockdown user
z'policies.addLockdownWhitelistUser('%s')N)
r r^ r r1 r; r# r7 r� Zadd_user�LockdownWhitelistUserAdded)r) r5 r: r- r- r. �addLockdownWhitelistUser� s
z"FirewallD.addLockdownWhitelistUserc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Remove lockdown user
z*policies.removeLockdownWhitelistUser('%s')N)
r r^ r r1 r; r# r7 r� Z remove_user� LockdownWhitelistUserRemoved)r) r5 r: r- r- r. �removeLockdownWhitelistUser� s
z%FirewallD.removeLockdownWhitelistUserc C s( t |t�}tjd| � | jjjj|�S )z Query lockdown user
z)policies.queryLockdownWhitelistUser('%s'))r r^ r r1 r# r7 r� Zhas_user)r) r5 r: r- r- r. �queryLockdownWhitelistUser� s
z$FirewallD.queryLockdownWhitelistUserc C s t jd� | jjjj� S )zAdd lockdown user
z$policies.getLockdownWhitelistUsers())r r1 r# r7 r� Z get_users)r) r: r- r- r. �getLockdownWhitelistUsers s
z#FirewallD.getLockdownWhitelistUsersc C s t jd| � d S )Nz LockdownWhitelistUserAdded('%s'))r r1 )r) r5 r- r- r. r� s z$FirewallD.LockdownWhitelistUserAddedc C s t jd| � d S )Nz"LockdownWhitelistUserRemoved('%s'))r r1 )r) r5 r- r- r. r� s z&FirewallD.LockdownWhitelistUserRemovedc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Add lockdown context
z*policies.addLockdownWhitelistContext('%s')N)
r r^ r r1 r; r# r7 r� Z add_context� LockdownWhitelistContextAdded)r) r3 r: r- r- r. �addLockdownWhitelistContext s
z%FirewallD.addLockdownWhitelistContextc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Remove lockdown context
z-policies.removeLockdownWhitelistContext('%s')N)
r r^ r r1 r; r# r7 r� Zremove_context� LockdownWhitelistContextRemoved)r) r3 r: r- r- r. � removeLockdownWhitelistContext' s
z(FirewallD.removeLockdownWhitelistContextc C s( t |t�}tjd| � | jjjj|�S )z Query lockdown context
z,policies.queryLockdownWhitelistContext('%s'))r r^ r r1 r# r7 r� Z has_context)r) r3 r: r- r- r. � queryLockdownWhitelistContext4 s
z'FirewallD.queryLockdownWhitelistContextc C s t jd� | jjjj� S )z Add lockdown context
z'policies.getLockdownWhitelistContexts())r r1 r# r7 r� Z get_contexts)r) r: r- r- r. � getLockdownWhitelistContexts@ s
z&FirewallD.getLockdownWhitelistContextsc C s t jd| � d S )Nz#LockdownWhitelistContextAdded('%s'))r r1 )r) r3 r- r- r. r� K s z'FirewallD.LockdownWhitelistContextAddedc C s t jd| � d S )Nz%LockdownWhitelistContextRemoved('%s'))r r1 )r) r3 r- r- r. r� P s z)FirewallD.LockdownWhitelistContextRemovedc C s* t jd� | j|� | jj� | j� dS )znEnable panic mode.
All ingoing and outgoing connections and packets will be blocked.
zenablePanicMode()N)r r1 r; r# Zenable_panic_mode�PanicModeEnabled)r) r: r- r- r. �enablePanicModeY s
zFirewallD.enablePanicModec C s* t jd� | j|� | jj� | j� dS )z�Disable panic mode.
Enables normal mode: Allowed ingoing and outgoing connections
will not be blocked anymore
zdisablePanicMode()N)r r1 r; r# Zdisable_panic_mode�PanicModeDisabled)r) r: r- r- r. �disablePanicModeg s
zFirewallD.disablePanicModec C s t jd� | jj� S )NzqueryPanicMode())r r1 r# Zquery_panic_mode)r) r: r- r- r. �queryPanicModev s
zFirewallD.queryPanicModec C s t jd� d S )NzPanicModeEnabled())r r1 )r) r- r- r. r� s zFirewallD.PanicModeEnabledc C s t jd� d S )NzPanicModeDisabled())r r1 )r) r- r- r. r� � s zFirewallD.PanicModeDisabledz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C s$ t |t�}tjd|� | jjj|�S )NzgetZoneSettings(%s))r r^ r r1 r# r< Zget_config_with_settings)r) r< r: r- r- r. �getZoneSettings� s
zFirewallD.getZoneSettingsc C s$ t |t�}tjd|� | jjj|�S )NzgetZoneSettings2(%s))r r^ r r1 r# r< � get_config_with_settings_dict)r) r< r: r- r- r. r� � s
zFirewallD.getZoneSettings2zsa{sv}c C sB t |t�}tjd|� | j|� | jjj|||� | j||� d S )NzsetZoneSettings2(%s)) r r^ r r1 r; r# r< � set_config_with_settings_dict� ZoneUpdated)r) r< r� r: r- r- r. �setZoneSettings2� s
zFirewallD.setZoneSettings2c C s t jd||f � d S )Nz zone.ZoneUpdated('%s', '%s'))r r1 )r) r< r� r- r- r. r� � s zFirewallD.ZoneUpdatedc C s$ t |t�}tjd|� | jjj|�S )Nz policy.getPolicySettings(%s))r r^ r r1 r# r� r� )r) r� r: r- r- r. r� � s
zFirewallD.getPolicySettingsc C sB t |t�}tjd|� | j|� | jjj|||� | j||� d S )Nz policy.setPolicySettings(%s)) r r^ r r1 r; r# r� r� �
PolicyUpdated)r) r� r� r: r- r- r. �setPolicySettings� s
zFirewallD.setPolicySettingsc C s t jd||f � d S )Nz policy.PolicyUpdated('%s', '%s'))r r1 )r) r� r� r- r- r. r� � s zFirewallD.PolicyUpdatedc C s t jd� | jjj� S )NzlistServices())r r1 r# rr rs )r) r: r- r- r. � listServices� s
zFirewallD.listServicesz(sssa(ss)asa{ss}asa(ss))c C s� t |t�}tjd|� | jjj|�}|j� }g }x\td�D ]P}|j | d |krr|j
t j t
||j | d ��� q:|j
||j | d � q:W t|�S )NzgetServiceSettings(%s)� r )r r^ r r1 r# rr � get_service�export_config_dict�rangeZIMPORT_EXPORT_STRUCTURE�append�copy�deepcopy�getattr�tuple)r) rr r: �objZ conf_dictZ conf_listr� r- r- r. rt � s
" z FirewallD.getServiceSettingsc C s, t |t�}tjd|� | jjj|�}|j� S )NzgetServiceSettings2(%s))r r^ r r1 r# rr r� r� )r) rr r: r� r- r- r. �getServiceSettings2� s
z FirewallD.getServiceSettings2c C s t jd� | jjj� S )NzlistIcmpTypes())r r1 r# ry rz )r) r: r- r- r. �
listIcmpTypes� s
zFirewallD.listIcmpTypesc C s( t |t�}tjd|� | jjj|�j� S )NzgetIcmpTypeSettings(%s))r r^ r r1 r# ry Z get_icmptyper� )r) ry r: r- r- r. r{ � s
z FirewallD.getIcmpTypeSettingsc C s t jd� | jj� S )NzgetLogDenied())r r1 r# Zget_log_denied)r) r: r- r- r. � getLogDenied s
zFirewallD.getLogDeniedc C sX t |t�}tjd| � | j|� | jj|� | j|� | jj� | j j� | j
� d S )NzsetLogDenied('%s')) r r^ r r1 r; r# Zset_log_denied�LogDeniedChangedrn r ro )r) �valuer: r- r- r. � setLogDenied s
zFirewallD.setLogDeniedc C s t jd| � d S )NzLogDeniedChanged('%s'))r r1 )r) r� r- r- r. r� " s zFirewallD.LogDeniedChangedc C s t jd� dS )NzgetAutomaticHelpers()�no)r r1 )r) r: r- r- r. �getAutomaticHelpers+ s
z FirewallD.getAutomaticHelpersc C s& t |t�}tjd| � | j|� d S )NzsetAutomaticHelpers('%s'))r r^ r r1 r; )r) r� r: r- r- r. �setAutomaticHelpers6 s
z FirewallD.setAutomaticHelpersc C s t jd| � d S )Nz AutomaticHelpersChanged('%s'))r r1 )r) r� r- r- r. �AutomaticHelpersChangedB s z!FirewallD.AutomaticHelpersChangedc C s t jd� | jj� S )NzgetDefaultZone())r r1 r# Zget_default_zone)r) r: r- r- r. �getDefaultZoneK s
zFirewallD.getDefaultZonec C s< t |t�}tjd| � | j|� | jj|� | j|� d S )NzsetDefaultZone('%s'))r r^ r r1 r; r# Zset_default_zone�DefaultZoneChanged)r) r< r: r- r- r. �setDefaultZoneT s
zFirewallD.setDefaultZonec C s t jd| � d S )NzDefaultZoneChanged('%s'))r r1 )r) r< r- r- r. r� ` s z FirewallD.DefaultZoneChangedc C s t jd� | jjj� S )Nzpolicy.getPolicies())r r1 r# r� r� )r) r: r- r- r. � getPoliciesk s
zFirewallD.getPoliciesz
a{sa{sas}}c C s\ t jd� i }xH| jjj� D ]8}i ||< | jjj|�|| d< | jjj|�|| d< q W |S )Nzpolicy.getActivePolicies()Z
ingress_zonesZ egress_zones)r r1 r# r� Z)get_active_policies_not_derived_from_zoneZlist_ingress_zonesZlist_egress_zones)r) r: r7 r� r- r- r. �getActivePoliciess s
zFirewallD.getActivePoliciesc C s t jd� | jjj� S )Nzzone.getZones())r r1 r# r< r )r) r: r- r- r. �getZones� s
zFirewallD.getZonesc C s� t jd� i }x|| jjj� D ]l}| jjj|�}| jjj|�}t|�t|� dkr i ||< t|�dkrp||| d< t|�dkr ||| d< q W |S )Nzzone.getActiveZones()r �
interfaces�sources)r r1 r# r< r �list_interfaces� list_sources�len)r) r: Zzonesr< r� r� r- r- r. �getActiveZones� s
zFirewallD.getActiveZonesc C s2 t |t�}tjd| � | jjj|�}|r.|S dS )z�Return the zone an interface belongs to.
:Parameters:
`interface` : str
Name of the interface
:Returns: str. The name of the zone.
z zone.getZoneOfInterface('%s')rm )r r^ r r1 r# r< Zget_zone_of_interface)r) r� r: r< r- r- r. �getZoneOfInterface� s
z FirewallD.getZoneOfInterfacec C s2 t |t�}tjd| � | jjj|�}|r.|S dS )Nzzone.getZoneOfSource('%s')rm )r r^ r r1 r# r< Zget_zone_of_source)r) �sourcer: r< r- r- r. �getZoneOfSource� s
zFirewallD.getZoneOfSourcec C s dS )NFr- )r) r< r: r- r- r. � isImmutable� s zFirewallD.isImmutablec C sR t |t�}t |t�}tjd||f � | j|� | jjj|||�}| j||� |S )zPAdd an interface to a zone.
If zone is empty, use default zone.
z zone.addInterface('%s', '%s')) r r^ r r1 r; r# r< Z
add_interface�InterfaceAdded)r) r< r� r: �_zoner- r- r. � addInterface� s
zFirewallD.addInterfacec C s" t |t�}t |t�}| j|||�S )z�Change a zone an interface is part of.
If zone is empty, use default zone.
This function is deprecated, use changeZoneOfInterface instead
)r r^ �changeZoneOfInterface)r) r< r� r: r- r- r. �
changeZone� s
zFirewallD.changeZonec C sR t |t�}t |t�}tjd||f � | j|� | jjj|||�}| j||� |S )z[Change a zone an interface is part of.
If zone is empty, use default zone.
z&zone.changeZoneOfInterface('%s', '%s')) r r^ r r1 r; r# r< Zchange_zone_of_interface�ZoneOfInterfaceChanged)r) r< r� r: r� r- r- r. r� � s
z FirewallD.changeZoneOfInterfacec C sP t |t�}t |t�}tjd||f � | j|� | jjj||�}| j||� |S )zkRemove interface from a zone.
If zone is empty, remove from zone the interface belongs to.
z zone.removeInterface('%s', '%s')) r r^ r r1 r; r# r< Zremove_interface�InterfaceRemoved)r) r< r� r: r� r- r- r. r� � s
zFirewallD.removeInterfacec C s6 t |t�}t |t�}tjd||f � | jjj||�S )z^Return true if an interface is in a zone.
If zone is empty, use default zone.
z zone.queryInterface('%s', '%s'))r r^ r r1 r# r< Zquery_interface)r) r< r� r: r- r- r. �queryInterface s
zFirewallD.queryInterfacec C s& t |t�}tjd| � | jjj|�S )z]Return the list of interfaces of a zone.
If zone is empty, use default zone.
zzone.getInterfaces('%s'))r r^ r r1 r# r< r� )r) r< r: r- r- r. r� s
zFirewallD.getInterfacesc C s t jd||f � d S )Nz zone.InterfaceAdded('%s', '%s'))r r1 )r) r< r� r- r- r. r� + s zFirewallD.InterfaceAddedc C s t jd||f � dS )z,
This signal is deprecated.
z zone.ZoneChanged('%s', '%s')N)r r1 )r) r< r� r- r- r. � ZoneChanged0 s zFirewallD.ZoneChangedc C s" t jd||f � | j||� d S )Nz'zone.ZoneOfInterfaceChanged('%s', '%s'))r r1 r� )r) r< r� r- r- r. r� 8 s
z FirewallD.ZoneOfInterfaceChangedc C s t jd||f � d S )Nz!zone.InterfaceRemoved('%s', '%s'))r r1 )r) r< r� r- r- r. r� ? s zFirewallD.InterfaceRemovedc C sR t |t�}t |t�}tjd||f � | j|� | jjj|||�}| j||� |S )zLAdd a source to a zone.
If zone is empty, use default zone.
zzone.addSource('%s', '%s')) r r^ r r1 r; r# r< Z
add_source� SourceAdded)r) r< r� r: r� r- r- r. � addSourceH s
zFirewallD.addSourcec C sR t |t�}t |t�}tjd||f � | j|� | jjj|||�}| j||� |S )zXChange a zone an source is part of.
If zone is empty, use default zone.
z#zone.changeZoneOfSource('%s', '%s')) r r^ r r1 r; r# r< Zchange_zone_of_source�ZoneOfSourceChanged)r) r< r� r: r� r- r- r. �changeZoneOfSourceY s
z FirewallD.changeZoneOfSourcec C sP t |t�}t |t�}tjd||f � | j|� | jjj||�}| j||� |S )zeRemove source from a zone.
If zone is empty, remove from zone the source belongs to.
z zone.removeSource('%s', '%s')) r r^ r r1 r; r# r< Z
remove_source�
SourceRemoved)r) r< r� r: r� r- r- r. � removeSourcej s
zFirewallD.removeSourcec C s6 t |t�}t |t�}tjd||f � | jjj||�S )z[Return true if an source is in a zone.
If zone is empty, use default zone.
z zone.querySource('%s', '%s'))r r^ r r1 r# r< Z query_source)r) r< r� r: r- r- r. � querySource{ s
zFirewallD.querySourcec C s& t |t�}tjd| � | jjj|�S )zZReturn the list of sources of a zone.
If zone is empty, use default zone.
zzone.getSources('%s'))r r^ r r1 r# r< r� )r) r< r: r- r- r. �
getSources� s
zFirewallD.getSourcesc C s t jd||f � d S )Nz zone.SourceAdded('%s', '%s'))r r1 )r) r< r� r- r- r. r� � s zFirewallD.SourceAddedc C s t jd||f � d S )Nz$zone.ZoneOfSourceChanged('%s', '%s'))r r1 )r) r< r� r- r- r. r� � s z FirewallD.ZoneOfSourceChangedc C s t jd||f � d S )Nz zone.SourceRemoved('%s', '%s'))r r1 )r) r< r� r- r- r. r� � s zFirewallD.SourceRemovedc C sH t jd||f � | j| |= t|d�}| jjj||� | j||� d S )Nz%zone.disableTimedRichRule('%s', '%s'))�rule_str)r r1 r2 r r# r< � remove_rule�RichRuleRemoved)r) r< �ruler� r- r- r. �disableTimedRichRule� s
z FirewallD.disableTimedRichRuleZssic C s� t |t�}t |t�}t |t�}tjd||f � t|d�}| jjj|||�}|dkrtt j
|| j ||�}| j |||� | j
|||� |S )Nz zone.addRichRule('%s', '%s'))r� r )r r^ r� r r1 r r# r< �add_ruler �timeout_add_secondsr� r? �
RichRuleAdded)r) r< r� �timeoutr: r� r� r> r- r- r. � addRichRule� s
zFirewallD.addRichRulec C s\ t |t�}t |t�}tjd||f � t|d�}| jjj||�}| j||� | j ||� |S )Nz zone.removeRichRule('%s', '%s'))r� )
r r^ r r1 r r# r< r� rA r� )r) r< r� r: r� r� r- r- r. �removeRichRule� s
zFirewallD.removeRichRulec C s@ t |t�}t |t�}tjd||f � t|d�}| jjj||�S )Nz zone.queryRichRule('%s', '%s'))r� )r r^ r r1 r r# r< �
query_rule)r) r< r� r: r� r- r- r. �
queryRichRule� s
zFirewallD.queryRichRulec C s& t |t�}tjd| � | jjj|�S )Nzzone.getRichRules('%s'))r r^ r r1 r# r< Z
list_rules)r) r< r: r- r- r. � getRichRules� s
zFirewallD.getRichRulesc C s t jd|||f � d S )Nz"zone.RichRuleAdded('%s', '%s', %d))r r1 )r) r< r� r� r- r- r. r� � s zFirewallD.RichRuleAddedc C s t jd||f � d S )Nz zone.RichRuleRemoved('%s', '%s'))r r1 )r) r< r� r- r- r. r� � s zFirewallD.RichRuleRemovedc C s> t jd||f � | j| |= | jjj||� | j||� d S )Nz$zone.disableTimedService('%s', '%s'))r r1 r2 r# r< �remove_service�ServiceRemoved)r) r< rr r- r- r. �disableTimedService� s z FirewallD.disableTimedServicec C s� t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj||||�}|dkrxt j
|| j ||�}| j |||� | j
|||� |S )Nz zone.addService('%s', '%s', %d)r )r r^ r� r r1 r; r# r< Z add_servicer r� r r? � ServiceAdded)r) r< rr r� r: r� r> r- r- r. rv � s
zFirewallD.addServicec C s\ t |t�}t |t�}tjd||f � | j|� | jjj||�}| j||� | j ||� |S )Nz zone.removeService('%s', '%s'))
r r^ r r1 r; r# r< r rA r )r) r< rr r: r� r- r- r. �
removeService s
zFirewallD.removeServicec C s6 t |t�}t |t�}tjd||f � | jjj||�S )Nz zone.queryService('%s', '%s'))r r^ r r1 r# r< Z
query_service)r) r< rr r: r- r- r. � queryService& s
zFirewallD.queryServicec C s& t |t�}tjd| � | jjj|�S )Nzzone.getServices('%s'))r r^ r r1 r# r< Z
list_services)r) r< r: r- r- r. � getServices1 s
zFirewallD.getServicesc C s t jd|||f � d S )Nz!zone.ServiceAdded('%s', '%s', %d))r r1 )r) r< rr r� r- r- r. r = s zFirewallD.ServiceAddedc C s t jd||f � d S )Nz zone.ServiceRemoved('%s', '%s'))r r1 )r) r< rr r- r- r. r C s zFirewallD.ServiceRemovedc C sH t jd|||f � | j| ||f= | jjj|||� | j|||� d S )Nz'zone.disableTimedPort('%s', '%s', '%s'))r r1 r2 r# r< � remove_port� PortRemoved)r) r< �port�protocolr- r- r. �disableTimedPortL s
zFirewallD.disableTimedPortZsssic C s� t |t�}t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||||�}|dkr�t j
|| j |||�}| j |||f|� | j
||||� |S )Nz zone.addPort('%s', '%s', '%s')r )r r^ r� r r1 r; r# r< Zadd_portr r� r r? � PortAdded)r) r< r r r� r: r� r> r- r- r. �addPortT s
zFirewallD.addPortZsssc C sp t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||�}| j|||f� | j |||� |S )Nz!zone.removePort('%s', '%s', '%s'))
r r^ r r1 r; r# r< r rA r
)r) r< r r r: r� r- r- r. �
removePortk s
zFirewallD.removePortc C sD t |t�}t |t�}t |t�}tjd|||f � | jjj|||�S )Nz zone.queryPort('%s', '%s', '%s'))r r^ r r1 r# r< Z
query_port)r) r< r r r: r- r- r. � queryPort} s
zFirewallD.queryPortZaasc C s& t |t�}tjd| � | jjj|�S )Nzzone.getPorts('%s'))r r^ r r1 r# r< Z
list_ports)r) r< r: r- r- r. �getPorts� s
zFirewallD.getPortsr c C s t jd||||f � d S )Nz$zone.PortAdded('%s', '%s', '%s', %d))r r1 )r) r< r r r� r- r- r. r � s zFirewallD.PortAddedc C s t jd|||f � d S )Nz"zone.PortRemoved('%s', '%s', '%s'))r r1 )r) r< r r r- r- r. r
� s zFirewallD.PortRemovedc C s> t jd||f � | j| |= | jjj||� | j||� d S )Nz%zone.disableTimedProtocol('%s', '%s'))r r1 r2 r# r< �remove_protocol�ProtocolRemoved)r) r< r r- r- r. �disableTimedProtocol� s z FirewallD.disableTimedProtocolc C s� t |t�}t |t�}t |t�}tjd||f � | j|� | jjj||||�}|dkrvt j
|| j ||�}| j |||� | j
|||� |S )Nz zone.enableProtocol('%s', '%s')r )r r^ r� r r1 r; r# r< Z add_protocolr r� r r? �
ProtocolAdded)r) r< r r� r: r� r> r- r- r. � addProtocol� s
zFirewallD.addProtocolc C s\ t |t�}t |t�}tjd||f � | j|� | jjj||�}| j||� | j ||� |S )Nz zone.removeProtocol('%s', '%s'))
r r^ r r1 r; r# r< r rA r )r) r< r r: r� r- r- r. �removeProtocol� s
zFirewallD.removeProtocolc C s6 t |t�}t |t�}tjd||f � | jjj||�S )Nz zone.queryProtocol('%s', '%s'))r r^ r r1 r# r< Zquery_protocol)r) r< r r: r- r- r. �
queryProtocol� s
zFirewallD.queryProtocolc C s& t |t�}tjd| � | jjj|�S )Nzzone.getProtocols('%s'))r r^ r r1 r# r< Zlist_protocols)r) r< r: r- r- r. � getProtocols� s
zFirewallD.getProtocolsc C s t jd|||f � d S )Nz"zone.ProtocolAdded('%s', '%s', %d))r r1 )r) r< r r� r- r- r. r � s zFirewallD.ProtocolAddedc C s t jd||f � d S )Nz zone.ProtocolRemoved('%s', '%s'))r r1 )r) r< r r- r- r. r � s zFirewallD.ProtocolRemovedc C sJ t jd|||f � | j| d||f= | jjj|||� | j|||� d S )Nz-zone.disableTimedSourcePort('%s', '%s', '%s')�sport)r r1 r2 r# r< �remove_source_port�SourcePortRemoved)r) r< r r r- r- r. �disableTimedSourcePort� s
z FirewallD.disableTimedSourcePortc C s� t |t�}t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||||�}|dkr�t j
|| j |||�}| j |d||f|� | j
||||� |S )Nz$zone.addSourcePort('%s', '%s', '%s')r r )r r^ r� r r1 r; r# r< Zadd_source_portr r� r! r? �SourcePortAdded)r) r< r r r� r: r� r> r- r- r. �
addSourcePort� s
zFirewallD.addSourcePortc C sr t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||�}| j|d||f� | j |||� |S )Nz'zone.removeSourcePort('%s', '%s', '%s')r )
r r^ r r1 r; r# r< r rA r )r) r< r r r: r� r- r- r. �removeSourcePort s
zFirewallD.removeSourcePortc C sD t |t�}t |t�}t |t�}tjd|||f � | jjj|||�S )Nz&zone.querySourcePort('%s', '%s', '%s'))r r^ r r1 r# r< Zquery_source_port)r) r< r r r: r- r- r. �querySourcePort) s
zFirewallD.querySourcePortc C s& t |t�}tjd| � | jjj|�S )Nzzone.getSourcePorts('%s'))r r^ r r1 r# r< Zlist_source_ports)r) r< r: r- r- r. �getSourcePorts6 s
zFirewallD.getSourcePortsc C s t jd||||f � d S )Nz*zone.SourcePortAdded('%s', '%s', '%s', %d))r r1 )r) r< r r r� r- r- r. r" B s zFirewallD.SourcePortAddedc C s t jd|||f � d S )Nz(zone.SourcePortRemoved('%s', '%s', '%s'))r r1 )r) r< r r r- r- r. r H s
zFirewallD.SourcePortRemovedc C s( | j | d= | jjj|� | j|� d S )N�
masquerade)r2 r# r< �remove_masquerade�MasqueradeRemoved)r) r< r- r- r. �disableTimedMasqueradeR s z FirewallD.disableTimedMasqueradeZsic C st t |t�}t |t�}tjd| � | j|� | jjj|||�}|dkrdt j
|| j |�}| j |d|� | j
||� |S )Nzzone.addMasquerade('%s')r r' )r r^ r� r r1 r; r# r< Zadd_masquerader r� r* r? �MasqueradeAdded)r) r< r� r: r� r> r- r- r. �
addMasqueradeX s
zFirewallD.addMasqueradec C sJ t |t�}tjd| � | j|� | jjj|�}| j|d� | j |� |S )Nzzone.removeMasquerade('%s')r' )
r r^ r r1 r; r# r< r( rA r) )r) r< r: r� r- r- r. �removeMasqueradel s
zFirewallD.removeMasqueradec C s& t |t�}tjd| � | jjj|�S )Nzzone.queryMasquerade('%s'))r r^ r r1 r# r< Zquery_masquerade)r) r< r: r- r- r. �queryMasquerade{ s
zFirewallD.queryMasqueradec C s t jd||f � d S )Nz zone.MasqueradeAdded('%s', %d))r r1 )r) r< r� r- r- r. r+ � s zFirewallD.MasqueradeAddedc C s t jd| � d S )Nz zone.MasqueradeRemoved('%s'))r r1 )r) r< r- r- r. r) � s zFirewallD.MasqueradeRemovedc C s@ | j | ||||f= | jjj|||||� | j|||||� d S )N)r2 r# r< �remove_forward_port�ForwardPortRemoved)r) r< r r �toport�toaddrr- r- r. �disable_forward_port� s z FirewallD.disable_forward_portZsssssic
C s� t |t�}t |t�}t |t�}t |t�}t |t�}t |t�}tjd|||||f � | j|� | jjj|||||||�}|dkr�t j
|| j |||||�} | j |||||f| � | j
||||||� |S )Nz1zone.addForwardPort('%s', '%s', '%s', '%s', '%s')r )r r^ r� r r1 r; r# r< Zadd_forward_portr r� r3 r? �ForwardPortAdded)
r) r< r r r1 r2 r� r: r� r> r- r- r. �addForwardPort� s&
zFirewallD.addForwardPortZsssssc C s� t |t�}t |t�}t |t�}t |t�}t |t�}tjd|||||f � | j|� | jjj|||||�}| j|||||f� | j |||||� |S )Nz4zone.removeForwardPort('%s', '%s', '%s', '%s', '%s'))
r r^ r r1 r; r# r< r/ rA r0 )r) r< r r r1 r2 r: r� r- r- r. �removeForwardPort� s
zFirewallD.removeForwardPortc C s` t |t�}t |t�}t |t�}t |t�}t |t�}tjd|||||f � | jjj|||||�S )Nz3zone.queryForwardPort('%s', '%s', '%s', '%s', '%s'))r r^ r r1 r# r< Zquery_forward_port)r) r< r r r1 r2 r: r- r- r. �queryForwardPort� s
zFirewallD.queryForwardPortc C s& t |t�}tjd| � | jjj|�S )Nzzone.getForwardPorts('%s'))r r^ r r1 r# r< Zlist_forward_ports)r) r< r: r- r- r. �getForwardPorts� s
zFirewallD.getForwardPortsc C s t jd||||||f � d S )Nz7zone.ForwardPortAdded('%s', '%s', '%s', '%s', '%s', %d))r r1 )r) r< r r r1 r2 r� r- r- r. r4 � s zFirewallD.ForwardPortAddedc C s t jd|||||f � d S )Nz5zone.ForwardPortRemoved('%s', '%s', '%s', '%s', '%s'))r r1 )r) r< r r r1 r2 r- r- r. r0 � s z FirewallD.ForwardPortRemovedc C s> t jd||f � | j| |= | jjj||� | j||� d S )Nz&zone.disableTimedIcmpBlock('%s', '%s'))r r1 r2 r# r< �remove_icmp_block�IcmpBlockRemoved)r) r< �icmpr: r- r- r. �disableTimedIcmpBlock� s z FirewallD.disableTimedIcmpBlockc C s� t |t�}t |t�}t |t�}tjd||f � | j|� | jjj||||�}|dkrxt j
|| j |||�}| j |||� | j
|||� |S )Nz zone.enableIcmpBlock('%s', '%s')r )r r^ r� r r1 r; r# r< Zadd_icmp_blockr r� r< r? �IcmpBlockAdded)r) r< r; r� r: r� r> r- r- r. � addIcmpBlock s
zFirewallD.addIcmpBlockc C s\ t |t�}t |t�}tjd||f � | j|� | jjj||�}| j||� | j ||� |S )Nz zone.removeIcmpBlock('%s', '%s'))
r r^ r r1 r; r# r< r9 rA r: )r) r< r; r: r� r- r- r. �removeIcmpBlock s
zFirewallD.removeIcmpBlockc C s6 t |t�}t |t�}tjd||f � | jjj||�S )Nz zone.queryIcmpBlock('%s', '%s'))r r^ r r1 r# r< Zquery_icmp_block)r) r< r; r: r- r- r. �queryIcmpBlock& s
zFirewallD.queryIcmpBlockc C s& t |t�}tjd| � | jjj|�S )Nzzone.getIcmpBlocks('%s'))r r^ r r1 r# r< Zlist_icmp_blocks)r) r< r: r- r- r. �
getIcmpBlocks1 s
zFirewallD.getIcmpBlocksc C s t jd|||f � d S )Nz#zone.IcmpBlockAdded('%s', '%s', %d))r r1 )r) r< r; r� r- r- r. r= = s zFirewallD.IcmpBlockAddedc C s t jd||f � d S )Nz!zone.IcmpBlockRemoved('%s', '%s'))r r1 )r) r< r; r- r- r. r: C s zFirewallD.IcmpBlockRemovedc C s@ t |t�}tjd| � | j|� | jjj||�}| j|� |S )Nz zone.addIcmpBlockInversion('%s')) r r^ r r1 r; r# r< Zadd_icmp_block_inversion�IcmpBlockInversionAdded)r) r< r: r� r- r- r. �addIcmpBlockInversionL s
z FirewallD.addIcmpBlockInversionc C s> t |t�}tjd| � | j|� | jjj|�}| j|� |S )Nz#zone.removeIcmpBlockInversion('%s')) r r^ r r1 r; r# r< Zremove_icmp_block_inversion�IcmpBlockInversionRemoved)r) r< r: r� r- r- r. �removeIcmpBlockInversionZ s
z"FirewallD.removeIcmpBlockInversionc C s& t |t�}tjd| � | jjj|�S )Nz"zone.queryIcmpBlockInversion('%s'))r r^ r r1 r# r< Zquery_icmp_block_inversion)r) r< r: r- r- r. �queryIcmpBlockInversionh s
z!FirewallD.queryIcmpBlockInversionc C s t jd| � d S )Nz"zone.IcmpBlockInversionAdded('%s'))r r1 )r) r< r- r- r. rB r s z!FirewallD.IcmpBlockInversionAddedc C s t jd| � d S )Nz$zone.IcmpBlockInversionRemoved('%s'))r r1 )r) r< r- r- r. rD w s z#FirewallD.IcmpBlockInversionRemovedc C s` t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||� | j|||� d S )Nz!direct.addChain('%s', '%s', '%s')) r r^ r r1 r; r# r� Z add_chain�
ChainAdded)r) �ipv�table�chainr: r- r- r. �addChain� s
zFirewallD.addChainc C s` t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||� | j|||� d S )Nz$direct.removeChain('%s', '%s', '%s')) r r^ r r1 r; r# r� Z remove_chain� ChainRemoved)r) rH rI rJ r: r- r- r. � removeChain� s
zFirewallD.removeChainc C sD t |t�}t |t�}t |t�}tjd|||f � | jjj|||�S )Nz#direct.queryChain('%s', '%s', '%s'))r r^ r r1 r# r� Z query_chain)r) rH rI rJ r: r- r- r. �
queryChain� s
zFirewallD.queryChainc C s6 t |t�}t |t�}tjd||f � | jjj||�S )Nz direct.getChains('%s', '%s'))r r^ r r1 r# r� Z
get_chains)r) rH rI r: r- r- r. � getChains� s
zFirewallD.getChainsza(sss)c C s t jd� | jjj� S )Nzdirect.getAllChains())r r1 r# r� r� )r) r: r- r- r. � getAllChains� s
zFirewallD.getAllChainsc C s t jd|||f � d S )Nz#direct.ChainAdded('%s', '%s', '%s'))r r1 )r) rH rI rJ r- r- r. rG � s zFirewallD.ChainAddedc C s t jd|||f � d S )Nz%direct.ChainRemoved('%s', '%s', '%s'))r r1 )r) rH rI rJ r- r- r. rL � s
zFirewallD.ChainRemovedZsssiasc C s� t |t�}t |t�}t |t�}t |t�}tdd� |D ��}tjd||||dj|�f � | j|� | jj j
|||||� | j |||||� d S )Nc s s | ]}t |t�V qd S )N)r r^ )�.0r� r- r- r. � <genexpr>� s z$FirewallD.addRule.<locals>.<genexpr>z*direct.addRule('%s', '%s', '%s', %d, '%s')z',') r r^ r� r� r r1 �joinr; r# r� r� � RuleAdded)r) rH rI rJ �priorityr* r: r- r- r. �addRule� s
zFirewallD.addRulec C s� t |t�}t |t�}t |t�}t |t�}tdd� |D ��}tjd||||dj|�f � | j|� | jj j
|||||� | j |||||� d S )Nc s s | ]}t |t�V qd S )N)r r^ )rQ r� r- r- r. rR � s z'FirewallD.removeRule.<locals>.<genexpr>z-direct.removeRule('%s', '%s', '%s', %d, '%s')z',') r r^ r� r� r r1 rS r; r# r� r� � RuleRemoved)r) rH rI rJ rU r* r: r- r- r. �
removeRule� s
zFirewallD.removeRulec C s� t |t�}t |t�}t |t�}tjd|||f � | j|� xF| jjj|||�D ]0\}}| jjj|||||� | j |||||� qPW d S )Nz$direct.removeRules('%s', '%s', '%s'))
r r^ r r1 r; r# r� � get_rulesr� rW )r) rH rI rJ r: rU r* r- r- r. � removeRules� s
zFirewallD.removeRulesc C sn t |t�}t |t�}t |t�}t |t�}tdd� |D ��}tjd||||dj|�f � | jjj |||||�S )Nc s s | ]}t |t�V qd S )N)r r^ )rQ r� r- r- r. rR s z&FirewallD.queryRule.<locals>.<genexpr>z,direct.queryRule('%s', '%s', '%s', %d, '%s')z',')
r r^ r� r� r r1 rS r# r� r )r) rH rI rJ rU r* r: r- r- r. � queryRule� s
zFirewallD.queryRuleza(ias)c C sD t |t�}t |t�}t |t�}tjd|||f � | jjj|||�S )Nz!direct.getRules('%s', '%s', '%s'))r r^ r r1 r# r� rY )r) rH rI rJ r: r- r- r. �getRules
s
zFirewallD.getRulesz a(sssias)c C s t jd� | jjj� S )Nzdirect.getAllRules())r r1 r# r� r� )r) r: r- r- r. � getAllRules s
zFirewallD.getAllRulesc C s" t jd||||dj|�f � d S )Nz,direct.RuleAdded('%s', '%s', '%s', %d, '%s')z',')r r1 rS )r) rH rI rJ rU r* r- r- r. rT " s zFirewallD.RuleAddedc C s" t jd||||dj|�f � d S )Nz.direct.RuleRemoved('%s', '%s', '%s', %d, '%s')z',')r r1 rS )r) rH rI rJ rU r* r- r- r. rW ( s zFirewallD.RuleRemovedrS c C s� t |t�}tdd� |D ��}tjd|dj|�f � | j|� y| jjj ||�S t
k
r� } zh|d krzt ddd d
g�}n t d d
g�}t|�}|j t
jkr�tt |�|@ �d kr�tj|� t|��� W Y d d }~X nX d S )
Nc s s | ]}t |t�V qd S )N)r r^ )rQ r� r- r- r. rR 9 s z(FirewallD.passthrough.<locals>.<genexpr>z direct.passthrough('%s', '%s')z','rH rL z-Cz--checkz-Lz--listr )rH rL )r r^ r� r r1 rS r; r# r� � passthroughr �set�coder ZCOMMAND_FAILEDr� rx r
)r) rH r* r: r9 Z
query_args�msgr- r- r. r^ 2 s"
zFirewallD.passthroughc C s\ t |�}tdd� |D ��}tjd|dj|�f � | j|� | jjj||� | j ||� d S )Nc s s | ]}t |�V qd S )N)r )rQ r� r- r- r. rR T s z+FirewallD.addPassthrough.<locals>.<genexpr>z!direct.addPassthrough('%s', '%s')z',')
r r� r r1 rS r; r# r� Zadd_passthrough�PassthroughAdded)r) rH r* r: r- r- r. �addPassthroughM s
zFirewallD.addPassthroughc C s\ t |�}tdd� |D ��}tjd|dj|�f � | j|� | jjj||� | j ||� d S )Nc s s | ]}t |�V qd S )N)r )rQ r� r- r- r. rR b s z.FirewallD.removePassthrough.<locals>.<genexpr>z$direct.removePassthrough('%s', '%s')z',')
r r� r r1 rS r; r# r� Zremove_passthrough�PassthroughRemoved)r) rH r* r: r- r- r. �removePassthrough[ s
zFirewallD.removePassthroughc C sB t |�}tdd� |D ��}tjd|dj|�f � | jjj||�S )Nc s s | ]}t |�V qd S )N)r )rQ r� r- r- r. rR p s z-FirewallD.queryPassthrough.<locals>.<genexpr>z#direct.queryPassthrough('%s', '%s')z',')r r� r r1 rS r# r� Zquery_passthrough)r) rH r* r: r- r- r. �queryPassthroughi s
zFirewallD.queryPassthroughza(sas)c C s t jd� | jjj� S )Nzdirect.getAllPassthroughs())r r1 r# r� r� )r) r: r- r- r. �getAllPassthroughsu s
z FirewallD.getAllPassthroughsc C s. t jd� x t| j� �D ]}| j|� qW d S )Nz direct.removeAllPassthroughs())r r1 �reversedrg re )r) r: r^ r- r- r. �removeAllPassthroughs~ s
z FirewallD.removeAllPassthroughsc C s" t |�}tjd|� | jjj|�S )Nz direct.getPassthroughs('%s'))r r r1 r# r� Zget_passthroughs)r) rH r: r- r- r. �getPassthroughs� s zFirewallD.getPassthroughsc C s t jd|dj|�f � d S )Nz#direct.PassthroughAdded('%s', '%s')z',')r r1 rS )r) rH r* r- r- r. rb � s zFirewallD.PassthroughAddedc C s t jd|dj|�f � d S )Nz%direct.PassthroughRemoved('%s', '%s')z',')r r1 rS )r) rH r* r- r- r. rd � s z FirewallD.PassthroughRemovedc C s dS )z� PK_ACTION_ALL implies all other actions, i.e. once a subject is
authorized for PK_ACTION_ALL it's also authorized for any other action.
Use-case is GUI (RHBZ#994729).
Nr- )r) r: r- r- r. � authorizeAll� s zFirewallD.authorizeAllc C s$ t |�}tjd| � | jjj|�S )Nzipset.queryIPSet('%s'))r r r1 r# r| Z query_ipset)r) r| r: r- r- r. �
queryIPSet� s zFirewallD.queryIPSetc C s t jd� | jjj� S )Nzipsets.getIPSets())r r1 r# r| r} )r) r: r- r- r. � getIPSets� s
zFirewallD.getIPSetsc C s( t |t�}tjd|� | jjj|�j� S )NzgetIPSetSettings(%s))r r^ r r1 r# r| Z get_ipsetr� )r) r| r: r- r- r. r~ � s
zFirewallD.getIPSetSettingsc C sL t |�}t |�}tjd||f � | j|� | jjj||� | j||� d S )Nzipset.addEntry('%s', '%s'))r r r1 r; r# r| Z add_entry�
EntryAdded)r) r| �entryr: r- r- r. �addEntry� s
zFirewallD.addEntryc C sL t |�}t |�}tjd||f � | j|� | jjj||� | j||� d S )Nz ipset.removeEntry('%s', '%s'))r r r1 r; r# r| Z remove_entry� EntryRemoved)r) r| ro r: r- r- r. � removeEntry� s
zFirewallD.removeEntryc C s2 t |�}t |�}tjd||f � | jjj||�S )Nz ipset.queryEntry('%s', '%s'))r r r1 r# r| Z query_entry)r) r| ro r: r- r- r. �
queryEntry� s zFirewallD.queryEntryc C s$ t |�}tjd| � | jjj|�S )Nzipset.getEntries('%s'))r r r1 r# r| � get_entries)r) r| r: r- r- r. �
getEntries� s zFirewallD.getEntriesc C s� t |�}t |t�}tjd|dj|�� | jjj|�}| jjj||� t |�}t |�}x || D ]}| j
||� q^W x || D ]}| j ||� q|W d S )Nz ipset.setEntries('%s', '[%s]')�,) r �listr r1 rS r# r| rt Z set_entriesr_ rn rq )r) r| Zentriesr: Z old_entriesZold_entries_setZ entries_setro r- r- r. �
setEntries� s
zFirewallD.setEntriesc C s& t |�}t |�}tjd||f � d S )Nz ipset.EntryAdded('%s', '%s'))r r r1 )r) r| ro r- r- r. rn
s zFirewallD.EntryAddedc C s& t |�}t |�}tjd||f � d S )Nz ipset.EntryRemoved('%s', '%s'))r r r1 )r) r| ro r- r- r. rq
s zFirewallD.EntryRemovedc C s t jd� | jjj� S )Nzhelpers.getHelpers())r r1 r# r� r� )r) r: r- r- r. �
getHelpers!
s
zFirewallD.getHelpersc C s( t |t�}tjd|� | jjj|�j� S )NzgetHelperSettings(%s))r r^ r r1 r# r� Z
get_helperr� )r) r� r: r- r- r. r� *
s
zFirewallD.getHelperSettings)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)r )N)N)N)N)r )N)N)N)N)r )N)N)N)r )N)N)N)N)r )N)N)N)N)r )N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)��__name__�
__module__� __qualname__�__doc__Z
persistentr r' ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r" r0 r& r/ r
r; r? rA rC rZ r ZPROPERTIES_IFACEre rh �slipZpolkitZ require_authri rr �signalrj ZPK_ACTION_INFOZINTROSPECTABLE_IFACErk r( rn rp ro rq r� ZPK_ACTION_POLICIESra r� r� ZPK_ACTION_POLICIES_INFOr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� ZPK_ACTION_CONFIG_INFOr� r_ r� r� r� ZDBUS_INTERFACE_POLICYr� r� r� r� rt r� r� r ZDBUS_SIGNATUREr{ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� r� r rv r r
r r r r r r r r r r
r r r r r r r r! r# r$ r% r& r" r r* r, r- r. r+ r) r3 r5 r6 r7 r8 r4 r0 r< r> r? r@ rA r= r: rC rE rF rB rD ZPK_ACTION_DIRECTr` rK rM ZPK_ACTION_DIRECT_INFOrN rO rP rG rL rV rX rZ r[ r\ r] rT rW r^ rc re rf rg ri rj rb rd Z
PK_ACTION_ALLrk rb rl rm r r~ rp rr rs ru rx rn rq ry r r� �
__classcell__r- r- )r, r. r A s� 0 "
K
)9�__all__Z
gi.repositoryr r �sys�modulesr� r' Z dbus.serviceZ slip.dbusr~ Zslip.dbus.serviceZfirewallr Zfirewall.core.fwr Zfirewall.core.richr Zfirewall.core.loggerr Zfirewall.clientr Zfirewall.server.decoratorsr
r r r
Zfirewall.server.configr Zfirewall.dbus_utilsr r r r r r r Zfirewall.core.io.functionsr Zfirewall.core.io.ipsetr Zfirewall.core.io.icmptyper Zfirewall.core.io.helperr Zfirewall.core.fw_nmr r r Zfirewall.core.fw_ifcfgr r Zfirewall.errorsr rr ZObjectr r- r- r- r. �<module> s2
$ server/__pycache__/config_service.cpython-36.pyc 0000644 00000051355 15035135172 0015710 0 ustar 00 3
��g�u � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZmZmZ d dl mZ d d lmZ G d
d � d ejjj�ZdS ) � )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�errors)�
FirewallErrorc s� e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z
e d d
� �Zeejd d d
�e d�dd���Zeejddd
�e d�dd���Zejjjejj�eejdd�e d�dd����Zejjejdd�dd � �Zejjjejj�eejdd �e d�� fd d � ���Z eejj d d �e d�d!d"���Z eejj dd �e d�d#d$���Z eejj d d�e d�d%d&���Z eejj dd�e d�d'd(���Z!eejj �e d�d)d*���Z"ejjejj dd�e d+d,� ��Z#eejj �e d�d-d.���Z$ejjejj dd�e d/d0� ��Z%eejj dd�e d�d1d2���Z&ejjejj dd�e d3d4� ��Z'eejj dd �e d�d5d6���Z(eejj dd�e d�d7d8���Z)eejj dd �e d�d9d:���Z*eejj dd�e d�d;d<���Z+eejj dd �e d�d=d>���Z,eejj dd�e d�d?d@���Z-eejj dAd �e d�dBdC���Z.eejj dAd�e d�dDdE���Z/eejj d d�e d�dFdG���Z0eejj d d�e d�dHdI���Z1eejj d dJd
�e d�dKdL���Z2eejj dMd �e d�dNdO���Z3eejj dMd�e d�dPdQ���Z4eejj dd�e d�dRdS���Z5eejj dd�e d�dTdU���Z6eejj ddJd
�e d�dVdW���Z7eejj dAd �e d�dXdY���Z8eejj dAd�e d�dZd[���Z9eejj d d�e d�d\d]���Z:eejj d d�e d�d^d_���Z;eejj d dJd
�e d�d`da���Z<eejj dMd �e d�dbdc���Z=eejj dMd�e d�ddde���Z>eejj dd�e d�dfdg���Z?eejj dd�e d�dhdi���Z@eejj ddJd
�e d�djdk���ZAeejj dld �e d�dmdn���ZBeejj dld�e d�dodp���ZCeejj ddd
�e d�dqdr���ZDeejj d d�e d�dsdt���ZEeejj dd�e d�dudv���ZFeejj d dJd
�e d�dwdx���ZGeejj dMd �e d�dydz���ZHeejj dMd�e d�d{d|���ZIeejj dd�e d�d}d~���ZJeejj dd�e d�dd����ZKeejj ddJd
�e d�d�d����ZL� ZMS )��FirewallDConfigServicezFirewallD main classTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.service.%d)
�superr
�__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_SERVICE)�selfr Zconf�servicer �args�kwargs)� __class__� �$/usr/lib/python3.6/config_service.pyr 7 s
z FirewallDConfigService.__init__c C s d S )Nr )r r r r �__del__D s z FirewallDConfigService.__del__c C s | j � d S )N)Zremove_from_connection)r r r r �
unregisterH s z!FirewallDConfigService.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r" r# r ZBooleanr$ r% �
exceptions�
DBusException)r �
property_namer r r �
_get_propertyP s z$FirewallDConfigService._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r' r( r* )r �interface_namer) �senderr r r �Geta s
zFirewallDConfigService.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr" r# r r$ r% Zsv)� signature)r" r# r r$ r% ) r r. r r/ r r r r r' r( r* Z
Dictionary)r r0 r1 �ret�xr r r �GetAllr s
z FirewallDConfigService.GetAllZssv)r, c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r. r r/ r r � accessCheckr r r r' r( )r r0 r) Z new_valuer1 r r r �Set� s
zFirewallDConfigService.Setzsa{sv}as)r4 c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r. r r/ r )r r0 Zchanged_propertiesZinvalidated_propertiesr r r �PropertiesChanged� s
z(FirewallDConfigService.PropertiesChanged)r- c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r r
�
Introspectr r Zget_busr r r r )r r1 �data)r r r r; � s
z!FirewallDConfigService.Introspectz(sssa(ss)asa{ss}asa(ss))c C s t jd| j� | jj| j�S )z!get settings for service
z%s.getSettings())r r/ r r Zget_service_configr )r r1 r r r � getSettings� s z"FirewallDConfigService.getSettingsc C s t jd| j� | jj| j�S )z!get settings for service
z%s.getSettings2())r r/ r r �get_service_config_dictr )r r1 r r r � getSettings2� s z#FirewallDConfigService.getSettings2c C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� dS )z$update settings for service
z%s.update('...')N) r r r/ r r r8 r Zset_service_configr �Updatedr" )r �settingsr1 r r r �update� s
z FirewallDConfigService.updatec C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� d S )Nz%s.update2('...')) r r r/ r r r8 r �set_service_config_dictr r@ r" )r rA r1 r r r �update2� s
z FirewallDConfigService.update2c C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z2load default settings for builtin service
z%s.loadDefaults()N)
r r/ r r r8 r Zload_service_defaultsr r@ r" )r r1 r r r � loadDefaults� s z#FirewallDConfigService.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r/ r )r r" r r r r@ � s z FirewallDConfigService.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove service
z%s.removeService()N) r r/ r r r8 r Zremove_servicer Z
removeService)r r1 r r r �remove� s z FirewallDConfigService.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r/ r )r r" r r r �Removed� s z FirewallDConfigService.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename service
z%s.rename('%s')N) r r. r r/ r r r8 r Zrename_servicer �Renamed)r r" r1 r r r �rename� s
z FirewallDConfigService.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r/ r )r r" r r r rH s z FirewallDConfigService.Renamedc C s t jd| j� | j� d S )Nz%s.getVersion()r )r r/ r r= )r r1 r r r �
getVersion s z!FirewallDConfigService.getVersionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setVersion('%s')r )
r r. r r/ r r r8 �listr= rB )r �versionr1 rA r r r �
setVersion s
z!FirewallDConfigService.setVersionc C s t jd| j� | j� d S )Nz
%s.getShort()r )r r/ r r= )r r1 r r r �getShort" s z FirewallDConfigService.getShortc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setShort('%s')r )
r r. r r/ r r r8 rK r= rB )r Zshortr1 rA r r r �setShort) s
z FirewallDConfigService.setShortc C s t jd| j� | j� d S )Nz%s.getDescription()� )r r/ r r= )r r1 r r r �getDescription6 s z%FirewallDConfigService.getDescriptionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDescription('%s')rP )
r r. r r/ r r r8 rK r= rB )r � descriptionr1 rA r r r �setDescription= s
z%FirewallDConfigService.setDescriptionza(ss)c C s t jd| j� | j� d S )Nz
%s.getPorts()� )r r/ r r= )r r1 r r r �getPortsK s z FirewallDConfigService.getPortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setPorts('[%s]')�,c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr )�.0�portr r r � <genexpr>_ s z2FirewallDConfigService.setPorts.<locals>.<genexpr>rT )
r rK �
isinstance�append�tupler r/ r �joinr r8 r= rB )r �portsr1 �_portsrX rA r r r �setPortsR s
z FirewallDConfigService.setPortsc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz%s.addPort('%s', '%s')rT z%s:%s)r r. r r/ r r r8 rK r= r r �ALREADY_ENABLEDr[ rB )r rX �protocolr1 rA r r r �addPorte s
z FirewallDConfigService.addPortc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz%s.removePort('%s', '%s')rT z%s:%s)r r. r r/ r r r8 rK r= r r � NOT_ENABLEDrF rB )r rX rb r1 rA r r r �
removePortu s
z!FirewallDConfigService.removePort�bc C s: t |t�}t |t�}tjd| j||� ||f| j� d kS )Nz%s.queryPort('%s', '%s')rT )r r. r r/ r r= )r rX rb r1 r r r � queryPort� s
z FirewallDConfigService.queryPort�asc C s t jd| j� | j� d S )Nz%s.getProtocols()� )r r/ r r= )r r1 r r r � getProtocols� s z#FirewallDConfigService.getProtocolsc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setProtocols('[%s]')rV ri )
r rK r r/ r r] r r8 r= rB )r Z protocolsr1 rA r r r � setProtocols� s
z#FirewallDConfigService.setProtocolsc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addProtocol('%s')ri )r r. r r/ r r r8 rK r= r r ra r[ rB )r rb r1 rA r r r � addProtocol� s
z"FirewallDConfigService.addProtocolc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.removeProtocol('%s')ri )r r. r r/ r r r8 rK r= r r rd rF rB )r rb r1 rA r r r �removeProtocol� s
z%FirewallDConfigService.removeProtocolc C s* t |t�}tjd| j|� || j� d kS )Nz%s.queryProtocol(%s')ri )r r. r r/ r r= )r rb r1 r r r �
queryProtocol� s
z$FirewallDConfigService.queryProtocolc C s t jd| j� | j� d S )Nz%s.getSourcePorts()� )r r/ r r= )r r1 r r r �getSourcePorts� s z%FirewallDConfigService.getSourcePortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setSourcePorts('[%s]')rV c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr )rW rX r r r rY � s z8FirewallDConfigService.setSourcePorts.<locals>.<genexpr>ro )
r rK rZ r[ r\ r r/ r r] r r8 r= rB )r r^ r1 r_ rX rA r r r �setSourcePorts� s
z%FirewallDConfigService.setSourcePortsc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz %s.addSourcePort('%s', '%s')ro z%s:%s)r r. r r/ r r r8 rK r= r r ra r[ rB )r rX rb r1 rA r r r �
addSourcePort� s
z$FirewallDConfigService.addSourcePortc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz %s.removeSourcePort('%s', '%s')ro z%s:%s)r r. r r/ r r r8 rK r= r r rd rF rB )r rX rb r1 rA r r r �removeSourcePort� s
z'FirewallDConfigService.removeSourcePortc C s: t |t�}t |t�}tjd| j||� ||f| j� d kS )Nz %s.querySourcePort('%s', '%s')ro )r r. r r/ r r= )r rX rb r1 r r r �querySourcePort s
z&FirewallDConfigService.querySourcePortc C s t jd| j� | j� d S )Nz%s.getModules()� )r r/ r r= )r r1 r r r �
getModules s z!FirewallDConfigService.getModulesc C s� t |t�}g }x@|D ]8}|jd�rB|jdd�}d|krB|jdd�}|j|� qW |}tjd| jdj|�� | j j
|� t| j � �}||d< | j |� d S )N�
nf_conntrack_� �_�-z%s.setModules('[%s]')rV ru )
r rK �
startswith�replacer[ r r/ r r] r r8 r= rB )r �modulesr1 Z_modules�modulerA r r r �
setModules s
z!FirewallDConfigService.setModulesc C s� t |t�}|jd�r4|jdd�}d|kr4|jdd�}tjd| j|� | jj|� t | j
� �}||d krtt t j
|��|d j|� | j|� d S )Nrw rx ry rz z%s.addModule('%s')ru )r r. r{ r| r r/ r r r8 rK r= r r ra r[ rB )r r~ r1 rA r r r � addModule' s
z FirewallDConfigService.addModulec C s� t |t�}|jd�r4|jdd�}d|kr4|jdd�}tjd| j|� | jj|� t | j
� �}||d krtt t j
|��|d j|� | j|� d S )Nrw rx ry rz z%s.removeModule('%s')ru )r r. r{ r| r r/ r r r8 rK r= r r rd rF rB )r r~ r1 rA r r r � removeModule8 s
z#FirewallDConfigService.removeModulec C sT t |t�}|jd�r4|jdd�}d|kr4|jdd�}tjd| j|� || j� d kS )Nrw rx ry rz z%s.queryModule('%s')ru )r r. r{ r| r r/ r r= )r r~ r1 r r r � queryModuleI s
z"FirewallDConfigService.queryModuleza{ss}c C s t jd| j� | j� d S )Nz%s.getDestinations()� )r r/ r r= )r r1 r r r �getDestinationsW s z&FirewallDConfigService.getDestinationsc C sV t |t�}tjd| j|jd�|jd�� | jj|� t| j � �}||d< | j
|� d S )Nz*%s.setDestinations({ipv4:'%s', ipv6:'%s'})Zipv4Zipv6r� ) r �dictr r/ r �getr r8 rK r= rB )r Z destinationsr1 rA r r r �setDestinations^ s
z&FirewallDConfigService.setDestinationsc C sV t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d | S )Nz%s.getDestination('%s')r� ) r r. r r/ r r r8 rK r= r r rd )r �familyr1 rA r r r �getDestinationk s
z%FirewallDConfigService.getDestinationc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||d krn|d | |krnt t
j d||f ��||d |< | j |� d S )Nz %s.setDestination('%s', '%s')r� z
'%s': '%s')
r r. r r/ r r r8 rK r= r r ra rB )r r� �addressr1 rA r r r �setDestinationx s
z%FirewallDConfigService.setDestinationc C sb t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d |= | j |� d S )Nz%s.removeDestination('%s')r� )
r r. r r/ r r r8 rK r= r r rd rB )r r� r1 rA r r r �removeDestination� s
z(FirewallDConfigService.removeDestinationc C sJ t |t�}t |t�}tjd| j||� | j� }||d koH||d | kS )Nz %s.queryDestination('%s', '%s')r� )r r. r r/ r r= )r r� r� r1 rA r r r �queryDestination� s
z'FirewallDConfigService.queryDestinationc C s< t jd| j� | jj|� | jj| j�}d|kr8|d S g S )Nz%s.getIncludes()�includes)r r/ r r r8 r r> r )r r1 rA r r r � getIncludes� s z"FirewallDConfigService.getIncludesc C sZ t |t�}tjd| j|� | jj|� d|d d � i}| jj| j |�| _ | j
| j j � d S )Nz%s.setIncludes('%s')r� ) r rK r r/ r r r8 r rC r r@ r" )r r� r1 rA r r r � setIncludes� s
z"FirewallDConfigService.setIncludesc C sj t |t�}tjd| j|� | jj|� | jj| j �}|j
dg �j |� | jj | j |�| _ | j
| j j� d S )Nz%s.addInclude('%s')r� )r r. r r/ r r r8 r r> r �
setdefaultr[ rC r@ r" )r �includer1 rA r r r �
addInclude� s
z!FirewallDConfigService.addIncludec C sf t |t�}tjd| j|� | jj|� | jj| j �}|d j
|� | jj | j |�| _ | j | j j
� d S )Nz%s.removeInclude('%s')r� )r r. r r/ r r r8 r r> r rF rC r@ r" )r r� r1 rA r r r �
removeInclude� s
z$FirewallDConfigService.removeIncludec C s@ t |t�}tjd| j|� | jj| j�}d|kr<||d kS dS )Nz%s.queryInclude('%s')r� F)r r. r r/ r r r> r )r r� r1 rA r r r � queryInclude� s
z#FirewallDConfigService.queryInclude)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N�__name__�
__module__� __qualname__�__doc__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r r! r* r
ZPROPERTIES_IFACEr2 r7 �slipZpolkitZ require_authr9 r �signalr: ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr; r r= r? rB rD rE r@ rF rG rI rH rJ rM rN rO rQ rS rU r` rc re rg rj rk rl rm rn rp rq rr rs rt rv r r� r� r� r� r� r� r� r� r� r� r� r� r� r� �
__classcell__r r )r r r
/ s�
r
)Z
gi.repositoryr �sysr} r Z dbus.serviceZ slip.dbusr� Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.loggerr Zfirewall.server.decoratorsr r r
r Zfirewall.errorsr r ZObjectr
r r r r �<module> s
server/__pycache__/config_icmptype.cpython-36.pyc 0000644 00000024677 15035135172 0016111 0 ustar 00 3
��gS: � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZ d dlmZmZmZ d d l mZ d d
lmZ G d d � d ejjj�Z dS )
� )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�IcmpType)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�errors)�
FirewallErrorc sH e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z
e d d
� �Zeejd d d
�e dHdd���Zeejddd
�e dIdd���Zejjjejj�eejdd�e dJdd����Zejjejdd�dd � �Zejjjejj�eejdd �e dK� fd d � ���Z eejj e j d �e dLd d!���Z eejj e j d�e dMd"d#���Z!eejj �e dNd$d%���Z"ejjejj dd�e d&d'� ��Z#eejj �e dOd(d)���Z$ejjejj dd�e d*d+� ��Z%eejj dd�e dPd,d-���Z&ejjejj dd�e d.d/� ��Z'eejj dd �e dQd0d1���Z(eejj dd�e dRd2d3���Z)eejj dd �e dSd4d5���Z*eejj dd�e dTd6d7���Z+eejj dd �e dUd8d9���Z,eejj dd�e dVd:d;���Z-eejj d<d �e dWd=d>���Z.eejj d<d�e dXd?d@���Z/eejj dd�e dYdAdB���Z0eejj dd�e dZdCdD���Z1eejj ddEd
�e d[dFdG���Z2� Z3S )\�FirewallDConfigIcmpTypezFirewallD main classTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.icmptype.%d)
�superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_ICMPTYPE)�selfr ZconfZicmptyper �args�kwargs)� __class__� �%/usr/lib/python3.6/config_icmptype.pyr 8 s
z FirewallDConfigIcmpType.__init__c C s d S )Nr )r r r r �__del__E s z FirewallDConfigIcmpType.__del__c C s | j � d S )N)Zremove_from_connection)r r r r �
unregisterI s z"FirewallDConfigIcmpType.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r" r# r ZBooleanr$ r% �
exceptions�
DBusException)r �
property_namer r r �
_get_propertyQ s z%FirewallDConfigIcmpType._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r' r( r* )r �interface_namer) �senderr r r �Getb s
zFirewallDConfigIcmpType.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr" r# r r$ r% Zsv)� signature)r" r# r r$ r% ) r r. r r/ r r r r r' r( r* Z
Dictionary)r r0 r1 �ret�xr r r �GetAlls s
z FirewallDConfigIcmpType.GetAllZssv)r, c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r. r r/ r r � accessCheckr r r r' r( )r r0 r) Z new_valuer1 r r r �Set� s
zFirewallDConfigIcmpType.Setzsa{sv}as)r4 c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r. r r/ r )r r0 Zchanged_propertiesZinvalidated_propertiesr r r �PropertiesChanged� s
z)FirewallDConfigIcmpType.PropertiesChanged)r- c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r r �
Introspectr r Zget_busr r r r )r r1 �data)r r r r; � s
z"FirewallDConfigIcmpType.Introspectc C s t jd| j� | jj| j�S )z"get settings for icmptype
z%s.getSettings())r r/ r r Zget_icmptype_configr )r r1 r r r � getSettings� s z#FirewallDConfigIcmpType.getSettingsc C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� dS )z%update settings for icmptype
z%s.update('...')N) r r r/ r r r8 r Zset_icmptype_configr �Updatedr" )r �settingsr1 r r r �update� s
z FirewallDConfigIcmpType.updatec C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z3load default settings for builtin icmptype
z%s.loadDefaults()N)
r r/ r r r8 r Zload_icmptype_defaultsr r> r" )r r1 r r r � loadDefaults� s z$FirewallDConfigIcmpType.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r/ r )r r" r r r r> � s z FirewallDConfigIcmpType.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove icmptype
z%s.removeIcmpType()N) r r/ r r r8 r Zremove_icmptyper ZremoveIcmpType)r r1 r r r �remove� s z FirewallDConfigIcmpType.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r/ r )r r" r r r �Removed� s z FirewallDConfigIcmpType.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename icmptype
z%s.rename('%s')N) r r. r r/ r r r8 r Zrename_icmptyper �Renamed)r r" r1 r r r �rename� s
z FirewallDConfigIcmpType.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r/ r )r r" r r r rD � s z FirewallDConfigIcmpType.Renamedc C s t jd| j� | j� d S )Nz%s.getVersion()r )r r/ r r= )r r1 r r r �
getVersion� s z"FirewallDConfigIcmpType.getVersionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setVersion('%s')r )
r r. r r/ r r r8 �listr= r@ )r �versionr1 r? r r r �
setVersion s
z"FirewallDConfigIcmpType.setVersionc C s t jd| j� | j� d S )Nz
%s.getShort()r )r r/ r r= )r r1 r r r �getShort s z FirewallDConfigIcmpType.getShortc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setShort('%s')r )
r r. r r/ r r r8 rG r= r@ )r Zshortr1 r? r r r �setShort s
z FirewallDConfigIcmpType.setShortc C s t jd| j� | j� d S )Nz%s.getDescription()� )r r/ r r= )r r1 r r r �getDescription$ s z&FirewallDConfigIcmpType.getDescriptionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDescription('%s')rL )
r r. r r/ r r r8 rG r= r@ )r � descriptionr1 r? r r r �setDescription+ s
z&FirewallDConfigIcmpType.setDescription�asc C s t jd| j� t| j� d �S )Nz%s.getDestinations()� )r r/ r �sortedr= )r r1 r r r �getDestinations9 s z'FirewallDConfigIcmpType.getDestinationsc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDestinations('[%s]')�,rQ )
r rG r r/ r �joinr r8 r= r@ )r Z destinationsr1 r? r r r �setDestinations@ s
z'FirewallDConfigIcmpType.setDestinationsc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addDestination('%s')rQ )r r. r r/ r r r8 rG r= r
r ZALREADY_ENABLED�appendr@ )r � destinationr1 r? r r r �addDestinationL s
z&FirewallDConfigIcmpType.addDestinationc C s� t |t�}tjd| j|� | jj|� t| j� �}|d rd||d krTt t
j |��q�|d j |� n tt
ddg�t
|g� �|d< | j|� d S )Nz%s.removeDestination('%s')rQ Zipv4Zipv6)r r. r r/ r r r8 rG r= r
r Z NOT_ENABLEDrB �setr@ )r rX r1 r? r r r �removeDestinationZ s
z)FirewallDConfigIcmpType.removeDestination�bc C s8 t |t�}tjd| j|� | j� }|d p6||d kS )Nz%s.queryDestination('%s')rQ )r r. r r/ r r= )r rX r1 r? r r r �queryDestinationm s
z(FirewallDConfigIcmpType.queryDestination)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)4�__name__�
__module__� __qualname__�__doc__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r
r r! r* r ZPROPERTIES_IFACEr2 r7 �slipZpolkitZ require_authr9 �service�signalr: ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr; r r ZDBUS_SIGNATUREr= r@ rA r> rB rC rE rD rF rI rJ rK rM rO rS rV rY r[ r] �
__classcell__r r )r r r 0 s�
r ) Z
gi.repositoryr �sys�modulesr Z dbus.serviceZ slip.dbusrb Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.icmptyper Zfirewall.core.loggerr Zfirewall.server.decoratorsr r
r r Zfirewall.errorsr
rc ZObjectr r r r r �<module> s
server/__pycache__/firewalld.cpython-36.pyc 0000644 00000217455 15035135172 0014701 0 ustar 00 3
��gb� � @ sV d gZ ddlmZmZ ddlZeejd< ddlZddlZddlZddl Z
ddl Z
ddl m
Z
ddlmZ ddlmZ ddlmZ dd lmZ dd
lmZmZmZmZ dd lm Z dd l m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ dd
l%m&Z& ddl'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z.m/Z/m0Z0 ddl1m2Z2 ddl m3Z3 ddl4m5Z5 G dd � d e
jj6j7�Z8dS )� FirewallD� )�GLib�GObjectNZgobject)�config)�Firewall)� Rich_Rule)�log)�FirewallClientZoneSettings)�dbus_handle_exceptions�dbus_service_method�handle_exceptions�FirewallDBusException)�FirewallDConfig)�dbus_to_python�command_of_sender�context_of_sender�
uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)� check_config)�IPSet)�IcmpType)�Helper)�nm_get_bus_name� nm_get_connection_of_interface�nm_set_zone_of_connection)�ifcfg_set_zone_of_interface)�errors)�
FirewallErrorc s�" e Zd ZdZdZejjZe � fdd��Z
dd� Z e dd� �Z e d d
� �Z
ed d � �Zed
d� �Zedd� �Zedd� �Zedd� �Zeejddd�e�d�dd���Zeejdd d�e�d�d d ���Zejjjejj�eejd d �e�d�d!d"����Zej j ejd#d$�d%d&� �Z ejjjejj �eej dd'�e�d�� fd(d)� ���Z!ejjjejj�eejj"d*d*d�e�d�d+d,����Z#ejjjejj�eejj"d*d*d�e�d�d-d.����Z$ej j ejj"�ed/d0� ��Z%ejjjejj�eejj"d*d*d�e�d�d1d2����Z&ejjjejj�eejj"d*d*d�e�d�d3d4����Z'ejjjejj(�eejj)d*d*d�e�d�d5d6����Z*ejjjejj(�eejj)d*d*d�e�d�d7d8����Z+ejjjejj,�eejj)d*d9d�e�d�d:d;����Z-ej j ejj)d*d$�ed<d=� ��Z.ej j ejj)d*d$�ed>d?� ��Z/ejjjejj(�eejj)dd*d�e�d�d@dA����Z0ejjjejj(�eejj)dd*d�e�d�dBdC����Z1ejjjejj,�eejj)dd9d�e�d�dDdE����Z2ejjjejj,�eejj)d*dFd�e�d�dGdH����Z3ej j ejj)dd$�edIdJ� ��Z4ej j ejj)dd$�edKdL� ��Z5ejjjejj(�eejj)dMd*d�e�d�dNdO����Z6ejjjejj(�eejj)dMd*d�e�d�dPdQ����Z7ejjjejj,�eejj)dMd9d�e�d�dRdS����Z8ejjjejj,�eejj)d*dTd�e�d�dUdV����Z9ej j ejj)dMd$�edWdX� ��Z:ej j ejj)dMd$�edYdZ� ��Z;ejjjejj(�eejj)dd*d�e�d�d[d\����Z<ejjjejj(�eejj)dd*d�e�d�d]d^����Z=ejjjejj,�eejj)dd9d�e�d�d_d`����Z>ejjjejj,�eejj)d*dFd�e�d�dadb����Z?ej j ejj)dd$�edcdd� ��Z@ej j ejj)dd$�ededf� ��ZAejjjejj(�eejj)dd*d�e�d�dgdh����ZBejjjejj(�eejj)dd*d�e�d�didj����ZCejjjejj,�eejj)dd9d�e�d�dkdl����ZDejjjejj,�eejj)d*dFd�e�d�dmdn����ZEej j ejj)dd$�edodp� ��ZFej j ejj)dd$�edqdr� ��ZGejjjejj�eejj"d*d*d�e�d�dsdt����ZHejjjejj�eejj"d*d*d�e�d�dudv����ZIejjjejj �eejj"d*d9d�e�d�dwdx����ZJej j ejj"d*d$�edydz� ��ZKej j ejj"d*d$�ed{d|� ��ZLejjjejjM�eejj"dd}d�e�d�d~d����ZNejjjejjM�eejjOdd d�e�d�d�d�����ZPejjjejjM�eejjOd�d �e�d�d�d�����ZQej j ejjOd�d$�ed�d�� ��ZRejjjejjM�eejjSdd d�e�d�d�d�����ZTejjjejjM�eejjSd�d �e�d�d�d�����ZUej j ejjSd�d$�ed�d�� ��ZVejjjejj �eejj"d*dFd�e�d�d�d�����ZWejjjejjM�eejj"dd�d�e�d�d�d�����ZXejjjejjM�eejj"dd d�e�d�d�d�����ZYejjjejj �eejj"d*dFd�e�d�d�d�����ZZejjjejjM�eejj"de[j\d�e�d�d�d�����Z]ejjjejjM�eejj"d*dd�e�d�d�d�����Z^ejjjejj�eejj"dd*d�e�d�d�d�����Z_ej j ejj"dd$�ed�d�� ��Z`ejjjejjM�eejj"d*dd�e�d�d�d�����Zaejjjejj�eejj"dd*d�e�d�d�d�����Zbej j ejj"dd$�ed�d�� ��Zcejjjejj �eejj"d*dd�e�d�d�d�����Zdejjjejj�eejj"dd*d�e�d�d�d�����Zeej j ejj"dd$�ed�d�� ��Zfejjjejj �eejjSd*dFd�e�d�d�d�����Zgejjjejj �eejjSd*d�d�e�d�d�d�����Zhejjjejj �eejjOd*dFd�e�d�d�d�����Ziejjjejj �eejjOd*d�d�e�d�d�d�����Zjejjjejj �eejjOddd�e�d�d�d�����Zkejjjejj �eejjOddd�e�d�d�d�����ZlejjjejjM�eejjOdd9d�e�d�d�d�����Zmejjjejj�eejjOddd�e�d�d�d�����Znejjjejj�eejjOddd�e�d�d�d�����Zoejjjejj�eejjOddd�e�d�d�d�����Zpejjjejj�eejjOddd�e�d�d�d�����ZqejjjejjM�eejjOdd9d�e�d�d�d���ZrejjjejjM�eejjOddFd�e�d�d�dĄ���Zsej j ejjOdd$�ed�dƄ ��Ztej j ejjOdd$�ed�dȄ ��Zuej j ejjOdd$�ed�dʄ ��Zvej j ejjOdd$�ed�d̄ ��Zwejjjejj�eejjOddd�e�d�d�d΄���Zxejjjejj�eejjOddd�e�d�d�dЄ���Zyejjjejj�eejjOddd�e�d�d�d҄���ZzejjjejjM�eejjOdd9d�e�d�d�dԄ���Z{ejjjejjM�eejjOddFd�e�d�d�dք���Z|ej j ejjOdd$�ed�d ��Z}ej j ejjOdd$�ed�dڄ ��Z~ej j ejjOdd$�ed�d܄ ��Zed�dބ �Z�ejjjejj�eejjOd�dd�e�d�d�d����Z�ejjjejj�eejjOddd�e�d�d�d����Z�ejjjejjM�eejjOdd9d�e�d�d�d����Z�ejjjejjM�eejjOddFd�e�d�d�d����Z�ej j ejjOd�d$�ed�d� ��Z�ej j ejjOdd$�ed�d� ��Z�ed�d� �Z�ejjjejj�eejjOd�dd�e�d�d�d����Z�ejjjejj�eejjOddd�e�d�d�d����Z�ejjjejjM�eejjOdd9d�e�d�d�d����Z�ejjjejjM�eejjOddFd�e�d�d�d�����Z�ej j ejjOd�d$�ed�d�� ��Z�ej j ejjOdd$�ed�d�� ��Z�ed�d�� �Z�ejjjejj�eejjOd�dd�e�d�d�d�����Z�ejjjejj�eejjOd�dd�e�d��d �d����Z�ejjjejjM�eejjOd�d9d�e�d��d�d����Z�ejjjejjM�eejjOd�dd�e�d��d�d����Z�ej j ejjOd�d$�e�d��d�d ���Z�ej j ejjOd�d$�e�d
�d � ��Z�e�d �d
� �Z�ejjjejj�eejjOd�dd�e�d��d�d����Z�ejjjejj�eejjOddd�e�d��d�d����Z�ejjjejjM�eejjOdd9d�e�d��d�d����Z�ejjjejjM�eejjOddFd�e�d��d�d����Z�ej j ejjOd�d$�e�d��d�d���Z�ej j ejjOdd$�e�d�d� ��Z�e�d�d� �Z�ejjjejj�eejjOd�dd�e�d��d �d ����Z�ejjjejj�eejjOd�dd�e�d �d �d ����Z�ejjjejjM�eejjOd�d9d�e�d�d �d!����Z�ejjjejjM�eejjOd�dd�e�d�d"�d#����Z�ej j ejjOd�d$�e�d�d$�d%���Z�ej j ejjOd�d$�e�d&�d'� ��Z�e�d(�d)� �Z�ejjjejj�eejjO�d*dd�e�d�d+�d,����Z�ejjjejj�eejjOddd�e�d�d-�d.����Z�ejjjejjM�eejjOdd9d�e�d�d/�d0����Z�ej j ejjO�d*d$�e�d�d1�d2���Z�ej j ejjOdd$�e�d3�d4� ��Z�e�d5�d6� �Z�ejjjejj�eejjO�d7dd�e�d�d8�d9����Z�ejjjejj�eejjO�d:dd�e�d �d;�d<����Z�ejjjejjM�eejjO�d:d9d�e�d
�d=�d>����Z�ejjjejjM�eejjOd�dd�e�d �d?�d@����Z�ej j ejjO�d7d$�e�d �dA�dB���Z�ej j ejjO�d:d$�e�dC�dD� ��Z�e�dE�dF� �Z�ejjjejj�eejjOd�dd�e�d
�dG�dH����Z�ejjjejj�eejjOddd�e�d�dI�dJ����Z�ejjjejjM�eejjOdd9d�e�d�dK�dL����Z�ejjjejjM�eejjOddFd�e�d�dM�dN����Z�ej j ejjOd�d$�e�d�dO�dP���Z�ej j ejjOdd$�e�dQ�dR� ��Z�ejjjejj�eejjOddd�e�d�dS�dT����Z�ejjjejj�eejjOddd�e�d�dU�dV����Z�ejjjejjM�eejjOdd9d�e�d�dW�dX����Z�ej j ejjOdd$�e�dY�dZ� ��Z�ej j ejjOdd$�e�d[�d\� ��Z�ejjjejj��eejj�d�d*d�e�d�d]�d^����Z�ejjjejj��eejj�d�d*d�e�d�d_�d`����Z�ejjjejj��eejj�d�d9d�e�d�da�db����Z�ejjjejj��eejj�ddFd�e�d�dc�dd����Z�ejjjejj��eejj�d*�ded�e�d�df�dg����Z�ej j ejj�d�d$�e�dh�di� ��Z�ej j ejj�d�d$�e�dj�dk� ��Z�ejjjejj��eejj��dld*d�e�d�dm�dn����Z�ejjjejj��eejj��dld*d�e�d�do�dp����Z�ejjjejj��eejj�d�d*d�e�d �dq�dr����Z�ejjjejj��eejj��dld9d�e�d �ds�dt����Z�ejjjejj��eejj�d��dud�e�d �dv�dw����Z�ejjjejj��eejj�d*�dxd�e�d �dy�dz����Z�ej j ejj��dld$�e�d{�d|� ��Z�ej j ejj��dld$�e�d}�d~� ��Z�ejjjejj��eejj��ddd�e�d �d��d�����Z�ejjjejj��eejj��dd*d�e�d!�d��d�����Z�ejjjejj��eejj��dd*d�e�d"�d��d�����Z�ejjjejj��eejj��dd9d�e�d#�d��d�����Z�ejjjejj��eejj�d*�d�d�e�d$�d��d�����Z�ejjjejj��eejj�d*d*d�e�d%�d��d�����Z�ejjjejj��eejj�d�dd�e�d&�d��d�����Z�ej j ejj��dd$�e�d��d�� ��Z�ej j ejj��dd$�e�d��d�� ��Z�ejjjejj׃eejj"d*d*d�e�d'�d��d�����Z�ejjjejj �eejj�dd9d�e�d(�d��d�����Z�ejjjejj �eejj�d*dFd�e�d)�d��d�����Z�ejjjejjM�eejj�de�j\d�e�d*�d��d�����Z�ejjjejj�eejj�dd*d�e�d+�d��d�����Z�ejjjejj�eejj�dd*d�e�d,�d��d�����Z�ejjjejj �eejj�dd9d�e�d-�d��d�����Z�ejjjejj �eejj�ddFd�e�d.�d��d�����Z�ejjjejj�eejjِdd �e�d/�d��d�����Z�ej j ejj�dd$�e�d��d�� ��Z�ej j ejj�dd$�e�d��d�� ��Z�ejjjejj �eejj"d*dFd�e�d0�d��d�����Z�ejjjejjM�eejj"de�j\d�e�d1�d��d�����Z� Z�S (2 r zFirewallD main classTc s` t t| �j||� t� | _|d | _|d | _| j� t| t j
j � t | jj | jt j
j
�| _ d S )Nr � )�superr �__init__r �fw�busname�path�startr r �dbus�DBUS_INTERFACEr ZDBUS_PATH_CONFIG)�self�args�kwargs)� __class__� � /usr/lib/python3.6/firewalld.pyr" I s
zFirewallD.__init__c C s | j � d S )N)�stop)r) r- r- r. �__del__T s zFirewallD.__del__c C s t jd� i | _| jj� S )Nzstart())r �debug1� _timeoutsr# r& )r) r- r- r. r& W s
zFirewallD.startc C s t jd� | jj� S )Nzstop())r r1 r# r/ )r) r- r- r. r/ _ s
zFirewallD.stopc C s� | j jj� r�|d kr"tjd� d S tj� }t||�}| j jjd|�rHd S t ||�}| j jjd|�rfd S t
|�}| j jjd|�r�d S t ||�}| j jjd|�r�d S t t
jd��d S )Nz&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r# �policies�query_lockdownr �errorr' Z SystemBusr Z access_checkr r r r r Z
ACCESS_DENIED)r) �senderZbusr3 r4 r5 r6 r- r- r. � accessCheckh s$
zFirewallD.accessCheckc C s& || j kri | j |< || j | |< d S )N)r2 )r) �zone�x�tagr- r- r. �
addTimeout s
zFirewallD.addTimeoutc C s< || j kr8|| j | kr8tj| j | | � | j | |= d S )N)r2 r �
source_remove)r) r< r= r- r- r. �
removeTimeout� s zFirewallD.removeTimeoutc C sT xD| j D ]:}x&| j | D ]}tj| j | | � qW | j | j� qW | j j� d S )N)r2 r r@ �clear)r) r< r= r- r- r. �cleanup_timeouts� s
zFirewallD.cleanup_timeoutsc C sd |dkrt jtj�S |dkr6t jdtj jtj jf �S |dkrNt j| jj� �S |dkrht j| jj d��S |dkr�t j
| jj d�S |d kr�t j| jj d
��S |d kr�t j| jj �S |d kr�t j
| jj
d�S |d
kr�t j| jj�S |dk� r�t j| jj�S |dk�rt j
| jjd�S |dk�r$t jd�S |dk�r:t ji d�S |dk�rPt ji d�S t jjd| ��d S )N�version�interface_versionz%d.%d�state�IPv4�ipv4�
IPv4ICMPTypes�s�IPv6�ipv6�
IPv6_rpfilter�
IPv6ICMPTypes�BRIDGEr �
IPSetTypes�nf_conntrack_helper_settingF�nf_conntrack_helpers�sas�nf_nat_helperszDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist)r' �Stringr �VERSIONZDBUS_INTERFACE_VERSIONZDBUS_INTERFACE_REVISIONr# Z get_stateZBooleanZis_ipv_enabledZArrayZipv4_supported_icmp_typesZipv6_rpfilter_enabledZipv6_supported_icmp_typesZebtables_enabledZ
ipset_enabledZipset_supported_types�
Dictionary�
exceptions�
DBusException)r) Zpropr- r- r. �
_get_property� s@
zFirewallD._get_propertyZss�v)� in_signature�
out_signatureNc C s~ t |t�}t |t�}tjd||� |tjjkr8| j|�S |tjjtjj tjj
tjj gkrjtj j
d| ��ntj j
d| ��d S )NzGet('%s', '%s')zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)r �strr r1 r r' r( rZ �DBUS_INTERFACE_ZONE�DBUS_INTERFACE_DIRECT�DBUS_INTERFACE_POLICIES�DBUS_INTERFACE_IPSETrX rY )r) �interface_name�
property_namer: r- r- r. �Get� s
z
FirewallD.GetrJ za{sv}c C s� t |t�}tjd|� i }|tjjkrDxNdD ]}| j|�||< q,W n2|tjjtjj tjj
tjj gkrfntj j
d| ��tj|dd�S )Nz GetAll('%s')rD rE rF rG rK rM rO r rP rQ rR rT rI rN zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existZsv)� signature)rD rE rF rG rK rM rO r rP rQ rR rT rI rN )r r^ r r1 r r' r( rZ r_ r` ra rb rX rY rW )r) rc r: �retr= r- r- r. �GetAll� s&
zFirewallD.GetAllZssv)r\ c C s� t |t�}t |t�}t |�}tjd|||� | j|� |tjjkrn|dkr\tjj d| ��q�tjj d| ��nB|tjj
tjj tjj tjj
gkr�tjj d| ��ntjj d| ��d S )NzSet('%s', '%s', '%s')rD rE rF rG rK rM rO r rP rQ rR rT rI rN zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-onlyzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)rD rE rF rG rK rM rO r rP rQ rR rT rI rN )r r^ r r1 r; r r' r( rX rY r_ r` ra rb )r) rc rd Z new_valuer: r- r- r. �Set� s:
z
FirewallD.Setzsa{sv}as)rf c C s. t |t�}t |�}t |�}tjd|||� d S )Nz#PropertiesChanged('%s', '%s', '%s'))r r^ r r1 )r) rc Zchanged_propertiesZinvalidated_propertiesr- r- r. �PropertiesChanged s
zFirewallD.PropertiesChanged)r] c s4 t jd� tt| �j| j| jj� �}t| |t j
j �S )Nz Introspect()) r Zdebug2r! r �
Introspectr% r$ Zget_busr r r' r( )r) r: �data)r, r- r. rk & s
zFirewallD.Introspect� c C s* t jd� | jj� | jj� | j� dS )z#Reload the firewall rules.
zreload()N)r r1 r# �reloadr �Reloaded)r) r: r- r- r. rn 4 s
zFirewallD.reloadc C s, t jd� | jjd� | jj� | j� dS )z�Completely reload the firewall.
Completely reload the firewall: Stops firewall, unloads modules and
starts the firewall again.
zcompleteReload()TN)r r1 r# rn r ro )r) r: r- r- r. �completeReloadC s
zFirewallD.completeReloadc C s t jd� d S )Nz
Reloaded())r r1 )r) r- r- r. ro S s zFirewallD.Reloadedc C s t jd� t| j� dS )z&Check permanent configuration
zcheckPermanentConfig()N)r r1 r r# )r) r: r- r- r. �checkPermanentConfigX s
z FirewallD.checkPermanentConfigc
C s� t jd� d}| jj� }x�| jjj� D ]�}| j|�}yj||kr�| jj|�}|j � |krpt jd| � |j
|� q�t jd| � n t jd| � | jj ||� W q& t k
r� } z t j
d||f � d}W Y dd}~X q&X q&W | jj� }x�| jjj� D ]�}| j|�}yn||k�rR| jj|�}|j � |k�rBt jd | � |j
|� nt jd
| � n t jd | � | jj||� W q� t k
�r� } z t j
d ||f � d}W Y dd}~X q�X q�W | jj� }x�| jjj� D ]�}yx| j|�}||k�r&| jj|�}|j � |k�rt jd
| � |j
|� nt jd| � n t jd| � | jj||� W n: t k
�r~ } z t j
d||f � d}W Y dd}~X nX �q�W | jj� }t� }�x�| jj j � D �]�}| j |�}t |�} |dk �r~d}
xH| j � D ]<} | jj j!|| �|k�r�t jd|| f � | j"| � d}
�q�W xV| j � D ]J} y,t#| �} | �rNt$|| ��rN| j"| � d}
W n t k
�rf Y nX �q W |
�r~~| j%� }x | j � D ]} t&|| � �q�W yP||k�r�| jj'|�}t jd| � |j(|� n t jd| � | jj)||� W n: t k
�r& } z t j
d||f � d}W Y dd}~X nX �q�W | jj*� }x�| jj+j,� D ]�}| j-|�}yB||k�rx| jj.|�}|j
|� n t jd| � | jj/||� W n: t k
�r� } z t j
d||f � d}W Y dd}~X nX �qFW | jj0� }x�| jj1j2� D ]�}| j3|�}yn||k�rN| jj4|�}|j � |k�r>t jd| � |j
|� nt jd| � n t jd| � | jj5||� W n: t k
�r� } z t j
d||f � d}W Y dd}~X nX �q�W | jj6j7� | jj6j8� | jj6j9� f}y6| jj � |k�r�t jd� | jj
|� n
t jd � W n6 t k
�r< } zt j
d | � d}W Y dd}~X nX | jj:j;j<� }y6| jj � |k�rvt jd � | jj=|� n
t jd � W n6 t k
�r� } zt j
d | � d}W Y dd}~X nX |�r�t>t?j@��dS )!z-Make runtime configuration permanent
zcopyRuntimeToPermanent()Fz Copying service '%s' settingsz$Service '%s' is identical, ignoring.zCreating service '%s'z/Runtime To Permanent failed on service '%s': %sTNz Copying icmptype '%s' settingsz%IcmpType '%s' is identical, ignoring.zCreating icmptype '%s'z0Runtime To Permanent failed on icmptype '%s': %szCopying ipset '%s' settingsz"IPSet '%s' is identical, ignoring.zCreating ipset '%s'z-Runtime To Permanent failed on ipset '%s': %szEZone '%s': interface binding for '%s' has been added by NM, ignoring.zCopying zone '%s' settingszCreating zone '%s'z,Runtime To Permanent failed on zone '%s': %szCreating policy '%s'z.Runtime To Permanent failed on policy '%s': %sz Copying helper '%s' settingsz#Helper '%s' is identical, ignoring.zCreating helper '%s'z.Runtime To Permanent failed on helper '%s': %sz Copying direct configurationz,Direct configuration is identical, ignoring.z7Runtime To Permanent failed on direct configuration: %sz Copying policies configurationz.Policies configuration is identical, ignoring.z9Runtime To Permanent failed on policies configuration: %s)Ar r1 r ZgetServiceNamesr# �service� get_services�getServiceSettingsZgetServiceByNameZ getSettings�update�
addService� Exception�warningZgetIcmpTypeNames�icmptype�
get_icmptypes�getIcmpTypeSettingsZgetIcmpTypeByNameZ addIcmpTypeZ
getIPSetNames�ipset�
get_ipsets�getIPSetSettingsZgetIPSetByNameZaddIPSetZ getZoneNamesr r< � get_zones�getZoneSettings2r �
getInterfacesZinterface_get_sender�removeInterfacer r ZgetSettingsDictr Z
getZoneByNameZupdate2ZaddZone2ZgetPolicyNames�policy�"get_policies_not_derived_from_zone�getPolicySettingsZgetPolicyByNameZ addPolicyZgetHelperNames�helper� get_helpers�getHelperSettingsZgetHelperByNameZ addHelper�direct�get_all_chains�
get_all_rules�get_all_passthroughsr7 �lockdown_whitelist�
export_configZsetLockdownWhitelistr r ZRT_TO_PERM_FAILED)
r) r: r9 Z config_names�nameZconfZconf_obj�eZ nm_bus_name�settingsZchanged� interfaceZ
connectionr- r- r. �runtimeToPermanentd s$
z FirewallD.runtimeToPermanentc C s, t jd� | j|� | jjj� | j� dS )z!Enable lockdown policies
zpolicies.enableLockdown()N)r r1 r; r# r7 Zenable_lockdown�LockdownEnabled)r) r: r- r- r. �enableLockdown2 s
zFirewallD.enableLockdownc C s, t jd� | j|� | jjj� | j� dS )z"Disable lockdown policies
zpolicies.disableLockdown()N)r r1 r; r# r7 Zdisable_lockdown�LockdownDisabled)r) r: r- r- r. �disableLockdown> s
zFirewallD.disableLockdown�bc C s t jd� | jjj� S )z+Retuns True if lockdown is enabled
zpolicies.queryLockdown())r r1 r# r7 r8 )r) r: r- r- r. �
queryLockdownJ s
zFirewallD.queryLockdownc C s t jd� d S )NzLockdownEnabled())r r1 )r) r- r- r. r� U s zFirewallD.LockdownEnabledc C s t jd� d S )NzLockdownDisabled())r r1 )r) r- r- r. r� Z s zFirewallD.LockdownDisabledc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Add lockdown command
z*policies.addLockdownWhitelistCommand('%s')N)
r r^ r r1 r; r# r7 r� Z add_command� LockdownWhitelistCommandAdded)r) r6 r: r- r- r. �addLockdownWhitelistCommandc s
z%FirewallD.addLockdownWhitelistCommandc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Remove lockdown command
z-policies.removeLockdownWhitelistCommand('%s')N)
r r^ r r1 r; r# r7 r� Zremove_command� LockdownWhitelistCommandRemoved)r) r6 r: r- r- r. � removeLockdownWhitelistCommandp s
z(FirewallD.removeLockdownWhitelistCommandc C s( t |t�}tjd| � | jjjj|�S )z Query lockdown command
z,policies.queryLockdownWhitelistCommand('%s'))r r^ r r1 r# r7 r� Z has_command)r) r6 r: r- r- r. � queryLockdownWhitelistCommand} s
z'FirewallD.queryLockdownWhitelistCommand�asc C s t jd� | jjjj� S )z Add lockdown command
z'policies.getLockdownWhitelistCommands())r r1 r# r7 r� Z get_commands)r) r: r- r- r. � getLockdownWhitelistCommands� s
z&FirewallD.getLockdownWhitelistCommandsc C s t jd| � d S )Nz#LockdownWhitelistCommandAdded('%s'))r r1 )r) r6 r- r- r. r� � s z'FirewallD.LockdownWhitelistCommandAddedc C s t jd| � d S )Nz%LockdownWhitelistCommandRemoved('%s'))r r1 )r) r6 r- r- r. r� � s z)FirewallD.LockdownWhitelistCommandRemoved�ic C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )zAdd lockdown uid
z&policies.addLockdownWhitelistUid('%s')N)
r �intr r1 r; r# r7 r� Zadd_uid�LockdownWhitelistUidAdded)r) r4 r: r- r- r. �addLockdownWhitelistUid� s
z!FirewallD.addLockdownWhitelistUidc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Remove lockdown uid
z)policies.removeLockdownWhitelistUid('%s')N)
r r� r r1 r; r# r7 r� Z
remove_uid�LockdownWhitelistUidRemoved)r) r4 r: r- r- r. �removeLockdownWhitelistUid� s
z$FirewallD.removeLockdownWhitelistUidc C s( t |t�}tjd| � | jjjj|�S )zQuery lockdown uid
z(policies.queryLockdownWhitelistUid('%s'))r r� r r1 r# r7 r� Zhas_uid)r) r4 r: r- r- r. �queryLockdownWhitelistUid� s
z#FirewallD.queryLockdownWhitelistUidZaic C s t jd� | jjjj� S )zAdd lockdown uid
z#policies.getLockdownWhitelistUids())r r1 r# r7 r� Zget_uids)r) r: r- r- r. �getLockdownWhitelistUids� s
z"FirewallD.getLockdownWhitelistUidsc C s t jd| � d S )Nz LockdownWhitelistUidAdded(%d))r r1 )r) r4 r- r- r. r� � s z#FirewallD.LockdownWhitelistUidAddedc C s t jd| � d S )Nz LockdownWhitelistUidRemoved(%d))r r1 )r) r4 r- r- r. r� � s z%FirewallD.LockdownWhitelistUidRemovedc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )zAdd lockdown user
z'policies.addLockdownWhitelistUser('%s')N)
r r^ r r1 r; r# r7 r� Zadd_user�LockdownWhitelistUserAdded)r) r5 r: r- r- r. �addLockdownWhitelistUser� s
z"FirewallD.addLockdownWhitelistUserc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Remove lockdown user
z*policies.removeLockdownWhitelistUser('%s')N)
r r^ r r1 r; r# r7 r� Z remove_user� LockdownWhitelistUserRemoved)r) r5 r: r- r- r. �removeLockdownWhitelistUser� s
z%FirewallD.removeLockdownWhitelistUserc C s( t |t�}tjd| � | jjjj|�S )z Query lockdown user
z)policies.queryLockdownWhitelistUser('%s'))r r^ r r1 r# r7 r� Zhas_user)r) r5 r: r- r- r. �queryLockdownWhitelistUser� s
z$FirewallD.queryLockdownWhitelistUserc C s t jd� | jjjj� S )zAdd lockdown user
z$policies.getLockdownWhitelistUsers())r r1 r# r7 r� Z get_users)r) r: r- r- r. �getLockdownWhitelistUsers s
z#FirewallD.getLockdownWhitelistUsersc C s t jd| � d S )Nz LockdownWhitelistUserAdded('%s'))r r1 )r) r5 r- r- r. r� s z$FirewallD.LockdownWhitelistUserAddedc C s t jd| � d S )Nz"LockdownWhitelistUserRemoved('%s'))r r1 )r) r5 r- r- r. r� s z&FirewallD.LockdownWhitelistUserRemovedc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Add lockdown context
z*policies.addLockdownWhitelistContext('%s')N)
r r^ r r1 r; r# r7 r� Z add_context� LockdownWhitelistContextAdded)r) r3 r: r- r- r. �addLockdownWhitelistContext s
z%FirewallD.addLockdownWhitelistContextc C s@ t |t�}tjd| � | j|� | jjjj|� | j |� dS )z Remove lockdown context
z-policies.removeLockdownWhitelistContext('%s')N)
r r^ r r1 r; r# r7 r� Zremove_context� LockdownWhitelistContextRemoved)r) r3 r: r- r- r. � removeLockdownWhitelistContext' s
z(FirewallD.removeLockdownWhitelistContextc C s( t |t�}tjd| � | jjjj|�S )z Query lockdown context
z,policies.queryLockdownWhitelistContext('%s'))r r^ r r1 r# r7 r� Z has_context)r) r3 r: r- r- r. � queryLockdownWhitelistContext4 s
z'FirewallD.queryLockdownWhitelistContextc C s t jd� | jjjj� S )z Add lockdown context
z'policies.getLockdownWhitelistContexts())r r1 r# r7 r� Z get_contexts)r) r: r- r- r. � getLockdownWhitelistContexts@ s
z&FirewallD.getLockdownWhitelistContextsc C s t jd| � d S )Nz#LockdownWhitelistContextAdded('%s'))r r1 )r) r3 r- r- r. r� K s z'FirewallD.LockdownWhitelistContextAddedc C s t jd| � d S )Nz%LockdownWhitelistContextRemoved('%s'))r r1 )r) r3 r- r- r. r� P s z)FirewallD.LockdownWhitelistContextRemovedc C s* t jd� | j|� | jj� | j� dS )znEnable panic mode.
All ingoing and outgoing connections and packets will be blocked.
zenablePanicMode()N)r r1 r; r# Zenable_panic_mode�PanicModeEnabled)r) r: r- r- r. �enablePanicModeY s
zFirewallD.enablePanicModec C s* t jd� | j|� | jj� | j� dS )z�Disable panic mode.
Enables normal mode: Allowed ingoing and outgoing connections
will not be blocked anymore
zdisablePanicMode()N)r r1 r; r# Zdisable_panic_mode�PanicModeDisabled)r) r: r- r- r. �disablePanicModeg s
zFirewallD.disablePanicModec C s t jd� | jj� S )NzqueryPanicMode())r r1 r# Zquery_panic_mode)r) r: r- r- r. �queryPanicModev s
zFirewallD.queryPanicModec C s t jd� d S )NzPanicModeEnabled())r r1 )r) r- r- r. r� s zFirewallD.PanicModeEnabledc C s t jd� d S )NzPanicModeDisabled())r r1 )r) r- r- r. r� � s zFirewallD.PanicModeDisabledz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C s$ t |t�}tjd|� | jjj|�S )NzgetZoneSettings(%s))r r^ r r1 r# r< Zget_config_with_settings)r) r< r: r- r- r. �getZoneSettings� s
zFirewallD.getZoneSettingsc C s$ t |t�}tjd|� | jjj|�S )NzgetZoneSettings2(%s))r r^ r r1 r# r< � get_config_with_settings_dict)r) r< r: r- r- r. r� � s
zFirewallD.getZoneSettings2zsa{sv}c C sB t |t�}tjd|� | j|� | jjj|||� | j||� d S )NzsetZoneSettings2(%s)) r r^ r r1 r; r# r< � set_config_with_settings_dict� ZoneUpdated)r) r< r� r: r- r- r. �setZoneSettings2� s
zFirewallD.setZoneSettings2c C s t jd||f � d S )Nz zone.ZoneUpdated('%s', '%s'))r r1 )r) r< r� r- r- r. r� � s zFirewallD.ZoneUpdatedc C s$ t |t�}tjd|� | jjj|�S )Nz policy.getPolicySettings(%s))r r^ r r1 r# r� r� )r) r� r: r- r- r. r� � s
zFirewallD.getPolicySettingsc C sB t |t�}tjd|� | j|� | jjj|||� | j||� d S )Nz policy.setPolicySettings(%s)) r r^ r r1 r; r# r� r� �
PolicyUpdated)r) r� r� r: r- r- r. �setPolicySettings� s
zFirewallD.setPolicySettingsc C s t jd||f � d S )Nz policy.PolicyUpdated('%s', '%s'))r r1 )r) r� r� r- r- r. r� � s zFirewallD.PolicyUpdatedc C s t jd� | jjj� S )NzlistServices())r r1 r# rr rs )r) r: r- r- r. � listServices� s
zFirewallD.listServicesz(sssa(ss)asa{ss}asa(ss))c C s� t |t�}tjd|� | jjj|�}|j� }g }x\td�D ]P}|j | d |krr|j
t j t
||j | d ��� q:|j
||j | d � q:W t|�S )NzgetServiceSettings(%s)� r )r r^ r r1 r# rr � get_service�export_config_dict�rangeZIMPORT_EXPORT_STRUCTURE�append�copy�deepcopy�getattr�tuple)r) rr r: �objZ conf_dictZ conf_listr� r- r- r. rt � s
" z FirewallD.getServiceSettingsc C s, t |t�}tjd|� | jjj|�}|j� S )NzgetServiceSettings2(%s))r r^ r r1 r# rr r� r� )r) rr r: r� r- r- r. �getServiceSettings2� s
z FirewallD.getServiceSettings2c C s t jd� | jjj� S )NzlistIcmpTypes())r r1 r# ry rz )r) r: r- r- r. �
listIcmpTypes� s
zFirewallD.listIcmpTypesc C s( t |t�}tjd|� | jjj|�j� S )NzgetIcmpTypeSettings(%s))r r^ r r1 r# ry Z get_icmptyper� )r) ry r: r- r- r. r{ � s
z FirewallD.getIcmpTypeSettingsc C s t jd� | jj� S )NzgetLogDenied())r r1 r# Zget_log_denied)r) r: r- r- r. � getLogDenied s
zFirewallD.getLogDeniedc C sX t |t�}tjd| � | j|� | jj|� | j|� | jj� | j j� | j
� d S )NzsetLogDenied('%s')) r r^ r r1 r; r# Zset_log_denied�LogDeniedChangedrn r ro )r) �valuer: r- r- r. � setLogDenied s
zFirewallD.setLogDeniedc C s t jd| � d S )NzLogDeniedChanged('%s'))r r1 )r) r� r- r- r. r� " s zFirewallD.LogDeniedChangedc C s t jd� dS )NzgetAutomaticHelpers()�no)r r1 )r) r: r- r- r. �getAutomaticHelpers+ s
z FirewallD.getAutomaticHelpersc C s& t |t�}tjd| � | j|� d S )NzsetAutomaticHelpers('%s'))r r^ r r1 r; )r) r� r: r- r- r. �setAutomaticHelpers6 s
z FirewallD.setAutomaticHelpersc C s t jd| � d S )Nz AutomaticHelpersChanged('%s'))r r1 )r) r� r- r- r. �AutomaticHelpersChangedB s z!FirewallD.AutomaticHelpersChangedc C s t jd� | jj� S )NzgetDefaultZone())r r1 r# Zget_default_zone)r) r: r- r- r. �getDefaultZoneK s
zFirewallD.getDefaultZonec C s< t |t�}tjd| � | j|� | jj|� | j|� d S )NzsetDefaultZone('%s'))r r^ r r1 r; r# Zset_default_zone�DefaultZoneChanged)r) r< r: r- r- r. �setDefaultZoneT s
zFirewallD.setDefaultZonec C s t jd| � d S )NzDefaultZoneChanged('%s'))r r1 )r) r< r- r- r. r� ` s z FirewallD.DefaultZoneChangedc C s t jd� | jjj� S )Nzpolicy.getPolicies())r r1 r# r� r� )r) r: r- r- r. � getPoliciesk s
zFirewallD.getPoliciesz
a{sa{sas}}c C s\ t jd� i }xH| jjj� D ]8}i ||< | jjj|�|| d< | jjj|�|| d< q W |S )Nzpolicy.getActivePolicies()Z
ingress_zonesZ egress_zones)r r1 r# r� Z)get_active_policies_not_derived_from_zoneZlist_ingress_zonesZlist_egress_zones)r) r: r7 r� r- r- r. �getActivePoliciess s
zFirewallD.getActivePoliciesc C s t jd� | jjj� S )Nzzone.getZones())r r1 r# r< r )r) r: r- r- r. �getZones� s
zFirewallD.getZonesc C s� t jd� i }x|| jjj� D ]l}| jjj|�}| jjj|�}t|�t|� dkr i ||< t|�dkrp||| d< t|�dkr ||| d< q W |S )Nzzone.getActiveZones()r �
interfaces�sources)r r1 r# r< r �list_interfaces� list_sources�len)r) r: Zzonesr< r� r� r- r- r. �getActiveZones� s
zFirewallD.getActiveZonesc C s2 t |t�}tjd| � | jjj|�}|r.|S dS )z�Return the zone an interface belongs to.
:Parameters:
`interface` : str
Name of the interface
:Returns: str. The name of the zone.
z zone.getZoneOfInterface('%s')rm )r r^ r r1 r# r< Zget_zone_of_interface)r) r� r: r< r- r- r. �getZoneOfInterface� s
z FirewallD.getZoneOfInterfacec C s2 t |t�}tjd| � | jjj|�}|r.|S dS )Nzzone.getZoneOfSource('%s')rm )r r^ r r1 r# r< Zget_zone_of_source)r) �sourcer: r< r- r- r. �getZoneOfSource� s
zFirewallD.getZoneOfSourcec C s dS )NFr- )r) r< r: r- r- r. � isImmutable� s zFirewallD.isImmutablec C sR t |t�}t |t�}tjd||f � | j|� | jjj|||�}| j||� |S )zPAdd an interface to a zone.
If zone is empty, use default zone.
z zone.addInterface('%s', '%s')) r r^ r r1 r; r# r< Z
add_interface�InterfaceAdded)r) r< r� r: �_zoner- r- r. � addInterface� s
zFirewallD.addInterfacec C s" t |t�}t |t�}| j|||�S )z�Change a zone an interface is part of.
If zone is empty, use default zone.
This function is deprecated, use changeZoneOfInterface instead
)r r^ �changeZoneOfInterface)r) r< r� r: r- r- r. �
changeZone� s
zFirewallD.changeZonec C sR t |t�}t |t�}tjd||f � | j|� | jjj|||�}| j||� |S )z[Change a zone an interface is part of.
If zone is empty, use default zone.
z&zone.changeZoneOfInterface('%s', '%s')) r r^ r r1 r; r# r< Zchange_zone_of_interface�ZoneOfInterfaceChanged)r) r< r� r: r� r- r- r. r� � s
z FirewallD.changeZoneOfInterfacec C sP t |t�}t |t�}tjd||f � | j|� | jjj||�}| j||� |S )zkRemove interface from a zone.
If zone is empty, remove from zone the interface belongs to.
z zone.removeInterface('%s', '%s')) r r^ r r1 r; r# r< Zremove_interface�InterfaceRemoved)r) r< r� r: r� r- r- r. r� � s
zFirewallD.removeInterfacec C s6 t |t�}t |t�}tjd||f � | jjj||�S )z^Return true if an interface is in a zone.
If zone is empty, use default zone.
z zone.queryInterface('%s', '%s'))r r^ r r1 r# r< Zquery_interface)r) r< r� r: r- r- r. �queryInterface s
zFirewallD.queryInterfacec C s& t |t�}tjd| � | jjj|�S )z]Return the list of interfaces of a zone.
If zone is empty, use default zone.
zzone.getInterfaces('%s'))r r^ r r1 r# r< r� )r) r< r: r- r- r. r� s
zFirewallD.getInterfacesc C s t jd||f � d S )Nz zone.InterfaceAdded('%s', '%s'))r r1 )r) r< r� r- r- r. r� + s zFirewallD.InterfaceAddedc C s t jd||f � dS )z,
This signal is deprecated.
z zone.ZoneChanged('%s', '%s')N)r r1 )r) r< r� r- r- r. � ZoneChanged0 s zFirewallD.ZoneChangedc C s" t jd||f � | j||� d S )Nz'zone.ZoneOfInterfaceChanged('%s', '%s'))r r1 r� )r) r< r� r- r- r. r� 8 s
z FirewallD.ZoneOfInterfaceChangedc C s t jd||f � d S )Nz!zone.InterfaceRemoved('%s', '%s'))r r1 )r) r< r� r- r- r. r� ? s zFirewallD.InterfaceRemovedc C sR t |t�}t |t�}tjd||f � | j|� | jjj|||�}| j||� |S )zLAdd a source to a zone.
If zone is empty, use default zone.
zzone.addSource('%s', '%s')) r r^ r r1 r; r# r< Z
add_source� SourceAdded)r) r< r� r: r� r- r- r. � addSourceH s
zFirewallD.addSourcec C sR t |t�}t |t�}tjd||f � | j|� | jjj|||�}| j||� |S )zXChange a zone an source is part of.
If zone is empty, use default zone.
z#zone.changeZoneOfSource('%s', '%s')) r r^ r r1 r; r# r< Zchange_zone_of_source�ZoneOfSourceChanged)r) r< r� r: r� r- r- r. �changeZoneOfSourceY s
z FirewallD.changeZoneOfSourcec C sP t |t�}t |t�}tjd||f � | j|� | jjj||�}| j||� |S )zeRemove source from a zone.
If zone is empty, remove from zone the source belongs to.
z zone.removeSource('%s', '%s')) r r^ r r1 r; r# r< Z
remove_source�
SourceRemoved)r) r< r� r: r� r- r- r. � removeSourcej s
zFirewallD.removeSourcec C s6 t |t�}t |t�}tjd||f � | jjj||�S )z[Return true if an source is in a zone.
If zone is empty, use default zone.
z zone.querySource('%s', '%s'))r r^ r r1 r# r< Z query_source)r) r< r� r: r- r- r. � querySource{ s
zFirewallD.querySourcec C s& t |t�}tjd| � | jjj|�S )zZReturn the list of sources of a zone.
If zone is empty, use default zone.
zzone.getSources('%s'))r r^ r r1 r# r< r� )r) r< r: r- r- r. �
getSources� s
zFirewallD.getSourcesc C s t jd||f � d S )Nz zone.SourceAdded('%s', '%s'))r r1 )r) r< r� r- r- r. r� � s zFirewallD.SourceAddedc C s t jd||f � d S )Nz$zone.ZoneOfSourceChanged('%s', '%s'))r r1 )r) r< r� r- r- r. r� � s z FirewallD.ZoneOfSourceChangedc C s t jd||f � d S )Nz zone.SourceRemoved('%s', '%s'))r r1 )r) r< r� r- r- r. r� � s zFirewallD.SourceRemovedc C sH t jd||f � | j| |= t|d�}| jjj||� | j||� d S )Nz%zone.disableTimedRichRule('%s', '%s'))�rule_str)r r1 r2 r r# r< � remove_rule�RichRuleRemoved)r) r< �ruler� r- r- r. �disableTimedRichRule� s
z FirewallD.disableTimedRichRuleZssic C s� t |t�}t |t�}t |t�}tjd||f � t|d�}| jjj|||�}|dkrtt j
|| j ||�}| j |||� | j
|||� |S )Nz zone.addRichRule('%s', '%s'))r� r )r r^ r� r r1 r r# r< �add_ruler �timeout_add_secondsr� r? �
RichRuleAdded)r) r< r� �timeoutr: r� r� r> r- r- r. � addRichRule� s
zFirewallD.addRichRulec C s\ t |t�}t |t�}tjd||f � t|d�}| jjj||�}| j||� | j ||� |S )Nz zone.removeRichRule('%s', '%s'))r� )
r r^ r r1 r r# r< r� rA r� )r) r< r� r: r� r� r- r- r. �removeRichRule� s
zFirewallD.removeRichRulec C s@ t |t�}t |t�}tjd||f � t|d�}| jjj||�S )Nz zone.queryRichRule('%s', '%s'))r� )r r^ r r1 r r# r< �
query_rule)r) r< r� r: r� r- r- r. �
queryRichRule� s
zFirewallD.queryRichRulec C s& t |t�}tjd| � | jjj|�S )Nzzone.getRichRules('%s'))r r^ r r1 r# r< Z
list_rules)r) r< r: r- r- r. � getRichRules� s
zFirewallD.getRichRulesc C s t jd|||f � d S )Nz"zone.RichRuleAdded('%s', '%s', %d))r r1 )r) r< r� r� r- r- r. r� � s zFirewallD.RichRuleAddedc C s t jd||f � d S )Nz zone.RichRuleRemoved('%s', '%s'))r r1 )r) r< r� r- r- r. r� � s zFirewallD.RichRuleRemovedc C s> t jd||f � | j| |= | jjj||� | j||� d S )Nz$zone.disableTimedService('%s', '%s'))r r1 r2 r# r< �remove_service�ServiceRemoved)r) r< rr r- r- r. �disableTimedService� s z FirewallD.disableTimedServicec C s� t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj||||�}|dkrxt j
|| j ||�}| j |||� | j
|||� |S )Nz zone.addService('%s', '%s', %d)r )r r^ r� r r1 r; r# r< Z add_servicer r� r r? � ServiceAdded)r) r< rr r� r: r� r> r- r- r. rv � s
zFirewallD.addServicec C s\ t |t�}t |t�}tjd||f � | j|� | jjj||�}| j||� | j ||� |S )Nz zone.removeService('%s', '%s'))
r r^ r r1 r; r# r< r rA r )r) r< rr r: r� r- r- r. �
removeService s
zFirewallD.removeServicec C s6 t |t�}t |t�}tjd||f � | jjj||�S )Nz zone.queryService('%s', '%s'))r r^ r r1 r# r< Z
query_service)r) r< rr r: r- r- r. � queryService& s
zFirewallD.queryServicec C s& t |t�}tjd| � | jjj|�S )Nzzone.getServices('%s'))r r^ r r1 r# r< Z
list_services)r) r< r: r- r- r. � getServices1 s
zFirewallD.getServicesc C s t jd|||f � d S )Nz!zone.ServiceAdded('%s', '%s', %d))r r1 )r) r< rr r� r- r- r. r = s zFirewallD.ServiceAddedc C s t jd||f � d S )Nz zone.ServiceRemoved('%s', '%s'))r r1 )r) r< rr r- r- r. r C s zFirewallD.ServiceRemovedc C sH t jd|||f � | j| ||f= | jjj|||� | j|||� d S )Nz'zone.disableTimedPort('%s', '%s', '%s'))r r1 r2 r# r< � remove_port� PortRemoved)r) r< �port�protocolr- r- r. �disableTimedPortL s
zFirewallD.disableTimedPortZsssic C s� t |t�}t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||||�}|dkr�t j
|| j |||�}| j |||f|� | j
||||� |S )Nz zone.addPort('%s', '%s', '%s')r )r r^ r� r r1 r; r# r< Zadd_portr r� r r? � PortAdded)r) r< r r r� r: r� r> r- r- r. �addPortT s
zFirewallD.addPortZsssc C sp t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||�}| j|||f� | j |||� |S )Nz!zone.removePort('%s', '%s', '%s'))
r r^ r r1 r; r# r< r rA r
)r) r< r r r: r� r- r- r. �
removePortk s
zFirewallD.removePortc C sD t |t�}t |t�}t |t�}tjd|||f � | jjj|||�S )Nz zone.queryPort('%s', '%s', '%s'))r r^ r r1 r# r< Z
query_port)r) r< r r r: r- r- r. � queryPort} s
zFirewallD.queryPortZaasc C s& t |t�}tjd| � | jjj|�S )Nzzone.getPorts('%s'))r r^ r r1 r# r< Z
list_ports)r) r< r: r- r- r. �getPorts� s
zFirewallD.getPortsr c C s t jd||||f � d S )Nz$zone.PortAdded('%s', '%s', '%s', %d))r r1 )r) r< r r r� r- r- r. r � s zFirewallD.PortAddedc C s t jd|||f � d S )Nz"zone.PortRemoved('%s', '%s', '%s'))r r1 )r) r< r r r- r- r. r
� s zFirewallD.PortRemovedc C s> t jd||f � | j| |= | jjj||� | j||� d S )Nz%zone.disableTimedProtocol('%s', '%s'))r r1 r2 r# r< �remove_protocol�ProtocolRemoved)r) r< r r- r- r. �disableTimedProtocol� s z FirewallD.disableTimedProtocolc C s� t |t�}t |t�}t |t�}tjd||f � | j|� | jjj||||�}|dkrvt j
|| j ||�}| j |||� | j
|||� |S )Nz zone.enableProtocol('%s', '%s')r )r r^ r� r r1 r; r# r< Z add_protocolr r� r r? �
ProtocolAdded)r) r< r r� r: r� r> r- r- r. � addProtocol� s
zFirewallD.addProtocolc C s\ t |t�}t |t�}tjd||f � | j|� | jjj||�}| j||� | j ||� |S )Nz zone.removeProtocol('%s', '%s'))
r r^ r r1 r; r# r< r rA r )r) r< r r: r� r- r- r. �removeProtocol� s
zFirewallD.removeProtocolc C s6 t |t�}t |t�}tjd||f � | jjj||�S )Nz zone.queryProtocol('%s', '%s'))r r^ r r1 r# r< Zquery_protocol)r) r< r r: r- r- r. �
queryProtocol� s
zFirewallD.queryProtocolc C s& t |t�}tjd| � | jjj|�S )Nzzone.getProtocols('%s'))r r^ r r1 r# r< Zlist_protocols)r) r< r: r- r- r. � getProtocols� s
zFirewallD.getProtocolsc C s t jd|||f � d S )Nz"zone.ProtocolAdded('%s', '%s', %d))r r1 )r) r< r r� r- r- r. r � s zFirewallD.ProtocolAddedc C s t jd||f � d S )Nz zone.ProtocolRemoved('%s', '%s'))r r1 )r) r< r r- r- r. r � s zFirewallD.ProtocolRemovedc C sJ t jd|||f � | j| d||f= | jjj|||� | j|||� d S )Nz-zone.disableTimedSourcePort('%s', '%s', '%s')�sport)r r1 r2 r# r< �remove_source_port�SourcePortRemoved)r) r< r r r- r- r. �disableTimedSourcePort� s
z FirewallD.disableTimedSourcePortc C s� t |t�}t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||||�}|dkr�t j
|| j |||�}| j |d||f|� | j
||||� |S )Nz$zone.addSourcePort('%s', '%s', '%s')r r )r r^ r� r r1 r; r# r< Zadd_source_portr r� r! r? �SourcePortAdded)r) r< r r r� r: r� r> r- r- r. �
addSourcePort� s
zFirewallD.addSourcePortc C sr t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||�}| j|d||f� | j |||� |S )Nz'zone.removeSourcePort('%s', '%s', '%s')r )
r r^ r r1 r; r# r< r rA r )r) r< r r r: r� r- r- r. �removeSourcePort s
zFirewallD.removeSourcePortc C sD t |t�}t |t�}t |t�}tjd|||f � | jjj|||�S )Nz&zone.querySourcePort('%s', '%s', '%s'))r r^ r r1 r# r< Zquery_source_port)r) r< r r r: r- r- r. �querySourcePort) s
zFirewallD.querySourcePortc C s& t |t�}tjd| � | jjj|�S )Nzzone.getSourcePorts('%s'))r r^ r r1 r# r< Zlist_source_ports)r) r< r: r- r- r. �getSourcePorts6 s
zFirewallD.getSourcePortsc C s t jd||||f � d S )Nz*zone.SourcePortAdded('%s', '%s', '%s', %d))r r1 )r) r< r r r� r- r- r. r" B s zFirewallD.SourcePortAddedc C s t jd|||f � d S )Nz(zone.SourcePortRemoved('%s', '%s', '%s'))r r1 )r) r< r r r- r- r. r H s
zFirewallD.SourcePortRemovedc C s( | j | d= | jjj|� | j|� d S )N�
masquerade)r2 r# r< �remove_masquerade�MasqueradeRemoved)r) r< r- r- r. �disableTimedMasqueradeR s z FirewallD.disableTimedMasqueradeZsic C st t |t�}t |t�}tjd| � | j|� | jjj|||�}|dkrdt j
|| j |�}| j |d|� | j
||� |S )Nzzone.addMasquerade('%s')r r' )r r^ r� r r1 r; r# r< Zadd_masquerader r� r* r? �MasqueradeAdded)r) r< r� r: r� r> r- r- r. �
addMasqueradeX s
zFirewallD.addMasqueradec C sJ t |t�}tjd| � | j|� | jjj|�}| j|d� | j |� |S )Nzzone.removeMasquerade('%s')r' )
r r^ r r1 r; r# r< r( rA r) )r) r< r: r� r- r- r. �removeMasqueradel s
zFirewallD.removeMasqueradec C s& t |t�}tjd| � | jjj|�S )Nzzone.queryMasquerade('%s'))r r^ r r1 r# r< Zquery_masquerade)r) r< r: r- r- r. �queryMasquerade{ s
zFirewallD.queryMasqueradec C s t jd||f � d S )Nz zone.MasqueradeAdded('%s', %d))r r1 )r) r< r� r- r- r. r+ � s zFirewallD.MasqueradeAddedc C s t jd| � d S )Nz zone.MasqueradeRemoved('%s'))r r1 )r) r< r- r- r. r) � s zFirewallD.MasqueradeRemovedc C s@ | j | ||||f= | jjj|||||� | j|||||� d S )N)r2 r# r< �remove_forward_port�ForwardPortRemoved)r) r< r r �toport�toaddrr- r- r. �disable_forward_port� s z FirewallD.disable_forward_portZsssssic
C s� t |t�}t |t�}t |t�}t |t�}t |t�}t |t�}tjd|||||f � | j|� | jjj|||||||�}|dkr�t j
|| j |||||�} | j |||||f| � | j
||||||� |S )Nz1zone.addForwardPort('%s', '%s', '%s', '%s', '%s')r )r r^ r� r r1 r; r# r< Zadd_forward_portr r� r3 r? �ForwardPortAdded)
r) r< r r r1 r2 r� r: r� r> r- r- r. �addForwardPort� s&
zFirewallD.addForwardPortZsssssc C s� t |t�}t |t�}t |t�}t |t�}t |t�}tjd|||||f � | j|� | jjj|||||�}| j|||||f� | j |||||� |S )Nz4zone.removeForwardPort('%s', '%s', '%s', '%s', '%s'))
r r^ r r1 r; r# r< r/ rA r0 )r) r< r r r1 r2 r: r� r- r- r. �removeForwardPort� s
zFirewallD.removeForwardPortc C s` t |t�}t |t�}t |t�}t |t�}t |t�}tjd|||||f � | jjj|||||�S )Nz3zone.queryForwardPort('%s', '%s', '%s', '%s', '%s'))r r^ r r1 r# r< Zquery_forward_port)r) r< r r r1 r2 r: r- r- r. �queryForwardPort� s
zFirewallD.queryForwardPortc C s& t |t�}tjd| � | jjj|�S )Nzzone.getForwardPorts('%s'))r r^ r r1 r# r< Zlist_forward_ports)r) r< r: r- r- r. �getForwardPorts� s
zFirewallD.getForwardPortsc C s t jd||||||f � d S )Nz7zone.ForwardPortAdded('%s', '%s', '%s', '%s', '%s', %d))r r1 )r) r< r r r1 r2 r� r- r- r. r4 � s zFirewallD.ForwardPortAddedc C s t jd|||||f � d S )Nz5zone.ForwardPortRemoved('%s', '%s', '%s', '%s', '%s'))r r1 )r) r< r r r1 r2 r- r- r. r0 � s z FirewallD.ForwardPortRemovedc C s> t jd||f � | j| |= | jjj||� | j||� d S )Nz&zone.disableTimedIcmpBlock('%s', '%s'))r r1 r2 r# r< �remove_icmp_block�IcmpBlockRemoved)r) r< �icmpr: r- r- r. �disableTimedIcmpBlock� s z FirewallD.disableTimedIcmpBlockc C s� t |t�}t |t�}t |t�}tjd||f � | j|� | jjj||||�}|dkrxt j
|| j |||�}| j |||� | j
|||� |S )Nz zone.enableIcmpBlock('%s', '%s')r )r r^ r� r r1 r; r# r< Zadd_icmp_blockr r� r< r? �IcmpBlockAdded)r) r< r; r� r: r� r> r- r- r. � addIcmpBlock s
zFirewallD.addIcmpBlockc C s\ t |t�}t |t�}tjd||f � | j|� | jjj||�}| j||� | j ||� |S )Nz zone.removeIcmpBlock('%s', '%s'))
r r^ r r1 r; r# r< r9 rA r: )r) r< r; r: r� r- r- r. �removeIcmpBlock s
zFirewallD.removeIcmpBlockc C s6 t |t�}t |t�}tjd||f � | jjj||�S )Nz zone.queryIcmpBlock('%s', '%s'))r r^ r r1 r# r< Zquery_icmp_block)r) r< r; r: r- r- r. �queryIcmpBlock& s
zFirewallD.queryIcmpBlockc C s& t |t�}tjd| � | jjj|�S )Nzzone.getIcmpBlocks('%s'))r r^ r r1 r# r< Zlist_icmp_blocks)r) r< r: r- r- r. �
getIcmpBlocks1 s
zFirewallD.getIcmpBlocksc C s t jd|||f � d S )Nz#zone.IcmpBlockAdded('%s', '%s', %d))r r1 )r) r< r; r� r- r- r. r= = s zFirewallD.IcmpBlockAddedc C s t jd||f � d S )Nz!zone.IcmpBlockRemoved('%s', '%s'))r r1 )r) r< r; r- r- r. r: C s zFirewallD.IcmpBlockRemovedc C s@ t |t�}tjd| � | j|� | jjj||�}| j|� |S )Nz zone.addIcmpBlockInversion('%s')) r r^ r r1 r; r# r< Zadd_icmp_block_inversion�IcmpBlockInversionAdded)r) r< r: r� r- r- r. �addIcmpBlockInversionL s
z FirewallD.addIcmpBlockInversionc C s> t |t�}tjd| � | j|� | jjj|�}| j|� |S )Nz#zone.removeIcmpBlockInversion('%s')) r r^ r r1 r; r# r< Zremove_icmp_block_inversion�IcmpBlockInversionRemoved)r) r< r: r� r- r- r. �removeIcmpBlockInversionZ s
z"FirewallD.removeIcmpBlockInversionc C s& t |t�}tjd| � | jjj|�S )Nz"zone.queryIcmpBlockInversion('%s'))r r^ r r1 r# r< Zquery_icmp_block_inversion)r) r< r: r- r- r. �queryIcmpBlockInversionh s
z!FirewallD.queryIcmpBlockInversionc C s t jd| � d S )Nz"zone.IcmpBlockInversionAdded('%s'))r r1 )r) r< r- r- r. rB r s z!FirewallD.IcmpBlockInversionAddedc C s t jd| � d S )Nz$zone.IcmpBlockInversionRemoved('%s'))r r1 )r) r< r- r- r. rD w s z#FirewallD.IcmpBlockInversionRemovedc C s` t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||� | j|||� d S )Nz!direct.addChain('%s', '%s', '%s')) r r^ r r1 r; r# r� Z add_chain�
ChainAdded)r) �ipv�table�chainr: r- r- r. �addChain� s
zFirewallD.addChainc C s` t |t�}t |t�}t |t�}tjd|||f � | j|� | jjj|||� | j|||� d S )Nz$direct.removeChain('%s', '%s', '%s')) r r^ r r1 r; r# r� Z remove_chain� ChainRemoved)r) rH rI rJ r: r- r- r. � removeChain� s
zFirewallD.removeChainc C sD t |t�}t |t�}t |t�}tjd|||f � | jjj|||�S )Nz#direct.queryChain('%s', '%s', '%s'))r r^ r r1 r# r� Z query_chain)r) rH rI rJ r: r- r- r. �
queryChain� s
zFirewallD.queryChainc C s6 t |t�}t |t�}tjd||f � | jjj||�S )Nz direct.getChains('%s', '%s'))r r^ r r1 r# r� Z
get_chains)r) rH rI r: r- r- r. � getChains� s
zFirewallD.getChainsza(sss)c C s t jd� | jjj� S )Nzdirect.getAllChains())r r1 r# r� r� )r) r: r- r- r. � getAllChains� s
zFirewallD.getAllChainsc C s t jd|||f � d S )Nz#direct.ChainAdded('%s', '%s', '%s'))r r1 )r) rH rI rJ r- r- r. rG � s zFirewallD.ChainAddedc C s t jd|||f � d S )Nz%direct.ChainRemoved('%s', '%s', '%s'))r r1 )r) rH rI rJ r- r- r. rL � s
zFirewallD.ChainRemovedZsssiasc C s� t |t�}t |t�}t |t�}t |t�}tdd� |D ��}tjd||||dj|�f � | j|� | jj j
|||||� | j |||||� d S )Nc s s | ]}t |t�V qd S )N)r r^ )�.0r� r- r- r. � <genexpr>� s z$FirewallD.addRule.<locals>.<genexpr>z*direct.addRule('%s', '%s', '%s', %d, '%s')z',') r r^ r� r� r r1 �joinr; r# r� r� � RuleAdded)r) rH rI rJ �priorityr* r: r- r- r. �addRule� s
zFirewallD.addRulec C s� t |t�}t |t�}t |t�}t |t�}tdd� |D ��}tjd||||dj|�f � | j|� | jj j
|||||� | j |||||� d S )Nc s s | ]}t |t�V qd S )N)r r^ )rQ r� r- r- r. rR � s z'FirewallD.removeRule.<locals>.<genexpr>z-direct.removeRule('%s', '%s', '%s', %d, '%s')z',') r r^ r� r� r r1 rS r; r# r� r� � RuleRemoved)r) rH rI rJ rU r* r: r- r- r. �
removeRule� s
zFirewallD.removeRulec C s� t |t�}t |t�}t |t�}tjd|||f � | j|� xF| jjj|||�D ]0\}}| jjj|||||� | j |||||� qPW d S )Nz$direct.removeRules('%s', '%s', '%s'))
r r^ r r1 r; r# r� � get_rulesr� rW )r) rH rI rJ r: rU r* r- r- r. � removeRules� s
zFirewallD.removeRulesc C sn t |t�}t |t�}t |t�}t |t�}tdd� |D ��}tjd||||dj|�f � | jjj |||||�S )Nc s s | ]}t |t�V qd S )N)r r^ )rQ r� r- r- r. rR s z&FirewallD.queryRule.<locals>.<genexpr>z,direct.queryRule('%s', '%s', '%s', %d, '%s')z',')
r r^ r� r� r r1 rS r# r� r )r) rH rI rJ rU r* r: r- r- r. � queryRule� s
zFirewallD.queryRuleza(ias)c C sD t |t�}t |t�}t |t�}tjd|||f � | jjj|||�S )Nz!direct.getRules('%s', '%s', '%s'))r r^ r r1 r# r� rY )r) rH rI rJ r: r- r- r. �getRules
s
zFirewallD.getRulesz a(sssias)c C s t jd� | jjj� S )Nzdirect.getAllRules())r r1 r# r� r� )r) r: r- r- r. � getAllRules s
zFirewallD.getAllRulesc C s" t jd||||dj|�f � d S )Nz,direct.RuleAdded('%s', '%s', '%s', %d, '%s')z',')r r1 rS )r) rH rI rJ rU r* r- r- r. rT " s zFirewallD.RuleAddedc C s" t jd||||dj|�f � d S )Nz.direct.RuleRemoved('%s', '%s', '%s', %d, '%s')z',')r r1 rS )r) rH rI rJ rU r* r- r- r. rW ( s zFirewallD.RuleRemovedrS c C s� t |t�}tdd� |D ��}tjd|dj|�f � | j|� y| jjj ||�S t
k
r� } zh|d krzt ddd d
g�}n t d d
g�}t|�}|j t
jkr�tt |�|@ �d kr�tj|� t|��� W Y d d }~X nX d S )
Nc s s | ]}t |t�V qd S )N)r r^ )rQ r� r- r- r. rR 9 s z(FirewallD.passthrough.<locals>.<genexpr>z direct.passthrough('%s', '%s')z','rH rL z-Cz--checkz-Lz--listr )rH rL )r r^ r� r r1 rS r; r# r� � passthroughr �set�coder ZCOMMAND_FAILEDr� rx r
)r) rH r* r: r9 Z
query_args�msgr- r- r. r^ 2 s"
zFirewallD.passthroughc C s\ t |�}tdd� |D ��}tjd|dj|�f � | j|� | jjj||� | j ||� d S )Nc s s | ]}t |�V qd S )N)r )rQ r� r- r- r. rR T s z+FirewallD.addPassthrough.<locals>.<genexpr>z!direct.addPassthrough('%s', '%s')z',')
r r� r r1 rS r; r# r� Zadd_passthrough�PassthroughAdded)r) rH r* r: r- r- r. �addPassthroughM s
zFirewallD.addPassthroughc C s\ t |�}tdd� |D ��}tjd|dj|�f � | j|� | jjj||� | j ||� d S )Nc s s | ]}t |�V qd S )N)r )rQ r� r- r- r. rR b s z.FirewallD.removePassthrough.<locals>.<genexpr>z$direct.removePassthrough('%s', '%s')z',')
r r� r r1 rS r; r# r� Zremove_passthrough�PassthroughRemoved)r) rH r* r: r- r- r. �removePassthrough[ s
zFirewallD.removePassthroughc C sB t |�}tdd� |D ��}tjd|dj|�f � | jjj||�S )Nc s s | ]}t |�V qd S )N)r )rQ r� r- r- r. rR p s z-FirewallD.queryPassthrough.<locals>.<genexpr>z#direct.queryPassthrough('%s', '%s')z',')r r� r r1 rS r# r� Zquery_passthrough)r) rH r* r: r- r- r. �queryPassthroughi s
zFirewallD.queryPassthroughza(sas)c C s t jd� | jjj� S )Nzdirect.getAllPassthroughs())r r1 r# r� r� )r) r: r- r- r. �getAllPassthroughsu s
z FirewallD.getAllPassthroughsc C s. t jd� x t| j� �D ]}| j|� qW d S )Nz direct.removeAllPassthroughs())r r1 �reversedrg re )r) r: r^ r- r- r. �removeAllPassthroughs~ s
z FirewallD.removeAllPassthroughsc C s" t |�}tjd|� | jjj|�S )Nz direct.getPassthroughs('%s'))r r r1 r# r� Zget_passthroughs)r) rH r: r- r- r. �getPassthroughs� s zFirewallD.getPassthroughsc C s t jd|dj|�f � d S )Nz#direct.PassthroughAdded('%s', '%s')z',')r r1 rS )r) rH r* r- r- r. rb � s zFirewallD.PassthroughAddedc C s t jd|dj|�f � d S )Nz%direct.PassthroughRemoved('%s', '%s')z',')r r1 rS )r) rH r* r- r- r. rd � s z FirewallD.PassthroughRemovedc C s dS )z� PK_ACTION_ALL implies all other actions, i.e. once a subject is
authorized for PK_ACTION_ALL it's also authorized for any other action.
Use-case is GUI (RHBZ#994729).
Nr- )r) r: r- r- r. � authorizeAll� s zFirewallD.authorizeAllc C s$ t |�}tjd| � | jjj|�S )Nzipset.queryIPSet('%s'))r r r1 r# r| Z query_ipset)r) r| r: r- r- r. �
queryIPSet� s zFirewallD.queryIPSetc C s t jd� | jjj� S )Nzipsets.getIPSets())r r1 r# r| r} )r) r: r- r- r. � getIPSets� s
zFirewallD.getIPSetsc C s( t |t�}tjd|� | jjj|�j� S )NzgetIPSetSettings(%s))r r^ r r1 r# r| Z get_ipsetr� )r) r| r: r- r- r. r~ � s
zFirewallD.getIPSetSettingsc C sL t |�}t |�}tjd||f � | j|� | jjj||� | j||� d S )Nzipset.addEntry('%s', '%s'))r r r1 r; r# r| Z add_entry�
EntryAdded)r) r| �entryr: r- r- r. �addEntry� s
zFirewallD.addEntryc C sL t |�}t |�}tjd||f � | j|� | jjj||� | j||� d S )Nz ipset.removeEntry('%s', '%s'))r r r1 r; r# r| Z remove_entry� EntryRemoved)r) r| ro r: r- r- r. � removeEntry� s
zFirewallD.removeEntryc C s2 t |�}t |�}tjd||f � | jjj||�S )Nz ipset.queryEntry('%s', '%s'))r r r1 r# r| Z query_entry)r) r| ro r: r- r- r. �
queryEntry� s zFirewallD.queryEntryc C s$ t |�}tjd| � | jjj|�S )Nzipset.getEntries('%s'))r r r1 r# r| � get_entries)r) r| r: r- r- r. �
getEntries� s zFirewallD.getEntriesc C s� t |�}t |t�}tjd|dj|�� | jjj|�}| jjj||� t |�}t |�}x || D ]}| j
||� q^W x || D ]}| j ||� q|W d S )Nz ipset.setEntries('%s', '[%s]')�,) r �listr r1 rS r# r| rt Z set_entriesr_ rn rq )r) r| Zentriesr: Z old_entriesZold_entries_setZ entries_setro r- r- r. �
setEntries� s
zFirewallD.setEntriesc C s& t |�}t |�}tjd||f � d S )Nz ipset.EntryAdded('%s', '%s'))r r r1 )r) r| ro r- r- r. rn
s zFirewallD.EntryAddedc C s& t |�}t |�}tjd||f � d S )Nz ipset.EntryRemoved('%s', '%s'))r r r1 )r) r| ro r- r- r. rq
s zFirewallD.EntryRemovedc C s t jd� | jjj� S )Nzhelpers.getHelpers())r r1 r# r� r� )r) r: r- r- r. �
getHelpers!
s
zFirewallD.getHelpersc C s( t |t�}tjd|� | jjj|�j� S )NzgetHelperSettings(%s))r r^ r r1 r# r� Z
get_helperr� )r) r� r: r- r- r. r� *
s
zFirewallD.getHelperSettings)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)r )N)N)N)N)r )N)N)N)N)r )N)N)N)r )N)N)N)N)r )N)N)N)N)r )N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)��__name__�
__module__� __qualname__�__doc__Z
persistentr r' ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r" r0 r& r/ r
r; r? rA rC rZ r ZPROPERTIES_IFACEre rh �slipZpolkitZ require_authri rr �signalrj ZPK_ACTION_INFOZINTROSPECTABLE_IFACErk r( rn rp ro rq r� ZPK_ACTION_POLICIESra r� r� ZPK_ACTION_POLICIES_INFOr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� ZPK_ACTION_CONFIG_INFOr� r_ r� r� r� ZDBUS_INTERFACE_POLICYr� r� r� r� rt r� r� r ZDBUS_SIGNATUREr{ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� r� r rv r r
r r r r r r r r r r
r r r r r r r r! r# r$ r% r& r" r r* r, r- r. r+ r) r3 r5 r6 r7 r8 r4 r0 r< r> r? r@ rA r= r: rC rE rF rB rD ZPK_ACTION_DIRECTr` rK rM ZPK_ACTION_DIRECT_INFOrN rO rP rG rL rV rX rZ r[ r\ r] rT rW r^ rc re rf rg ri rj rb rd Z
PK_ACTION_ALLrk rb rl rm r r~ rp rr rs ru rx rn rq ry r r� �
__classcell__r- r- )r, r. r A s� 0 "
K
)9�__all__Z
gi.repositoryr r �sys�modulesr� r' Z dbus.serviceZ slip.dbusr~ Zslip.dbus.serviceZfirewallr Zfirewall.core.fwr Zfirewall.core.richr Zfirewall.core.loggerr Zfirewall.clientr Zfirewall.server.decoratorsr
r r r
Zfirewall.server.configr Zfirewall.dbus_utilsr r r r r r r Zfirewall.core.io.functionsr Zfirewall.core.io.ipsetr Zfirewall.core.io.icmptyper Zfirewall.core.io.helperr Zfirewall.core.fw_nmr r r Zfirewall.core.fw_ifcfgr r Zfirewall.errorsr rr ZObjectr r- r- r- r. �<module> s2
$ server/__pycache__/decorators.cpython-36.pyc 0000644 00000004023 15035135172 0015056 0 ustar 00 3
��go � @ s� d Z ddddgZddlZddlZddlZddlmZ ddlmZ dd lm Z dd
l
m Z dd lm Z dd l
mZ G d
d� dej�Zedd� �Zedd� �Zdd� ZdS )z>This module contains decorators for use with and without D-Bus�FirewallDBusException�handle_exceptions�dbus_handle_exceptions�dbus_service_method� N)�
DBusException)� decorator)�config)�
FirewallError)�errors)�logc @ s e Zd Zd Zdejj ZdS )r z %s.ExceptionN)�__name__�
__module__� __qualname__�__doc__r �dbusZDBUS_INTERFACEZ_dbus_error_name� r r � /usr/lib/python3.6/decorators.pyr + s c O sd y
| ||�S t k
rD } z tjtj� � tj|� W Y dd}~X n tk
r^ tj� Y nX dS )zTDecorator to handle exceptions and log them. Used if not conneced
to D-Bus.
N)r r �debug1� traceback�
format_exc�error� Exception� exception)�func�args�kwargsr r r r r / s
c O s� y
| ||�S t k
r� } zdt jt|��}|tjtjtjtjgkrRtj t|�� n tj
t j � � tj
t|�� tt|���W Y dd}~X nZ tk
r� } z
|�W Y dd}~X n6 tk
r� } ztj� tt|���W Y dd}~X nX dS )z�Decorator to handle exceptions, log and report them into D-Bus
:Raises DBusException: on a firewall error code problems.
N)r �get_code�strr
ZALREADY_ENABLEDZ NOT_ENABLEDZZONE_ALREADY_SETZ ALREADY_SETr Zwarningr r r r r r r r )r r r r �codeZexr r r r < s
c O s |j dd� tjj| |�S )z Add sender argument for D-BusZsender_keywordZsender)�
setdefaultr Zservice�method)r r r r r r T s )r �__all__r Z dbus.servicer Zdbus.exceptionsr r Zfirewallr Zfirewall.errorsr r
Zfirewall.core.loggerr r r r r r r r r �<module> s
server/__pycache__/config_service.cpython-36.opt-1.pyc 0000644 00000051355 15035135172 0016647 0 ustar 00 3
��g�u � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZmZmZ d dl mZ d d lmZ G d
d � d ejjj�ZdS ) � )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�errors)�
FirewallErrorc s� e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z
e d d
� �Zeejd d d
�e d�dd���Zeejddd
�e d�dd���Zejjjejj�eejdd�e d�dd����Zejjejdd�dd � �Zejjjejj�eejdd �e d�� fd d � ���Z eejj d d �e d�d!d"���Z eejj dd �e d�d#d$���Z eejj d d�e d�d%d&���Z eejj dd�e d�d'd(���Z!eejj �e d�d)d*���Z"ejjejj dd�e d+d,� ��Z#eejj �e d�d-d.���Z$ejjejj dd�e d/d0� ��Z%eejj dd�e d�d1d2���Z&ejjejj dd�e d3d4� ��Z'eejj dd �e d�d5d6���Z(eejj dd�e d�d7d8���Z)eejj dd �e d�d9d:���Z*eejj dd�e d�d;d<���Z+eejj dd �e d�d=d>���Z,eejj dd�e d�d?d@���Z-eejj dAd �e d�dBdC���Z.eejj dAd�e d�dDdE���Z/eejj d d�e d�dFdG���Z0eejj d d�e d�dHdI���Z1eejj d dJd
�e d�dKdL���Z2eejj dMd �e d�dNdO���Z3eejj dMd�e d�dPdQ���Z4eejj dd�e d�dRdS���Z5eejj dd�e d�dTdU���Z6eejj ddJd
�e d�dVdW���Z7eejj dAd �e d�dXdY���Z8eejj dAd�e d�dZd[���Z9eejj d d�e d�d\d]���Z:eejj d d�e d�d^d_���Z;eejj d dJd
�e d�d`da���Z<eejj dMd �e d�dbdc���Z=eejj dMd�e d�ddde���Z>eejj dd�e d�dfdg���Z?eejj dd�e d�dhdi���Z@eejj ddJd
�e d�djdk���ZAeejj dld �e d�dmdn���ZBeejj dld�e d�dodp���ZCeejj ddd
�e d�dqdr���ZDeejj d d�e d�dsdt���ZEeejj dd�e d�dudv���ZFeejj d dJd
�e d�dwdx���ZGeejj dMd �e d�dydz���ZHeejj dMd�e d�d{d|���ZIeejj dd�e d�d}d~���ZJeejj dd�e d�dd����ZKeejj ddJd
�e d�d�d����ZL� ZMS )��FirewallDConfigServicezFirewallD main classTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.service.%d)
�superr
�__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_SERVICE)�selfr Zconf�servicer �args�kwargs)� __class__� �$/usr/lib/python3.6/config_service.pyr 7 s
z FirewallDConfigService.__init__c C s d S )Nr )r r r r �__del__D s z FirewallDConfigService.__del__c C s | j � d S )N)Zremove_from_connection)r r r r �
unregisterH s z!FirewallDConfigService.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r" r# r ZBooleanr$ r% �
exceptions�
DBusException)r �
property_namer r r �
_get_propertyP s z$FirewallDConfigService._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r' r( r* )r �interface_namer) �senderr r r �Geta s
zFirewallDConfigService.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr" r# r r$ r% Zsv)� signature)r" r# r r$ r% ) r r. r r/ r r r r r' r( r* Z
Dictionary)r r0 r1 �ret�xr r r �GetAllr s
z FirewallDConfigService.GetAllZssv)r, c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r. r r/ r r � accessCheckr r r r' r( )r r0 r) Z new_valuer1 r r r �Set� s
zFirewallDConfigService.Setzsa{sv}as)r4 c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r. r r/ r )r r0 Zchanged_propertiesZinvalidated_propertiesr r r �PropertiesChanged� s
z(FirewallDConfigService.PropertiesChanged)r- c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r r
�
Introspectr r Zget_busr r r r )r r1 �data)r r r r; � s
z!FirewallDConfigService.Introspectz(sssa(ss)asa{ss}asa(ss))c C s t jd| j� | jj| j�S )z!get settings for service
z%s.getSettings())r r/ r r Zget_service_configr )r r1 r r r � getSettings� s z"FirewallDConfigService.getSettingsc C s t jd| j� | jj| j�S )z!get settings for service
z%s.getSettings2())r r/ r r �get_service_config_dictr )r r1 r r r � getSettings2� s z#FirewallDConfigService.getSettings2c C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� dS )z$update settings for service
z%s.update('...')N) r r r/ r r r8 r Zset_service_configr �Updatedr" )r �settingsr1 r r r �update� s
z FirewallDConfigService.updatec C sF t |�}tjd| j� | jj|� | jj| j|�| _| j | jj
� d S )Nz%s.update2('...')) r r r/ r r r8 r �set_service_config_dictr r@ r" )r rA r1 r r r �update2� s
z FirewallDConfigService.update2c C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z2load default settings for builtin service
z%s.loadDefaults()N)
r r/ r r r8 r Zload_service_defaultsr r@ r" )r r1 r r r � loadDefaults� s z#FirewallDConfigService.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r/ r )r r" r r r r@ � s z FirewallDConfigService.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove service
z%s.removeService()N) r r/ r r r8 r Zremove_servicer Z
removeService)r r1 r r r �remove� s z FirewallDConfigService.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r/ r )r r" r r r �Removed� s z FirewallDConfigService.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename service
z%s.rename('%s')N) r r. r r/ r r r8 r Zrename_servicer �Renamed)r r" r1 r r r �rename� s
z FirewallDConfigService.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r/ r )r r" r r r rH s z FirewallDConfigService.Renamedc C s t jd| j� | j� d S )Nz%s.getVersion()r )r r/ r r= )r r1 r r r �
getVersion s z!FirewallDConfigService.getVersionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setVersion('%s')r )
r r. r r/ r r r8 �listr= rB )r �versionr1 rA r r r �
setVersion s
z!FirewallDConfigService.setVersionc C s t jd| j� | j� d S )Nz
%s.getShort()r )r r/ r r= )r r1 r r r �getShort" s z FirewallDConfigService.getShortc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setShort('%s')r )
r r. r r/ r r r8 rK r= rB )r Zshortr1 rA r r r �setShort) s
z FirewallDConfigService.setShortc C s t jd| j� | j� d S )Nz%s.getDescription()� )r r/ r r= )r r1 r r r �getDescription6 s z%FirewallDConfigService.getDescriptionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDescription('%s')rP )
r r. r r/ r r r8 rK r= rB )r � descriptionr1 rA r r r �setDescription= s
z%FirewallDConfigService.setDescriptionza(ss)c C s t jd| j� | j� d S )Nz
%s.getPorts()� )r r/ r r= )r r1 r r r �getPortsK s z FirewallDConfigService.getPortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setPorts('[%s]')�,c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr )�.0�portr r r � <genexpr>_ s z2FirewallDConfigService.setPorts.<locals>.<genexpr>rT )
r rK �
isinstance�append�tupler r/ r �joinr r8 r= rB )r �portsr1 �_portsrX rA r r r �setPortsR s
z FirewallDConfigService.setPortsc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz%s.addPort('%s', '%s')rT z%s:%s)r r. r r/ r r r8 rK r= r r �ALREADY_ENABLEDr[ rB )r rX �protocolr1 rA r r r �addPorte s
z FirewallDConfigService.addPortc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz%s.removePort('%s', '%s')rT z%s:%s)r r. r r/ r r r8 rK r= r r � NOT_ENABLEDrF rB )r rX rb r1 rA r r r �
removePortu s
z!FirewallDConfigService.removePort�bc C s: t |t�}t |t�}tjd| j||� ||f| j� d kS )Nz%s.queryPort('%s', '%s')rT )r r. r r/ r r= )r rX rb r1 r r r � queryPort� s
z FirewallDConfigService.queryPort�asc C s t jd| j� | j� d S )Nz%s.getProtocols()� )r r/ r r= )r r1 r r r � getProtocols� s z#FirewallDConfigService.getProtocolsc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setProtocols('[%s]')rV ri )
r rK r r/ r r] r r8 r= rB )r Z protocolsr1 rA r r r � setProtocols� s
z#FirewallDConfigService.setProtocolsc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addProtocol('%s')ri )r r. r r/ r r r8 rK r= r r ra r[ rB )r rb r1 rA r r r � addProtocol� s
z"FirewallDConfigService.addProtocolc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.removeProtocol('%s')ri )r r. r r/ r r r8 rK r= r r rd rF rB )r rb r1 rA r r r �removeProtocol� s
z%FirewallDConfigService.removeProtocolc C s* t |t�}tjd| j|� || j� d kS )Nz%s.queryProtocol(%s')ri )r r. r r/ r r= )r rb r1 r r r �
queryProtocol� s
z$FirewallDConfigService.queryProtocolc C s t jd| j� | j� d S )Nz%s.getSourcePorts()� )r r/ r r= )r r1 r r r �getSourcePorts� s z%FirewallDConfigService.getSourcePortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setSourcePorts('[%s]')rV c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr )rW rX r r r rY � s z8FirewallDConfigService.setSourcePorts.<locals>.<genexpr>ro )
r rK rZ r[ r\ r r/ r r] r r8 r= rB )r r^ r1 r_ rX rA r r r �setSourcePorts� s
z%FirewallDConfigService.setSourcePortsc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz %s.addSourcePort('%s', '%s')ro z%s:%s)r r. r r/ r r r8 rK r= r r ra r[ rB )r rX rb r1 rA r r r �
addSourcePort� s
z$FirewallDConfigService.addSourcePortc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||f|d krbt t
j d||f ��|d j ||f� | j
|� d S )Nz %s.removeSourcePort('%s', '%s')ro z%s:%s)r r. r r/ r r r8 rK r= r r rd rF rB )r rX rb r1 rA r r r �removeSourcePort� s
z'FirewallDConfigService.removeSourcePortc C s: t |t�}t |t�}tjd| j||� ||f| j� d kS )Nz %s.querySourcePort('%s', '%s')ro )r r. r r/ r r= )r rX rb r1 r r r �querySourcePort s
z&FirewallDConfigService.querySourcePortc C s t jd| j� | j� d S )Nz%s.getModules()� )r r/ r r= )r r1 r r r �
getModules s z!FirewallDConfigService.getModulesc C s� t |t�}g }x@|D ]8}|jd�rB|jdd�}d|krB|jdd�}|j|� qW |}tjd| jdj|�� | j j
|� t| j � �}||d< | j |� d S )N�
nf_conntrack_� �_�-z%s.setModules('[%s]')rV ru )
r rK �
startswith�replacer[ r r/ r r] r r8 r= rB )r �modulesr1 Z_modules�modulerA r r r �
setModules s
z!FirewallDConfigService.setModulesc C s� t |t�}|jd�r4|jdd�}d|kr4|jdd�}tjd| j|� | jj|� t | j
� �}||d krtt t j
|��|d j|� | j|� d S )Nrw rx ry rz z%s.addModule('%s')ru )r r. r{ r| r r/ r r r8 rK r= r r ra r[ rB )r r~ r1 rA r r r � addModule' s
z FirewallDConfigService.addModulec C s� t |t�}|jd�r4|jdd�}d|kr4|jdd�}tjd| j|� | jj|� t | j
� �}||d krtt t j
|��|d j|� | j|� d S )Nrw rx ry rz z%s.removeModule('%s')ru )r r. r{ r| r r/ r r r8 rK r= r r rd rF rB )r r~ r1 rA r r r � removeModule8 s
z#FirewallDConfigService.removeModulec C sT t |t�}|jd�r4|jdd�}d|kr4|jdd�}tjd| j|� || j� d kS )Nrw rx ry rz z%s.queryModule('%s')ru )r r. r{ r| r r/ r r= )r r~ r1 r r r � queryModuleI s
z"FirewallDConfigService.queryModuleza{ss}c C s t jd| j� | j� d S )Nz%s.getDestinations()� )r r/ r r= )r r1 r r r �getDestinationsW s z&FirewallDConfigService.getDestinationsc C sV t |t�}tjd| j|jd�|jd�� | jj|� t| j � �}||d< | j
|� d S )Nz*%s.setDestinations({ipv4:'%s', ipv6:'%s'})Zipv4Zipv6r� ) r �dictr r/ r �getr r8 rK r= rB )r Z destinationsr1 rA r r r �setDestinations^ s
z&FirewallDConfigService.setDestinationsc C sV t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d | S )Nz%s.getDestination('%s')r� ) r r. r r/ r r r8 rK r= r r rd )r �familyr1 rA r r r �getDestinationk s
z%FirewallDConfigService.getDestinationc C s� t |t�}t |t�}tjd| j||� | jj|� t| j� �}||d krn|d | |krnt t
j d||f ��||d |< | j |� d S )Nz %s.setDestination('%s', '%s')r� z
'%s': '%s')
r r. r r/ r r r8 rK r= r r ra rB )r r� �addressr1 rA r r r �setDestinationx s
z%FirewallDConfigService.setDestinationc C sb t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d |= | j |� d S )Nz%s.removeDestination('%s')r� )
r r. r r/ r r r8 rK r= r r rd rB )r r� r1 rA r r r �removeDestination� s
z(FirewallDConfigService.removeDestinationc C sJ t |t�}t |t�}tjd| j||� | j� }||d koH||d | kS )Nz %s.queryDestination('%s', '%s')r� )r r. r r/ r r= )r r� r� r1 rA r r r �queryDestination� s
z'FirewallDConfigService.queryDestinationc C s< t jd| j� | jj|� | jj| j�}d|kr8|d S g S )Nz%s.getIncludes()�includes)r r/ r r r8 r r> r )r r1 rA r r r � getIncludes� s z"FirewallDConfigService.getIncludesc C sZ t |t�}tjd| j|� | jj|� d|d d � i}| jj| j |�| _ | j
| j j � d S )Nz%s.setIncludes('%s')r� ) r rK r r/ r r r8 r rC r r@ r" )r r� r1 rA r r r � setIncludes� s
z"FirewallDConfigService.setIncludesc C sj t |t�}tjd| j|� | jj|� | jj| j �}|j
dg �j |� | jj | j |�| _ | j
| j j� d S )Nz%s.addInclude('%s')r� )r r. r r/ r r r8 r r> r �
setdefaultr[ rC r@ r" )r �includer1 rA r r r �
addInclude� s
z!FirewallDConfigService.addIncludec C sf t |t�}tjd| j|� | jj|� | jj| j �}|d j
|� | jj | j |�| _ | j | j j
� d S )Nz%s.removeInclude('%s')r� )r r. r r/ r r r8 r r> r rF rC r@ r" )r r� r1 rA r r r �
removeInclude� s
z$FirewallDConfigService.removeIncludec C s@ t |t�}tjd| j|� | jj| j�}d|kr<||d kS dS )Nz%s.queryInclude('%s')r� F)r r. r r/ r r r> r )r r� r1 rA r r r � queryInclude� s
z#FirewallDConfigService.queryInclude)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N�__name__�
__module__� __qualname__�__doc__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r r! r* r
ZPROPERTIES_IFACEr2 r7 �slipZpolkitZ require_authr9 r �signalr: ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr; r r= r? rB rD rE r@ rF rG rI rH rJ rM rN rO rQ rS rU r` rc re rg rj rk rl rm rn rp rq rr rs rt rv r r� r� r� r� r� r� r� r� r� r� r� r� r� r� �
__classcell__r r )r r r
/ s�
r
)Z
gi.repositoryr �sysr} r Z dbus.serviceZ slip.dbusr� Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.loggerr Zfirewall.server.decoratorsr r r
r Zfirewall.errorsr r ZObjectr
r r r r �<module> s
server/__pycache__/config_zone.cpython-36.pyc 0000644 00000101501 15035135172 0015210 0 ustar 00 3
��gW� � @ s� d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl m
Z
d dl m Z m
Z
mZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZ d d lmZmZm Z d d l m Z d d
l m Z d dl m!Z!m"Z"m#Z#m$Z$ G dd� dejj%j&�Z'dS )� )�GObjectNZgobject)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�Zone)�ifcfg_set_zone_of_interface)�DEFAULT_ZONE_TARGET)� Rich_Rule)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�errors)�
FirewallError)�portStr�portInPortRange�coalescePortRange�breakPortRangec s� e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z
e d d
� �Zeejd d d
�e d�dd���Zeejddd
�e d�dd���Zejjjejj�eejdd�e d�dd����Zejjejdd�dd � �Zejjjejj�eejdd �e d�� fd d � ���Z eejj d d �e d�d!d"���Z eejj dd �e d�d#d$���Z d%d&� Z eejj d d�e d�d'd(���Z!eejj dd�e d�d)d*���Z"eejj �e d�d+d,���Z#ejjejj dd�e d-d.� ��Z$eejj �e d�d/d0���Z%ejjejj dd�e d1d2� ��Z&eejj dd�e d�d3d4���Z'ejjejj dd�e d5d6� ��Z(eejj dd �e d�d7d8���Z)eejj dd�e d�d9d:���Z*eejj dd �e d�d;d<���Z+eejj dd�e d�d=d>���Z,eejj dd �e d�d?d@���Z-eejj dd�e d�dAdB���Z.eejj dd �e d�dCdD���Z/eejj dd�e d�dEdF���Z0eejj dGd �e d�dHdI���Z1eejj dGd�e d�dJdK���Z2eejj dd�e d�dLdM���Z3eejj dd�e d�dNdO���Z4eejj ddPd
�e d�dQdR���Z5eejj dSd �e d�dTdU���Z6eejj dSd�e d�dVdW���Z7eejj d d�e d�dXdY���Z8eejj d d�e d�dZd[���Z9eejj d dPd
�e d�d\d]���Z:eejj dGd �e d�d^d_���Z;eejj dGd�e d�d`da���Z<eejj dd�e d�dbdc���Z=eejj dd�e d�ddde���Z>eejj ddPd
�e d�dfdg���Z?eejj dSd �e d�dhdi���Z@eejj dSd�e d�djdk���ZAeejj d d�e d�dldm���ZBeejj d d�e d�dndo���ZCeejj d dPd
�e d�dpdq���ZDeejj dGd �e d�drds���ZEeejj dGd�e d�dtdu���ZFeejj dd�e d�dvdw���ZGeejj dd�e d�dxdy���ZHeejj ddPd
�e d�dzd{���ZIeejj dPd �e d�d|d}���ZJeejj dPd�e d�d~d���ZKeejj �e d�d�d����ZLeejj �e d�d�d����ZMeejj dPd �e d�d�d����ZNeejj dPd �e d�d�d����ZOeejj dPd�e d�d�d����ZPeejj �e d�d�d����ZQeejj �e d�d�d����ZReejj dPd �e d�d�d����ZSeejj d�d �e d�d�d����ZTeejj d�d�e d�d�d����ZUeejj d�d�e d�d�d����ZVeejj d�d�e d�d�d����ZWeejj d�dPd
�e d�d�d����ZXeejj dGd �e d�d�d����ZYeejj dGd�e d�d�d����ZZeejj dd�e d�d�d����Z[eejj dd�e d�d�d����Z\eejj ddPd
�e d�d�d����Z]eejj dGd �e d�d�d����Z^eejj dGd�e d�d�d����Z_eejj dd�e d�d�d����Z`eejj dd�e d�d�d����Zaeejj ddPd
�e d�d�d����Zbeejj dGd �e d�d�d����Zceejj dGd�e �d d�d����Zdeejj dd�e �dd�d����Zeeejj dd�e �dd�d����Zfeejj ddPd
�e �dd�d����Zg� ZhS ( �FirewallDConfigZonezFirewallD main classTc s\ t t| �j||� || _|| _|| _|| _|d | _|d | _d| j | _ t
| tj j � d S )Nr � zconfig.zone.%d)
�superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus�DBUS_INTERFACE_CONFIG_ZONE)�selfr ZconfZzoner �args�kwargs)� __class__� �!/usr/lib/python3.6/config_zone.pyr = s
z FirewallDConfigZone.__init__c C s d S )Nr% )r! r% r% r& �__del__J s zFirewallDConfigZone.__del__c C s | j � d S )N)Zremove_from_connection)r! r% r% r& �
unregisterN s z FirewallDConfigZone.unregisterc C s� |dkrt j| jj�S |dkr,t j| jj�S |dkrBt j| jj�S |dkrXt j| jj�S |dkrnt j| jj�S t j j
d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r) r* r ZBooleanr+ r, �
exceptions�
DBusException)r! �
property_namer% r% r& �
_get_propertyV s z!FirewallDConfigZone._get_propertyZss�v)� in_signature�
out_signatureNc C sL t |t�}t |t�}tjd| j||� |tjjkrBtjj d| ��| j
|�S )Nz%s.Get('%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r. r/ r1 )r! �interface_namer0 �senderr% r% r& �Getg s
zFirewallDConfigZone.Get�sza{sv}c C sd t |t�}tjd| j|� |tjjkr6tjj d| ��i }xd
D ]}| j
|�||< q@W tj |dd �S ) Nz%s.GetAll('%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existr) r* r r+ r, Zsv)� signature)r) r* r r+ r, ) r r5 r r6 r r r r r. r/ r1 Z
Dictionary)r! r7 r8 �ret�xr% r% r& �GetAllx s
zFirewallDConfigZone.GetAllZssv)r3 c C sl t |t�}t |t�}t |�}tjd| j|||� | jj|� |tjj krXtj
j d| ��tj
j d| ��d S )Nz%s.Set('%s', '%s', '%s')zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r5 r r6 r r � accessCheckr r r r. r/ )r! r7 r0 Z new_valuer8 r% r% r& �Set� s
zFirewallDConfigZone.Setzsa{sv}as)r; c C s2 t |t�}t |�}t |�}tjd| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r5 r r6 r )r! r7 Zchanged_propertiesZinvalidated_propertiesr% r% r& �PropertiesChanged� s
z%FirewallDConfigZone.PropertiesChanged)r4 c s8 t jd| j� tt| �j| j| jj� �}t | |t
j j �S )Nz%s.Introspect())
r Zdebug2r r r �
Introspectr r Zget_busr r r r )r! r8 �data)r$ r% r& rB � s
z FirewallDConfigZone.Introspectz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sD t jd| j� | jj| j�}|d tkr@t|�}d|d< t|�}|S )z get settings for zone
z%s.getSettings()� r+ ) r r6 r r Zget_zone_configr r �list�tuple)r! r8 �settings� _settingsr% r% r& � getSettings� s z FirewallDConfigZone.getSettingsc C s4 t jd| j� | jj| j�}|d tkr0d|d< |S )z get settings for zone
z%s.getSettings2()�targetr+ )r r6 r r �get_zone_config_dictr r )r! r8 rG r% r% r& � getSettings2� s
z FirewallDConfigZone.getSettings2c C s | j j| j�}d|kr"t|d �nt� }d|kr<t|d �nt� }t|t�rzt|tjd� �| }t|tjd� �| }nDd|kr�t|d �nt� }d|kr�t|d �nt� }|| }|| }x$|D ] } | jj | �r�t
t j | ��q�W x$|D ] }
| jj
|
�r�t
t j |
��q�W dS )a
Assignment of interfaces/sources to zones is different from other
zone settings in the sense that particular interface/zone can be
part of only one zone. So make sure added interfaces/sources have
not already been bound to another zone.�
interfaces�sourcesN)r rK r �set�
isinstancerF r Zindex_ofr ZgetZoneOfInterfacer r Z
ZONE_CONFLICTZgetZoneOfSource) r! rG Z old_settingsZ
old_ifacesZ old_sourcesZ added_ifacesZ
added_sourcesZ
new_ifacesZ new_sourcesZiface�sourcer% r% r& � _checkDuplicateInterfacesSources� s
z4FirewallDConfigZone._checkDuplicateInterfacesSourcesc C st t |�}tjd| j� | jj|� |d dkrFt|�}t|d< t|�}| j |� | j
j | j |�| _ | j
| j j� dS )z!update settings for zone
z%s.update('...')rD r+ N)r r r6 r r r? rE r rF rR r Zset_zone_configr �Updatedr) )r! rG r8 rH r% r% r& �update� s
zFirewallDConfigZone.updatec C sl t |�}tjd| j� | jj|� d|kr>|d dkr>t|d< | j|� | jj | j
|�| _
| j | j
j � dS )z!update settings for zone
z%s.update2('...')rJ r+ N)
r r r6 r r r? r rR r Zset_zone_config_dictr rS r) )r! rG r8 r% r% r& �update2� s
zFirewallDConfigZone.update2c C s< t jd| j� | jj|� | jj| j�| _| j| jj � dS )z/load default settings for builtin zone
z%s.loadDefaults()N)
r r6 r r r? r Zload_zone_defaultsr rS r) )r! r8 r% r% r& � loadDefaults s z FirewallDConfigZone.loadDefaultsc C s t jd| j|f � d S )Nz%s.Updated('%s'))r r6 r )r! r) r% r% r& rS s zFirewallDConfigZone.Updatedc C s: t jd| j� | jj|� | jj| j� | jj| j� dS )zremove zone
z%s.removeZone()N) r r6 r r r? r Z remove_zoner Z
removeZone)r! r8 r% r% r& �remove s zFirewallDConfigZone.removec C s t jd| j|f � d S )Nz%s.Removed('%s'))r r6 r )r! r) r% r% r& �Removed# s zFirewallDConfigZone.Removedc C sF t |t�}tjd| j|� | jj|� | jj| j |�| _ | j
|� dS )zrename zone
z%s.rename('%s')N) r r5 r r6 r r r? r Z rename_zoner �Renamed)r! r) r8 r% r% r& �rename* s
zFirewallDConfigZone.renamec C s t jd| j|f � d S )Nz%s.Renamed('%s'))r r6 r )r! r) r% r% r& rY 6 s zFirewallDConfigZone.Renamedc C s t jd| j� | j� d S )Nz%s.getVersion()r )r r6 r rI )r! r8 r% r% r& �
getVersion= s z FirewallDConfigZone.getVersionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setVersion('%s')r )
r r5 r r6 r r r? rE rI rT )r! �versionr8 rG r% r% r& �
setVersionD s
z FirewallDConfigZone.setVersionc C s t jd| j� | j� d S )Nz
%s.getShort()r )r r6 r rI )r! r8 r% r% r& �getShortQ s z FirewallDConfigZone.getShortc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setShort('%s')r )
r r5 r r6 r r r? rE rI rT )r! Zshortr8 rG r% r% r& �setShortX s
z FirewallDConfigZone.setShortc C s t jd| j� | j� d S )Nz%s.getDescription()� )r r6 r rI )r! r8 r% r% r& �getDescriptione s z"FirewallDConfigZone.getDescriptionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setDescription('%s')r` )
r r5 r r6 r r r? rE rI rT )r! � descriptionr8 rG r% r% r& �setDescriptionl s
z"FirewallDConfigZone.setDescriptionc C s. t jd| j� | j� }|d tkr*|d S dS )Nz%s.getTarget()rD r+ )r r6 r rI r )r! r8 rG r% r% r& � getTarget| s z FirewallDConfigZone.getTargetc C sT t |t�}tjd| j|� | jj|� t| j� �}|dkr>|nt |d< | j
|� d S )Nz%s.setTarget('%s')r+ rD ) r r5 r r6 r r r? rE rI r rT )r! rJ r8 rG r% r% r& � setTarget� s
z FirewallDConfigZone.setTarget�asc C s t jd| j� | j� d S )Nz%s.getServices()� )r r6 r rI )r! r8 r% r% r& � getServices� s z FirewallDConfigZone.getServicesc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setServices('[%s]')�,rg )
r rE r r6 r �joinr r? rI rT )r! Zservicesr8 rG r% r% r& � setServices� s
z FirewallDConfigZone.setServicesc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addService('%s')rg )r r5 r r6 r r r? rE rI r r �ALREADY_ENABLED�appendrT )r! �servicer8 rG r% r% r& �
addService� s
z FirewallDConfigZone.addServicec C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.removeService('%s')rg )r r5 r r6 r r r? rE rI r r � NOT_ENABLEDrW rT )r! rn r8 rG r% r% r& �
removeService� s
z!FirewallDConfigZone.removeService�bc C s* t |t�}tjd| j|� || j� d kS )Nz%s.queryService('%s')rg )r r5 r r6 r rI )r! rn r8 r% r% r& � queryService� s
z FirewallDConfigZone.queryServiceza(ss)c C s t jd| j� | j� d S )Nz
%s.getPorts()� )r r6 r rI )r! r8 r% r% r& �getPorts� s z FirewallDConfigZone.getPortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setPorts('[%s]')ri c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr% )�.0�portr% r% r& � <genexpr>� s z/FirewallDConfigZone.setPorts.<locals>.<genexpr>rt )
r rE rP rm rF r r6 r rj r r? rI rT )r! �portsr8 �_portsrw rG r% r% r& �setPorts� s
z FirewallDConfigZone.setPortsc
s� t |t�}t � t�� tjd| j|� � | jj|� t| j� �}tt � fdd�|d ��}x.|D ]&}t
||d �r^t t j
d|� f ��q^W t|dd� |D ��\}}x$|D ] } |d jt| d �� f� q�W x$|D ] } |d jt| d �� f� q�W | j|� d S )
Nz%s.addPort('%s', '%s')c s | d � kS )Nr r% )r= )�protocolr% r& �<lambda>� s z-FirewallDConfigZone.addPort.<locals>.<lambda>rt r z%s:%sc S s g | ] \}}|�qS r% r% )rv �_port� _protocolr% r% r& �
<listcomp>� s z/FirewallDConfigZone.addPort.<locals>.<listcomp>�-)r r5 r r6 r r r? rE rI �filterr r r rl r rW r rm rT )
r! rw r| r8 rG �existing_port_ids�port_id� added_ranges�removed_ranges�ranger% )r| r& �addPort� s"
zFirewallDConfigZone.addPortc
s� t |t�}t � t�� tjd| j|� � | jj|� t| j� �}tt � fdd�|d ��}x0|D ]}t
||d �r^P q^W t t j
d|� f ��t|dd� |D ��\}}x$|D ] } |d jt| d �� f� q�W x$|D ] } |d jt| d �� f� q�W | j|� d S )
Nz%s.removePort('%s', '%s')c s | d � kS )Nr r% )r= )r| r% r& r} s z0FirewallDConfigZone.removePort.<locals>.<lambda>rt r z%s:%sc S s g | ] \}}|�qS r% r% )rv r~ r r% r% r& r� s z2FirewallDConfigZone.removePort.<locals>.<listcomp>r� )r r5 r r6 r r r? rE rI r� r r r rp r rW r rm rT )
r! rw r| r8 rG r� r� r� r� r� r% )r| r& �
removePort� s"
z FirewallDConfigZone.removePortc C sZ t |t�}t |t�}tjd| j||� x.| j� d D ] \}}t||�r4||kr4dS q4W dS )Nz%s.queryPort('%s', '%s')rt TF)r r5 r r6 r rI r )r! rw r| r8 r~ r r% r% r& � queryPort s
z FirewallDConfigZone.queryPortc C s t jd| j� | j� d S )Nz%s.getProtocols()�
)r r6 r rI )r! r8 r% r% r& � getProtocols s z FirewallDConfigZone.getProtocolsc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setProtocols('[%s]')ri r� )
r rE r r6 r rj r r? rI rT )r! Z protocolsr8 rG r% r% r& � setProtocols& s
z FirewallDConfigZone.setProtocolsc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addProtocol('%s')r� )r r5 r r6 r r r? rE rI r r rl rm rT )r! r| r8 rG r% r% r& � addProtocol2 s
z FirewallDConfigZone.addProtocolc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.removeProtocol('%s')r� )r r5 r r6 r r r? rE rI r r rp rW rT )r! r| r8 rG r% r% r& �removeProtocol? s
z"FirewallDConfigZone.removeProtocolc C s* t |t�}tjd| j|� || j� d kS )Nz%s.queryProtocol('%s')r� )r r5 r r6 r rI )r! r| r8 r% r% r& �
queryProtocolL s
z!FirewallDConfigZone.queryProtocolc C s t jd| j� | j� d S )Nz%s.getSourcePorts()� )r r6 r rI )r! r8 r% r% r& �getSourcePortsV s z"FirewallDConfigZone.getSourcePortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setSourcePorts('[%s]')ri c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr% )rv rw r% r% r& rx j s z5FirewallDConfigZone.setSourcePorts.<locals>.<genexpr>r� )
r rE rP rm rF r r6 r rj r r? rI rT )r! ry r8 rz rw rG r% r% r& �setSourcePorts] s
z"FirewallDConfigZone.setSourcePortsc
s� t |t�}t � t�� tjd| j|� � | jj|� t| j� �}tt � fdd�|d ��}x.|D ]&}t
||d �r^t t j
d|� f ��q^W t|dd� |D ��\}}x$|D ] } |d jt| d �� f� q�W x$|D ] } |d jt| d �� f� q�W | j|� d S )
Nz %s.addSourcePort('%s', '%s')c s | d � kS )Nr r% )r= )r| r% r& r} z s z3FirewallDConfigZone.addSourcePort.<locals>.<lambda>r� r z%s:%sc S s g | ] \}}|�qS r% r% )rv r~ r r% r% r& r� s z5FirewallDConfigZone.addSourcePort.<locals>.<listcomp>r� )r r5 r r6 r r r? rE rI r� r r r rl r rW r rm rT )
r! rw r| r8 rG r� r� r� r� r� r% )r| r& �
addSourcePortp s"
z!FirewallDConfigZone.addSourcePortc
s� t |t�}t � t�� tjd| j|� � | jj|� t| j� �}tt � fdd�|d ��}x0|D ]}t
||d �r^P q^W t t j
d|� f ��t|dd� |D ��\}}x$|D ] } |d jt| d �� f� q�W x$|D ] } |d jt| d �� f� q�W | j|� d S )
Nz %s.removeSourcePort('%s', '%s')c s | d � kS )Nr r% )r= )r| r% r& r} � s z6FirewallDConfigZone.removeSourcePort.<locals>.<lambda>r� r z%s:%sc S s g | ] \}}|�qS r% r% )rv r~ r r% r% r& r� � s z8FirewallDConfigZone.removeSourcePort.<locals>.<listcomp>r� )r r5 r r6 r r r? rE rI r� r r r rp r rW r rm rT )
r! rw r| r8 rG r� r� r� r� r� r% )r| r& �removeSourcePort� s"
z$FirewallDConfigZone.removeSourcePortc C sZ t |t�}t |t�}tjd| j||� x.| j� d D ] \}}t||�r4||kr4dS q4W dS )Nz %s.querySourcePort('%s', '%s')r� TF)r r5 r r6 r rI r )r! rw r| r8 r~ r r% r% r& �querySourcePort� s
z#FirewallDConfigZone.querySourcePortc C s t jd| j� | j� d S )Nz%s.getIcmpBlocks()� )r r6 r rI )r! r8 r% r% r& �
getIcmpBlocks� s z!FirewallDConfigZone.getIcmpBlocksc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setIcmpBlocks('[%s]')ri r� )
r rE r r6 r rj r r? rI rT )r! Z icmptypesr8 rG r% r% r& �
setIcmpBlocks� s
z!FirewallDConfigZone.setIcmpBlocksc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addIcmpBlock('%s')r� )r r5 r r6 r r r? rE rI r r rl rm rT )r! �icmptyper8 rG r% r% r& � addIcmpBlock� s
z FirewallDConfigZone.addIcmpBlockc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.removeIcmpBlock('%s')r� )r r5 r r6 r r r? rE rI r r rp rW rT )r! r� r8 rG r% r% r& �removeIcmpBlock� s
z#FirewallDConfigZone.removeIcmpBlockc C s* t |t�}tjd| j|� || j� d kS )Nz%s.queryIcmpBlock('%s')r� )r r5 r r6 r rI )r! r� r8 r% r% r& �queryIcmpBlock� s
z"FirewallDConfigZone.queryIcmpBlockc C s t jd| j� | j� d S )Nz%s.getIcmpBlockInversion()� )r r6 r rI )r! r8 r% r% r& �getIcmpBlockInversion� s z)FirewallDConfigZone.getIcmpBlockInversionc C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz %s.setIcmpBlockInversion('%s')r� )
r �boolr r6 r r r? rE rI rT )r! �flagr8 rG r% r% r& �setIcmpBlockInversion� s
z)FirewallDConfigZone.setIcmpBlockInversionc C sP t jd| j� | jj|� t| j� �}|d r:ttj d��d|d< | j
|� d S )Nz%s.addIcmpBlockInversion()r� zicmp-block-inversionT) r r6 r r r? rE rI r r rl rT )r! r8 rG r% r% r& �addIcmpBlockInversion� s z)FirewallDConfigZone.addIcmpBlockInversionc C sP t jd| j� | jj|� t| j� �}|d s:ttj d��d|d< | j
|� d S )Nz %s.removeIcmpBlockInversion()r� zicmp-block-inversionF) r r6 r r r? rE rI r r rp rT )r! r8 rG r% r% r& �removeIcmpBlockInversion s z,FirewallDConfigZone.removeIcmpBlockInversionc C s t jd| j� | j� d S )Nz %s.queryIcmpBlockInversion()r� )r r6 r rI )r! r8 r% r% r& �queryIcmpBlockInversion s z+FirewallDConfigZone.queryIcmpBlockInversionc C s t jd| j� | j� d S )Nz%s.getMasquerade()� )r r6 r rI )r! r8 r% r% r& �
getMasquerade s z!FirewallDConfigZone.getMasqueradec C sH t |t�}tjd| j|� | jj|� t| j� �}||d< | j |� d S )Nz%s.setMasquerade('%s')r� )
r r� r r6 r r r? rE rI rT )r! �
masquerader8 rG r% r% r& �
setMasquerade s
z!FirewallDConfigZone.setMasqueradec C sP t jd| j� | jj|� t| j� �}|d r:ttj d��d|d< | j
|� d S )Nz%s.addMasquerade()r� r� T) r r6 r r r? rE rI r r rl rT )r! r8 rG r% r% r& �
addMasquerade' s z!FirewallDConfigZone.addMasqueradec C sP t jd| j� | jj|� t| j� �}|d s:ttj d��d|d< | j
|� d S )Nz%s.removeMasquerade()r� r� F) r r6 r r r? rE rI r r rp rT )r! r8 rG r% r% r& �removeMasquerade2 s z$FirewallDConfigZone.removeMasqueradec C s t jd| j� | j� d S )Nz%s.queryMasquerade()r� )r r6 r rI )r! r8 r% r% r& �queryMasquerade= s z#FirewallDConfigZone.queryMasqueradeza(ssss)c C s t jd| j� | j� d S )Nz%s.getForwardPorts()� )r r6 r rI )r! r8 r% r% r& �getForwardPortsF s z#FirewallDConfigZone.getForwardPortsc C s� g }x6t |t�D ](}t|t�r.|jt|�� q|j|� qW |}tjd| jdjdd� |D ��� | j j
|� t| j � �}||d< | j |� d S )Nz%s.setForwardPorts('[%s]')ri c s s. | ]&}d |d |d |d |d f V qdS )z('%s, '%s', '%s', '%s')r r r` � Nr% )rv rw r% r% r& rx Z s z6FirewallDConfigZone.setForwardPorts.<locals>.<genexpr>r� )
r rE rP rm rF r r6 r rj r r? rI rT )r! ry r8 rz rw rG r% r% r& �setForwardPortsM s
z#FirewallDConfigZone.setForwardPortsZssssc C s� t |t�}t |t�}t |t�}t |t�}tjd| j||||� | jj|� ||t|�t|�f}t| j� �}||d kr�t t
j d||||f ��|d j |� | j
|� d S )Nz)%s.addForwardPort('%s', '%s', '%s', '%s')r� z %s:%s:%s:%s)r r5 r r6 r r r? rE rI r r rl rm rT )r! rw r| �toport�toaddrr8 �fwp_idrG r% r% r& �addForwardPorta s
z"FirewallDConfigZone.addForwardPortc C s� t |t�}t |t�}t |t�}t |t�}tjd| j||||� | jj|� ||t|�t|�f}t| j� �}||d kr�t t
j d||||f ��|d j |� | j
|� d S )Nz,%s.removeForwardPort('%s', '%s', '%s', '%s')r� z %s:%s:%s:%s)r r5 r r6 r r r? rE rI r r rp rW rT )r! rw r| r� r� r8 r� rG r% r% r& �removeForwardPortu s
z%FirewallDConfigZone.removeForwardPortc C sb t |t�}t |t�}t |t�}t |t�}tjd| j||||� ||t|�t|�f}|| j� d kS )Nz+%s.queryForwardPort('%s', '%s', '%s', '%s')r� )r r5 r r6 r rI )r! rw r| r� r� r8 r� r% r% r& �queryForwardPort� s
z$FirewallDConfigZone.queryForwardPortc C s t jd| j� | j� d S )Nz%s.getInterfaces()�
)r r6 r rI )r! r8 r% r% r& �
getInterfaces� s z!FirewallDConfigZone.getInterfacesc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setInterfaces('[%s]')ri r� )
r rE r r6 r rj r r? rI rT )r! rM r8 rG r% r% r& �
setInterfaces� s
z!FirewallDConfigZone.setInterfacesc C st t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� t| jj|� d S )Nz%s.addInterface('%s')r� )r r5 r r6 r r r? rE rI r r rl rm rT r r r) )r! � interfacer8 rG r% r% r& � addInterface� s
z FirewallDConfigZone.addInterfacec C sp t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� td|� d S )Nz%s.removeInterface('%s')r� � )r r5 r r6 r r r? rE rI r r rp rW rT r )r! r� r8 rG r% r% r& �removeInterface� s
z#FirewallDConfigZone.removeInterfacec C s* t |t�}tjd| j|� || j� d kS )Nz%s.queryInterface('%s')r� )r r5 r r6 r rI )r! r� r8 r% r% r& �queryInterface� s
z"FirewallDConfigZone.queryInterfacec C s t jd| j� | j� d S )Nz%s.getSources()� )r r6 r rI )r! r8 r% r% r& �
getSources� s z FirewallDConfigZone.getSourcesc C sN t |t�}tjd| jdj|�� | jj|� t| j� �}||d< | j |� d S )Nz%s.setSources('[%s]')ri r� )
r rE r r6 r rj r r? rI rT )r! rN r8 rG r% r% r& �
setSources� s
z FirewallDConfigZone.setSourcesc C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.addSource('%s')r� )r r5 r r6 r r r? rE rI r r rl rm rT )r! rQ r8 rG r% r% r& � addSource� s
z FirewallDConfigZone.addSourcec C sf t |t�}tjd| j|� | jj|� t| j� �}||d krJt t
j |��|d j |� | j
|� d S )Nz%s.removeSource('%s')r� )r r5 r r6 r r r? rE rI r r rp rW rT )r! rQ r8 rG r% r% r& � removeSource� s
z FirewallDConfigZone.removeSourcec C s* t |t�}tjd| j|� || j� d kS )Nz%s.querySource('%s')r� )r r5 r r6 r rI )r! rQ r8 r% r% r& � querySource s
z FirewallDConfigZone.querySourcec C s t jd| j� | j� d S )Nz%s.getRichRules()� )r r6 r rI )r! r8 r% r% r& � getRichRules s z FirewallDConfigZone.getRichRulesc C s\ t |t�}tjd| jdj|�� | jj|� t| j� �}dd� |D �}||d< | j |� d S )Nz%s.setRichRules('[%s]')ri c S s g | ]}t t|d ���qS ))�rule_str)r5 r
)rv �rr% r% r& r� s z4FirewallDConfigZone.setRichRules.<locals>.<listcomp>r� )
r rE r r6 r rj r r? rI rT )r! Zrulesr8 rG r% r% r& � setRichRules s
z FirewallDConfigZone.setRichRulesc C st t |t�}tjd| j|� | jj|� t| j� �}tt |d��}||d krXt
t j |��|d j
|� | j|� d S )Nz%s.addRichRule('%s'))r� r� )r r5 r r6 r r r? rE rI r
r r rl rm rT )r! �ruler8 rG r� r% r% r& � addRichRule s
z FirewallDConfigZone.addRichRulec C st t |t�}tjd| j|� | jj|� t| j� �}tt |d��}||d krXt
t j |��|d j
|� | j|� d S )Nz%s.removeRichRule('%s'))r� r� )r r5 r r6 r r r? rE rI r
r r rp rW rT )r! r� r8 rG r� r% r% r& �removeRichRule. s
z"FirewallDConfigZone.removeRichRulec C s8 t |t�}tjd| j|� tt|d��}|| j� d kS )Nz%s.queryRichRule('%s'))r� r� )r r5 r r6 r r
rI )r! r� r8 r� r% r% r& �
queryRichRule< s
z!FirewallDConfigZone.queryRichRule)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)i�__name__�
__module__� __qualname__�__doc__Z
persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r
r' r( r1 r ZPROPERTIES_IFACEr9 r> �slipZpolkitZ require_authr@ rn �signalrA ZPK_ACTION_INFOZINTROSPECTABLE_IFACErB r rI rL rR rT rU rV rS rW rX rZ rY r[ r] r^ r_ ra rc rd re rh rk ro rq rs ru r{ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� �
__classcell__r% r% )r$ r& r 5 sf
r )(Z
gi.repositoryr �sys�modulesr Z dbus.serviceZ slip.dbusr� Zslip.dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.zoner Zfirewall.core.fw_ifcfgr Zfirewall.core.baser Zfirewall.core.richr
Zfirewall.core.loggerr Zfirewall.server.decoratorsr r
r r Zfirewall.errorsr Zfirewall.functionsr r r r rn ZObjectr r% r% r% r& �<module> s$
server/__pycache__/__init__.cpython-36.pyc 0000644 00000000161 15035135172 0014447 0 ustar 00 3
��g � @ s d S )N� r r r � /usr/lib/python3.6/__init__.py�<module> s server/__pycache__/__init__.cpython-36.opt-1.pyc 0000644 00000000161 15035135172 0015406 0 ustar 00 3
��g � @ s d S )N� r r r � /usr/lib/python3.6/__init__.py�<module> s server/config_ipset.py 0000644 00000044572 15035135172 0011113 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2015-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
# force use of pygobject3 in python-slip
from gi.repository import GObject
import sys
sys.modules['gobject'] = GObject
import dbus
import dbus.service
import slip.dbus
import slip.dbus.service
from firewall import config
from firewall.dbus_utils import dbus_to_python, \
dbus_introspection_prepare_properties, \
dbus_introspection_add_properties
from firewall.core.io.ipset import IPSet
from firewall.core.ipset import IPSET_TYPES, normalize_ipset_entry, \
check_entry_overlaps_existing, \
check_for_overlapping_entries
from firewall.core.logger import log
from firewall.server.decorators import handle_exceptions, \
dbus_handle_exceptions, dbus_service_method
from firewall import errors
from firewall.errors import FirewallError
############################################################################
#
# class FirewallDConfigIPSet
#
############################################################################
class FirewallDConfigIPSet(slip.dbus.service.Object):
"""FirewallD main class"""
persistent = True
""" Make FirewallD persistent. """
default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG
""" Use PK_ACTION_INFO as a default """
@handle_exceptions
def __init__(self, parent, conf, ipset, item_id, *args, **kwargs):
super(FirewallDConfigIPSet, self).__init__(*args, **kwargs)
self.parent = parent
self.config = conf
self.obj = ipset
self.item_id = item_id
self.busname = args[0]
self.path = args[1]
self._log_prefix = "config.ipset.%d" % self.item_id
dbus_introspection_prepare_properties(
self, config.dbus.DBUS_INTERFACE_CONFIG_IPSET)
@dbus_handle_exceptions
def __del__(self):
pass
@dbus_handle_exceptions
def unregister(self):
self.remove_from_connection()
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# P R O P E R T I E S
@dbus_handle_exceptions
def _get_property(self, property_name):
if property_name == "name":
return dbus.String(self.obj.name)
elif property_name == "filename":
return dbus.String(self.obj.filename)
elif property_name == "path":
return dbus.String(self.obj.path)
elif property_name == "default":
return dbus.Boolean(self.obj.default)
elif property_name == "builtin":
return dbus.Boolean(self.obj.builtin)
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss',
out_signature='v')
@dbus_handle_exceptions
def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613
# get a property
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
log.debug1("%s.Get('%s', '%s')", self._log_prefix,
interface_name, property_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_IPSET:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
return self._get_property(property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s',
out_signature='a{sv}')
@dbus_handle_exceptions
def GetAll(self, interface_name, sender=None): # pylint: disable=W0613
interface_name = dbus_to_python(interface_name, str)
log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_IPSET:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
ret = { }
for x in [ "name", "filename", "path", "default", "builtin" ]:
ret[x] = self._get_property(x)
return dbus.Dictionary(ret, signature="sv")
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv')
@dbus_handle_exceptions
def Set(self, interface_name, property_name, new_value, sender=None):
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
new_value = dbus_to_python(new_value)
log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix,
interface_name, property_name, new_value)
self.parent.accessCheck(sender)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_IPSET:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.PropertyReadOnly: "
"Property '%s' is read-only" % property_name)
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as')
def PropertiesChanged(self, interface_name, changed_properties,
invalidated_properties):
interface_name = dbus_to_python(interface_name, str)
changed_properties = dbus_to_python(changed_properties)
invalidated_properties = dbus_to_python(invalidated_properties)
log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix,
interface_name, changed_properties, invalidated_properties)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s')
@dbus_handle_exceptions
def Introspect(self, sender=None): # pylint: disable=W0613
log.debug2("%s.Introspect()", self._log_prefix)
data = super(FirewallDConfigIPSet, self).Introspect(
self.path, self.busname.get_bus())
return dbus_introspection_add_properties(
self, data, config.dbus.DBUS_INTERFACE_CONFIG_IPSET)
# S E T T I N G S
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
out_signature=IPSet.DBUS_SIGNATURE)
@dbus_handle_exceptions
def getSettings(self, sender=None): # pylint: disable=W0613
"""get settings for ipset
"""
log.debug1("%s.getSettings()", self._log_prefix)
return self.config.get_ipset_config(self.obj)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature=IPSet.DBUS_SIGNATURE)
@dbus_handle_exceptions
def update(self, settings, sender=None):
"""update settings for ipset
"""
settings = dbus_to_python(settings)
log.debug1("%s.update('...')", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.set_ipset_config(self.obj, settings)
self.Updated(self.obj.name)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET)
@dbus_handle_exceptions
def loadDefaults(self, sender=None):
"""load default settings for builtin ipset
"""
log.debug1("%s.loadDefaults()", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.load_ipset_defaults(self.obj)
self.Updated(self.obj.name)
#self.PropertiesChanged(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
# { "default": True }, [ ])
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, signature='s')
@dbus_handle_exceptions
def Updated(self, name):
log.debug1("%s.Updated('%s')" % (self._log_prefix, name))
# R E M O V E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET)
@dbus_handle_exceptions
def remove(self, sender=None):
"""remove ipset
"""
log.debug1("%s.remove()", self._log_prefix)
self.parent.accessCheck(sender)
self.config.remove_ipset(self.obj)
self.parent.removeIPSet(self.obj)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, signature='s')
@dbus_handle_exceptions
def Removed(self, name):
log.debug1("%s.Removed('%s')" % (self._log_prefix, name))
# R E N A M E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='s')
@dbus_handle_exceptions
def rename(self, name, sender=None):
"""rename ipset
"""
name = dbus_to_python(name, str)
log.debug1("%s.rename('%s')", self._log_prefix, name)
self.parent.accessCheck(sender)
self.obj = self.config.rename_ipset(self.obj, name)
self.Renamed(name)
#self.PropertiesChanged(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
# { "name": name }, [ ])
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, signature='s')
@dbus_handle_exceptions
def Renamed(self, name):
log.debug1("%s.Renamed('%s')" % (self._log_prefix, name))
# version
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
out_signature='s')
@dbus_handle_exceptions
def getVersion(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getVersion()", self._log_prefix)
return self.getSettings()[0]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='s')
@dbus_handle_exceptions
def setVersion(self, version, sender=None):
version = dbus_to_python(version, str)
log.debug1("%s.setVersion('%s')", self._log_prefix, version)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[0] = version
self.update(settings)
# short
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
out_signature='s')
@dbus_handle_exceptions
def getShort(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getShort()", self._log_prefix)
return self.getSettings()[1]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='s')
@dbus_handle_exceptions
def setShort(self, short, sender=None):
short = dbus_to_python(short, str)
log.debug1("%s.setShort('%s')", self._log_prefix, short)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[1] = short
self.update(settings)
# description
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
out_signature='s')
@dbus_handle_exceptions
def getDescription(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getDescription()", self._log_prefix)
return self.getSettings()[2]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='s')
@dbus_handle_exceptions
def setDescription(self, description, sender=None):
description = dbus_to_python(description, str)
log.debug1("%s.setDescription('%s')", self._log_prefix,
description)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[2] = description
self.update(settings)
# type
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
out_signature='s')
@dbus_handle_exceptions
def getType(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getType()", self._log_prefix)
return self.getSettings()[3]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='s')
@dbus_handle_exceptions
def setType(self, ipset_type, sender=None):
ipset_type = dbus_to_python(ipset_type, str)
log.debug1("%s.setType('%s')", self._log_prefix, ipset_type)
self.parent.accessCheck(sender)
if ipset_type not in IPSET_TYPES:
raise FirewallError(errors.INVALID_TYPE, ipset_type)
settings = list(self.getSettings())
settings[3] = ipset_type
self.update(settings)
# options
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
out_signature='a{ss}')
@dbus_handle_exceptions
def getOptions(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getOptions()", self._log_prefix)
return self.getSettings()[4]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='a{ss}')
@dbus_handle_exceptions
def setOptions(self, options, sender=None):
options = dbus_to_python(options, dict)
log.debug1("%s.setOptions('[%s]')", self._log_prefix,
repr(options))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[4] = options
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='ss')
@dbus_handle_exceptions
def addOption(self, key, value, sender=None):
key = dbus_to_python(key, str)
value = dbus_to_python(value, str)
log.debug1("%s.addOption('%s', '%s')", self._log_prefix, key, value)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if key in settings[4] and settings[4][key] == value:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s': '%s'" % (key, value))
settings[4][key] = value
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='s')
@dbus_handle_exceptions
def removeOption(self, key, sender=None):
key = dbus_to_python(key, str)
log.debug1("%s.removeOption('%s')", self._log_prefix, key)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if key not in settings[4]:
raise FirewallError(errors.NOT_ENABLED, key)
del settings[4][key]
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='ss',
out_signature='b')
@dbus_handle_exceptions
def queryOption(self, key, value, sender=None): # pylint: disable=W0613
key = dbus_to_python(key, str)
value = dbus_to_python(value, str)
log.debug1("%s.queryOption('%s', '%s')", self._log_prefix, key,
value)
settings = list(self.getSettings())
return (key in settings[4] and settings[4][key] == value)
# entries
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
out_signature='as')
@dbus_handle_exceptions
def getEntries(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getEntries()", self._log_prefix)
return self.getSettings()[5]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='as')
@dbus_handle_exceptions
def setEntries(self, entries, sender=None):
entries = dbus_to_python(entries, list)
check_for_overlapping_entries(entries)
log.debug1("%s.setEntries('[%s]')", self._log_prefix,
",".join(entries))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if "timeout" in settings[4] and settings[4]["timeout"] != "0":
raise FirewallError(errors.IPSET_WITH_TIMEOUT)
settings[5] = entries
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='s')
@dbus_handle_exceptions
def addEntry(self, entry, sender=None):
entry = dbus_to_python(entry, str)
entry = normalize_ipset_entry(entry)
log.debug1("%s.addEntry('%s')", self._log_prefix, entry)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if "timeout" in settings[4] and settings[4]["timeout"] != "0":
raise FirewallError(errors.IPSET_WITH_TIMEOUT)
if entry in settings[5]:
raise FirewallError(errors.ALREADY_ENABLED, entry)
check_entry_overlaps_existing(entry, settings[5])
settings[5].append(entry)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='s')
@dbus_handle_exceptions
def removeEntry(self, entry, sender=None):
entry = dbus_to_python(entry, str)
entry = normalize_ipset_entry(entry)
log.debug1("%s.removeEntry('%s')", self._log_prefix, entry)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if "timeout" in settings[4] and settings[4]["timeout"] != "0":
raise FirewallError(errors.IPSET_WITH_TIMEOUT)
if entry not in settings[5]:
raise FirewallError(errors.NOT_ENABLED, entry)
settings[5].remove(entry)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryEntry(self, entry, sender=None): # pylint: disable=W0613
entry = dbus_to_python(entry, str)
entry = normalize_ipset_entry(entry)
log.debug1("%s.queryEntry('%s')", self._log_prefix, entry)
settings = list(self.getSettings())
if "timeout" in settings[4] and settings[4]["timeout"] != "0":
raise FirewallError(errors.IPSET_WITH_TIMEOUT)
return entry in settings[5]
server/config.py 0000644 00000211644 15035135172 0007703 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
# force use of pygobject3 in python-slip
from gi.repository import GObject
import sys
sys.modules['gobject'] = GObject
import os
import dbus
import dbus.service
import slip.dbus
import slip.dbus.service
from firewall import config
from firewall.core.base import DEFAULT_ZONE_TARGET
from firewall.core.watcher import Watcher
from firewall.core.logger import log
from firewall.server.decorators import handle_exceptions, \
dbus_handle_exceptions, dbus_service_method
from firewall.server.config_icmptype import FirewallDConfigIcmpType
from firewall.server.config_service import FirewallDConfigService
from firewall.server.config_zone import FirewallDConfigZone
from firewall.server.config_policy import FirewallDConfigPolicy
from firewall.server.config_ipset import FirewallDConfigIPSet
from firewall.server.config_helper import FirewallDConfigHelper
from firewall.core.io.icmptype import IcmpType
from firewall.core.io.ipset import IPSet
from firewall.core.io.helper import Helper
from firewall.core.io.lockdown_whitelist import LockdownWhitelist
from firewall.core.io.direct import Direct
from firewall.dbus_utils import dbus_to_python, \
command_of_sender, context_of_sender, uid_of_sender, user_of_uid, \
dbus_introspection_prepare_properties, \
dbus_introspection_add_properties
from firewall import errors
from firewall.errors import FirewallError
############################################################################
#
# class FirewallDConfig
#
############################################################################
class FirewallDConfig(slip.dbus.service.Object):
"""FirewallD main class"""
persistent = True
""" Make FirewallD persistent. """
default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG
""" Use config.dbus.PK_ACTION_INFO as a default """
@handle_exceptions
def __init__(self, conf, *args, **kwargs):
super(FirewallDConfig, self).__init__(*args, **kwargs)
self.config = conf
self.busname = args[0]
self.path = args[1]
self._init_vars()
self.watcher = Watcher(self.watch_updater, 5)
self.watcher.add_watch_dir(config.FIREWALLD_IPSETS)
self.watcher.add_watch_dir(config.ETC_FIREWALLD_IPSETS)
self.watcher.add_watch_dir(config.FIREWALLD_ICMPTYPES)
self.watcher.add_watch_dir(config.ETC_FIREWALLD_ICMPTYPES)
self.watcher.add_watch_dir(config.FIREWALLD_HELPERS)
self.watcher.add_watch_dir(config.ETC_FIREWALLD_HELPERS)
self.watcher.add_watch_dir(config.FIREWALLD_SERVICES)
self.watcher.add_watch_dir(config.ETC_FIREWALLD_SERVICES)
self.watcher.add_watch_dir(config.FIREWALLD_ZONES)
self.watcher.add_watch_dir(config.ETC_FIREWALLD_ZONES)
self.watcher.add_watch_dir(config.FIREWALLD_POLICIES)
self.watcher.add_watch_dir(config.ETC_FIREWALLD_POLICIES)
# Add watches for combined zone directories
if os.path.exists(config.ETC_FIREWALLD_ZONES):
for filename in sorted(os.listdir(config.ETC_FIREWALLD_ZONES)):
path = "%s/%s" % (config.ETC_FIREWALLD_ZONES, filename)
if os.path.isdir(path):
self.watcher.add_watch_dir(path)
self.watcher.add_watch_file(config.LOCKDOWN_WHITELIST)
self.watcher.add_watch_file(config.FIREWALLD_DIRECT)
self.watcher.add_watch_file(config.FIREWALLD_CONF)
dbus_introspection_prepare_properties(self,
config.dbus.DBUS_INTERFACE_CONFIG,
{ "CleanupOnExit": "readwrite",
"CleanupModulesOnExit": "readwrite",
"IPv6_rpfilter": "readwrite",
"Lockdown": "readwrite",
"MinimalMark": "readwrite",
"IndividualCalls": "readwrite",
"LogDenied": "readwrite",
"AutomaticHelpers": "readwrite",
"FirewallBackend": "readwrite",
"FlushAllOnReload": "readwrite",
"RFC3964_IPv4": "readwrite",
"AllowZoneDrifting": "readwrite",
})
@handle_exceptions
def _init_vars(self):
self.ipsets = [ ]
self.ipset_idx = 0
self.icmptypes = [ ]
self.icmptype_idx = 0
self.services = [ ]
self.service_idx = 0
self.zones = [ ]
self.zone_idx = 0
self.helpers = [ ]
self.helper_idx = 0
self.policy_objects = [ ]
self.policy_object_idx = 0
for ipset in self.config.get_ipsets():
self._addIPSet(self.config.get_ipset(ipset))
for icmptype in self.config.get_icmptypes():
self._addIcmpType(self.config.get_icmptype(icmptype))
for service in self.config.get_services():
self._addService(self.config.get_service(service))
for zone in self.config.get_zones():
self._addZone(self.config.get_zone(zone))
for helper in self.config.get_helpers():
self._addHelper(self.config.get_helper(helper))
for policy in self.config.get_policy_objects():
self._addPolicy(self.config.get_policy_object(policy))
@handle_exceptions
def __del__(self):
pass
@handle_exceptions
def reload(self):
while len(self.ipsets) > 0:
item = self.ipsets.pop()
item.unregister()
del item
while len(self.icmptypes) > 0:
item = self.icmptypes.pop()
item.unregister()
del item
while len(self.services) > 0:
item = self.services.pop()
item.unregister()
del item
while len(self.zones) > 0:
item = self.zones.pop()
item.unregister()
del item
while len(self.helpers) > 0:
item = self.helpers.pop()
item.unregister()
del item
while len(self.policy_objects) > 0:
item = self.policy_objects.pop()
item.unregister()
del item
self._init_vars()
@handle_exceptions
def watch_updater(self, name):
if name == config.FIREWALLD_CONF:
old_props = self.GetAll(config.dbus.DBUS_INTERFACE_CONFIG)
log.debug1("config: Reloading firewalld config file '%s'",
config.FIREWALLD_CONF)
try:
self.config.update_firewalld_conf()
except Exception as msg:
log.error("Failed to load firewalld.conf file '%s': %s" % \
(name, msg))
return
props = self.GetAll(config.dbus.DBUS_INTERFACE_CONFIG).copy()
for key in list(props.keys()):
if key in old_props and old_props[key] == props[key]:
del props[key]
if len(props) > 0:
self.PropertiesChanged(config.dbus.DBUS_INTERFACE_CONFIG,
props, [])
return
if (name.startswith(config.FIREWALLD_ICMPTYPES) or \
name.startswith(config.ETC_FIREWALLD_ICMPTYPES)) and \
name.endswith(".xml"):
try:
(what, obj) = self.config.update_icmptype_from_path(name)
except Exception as msg:
log.error("Failed to load icmptype file '%s': %s" % (name, msg))
return
if what == "new":
self._addIcmpType(obj)
elif what == "remove":
self.removeIcmpType(obj)
elif what == "update":
self._updateIcmpType(obj)
elif (name.startswith(config.FIREWALLD_SERVICES) or \
name.startswith(config.ETC_FIREWALLD_SERVICES)) and \
name.endswith(".xml"):
try:
(what, obj) = self.config.update_service_from_path(name)
except Exception as msg:
log.error("Failed to load service file '%s': %s" % (name, msg))
return
if what == "new":
self._addService(obj)
elif what == "remove":
self.removeService(obj)
elif what == "update":
self._updateService(obj)
elif name.startswith(config.FIREWALLD_ZONES) or \
name.startswith(config.ETC_FIREWALLD_ZONES):
if name.endswith(".xml"):
try:
(what, obj) = self.config.update_zone_from_path(name)
except Exception as msg:
log.error("Failed to load zone file '%s': %s" % (name, msg))
return
if what == "new":
self._addZone(obj)
elif what == "remove":
self.removeZone(obj)
elif what == "update":
self._updateZone(obj)
elif name.startswith(config.ETC_FIREWALLD_ZONES):
# possible combined zone base directory
_name = name.replace(config.ETC_FIREWALLD_ZONES, "").strip("/")
if len(_name) < 1 or "/" in _name:
# if there is a / in x, then it is a sub sub directory
# ignore it
return
if os.path.isdir(name):
if not self.watcher.has_watch(name):
self.watcher.add_watch_dir(name)
elif self.watcher.has_watch(name):
self.watcher.remove_watch(name)
elif (name.startswith(config.FIREWALLD_IPSETS) or \
name.startswith(config.ETC_FIREWALLD_IPSETS)) and \
name.endswith(".xml"):
try:
(what, obj) = self.config.update_ipset_from_path(name)
except Exception as msg:
log.error("Failed to load ipset file '%s': %s" % (name,
msg))
return
if what == "new":
self._addIPSet(obj)
elif what == "remove":
self.removeIPSet(obj)
elif what == "update":
self._updateIPSet(obj)
elif (name.startswith(config.FIREWALLD_HELPERS) or \
name.startswith(config.ETC_FIREWALLD_HELPERS)) and \
name.endswith(".xml"):
try:
(what, obj) = self.config.update_helper_from_path(name)
except Exception as msg:
log.error("Failed to load helper file '%s': %s" % (name,
msg))
return
if what == "new":
self._addHelper(obj)
elif what == "remove":
self.removeHelper(obj)
elif what == "update":
self._updateHelper(obj)
elif name == config.LOCKDOWN_WHITELIST:
try:
self.config.update_lockdown_whitelist()
except Exception as msg:
log.error("Failed to load lockdown whitelist file '%s': %s" % \
(name, msg))
return
self.LockdownWhitelistUpdated()
elif name == config.FIREWALLD_DIRECT:
try:
self.config.update_direct()
except Exception as msg:
log.error("Failed to load direct rules file '%s': %s" % (name,
msg))
return
self.Updated()
elif (name.startswith(config.FIREWALLD_POLICIES) or \
name.startswith(config.ETC_FIREWALLD_POLICIES)) and \
name.endswith(".xml"):
try:
(what, obj) = self.config.update_policy_object_from_path(name)
except Exception as msg:
log.error("Failed to load policy file '%s': %s" % (name, msg))
return
if what == "new":
self._addPolicy(obj)
elif what == "remove":
self.removePolicy(obj)
elif what == "update":
self._updatePolicy(obj)
@handle_exceptions
def _addIcmpType(self, obj):
# TODO: check for idx overflow
config_icmptype = FirewallDConfigIcmpType(
self, self.config, obj, self.icmptype_idx, self.busname,
"%s/%d" % (config.dbus.DBUS_PATH_CONFIG_ICMPTYPE,
self.icmptype_idx))
self.icmptypes.append(config_icmptype)
self.icmptype_idx += 1
self.IcmpTypeAdded(obj.name)
return config_icmptype
@handle_exceptions
def _updateIcmpType(self, obj):
for icmptype in self.icmptypes:
if icmptype.obj.name == obj.name and \
icmptype.obj.path == obj.path and \
icmptype.obj.filename == obj.filename:
icmptype.obj = obj
icmptype.Updated(obj.name)
@handle_exceptions
def removeIcmpType(self, obj):
index = 7 # see IMPORT_EXPORT_STRUCTURE in class Zone(IO_Object)
for zone in self.zones:
settings = zone.getSettings()
# if this IcmpType is used in a zone remove it from that zone first
if obj.name in settings[index]:
settings[index].remove(obj.name)
zone.obj = self.config.set_zone_config(zone.obj, settings)
zone.Updated(zone.obj.name)
for policy in self.policy_objects:
settings = policy.getSettings()
# if this IcmpType is used in a policy remove it from that policy first
if "icmp_blocks" in settings and obj.name in settings["icmp_blocks"]:
settings["icmp_blocks"].remove(obj.name)
policy.obj = self.config.set_policy_object_config_dict(policy.obj, settings)
policy.Updated(policy.obj.name)
for icmptype in self.icmptypes:
if icmptype.obj == obj:
icmptype.Removed(obj.name)
icmptype.unregister()
self.icmptypes.remove(icmptype)
del icmptype
@handle_exceptions
def _addService(self, obj):
# TODO: check for idx overflow
config_service = FirewallDConfigService(
self, self.config, obj, self.service_idx, self.busname,
"%s/%d" % (config.dbus.DBUS_PATH_CONFIG_SERVICE, self.service_idx))
self.services.append(config_service)
self.service_idx += 1
self.ServiceAdded(obj.name)
return config_service
@handle_exceptions
def _updateService(self, obj):
for service in self.services:
if service.obj.name == obj.name and \
service.obj.path == obj.path and \
service.obj.filename == obj.filename:
service.obj = obj
service.Updated(obj.name)
@handle_exceptions
def removeService(self, obj):
index = 5 # see IMPORT_EXPORT_STRUCTURE in class Zone(IO_Object)
for zone in self.zones:
settings = zone.getSettings()
# if this Service is used in a zone remove it from that zone first
if obj.name in settings[index]:
settings[index].remove(obj.name)
zone.obj = self.config.set_zone_config(zone.obj, settings)
zone.Updated(zone.obj.name)
for policy in self.policy_objects:
settings = policy.getSettings()
# if this Service is used in a policy remove it from that policy first
if "services" in settings and obj.name in settings["services"]:
settings["services"].remove(obj.name)
policy.obj = self.config.set_policy_object_config_dict(policy.obj, settings)
policy.Updated(policy.obj.name)
for service in self.services:
if service.obj == obj:
service.Removed(obj.name)
service.unregister()
self.services.remove(service)
del service
@handle_exceptions
def _addZone(self, obj):
# TODO: check for idx overflow
config_zone = FirewallDConfigZone(
self, self.config, obj, self.zone_idx, self.busname,
"%s/%d" % (config.dbus.DBUS_PATH_CONFIG_ZONE, self.zone_idx))
self.zones.append(config_zone)
self.zone_idx += 1
self.ZoneAdded(obj.name)
return config_zone
@handle_exceptions
def _updateZone(self, obj):
for zone in self.zones:
if zone.obj.name == obj.name and zone.obj.path == obj.path and \
zone.obj.filename == obj.filename:
zone.obj = obj
zone.Updated(obj.name)
@handle_exceptions
def removeZone(self, obj):
for zone in self.zones:
if zone.obj == obj:
zone.Removed(obj.name)
zone.unregister()
self.zones.remove(zone)
del zone
@handle_exceptions
def _addPolicy(self, obj):
# TODO: check for idx overflow
config_policy = FirewallDConfigPolicy(
self, self.config, obj, self.policy_object_idx, self.busname,
"%s/%d" % (config.dbus.DBUS_PATH_CONFIG_POLICY, self.policy_object_idx))
self.policy_objects.append(config_policy)
self.policy_object_idx += 1
self.PolicyAdded(obj.name)
return config_policy
@handle_exceptions
def _updatePolicy(self, obj):
for policy in self.policy_objects:
if policy.obj.name == obj.name and policy.obj.path == obj.path and \
policy.obj.filename == obj.filename:
policy.obj = obj
policy.Updated(obj.name)
@handle_exceptions
def removePolicy(self, obj):
for policy in self.policy_objects:
if policy.obj == obj:
policy.Removed(obj.name)
policy.unregister()
self.policy_objects.remove(policy)
del policy
@handle_exceptions
def _addIPSet(self, obj):
# TODO: check for idx overflow
config_ipset = FirewallDConfigIPSet(
self, self.config, obj, self.ipset_idx, self.busname,
"%s/%d" % (config.dbus.DBUS_PATH_CONFIG_IPSET, self.ipset_idx))
self.ipsets.append(config_ipset)
self.ipset_idx += 1
self.IPSetAdded(obj.name)
return config_ipset
@handle_exceptions
def _updateIPSet(self, obj):
for ipset in self.ipsets:
if ipset.obj.name == obj.name and ipset.obj.path == obj.path and \
ipset.obj.filename == obj.filename:
ipset.obj = obj
ipset.Updated(obj.name)
@handle_exceptions
def removeIPSet(self, obj):
for ipset in self.ipsets:
if ipset.obj == obj:
ipset.Removed(obj.name)
ipset.unregister()
self.ipsets.remove(ipset)
del ipset
# access check
@handle_exceptions
def _addHelper(self, obj):
# TODO: check for idx overflow
config_helper = FirewallDConfigHelper(
self, self.config, obj, self.helper_idx, self.busname,
"%s/%d" % (config.dbus.DBUS_PATH_CONFIG_HELPER, self.helper_idx))
self.helpers.append(config_helper)
self.helper_idx += 1
self.HelperAdded(obj.name)
return config_helper
@handle_exceptions
def _updateHelper(self, obj):
for helper in self.helpers:
if helper.obj.name == obj.name and helper.obj.path == obj.path and \
helper.obj.filename == obj.filename:
helper.obj = obj
helper.Updated(obj.name)
@handle_exceptions
def removeHelper(self, obj):
for helper in self.helpers:
if helper.obj == obj:
helper.Removed(obj.name)
helper.unregister()
self.helpers.remove(helper)
del helper
# access check
@dbus_handle_exceptions
def accessCheck(self, sender):
if self.config.lockdown_enabled():
if sender is None:
log.error("Lockdown not possible, sender not set.")
return
bus = dbus.SystemBus()
context = context_of_sender(bus, sender)
if self.config.access_check("context", context):
return
uid = uid_of_sender(bus, sender)
if self.config.access_check("uid", uid):
return
user = user_of_uid(uid)
if self.config.access_check("user", user):
return
command = command_of_sender(bus, sender)
if self.config.access_check("command", command):
return
raise FirewallError(errors.ACCESS_DENIED, "lockdown is enabled")
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# P R O P E R T I E S
@dbus_handle_exceptions
def _get_property(self, prop):
if prop not in [ "DefaultZone", "MinimalMark", "CleanupOnExit",
"CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter",
"IndividualCalls", "LogDenied", "AutomaticHelpers",
"FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4",
"AllowZoneDrifting" ]:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % prop)
value = self.config.get_firewalld_conf().get(prop)
if prop == "DefaultZone":
if value is None:
value = config.FALLBACK_ZONE
return dbus.String(value)
elif prop == "MinimalMark":
if value is None:
value = config.FALLBACK_MINIMAL_MARK
else:
value = int(value)
return dbus.Int32(value)
elif prop == "CleanupOnExit":
if value is None:
value = "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no"
return dbus.String(value)
elif prop == "CleanupModulesOnExit":
if value is None:
value = "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no"
return dbus.String(value)
elif prop == "Lockdown":
if value is None:
value = "yes" if config.FALLBACK_LOCKDOWN else "no"
return dbus.String(value)
elif prop == "IPv6_rpfilter":
if value is None:
value = "yes" if config.FALLBACK_IPV6_RPFILTER else "no"
return dbus.String(value)
elif prop == "IndividualCalls":
if value is None:
value = "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no"
return dbus.String(value)
elif prop == "LogDenied":
if value is None:
value = config.FALLBACK_LOG_DENIED
return dbus.String(value)
elif prop == "AutomaticHelpers":
if value is None:
value = config.FALLBACK_AUTOMATIC_HELPERS
return dbus.String(value)
elif prop == "FirewallBackend":
if value is None:
value = config.FALLBACK_FIREWALL_BACKEND
return dbus.String(value)
elif prop == "FlushAllOnReload":
if value is None:
value = "yes" if config.FALLBACK_FLUSH_ALL_ON_RELOAD else "no"
return dbus.String(value)
elif prop == "RFC3964_IPv4":
if value is None:
value = "yes" if config.FALLBACK_RFC3964_IPV4 else "no"
return dbus.String(value)
elif prop == "AllowZoneDrifting":
if value is None:
value = "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no"
return dbus.String(value)
@dbus_handle_exceptions
def _get_dbus_property(self, prop):
if prop == "DefaultZone":
return dbus.String(self._get_property(prop))
elif prop == "MinimalMark":
return dbus.Int32(self._get_property(prop))
elif prop == "CleanupOnExit":
return dbus.String(self._get_property(prop))
elif prop == "CleanupModulesOnExit":
return dbus.String(self._get_property(prop))
elif prop == "Lockdown":
return dbus.String(self._get_property(prop))
elif prop == "IPv6_rpfilter":
return dbus.String(self._get_property(prop))
elif prop == "IndividualCalls":
return dbus.String(self._get_property(prop))
elif prop == "LogDenied":
return dbus.String(self._get_property(prop))
elif prop == "AutomaticHelpers":
return dbus.String(self._get_property(prop))
elif prop == "FirewallBackend":
return dbus.String(self._get_property(prop))
elif prop == "FlushAllOnReload":
return dbus.String(self._get_property(prop))
elif prop == "RFC3964_IPv4":
return dbus.String(self._get_property(prop))
elif prop == "AllowZoneDrifting":
return dbus.String(self._get_property(prop))
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % prop)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss',
out_signature='v')
@dbus_handle_exceptions
def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613
# get a property
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
log.debug1("config.Get('%s', '%s')", interface_name, property_name)
if interface_name == config.dbus.DBUS_INTERFACE_CONFIG:
return self._get_dbus_property(property_name)
elif interface_name in [ config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
return self._get_dbus_property(property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s',
out_signature='a{sv}')
@dbus_handle_exceptions
def GetAll(self, interface_name, sender=None): # pylint: disable=W0613
interface_name = dbus_to_python(interface_name, str)
log.debug1("config.GetAll('%s')", interface_name)
ret = { }
if interface_name == config.dbus.DBUS_INTERFACE_CONFIG:
for x in [ "DefaultZone", "MinimalMark", "CleanupOnExit",
"CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter",
"IndividualCalls", "LogDenied", "AutomaticHelpers",
"FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4",
"AllowZoneDrifting" ]:
ret[x] = self._get_property(x)
elif interface_name in [ config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]:
pass
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
return dbus.Dictionary(ret, signature="sv")
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv')
@dbus_handle_exceptions
def Set(self, interface_name, property_name, new_value, sender=None):
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
new_value = dbus_to_python(new_value)
log.debug1("config.Set('%s', '%s', '%s')", interface_name,
property_name, new_value)
self.accessCheck(sender)
if interface_name == config.dbus.DBUS_INTERFACE_CONFIG:
if property_name in [ "CleanupOnExit", "Lockdown", "CleanupModulesOnExit",
"IPv6_rpfilter", "IndividualCalls",
"LogDenied",
"FirewallBackend", "FlushAllOnReload",
"RFC3964_IPv4", "AllowZoneDrifting" ]:
if property_name in [ "CleanupOnExit", "Lockdown", "CleanupModulesOnExit",
"IPv6_rpfilter", "IndividualCalls" ]:
if new_value.lower() not in [ "yes", "no",
"true", "false" ]:
raise FirewallError(errors.INVALID_VALUE,
"'%s' for %s" % \
(new_value, property_name))
if property_name == "LogDenied":
if new_value not in config.LOG_DENIED_VALUES:
raise FirewallError(errors.INVALID_VALUE,
"'%s' for %s" % \
(new_value, property_name))
if property_name == "FirewallBackend":
if new_value not in config.FIREWALL_BACKEND_VALUES:
raise FirewallError(errors.INVALID_VALUE,
"'%s' for %s" % \
(new_value, property_name))
if property_name == "FlushAllOnReload":
if new_value.lower() not in ["yes", "true", "no", "false"]:
raise FirewallError(errors.INVALID_VALUE,
"'%s' for %s" % \
(new_value, property_name))
if property_name == "RFC3964_IPv4":
if new_value.lower() not in ["yes", "true", "no", "false"]:
raise FirewallError(errors.INVALID_VALUE,
"'%s' for %s" % \
(new_value, property_name))
if property_name == "AllowZoneDrifting":
if new_value.lower() not in ["yes", "true", "no", "false"]:
raise FirewallError(errors.INVALID_VALUE,
"'%s' for %s" % \
(new_value, property_name))
self.config.get_firewalld_conf().set(property_name, new_value)
self.config.get_firewalld_conf().write()
self.PropertiesChanged(interface_name,
{ property_name: new_value }, [ ])
elif property_name in ["MinimalMark", "AutomaticHelpers"]:
# deprecated fields. Ignore setting them.
pass
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
elif interface_name in [ config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as')
def PropertiesChanged(self, interface_name, changed_properties,
invalidated_properties):
interface_name = dbus_to_python(interface_name, str)
changed_properties = dbus_to_python(changed_properties)
invalidated_properties = dbus_to_python(invalidated_properties)
log.debug1("config.PropertiesChanged('%s', '%s', '%s')",
interface_name, changed_properties, invalidated_properties)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s')
@dbus_handle_exceptions
def Introspect(self, sender=None): # pylint: disable=W0613
log.debug2("config.Introspect()")
data = super(FirewallDConfig, self).Introspect(self.path,
self.busname.get_bus())
return dbus_introspection_add_properties(
self, data, config.dbus.DBUS_INTERFACE_CONFIG)
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# policies
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
out_signature=LockdownWhitelist.DBUS_SIGNATURE)
@dbus_handle_exceptions
def getLockdownWhitelist(self, sender=None): # pylint: disable=W0613
log.debug1("config.policies.getLockdownWhitelist()")
return self.config.get_policies().lockdown_whitelist.export_config()
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature=LockdownWhitelist.DBUS_SIGNATURE)
@dbus_handle_exceptions
def setLockdownWhitelist(self, settings, sender=None): # pylint: disable=W0613
log.debug1("config.policies.setLockdownWhitelist(...)")
settings = dbus_to_python(settings)
self.config.get_policies().lockdown_whitelist.import_config(settings)
self.config.get_policies().lockdown_whitelist.write()
self.LockdownWhitelistUpdated()
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES)
@dbus_handle_exceptions
def LockdownWhitelistUpdated(self):
log.debug1("config.policies.LockdownWhitelistUpdated()")
# command
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='s')
@dbus_handle_exceptions
def addLockdownWhitelistCommand(self, command, sender=None):
command = dbus_to_python(command)
log.debug1("config.policies.addLockdownWhitelistCommand('%s')", command)
self.accessCheck(sender)
settings = list(self.getLockdownWhitelist())
if command in settings[0]:
raise FirewallError(errors.ALREADY_ENABLED, command)
settings[0].append(command)
self.setLockdownWhitelist(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='s')
@dbus_handle_exceptions
def removeLockdownWhitelistCommand(self, command, sender=None):
command = dbus_to_python(command)
log.debug1("config.policies.removeLockdownWhitelistCommand('%s')",
command)
self.accessCheck(sender)
settings = list(self.getLockdownWhitelist())
if command not in settings[0]:
raise FirewallError(errors.NOT_ENABLED, command)
settings[0].remove(command)
self.setLockdownWhitelist(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryLockdownWhitelistCommand(self, command, sender=None): # pylint: disable=W0613
command = dbus_to_python(command)
log.debug1("config.policies.queryLockdownWhitelistCommand('%s')",
command)
return command in self.getLockdownWhitelist()[0]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
out_signature='as')
@dbus_handle_exceptions
def getLockdownWhitelistCommands(self, sender=None): # pylint: disable=W0613
log.debug1("config.policies.getLockdownWhitelistCommands()")
return self.getLockdownWhitelist()[0]
# context
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='s')
@dbus_handle_exceptions
def addLockdownWhitelistContext(self, context, sender=None):
context = dbus_to_python(context)
log.debug1("config.policies.addLockdownWhitelistContext('%s')", context)
self.accessCheck(sender)
settings = list(self.getLockdownWhitelist())
if context in settings[1]:
raise FirewallError(errors.ALREADY_ENABLED, context)
settings[1].append(context)
self.setLockdownWhitelist(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='s')
@dbus_handle_exceptions
def removeLockdownWhitelistContext(self, context, sender=None):
context = dbus_to_python(context)
log.debug1("config.policies.removeLockdownWhitelistContext('%s')",
context)
self.accessCheck(sender)
settings = list(self.getLockdownWhitelist())
if context not in settings[1]:
raise FirewallError(errors.NOT_ENABLED, context)
settings[1].remove(context)
self.setLockdownWhitelist(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryLockdownWhitelistContext(self, context, sender=None): # pylint: disable=W0613
context = dbus_to_python(context)
log.debug1("config.policies.queryLockdownWhitelistContext('%s')",
context)
return context in self.getLockdownWhitelist()[1]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
out_signature='as')
@dbus_handle_exceptions
def getLockdownWhitelistContexts(self, sender=None): # pylint: disable=W0613
log.debug1("config.policies.getLockdownWhitelistContexts()")
return self.getLockdownWhitelist()[1]
# user
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='s')
@dbus_handle_exceptions
def addLockdownWhitelistUser(self, user, sender=None):
user = dbus_to_python(user)
log.debug1("config.policies.addLockdownWhitelistUser('%s')", user)
self.accessCheck(sender)
settings = list(self.getLockdownWhitelist())
if user in settings[2]:
raise FirewallError(errors.ALREADY_ENABLED, user)
settings[2].append(user)
self.setLockdownWhitelist(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='s')
@dbus_handle_exceptions
def removeLockdownWhitelistUser(self, user, sender=None):
user = dbus_to_python(user)
log.debug1("config.policies.removeLockdownWhitelistUser('%s')", user)
self.accessCheck(sender)
settings = list(self.getLockdownWhitelist())
if user not in settings[2]:
raise FirewallError(errors.NOT_ENABLED, user)
settings[2].remove(user)
self.setLockdownWhitelist(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryLockdownWhitelistUser(self, user, sender=None): # pylint: disable=W0613
user = dbus_to_python(user)
log.debug1("config.policies.queryLockdownWhitelistUser('%s')", user)
return user in self.getLockdownWhitelist()[2]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
out_signature='as')
@dbus_handle_exceptions
def getLockdownWhitelistUsers(self, sender=None): # pylint: disable=W0613
log.debug1("config.policies.getLockdownWhitelistUsers()")
return self.getLockdownWhitelist()[2]
# uid
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='i')
@dbus_handle_exceptions
def addLockdownWhitelistUid(self, uid, sender=None):
uid = dbus_to_python(uid)
log.debug1("config.policies.addLockdownWhitelistUid(%d)", uid)
self.accessCheck(sender)
settings = list(self.getLockdownWhitelist())
if uid in settings[3]:
raise FirewallError(errors.ALREADY_ENABLED, uid)
settings[3].append(uid)
self.setLockdownWhitelist(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='i')
@dbus_handle_exceptions
def removeLockdownWhitelistUid(self, uid, sender=None):
uid = dbus_to_python(uid)
log.debug1("config.policies.removeLockdownWhitelistUid(%d)", uid)
self.accessCheck(sender)
settings = list(self.getLockdownWhitelist())
if uid not in settings[3]:
raise FirewallError(errors.NOT_ENABLED, uid)
settings[3].remove(uid)
self.setLockdownWhitelist(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
in_signature='i', out_signature='b')
@dbus_handle_exceptions
def queryLockdownWhitelistUid(self, uid, sender=None): # pylint: disable=W0613
uid = dbus_to_python(uid)
log.debug1("config.policies.queryLockdownWhitelistUid(%d)", uid)
return uid in self.getLockdownWhitelist()[3]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
out_signature='ai')
@dbus_handle_exceptions
def getLockdownWhitelistUids(self, sender=None): # pylint: disable=W0613
log.debug1("config.policies.getLockdownWhitelistUids()")
return self.getLockdownWhitelist()[3]
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# I P S E T S
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao')
@dbus_handle_exceptions
def listIPSets(self, sender=None): # pylint: disable=W0613
"""list ipsets objects paths
"""
log.debug1("config.listIPSets()")
return self.ipsets
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as')
@dbus_handle_exceptions
def getIPSetNames(self, sender=None): # pylint: disable=W0613
"""get ipset names
"""
log.debug1("config.getIPSetNames()")
ipsets = [ ]
for obj in self.ipsets:
ipsets.append(obj.obj.name)
return sorted(ipsets)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s',
out_signature='o')
@dbus_handle_exceptions
def getIPSetByName(self, ipset, sender=None): # pylint: disable=W0613
"""object path of ipset with given name
"""
ipset = dbus_to_python(ipset, str)
log.debug1("config.getIPSetByName('%s')", ipset)
for obj in self.ipsets:
if obj.obj.name == ipset:
return obj
raise FirewallError(errors.INVALID_IPSET, ipset)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG,
in_signature='s'+IPSet.DBUS_SIGNATURE,
out_signature='o')
@dbus_handle_exceptions
def addIPSet(self, ipset, settings, sender=None):
"""add ipset with given name and settings
"""
ipset = dbus_to_python(ipset, str)
settings = dbus_to_python(settings)
log.debug1("config.addIPSet('%s')", ipset)
self.accessCheck(sender)
obj = self.config.new_ipset(ipset, settings)
config_ipset = self._addIPSet(obj)
return config_ipset
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s')
@dbus_handle_exceptions
def IPSetAdded(self, ipset):
ipset = dbus_to_python(ipset, str)
log.debug1("config.IPSetAdded('%s')" % (ipset))
# I C M P T Y P E S
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao')
@dbus_handle_exceptions
def listIcmpTypes(self, sender=None): # pylint: disable=W0613
"""list icmptypes objects paths
"""
log.debug1("config.listIcmpTypes()")
return self.icmptypes
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as')
@dbus_handle_exceptions
def getIcmpTypeNames(self, sender=None): # pylint: disable=W0613
"""get icmptype names
"""
log.debug1("config.getIcmpTypeNames()")
icmptypes = [ ]
for obj in self.icmptypes:
icmptypes.append(obj.obj.name)
return sorted(icmptypes)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s',
out_signature='o')
@dbus_handle_exceptions
def getIcmpTypeByName(self, icmptype, sender=None): # pylint: disable=W0613
"""object path of icmptype with given name
"""
icmptype = dbus_to_python(icmptype, str)
log.debug1("config.getIcmpTypeByName('%s')", icmptype)
for obj in self.icmptypes:
if obj.obj.name == icmptype:
return obj
raise FirewallError(errors.INVALID_ICMPTYPE, icmptype)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG,
in_signature='s'+IcmpType.DBUS_SIGNATURE,
out_signature='o')
@dbus_handle_exceptions
def addIcmpType(self, icmptype, settings, sender=None):
"""add icmptype with given name and settings
"""
icmptype = dbus_to_python(icmptype, str)
settings = dbus_to_python(settings)
log.debug1("config.addIcmpType('%s')", icmptype)
self.accessCheck(sender)
obj = self.config.new_icmptype(icmptype, settings)
config_icmptype = self._addIcmpType(obj)
return config_icmptype
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s')
@dbus_handle_exceptions
def IcmpTypeAdded(self, icmptype):
log.debug1("config.IcmpTypeAdded('%s')" % (icmptype))
# S E R V I C E S
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao')
@dbus_handle_exceptions
def listServices(self, sender=None): # pylint: disable=W0613
"""list services objects paths
"""
log.debug1("config.listServices()")
return self.services
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as')
@dbus_handle_exceptions
def getServiceNames(self, sender=None): # pylint: disable=W0613
"""get service names
"""
log.debug1("config.getServiceNames()")
services = [ ]
for obj in self.services:
services.append(obj.obj.name)
return sorted(services)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s',
out_signature='o')
@dbus_handle_exceptions
def getServiceByName(self, service, sender=None): # pylint: disable=W0613
"""object path of service with given name
"""
service = dbus_to_python(service, str)
log.debug1("config.getServiceByName('%s')", service)
for obj in self.services:
if obj.obj.name == service:
return obj
raise FirewallError(errors.INVALID_SERVICE, service)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG,
in_signature='s(sssa(ss)asa{ss}asa(ss))',
out_signature='o')
@dbus_handle_exceptions
def addService(self, service, settings, sender=None):
"""add service with given name and settings
"""
service = dbus_to_python(service, str)
settings = dbus_to_python(settings)
log.debug1("config.addService('%s')", service)
self.accessCheck(sender)
obj = self.config.new_service(service, settings)
config_service = self._addService(obj)
return config_service
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG,
in_signature='sa{sv}',
out_signature='o')
@dbus_handle_exceptions
def addService2(self, service, settings, sender=None):
"""add service with given name and settings
"""
service = dbus_to_python(service, str)
settings = dbus_to_python(settings)
log.debug1("config.addService2('%s')", service)
self.accessCheck(sender)
obj = self.config.new_service_dict(service, settings)
config_service = self._addService(obj)
return config_service
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s')
@dbus_handle_exceptions
def ServiceAdded(self, service):
log.debug1("config.ServiceAdded('%s')" % (service))
# Z O N E S
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao')
@dbus_handle_exceptions
def listZones(self, sender=None): # pylint: disable=W0613
"""list zones objects paths
"""
log.debug1("config.listZones()")
return self.zones
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as')
@dbus_handle_exceptions
def getZoneNames(self, sender=None): # pylint: disable=W0613
"""get zone names
"""
log.debug1("config.getZoneNames()")
zones = [ ]
for obj in self.zones:
zones.append(obj.obj.name)
return sorted(zones)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s',
out_signature='o')
@dbus_handle_exceptions
def getZoneByName(self, zone, sender=None): # pylint: disable=W0613
"""object path of zone with given name
"""
zone = dbus_to_python(zone, str)
log.debug1("config.getZoneByName('%s')", zone)
for obj in self.zones:
if obj.obj.name == zone:
return obj
raise FirewallError(errors.INVALID_ZONE, zone)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s',
out_signature='s')
@dbus_handle_exceptions
def getZoneOfInterface(self, iface, sender=None): # pylint: disable=W0613
"""name of zone the given interface belongs to
"""
iface = dbus_to_python(iface, str)
log.debug1("config.getZoneOfInterface('%s')", iface)
ret = []
for obj in self.zones:
if iface in obj.obj.interfaces:
ret.append(obj.obj.name)
if len(ret) > 1:
# Even it shouldn't happen, it's actually possible that
# the same interface is in several zone XML files
return " ".join(ret) + \
" (ERROR: interface '%s' is in %s zone XML files, can be only in one)" % \
(iface, len(ret))
return ret[0] if ret else ""
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s',
out_signature='s')
@dbus_handle_exceptions
def getZoneOfSource(self, source, sender=None): # pylint: disable=W0613
"""name of zone the given source belongs to
"""
source = dbus_to_python(source, str)
log.debug1("config.getZoneOfSource('%s')", source)
ret = []
for obj in self.zones:
if source in obj.obj.sources:
ret.append(obj.obj.name)
if len(ret) > 1:
# Even it shouldn't happen, it's actually possible that
# the same source is in several zone XML files
return " ".join(ret) + \
" (ERROR: source '%s' is in %s zone XML files, can be only in one)" % \
(source, len(ret))
return ret[0] if ret else ""
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG,
in_signature="s(sssbsasa(ss)asba(ssss)asasasasa(ss)b)",
out_signature='o')
@dbus_handle_exceptions
def addZone(self, zone, settings, sender=None):
"""add zone with given name and settings
"""
zone = dbus_to_python(zone, str)
settings = dbus_to_python(settings)
log.debug1("config.addZone('%s')", zone)
self.accessCheck(sender)
if settings[4] == "default":
# convert to list, fix target, convert back to tuple
_settings = list(settings)
_settings[4] = DEFAULT_ZONE_TARGET
settings = tuple(_settings)
obj = self.config.new_zone(zone, settings)
config_zone = self._addZone(obj)
return config_zone
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG,
in_signature="sa{sv}",
out_signature='o')
@dbus_handle_exceptions
def addZone2(self, zone, settings, sender=None):
"""add zone with given name and settings
"""
zone = dbus_to_python(zone, str)
settings = dbus_to_python(settings)
log.debug1("config.addZone('%s')", zone)
self.accessCheck(sender)
if "target" in settings and settings["target"] == "default":
settings["target"] = DEFAULT_ZONE_TARGET
obj = self.config.new_zone_dict(zone, settings)
config_zone = self._addZone(obj)
return config_zone
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s')
@dbus_handle_exceptions
def ZoneAdded(self, zone):
log.debug1("config.ZoneAdded('%s')" % (zone))
# policies
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao')
@dbus_handle_exceptions
def listPolicies(self, sender=None):
"""list policies objects paths
"""
log.debug1("config.listPolicies()")
return self.policy_objects
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as')
@dbus_handle_exceptions
def getPolicyNames(self, sender=None):
"""get policy names
"""
log.debug1("config.getPolicyNames()")
policies = [ ]
for obj in self.policy_objects:
policies.append(obj.obj.name)
return sorted(policies)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s',
out_signature='o')
@dbus_handle_exceptions
def getPolicyByName(self, policy, sender=None):
"""object path of policy with given name
"""
policy = dbus_to_python(policy, str)
log.debug1("config.getPolicyByName('%s')", policy)
for obj in self.policy_objects:
if obj.obj.name == policy:
return obj
raise FirewallError(errors.INVALID_POLICY, policy)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG,
in_signature="sa{sv}",
out_signature='o')
@dbus_handle_exceptions
def addPolicy(self, policy, settings, sender=None):
"""add policy with given name and settings
"""
policy = dbus_to_python(policy, str)
settings = dbus_to_python(settings)
log.debug1("config.addPolicy('%s')", policy)
self.accessCheck(sender)
obj = self.config.new_policy_object_dict(policy, settings)
config_policy = self._addPolicy(obj)
return config_policy
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s')
@dbus_handle_exceptions
def PolicyAdded(self, policy):
log.debug1("config.PolicyAdded('%s')" % (policy))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# H E L P E R S
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao')
@dbus_handle_exceptions
def listHelpers(self, sender=None): # pylint: disable=W0613
"""list helpers objects paths
"""
log.debug1("config.listHelpers()")
return self.helpers
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as')
@dbus_handle_exceptions
def getHelperNames(self, sender=None): # pylint: disable=W0613
"""get helper names
"""
log.debug1("config.getHelperNames()")
helpers = [ ]
for obj in self.helpers:
helpers.append(obj.obj.name)
return sorted(helpers)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s',
out_signature='o')
@dbus_handle_exceptions
def getHelperByName(self, helper, sender=None): # pylint: disable=W0613
"""object path of helper with given name
"""
helper = dbus_to_python(helper, str)
log.debug1("config.getHelperByName('%s')", helper)
for obj in self.helpers:
if obj.obj.name == helper:
return obj
raise FirewallError(errors.INVALID_HELPER, helper)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG,
in_signature='s'+Helper.DBUS_SIGNATURE,
out_signature='o')
@dbus_handle_exceptions
def addHelper(self, helper, settings, sender=None):
"""add helper with given name and settings
"""
helper = dbus_to_python(helper, str)
settings = dbus_to_python(settings)
log.debug1("config.addHelper('%s')", helper)
self.accessCheck(sender)
obj = self.config.new_helper(helper, settings)
config_helper = self._addHelper(obj)
return config_helper
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s')
@dbus_handle_exceptions
def HelperAdded(self, helper):
helper = dbus_to_python(helper, str)
log.debug1("config.HelperAdded('%s')" % (helper))
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# DIRECT
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
out_signature=Direct.DBUS_SIGNATURE)
@dbus_handle_exceptions
def getSettings(self, sender=None): # pylint: disable=W0613
# returns list ipv, table, list of chains
log.debug1("config.direct.getSettings()")
return self.config.get_direct().export_config()
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature=Direct.DBUS_SIGNATURE)
@dbus_handle_exceptions
def update(self, settings, sender=None): # pylint: disable=W0613
# returns list ipv, table, list of chains
log.debug1("config.direct.update()")
settings = dbus_to_python(settings)
self.config.get_direct().import_config(settings)
self.config.get_direct().write()
self.Updated()
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT)
@dbus_handle_exceptions
def Updated(self):
log.debug1("config.direct.Updated()")
# chain
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='sss')
@dbus_handle_exceptions
def addChain(self, ipv, table, chain, sender=None):
ipv = dbus_to_python(ipv)
table = dbus_to_python(table)
chain = dbus_to_python(chain)
log.debug1("config.direct.addChain('%s', '%s', '%s')" % \
(ipv, table, chain))
self.accessCheck(sender)
idx = tuple((ipv, table, chain))
settings = list(self.getSettings())
if idx in settings[0]:
raise FirewallError(errors.ALREADY_ENABLED,
"chain '%s' already is in '%s:%s'" % \
(chain, ipv, table))
settings[0].append(idx)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='sss')
@dbus_handle_exceptions
def removeChain(self, ipv, table, chain, sender=None):
ipv = dbus_to_python(ipv)
table = dbus_to_python(table)
chain = dbus_to_python(chain)
log.debug1("config.direct.removeChain('%s', '%s', '%s')" % \
(ipv, table, chain))
self.accessCheck(sender)
idx = tuple((ipv, table, chain))
settings = list(self.getSettings())
if idx not in settings[0]:
raise FirewallError(errors.NOT_ENABLED,
"chain '%s' is not in '%s:%s'" % (chain, ipv,
table))
settings[0].remove(idx)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='sss', out_signature='b')
@dbus_handle_exceptions
def queryChain(self, ipv, table, chain, sender=None): # pylint: disable=W0613
ipv = dbus_to_python(ipv)
table = dbus_to_python(table)
chain = dbus_to_python(chain)
log.debug1("config.direct.queryChain('%s', '%s', '%s')" % \
(ipv, table, chain))
idx = tuple((ipv, table, chain))
return idx in self.getSettings()[0]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='ss', out_signature='as')
@dbus_handle_exceptions
def getChains(self, ipv, table, sender=None): # pylint: disable=W0613
ipv = dbus_to_python(ipv)
table = dbus_to_python(table)
log.debug1("config.direct.getChains('%s', '%s')" % (ipv, table))
ret = [ ]
for idx in self.getSettings()[0]:
if idx[0] == ipv and idx[1] == table:
ret.append(idx[2])
return ret
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='', out_signature='a(sss)')
@dbus_handle_exceptions
def getAllChains(self, sender=None): # pylint: disable=W0613
log.debug1("config.direct.getAllChains()")
return self.getSettings()[0]
# rule
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='sssias')
@dbus_handle_exceptions
def addRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913
ipv = dbus_to_python(ipv)
table = dbus_to_python(table)
chain = dbus_to_python(chain)
priority = dbus_to_python(priority)
args = dbus_to_python(args)
log.debug1("config.direct.addRule('%s', '%s', '%s', %d, '%s')" % \
(ipv, table, chain, priority, "','".join(args)))
self.accessCheck(sender)
idx = (ipv, table, chain, priority, args)
settings = list(self.getSettings())
if idx in settings[1]:
raise FirewallError(errors.ALREADY_ENABLED,
"rule '%s' already is in '%s:%s:%s'" % \
(args, ipv, table, chain))
settings[1].append(idx)
self.update(tuple(settings))
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='sssias')
@dbus_handle_exceptions
def removeRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913
ipv = dbus_to_python(ipv)
table = dbus_to_python(table)
chain = dbus_to_python(chain)
priority = dbus_to_python(priority)
args = dbus_to_python(args)
log.debug1("config.direct.removeRule('%s', '%s', '%s', %d, '%s')" % \
(ipv, table, chain, priority, "','".join(args)))
self.accessCheck(sender)
idx = (ipv, table, chain, priority, args)
settings = list(self.getSettings())
if idx not in settings[1]:
raise FirewallError(errors.NOT_ENABLED,
"rule '%s' is not in '%s:%s:%s'" % \
(args, ipv, table, chain))
settings[1].remove(idx)
self.update(tuple(settings))
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='sssias', out_signature='b')
@dbus_handle_exceptions
def queryRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=W0613,R0913
ipv = dbus_to_python(ipv)
table = dbus_to_python(table)
chain = dbus_to_python(chain)
priority = dbus_to_python(priority)
args = dbus_to_python(args)
log.debug1("config.direct.queryRule('%s', '%s', '%s', %d, '%s')" % \
(ipv, table, chain, priority, "','".join(args)))
idx = (ipv, table, chain, priority, args)
return idx in self.getSettings()[1]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='sss')
@dbus_handle_exceptions
def removeRules(self, ipv, table, chain, sender=None):
ipv = dbus_to_python(ipv)
table = dbus_to_python(table)
chain = dbus_to_python(chain)
log.debug1("config.direct.removeRules('%s', '%s', '%s')" % \
(ipv, table, chain, ))
self.accessCheck(sender)
settings = list(self.getSettings())
for rule in settings[1][:]:
if (ipv, table, chain) == (rule[0], rule[1], rule[2]):
settings[1].remove(rule)
self.update(tuple(settings))
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='sss', out_signature='a(ias)')
@dbus_handle_exceptions
def getRules(self, ipv, table, chain, sender=None): # pylint: disable=W0613
ipv = dbus_to_python(ipv)
table = dbus_to_python(table)
chain = dbus_to_python(chain)
log.debug1("config.direct.getRules('%s', '%s', '%s')" % \
(ipv, table, chain))
ret = [ ]
for idx in self.getSettings()[1]:
if idx[0] == ipv and idx[1] == table and idx[2] == chain:
ret.append((idx[3], idx[4]))
return ret
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='', out_signature='a(sssias)')
@dbus_handle_exceptions
def getAllRules(self, sender=None): # pylint: disable=W0613
log.debug1("config.direct.getAllRules()")
return self.getSettings()[1]
# passthrough
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='sas')
@dbus_handle_exceptions
def addPassthrough(self, ipv, args, sender=None):
ipv = dbus_to_python(ipv)
args = dbus_to_python(args)
log.debug1("config.direct.addPassthrough('%s', '%s')" % \
(ipv, "','".join(args)))
self.accessCheck(sender)
idx = (ipv, args)
settings = list(self.getSettings())
if idx in settings[2]:
raise FirewallError(errors.ALREADY_ENABLED,
"passthrough '%s', '%s'" % (ipv, args))
settings[2].append(idx)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='sas')
@dbus_handle_exceptions
def removePassthrough(self, ipv, args, sender=None):
ipv = dbus_to_python(ipv)
args = dbus_to_python(args)
log.debug1("config.direct.removePassthrough('%s', '%s')" % \
(ipv, "','".join(args)))
self.accessCheck(sender)
idx = (ipv, args)
settings = list(self.getSettings())
if idx not in settings[2]:
raise FirewallError(errors.NOT_ENABLED,
"passthrough '%s', '%s'" % (ipv, args))
settings[2].remove(idx)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='sas', out_signature='b')
@dbus_handle_exceptions
def queryPassthrough(self, ipv, args, sender=None): # pylint: disable=W0613
ipv = dbus_to_python(ipv)
args = dbus_to_python(args)
log.debug1("config.direct.queryPassthrough('%s', '%s')" % \
(ipv, "','".join(args)))
idx = (ipv, args)
return idx in self.getSettings()[2]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
in_signature='s', out_signature='aas')
@dbus_handle_exceptions
def getPassthroughs(self, ipv, sender=None): # pylint: disable=W0613
ipv = dbus_to_python(ipv)
log.debug1("config.direct.getPassthroughs('%s')" % (ipv))
ret = [ ]
for idx in self.getSettings()[2]:
if idx[0] == ipv:
ret.append(idx[1])
return ret
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
out_signature='a(sas)')
@dbus_handle_exceptions
def getAllPassthroughs(self, sender=None): # pylint: disable=W0613
log.debug1("config.direct.getAllPassthroughs()")
return self.getSettings()[2]
server/config_icmptype.py 0000644 00000035123 15035135172 0011611 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
# force use of pygobject3 in python-slip
from gi.repository import GObject
import sys
sys.modules['gobject'] = GObject
import dbus
import dbus.service
import slip.dbus
import slip.dbus.service
from firewall import config
from firewall.dbus_utils import dbus_to_python, \
dbus_introspection_prepare_properties, \
dbus_introspection_add_properties
from firewall.core.io.icmptype import IcmpType
from firewall.core.logger import log
from firewall.server.decorators import handle_exceptions, \
dbus_handle_exceptions, dbus_service_method
from firewall import errors
from firewall.errors import FirewallError
############################################################################
#
# class FirewallDConfigIcmpType
#
############################################################################
class FirewallDConfigIcmpType(slip.dbus.service.Object):
"""FirewallD main class"""
persistent = True
""" Make FirewallD persistent. """
default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG
""" Use PK_ACTION_INFO as a default """
@handle_exceptions
def __init__(self, parent, conf, icmptype, item_id, *args, **kwargs):
super(FirewallDConfigIcmpType, self).__init__(*args, **kwargs)
self.parent = parent
self.config = conf
self.obj = icmptype
self.item_id = item_id
self.busname = args[0]
self.path = args[1]
self._log_prefix = "config.icmptype.%d" % self.item_id
dbus_introspection_prepare_properties(
self, config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE)
@dbus_handle_exceptions
def __del__(self):
pass
@dbus_handle_exceptions
def unregister(self):
self.remove_from_connection()
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# P R O P E R T I E S
@dbus_handle_exceptions
def _get_property(self, property_name):
if property_name == "name":
return dbus.String(self.obj.name)
elif property_name == "filename":
return dbus.String(self.obj.filename)
elif property_name == "path":
return dbus.String(self.obj.path)
elif property_name == "default":
return dbus.Boolean(self.obj.default)
elif property_name == "builtin":
return dbus.Boolean(self.obj.builtin)
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss',
out_signature='v')
@dbus_handle_exceptions
def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613
# get a property
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
log.debug1("%s.Get('%s', '%s')", self._log_prefix,
interface_name, property_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
return self._get_property(property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s',
out_signature='a{sv}')
@dbus_handle_exceptions
def GetAll(self, interface_name, sender=None): # pylint: disable=W0613
interface_name = dbus_to_python(interface_name, str)
log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
ret = { }
for x in [ "name", "filename", "path", "default", "builtin" ]:
ret[x] = self._get_property(x)
return dbus.Dictionary(ret, signature="sv")
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv')
@dbus_handle_exceptions
def Set(self, interface_name, property_name, new_value, sender=None):
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
new_value = dbus_to_python(new_value)
log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix,
interface_name, property_name, new_value)
self.parent.accessCheck(sender)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.PropertyReadOnly: "
"Property '%s' is read-only" % property_name)
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as')
def PropertiesChanged(self, interface_name, changed_properties,
invalidated_properties):
interface_name = dbus_to_python(interface_name, str)
changed_properties = dbus_to_python(changed_properties)
invalidated_properties = dbus_to_python(invalidated_properties)
log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix,
interface_name, changed_properties, invalidated_properties)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s')
@dbus_handle_exceptions
def Introspect(self, sender=None): # pylint: disable=W0613
log.debug2("%s.Introspect()", self._log_prefix)
data = super(FirewallDConfigIcmpType, self).Introspect(
self.path, self.busname.get_bus())
return dbus_introspection_add_properties(
self, data, config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE)
# S E T T I N G S
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
out_signature=IcmpType.DBUS_SIGNATURE)
@dbus_handle_exceptions
def getSettings(self, sender=None): # pylint: disable=W0613
"""get settings for icmptype
"""
log.debug1("%s.getSettings()", self._log_prefix)
return self.config.get_icmptype_config(self.obj)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
in_signature=IcmpType.DBUS_SIGNATURE)
@dbus_handle_exceptions
def update(self, settings, sender=None):
"""update settings for icmptype
"""
settings = dbus_to_python(settings)
log.debug1("%s.update('...')", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.set_icmptype_config(self.obj, settings)
self.Updated(self.obj.name)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE)
@dbus_handle_exceptions
def loadDefaults(self, sender=None):
"""load default settings for builtin icmptype
"""
log.debug1("%s.loadDefaults()", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.load_icmptype_defaults(self.obj)
self.Updated(self.obj.name)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
signature='s')
@dbus_handle_exceptions
def Updated(self, name):
log.debug1("%s.Updated('%s')" % (self._log_prefix, name))
# R E M O V E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE)
@dbus_handle_exceptions
def remove(self, sender=None):
"""remove icmptype
"""
log.debug1("%s.removeIcmpType()", self._log_prefix)
self.parent.accessCheck(sender)
self.config.remove_icmptype(self.obj)
self.parent.removeIcmpType(self.obj)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
signature='s')
@dbus_handle_exceptions
def Removed(self, name):
log.debug1("%s.Removed('%s')" % (self._log_prefix, name))
# R E N A M E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
in_signature='s')
@dbus_handle_exceptions
def rename(self, name, sender=None):
"""rename icmptype
"""
name = dbus_to_python(name, str)
log.debug1("%s.rename('%s')", self._log_prefix, name)
self.parent.accessCheck(sender)
self.obj = self.config.rename_icmptype(self.obj, name)
self.Renamed(name)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
signature='s')
@dbus_handle_exceptions
def Renamed(self, name):
log.debug1("%s.Renamed('%s')" % (self._log_prefix, name))
# version
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
out_signature='s')
@dbus_handle_exceptions
def getVersion(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getVersion()", self._log_prefix)
return self.getSettings()[0]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
in_signature='s')
@dbus_handle_exceptions
def setVersion(self, version, sender=None):
version = dbus_to_python(version, str)
log.debug1("%s.setVersion('%s')", self._log_prefix, version)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[0] = version
self.update(settings)
# short
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
out_signature='s')
@dbus_handle_exceptions
def getShort(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getShort()", self._log_prefix)
return self.getSettings()[1]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
in_signature='s')
@dbus_handle_exceptions
def setShort(self, short, sender=None):
short = dbus_to_python(short, str)
log.debug1("%s.setShort('%s')", self._log_prefix, short)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[1] = short
self.update(settings)
# description
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
out_signature='s')
@dbus_handle_exceptions
def getDescription(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getDescription()", self._log_prefix)
return self.getSettings()[2]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
in_signature='s')
@dbus_handle_exceptions
def setDescription(self, description, sender=None):
description = dbus_to_python(description, str)
log.debug1("%s.setDescription('%s')", self._log_prefix,
description)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[2] = description
self.update(settings)
# destination
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
out_signature='as')
@dbus_handle_exceptions
def getDestinations(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getDestinations()", self._log_prefix)
return sorted(self.getSettings()[3])
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
in_signature='as')
@dbus_handle_exceptions
def setDestinations(self, destinations, sender=None):
destinations = dbus_to_python(destinations, list)
log.debug1("%s.setDestinations('[%s]')", self._log_prefix,
",".join(destinations))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[3] = destinations
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
in_signature='s')
@dbus_handle_exceptions
def addDestination(self, destination, sender=None):
destination = dbus_to_python(destination, str)
log.debug1("%s.addDestination('%s')", self._log_prefix,
destination)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if destination in settings[3]:
raise FirewallError(errors.ALREADY_ENABLED, destination)
settings[3].append(destination)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
in_signature='s')
@dbus_handle_exceptions
def removeDestination(self, destination, sender=None):
destination = dbus_to_python(destination, str)
log.debug1("%s.removeDestination('%s')", self._log_prefix,
destination)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if settings[3]:
if destination not in settings[3]:
raise FirewallError(errors.NOT_ENABLED, destination)
else:
settings[3].remove(destination)
else: # empty means all
settings[3] = list(set(['ipv4', 'ipv6']) -
set([destination]))
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryDestination(self, destination, sender=None): # pylint: disable=W0613
destination = dbus_to_python(destination, str)
log.debug1("%s.queryDestination('%s')", self._log_prefix,
destination)
settings = self.getSettings()
# empty means all
return (not settings[3] or
destination in settings[3])
server/decorators.py 0000644 00000005557 15035135172 0010607 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2012-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
"""This module contains decorators for use with and without D-Bus"""
__all__ = ["FirewallDBusException", "handle_exceptions",
"dbus_handle_exceptions", "dbus_service_method"]
import dbus
import dbus.service
import traceback
from dbus.exceptions import DBusException
from decorator import decorator
from firewall import config
from firewall.errors import FirewallError
from firewall import errors
from firewall.core.logger import log
############################################################################
#
# Exception handler decorators
#
############################################################################
class FirewallDBusException(dbus.DBusException):
"""FirewallDBusException"""
_dbus_error_name = "%s.Exception" % config.dbus.DBUS_INTERFACE
@decorator
def handle_exceptions(func, *args, **kwargs):
"""Decorator to handle exceptions and log them. Used if not conneced
to D-Bus.
"""
try:
return func(*args, **kwargs)
except FirewallError as error:
log.debug1(traceback.format_exc())
log.error(error)
except Exception: # pylint: disable=W0703
log.exception()
@decorator
def dbus_handle_exceptions(func, *args, **kwargs):
"""Decorator to handle exceptions, log and report them into D-Bus
:Raises DBusException: on a firewall error code problems.
"""
try:
return func(*args, **kwargs)
except FirewallError as error:
code = FirewallError.get_code(str(error))
if code in [ errors.ALREADY_ENABLED, errors.NOT_ENABLED,
errors.ZONE_ALREADY_SET, errors.ALREADY_SET ]:
log.warning(str(error))
else:
log.debug1(traceback.format_exc())
log.error(str(error))
raise FirewallDBusException(str(error))
except DBusException as ex:
# only log DBusExceptions once
raise ex
except Exception as ex:
log.exception()
raise FirewallDBusException(str(ex))
def dbus_service_method(*args, **kwargs):
"""Add sender argument for D-Bus"""
kwargs.setdefault("sender_keyword", "sender")
return dbus.service.method(*args, **kwargs)
server/server.py 0000644 00000007371 15035135172 0007744 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# signal handling and run_server derived from setroubleshoot
# Copyright (C) 2006,2007,2008,2009 Red Hat, Inc.
# Authors:
# John Dennis <jdennis@redhat.com>
# Thomas Liu <tliu@redhat.com>
# Dan Walsh <dwalsh@redhat.com>
__all__ = [ "run_server" ]
import sys
import signal
# force use of pygobject3 in python-slip
from gi.repository import GObject, GLib
sys.modules['gobject'] = GObject
import dbus
import dbus.service
import dbus.mainloop.glib
import slip.dbus
from firewall import config
from firewall.core.logger import log
from firewall.server.firewalld import FirewallD
############################################################################
#
# signal handlers
#
############################################################################
def sighup(service):
service.reload()
return True
def sigterm(mainloop):
mainloop.quit()
############################################################################
#
# run_server function
#
############################################################################
def run_server(debug_gc=False):
""" Main function for firewall server. Handles D-Bus and GLib mainloop.
"""
service = None
if debug_gc:
from pprint import pformat
import gc
gc.enable()
gc.set_debug(gc.DEBUG_LEAK)
gc_timeout = 10
def gc_collect():
gc.collect()
if len(gc.garbage) > 0:
print("\n>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n")
print("GARBAGE OBJECTS (%d):\n" % len(gc.garbage))
for x in gc.garbage:
print(type(x), "\n ",)
print(pformat(x))
print("\n<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<"
"<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n")
GLib.timeout_add_seconds(gc_timeout, gc_collect)
try:
dbus.mainloop.glib.DBusGMainLoop(set_as_default=True)
bus = dbus.SystemBus()
name = dbus.service.BusName(config.dbus.DBUS_INTERFACE, bus=bus)
service = FirewallD(name, config.dbus.DBUS_PATH)
mainloop = GLib.MainLoop()
slip.dbus.service.set_mainloop(mainloop)
if debug_gc:
GLib.timeout_add_seconds(gc_timeout, gc_collect)
# use unix_signal_add if available, else unix_signal_add_full
if hasattr(GLib, 'unix_signal_add'):
unix_signal_add = GLib.unix_signal_add
else:
unix_signal_add = GLib.unix_signal_add_full
unix_signal_add(GLib.PRIORITY_HIGH, signal.SIGHUP,
sighup, service)
unix_signal_add(GLib.PRIORITY_HIGH, signal.SIGTERM,
sigterm, mainloop)
mainloop.run()
except KeyboardInterrupt:
log.debug1("Stopping..")
except SystemExit:
log.error("Raising SystemExit in run_server")
except Exception as e:
log.error("Exception %s: %s", e.__class__.__name__, str(e))
if service:
service.stop()
server/config_service.py 0000644 00000072677 15035135172 0011436 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
# force use of pygobject3 in python-slip
from gi.repository import GObject
import sys
sys.modules['gobject'] = GObject
import dbus
import dbus.service
import slip.dbus
import slip.dbus.service
from firewall import config
from firewall.dbus_utils import dbus_to_python, \
dbus_introspection_prepare_properties, \
dbus_introspection_add_properties
from firewall.core.logger import log
from firewall.server.decorators import handle_exceptions, \
dbus_handle_exceptions, dbus_service_method
from firewall import errors
from firewall.errors import FirewallError
############################################################################
#
# class FirewallDConfig
#
############################################################################
class FirewallDConfigService(slip.dbus.service.Object):
"""FirewallD main class"""
persistent = True
""" Make FirewallD persistent. """
default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG
""" Use PK_ACTION_INFO as a default """
@handle_exceptions
def __init__(self, parent, conf, service, item_id, *args, **kwargs):
super(FirewallDConfigService, self).__init__(*args, **kwargs)
self.parent = parent
self.config = conf
self.obj = service
self.item_id = item_id
self.busname = args[0]
self.path = args[1]
self._log_prefix = "config.service.%d" % self.item_id
dbus_introspection_prepare_properties(
self, config.dbus.DBUS_INTERFACE_CONFIG_SERVICE)
@dbus_handle_exceptions
def __del__(self):
pass
@dbus_handle_exceptions
def unregister(self):
self.remove_from_connection()
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# P R O P E R T I E S
@dbus_handle_exceptions
def _get_property(self, property_name):
if property_name == "name":
return dbus.String(self.obj.name)
elif property_name == "filename":
return dbus.String(self.obj.filename)
elif property_name == "path":
return dbus.String(self.obj.path)
elif property_name == "default":
return dbus.Boolean(self.obj.default)
elif property_name == "builtin":
return dbus.Boolean(self.obj.builtin)
else:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.InvalidArgs: "
"Property '%s' does not exist" % property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss',
out_signature='v')
@dbus_handle_exceptions
def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613
# get a property
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
log.debug1("%s.Get('%s', '%s')", self._log_prefix,
interface_name, property_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_SERVICE:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
return self._get_property(property_name)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s',
out_signature='a{sv}')
@dbus_handle_exceptions
def GetAll(self, interface_name, sender=None): # pylint: disable=W0613
interface_name = dbus_to_python(interface_name, str)
log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_SERVICE:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
ret = { }
for x in [ "name", "filename", "path", "default", "builtin" ]:
ret[x] = self._get_property(x)
return dbus.Dictionary(ret, signature="sv")
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv')
@dbus_handle_exceptions
def Set(self, interface_name, property_name, new_value, sender=None):
interface_name = dbus_to_python(interface_name, str)
property_name = dbus_to_python(property_name, str)
new_value = dbus_to_python(new_value)
log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix,
interface_name, property_name, new_value)
self.parent.accessCheck(sender)
if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_SERVICE:
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.UnknownInterface: "
"Interface '%s' does not exist" % interface_name)
raise dbus.exceptions.DBusException(
"org.freedesktop.DBus.Error.PropertyReadOnly: "
"Property '%s' is read-only" % property_name)
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as')
def PropertiesChanged(self, interface_name, changed_properties,
invalidated_properties):
interface_name = dbus_to_python(interface_name, str)
changed_properties = dbus_to_python(changed_properties)
invalidated_properties = dbus_to_python(invalidated_properties)
log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix,
interface_name, changed_properties, invalidated_properties)
@slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO)
@dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s')
@dbus_handle_exceptions
def Introspect(self, sender=None): # pylint: disable=W0613
log.debug2("%s.Introspect()", self._log_prefix)
data = super(FirewallDConfigService, self).Introspect(
self.path, self.busname.get_bus())
return dbus_introspection_add_properties(
self, data, config.dbus.DBUS_INTERFACE_CONFIG_SERVICE)
# S E T T I N G S
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
out_signature='(sssa(ss)asa{ss}asa(ss))')
@dbus_handle_exceptions
def getSettings(self, sender=None): # pylint: disable=W0613
"""get settings for service
"""
log.debug1("%s.getSettings()", self._log_prefix)
return self.config.get_service_config(self.obj)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
out_signature='a{sv}')
@dbus_handle_exceptions
def getSettings2(self, sender=None):
"""get settings for service
"""
log.debug1("%s.getSettings2()", self._log_prefix)
return self.config.get_service_config_dict(self.obj)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='(sssa(ss)asa{ss}asa(ss))')
@dbus_handle_exceptions
def update(self, settings, sender=None):
"""update settings for service
"""
settings = dbus_to_python(settings)
log.debug1("%s.update('...')", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.set_service_config(self.obj, settings)
self.Updated(self.obj.name)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='a{sv}')
@dbus_handle_exceptions
def update2(self, settings, sender=None):
settings = dbus_to_python(settings)
log.debug1("%s.update2('...')", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.set_service_config_dict(self.obj, settings)
self.Updated(self.obj.name)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE)
@dbus_handle_exceptions
def loadDefaults(self, sender=None):
"""load default settings for builtin service
"""
log.debug1("%s.loadDefaults()", self._log_prefix)
self.parent.accessCheck(sender)
self.obj = self.config.load_service_defaults(self.obj)
self.Updated(self.obj.name)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
signature='s')
@dbus_handle_exceptions
def Updated(self, name):
log.debug1("%s.Updated('%s')" % (self._log_prefix, name))
# R E M O V E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE)
@dbus_handle_exceptions
def remove(self, sender=None):
"""remove service
"""
log.debug1("%s.removeService()", self._log_prefix)
self.parent.accessCheck(sender)
self.config.remove_service(self.obj)
self.parent.removeService(self.obj)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
signature='s')
@dbus_handle_exceptions
def Removed(self, name):
log.debug1("%s.Removed('%s')" % (self._log_prefix, name))
# R E N A M E
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s')
@dbus_handle_exceptions
def rename(self, name, sender=None):
"""rename service
"""
name = dbus_to_python(name, str)
log.debug1("%s.rename('%s')", self._log_prefix, name)
self.parent.accessCheck(sender)
self.obj = self.config.rename_service(self.obj, name)
self.Renamed(name)
@dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
signature='s')
@dbus_handle_exceptions
def Renamed(self, name):
log.debug1("%s.Renamed('%s')" % (self._log_prefix, name))
# version
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
out_signature='s')
@dbus_handle_exceptions
def getVersion(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getVersion()", self._log_prefix)
return self.getSettings()[0]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s')
@dbus_handle_exceptions
def setVersion(self, version, sender=None):
version = dbus_to_python(version, str)
log.debug1("%s.setVersion('%s')", self._log_prefix, version)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[0] = version
self.update(settings)
# short
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
out_signature='s')
@dbus_handle_exceptions
def getShort(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getShort()", self._log_prefix)
return self.getSettings()[1]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s')
@dbus_handle_exceptions
def setShort(self, short, sender=None):
short = dbus_to_python(short, str)
log.debug1("%s.setShort('%s')", self._log_prefix, short)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[1] = short
self.update(settings)
# description
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
out_signature='s')
@dbus_handle_exceptions
def getDescription(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getDescription()", self._log_prefix)
return self.getSettings()[2]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s')
@dbus_handle_exceptions
def setDescription(self, description, sender=None):
description = dbus_to_python(description, str)
log.debug1("%s.setDescription('%s')", self._log_prefix,
description)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[2] = description
self.update(settings)
# port
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
out_signature='a(ss)')
@dbus_handle_exceptions
def getPorts(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getPorts()", self._log_prefix)
return self.getSettings()[3]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='a(ss)')
@dbus_handle_exceptions
def setPorts(self, ports, sender=None):
_ports = [ ]
# convert embedded lists to tuples
for port in dbus_to_python(ports, list):
if isinstance(port, list):
_ports.append(tuple(port))
else:
_ports.append(port)
ports = _ports
log.debug1("%s.setPorts('[%s]')", self._log_prefix,
",".join("('%s, '%s')" % (port[0], port[1]) for port in ports))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[3] = ports
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='ss')
@dbus_handle_exceptions
def addPort(self, port, protocol, sender=None):
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.addPort('%s', '%s')", self._log_prefix, port,
protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if (port,protocol) in settings[3]:
raise FirewallError(errors.ALREADY_ENABLED,
"%s:%s" % (port, protocol))
settings[3].append((port,protocol))
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='ss')
@dbus_handle_exceptions
def removePort(self, port, protocol, sender=None):
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.removePort('%s', '%s')", self._log_prefix, port,
protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if (port,protocol) not in settings[3]:
raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol))
settings[3].remove((port,protocol))
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='ss', out_signature='b')
@dbus_handle_exceptions
def queryPort(self, port, protocol, sender=None): # pylint: disable=W0613
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.queryPort('%s', '%s')", self._log_prefix, port,
protocol)
return (port,protocol) in self.getSettings()[3]
# protocol
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
out_signature='as')
@dbus_handle_exceptions
def getProtocols(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getProtocols()", self._log_prefix)
return self.getSettings()[6]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='as')
@dbus_handle_exceptions
def setProtocols(self, protocols, sender=None):
protocols = dbus_to_python(protocols, list)
log.debug1("%s.setProtocols('[%s]')", self._log_prefix,
",".join(protocols))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[6] = protocols
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s')
@dbus_handle_exceptions
def addProtocol(self, protocol, sender=None):
protocol = dbus_to_python(protocol, str)
log.debug1("%s.addProtocol('%s')", self._log_prefix, protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if protocol in settings[6]:
raise FirewallError(errors.ALREADY_ENABLED, protocol)
settings[6].append(protocol)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s')
@dbus_handle_exceptions
def removeProtocol(self, protocol, sender=None):
protocol = dbus_to_python(protocol, str)
log.debug1("%s.removeProtocol('%s')", self._log_prefix, protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if protocol not in settings[6]:
raise FirewallError(errors.NOT_ENABLED, protocol)
settings[6].remove(protocol)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryProtocol(self, protocol, sender=None): # pylint: disable=W0613
protocol = dbus_to_python(protocol, str)
log.debug1("%s.queryProtocol(%s')", self._log_prefix, protocol)
return protocol in self.getSettings()[6]
# source port
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
out_signature='a(ss)')
@dbus_handle_exceptions
def getSourcePorts(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getSourcePorts()", self._log_prefix)
return self.getSettings()[7]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='a(ss)')
@dbus_handle_exceptions
def setSourcePorts(self, ports, sender=None):
_ports = [ ]
# convert embedded lists to tuples
for port in dbus_to_python(ports, list):
if isinstance(port, list):
_ports.append(tuple(port))
else:
_ports.append(port)
ports = _ports
log.debug1("%s.setSourcePorts('[%s]')", self._log_prefix,
",".join("('%s, '%s')" % (port[0], port[1]) for port in ports))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[7] = ports
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='ss')
@dbus_handle_exceptions
def addSourcePort(self, port, protocol, sender=None):
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.addSourcePort('%s', '%s')", self._log_prefix, port,
protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if (port,protocol) in settings[7]:
raise FirewallError(errors.ALREADY_ENABLED,
"%s:%s" % (port, protocol))
settings[7].append((port,protocol))
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='ss')
@dbus_handle_exceptions
def removeSourcePort(self, port, protocol, sender=None):
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.removeSourcePort('%s', '%s')", self._log_prefix, port,
protocol)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if (port,protocol) not in settings[7]:
raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol))
settings[7].remove((port,protocol))
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='ss', out_signature='b')
@dbus_handle_exceptions
def querySourcePort(self, port, protocol, sender=None): # pylint: disable=W0613
port = dbus_to_python(port, str)
protocol = dbus_to_python(protocol, str)
log.debug1("%s.querySourcePort('%s', '%s')", self._log_prefix, port,
protocol)
return (port,protocol) in self.getSettings()[7]
# module
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
out_signature='as')
@dbus_handle_exceptions
def getModules(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getModules()", self._log_prefix)
return self.getSettings()[4]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='as')
@dbus_handle_exceptions
def setModules(self, modules, sender=None):
modules = dbus_to_python(modules, list)
_modules = [ ]
for module in modules:
if module.startswith("nf_conntrack_"):
module = module.replace("nf_conntrack_", "")
if "_" in module:
module = module.replace("_", "-")
_modules.append(module)
modules = _modules
log.debug1("%s.setModules('[%s]')", self._log_prefix,
",".join(modules))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[4] = modules
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s')
@dbus_handle_exceptions
def addModule(self, module, sender=None):
module = dbus_to_python(module, str)
if module.startswith("nf_conntrack_"):
module = module.replace("nf_conntrack_", "")
if "_" in module:
module = module.replace("_", "-")
log.debug1("%s.addModule('%s')", self._log_prefix, module)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if module in settings[4]:
raise FirewallError(errors.ALREADY_ENABLED, module)
settings[4].append(module)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s')
@dbus_handle_exceptions
def removeModule(self, module, sender=None):
module = dbus_to_python(module, str)
if module.startswith("nf_conntrack_"):
module = module.replace("nf_conntrack_", "")
if "_" in module:
module = module.replace("_", "-")
log.debug1("%s.removeModule('%s')", self._log_prefix, module)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if module not in settings[4]:
raise FirewallError(errors.NOT_ENABLED, module)
settings[4].remove(module)
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryModule(self, module, sender=None): # pylint: disable=W0613
module = dbus_to_python(module, str)
if module.startswith("nf_conntrack_"):
module = module.replace("nf_conntrack_", "")
if "_" in module:
module = module.replace("_", "-")
log.debug1("%s.queryModule('%s')", self._log_prefix, module)
return module in self.getSettings()[4]
# destination
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
out_signature='a{ss}')
@dbus_handle_exceptions
def getDestinations(self, sender=None): # pylint: disable=W0613
log.debug1("%s.getDestinations()", self._log_prefix)
return self.getSettings()[5]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='a{ss}')
@dbus_handle_exceptions
def setDestinations(self, destinations, sender=None):
destinations = dbus_to_python(destinations, dict)
log.debug1("%s.setDestinations({ipv4:'%s', ipv6:'%s'})",
self._log_prefix, destinations.get('ipv4'),
destinations.get('ipv6'))
self.parent.accessCheck(sender)
settings = list(self.getSettings())
settings[5] = destinations
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s', out_signature='s')
@dbus_handle_exceptions
def getDestination(self, family, sender=None):
family = dbus_to_python(family, str)
log.debug1("%s.getDestination('%s')", self._log_prefix,
family)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if family not in settings[5]:
raise FirewallError(errors.NOT_ENABLED, family)
return settings[5][family]
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='ss')
@dbus_handle_exceptions
def setDestination(self, family, address, sender=None):
family = dbus_to_python(family, str)
address = dbus_to_python(address, str)
log.debug1("%s.setDestination('%s', '%s')", self._log_prefix,
family, address)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if family in settings[5] and settings[5][family] == address:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s': '%s'" % (family, address))
settings[5][family] = address
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s')
@dbus_handle_exceptions
def removeDestination(self, family, sender=None):
family = dbus_to_python(family, str)
log.debug1("%s.removeDestination('%s')", self._log_prefix,
family)
self.parent.accessCheck(sender)
settings = list(self.getSettings())
if family not in settings[5]:
raise FirewallError(errors.NOT_ENABLED, family)
del settings[5][family]
self.update(settings)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='ss', out_signature='b')
@dbus_handle_exceptions
def queryDestination(self, family, address, sender=None): # pylint: disable=W0613
family = dbus_to_python(family, str)
address = dbus_to_python(address, str)
log.debug1("%s.queryDestination('%s', '%s')", self._log_prefix,
family, address)
settings = self.getSettings()
return (family in settings[5] and
address == settings[5][family])
# includes
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
out_signature='as')
@dbus_handle_exceptions
def getIncludes(self, sender=None):
log.debug1("%s.getIncludes()", self._log_prefix)
self.parent.accessCheck(sender)
settings = self.config.get_service_config_dict(self.obj)
return settings["includes"] if "includes" in settings else []
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='as')
@dbus_handle_exceptions
def setIncludes(self, includes, sender=None):
includes = dbus_to_python(includes, list)
log.debug1("%s.setIncludes('%s')", self._log_prefix, includes)
self.parent.accessCheck(sender)
settings = {"includes": includes[:]}
self.obj = self.config.set_service_config_dict(self.obj, settings)
self.Updated(self.obj.name)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s')
@dbus_handle_exceptions
def addInclude(self, include, sender=None):
include = dbus_to_python(include, str)
log.debug1("%s.addInclude('%s')", self._log_prefix, include)
self.parent.accessCheck(sender)
settings = self.config.get_service_config_dict(self.obj)
settings.setdefault("includes", []).append(include)
self.obj = self.config.set_service_config_dict(self.obj, settings)
self.Updated(self.obj.name)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s')
@dbus_handle_exceptions
def removeInclude(self, include, sender=None):
include = dbus_to_python(include, str)
log.debug1("%s.removeInclude('%s')", self._log_prefix, include)
self.parent.accessCheck(sender)
settings = self.config.get_service_config_dict(self.obj)
settings["includes"].remove(include)
self.obj = self.config.set_service_config_dict(self.obj, settings)
self.Updated(self.obj.name)
@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE,
in_signature='s', out_signature='b')
@dbus_handle_exceptions
def queryInclude(self, include, sender=None):
include = dbus_to_python(include, str)
log.debug1("%s.queryInclude('%s')", self._log_prefix, include)
settings = self.config.get_service_config_dict(self.obj)
return include in settings["includes"] if "includes" in settings else False
functions.py 0000644 00000045447 15035135172 0007146 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2007,2008,2011,2012 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "PY2", "getPortID", "getPortRange", "portStr", "getServiceName",
"checkIP", "checkIP6", "checkIPnMask", "checkIP6nMask",
"checkProtocol", "checkInterface", "checkUINT32",
"firewalld_is_active", "tempFile", "readfile", "writefile",
"enable_ip_forwarding", "check_port", "check_address",
"check_single_address", "check_mac", "uniqify", "ppid_of_pid",
"max_zone_name_len", "checkUser", "checkUid", "checkCommand",
"checkContext", "joinArgs", "splitArgs",
"b2u", "u2b", "u2b_if_py2", "max_policy_name_len",
"stripNonPrintableCharacters"]
import socket
import os
import os.path
import shlex
import pipes
import string
import sys
import tempfile
from firewall.core.logger import log
from firewall.config import FIREWALLD_TEMPDIR, FIREWALLD_PIDFILE
PY2 = sys.version < '3'
NOPRINT_TRANS_TABLE = {
# Limit to C0 and C1 code points. Building entries for all unicode code
# points requires too much memory.
# C0 = [0, 31]
# C1 = [127, 159]
#
i: None for i in range(0, 160) if not (i > 31 and i < 127)
}
def getPortID(port):
""" Check and Get port id from port string or port id using socket.getservbyname
@param port port string or port id
@return Port id if valid, -1 if port can not be found and -2 if port is too big
"""
if isinstance(port, int):
_id = port
else:
if port:
port = port.strip()
try:
_id = int(port)
except ValueError:
try:
_id = socket.getservbyname(port)
except socket.error:
return -1
if _id > 65535:
return -2
return _id
def getPortRange(ports):
""" Get port range for port range string or single port id
@param ports an integer or port string or port range string
@return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous.
"""
# (port, port) or [port, port] case
if isinstance(ports, tuple) or isinstance(ports, list):
return ports
# "<port-id>" case
if isinstance(ports, int) or ports.isdigit():
id1 = getPortID(ports)
if id1 >= 0:
return (id1,)
return id1
splits = ports.split("-")
# "<port-id>-<port-id>" case
if len(splits) == 2 and splits[0].isdigit() and splits[1].isdigit():
id1 = getPortID(splits[0])
id2 = getPortID(splits[1])
if id1 >= 0 and id2 >= 0:
if id1 < id2:
return (id1, id2)
elif id1 > id2:
return (id2, id1)
else: # ids are the same
return (id1,)
# everything else "<port-str>[-<port-str>]"
matched = [ ]
for i in range(len(splits), 0, -1):
id1 = getPortID("-".join(splits[:i]))
port2 = "-".join(splits[i:])
if len(port2) > 0:
id2 = getPortID(port2)
if id1 >= 0 and id2 >= 0:
if id1 < id2:
matched.append((id1, id2))
elif id1 > id2:
matched.append((id2, id1))
else:
matched.append((id1, ))
else:
if id1 >= 0:
matched.append((id1,))
if i == len(splits):
# full match, stop here
break
if len(matched) < 1:
return -1
elif len(matched) > 1:
return None
return matched[0]
def portStr(port, delimiter=":"):
""" Create port and port range string
@param port port or port range int or [int, int]
@param delimiter of the output string for port ranges, default ':'
@return Port or port range string, empty string if port isn't specified, None if port or port range is not valid
"""
if port == "":
return ""
_range = getPortRange(port)
if isinstance(_range, int) and _range < 0:
return None
elif len(_range) == 1:
return "%s" % _range
else:
return "%s%s%s" % (_range[0], delimiter, _range[1])
def portInPortRange(port, range):
_port = getPortRange(port)
_range = getPortRange(range)
if len(_port) == 1:
if len(_range) == 1:
return getPortID(_port[0]) == getPortID(_range[0])
if len(_range) == 2 and \
getPortID(_port[0]) >= getPortID(_range[0]) and getPortID(_port[0]) <= getPortID(_range[1]):
return True
elif len(_port) == 2:
if len(_range) == 2 and \
getPortID(_port[0]) >= getPortID(_range[0]) and getPortID(_port[0]) <= getPortID(_range[1]) and \
getPortID(_port[1]) >= getPortID(_range[0]) and getPortID(_port[1]) <= getPortID(_range[1]):
return True
return False
def coalescePortRange(new_range, ranges):
""" Coalesce a port range with existing list of port ranges
@param new_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after coalescing, list of removed original ranges)
"""
coalesced_range = getPortRange(new_range)
# normalize singleton ranges, e.g. (x,) --> (x,x)
if len(coalesced_range) == 1:
coalesced_range = (coalesced_range[0], coalesced_range[0])
_ranges = map(getPortRange, ranges)
_ranges = sorted(map(lambda x: (x[0],x[0]) if len(x) == 1 else x, _ranges), key=lambda x: x[0])
removed_ranges = []
for range in _ranges:
if coalesced_range[0] <= range[0] and coalesced_range[1] >= range[1]:
# new range covers this
removed_ranges.append(range)
elif coalesced_range[0] <= range[0] and coalesced_range[1] < range[1] and \
coalesced_range[1] >= range[0]:
# expand beginning of range
removed_ranges.append(range)
coalesced_range = (coalesced_range[0], range[1])
elif coalesced_range[0] > range[0] and coalesced_range[1] >= range[1] and \
coalesced_range[0] <= range[1]:
# expand end of range
removed_ranges.append(range)
coalesced_range = (range[0], coalesced_range[1])
# normalize singleton ranges, e.g. (x,x) --> (x,)
removed_ranges = list(map(lambda x: (x[0],) if x[0] == x[1] else x, removed_ranges))
if coalesced_range[0] == coalesced_range[1]:
coalesced_range = (coalesced_range[0],)
return ([coalesced_range], removed_ranges)
def breakPortRange(remove_range, ranges):
""" break a port range from existing list of port ranges
@param remove_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after breaking up, list of removed original ranges)
"""
remove_range = getPortRange(remove_range)
# normalize singleton ranges, e.g. (x,) --> (x,x)
if len(remove_range) == 1:
remove_range = (remove_range[0], remove_range[0])
_ranges = map(getPortRange, ranges)
_ranges = sorted(map(lambda x: (x[0],x[0]) if len(x) == 1 else x, _ranges), key=lambda x: x[0])
removed_ranges = []
added_ranges = []
for range in _ranges:
if remove_range[0] <= range[0] and remove_range[1] >= range[1]:
# remove entire range
removed_ranges.append(range)
elif remove_range[0] <= range[0] and remove_range[1] < range[1] and \
remove_range[1] >= range[0]:
# remove from beginning of range
removed_ranges.append(range)
added_ranges.append((remove_range[1] + 1, range[1]))
elif remove_range[0] > range[0] and remove_range[1] >= range[1] and \
remove_range[0] <= range[1]:
# remove from end of range
removed_ranges.append(range)
added_ranges.append((range[0], remove_range[0] - 1))
elif remove_range[0] > range[0] and remove_range[1] < range[1]:
# remove inside range
removed_ranges.append(range)
added_ranges.append((range[0], remove_range[0] - 1))
added_ranges.append((remove_range[1] + 1, range[1]))
# normalize singleton ranges, e.g. (x,x) --> (x,)
removed_ranges = list(map(lambda x: (x[0],) if x[0] == x[1] else x, removed_ranges))
added_ranges = list(map(lambda x: (x[0],) if x[0] == x[1] else x, added_ranges))
return (added_ranges, removed_ranges)
def getServiceName(port, proto):
""" Check and Get service name from port and proto string combination using socket.getservbyport
@param port string or id
@param protocol string
@return Service name if port and protocol are valid, else None
"""
try:
name = socket.getservbyport(int(port), proto)
except socket.error:
return None
return name
def checkIP(ip):
""" Check IPv4 address.
@param ip address string
@return True if address is valid, else False
"""
try:
socket.inet_pton(socket.AF_INET, ip)
except socket.error:
return False
return True
def normalizeIP6(ip):
""" Normalize the IPv6 address
This is mostly about converting URL-like IPv6 address to normal ones.
e.g. [1234::4321] --> 1234:4321
"""
return ip.strip("[]")
def checkIP6(ip):
""" Check IPv6 address.
@param ip address string
@return True if address is valid, else False
"""
try:
socket.inet_pton(socket.AF_INET6, normalizeIP6(ip))
except socket.error:
return False
return True
def checkIPnMask(ip):
if "/" in ip:
addr = ip[:ip.index("/")]
mask = ip[ip.index("/")+1:]
if len(addr) < 1 or len(mask) < 1:
return False
else:
addr = ip
mask = None
if not checkIP(addr):
return False
if mask:
if "." in mask:
return checkIP(mask)
else:
try:
i = int(mask)
except ValueError:
return False
if i < 0 or i > 32:
return False
return True
def stripNonPrintableCharacters(rule_str):
return rule_str.translate(NOPRINT_TRANS_TABLE)
def checkIP6nMask(ip):
if "/" in ip:
addr = ip[:ip.index("/")]
mask = ip[ip.index("/")+1:]
if len(addr) < 1 or len(mask) < 1:
return False
else:
addr = ip
mask = None
if not checkIP6(addr):
return False
if mask:
try:
i = int(mask)
except ValueError:
return False
if i < 0 or i > 128:
return False
return True
def checkProtocol(protocol):
try:
i = int(protocol)
except ValueError:
# string
try:
socket.getprotobyname(protocol)
except socket.error:
return False
else:
if i < 0 or i > 255:
return False
return True
def checkInterface(iface):
""" Check interface string
@param interface string
@return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False
"""
if not iface or len(iface) > 16:
return False
for ch in [ ' ', '/', '!', '*' ]:
# !:* are limits for iptables <= 1.4.5
if ch in iface:
return False
# disabled old iptables check
#if iface == "+":
# # limit for iptables <= 1.4.5
# return False
return True
def checkUINT32(val):
try:
x = int(val, 0)
except ValueError:
return False
else:
if x >= 0 and x <= 4294967295:
return True
return False
def firewalld_is_active():
""" Check if firewalld is active
@return True if there is a firewalld pid file and the pid is used by firewalld
"""
if not os.path.exists(FIREWALLD_PIDFILE):
return False
try:
with open(FIREWALLD_PIDFILE, "r") as fd:
pid = fd.readline()
except Exception:
return False
if not os.path.exists("/proc/%s" % pid):
return False
try:
with open("/proc/%s/cmdline" % pid, "r") as fd:
cmdline = fd.readline()
except Exception:
return False
if "firewalld" in cmdline:
return True
return False
def tempFile():
try:
if not os.path.exists(FIREWALLD_TEMPDIR):
os.mkdir(FIREWALLD_TEMPDIR, 0o750)
return tempfile.NamedTemporaryFile(mode='wt', prefix="temp.",
dir=FIREWALLD_TEMPDIR, delete=False)
except Exception as msg:
log.error("Failed to create temporary file: %s" % msg)
raise
return None
def readfile(filename):
try:
with open(filename, "r") as f:
return f.readlines()
except Exception as e:
log.error('Failed to read file "%s": %s' % (filename, e))
return None
def writefile(filename, line):
try:
with open(filename, "w") as f:
f.write(line)
except Exception as e:
log.error('Failed to write to file "%s": %s' % (filename, e))
return False
return True
def enable_ip_forwarding(ipv):
if ipv == "ipv4":
return writefile("/proc/sys/net/ipv4/ip_forward", "1\n")
elif ipv == "ipv6":
return writefile("/proc/sys/net/ipv6/conf/all/forwarding", "1\n")
return False
def get_nf_conntrack_short_name(module):
return module.replace("_","-").replace("nf-conntrack-", "")
def check_port(port):
_range = getPortRange(port)
if _range == -2 or _range == -1 or _range is None or \
(len(_range) == 2 and _range[0] >= _range[1]):
if _range == -2:
log.debug2("'%s': port > 65535" % port)
elif _range == -1:
log.debug2("'%s': port is invalid" % port)
elif _range is None:
log.debug2("'%s': port is ambiguous" % port)
elif len(_range) == 2 and _range[0] >= _range[1]:
log.debug2("'%s': range start >= end" % port)
return False
return True
def check_address(ipv, source):
if ipv == "ipv4":
return checkIPnMask(source)
elif ipv == "ipv6":
return checkIP6nMask(source)
else:
return False
def check_single_address(ipv, source):
if ipv == "ipv4":
return checkIP(source)
elif ipv == "ipv6":
return checkIP6(source)
else:
return False
def check_mac(mac):
if len(mac) == 12+5:
# 0 1 : 3 4 : 6 7 : 9 10 : 12 13 : 15 16
for i in (2, 5, 8, 11, 14):
if mac[i] != ":":
return False
for i in (0, 1, 3, 4, 6, 7, 9, 10, 12, 13, 15, 16):
if mac[i] not in string.hexdigits:
return False
return True
return False
def uniqify(_list):
# removes duplicates from list, whilst preserving order
output = []
for x in _list:
if x not in output:
output.append(x)
return output
def ppid_of_pid(pid):
""" Get parent for pid """
try:
f = os.popen("ps -o ppid -h -p %d 2>/dev/null" % pid)
pid = int(f.readlines()[0].strip())
f.close()
except Exception:
return None
return pid
def max_policy_name_len():
"""
iptables limits length of chain to (currently) 28 chars.
The longest chain we create is POST_<policy>_allow,
which leaves 28 - 11 = 17 chars for <policy>.
"""
from firewall.core.ipXtables import POLICY_CHAIN_PREFIX
from firewall.core.base import SHORTCUTS
longest_shortcut = max(map(len, SHORTCUTS.values()))
return 28 - (longest_shortcut + len(POLICY_CHAIN_PREFIX) + len("_allow"))
def max_zone_name_len():
"""
Netfilter limits length of chain to (currently) 28 chars.
The longest chain we create is FWDI_<zone>_allow,
which leaves 28 - 11 = 17 chars for <zone>.
"""
from firewall.core.base import SHORTCUTS
longest_shortcut = max(map(len, SHORTCUTS.values()))
return 28 - (longest_shortcut + len("__allow"))
def checkUser(user):
if len(user) < 1 or len(user) > os.sysconf('SC_LOGIN_NAME_MAX'):
return False
for c in user:
if c not in string.ascii_letters and \
c not in string.digits and \
c not in [ ".", "-", "_", "$" ]:
return False
return True
def checkUid(uid):
if isinstance(uid, str):
try:
uid = int(uid)
except ValueError:
return False
if uid >= 0 and uid <= 2**31-1:
return True
return False
def checkCommand(command):
if len(command) < 1 or len(command) > 1024:
return False
for ch in [ "|", "\n", "\0" ]:
if ch in command:
return False
if command[0] != "/":
return False
return True
def checkContext(context):
splits = context.split(":")
if len(splits) not in [4, 5]:
return False
# user ends with _u if not root
if splits[0] != "root" and splits[0][-2:] != "_u":
return False
# role ends with _r
if splits[1][-2:] != "_r":
return False
# type ends with _t
if splits[2][-2:] != "_t":
return False
# level might also contain :
if len(splits[3]) < 1:
return False
return True
def joinArgs(args):
if "quote" in dir(shlex):
return " ".join(shlex.quote(a) for a in args)
else:
return " ".join(pipes.quote(a) for a in args)
def splitArgs(_string):
if PY2 and isinstance(_string, unicode): # noqa: F821
# Python2's shlex doesn't like unicode
_string = u2b(_string)
splits = shlex.split(_string)
return map(b2u, splits)
else:
return shlex.split(_string)
def b2u(_string):
""" bytes to unicode """
if isinstance(_string, bytes):
return _string.decode('UTF-8', 'replace')
return _string
def u2b(_string):
""" unicode to bytes """
if not isinstance(_string, bytes):
return _string.encode('UTF-8', 'replace')
return _string
def u2b_if_py2(_string):
""" unicode to bytes only if Python 2"""
if PY2 and isinstance(_string, unicode): # noqa: F821
return _string.encode('UTF-8', 'replace')
return _string
errors.py 0000644 00000010343 15035135172 0006435 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2012 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
ALREADY_ENABLED = 11
NOT_ENABLED = 12
COMMAND_FAILED = 13
NO_IPV6_NAT = 14
PANIC_MODE = 15
ZONE_ALREADY_SET = 16
UNKNOWN_INTERFACE = 17
ZONE_CONFLICT = 18
BUILTIN_CHAIN = 19
EBTABLES_NO_REJECT = 20
NOT_OVERLOADABLE = 21
NO_DEFAULTS = 22
BUILTIN_ZONE = 23
BUILTIN_SERVICE = 24
BUILTIN_ICMPTYPE = 25
NAME_CONFLICT = 26
NAME_MISMATCH = 27
PARSE_ERROR = 28
ACCESS_DENIED = 29
UNKNOWN_SOURCE = 30
RT_TO_PERM_FAILED = 31
IPSET_WITH_TIMEOUT = 32
BUILTIN_IPSET = 33
ALREADY_SET = 34
MISSING_IMPORT = 35
DBUS_ERROR = 36
BUILTIN_HELPER = 37
NOT_APPLIED = 38
INVALID_ACTION = 100
INVALID_SERVICE = 101
INVALID_PORT = 102
INVALID_PROTOCOL = 103
INVALID_INTERFACE = 104
INVALID_ADDR = 105
INVALID_FORWARD = 106
INVALID_ICMPTYPE = 107
INVALID_TABLE = 108
INVALID_CHAIN = 109
INVALID_TARGET = 110
INVALID_IPV = 111
INVALID_ZONE = 112
INVALID_PROPERTY = 113
INVALID_VALUE = 114
INVALID_OBJECT = 115
INVALID_NAME = 116
INVALID_FILENAME = 117
INVALID_DIRECTORY = 118
INVALID_TYPE = 119
INVALID_SETTING = 120
INVALID_DESTINATION = 121
INVALID_RULE = 122
INVALID_LIMIT = 123
INVALID_FAMILY = 124
INVALID_LOG_LEVEL = 125
INVALID_AUDIT_TYPE = 126
INVALID_MARK = 127
INVALID_CONTEXT = 128
INVALID_COMMAND = 129
INVALID_USER = 130
INVALID_UID = 131
INVALID_MODULE = 132
INVALID_PASSTHROUGH = 133
INVALID_MAC = 134
INVALID_IPSET = 135
INVALID_ENTRY = 136
INVALID_OPTION = 137
INVALID_HELPER = 138
INVALID_PRIORITY = 139
INVALID_POLICY = 140
MISSING_TABLE = 200
MISSING_CHAIN = 201
MISSING_PORT = 202
MISSING_PROTOCOL = 203
MISSING_ADDR = 204
MISSING_NAME = 205
MISSING_SETTING = 206
MISSING_FAMILY = 207
RUNNING_BUT_FAILED = 251
NOT_RUNNING = 252
NOT_AUTHORIZED = 253
UNKNOWN_ERROR = 254
import sys
class FirewallError(Exception):
def __init__(self, code, msg=None):
self.code = code
if msg is not None:
# escape msg if needed
if sys.version < '3':
try:
x = str(msg) # noqa: F841
except UnicodeEncodeError:
msg = unicode(msg).encode("unicode_escape") # noqa: F821
self.msg = msg
def __repr__(self):
return '%s(%r, %r)' % (self.__class__, self.code, self.msg)
def __str__(self):
if self.msg:
return "%s: %s" % (self.errors[self.code], self.msg)
return self.errors[self.code]
def get_code(msg):
if ":" in msg:
idx = msg.index(":")
ecode = msg[:idx]
else:
ecode = msg
try:
code = FirewallError.codes[ecode]
except KeyError:
code = UNKNOWN_ERROR
return code
get_code = staticmethod(get_code)
mod = sys.modules[FirewallError.__module__]
FirewallError.errors = { getattr(mod,varname) : varname
for varname in dir(mod)
if not varname.startswith("_") and \
type(getattr(mod,varname)) == int }
FirewallError.codes = { FirewallError.errors[code] : code
for code in FirewallError.errors }
command.py 0000644 00000057301 15035135172 0006544 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""FirewallCommand class for command line client simplification"""
__all__ = [ "FirewallCommand" ]
import sys
from firewall import errors
from firewall.errors import FirewallError
from dbus.exceptions import DBusException
from firewall.functions import checkIPnMask, checkIP6nMask, check_mac, \
check_port, check_single_address
class FirewallCommand(object):
def __init__(self, quiet=False, verbose=False):
self.quiet = quiet
self.verbose = verbose
self.__use_exception_handler = True
self.fw = None
def set_fw(self, fw):
self.fw = fw
def set_quiet(self, flag):
self.quiet = flag
def get_quiet(self):
return self.quiet
def set_verbose(self, flag):
self.verbose = flag
def get_verbose(self):
return self.verbose
def print_msg(self, msg=None):
if msg is not None and not self.quiet:
sys.stdout.write(msg + "\n")
def print_error_msg(self, msg=None):
if msg is not None and not self.quiet:
sys.stderr.write(msg + "\n")
def print_warning(self, msg=None):
FAIL = '\033[91m'
END = '\033[00m'
if sys.stderr.isatty():
msg = FAIL + msg + END
self.print_error_msg(msg)
def print_and_exit(self, msg=None, exit_code=0):
#OK = '\033[92m'
#END = '\033[00m'
if exit_code > 1:
self.print_warning(msg)
else:
#if sys.stdout.isatty():
# msg = OK + msg + END
self.print_msg(msg)
sys.exit(exit_code)
def fail(self, msg=None):
self.print_and_exit(msg, 2)
def print_if_verbose(self, msg=None):
if msg is not None and self.verbose:
sys.stdout.write(msg + "\n")
def __cmd_sequence(self, cmd_type, option, action_method, query_method, # pylint: disable=W0613, R0913, R0914
parse_method, message, start_args=None, end_args=None, # pylint: disable=W0613
no_exit=False):
if self.fw is not None:
self.fw.authorizeAll()
items = [ ]
_errors = 0
_error_codes = [ ]
for item in option:
if parse_method is not None:
try:
item = parse_method(item)
except Exception as msg:
code = FirewallError.get_code(str(msg))
if len(option) > 1:
self.print_warning("Warning: %s" % msg)
else:
self.print_and_exit("Error: %s" % msg, code)
if code not in _error_codes:
_error_codes.append(code)
_errors += 1
continue
items.append(item)
for item in items:
call_item = [ ]
if start_args is not None:
call_item += start_args
if not isinstance(item, list) and not isinstance(item, tuple):
call_item.append(item)
else:
call_item += item
if end_args is not None:
call_item += end_args
self.deactivate_exception_handler()
try:
action_method(*call_item)
except (DBusException, Exception) as msg:
if isinstance(msg, DBusException):
self.fail_if_not_authorized(msg.get_dbus_name())
msg = msg.get_dbus_message()
else:
msg = str(msg)
code = FirewallError.get_code(msg)
if code in [ errors.ALREADY_ENABLED, errors.NOT_ENABLED,
errors.ZONE_ALREADY_SET, errors.ALREADY_SET ]:
code = 0
if len(option) > 1:
self.print_warning("Warning: %s" % msg)
elif code == 0:
self.print_warning("Warning: %s" % msg)
return
else:
self.print_and_exit("Error: %s" % msg, code)
if code not in _error_codes:
_error_codes.append(code)
_errors += 1
self.activate_exception_handler()
if not no_exit:
if len(option) > _errors or 0 in _error_codes:
# There have been more options than errors or there
# was at least one error code 0, return.
return
elif len(_error_codes) == 1:
# Exactly one error code, use it.
sys.exit(_error_codes[0])
elif len(_error_codes) > 1:
# There is more than error, exit using
# UNKNOWN_ERROR. This could happen within sequences
# where parsing failed with different errors like
# INVALID_PORT and INVALID_PROTOCOL.
sys.exit(errors.UNKNOWN_ERROR)
def add_sequence(self, option, action_method, query_method, parse_method, # pylint: disable=R0913
message, no_exit=False):
self.__cmd_sequence("add", option, action_method, query_method,
parse_method, message, no_exit=no_exit)
def x_add_sequence(self, x, option, action_method, query_method, # pylint: disable=R0913
parse_method, message, no_exit=False):
self.__cmd_sequence("add", option, action_method, query_method,
parse_method, message, start_args=[x],
no_exit=no_exit)
def zone_add_timeout_sequence(self, zone, option, action_method, # pylint: disable=R0913
query_method, parse_method, message,
timeout, no_exit=False):
self.__cmd_sequence("add", option, action_method, query_method,
parse_method, message, start_args=[zone],
end_args=[timeout], no_exit=no_exit)
def remove_sequence(self, option, action_method, query_method, # pylint: disable=R0913
parse_method, message, no_exit=False):
self.__cmd_sequence("remove", option, action_method, query_method,
parse_method, message, no_exit=no_exit)
def x_remove_sequence(self, x, option, action_method, query_method, # pylint: disable=R0913
parse_method, message, no_exit=False):
self.__cmd_sequence("remove", option, action_method, query_method,
parse_method, message, start_args=[x],
no_exit=no_exit)
def __query_sequence(self, option, query_method, parse_method, message, # pylint: disable=R0913
start_args=None, no_exit=False):
items = [ ]
for item in option:
if parse_method is not None:
try:
item = parse_method(item)
except Exception as msg:
if len(option) > 1:
self.print_warning("Warning: %s" % msg)
continue
else:
code = FirewallError.get_code(str(msg))
self.print_and_exit("Error: %s" % msg, code)
items.append(item)
for item in items:
call_item = [ ]
if start_args is not None:
call_item += start_args
if not isinstance(item, list) and not isinstance(item, tuple):
call_item.append(item)
else:
call_item += item
self.deactivate_exception_handler()
try:
res = query_method(*call_item)
except DBusException as msg:
self.fail_if_not_authorized(msg.get_dbus_name())
code = FirewallError.get_code(msg.get_dbus_message())
if len(option) > 1:
self.print_warning("Warning: %s" % msg.get_dbus_message())
continue
else:
self.print_and_exit("Error: %s" % msg.get_dbus_message(),
code)
except Exception as msg:
code = FirewallError.get_code(str(msg))
if len(option) > 1:
self.print_warning("Warning: %s" % msg)
else:
self.print_and_exit("Error: %s" % msg, code)
self.activate_exception_handler()
if len(option) > 1:
self.print_msg("%s: %s" % (message % item, ("no", "yes")[res]))
else:
self.print_query_result(res)
if not no_exit:
sys.exit(0)
def query_sequence(self, option, query_method, parse_method, message, # pylint: disable=R0913
no_exit=False):
self.__query_sequence(option, query_method, parse_method,
message, no_exit=no_exit)
def x_query_sequence(self, x, option, query_method, parse_method, # pylint: disable=R0913
message, no_exit=False):
self.__query_sequence(option, query_method, parse_method,
message, start_args=[x], no_exit=no_exit)
def parse_source(self, value):
if not checkIPnMask(value) and not checkIP6nMask(value) \
and not check_mac(value) and not \
(value.startswith("ipset:") and len(value) > 6):
raise FirewallError(errors.INVALID_ADDR,
"'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset" % value)
return value
def parse_port(self, value, separator="/"):
try:
(port, proto) = value.split(separator)
except ValueError:
raise FirewallError(errors.INVALID_PORT, "bad port (most likely "
"missing protocol), correct syntax is "
"portid[-portid]%sprotocol" % separator)
if not check_port(port):
raise FirewallError(errors.INVALID_PORT, port)
if proto not in [ "tcp", "udp", "sctp", "dccp" ]:
raise FirewallError(errors.INVALID_PROTOCOL,
"'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \
proto)
return (port, proto)
def parse_forward_port(self, value, compat=False):
port = None
protocol = None
toport = None
toaddr = None
i = 0
while ("=" in value[i:]):
opt = value[i:].split("=", 1)[0]
i += len(opt) + 1
if "=" in value[i:]:
val = value[i:].split(":", 1)[0]
else:
val = value[i:]
i += len(val) + 1
if opt == "port":
port = val
elif opt == "proto":
protocol = val
elif opt == "toport":
toport = val
elif opt == "toaddr":
toaddr = val
elif opt == "if" and compat:
# ignore if option in compat mode
pass
else:
raise FirewallError(errors.INVALID_FORWARD,
"invalid forward port arg '%s'" % (opt))
if not port:
raise FirewallError(errors.INVALID_FORWARD, "missing port")
if not protocol:
raise FirewallError(errors.INVALID_FORWARD, "missing protocol")
if not (toport or toaddr):
raise FirewallError(errors.INVALID_FORWARD, "missing destination")
if not check_port(port):
raise FirewallError(errors.INVALID_PORT, port)
if protocol not in [ "tcp", "udp", "sctp", "dccp" ]:
raise FirewallError(errors.INVALID_PROTOCOL,
"'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \
protocol)
if toport and not check_port(toport):
raise FirewallError(errors.INVALID_PORT, toport)
if toaddr and not check_single_address("ipv4", toaddr):
if compat or not check_single_address("ipv6", toaddr):
raise FirewallError(errors.INVALID_ADDR, toaddr)
return (port, protocol, toport, toaddr)
def parse_ipset_option(self, value):
args = value.split("=")
if len(args) == 1:
return (args[0], "")
elif len(args) == 2:
return args
else:
raise FirewallError(errors.INVALID_OPTION,
"invalid ipset option '%s'" % (value))
def check_destination_ipv(self, value):
ipvs = [ "ipv4", "ipv6", ]
if value not in ipvs:
raise FirewallError(errors.INVALID_IPV,
"invalid argument: %s (choose from '%s')" % \
(value, "', '".join(ipvs)))
return value
def parse_service_destination(self, value):
try:
(ipv, destination) = value.split(":", 1)
except ValueError:
raise FirewallError(errors.INVALID_DESTINATION,
"destination syntax is ipv:address[/mask]")
return (self.check_destination_ipv(ipv), destination)
def check_ipv(self, value):
ipvs = [ "ipv4", "ipv6", "eb" ]
if value not in ipvs:
raise FirewallError(errors.INVALID_IPV,
"invalid argument: %s (choose from '%s')" % \
(value, "', '".join(ipvs)))
return value
def check_helper_family(self, value):
ipvs = [ "", "ipv4", "ipv6" ]
if value not in ipvs:
raise FirewallError(errors.INVALID_IPV,
"invalid argument: %s (choose from '%s')" % \
(value, "', '".join(ipvs)))
return value
def check_module(self, value):
if not value.startswith("nf_conntrack_"):
raise FirewallError(
errors.INVALID_MODULE,
"'%s' does not start with 'nf_conntrack_'" % value)
if len(value.replace("nf_conntrack_", "")) < 1:
raise FirewallError(errors.INVALID_MODULE,
"Module name '%s' too short" % value)
return value
def print_zone_policy_info(self, zone, settings, default_zone=None, extra_interfaces=[], isPolicy=True): # pylint: disable=R0914
target = settings.getTarget()
services = settings.getServices()
ports = settings.getPorts()
protocols = settings.getProtocols()
masquerade = settings.getMasquerade()
forward_ports = settings.getForwardPorts()
source_ports = settings.getSourcePorts()
icmp_blocks = settings.getIcmpBlocks()
rules = settings.getRichRules()
description = settings.getDescription()
short_description = settings.getShort()
if isPolicy:
ingress_zones = settings.getIngressZones()
egress_zones = settings.getEgressZones()
priority = settings.getPriority()
else:
icmp_block_inversion = settings.getIcmpBlockInversion()
interfaces = sorted(set(settings.getInterfaces() + extra_interfaces))
sources = settings.getSources()
forward = settings.getForward()
def rich_rule_sorted_key(rule):
priority = 0
search_str = "priority="
try:
i = rule.index(search_str)
except ValueError:
pass
else:
i += len(search_str)
priority = int(rule[i:i+(rule[i:].index(" "))].replace("\"", ""))
return priority
attributes = []
if default_zone is not None:
if zone == default_zone:
attributes.append("default")
if (not isPolicy and (interfaces or sources)) or \
( isPolicy and ingress_zones and egress_zones):
attributes.append("active")
if attributes:
zone = zone + " (%s)" % ", ".join(attributes)
self.print_msg(zone)
if self.verbose:
self.print_msg(" summary: " + short_description)
self.print_msg(" description: " + description)
if isPolicy:
self.print_msg(" priority: " + str(priority))
self.print_msg(" target: " + target)
if not isPolicy:
self.print_msg(" icmp-block-inversion: %s" % \
("yes" if icmp_block_inversion else "no"))
if isPolicy:
self.print_msg(" ingress-zones: " + " ".join(ingress_zones))
self.print_msg(" egress-zones: " + " ".join(egress_zones))
else:
self.print_msg(" interfaces: " + " ".join(interfaces))
self.print_msg(" sources: " + " ".join(sources))
self.print_msg(" services: " + " ".join(sorted(services)))
self.print_msg(" ports: " + " ".join(["%s/%s" % (port[0], port[1])
for port in ports]))
self.print_msg(" protocols: " + " ".join(sorted(protocols)))
if not isPolicy:
self.print_msg(" forward: %s" % ("yes" if forward else "no"))
self.print_msg(" masquerade: %s" % ("yes" if masquerade else "no"))
self.print_msg(" forward-ports: " + ("\n\t" if forward_ports else "") +
"\n\t".join(["port=%s:proto=%s:toport=%s:toaddr=%s" % \
(port, proto, toport, toaddr)
for (port, proto, toport, toaddr) in \
forward_ports]))
self.print_msg(" source-ports: " +
" ".join(["%s/%s" % (port[0], port[1])
for port in source_ports]))
self.print_msg(" icmp-blocks: " + " ".join(icmp_blocks))
self.print_msg(" rich rules: " + ("\n\t" if rules else "") +
"\n\t".join(sorted(rules, key=rich_rule_sorted_key)))
def print_zone_info(self, zone, settings, default_zone=None, extra_interfaces=[]):
self.print_zone_policy_info(zone, settings, default_zone=default_zone, extra_interfaces=extra_interfaces, isPolicy=False)
def print_policy_info(self, policy, settings, default_zone=None, extra_interfaces=[]):
self.print_zone_policy_info(policy, settings, default_zone=default_zone, extra_interfaces=extra_interfaces, isPolicy=True)
def print_service_info(self, service, settings):
ports = settings.getPorts()
protocols = settings.getProtocols()
source_ports = settings.getSourcePorts()
modules = settings.getModules()
description = settings.getDescription()
destinations = settings.getDestinations()
short_description = settings.getShort()
includes = settings.getIncludes()
helpers = settings.getHelpers()
self.print_msg(service)
if self.verbose:
self.print_msg(" summary: " + short_description)
self.print_msg(" description: " + description)
self.print_msg(" ports: " + " ".join(["%s/%s" % (port[0], port[1])
for port in ports]))
self.print_msg(" protocols: " + " ".join(protocols))
self.print_msg(" source-ports: " +
" ".join(["%s/%s" % (port[0], port[1])
for port in source_ports]))
self.print_msg(" modules: " + " ".join(modules))
self.print_msg(" destination: " +
" ".join(["%s:%s" % (k, v)
for k, v in destinations.items()]))
self.print_msg(" includes: " + " ".join(sorted(includes)))
self.print_msg(" helpers: " + " ".join(sorted(helpers)))
def print_icmptype_info(self, icmptype, settings):
destinations = settings.getDestinations()
description = settings.getDescription()
short_description = settings.getShort()
if len(destinations) == 0:
destinations = [ "ipv4", "ipv6" ]
self.print_msg(icmptype)
if self.verbose:
self.print_msg(" summary: " + short_description)
self.print_msg(" description: " + description)
self.print_msg(" destination: " + " ".join(destinations))
def print_ipset_info(self, ipset, settings):
ipset_type = settings.getType()
options = settings.getOptions()
entries = settings.getEntries()
description = settings.getDescription()
short_description = settings.getShort()
self.print_msg(ipset)
if self.verbose:
self.print_msg(" summary: " + short_description)
self.print_msg(" description: " + description)
self.print_msg(" type: " + ipset_type)
self.print_msg(" options: " + " ".join(["%s=%s" % (k, v) if v else k
for k, v in options.items()]))
self.print_msg(" entries: " + " ".join(entries))
def print_helper_info(self, helper, settings):
ports = settings.getPorts()
module = settings.getModule()
family = settings.getFamily()
description = settings.getDescription()
short_description = settings.getShort()
self.print_msg(helper)
if self.verbose:
self.print_msg(" summary: " + short_description)
self.print_msg(" description: " + description)
self.print_msg(" family: " + family)
self.print_msg(" module: " + module)
self.print_msg(" ports: " + " ".join(["%s/%s" % (port[0], port[1])
for port in ports]))
def print_query_result(self, value):
if value:
self.print_and_exit("yes")
else:
self.print_and_exit("no", 1)
def exception_handler(self, exception_message):
if not self.__use_exception_handler:
raise
self.fail_if_not_authorized(exception_message)
code = FirewallError.get_code(str(exception_message))
if code in [ errors.ALREADY_ENABLED, errors.NOT_ENABLED,
errors.ZONE_ALREADY_SET, errors.ALREADY_SET ]:
self.print_warning("Warning: %s" % exception_message)
else:
self.print_and_exit("Error: %s" % exception_message, code)
def fail_if_not_authorized(self, exception_message):
if "NotAuthorizedException" in exception_message:
msg = """Authorization failed.
Make sure polkit agent is running or run the application as superuser."""
self.print_and_exit(msg, errors.NOT_AUTHORIZED)
def deactivate_exception_handler(self):
self.__use_exception_handler = False
def activate_exception_handler(self):
self.__use_exception_handler = True
def get_ipset_entries_from_file(self, filename):
entries = [ ]
entries_set = set()
f = open(filename)
for line in f:
if not line:
break
line = line.strip()
if len(line) < 1 or line[0] in ['#', ';']:
continue
if line not in entries_set:
entries.append(line)
entries_set.add(line)
f.close()
return entries
core/__init__.py 0000644 00000000000 15035135172 0007575 0 ustar 00 core/nftables.py 0000644 00000305427 15035135172 0007661 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2018 Red Hat, Inc.
#
# Authors:
# Eric Garver <e@erig.me>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from __future__ import absolute_import
import copy
import json
import ipaddress
from firewall.core.logger import log
from firewall.functions import check_mac, getPortRange, normalizeIP6, \
check_single_address, check_address
from firewall.errors import FirewallError, UNKNOWN_ERROR, INVALID_RULE, \
INVALID_ICMPTYPE, INVALID_TYPE, INVALID_ENTRY, \
INVALID_PORT
from firewall.core.rich import Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark, \
Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock
from nftables.nftables import Nftables
TABLE_NAME = "firewalld"
TABLE_NAME_POLICY = TABLE_NAME + "_" + "policy_drop"
POLICY_CHAIN_PREFIX = "policy_"
# Map iptables (table, chain) to hooks and priorities.
# These are well defined by NF_IP_PRI_* defines in netfilter.
#
# This is analogous to ipXtables.BUILT_IN_CHAINS, but we omit the chains that
# are only used for direct rules.
#
# Note: All hooks use their standard position + NFT_HOOK_OFFSET. This means
# iptables will have DROP precedence. It also means that even if iptables
# ACCEPTs a packet it may still be dropped later by firewalld's rules.
#
NFT_HOOK_OFFSET = 10
IPTABLES_TO_NFT_HOOK = {
#"security": {
# "INPUT": ("input", 50 + NFT_HOOK_OFFSET),
# "OUTPUT": ("output", 50 + NFT_HOOK_OFFSET),
# "FORWARD": ("forward", 50 + NFT_HOOK_OFFSET),
#},
"raw": {
# "PREROUTING": ("prerouting", -300 + NFT_HOOK_OFFSET),
# "OUTPUT": ("output", -300 + NFT_HOOK_OFFSET),
},
"mangle": {
"PREROUTING": ("prerouting", -150 + NFT_HOOK_OFFSET),
# "POSTROUTING": ("postrouting", -150 + NFT_HOOK_OFFSET),
# "INPUT": ("input", -150 + NFT_HOOK_OFFSET),
# "OUTPUT": ("output", -150 + NFT_HOOK_OFFSET),
# "FORWARD": ("forward", -150 + NFT_HOOK_OFFSET),
},
"nat": {
"PREROUTING": ("prerouting", -100 + NFT_HOOK_OFFSET),
"POSTROUTING": ("postrouting", 100 + NFT_HOOK_OFFSET),
# "INPUT": ("input", 100 + NFT_HOOK_OFFSET),
# "OUTPUT": ("output", -100 + NFT_HOOK_OFFSET),
},
"filter": {
"PREROUTING": ("prerouting", 0 + NFT_HOOK_OFFSET),
"INPUT": ("input", 0 + NFT_HOOK_OFFSET),
"FORWARD": ("forward", 0 + NFT_HOOK_OFFSET),
"OUTPUT": ("output", 0 + NFT_HOOK_OFFSET),
},
}
def _icmp_types_fragments(protocol, type, code=None):
fragments = [{"match": {"left": {"payload": {"protocol": protocol, "field": "type"}},
"op": "==",
"right": type}}]
if code is not None:
fragments.append({"match": {"left": {"payload": {"protocol": protocol, "field": "code"}},
"op": "==",
"right": code}})
return fragments
# Most ICMP types are provided by nft, but for the codes we have to use numeric
# values.
#
ICMP_TYPES_FRAGMENTS = {
"ipv4": {
"communication-prohibited": _icmp_types_fragments("icmp", "destination-unreachable", 13),
"destination-unreachable": _icmp_types_fragments("icmp", "destination-unreachable"),
"echo-reply": _icmp_types_fragments("icmp", "echo-reply"),
"echo-request": _icmp_types_fragments("icmp", "echo-request"),
"fragmentation-needed": _icmp_types_fragments("icmp", "destination-unreachable", 4),
"host-precedence-violation": _icmp_types_fragments("icmp", "destination-unreachable", 14),
"host-prohibited": _icmp_types_fragments("icmp", "destination-unreachable", 10),
"host-redirect": _icmp_types_fragments("icmp", "redirect", 1),
"host-unknown": _icmp_types_fragments("icmp", "destination-unreachable", 7),
"host-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 1),
"ip-header-bad": _icmp_types_fragments("icmp", "parameter-problem", 1),
"network-prohibited": _icmp_types_fragments("icmp", "destination-unreachable", 8),
"network-redirect": _icmp_types_fragments("icmp", "redirect", 0),
"network-unknown": _icmp_types_fragments("icmp", "destination-unreachable", 6),
"network-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 0),
"parameter-problem": _icmp_types_fragments("icmp", "parameter-problem"),
"port-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 3),
"precedence-cutoff": _icmp_types_fragments("icmp", "destination-unreachable", 15),
"protocol-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 2),
"redirect": _icmp_types_fragments("icmp", "redirect"),
"required-option-missing": _icmp_types_fragments("icmp", "parameter-problem", 1),
"router-advertisement": _icmp_types_fragments("icmp", "router-advertisement"),
"router-solicitation": _icmp_types_fragments("icmp", "router-solicitation"),
"source-quench": _icmp_types_fragments("icmp", "source-quench"),
"source-route-failed": _icmp_types_fragments("icmp", "destination-unreachable", 5),
"time-exceeded": _icmp_types_fragments("icmp", "time-exceeded"),
"timestamp-reply": _icmp_types_fragments("icmp", "timestamp-reply"),
"timestamp-request": _icmp_types_fragments("icmp", "timestamp-request"),
"tos-host-redirect": _icmp_types_fragments("icmp", "redirect", 3),
"tos-host-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 12),
"tos-network-redirect": _icmp_types_fragments("icmp", "redirect", 2),
"tos-network-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 11),
"ttl-zero-during-reassembly": _icmp_types_fragments("icmp", "time-exceeded", 1),
"ttl-zero-during-transit": _icmp_types_fragments("icmp", "time-exceeded", 0),
},
"ipv6": {
"address-unreachable": _icmp_types_fragments("icmpv6", "destination-unreachable", 3),
"bad-header": _icmp_types_fragments("icmpv6", "parameter-problem", 0),
"beyond-scope": _icmp_types_fragments("icmpv6", "destination-unreachable", 2),
"communication-prohibited": _icmp_types_fragments("icmpv6", "destination-unreachable", 1),
"destination-unreachable": _icmp_types_fragments("icmpv6", "destination-unreachable"),
"echo-reply": _icmp_types_fragments("icmpv6", "echo-reply"),
"echo-request": _icmp_types_fragments("icmpv6", "echo-request"),
"failed-policy": _icmp_types_fragments("icmpv6", "destination-unreachable", 5),
"mld-listener-done": _icmp_types_fragments("icmpv6", "mld-listener-done"),
"mld-listener-query": _icmp_types_fragments("icmpv6", "mld-listener-query"),
"mld-listener-report": _icmp_types_fragments("icmpv6", "mld-listener-report"),
"mld2-listener-report": _icmp_types_fragments("icmpv6", "mld2-listener-report"),
"neighbour-advertisement": _icmp_types_fragments("icmpv6", "nd-neighbor-advert"),
"neighbour-solicitation": _icmp_types_fragments("icmpv6", "nd-neighbor-solicit"),
"no-route": _icmp_types_fragments("icmpv6", "destination-unreachable", 0),
"packet-too-big": _icmp_types_fragments("icmpv6", "packet-too-big"),
"parameter-problem": _icmp_types_fragments("icmpv6", "parameter-problem"),
"port-unreachable": _icmp_types_fragments("icmpv6", "destination-unreachable", 4),
"redirect": _icmp_types_fragments("icmpv6", "nd-redirect"),
"reject-route": _icmp_types_fragments("icmpv6", "destination-unreachable", 6),
"router-advertisement": _icmp_types_fragments("icmpv6", "nd-router-advert"),
"router-solicitation": _icmp_types_fragments("icmpv6", "nd-router-solicit"),
"time-exceeded": _icmp_types_fragments("icmpv6", "time-exceeded"),
"ttl-zero-during-reassembly": _icmp_types_fragments("icmpv6", "time-exceeded", 1),
"ttl-zero-during-transit": _icmp_types_fragments("icmpv6", "time-exceeded", 0),
"unknown-header-type": _icmp_types_fragments("icmpv6", "parameter-problem", 1),
"unknown-option": _icmp_types_fragments("icmpv6", "parameter-problem", 2),
}
}
class nftables(object):
name = "nftables"
policies_supported = True
def __init__(self, fw):
self._fw = fw
self.restore_command_exists = True
self.available_tables = []
self.rule_to_handle = {}
self.rule_ref_count = {}
self.rich_rule_priority_counts = {}
self.policy_priority_counts = {}
self.zone_source_index_cache = {}
self.created_tables = {"inet": [], "ip": [], "ip6": []}
self.nftables = Nftables()
self.nftables.set_echo_output(True)
self.nftables.set_handle_output(True)
def _run_replace_zone_source(self, rule, zone_source_index_cache):
for verb in ["add", "insert", "delete"]:
if verb in rule:
break
if "%%ZONE_SOURCE%%" in rule[verb]["rule"]:
zone_source = (rule[verb]["rule"]["%%ZONE_SOURCE%%"]["zone"],
rule[verb]["rule"]["%%ZONE_SOURCE%%"]["address"])
del rule[verb]["rule"]["%%ZONE_SOURCE%%"]
elif "%%ZONE_INTERFACE%%" in rule[verb]["rule"]:
zone_source = None
del rule[verb]["rule"]["%%ZONE_INTERFACE%%"]
else:
return
family = rule[verb]["rule"]["family"]
if zone_source and verb == "delete":
if family in zone_source_index_cache and \
zone_source in zone_source_index_cache[family]:
zone_source_index_cache[family].remove(zone_source)
elif verb != "delete":
if family not in zone_source_index_cache:
zone_source_index_cache[family] = []
if zone_source:
# order source based dispatch by zone name
if zone_source not in zone_source_index_cache[family]:
zone_source_index_cache[family].append(zone_source)
zone_source_index_cache[family].sort(key=lambda x: x[0])
index = zone_source_index_cache[family].index(zone_source)
else:
if self._fw._allow_zone_drifting:
index = 0
else:
index = len(zone_source_index_cache[family])
_verb_snippet = rule[verb]
del rule[verb]
if index == 0:
rule["insert"] = _verb_snippet
else:
index -= 1 # point to the rule before insertion point
rule["add"] = _verb_snippet
rule["add"]["rule"]["index"] = index
def reverse_rule(self, dict):
if "insert" in dict:
return {"delete": copy.deepcopy(dict["insert"])}
elif "add" in dict:
return {"delete": copy.deepcopy(dict["add"])}
else:
raise FirewallError(UNKNOWN_ERROR, "Failed to reverse rule")
def _set_rule_replace_priority(self, rule, priority_counts, token):
for verb in ["add", "insert", "delete"]:
if verb in rule:
break
if token in rule[verb]["rule"]:
priority = rule[verb]["rule"][token]
del rule[verb]["rule"][token]
if type(priority) != int:
raise FirewallError(INVALID_RULE, "priority must be followed by a number")
chain = (rule[verb]["rule"]["family"], rule[verb]["rule"]["chain"]) # family, chain
# Add the rule to the priority counts. We don't need to store the
# rule, just bump the ref count for the priority value.
if verb == "delete":
if chain not in priority_counts or \
priority not in priority_counts[chain] or \
priority_counts[chain][priority] <= 0:
raise FirewallError(UNKNOWN_ERROR, "nonexistent or underflow of priority count")
priority_counts[chain][priority] -= 1
else:
if chain not in priority_counts:
priority_counts[chain] = {}
if priority not in priority_counts[chain]:
priority_counts[chain][priority] = 0
# calculate index of new rule
index = 0
for p in sorted(priority_counts[chain].keys()):
if p == priority and verb == "insert":
break
index += priority_counts[chain][p]
if p == priority and verb == "add":
break
priority_counts[chain][priority] += 1
_verb_snippet = rule[verb]
del rule[verb]
if index == 0:
rule["insert"] = _verb_snippet
else:
index -= 1 # point to the rule before insertion point
rule["add"] = _verb_snippet
rule["add"]["rule"]["index"] = index
def _get_rule_key(self, rule):
for verb in ["add", "insert", "delete"]:
if verb in rule and "rule" in rule[verb]:
rule_key = copy.deepcopy(rule[verb]["rule"])
for non_key in ["index", "handle", "position"]:
if non_key in rule_key:
del rule_key[non_key]
# str(rule_key) is insufficient because dictionary order is
# not stable.. so abuse the JSON library
rule_key = json.dumps(rule_key, sort_keys=True)
return rule_key
# Not a rule (it's a table, chain, etc)
return None
def set_rules(self, rules, log_denied):
_valid_verbs = ["add", "insert", "delete", "flush", "replace"]
_valid_add_verbs = ["add", "insert", "replace"]
_deduplicated_rules = []
_executed_rules = []
rich_rule_priority_counts = copy.deepcopy(self.rich_rule_priority_counts)
policy_priority_counts = copy.deepcopy(self.policy_priority_counts)
zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache)
rule_ref_count = self.rule_ref_count.copy()
for rule in rules:
if type(rule) != dict:
raise FirewallError(UNKNOWN_ERROR, "rule must be a dictionary, rule: %s" % (rule))
for verb in _valid_verbs:
if verb in rule:
break
if verb not in rule:
raise FirewallError(INVALID_RULE, "no valid verb found, rule: %s" % (rule))
rule_key = self._get_rule_key(rule)
# rule deduplication
if rule_key in rule_ref_count:
log.debug2("%s: prev rule ref cnt %d, %s", self.__class__,
rule_ref_count[rule_key], rule_key)
if verb != "delete":
rule_ref_count[rule_key] += 1
continue
elif rule_ref_count[rule_key] > 1:
rule_ref_count[rule_key] -= 1
continue
elif rule_ref_count[rule_key] == 1:
rule_ref_count[rule_key] -= 1
else:
raise FirewallError(UNKNOWN_ERROR, "rule ref count bug: rule_key '%s', cnt %d"
% (rule_key, rule_ref_count[rule_key]))
elif rule_key and verb != "delete":
rule_ref_count[rule_key] = 1
_deduplicated_rules.append(rule)
_rule = copy.deepcopy(rule)
if rule_key:
# filter empty rule expressions. Rich rules add quite a bit of
# them, but it makes the rest of the code simpler. libnftables
# does not tolerate them.
_rule[verb]["rule"]["expr"] = list(filter(None, _rule[verb]["rule"]["expr"]))
self._set_rule_replace_priority(_rule, rich_rule_priority_counts, "%%RICH_RULE_PRIORITY%%")
self._set_rule_replace_priority(_rule, policy_priority_counts, "%%POLICY_PRIORITY%%")
self._run_replace_zone_source(_rule, zone_source_index_cache)
# delete using rule handle
if verb == "delete":
_rule = {"delete": {"rule": {"family": _rule["delete"]["rule"]["family"],
"table": _rule["delete"]["rule"]["table"],
"chain": _rule["delete"]["rule"]["chain"],
"handle": self.rule_to_handle[rule_key]}}}
_executed_rules.append(_rule)
json_blob = {"nftables": [{"metainfo": {"json_schema_version": 1}}] + _executed_rules}
if log.getDebugLogLevel() >= 3:
# guarded with if statement because json.dumps() is expensive.
log.debug3("%s: calling python-nftables with JSON blob: %s", self.__class__,
json.dumps(json_blob))
rc, output, error = self.nftables.json_cmd(json_blob)
if rc != 0:
raise ValueError("'%s' failed: %s\nJSON blob:\n%s" % ("python-nftables", error, json.dumps(json_blob)))
self.rich_rule_priority_counts = rich_rule_priority_counts
self.policy_priority_counts = policy_priority_counts
self.zone_source_index_cache = zone_source_index_cache
self.rule_ref_count = rule_ref_count
index = 0
for rule in _deduplicated_rules:
index += 1 # +1 due to metainfo
rule_key = self._get_rule_key(rule)
if not rule_key:
continue
if "delete" in rule:
del self.rule_to_handle[rule_key]
del self.rule_ref_count[rule_key]
continue
for verb in _valid_add_verbs:
if verb in output["nftables"][index]:
break
if verb not in output["nftables"][index]:
continue
self.rule_to_handle[rule_key] = output["nftables"][index][verb]["rule"]["handle"]
def set_rule(self, rule, log_denied):
self.set_rules([rule], log_denied)
return ""
def get_available_tables(self, table=None):
# Tables always exist in nftables
return [table] if table else IPTABLES_TO_NFT_HOOK.keys()
def _build_delete_table_rules(self, table):
# To avoid nftables returning ENOENT we always add the table before
# deleting to guarantee it will exist.
#
# In the future, this add+delete should be replaced with "destroy", but
# that verb is too new to rely upon.
rules = []
for family in ["inet", "ip", "ip6"]:
rules.append({"add": {"table": {"family": family,
"name": table}}})
rules.append({"delete": {"table": {"family": family,
"name": table}}})
return rules
def build_flush_rules(self):
# Policy is stashed in a separate table that we're _not_ going to
# flush. As such, we retain the policy rule handles and ref counts.
saved_rule_to_handle = {}
saved_rule_ref_count = {}
for rule in self._build_set_policy_rules_ct_rules(True):
policy_key = self._get_rule_key(rule)
if policy_key in self.rule_to_handle:
saved_rule_to_handle[policy_key] = self.rule_to_handle[policy_key]
saved_rule_ref_count[policy_key] = self.rule_ref_count[policy_key]
self.rule_to_handle = saved_rule_to_handle
self.rule_ref_count = saved_rule_ref_count
self.rich_rule_priority_counts = {}
self.policy_priority_counts = {}
self.zone_source_index_cache = {}
for family in ["inet", "ip", "ip6"]:
if TABLE_NAME in self.created_tables[family]:
self.created_tables[family].remove(TABLE_NAME)
return self._build_delete_table_rules(TABLE_NAME)
def _build_set_policy_rules_ct_rules(self, enable):
add_del = { True: "add", False: "delete" }[enable]
rules = []
for hook in ["input", "forward", "output"]:
rules.append({add_del: {"rule": {"family": "inet",
"table": TABLE_NAME_POLICY,
"chain": "%s_%s" % ("filter", hook),
"expr": [{"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["established", "related"]}}},
{"accept": None}]}}})
return rules
def build_set_policy_rules(self, policy):
# Policy is not exposed to the user. It's only to make sure we DROP
# packets while reloading and for panic mode. As such, using hooks with
# a higher priority than our base chains is sufficient.
rules = []
if policy == "PANIC":
rules.append({"add": {"table": {"family": "inet",
"name": TABLE_NAME_POLICY}}})
self.created_tables["inet"].append(TABLE_NAME_POLICY)
# Use "raw" priority for panic mode. This occurs before
# conntrack, mangle, nat, etc
for hook in ["prerouting", "output"]:
rules.append({"add": {"chain": {"family": "inet",
"table": TABLE_NAME_POLICY,
"name": "%s_%s" % ("raw", hook),
"type": "filter",
"hook": hook,
"prio": -300 + NFT_HOOK_OFFSET - 1,
"policy": "drop"}}})
if policy == "DROP":
rules.append({"add": {"table": {"family": "inet",
"name": TABLE_NAME_POLICY}}})
self.created_tables["inet"].append(TABLE_NAME_POLICY)
# To drop everything except existing connections we use
# "filter" because it occurs _after_ conntrack.
for hook in ["input", "forward", "output"]:
rules.append({"add": {"chain": {"family": "inet",
"table": TABLE_NAME_POLICY,
"name": "%s_%s" % ("filter", hook),
"type": "filter",
"hook": hook,
"prio": 0 + NFT_HOOK_OFFSET - 1,
"policy": "drop"}}})
rules += self._build_set_policy_rules_ct_rules(True)
elif policy == "ACCEPT":
for rule in self._build_set_policy_rules_ct_rules(False):
policy_key = self._get_rule_key(rule)
if policy_key in self.rule_to_handle:
rules.append(rule)
rules += self._build_delete_table_rules(TABLE_NAME_POLICY)
if TABLE_NAME_POLICY in self.created_tables["inet"]:
self.created_tables["inet"].remove(TABLE_NAME_POLICY)
else:
FirewallError(UNKNOWN_ERROR, "not implemented")
return rules
def supported_icmp_types(self, ipv=None):
# nftables supports any icmp_type via arbitrary type/code matching.
# We just need a translation for it in ICMP_TYPES_FRAGMENTS.
supported = set()
for _ipv in [ipv] if ipv else ICMP_TYPES_FRAGMENTS.keys():
supported.update(ICMP_TYPES_FRAGMENTS[_ipv].keys())
return list(supported)
def build_default_tables(self):
default_tables = []
for family in ["inet", "ip", "ip6"]:
default_tables.append({"add": {"table": {"family": family,
"name": TABLE_NAME}}})
self.created_tables[family].append(TABLE_NAME)
return default_tables
def build_default_rules(self, log_denied="off"):
default_rules = []
for chain in IPTABLES_TO_NFT_HOOK["mangle"].keys():
default_rules.append({"add": {"chain": {"family": "inet",
"table": TABLE_NAME,
"name": "mangle_%s" % chain,
"type": "filter",
"hook": "%s" % IPTABLES_TO_NFT_HOOK["mangle"][chain][0],
"prio": IPTABLES_TO_NFT_HOOK["mangle"][chain][1]}}})
for dispatch_suffix in ["POLICIES_pre", "ZONES_SOURCE", "ZONES", "POLICIES_post"] if self._fw._allow_zone_drifting else ["POLICIES_pre", "ZONES", "POLICIES_post"]:
default_rules.append({"add": {"chain": {"family": "inet",
"table": TABLE_NAME,
"name": "mangle_%s_%s" % (chain, dispatch_suffix)}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "mangle_%s" % chain,
"expr": [{"jump": {"target": "mangle_%s_%s" % (chain, dispatch_suffix)}}]}}})
for family in ["ip", "ip6"]:
for chain in IPTABLES_TO_NFT_HOOK["nat"].keys():
default_rules.append({"add": {"chain": {"family": family,
"table": TABLE_NAME,
"name": "nat_%s" % chain,
"type": "nat",
"hook": "%s" % IPTABLES_TO_NFT_HOOK["nat"][chain][0],
"prio": IPTABLES_TO_NFT_HOOK["nat"][chain][1]}}})
for dispatch_suffix in ["POLICIES_pre", "ZONES_SOURCE", "ZONES", "POLICIES_post"] if self._fw._allow_zone_drifting else ["POLICIES_pre", "ZONES", "POLICIES_post"]:
default_rules.append({"add": {"chain": {"family": family,
"table": TABLE_NAME,
"name": "nat_%s_%s" % (chain, dispatch_suffix)}}})
default_rules.append({"add": {"rule": {"family": family,
"table": TABLE_NAME,
"chain": "nat_%s" % chain,
"expr": [{"jump": {"target": "nat_%s_%s" % (chain, dispatch_suffix)}}]}}})
for chain in IPTABLES_TO_NFT_HOOK["filter"].keys():
default_rules.append({"add": {"chain": {"family": "inet",
"table": TABLE_NAME,
"name": "filter_%s" % chain,
"type": "filter",
"hook": "%s" % IPTABLES_TO_NFT_HOOK["filter"][chain][0],
"prio": IPTABLES_TO_NFT_HOOK["filter"][chain][1]}}})
# filter, INPUT
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "INPUT",
"expr": [{"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["established", "related"]}}},
{"accept": None}]}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "INPUT",
"expr": [{"match": {"left": {"ct": {"key": "status"}},
"op": "in",
"right": "dnat"}},
{"accept": None}]}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "INPUT",
"expr": [{"match": {"left": {"meta": {"key": "iifname"}},
"op": "==",
"right": "lo"}},
{"accept": None}]}}})
for dispatch_suffix in ["POLICIES_pre", "ZONES_SOURCE", "ZONES", "POLICIES_post"] if self._fw._allow_zone_drifting else ["POLICIES_pre", "ZONES", "POLICIES_post"]:
default_rules.append({"add": {"chain": {"family": "inet",
"table": TABLE_NAME,
"name": "filter_%s_%s" % ("INPUT", dispatch_suffix)}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "INPUT",
"expr": [{"jump": {"target": "filter_%s_%s" % ("INPUT", dispatch_suffix)}}]}}})
if log_denied != "off":
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "INPUT",
"expr": [{"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["invalid"]}}},
self._pkttype_match_fragment(log_denied),
{"log": {"prefix": "STATE_INVALID_DROP: "}}]}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "INPUT",
"expr": [{"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["invalid"]}}},
{"drop": None}]}}})
if log_denied != "off":
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "INPUT",
"expr": [self._pkttype_match_fragment(log_denied),
{"log": {"prefix": "FINAL_REJECT: "}}]}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "INPUT",
"expr": [{"reject": {"type": "icmpx", "expr": "admin-prohibited"}}]}}})
# filter, FORWARD
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "FORWARD",
"expr": [{"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["established", "related"]}}},
{"accept": None}]}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "FORWARD",
"expr": [{"match": {"left": {"ct": {"key": "status"}},
"op": "in",
"right": "dnat"}},
{"accept": None}]}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "FORWARD",
"expr": [{"match": {"left": {"meta": {"key": "iifname"}},
"op": "==",
"right": "lo"}},
{"accept": None}]}}})
for dispatch_suffix in ["POLICIES_pre"]:
default_rules.append({"add": {"chain": {"family": "inet",
"table": TABLE_NAME,
"name": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "FORWARD",
"expr": [{"jump": {"target": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}]}}})
for direction in ["IN", "OUT"]:
for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
default_rules.append({"add": {"chain": {"family": "inet",
"table": TABLE_NAME,
"name": "filter_%s_%s_%s" % ("FORWARD", direction, dispatch_suffix)}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "FORWARD",
"expr": [{"jump": {"target": "filter_%s_%s_%s" % ("FORWARD", direction, dispatch_suffix)}}]}}})
for dispatch_suffix in ["POLICIES_post"]:
default_rules.append({"add": {"chain": {"family": "inet",
"table": TABLE_NAME,
"name": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "FORWARD",
"expr": [{"jump": {"target": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}]}}})
if log_denied != "off":
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "FORWARD",
"expr": [{"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["invalid"]}}},
self._pkttype_match_fragment(log_denied),
{"log": {"prefix": "STATE_INVALID_DROP: "}}]}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "FORWARD",
"expr": [{"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["invalid"]}}},
{"drop": None}]}}})
if log_denied != "off":
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "FORWARD",
"expr": [self._pkttype_match_fragment(log_denied),
{"log": {"prefix": "FINAL_REJECT: "}}]}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "FORWARD",
"expr": [{"reject": {"type": "icmpx", "expr": "admin-prohibited"}}]}}})
# filter, OUTPUT
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "OUTPUT",
"expr": [{"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["established", "related"]}}},
{"accept": None}]}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_OUTPUT",
"expr": [{"match": {"left": {"meta": {"key": "oifname"}},
"op": "==",
"right": "lo"}},
{"accept": None}]}}})
for dispatch_suffix in ["POLICIES_pre"]:
default_rules.append({"add": {"chain": {"family": "inet",
"table": TABLE_NAME,
"name": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "OUTPUT",
"expr": [{"jump": {"target": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}]}}})
for dispatch_suffix in ["POLICIES_post"]:
default_rules.append({"add": {"chain": {"family": "inet",
"table": TABLE_NAME,
"name": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}})
default_rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s" % "OUTPUT",
"expr": [{"jump": {"target": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}]}}})
return default_rules
def get_zone_table_chains(self, table):
if table == "filter":
return ["INPUT", "FORWARD_IN", "FORWARD_OUT"]
if table == "mangle":
return ["PREROUTING"]
if table == "nat":
return ["PREROUTING", "POSTROUTING"]
return []
def build_policy_ingress_egress_rules(self, enable, policy, table, chain,
ingress_interfaces, egress_interfaces,
ingress_sources, egress_sources,
family="inet"):
# nat tables need to use ip/ip6 family
if table == "nat" and family == "inet":
rules = []
rules.extend(self.build_policy_ingress_egress_rules(enable, policy, table, chain,
ingress_interfaces, egress_interfaces,
ingress_sources, egress_sources,
family="ip"))
rules.extend(self.build_policy_ingress_egress_rules(enable, policy, table, chain,
ingress_interfaces, egress_interfaces,
ingress_sources, egress_sources,
family="ip6"))
return rules
p_obj = self._fw.policy.get_policy(policy)
chain_suffix = "pre" if p_obj.priority < 0 else "post"
isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT)
ingress_fragments = []
egress_fragments = []
if ingress_interfaces:
ingress_fragments.append({"match": {"left": {"meta": {"key": "iifname"}},
"op": "==",
"right": {"set": list(ingress_interfaces)}}})
if egress_interfaces:
egress_fragments.append({"match": {"left": {"meta": {"key": "oifname"}},
"op": "==",
"right": {"set": list(egress_interfaces)}}})
ipv_to_family = {"ipv4": "ip", "ipv6": "ip6"}
if ingress_sources:
for src in ingress_sources:
# skip if this source doesn't apply to the current family.
if table == "nat":
ipv = self._fw.zone.check_source(src)
if ipv in ipv_to_family and family != ipv_to_family[ipv]:
continue
ingress_fragments.append(self._rule_addr_fragment("saddr", src))
if egress_sources:
for dst in egress_sources:
# skip if this source doesn't apply to the current family.
if table == "nat":
ipv = self._fw.zone.check_source(dst)
if ipv in ipv_to_family and family != ipv_to_family[ipv]:
continue
egress_fragments.append(self._rule_addr_fragment("daddr", dst))
def _generate_policy_dispatch_rule(ingress_fragment, egress_fragment):
expr_fragments = []
if ingress_fragment:
expr_fragments.append(ingress_fragment)
if egress_fragment:
expr_fragments.append(egress_fragment)
expr_fragments.append({"jump": {"target": "%s_%s" % (table, _policy)}})
rule = {"family": family,
"table": TABLE_NAME,
"chain": "%s_%s_POLICIES_%s" % (table, chain, chain_suffix),
"expr": expr_fragments}
rule.update(self._policy_priority_fragment(p_obj))
if enable:
return {"add": {"rule": rule}}
else:
return {"delete": {"rule": rule}}
rules = []
if ingress_fragments: # zone --> [zone, ANY, HOST]
for ingress_fragment in ingress_fragments:
if egress_fragments:
# zone --> zone
for egress_fragment in egress_fragments:
rules.append(_generate_policy_dispatch_rule(ingress_fragment, egress_fragment))
elif table =="nat" and egress_sources:
# if the egress source is not for the current family (there
# are no egress fragments), then avoid creating an invalid
# catch all rule.
pass
else:
# zone --> [ANY, HOST]
rules.append(_generate_policy_dispatch_rule(ingress_fragment, None))
elif table =="nat" and ingress_sources:
# if the ingress source is not for the current family (there are no
# ingress fragments), then avoid creating an invalid catch all
# rule.
pass
else: # [ANY, HOST] --> [zone, ANY, HOST]
if egress_fragments:
# [ANY, HOST] --> zone
for egress_fragment in egress_fragments:
rules.append(_generate_policy_dispatch_rule(None, egress_fragment))
elif table =="nat" and egress_sources:
# if the egress source is not for the current family (there are
# no egress fragments), then avoid creating an invalid catch
# all rule.
pass
else:
# [ANY, HOST] --> [ANY, HOST]
rules.append(_generate_policy_dispatch_rule(None, None))
return rules
def build_zone_source_interface_rules(self, enable, zone, policy, interface,
table, chain, append=False,
family="inet"):
# nat tables needs to use ip/ip6 family
if table == "nat" and family == "inet":
rules = []
rules.extend(self.build_zone_source_interface_rules(enable, zone, policy,
interface, table, chain, append, "ip"))
rules.extend(self.build_zone_source_interface_rules(enable, zone, policy,
interface, table, chain, append, "ip6"))
return rules
isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT)
opt = {
"PREROUTING": "iifname",
"POSTROUTING": "oifname",
"INPUT": "iifname",
"FORWARD_IN": "iifname",
"FORWARD_OUT": "oifname",
"OUTPUT": "oifname",
}[chain]
if interface[len(interface)-1] == "+":
interface = interface[:len(interface)-1] + "*"
action = "goto"
if interface == "*":
expr_fragments = [{action: {"target": "%s_%s" % (table, _policy)}}]
else:
expr_fragments = [{"match": {"left": {"meta": {"key": opt}},
"op": "==",
"right": interface}},
{action: {"target": "%s_%s" % (table, _policy)}}]
if enable and not append:
verb = "insert"
rule = {"family": family,
"table": TABLE_NAME,
"chain": "%s_%s_ZONES" % (table, chain),
"expr": expr_fragments}
rule.update(self._zone_interface_fragment())
elif enable:
verb = "add"
rule = {"family": family,
"table": TABLE_NAME,
"chain": "%s_%s_ZONES" % (table, chain),
"expr": expr_fragments}
else:
verb = "delete"
rule = {"family": family,
"table": TABLE_NAME,
"chain": "%s_%s_ZONES" % (table, chain),
"expr": expr_fragments}
if not append:
rule.update(self._zone_interface_fragment())
return [{verb: {"rule": rule}}]
def build_zone_source_address_rules(self, enable, zone, policy,
address, table, chain, family="inet"):
# nat tables needs to use ip/ip6 family
if table == "nat" and family == "inet":
rules = []
if address.startswith("ipset:"):
ipset_family = self._set_get_family(address[len("ipset:"):])
else:
ipset_family = None
if check_address("ipv4", address) or check_mac(address) or ipset_family == "ip":
rules.extend(self.build_zone_source_address_rules(enable, zone, policy,
address, table, chain, "ip"))
if check_address("ipv6", address) or check_mac(address) or ipset_family == "ip6":
rules.extend(self.build_zone_source_address_rules(enable, zone, policy,
address, table, chain, "ip6"))
return rules
isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT)
add_del = { True: "insert", False: "delete" }[enable]
opt = {
"PREROUTING": "saddr",
"POSTROUTING": "daddr",
"INPUT": "saddr",
"FORWARD_IN": "saddr",
"FORWARD_OUT": "daddr",
"OUTPUT": "daddr",
}[chain]
if self._fw._allow_zone_drifting:
zone_dispatch_chain = "%s_%s_ZONES_SOURCE" % (table, chain)
else:
zone_dispatch_chain = "%s_%s_ZONES" % (table, chain)
action = "goto"
rule = {"family": family,
"table": TABLE_NAME,
"chain": zone_dispatch_chain,
"expr": [self._rule_addr_fragment(opt, address),
{action: {"target": "%s_%s" % (table, _policy)}}]}
rule.update(self._zone_source_fragment(zone, address))
return [{add_del: {"rule": rule}}]
def build_policy_chain_rules(self, enable, policy, table, chain, family="inet"):
# nat tables needs to use ip/ip6 family
if table == "nat" and family == "inet":
rules = []
rules.extend(self.build_policy_chain_rules(enable, policy, table, chain, "ip"))
rules.extend(self.build_policy_chain_rules(enable, policy, table, chain, "ip6"))
return rules
add_del = { True: "add", False: "delete" }[enable]
isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT)
rules = []
rules.append({add_del: {"chain": {"family": family,
"table": TABLE_NAME,
"name": "%s_%s" % (table, _policy)}}})
for chain_suffix in ["pre", "log", "deny", "allow", "post"]:
rules.append({add_del: {"chain": {"family": family,
"table": TABLE_NAME,
"name": "%s_%s_%s" % (table, _policy, chain_suffix)}}})
for chain_suffix in ["pre", "log", "deny", "allow", "post"]:
rules.append({add_del: {"rule": {"family": family,
"table": TABLE_NAME,
"chain": "%s_%s" % (table, _policy),
"expr": [{"jump": {"target": "%s_%s_%s" % (table, _policy, chain_suffix)}}]}}})
target = self._fw.policy._policies[policy].target
if self._fw.get_log_denied() != "off":
if table == "filter":
if target in ["REJECT", "%%REJECT%%", "DROP"]:
log_suffix = target
if target == "%%REJECT%%":
log_suffix = "REJECT"
rules.append({add_del: {"rule": {"family": family,
"table": TABLE_NAME,
"chain": "%s_%s" % (table, _policy),
"expr": [self._pkttype_match_fragment(self._fw.get_log_denied()),
{"log": {"prefix": "\"filter_%s_%s: \"" % (_policy, log_suffix)}}]}}})
if table == "filter" and \
target in ["ACCEPT", "REJECT", "%%REJECT%%", "DROP"]:
if target in ["%%REJECT%%", "REJECT"]:
target_fragment = self._reject_fragment()
else:
target_fragment = {target.lower(): None}
rules.append({add_del: {"rule": {"family": family,
"table": TABLE_NAME,
"chain": "%s_%s" % (table, _policy),
"expr": [target_fragment]}}})
if not enable:
rules.reverse()
return rules
def _pkttype_match_fragment(self, pkttype):
if pkttype == "all":
return {}
elif pkttype in ["unicast", "broadcast", "multicast"]:
return {"match": {"left": {"meta": {"key": "pkttype"}},
"op": "==",
"right": pkttype}}
raise FirewallError(INVALID_RULE, "Invalid pkttype \"%s\"", pkttype)
def _reject_types_fragment(self, reject_type):
frags = {
# REJECT_TYPES : <nft reject rule fragment>
"icmp-host-prohibited" : {"reject": {"type": "icmp", "expr": "host-prohibited"}},
"host-prohib" : {"reject": {"type": "icmp", "expr": "host-prohibited"}},
"icmp-net-prohibited" : {"reject": {"type": "icmp", "expr": "net-prohibited"}},
"net-prohib" : {"reject": {"type": "icmp", "expr": "net-prohibited"}},
"icmp-admin-prohibited" : {"reject": {"type": "icmp", "expr": "admin-prohibited"}},
"admin-prohib" : {"reject": {"type": "icmp", "expr": "admin-prohibited"}},
"icmp6-adm-prohibited" : {"reject": {"type": "icmpv6", "expr": "admin-prohibited"}},
"adm-prohibited" : {"reject": {"type": "icmpv6", "expr": "admin-prohibited"}},
"icmp-net-unreachable" : {"reject": {"type": "icmp", "expr": "net-unreachable"}},
"net-unreach" : {"reject": {"type": "icmp", "expr": "net-unreachable"}},
"icmp-host-unreachable" : {"reject": {"type": "icmp", "expr": "host-unreachable"}},
"host-unreach" : {"reject": {"type": "icmp", "expr": "host-unreachable"}},
"icmp-port-unreachable" : {"reject": {"type": "icmp", "expr": "port-unreachable"}},
"icmp6-port-unreachable" : {"reject": {"type": "icmpv6", "expr": "port-unreachable"}},
"port-unreach" : {"reject": {"type": "icmpx", "expr": "port-unreachable"}},
"icmp-proto-unreachable" : {"reject": {"type": "icmp", "expr": "prot-unreachable"}},
"proto-unreach" : {"reject": {"type": "icmp", "expr": "prot-unreachable"}},
"icmp6-addr-unreachable" : {"reject": {"type": "icmpv6", "expr": "addr-unreachable"}},
"addr-unreach" : {"reject": {"type": "icmpv6", "expr": "addr-unreachable"}},
"icmp6-no-route" : {"reject": {"type": "icmpv6", "expr": "no-route"}},
"no-route" : {"reject": {"type": "icmpv6", "expr": "no-route"}},
"tcp-reset" : {"reject": {"type": "tcp reset"}},
"tcp-rst" : {"reject": {"type": "tcp reset"}},
}
return frags[reject_type]
def _reject_fragment(self):
return {"reject": {"type": "icmpx",
"expr": "admin-prohibited"}}
def _icmp_match_fragment(self):
return {"match": {"left": {"meta": {"key": "l4proto"}},
"op": "==",
"right": {"set": ["icmp", "icmpv6"]}}}
def _rich_rule_limit_fragment(self, limit):
if not limit:
return {}
rich_to_nft = {
"s" : "second",
"m" : "minute",
"h" : "hour",
"d" : "day",
}
rate, duration = limit.value_parse()
d = {
"rate": rate,
"per": rich_to_nft[duration],
}
burst = limit.burst_parse()
if burst is not None:
d["burst"] = burst
return {"limit": d}
def _rich_rule_chain_suffix(self, rich_rule):
if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock]:
# These are special and don't have an explicit action
pass
elif rich_rule.action:
if type(rich_rule.action) not in [Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark]:
raise FirewallError(INVALID_RULE, "Unknown action %s" % type(rich_rule.action))
else:
raise FirewallError(INVALID_RULE, "No rule action specified.")
if rich_rule.priority == 0:
if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort] or \
type(rich_rule.action) in [Rich_Accept, Rich_Mark]:
return "allow"
elif type(rich_rule.element) in [Rich_IcmpBlock] or \
type(rich_rule.action) in [Rich_Reject, Rich_Drop]:
return "deny"
elif rich_rule.priority < 0:
return "pre"
else:
return "post"
def _rich_rule_chain_suffix_from_log(self, rich_rule):
if not rich_rule.log and not rich_rule.audit:
raise FirewallError(INVALID_RULE, "Not log or audit")
if rich_rule.priority == 0:
return "log"
elif rich_rule.priority < 0:
return "pre"
else:
return "post"
def _zone_interface_fragment(self):
return {"%%ZONE_INTERFACE%%": None}
def _zone_source_fragment(self, zone, address):
if check_single_address("ipv6", address):
address = normalizeIP6(address)
elif check_address("ipv6", address):
addr_split = address.split("/")
address = normalizeIP6(addr_split[0]) + "/" + addr_split[1]
return {"%%ZONE_SOURCE%%": {"zone": zone, "address": address}}
def _policy_priority_fragment(self, policy):
return {"%%POLICY_PRIORITY%%": policy.priority}
def _rich_rule_priority_fragment(self, rich_rule):
if not rich_rule or rich_rule.priority == 0:
return {}
return {"%%RICH_RULE_PRIORITY%%": rich_rule.priority}
def _rich_rule_log(self, policy, rich_rule, enable, table, expr_fragments):
if not rich_rule.log:
return {}
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
add_del = { True: "add", False: "delete" }[enable]
chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule)
log_options = {}
if rich_rule.log.prefix:
log_options["prefix"] = "%s" % rich_rule.log.prefix
if rich_rule.log.level:
level = "warn" if "warning" == rich_rule.log.level else rich_rule.log.level
log_options["level"] = "%s" % level
rule = {"family": "inet",
"table": TABLE_NAME,
"chain": "%s_%s_%s" % (table, _policy, chain_suffix),
"expr": expr_fragments +
[self._rich_rule_limit_fragment(rich_rule.log.limit),
{"log": log_options}]}
rule.update(self._rich_rule_priority_fragment(rich_rule))
return {add_del: {"rule": rule}}
def _rich_rule_audit(self, policy, rich_rule, enable, table, expr_fragments):
if not rich_rule.audit:
return {}
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
add_del = { True: "add", False: "delete" }[enable]
chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule)
rule = {"family": "inet",
"table": TABLE_NAME,
"chain": "%s_%s_%s" % (table, _policy, chain_suffix),
"expr": expr_fragments +
[self._rich_rule_limit_fragment(rich_rule.audit.limit),
{"log": {"level": "audit"}}]}
rule.update(self._rich_rule_priority_fragment(rich_rule))
return {add_del: {"rule": rule}}
def _rich_rule_action(self, policy, rich_rule, enable, table, expr_fragments):
if not rich_rule.action:
return {}
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
add_del = { True: "add", False: "delete" }[enable]
chain_suffix = self._rich_rule_chain_suffix(rich_rule)
chain = "%s_%s_%s" % (table, _policy, chain_suffix)
if type(rich_rule.action) == Rich_Accept:
rule_action = {"accept": None}
elif type(rich_rule.action) == Rich_Reject:
if rich_rule.action.type:
rule_action = self._reject_types_fragment(rich_rule.action.type)
else:
rule_action = {"reject": None}
elif type(rich_rule.action) == Rich_Drop:
rule_action = {"drop": None}
elif type(rich_rule.action) == Rich_Mark:
table = "mangle"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
chain = "%s_%s_%s" % (table, _policy, chain_suffix)
value = rich_rule.action.set.split("/")
if len(value) > 1:
rule_action = {"mangle": {"key": {"meta": {"key": "mark"}},
"value": {"^": [{"&": [{"meta": {"key": "mark"}}, value[1]]}, value[0]]}}}
else:
rule_action = {"mangle": {"key": {"meta": {"key": "mark"}},
"value": value[0]}}
else:
raise FirewallError(INVALID_RULE,
"Unknown action %s" % type(rich_rule.action))
rule = {"family": "inet",
"table": TABLE_NAME,
"chain": chain,
"expr": expr_fragments +
[self._rich_rule_limit_fragment(rich_rule.action.limit), rule_action]}
rule.update(self._rich_rule_priority_fragment(rich_rule))
return {add_del: {"rule": rule}}
def _rule_addr_fragment(self, addr_field, address, invert=False):
if address.startswith("ipset:"):
return self._set_match_fragment(address[len("ipset:"):], True if "daddr" == addr_field else False, invert)
else:
if check_mac(address):
family = "ether"
elif check_single_address("ipv4", address):
family = "ip"
elif check_address("ipv4", address):
family = "ip"
normalized_address = ipaddress.IPv4Network(address, strict=False)
address = {"prefix": {"addr": normalized_address.network_address.compressed, "len": normalized_address.prefixlen}}
elif check_single_address("ipv6", address):
family = "ip6"
address = normalizeIP6(address)
else:
family = "ip6"
addr_len = address.split("/")
address = {"prefix": {"addr": normalizeIP6(addr_len[0]), "len": int(addr_len[1])}}
return {"match": {"left": {"payload": {"protocol": family,
"field": addr_field}},
"op": "!=" if invert else "==",
"right": address}}
def _rich_rule_family_fragment(self, rich_family):
if not rich_family:
return {}
if rich_family not in ["ipv4", "ipv6"]:
raise FirewallError(INVALID_RULE,
"Invalid family" % rich_family)
return {"match": {"left": {"meta": {"key": "nfproto"}},
"op": "==",
"right": rich_family}}
def _rich_rule_destination_fragment(self, rich_dest):
if not rich_dest:
return {}
if rich_dest.addr:
address = rich_dest.addr
elif rich_dest.ipset:
address = "ipset:" + rich_dest.ipset
return self._rule_addr_fragment("daddr", address, invert=rich_dest.invert)
def _rich_rule_source_fragment(self, rich_source):
if not rich_source:
return {}
if rich_source.addr:
address = rich_source.addr
elif hasattr(rich_source, "mac") and rich_source.mac:
address = rich_source.mac
elif hasattr(rich_source, "ipset") and rich_source.ipset:
address = "ipset:" + rich_source.ipset
return self._rule_addr_fragment("saddr", address, invert=rich_source.invert)
def _port_fragment(self, port):
range = getPortRange(port)
if isinstance(range, int) and range < 0:
raise FirewallError(INVALID_PORT)
elif len(range) == 1:
return range[0]
else:
return {"range": [range[0], range[1]]}
def build_policy_ports_rules(self, enable, policy, proto, port, destination=None, rich_rule=None):
add_del = { True: "add", False: "delete" }[enable]
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
expr_fragments = []
if rich_rule:
expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family))
if destination:
expr_fragments.append(self._rule_addr_fragment("daddr", destination))
if rich_rule:
expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination))
expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source))
expr_fragments.append({"match": {"left": {"payload": {"protocol": proto,
"field": "dport"}},
"op": "==",
"right": self._port_fragment(port)}})
if not rich_rule or type(rich_rule.action) != Rich_Mark:
expr_fragments.append({"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["new", "untracked"]}}})
rules = []
if rich_rule:
rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments))
rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments))
rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments))
else:
rules.append({add_del: {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "%s_%s_allow" % (table, _policy),
"expr": expr_fragments + [{"accept": None}]}}})
return rules
def build_policy_protocol_rules(self, enable, policy, protocol, destination=None, rich_rule=None):
add_del = { True: "add", False: "delete" }[enable]
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
expr_fragments = []
if rich_rule:
expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family))
if destination:
expr_fragments.append(self._rule_addr_fragment("daddr", destination))
if rich_rule:
expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination))
expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source))
expr_fragments.append({"match": {"left": {"meta": {"key": "l4proto"}},
"op": "==",
"right": protocol}})
if not rich_rule or type(rich_rule.action) != Rich_Mark:
expr_fragments.append({"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["new", "untracked"]}}})
rules = []
if rich_rule:
rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments))
rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments))
rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments))
else:
rules.append({add_del: {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "%s_%s_allow" % (table, _policy),
"expr": expr_fragments + [{"accept": None}]}}})
return rules
def build_policy_source_ports_rules(self, enable, policy, proto, port,
destination=None, rich_rule=None):
add_del = { True: "add", False: "delete" }[enable]
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
expr_fragments = []
if rich_rule:
expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family))
if destination:
expr_fragments.append(self._rule_addr_fragment("daddr", destination))
if rich_rule:
expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination))
expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source))
expr_fragments.append({"match": {"left": {"payload": {"protocol": proto,
"field": "sport"}},
"op": "==",
"right": self._port_fragment(port)}})
if not rich_rule or type(rich_rule.action) != Rich_Mark:
expr_fragments.append({"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["new", "untracked"]}}})
rules = []
if rich_rule:
rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments))
rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments))
rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments))
else:
rules.append({add_del: {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "%s_%s_allow" % (table, _policy),
"expr": expr_fragments + [{"accept": None}]}}})
return rules
def build_policy_helper_ports_rules(self, enable, policy, proto, port,
destination, helper_name, module_short_name):
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
add_del = { True: "add", False: "delete" }[enable]
rules = []
if enable:
rules.append({"add": {"ct helper": {"family": "inet",
"table": TABLE_NAME,
"name": "helper-%s-%s" % (helper_name, proto),
"type": module_short_name,
"protocol": proto}}})
expr_fragments = []
if destination:
expr_fragments.append(self._rule_addr_fragment("daddr", destination))
expr_fragments.append({"match": {"left": {"payload": {"protocol": proto,
"field": "dport"}},
"op": "==",
"right": self._port_fragment(port)}})
expr_fragments.append({"ct helper": "helper-%s-%s" % (helper_name, proto)})
rules.append({add_del: {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s_allow" % (_policy),
"expr": expr_fragments}}})
return rules
def build_zone_forward_rules(self, enable, zone, policy, table, interface=None, source=None):
add_del = { True: "add", False: "delete" }[enable]
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
rules = []
if interface:
if interface[len(interface)-1] == "+":
interface = interface[:len(interface)-1] + "*"
expr = [{"match": {"left": {"meta": {"key": "oifname"}},
"op": "==",
"right": interface}},
{"accept": None}]
else: # source
expr = [self._rule_addr_fragment("daddr", source), {"accept": None}]
rule = {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s_allow" % (_policy),
"expr": expr}
rules.append({add_del: {"rule": rule}})
return rules
def _build_policy_masquerade_nat_rules(self, enable, policy, family, rich_rule=None):
table = "nat"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=True)
add_del = { True: "add", False: "delete" }[enable]
expr_fragments = []
if rich_rule:
expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination))
expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source))
chain_suffix = self._rich_rule_chain_suffix(rich_rule)
else:
chain_suffix = "allow"
rule = {"family": family,
"table": TABLE_NAME,
"chain": "nat_%s_%s" % (_policy, chain_suffix),
"expr": expr_fragments +
[{"match": {"left": {"meta": {"key": "oifname"}},
"op": "!=",
"right": "lo"}},
{"masquerade": None}]}
rule.update(self._rich_rule_priority_fragment(rich_rule))
return [{add_del: {"rule": rule}}]
def build_policy_masquerade_rules(self, enable, policy, rich_rule=None):
# nat tables needs to use ip/ip6 family
rules = []
if rich_rule and (rich_rule.family and rich_rule.family == "ipv6"
or rich_rule.source and check_address("ipv6", rich_rule.source.addr)):
rules.extend(self._build_policy_masquerade_nat_rules(enable, policy, "ip6", rich_rule))
elif rich_rule and (rich_rule.family and rich_rule.family == "ipv4"
or rich_rule.source and check_address("ipv4", rich_rule.source.addr)):
rules.extend(self._build_policy_masquerade_nat_rules(enable, policy, "ip", rich_rule))
else:
rules.extend(self._build_policy_masquerade_nat_rules(enable, policy, "ip", rich_rule))
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
add_del = { True: "add", False: "delete" }[enable]
expr_fragments = []
if rich_rule:
expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination))
expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source))
chain_suffix = self._rich_rule_chain_suffix(rich_rule)
else:
chain_suffix = "allow"
rule = {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_%s_%s" % (_policy, chain_suffix),
"expr": expr_fragments +
[{"match": {"left": {"ct": {"key": "state"}},
"op": "in",
"right": {"set": ["new", "untracked"]}}},
{"accept": None}]}
rule.update(self._rich_rule_priority_fragment(rich_rule))
rules.append({add_del: {"rule": rule}})
return rules
def _build_policy_forward_port_nat_rules(self, enable, policy, port, protocol,
toaddr, toport, family,
rich_rule=None):
table = "nat"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
add_del = { True: "add", False: "delete" }[enable]
expr_fragments = []
if rich_rule:
expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination))
expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source))
chain_suffix = self._rich_rule_chain_suffix(rich_rule)
else:
chain_suffix = "allow"
expr_fragments.append({"match": {"left": {"payload": {"protocol": protocol,
"field": "dport"}},
"op": "==",
"right": self._port_fragment(port)}})
if toaddr:
if check_single_address("ipv6", toaddr):
toaddr = normalizeIP6(toaddr)
if toport and toport != "":
expr_fragments.append({"dnat": {"addr": toaddr, "port": self._port_fragment(toport)}})
else:
expr_fragments.append({"dnat": {"addr": toaddr}})
else:
expr_fragments.append({"redirect": {"port": self._port_fragment(toport)}})
rule = {"family": family,
"table": TABLE_NAME,
"chain": "nat_%s_%s" % (_policy, chain_suffix),
"expr": expr_fragments}
rule.update(self._rich_rule_priority_fragment(rich_rule))
return [{add_del: {"rule": rule}}]
def build_policy_forward_port_rules(self, enable, policy, port,
protocol, toport, toaddr, rich_rule=None):
rules = []
if rich_rule and (rich_rule.family and rich_rule.family == "ipv6"
or toaddr and check_single_address("ipv6", toaddr)):
rules.extend(self._build_policy_forward_port_nat_rules(enable, policy,
port, protocol, toaddr, toport, "ip6", rich_rule))
elif rich_rule and (rich_rule.family and rich_rule.family == "ipv4"
or toaddr and check_single_address("ipv4", toaddr)):
rules.extend(self._build_policy_forward_port_nat_rules(enable, policy,
port, protocol, toaddr, toport, "ip", rich_rule))
else:
if toaddr and check_single_address("ipv6", toaddr):
rules.extend(self._build_policy_forward_port_nat_rules(enable, policy,
port, protocol, toaddr, toport, "ip6", rich_rule))
else:
rules.extend(self._build_policy_forward_port_nat_rules(enable, policy,
port, protocol, toaddr, toport, "ip", rich_rule))
return rules
def _icmp_types_to_nft_fragments(self, ipv, icmp_type):
if icmp_type in ICMP_TYPES_FRAGMENTS[ipv]:
return ICMP_TYPES_FRAGMENTS[ipv][icmp_type]
else:
raise FirewallError(INVALID_ICMPTYPE,
"ICMP type '%s' not supported by %s for %s" % (icmp_type, self.name, ipv))
def build_policy_icmp_block_rules(self, enable, policy, ict, rich_rule=None):
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
add_del = { True: "add", False: "delete" }[enable]
if rich_rule and rich_rule.ipvs:
ipvs = rich_rule.ipvs
elif ict.destination:
ipvs = []
if "ipv4" in ict.destination:
ipvs.append("ipv4")
if "ipv6" in ict.destination:
ipvs.append("ipv6")
else:
ipvs = ["ipv4", "ipv6"]
rules = []
for ipv in ipvs:
if self._fw.policy.query_icmp_block_inversion(policy):
final_chain = "%s_%s_allow" % (table, _policy)
target_fragment = {"accept": None}
else:
final_chain = "%s_%s_deny" % (table, _policy)
target_fragment = self._reject_fragment()
expr_fragments = []
if rich_rule:
expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family))
expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination))
expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source))
expr_fragments.extend(self._icmp_types_to_nft_fragments(ipv, ict.name))
if rich_rule:
rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments))
rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments))
if rich_rule.action:
rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments))
else:
chain_suffix = self._rich_rule_chain_suffix(rich_rule)
rule = {"family": "inet",
"table": TABLE_NAME,
"chain": "%s_%s_%s" % (table, _policy, chain_suffix),
"expr": expr_fragments + [self._reject_fragment()]}
rule.update(self._rich_rule_priority_fragment(rich_rule))
rules.append({add_del: {"rule": rule}})
else:
if self._fw.get_log_denied() != "off" and not self._fw.policy.query_icmp_block_inversion(policy):
rules.append({add_del: {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": final_chain,
"expr": (expr_fragments +
[self._pkttype_match_fragment(self._fw.get_log_denied()),
{"log": {"prefix": "\"%s_%s_ICMP_BLOCK: \"" % (table, policy)}}])}}})
rules.append({add_del: {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": final_chain,
"expr": expr_fragments + [target_fragment]}}})
return rules
def build_policy_icmp_block_inversion_rules(self, enable, policy):
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
rules = []
add_del = { True: "add", False: "delete" }[enable]
if self._fw.policy.query_icmp_block_inversion(policy):
target_fragment = self._reject_fragment()
else:
target_fragment = {"accept": None}
# WARN: The "index" used here must be kept in sync with
# build_policy_chain_rules()
#
rules.append({add_del: {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "%s_%s" % (table, _policy),
"index": 4,
"expr": [self._icmp_match_fragment(),
target_fragment]}}})
if self._fw.get_log_denied() != "off" and self._fw.policy.query_icmp_block_inversion(policy):
rules.append({add_del: {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "%s_%s" % (table, _policy),
"index": 4,
"expr": [self._icmp_match_fragment(),
self._pkttype_match_fragment(self._fw.get_log_denied()),
{"log": {"prefix": "%s_%s_ICMP_BLOCK: " % (table, policy)}}]}}})
return rules
def build_rpfilter_rules(self, log_denied=False):
rules = []
expr_fragments = [{"match": {"left": {"meta": {"key": "nfproto"}},
"op": "==",
"right": "ipv6"}},
{"match": {"left": {"fib": {"flags": ["saddr", "iif", "mark"],
"result": "oif"}},
"op": "==",
"right": False}}]
if log_denied != "off":
expr_fragments.append({"log": {"prefix": "rpfilter_DROP: "}})
expr_fragments.append({"drop": None})
rules.append({"insert": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_PREROUTING",
"expr": expr_fragments}}})
# RHBZ#1058505, RHBZ#1575431 (bug in kernel 4.16-4.17)
rules.append({"insert": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_PREROUTING",
"expr": [{"match": {"left": {"payload": {"protocol": "icmpv6",
"field": "type"}},
"op": "==",
"right": {"set": ["nd-router-advert", "nd-neighbor-solicit"]}}},
{"accept": None}]}}})
return rules
def build_rfc3964_ipv4_rules(self):
daddr_set = ["::0.0.0.0/96", # IPv4 compatible
"::ffff:0.0.0.0/96", # IPv4 mapped
"2002:0000::/24", # 0.0.0.0/8 (the system has no address assigned yet)
"2002:0a00::/24", # 10.0.0.0/8 (private)
"2002:7f00::/24", # 127.0.0.0/8 (loopback)
"2002:ac10::/28", # 172.16.0.0/12 (private)
"2002:c0a8::/32", # 192.168.0.0/16 (private)
"2002:a9fe::/32", # 169.254.0.0/16 (IANA Assigned DHCP link-local)
"2002:e000::/19", # 224.0.0.0/4 (multicast), 240.0.0.0/4 (reserved and broadcast)
]
daddr_set = [{"prefix": {"addr": x.split("/")[0], "len": int(x.split("/")[1])}} for x in daddr_set]
expr_fragments = [{"match": {"left": {"payload": {"protocol": "ip6",
"field": "daddr"}},
"op": "==",
"right": {"set": daddr_set}}}]
if self._fw._log_denied in ["unicast", "all"]:
expr_fragments.append({"log": {"prefix": "RFC3964_IPv4_REJECT: "}})
expr_fragments.append(self._reject_types_fragment("addr-unreach"))
rules = []
# WARN: index must be kept in sync with build_default_rules()
rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_OUTPUT",
"index": 1,
"expr": expr_fragments}}})
rules.append({"add": {"rule": {"family": "inet",
"table": TABLE_NAME,
"chain": "filter_FORWARD",
"index": 2,
"expr": expr_fragments}}})
return rules
def build_policy_rich_source_destination_rules(self, enable, policy, rich_rule):
table = "filter"
expr_fragments = []
expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family))
expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination))
expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source))
rules = []
rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments))
rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments))
rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments))
return rules
def is_ipv_supported(self, ipv):
if ipv in ["ipv4", "ipv6", "eb"]:
return True
return False
def _set_type_list(self, ipv, type):
ipv_addr = {
"ipv4" : "ipv4_addr",
"ipv6" : "ipv6_addr",
}
types = {
"hash:ip" : ipv_addr[ipv],
"hash:ip,port" : [ipv_addr[ipv], "inet_proto", "inet_service"],
"hash:ip,port,ip" : [ipv_addr[ipv], "inet_proto", "inet_service", ipv_addr[ipv]],
"hash:ip,port,net" : [ipv_addr[ipv], "inet_proto", "inet_service", ipv_addr[ipv]],
"hash:ip,mark" : [ipv_addr[ipv], "mark"],
"hash:net" : ipv_addr[ipv],
"hash:net,net" : [ipv_addr[ipv], ipv_addr[ipv]],
"hash:net,port" : [ipv_addr[ipv], "inet_proto", "inet_service"],
"hash:net,port,net" : [ipv_addr[ipv], "inet_proto", "inet_service", ipv_addr[ipv]],
"hash:net,iface" : [ipv_addr[ipv], "ifname"],
"hash:mac" : "ether_addr",
}
if type in types:
return types[type]
else:
raise FirewallError(INVALID_TYPE,
"ipset type name '%s' is not valid" % type)
def build_set_create_rules(self, name, type, options=None):
if options and "family" in options and options["family"] == "inet6":
ipv = "ipv6"
else:
ipv = "ipv4"
set_dict = {"table": TABLE_NAME,
"name": name,
"type": self._set_type_list(ipv, type)}
# Some types need the interval flag
for t in type.split(":")[1].split(","):
if t in ["ip", "net", "port"]:
set_dict["flags"] = ["interval"]
break
if options:
if "timeout" in options:
set_dict["timeout"] = options["timeout"]
if "maxelem" in options:
set_dict["size"] = options["maxelem"]
rules = []
for family in ["inet", "ip", "ip6"]:
rule_dict = {"family": family}
rule_dict.update(set_dict)
rules.append({"add": {"set": rule_dict}})
return rules
def set_create(self, name, type, options=None):
rules = self.build_set_create_rules(name, type, options)
self.set_rules(rules, self._fw.get_log_denied())
def set_destroy(self, name):
for family in ["inet", "ip", "ip6"]:
rule = {"delete": {"set": {"family": family,
"table": TABLE_NAME,
"name": name}}}
self.set_rule(rule, self._fw.get_log_denied())
def _set_match_fragment(self, name, match_dest, invert=False):
type_format = self._fw.ipset.get_ipset(name).type.split(":")[1].split(",")
fragments = []
for i in range(len(type_format)):
if type_format[i] == "port":
fragments.append({"meta": {"key": "l4proto"}})
fragments.append({"payload": {"protocol": "th",
"field": "dport" if match_dest else "sport"}})
elif type_format[i] in ["ip", "net", "mac"]:
fragments.append({"payload": {"protocol": self._set_get_family(name),
"field": "daddr" if match_dest else "saddr"}})
elif type_format[i] == "iface":
fragments.append({"meta": {"key": "iifname" if match_dest else "oifname"}})
elif type_format[i] == "mark":
fragments.append({"meta": {"key": "mark"}})
else:
raise FirewallError("Unsupported ipset type for match fragment: %s" % (type_format[i]))
return {"match": {"left": {"concat": fragments} if len(type_format) > 1 else fragments[0],
"op": "!=" if invert else "==",
"right": "@" + name}}
def _set_entry_fragment(self, name, entry):
# convert something like
# 1.2.3.4,sctp:8080 (type hash:ip,port)
# to
# ["1.2.3.4", "sctp", "8080"]
obj = self._fw.ipset.get_ipset(name)
type_format = obj.type.split(":")[1].split(",")
entry_tokens = entry.split(",")
if len(type_format) != len(entry_tokens):
raise FirewallError(INVALID_ENTRY,
"Number of values does not match ipset type.")
fragment = []
for i in range(len(type_format)):
if type_format[i] == "port":
try:
index = entry_tokens[i].index(":")
except ValueError:
# no protocol means default tcp
fragment.append("tcp")
port_str = entry_tokens[i]
else:
fragment.append(entry_tokens[i][:index])
port_str = entry_tokens[i][index+1:]
try:
index = port_str.index("-")
except ValueError:
fragment.append(port_str)
else:
fragment.append({"range": [port_str[:index], port_str[index+1:]]})
elif type_format[i] in ["ip", "net"]:
if '-' in entry_tokens[i]:
fragment.append({"range": entry_tokens[i].split('-') })
else:
try:
index = entry_tokens[i].index("/")
except ValueError:
addr = entry_tokens[i]
if "family" in obj.options and obj.options["family"] == "inet6":
addr = normalizeIP6(addr)
fragment.append(addr)
else:
addr = entry_tokens[i][:index]
if "family" in obj.options and obj.options["family"] == "inet6":
addr = normalizeIP6(addr)
fragment.append({"prefix": {"addr": addr,
"len": int(entry_tokens[i][index+1:])}})
else:
fragment.append(entry_tokens[i])
return [{"concat": fragment}] if len(type_format) > 1 else fragment
def build_set_add_rules(self, name, entry):
rules = []
element = self._set_entry_fragment(name, entry)
for family in ["inet", "ip", "ip6"]:
rules.append({"add": {"element": {"family": family,
"table": TABLE_NAME,
"name": name,
"elem": element}}})
return rules
def set_add(self, name, entry):
rules = self.build_set_add_rules(name, entry)
self.set_rules(rules, self._fw.get_log_denied())
def set_delete(self, name, entry):
element = self._set_entry_fragment(name, entry)
for family in ["inet", "ip", "ip6"]:
rule = {"delete": {"element": {"family": family,
"table": TABLE_NAME,
"name": name,
"elem": element}}}
self.set_rule(rule, self._fw.get_log_denied())
def build_set_flush_rules(self, name):
rules = []
for family in ["inet", "ip", "ip6"]:
rule = {"flush": {"set": {"family": family,
"table": TABLE_NAME,
"name": name}}}
rules.append(rule)
return rules
def set_flush(self, name):
rules = self.build_set_flush_rules(name)
self.set_rules(rules, self._fw.get_log_denied())
def _set_get_family(self, name):
ipset = self._fw.ipset.get_ipset(name)
if ipset.type == "hash:mac":
family = "ether"
elif ipset.options and "family" in ipset.options \
and ipset.options["family"] == "inet6":
family = "ip6"
else:
family = "ip"
return family
def set_restore(self, set_name, type_name, entries,
create_options=None, entry_options=None):
rules = []
rules.extend(self.build_set_create_rules(set_name, type_name, create_options))
rules.extend(self.build_set_flush_rules(set_name))
# avoid large memory usage by chunking the entries
chunk = 0
for entry in entries:
rules.extend(self.build_set_add_rules(set_name, entry))
chunk += 1
if chunk >= 1000:
self.set_rules(rules, self._fw.get_log_denied())
rules.clear()
chunk = 0
else:
self.set_rules(rules, self._fw.get_log_denied())
core/helper.py 0000644 00000001444 15035135172 0007332 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""The helper maxnamelen"""
HELPER_MAXNAMELEN = 32
core/fw_ifcfg.py 0000644 00000005002 15035135172 0007617 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""Functions to search for and change ifcfg files"""
__all__ = [ "search_ifcfg_of_interface", "ifcfg_set_zone_of_interface" ]
import os
import os.path
from firewall import config
from firewall.core.logger import log
from firewall.core.io.ifcfg import ifcfg
def search_ifcfg_of_interface(interface):
"""search ifcfg file for the interface in config.IFCFGDIR"""
# Return quickly if config.IFCFGDIR does not exist
if not os.path.exists(config.IFCFGDIR):
return None
for filename in sorted(os.listdir(config.IFCFGDIR)):
if not filename.startswith("ifcfg-"):
continue
for ignored in [ ".bak", ".orig", ".rpmnew", ".rpmorig", ".rpmsave",
"-range" ]:
if filename.endswith(ignored):
continue
if "." in filename:
continue
ifcfg_file = ifcfg("%s/%s" % (config.IFCFGDIR, filename))
ifcfg_file.read()
if ifcfg_file.get("DEVICE") == interface:
return ifcfg_file
# Wasn't found above, so assume filename matches the device we want
filename = "%s/ifcfg-%s" % (config.IFCFGDIR, interface)
if os.path.exists(filename):
ifcfg_file = ifcfg(filename)
ifcfg_file.read()
return ifcfg_file
return None
def ifcfg_set_zone_of_interface(zone, interface):
"""Set zone (ZONE=<zone>) in the ifcfg file that uses the interface
(DEVICE=<interface>)"""
if zone is None:
zone = ""
ifcfg_file = search_ifcfg_of_interface(interface)
if ifcfg_file is not None and ifcfg_file.get("ZONE") != zone and not \
(ifcfg_file.get("ZONE") is None and zone == ""):
log.debug1("Setting ZONE=%s in '%s'" % (zone, ifcfg_file.filename))
ifcfg_file.set("ZONE", zone)
ifcfg_file.write()
core/fw_service.py 0000644 00000003147 15035135172 0010211 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "FirewallService" ]
from firewall import errors
from firewall.errors import FirewallError
class FirewallService(object):
def __init__(self, fw):
self._fw = fw
self._services = { }
def __repr__(self):
return '%s(%r)' % (self.__class__, self._services)
def cleanup(self):
self._services.clear()
# zones
def get_services(self):
return sorted(self._services.keys())
def check_service(self, service):
if service not in self._services:
raise FirewallError(errors.INVALID_SERVICE, service)
def get_service(self, service):
self.check_service(service)
return self._services[service]
def add_service(self, obj):
self._services[obj.name] = obj
def remove_service(self, service):
self.check_service(service)
del self._services[service]
core/io/__init__.py 0000644 00000003074 15035135172 0010222 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2012 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# fix xmlplus to be compatible with the python xml sax parser and python 3
# by adding __contains__ to xml.sax.xmlreader.AttributesImpl
import xml
if "_xmlplus" in xml.__file__:
from xml.sax.xmlreader import AttributesImpl
if not hasattr(AttributesImpl, "__contains__"):
# this is missing:
def __AttributesImpl__contains__(self, name):
return name in getattr(self, "_attrs")
# add it using the name __contains__
setattr(AttributesImpl, "__contains__", __AttributesImpl__contains__)
from xml.sax.saxutils import XMLGenerator
if not hasattr(XMLGenerator, "_write"):
# this is missing:
def __XMLGenerator_write(self, text):
getattr(self, "_out").write(text)
# add it using the name _write
setattr(XMLGenerator, "_write", __XMLGenerator_write)
core/io/helper.py 0000644 00000020263 15035135172 0007741 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "Helper", "helper_reader", "helper_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import u2b_if_py2
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \
check_tcpudp
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class Helper(IO_Object):
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ), # s
( "short", "" ), # s
( "description", "" ), # s
( "family", "", ), # s
( "module", "", ), # s
( "ports", [ ( "", "" ), ], ), # a(ss)
)
DBUS_SIGNATURE = '(sssssa(ss))'
ADDITIONAL_ALNUM_CHARS = [ "-", "." ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"helper": [ "module" ],
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"helper": [ "name", "version", "family" ],
"port": [ "port", "protocol" ],
}
def __init__(self):
super(Helper, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.module = ""
self.family = ""
self.ports = [ ]
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
self.module = ""
self.family = ""
del self.ports[:]
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.version = u2b_if_py2(self.version)
self.short = u2b_if_py2(self.short)
self.description = u2b_if_py2(self.description)
self.module = u2b_if_py2(self.module)
self.family = u2b_if_py2(self.family)
self.ports = [(u2b_if_py2(po),u2b_if_py2(pr)) for (po,pr) in self.ports]
def check_ipv(self, ipv):
ipvs = [ 'ipv4', 'ipv6' ]
if ipv not in ipvs:
raise FirewallError(errors.INVALID_IPV,
"'%s' not in '%s'" % (ipv, ipvs))
def _check_config(self, config, item, all_config):
if item == "ports":
for port in config:
check_port(port[0])
check_tcpudp(port[1])
elif item == "module":
if not config.startswith("nf_conntrack_"):
raise FirewallError(
errors.INVALID_MODULE,
"'%s' does not start with 'nf_conntrack_'" % config)
if len(config.replace("nf_conntrack_", "")) < 1:
raise FirewallError(errors.INVALID_MODULE,
"Module name '%s' too short" % config)
# PARSER
class helper_ContentHandler(IO_Object_ContentHandler):
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "helper":
if "version" in attrs:
self.item.version = attrs["version"]
if "family" in attrs:
self.item.check_ipv(attrs["family"])
self.item.family = attrs["family"]
if "module" in attrs:
if not attrs["module"].startswith("nf_conntrack_"):
raise FirewallError(
errors.INVALID_MODULE,
"'%s' does not start with 'nf_conntrack_'" % \
attrs["module"])
if len(attrs["module"].replace("nf_conntrack_", "")) < 1:
raise FirewallError(
errors.INVALID_MODULE,
"Module name '%s' too short" % attrs["module"])
self.item.module = attrs["module"]
elif name == "short":
pass
elif name == "description":
pass
elif name == "port":
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
entry = (attrs["port"], attrs["protocol"])
if entry not in self.item.ports:
self.item.ports.append(entry)
else:
log.warning("Port '%s/%s' already set, ignoring.",
attrs["port"], attrs["protocol"])
def helper_reader(filename, path):
helper = Helper()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % filename)
helper.name = filename[:-4]
helper.check_name(helper.name)
helper.filename = filename
helper.path = path
helper.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
helper.default = helper.builtin
handler = helper_ContentHandler(helper)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_HELPER,
"not a valid helper file: %s" % \
msg.getException())
del handler
del parser
if PY2:
helper.encode_strings()
return helper
def helper_writer(helper, path=None):
_path = path if path else helper.path
if helper.filename:
name = "%s/%s" % (_path, helper.filename)
else:
name = "%s/%s.xml" % (_path, helper.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start helper element
attrs = {}
attrs["module"] = helper.module
if helper.version and helper.version != "":
attrs["version"] = helper.version
if helper.family and helper.family != "":
attrs["family"] = helper.family
handler.startElement("helper", attrs)
handler.ignorableWhitespace("\n")
# short
if helper.short and helper.short != "":
handler.ignorableWhitespace(" ")
handler.startElement("short", { })
handler.characters(helper.short)
handler.endElement("short")
handler.ignorableWhitespace("\n")
# description
if helper.description and helper.description != "":
handler.ignorableWhitespace(" ")
handler.startElement("description", { })
handler.characters(helper.description)
handler.endElement("description")
handler.ignorableWhitespace("\n")
# ports
for port in helper.ports:
handler.ignorableWhitespace(" ")
handler.simpleElement("port", { "port": port[0], "protocol": port[1] })
handler.ignorableWhitespace("\n")
# end helper element
handler.endElement('helper')
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
core/io/direct.py 0000644 00000036740 15035135172 0007743 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.fw_types import LastUpdatedOrderedDict
from firewall.functions import splitArgs, joinArgs, u2b_if_py2
from firewall.core.io.io_object import IO_Object, IO_Object_ContentHandler, \
IO_Object_XMLGenerator
from firewall.core.logger import log
from firewall.core import ipXtables
from firewall.core import ebtables
from firewall import errors
from firewall.errors import FirewallError
class direct_ContentHandler(IO_Object_ContentHandler):
def __init__(self, item):
IO_Object_ContentHandler.__init__(self, item)
self.direct = False
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "direct":
if self.direct:
raise FirewallError(errors.PARSE_ERROR,
"More than one direct tag.")
self.direct = True
elif name == "chain":
if not self.direct:
log.error("Parse Error: chain outside of direct")
return
ipv = attrs["ipv"]
table = attrs["table"]
chain = attrs["chain"]
self.item.add_chain(u2b_if_py2(ipv), u2b_if_py2(table),
u2b_if_py2(chain))
elif name == "rule":
if not self.direct:
log.error("Parse Error: rule outside of direct")
return
ipv = attrs["ipv"]
if ipv not in [ "ipv4", "ipv6", "eb" ]:
raise FirewallError(errors.INVALID_IPV,
"'%s' not from {'ipv4'|'ipv6'|'eb'}" % ipv)
table = attrs["table"]
chain = attrs["chain"]
try:
priority = int(attrs["priority"])
except ValueError:
log.error("Parse Error: %s is not a valid priority" %
attrs["priority"])
return
self._rule = [ u2b_if_py2(ipv), u2b_if_py2(table),
u2b_if_py2(chain), priority ]
elif name == "passthrough":
if not self.direct:
log.error("Parse Error: command outside of direct")
return
ipv = attrs["ipv"]
self._passthrough = [ u2b_if_py2(ipv) ]
else:
log.error('Unknown XML element %s' % name)
return
def endElement(self, name):
IO_Object_ContentHandler.endElement(self, name)
if name == "rule":
if self._element:
# add arguments
self._rule.append([ u2b_if_py2(x)
for x in splitArgs(self._element) ])
self.item.add_rule(*self._rule)
else:
log.error("Error: rule does not have any arguments, ignoring.")
self._rule = None
elif name == "passthrough":
if self._element:
# add arguments
self._passthrough.append([ u2b_if_py2(x)
for x in splitArgs(self._element) ])
self.item.add_passthrough(*self._passthrough)
else:
log.error("Error: passthrough does not have any arguments, " +
"ignoring.")
self._passthrough = None
class Direct(IO_Object):
""" Direct class """
IMPORT_EXPORT_STRUCTURE = (
# chain: [ ipv, table, [ chain ] ]
( "chains", [ ( "", "", "" ), ], ), # a(sss)
# rule: [ ipv, table, chain, [ priority, [ arg ] ] ]
( "rules", [ ( "", "", "", 0, [ "" ] ), ], ), # a(sssias)
# passthrough: [ ipv, [ [ arg ] ] ]
( "passthroughs", [ ( "", [ "" ]), ], ), # a(sas)
)
DBUS_SIGNATURE = '(a(sss)a(sssias)a(sas))'
PARSER_REQUIRED_ELEMENT_ATTRS = {
"direct": None,
"chain": [ "ipv", "table", "chain" ],
"rule": [ "ipv", "table", "chain", "priority" ],
"passthrough": [ "ipv" ]
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
}
def __init__(self, filename):
super(Direct, self).__init__()
self.filename = filename
self.chains = LastUpdatedOrderedDict()
self.rules = LastUpdatedOrderedDict()
self.passthroughs = LastUpdatedOrderedDict()
def _check_config(self, conf, item, all_conf):
pass
# check arg lists
def export_config(self):
ret = [ ]
x = [ ]
for key in self.chains:
for chain in self.chains[key]:
x.append(tuple(list(key) + list([chain])))
ret.append(x)
x = [ ]
for key in self.rules:
for rule in self.rules[key]:
x.append(tuple((key[0], key[1], key[2], rule[0],
list(rule[1]))))
ret.append(x)
x = [ ]
for key in self.passthroughs:
for rule in self.passthroughs[key]:
x.append(tuple((key, list(rule))))
ret.append(x)
return tuple(ret)
def import_config(self, conf):
self.cleanup()
self.check_config(conf)
for i,(element,dummy) in enumerate(self.IMPORT_EXPORT_STRUCTURE):
if element == "chains":
for x in conf[i]:
self.add_chain(*x)
if element == "rules":
for x in conf[i]:
self.add_rule(*x)
if element == "passthroughs":
for x in conf[i]:
self.add_passthrough(*x)
def cleanup(self):
self.chains.clear()
self.rules.clear()
self.passthroughs.clear()
def output(self):
print("chains")
for key in self.chains:
print(" (%s, %s): %s" % (key[0], key[1],
",".join(self.chains[key])))
print("rules")
for key in self.rules:
print(" (%s, %s, %s):" % (key[0], key[1], key[2]))
for (priority,args) in self.rules[key]:
print(" (%d, ('%s'))" % (priority, "','".join(args)))
print("passthroughs")
for key in self.passthroughs:
print(" %s:" % (key))
for args in self.passthroughs[key]:
print(" ('%s')" % ("','".join(args)))
def _check_ipv(self, ipv):
ipvs = ['ipv4', 'ipv6', 'eb']
if ipv not in ipvs:
raise FirewallError(errors.INVALID_IPV,
"'%s' not in '%s'" % (ipv, ipvs))
def _check_ipv_table(self, ipv, table):
self._check_ipv(ipv)
tables = ipXtables.BUILT_IN_CHAINS.keys() if ipv in ['ipv4', 'ipv6'] \
else ebtables.BUILT_IN_CHAINS.keys()
if table not in tables:
raise FirewallError(errors.INVALID_TABLE,
"'%s' not in '%s'" % (table, tables))
# chains
def add_chain(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
key = (ipv, table)
if key not in self.chains:
self.chains[key] = [ ]
if chain not in self.chains[key]:
self.chains[key].append(chain)
else:
log.warning("Chain '%s' for table '%s' with ipv '%s' " % \
(chain, table, ipv) + "already in list, ignoring")
def remove_chain(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
key = (ipv, table)
if key in self.chains and chain in self.chains[key]:
self.chains[key].remove(chain)
if len(self.chains[key]) == 0:
del self.chains[key]
else:
raise ValueError( \
"Chain '%s' with table '%s' with ipv '%s' not in list" % \
(chain, table, ipv))
def query_chain(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
key = (ipv, table)
return (key in self.chains and chain in self.chains[key])
def get_chains(self, ipv, table):
self._check_ipv_table(ipv, table)
key = (ipv, table)
if key in self.chains:
return self.chains[key]
else:
raise ValueError("No chains for table '%s' with ipv '%s'" % \
(table, ipv))
def get_all_chains(self):
return self.chains
# rules
def add_rule(self, ipv, table, chain, priority, args):
self._check_ipv_table(ipv, table)
key = (ipv, table, chain)
if key not in self.rules:
self.rules[key] = LastUpdatedOrderedDict()
value = (priority, tuple(args))
if value not in self.rules[key]:
self.rules[key][value] = priority
else:
log.warning("Rule '%s' for table '%s' and chain '%s' " % \
("',".join(args), table, chain) +
"with ipv '%s' and priority %d " % (ipv, priority) +
"already in list, ignoring")
def remove_rule(self, ipv, table, chain, priority, args):
self._check_ipv_table(ipv, table)
key = (ipv, table, chain)
value = (priority, tuple(args))
if key in self.rules and value in self.rules[key]:
del self.rules[key][value]
if len(self.rules[key]) == 0:
del self.rules[key]
else:
raise ValueError("Rule '%s' for table '%s' and chain '%s' " % \
("',".join(args), table, chain) + \
"with ipv '%s' and priority %d not in list" % (ipv, priority))
def remove_rules(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
key = (ipv, table, chain)
if key in self.rules:
for value in self.rules[key].keys():
del self.rules[key][value]
if len(self.rules[key]) == 0:
del self.rules[key]
def query_rule(self, ipv, table, chain, priority, args):
self._check_ipv_table(ipv, table)
key = (ipv, table, chain)
value = (priority, tuple(args))
return (key in self.rules and value in self.rules[key])
def get_rules(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
key = (ipv, table, chain)
if key in self.rules:
return self.rules[key]
else:
raise ValueError("No rules for table '%s' and chain '%s' " %\
(table, chain) + "with ipv '%s'" % (ipv))
def get_all_rules(self):
return self.rules
# # passthrough
#
def add_passthrough(self, ipv, args):
self._check_ipv(ipv)
if ipv not in self.passthroughs:
self.passthroughs[ipv] = [ ]
if args not in self.passthroughs[ipv]:
self.passthroughs[ipv].append(args)
else:
log.warning("Passthrough '%s' for ipv '%s'" % \
("',".join(args), ipv) + "already in list, ignoring")
def remove_passthrough(self, ipv, args):
self._check_ipv(ipv)
if ipv in self.passthroughs and args in self.passthroughs[ipv]:
self.passthroughs[ipv].remove(args)
if len(self.passthroughs[ipv]) == 0:
del self.passthroughs[ipv]
else:
raise ValueError("Passthrough '%s' for ipv '%s'" % \
("',".join(args), ipv) + "not in list")
def query_passthrough(self, ipv, args):
self._check_ipv(ipv)
return ipv in self.passthroughs and args in self.passthroughs[ipv]
def get_passthroughs(self, ipv):
self._check_ipv(ipv)
if ipv in self.passthroughs:
return self.passthroughs[ipv]
else:
raise ValueError("No passthroughs for ipv '%s'" % (ipv))
def get_all_passthroughs(self):
return self.passthroughs
# read
def read(self):
self.cleanup()
if not self.filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % self.filename)
handler = direct_ContentHandler(self)
parser = sax.make_parser()
parser.setContentHandler(handler)
with open(self.filename, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_TYPE,
"Not a valid file: %s" % \
msg.getException())
def write(self):
if os.path.exists(self.filename):
try:
shutil.copy2(self.filename, "%s.old" % self.filename)
except Exception as msg:
raise IOError("Backup of '%s' failed: %s" % (self.filename, msg))
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
f = io.open(self.filename, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start whitelist element
handler.startElement("direct", { })
handler.ignorableWhitespace("\n")
# chains
for key in self.chains:
(ipv, table) = key
for chain in self.chains[key]:
handler.ignorableWhitespace(" ")
handler.simpleElement("chain", { "ipv": ipv, "table": table,
"chain": chain })
handler.ignorableWhitespace("\n")
# rules
for key in self.rules:
(ipv, table, chain) = key
for (priority, args) in self.rules[key]:
if len(args) < 1:
continue
handler.ignorableWhitespace(" ")
handler.startElement("rule", { "ipv": ipv, "table": table,
"chain": chain,
"priority": "%d" % priority })
handler.ignorableWhitespace(sax.saxutils.escape(joinArgs(args)))
handler.endElement("rule")
handler.ignorableWhitespace("\n")
# passthroughs
for ipv in self.passthroughs:
for args in self.passthroughs[ipv]:
if len(args) < 1:
continue
handler.ignorableWhitespace(" ")
handler.startElement("passthrough", { "ipv": ipv })
handler.ignorableWhitespace(sax.saxutils.escape(joinArgs(args)))
handler.endElement("passthrough")
handler.ignorableWhitespace("\n")
# end zone element
handler.endElement("direct")
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
core/io/ifcfg.py 0000644 00000014345 15035135172 0007544 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""ifcfg file parser"""
__all__ = [ "ifcfg" ]
import os.path
import io
import tempfile
import shutil
from firewall.core.logger import log
from firewall.functions import b2u, u2b, PY2
class ifcfg(object):
def __init__(self, filename):
self._config = { }
self._deleted = [ ]
self.filename = filename
self.clear()
def clear(self):
self._config = { }
self._deleted = [ ]
def cleanup(self):
self._config.clear()
def get(self, key):
return self._config.get(key.strip())
def set(self, key, value):
_key = b2u(key.strip())
self._config[_key] = b2u(value.strip())
if _key in self._deleted:
self._deleted.remove(_key)
def __str__(self):
s = ""
for (key, value) in self._config.items():
if s:
s += '\n'
s += '%s=%s' % (key, value)
return u2b(s) if PY2 else s
# load self.filename
def read(self):
self.clear()
try:
f = open(self.filename, "r")
except Exception as msg:
log.error("Failed to load '%s': %s", self.filename, msg)
raise
for line in f:
if not line:
break
line = line.strip()
if len(line) < 1 or line[0] in ['#', ';']:
continue
# get key/value pair
pair = [ x.strip() for x in line.split("=", 1) ]
if len(pair) != 2:
continue
if len(pair[1]) >= 2 and \
pair[1].startswith('"') and pair[1].endswith('"'):
pair[1] = pair[1][1:-1]
if pair[1] == '':
continue
elif self._config.get(pair[0]) is not None:
log.warning("%s: Duplicate option definition: '%s'", self.filename, line.strip())
continue
self._config[pair[0]] = pair[1]
f.close()
def write(self):
if len(self._config) < 1:
# no changes: nothing to do
return
# handled keys
done = [ ]
try:
temp_file = tempfile.NamedTemporaryFile(
mode='wt',
prefix="%s." % os.path.basename(self.filename),
dir=os.path.dirname(self.filename), delete=False)
except Exception as msg:
log.error("Failed to open temporary file: %s" % msg)
raise
modified = False
empty = False
try:
f = io.open(self.filename, mode='rt', encoding='UTF-8')
except Exception as msg:
if os.path.exists(self.filename):
log.error("Failed to open '%s': %s" % (self.filename, msg))
raise
else:
f = None
else:
for line in f:
if not line:
break
# remove newline
line = line.strip("\n")
if len(line) < 1:
if not empty:
temp_file.write(u"\n")
empty = True
elif line[0] == '#':
empty = False
temp_file.write(line)
temp_file.write(u"\n")
else:
p = line.split("=", 1)
if len(p) != 2:
empty = False
temp_file.write(line+u"\n")
continue
key = p[0].strip()
value = p[1].strip()
if len(value) >= 2 and \
value.startswith('"') and value.endswith('"'):
value = value[1:-1]
# check for modified key/value pairs
if key not in done:
if key in self._config and self._config[key] != value:
empty = False
temp_file.write(u'%s=%s\n' % (key,
self._config[key]))
modified = True
elif key in self._deleted:
modified = True
else:
empty = False
temp_file.write(line+u"\n")
done.append(key)
else:
modified = True
# write remaining key/value pairs
if len(self._config) > 0:
for (key, value) in self._config.items():
if key in done:
continue
if not empty:
empty = True
temp_file.write(u'%s=%s\n' % (key, value))
modified = True
if f:
f.close()
temp_file.close()
if not modified: # not modified: remove tempfile
os.remove(temp_file.name)
return
# make backup
if os.path.exists(self.filename):
try:
shutil.copy2(self.filename, "%s.bak" % self.filename)
except Exception as msg:
os.remove(temp_file.name)
raise IOError("Backup of '%s' failed: %s" % (self.filename, msg))
# copy tempfile
try:
shutil.move(temp_file.name, self.filename)
except Exception as msg:
os.remove(temp_file.name)
raise IOError("Failed to create '%s': %s" % (self.filename, msg))
else:
os.chmod(self.filename, 0o600)
core/io/icmptype.py 0000644 00000015244 15035135172 0010317 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "IcmpType", "icmptype_reader", "icmptype_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import u2b_if_py2
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class IcmpType(IO_Object):
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ), # s
( "short", "" ), # s
( "description", "" ), # s
( "destination", [ "", ], ), # as
)
DBUS_SIGNATURE = '(sssas)'
ADDITIONAL_ALNUM_CHARS = [ "_", "-" ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"icmptype": None,
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"icmptype": [ "name", "version" ],
"destination": [ "ipv4", "ipv6" ],
}
def __init__(self):
super(IcmpType, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.destination = [ ]
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
del self.destination[:]
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.version = u2b_if_py2(self.version)
self.short = u2b_if_py2(self.short)
self.description = u2b_if_py2(self.description)
self.destination = [u2b_if_py2(m) for m in self.destination]
def _check_config(self, config, item, all_config):
if item == "destination":
for destination in config:
if destination not in [ "ipv4", "ipv6" ]:
raise FirewallError(errors.INVALID_DESTINATION,
"'%s' not from {'ipv4'|'ipv6'}" % \
destination)
# PARSER
class icmptype_ContentHandler(IO_Object_ContentHandler):
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "icmptype":
if "name" in attrs:
log.warning("Ignoring deprecated attribute name='%s'" %
attrs["name"])
if "version" in attrs:
self.item.version = attrs["version"]
elif name == "short":
pass
elif name == "description":
pass
elif name == "destination":
for x in [ "ipv4", "ipv6" ]:
if x in attrs and \
attrs[x].lower() in [ "yes", "true" ]:
self.item.destination.append(str(x))
def icmptype_reader(filename, path):
icmptype = IcmpType()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"%s is missing .xml suffix" % filename)
icmptype.name = filename[:-4]
icmptype.check_name(icmptype.name)
icmptype.filename = filename
icmptype.path = path
icmptype.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
icmptype.default = icmptype.builtin
handler = icmptype_ContentHandler(icmptype)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_ICMPTYPE,
"not a valid icmptype file: %s" % \
msg.getException())
del handler
del parser
if PY2:
icmptype.encode_strings()
return icmptype
def icmptype_writer(icmptype, path=None):
_path = path if path else icmptype.path
if icmptype.filename:
name = "%s/%s" % (_path, icmptype.filename)
else:
name = "%s/%s.xml" % (_path, icmptype.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start icmptype element
attrs = {}
if icmptype.version and icmptype.version != "":
attrs["version"] = icmptype.version
handler.startElement("icmptype", attrs)
handler.ignorableWhitespace("\n")
# short
if icmptype.short and icmptype.short != "":
handler.ignorableWhitespace(" ")
handler.startElement("short", { })
handler.characters(icmptype.short)
handler.endElement("short")
handler.ignorableWhitespace("\n")
# description
if icmptype.description and icmptype.description != "":
handler.ignorableWhitespace(" ")
handler.startElement("description", { })
handler.characters(icmptype.description)
handler.endElement("description")
handler.ignorableWhitespace("\n")
# destination
if icmptype.destination:
handler.ignorableWhitespace(" ")
attrs = { }
for x in icmptype.destination:
attrs[x] = "yes"
handler.simpleElement("destination", attrs)
handler.ignorableWhitespace("\n")
# end icmptype element
handler.endElement('icmptype')
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
core/io/__pycache__/functions.cpython-36.opt-1.pyc 0000644 00000005256 15035135172 0015722 0 ustar 00 3
��gy � @ s� d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl m
Z
d dl m Z d dl
mZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lmZ dd� ZdS )� N)�config)�
FirewallError)�FirewallConfig)� zone_reader)�service_reader)� ipset_reader)�icmptype_reader)�
helper_reader)�
policy_reader)�Direct)�LockdownWhitelist)�firewalld_confc - C s| t | �}t|jtjtjgd�t|jtjtj gd�t
|j tj tj
gd�t|jtjtjgd�t|jtjtjgd�t|jtjtjgd�d�}�x
|j� D � ]�}x�|| d D ]�}tj j |�s�q�x�t tj |��D ]�}|j d�r�yD|| d ||�}|d
k� r�||_!|j"|j#� � || d |� W q� t$k
�rT } z t$|j%d ||j&f ��W Y d d }~X q� t'k
�r� } zt'd ||f ��W Y d d }~X q�X q�W q�W q�W tj j(tj)��r:y$t*tj)�}|j+� |j,|j-� � W np t$k
�r } z t$|j%d tj)|j&f ��W Y d d }~X n6 t'k
�r8 } zt'd tj)|f ��W Y d d }~X nX tj j(tj.��r�y$t/tj.�}|j+� |j,|j-� � W np t$k
�r� } z t$|j%d tj.|j&f ��W Y d d }~X n6 t'k
�r� } zt'd tj.|f ��W Y d d }~X nX tj j(tj0��rxyt1tj0�}|j+� W np t$k
�rB } z t$|j%d tj0|j&f ��W Y d d }~X n6 t'k
�rv } zt'd tj0|f ��W Y d d }~X nX d S ) N)�reader�add�dirs)Zipset�helperZicmptypeZservice�zone�policyr z.xmlr r r r z'%s': %s)r r )2r r Z add_ipsetr ZFIREWALLD_IPSETSZETC_FIREWALLD_IPSETSr Z
add_helperZFIREWALLD_HELPERSZETC_FIREWALLD_HELPERSr Z add_icmptypeZFIREWALLD_ICMPTYPESZETC_FIREWALLD_ICMPTYPESr Z add_serviceZFIREWALLD_SERVICESZETC_FIREWALLD_SERVICESr Zadd_zoneZFIREWALLD_ZONESZETC_FIREWALLD_ZONESr
Zadd_policy_objectZFIREWALLD_POLICIESZETC_FIREWALLD_POLICIES�keys�os�path�isdir�sorted�listdir�endswith� fw_configZcheck_config_dictZexport_config_dictr �code�msg� Exception�isfileZFIREWALLD_DIRECTr �read� check_configZ
export_configZLOCKDOWN_WHITELISTr ZFIREWALLD_CONFr
) �fwr Zreadersr Z_dir�file�obj�errorr � r& � /usr/lib/python3.6/functions.pyr! & sz
&.
($
($
(r! )r Zfirewallr Zfirewall.errorsr Zfirewall.core.fw_configr Zfirewall.core.io.zoner Zfirewall.core.io.servicer Zfirewall.core.io.ipsetr Zfirewall.core.io.icmptyper Zfirewall.core.io.helperr Zfirewall.core.io.policyr
Zfirewall.core.io.directr Z#firewall.core.io.lockdown_whitelistr Z firewall.core.io.firewalld_confr
r! r& r& r& r' �<module> s core/io/__pycache__/io_object.cpython-36.pyc 0000644 00000027540 15035135172 0014710 0 ustar 00 3
��g5 � @ s d Z ddddddddgZd d
ljZd d
ljjZd d
lZd d
lZd d lm Z d d l
m Z d d
l m
Z
d dl
mZ d dlmZ ejdk ZG dd� de�ZG dd� de�ZG dd� de�ZG dd� de�ZG dd� dejj�ZG dd� dej �Z dd� Z dd� Z d d� Z d d� Z!d
S ) z5Generic io_object handler, io specific check methods.�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator�
check_port� check_tcpudp�check_protocol�
check_address� N)� OrderedDict)� functions)�b2u)�errors)�
FirewallError�3c @ s| e Zd ZdZf ZdZg Zi Zi Zdd� Z dd� Z
dd� Z d d
� Z d d � Z
d
d� Zdd� Zdd� Zdd� Zdd� Zdd� ZdS )r z; Abstract IO_Object as base for icmptype, service and zone z()c C s" d| _ d| _d| _d| _d| _d S )N� F)�filename�path�name�defaultZbuiltin)�self� r � /usr/lib/python3.6/io_object.py�__init__2 s
zIO_Object.__init__c C s6 g }x(| j D ] }|jtjt| |d ��� q W t|�S )Nr )�IMPORT_EXPORT_STRUCTURE�append�copy�deepcopy�getattr�tuple)r �ret�xr r r �
export_config9 s zIO_Object.export_configc C sX i }t dd� | jD ��}x:|D ]2}t| |�s<tt| |�t�r tjt| |��||< q W |S )Nc S s g | ]}|d |d f�qS )r � r )�.0r r r r �
<listcomp>A s z0IO_Object.export_config_dict.<locals>.<listcomp>)�dictr r �
isinstance�boolr r )r �conf� type_formats�keyr r r �export_config_dict? s
z IO_Object.export_config_dictc C s� | j |� x�t| j�D ]~\}\}}t|| t�r~g }t� }x,|| D ] }||krD|j|� |j|� qDW ~t| |t j
|�� qt| |t j
|| �� qW d S )N) � check_config� enumerater r& �list�setr �add�setattrr r )r r( �i�elementZdummyZ_confZ_setr r r r �
import_configG s
zIO_Object.import_configc C s~ | j |� xn|D ]f}t| |�s0ttjdj|���t|| t�r`t| |tt j
t j || ���� qt| |t j || �� qW d S )Nz-Internal error. '{}' is not a valid attribute)
�check_config_dict�hasattrr r
Z
UNKNOWN_ERROR�formatr& r. r1 r
�fromkeysr r )r r( r* r r r �import_config_dictW s
"z IO_Object.import_config_dictc C sz t |t�s(ttjd|td�t|�f ��t|�dk r@ttjd��x4|D ],}|j� rF|| j krFttjd||f ��qFW d S )Nz'%s' not of type %s, but %sr r" zname can't be emptyz'%s' is not allowed in '%s')
r& �strr r
� INVALID_TYPE�type�lenZ INVALID_NAME�isalnum�ADDITIONAL_ALNUM_CHARS)r r �charr r r �
check_namec s
zIO_Object.check_namec C sj t |�t | j�kr0ttjdt |�t | j�f ��i }x&t| j�D ]\}\}}|| ||< q@W | j|� d S )Nz structure size mismatch %d != %d)r= r r r
r; r- r5 )r r( Z conf_dictr2 r �yr r r r, p s zIO_Object.check_configc C sr t dd� | jD ��}xX|D ]P}|dd� | jD �krDttjdj|���| j|| || � | j|| ||� qW d S )Nc S s g | ]}|d |d f�qS )r r" r )r# r r r r r$ | s z/IO_Object.check_config_dict.<locals>.<listcomp>c S s g | ] \}}|�qS r r )r# r rB r r r r$ ~ s zoption '{}' is not valid)r% r r r
ZINVALID_OPTIONr7 �_check_config_structure�
_check_config)r r( r) r* r r r r5 { s
zIO_Object.check_config_dictc C s d S )Nr )r Zdummy1Zdummy2Zdummy3r r r rD � s zIO_Object._check_configc C s` t |t|��s,ttjd|t|�t|�f ��t |t�rrt|�dkrRttjd| ��x |D ]}| j||d � qXW n�t |t�r�t|�t|�kr�ttjd|t|�f ��x�t |�D ]\}}| j|| |� q�W n�t |t
��r\t|j � �d \}}xn|j � D ]b\}}t |t|���s,ttjd|t|�t|�f ��t |t|��s�ttjd|t|�t|�f ��q�W d S )Nz'%s' not of type %s, but %sr" zlen('%s') != 1r zlen('%s') != %d) r& r< r r
r; r. r= rC r r- r% �items) r r( Z structurer r2 �valueZskeyZsvaluer* r r r rC � s8
z!IO_Object._check_config_structurec C s� |j � }d}|| jkrdd}| j| d k rdx:| j| D ],}||krL|j|� q4ttjd||f ��q4W || jkr�d}x$| j| D ]}||kr~|j|� q~W |s�ttjd| ��x |D ]}ttjd||f ��q�W d S )NFTzMissing attribute %s for %szUnexpected element %sz%s: Unexpected attribute %s)ZgetNames� PARSER_REQUIRED_ELEMENT_ATTRS�remover r
Z PARSE_ERROR� PARSER_OPTIONAL_ELEMENT_ATTRS)r r �attrsZ_attrs�foundr r r r �parser_check_element_attrs� s,
z$IO_Object.parser_check_element_attrsN)�__name__�
__module__� __qualname__�__doc__r ZDBUS_SIGNATUREr? rG rI r r! r+ r4 r9 rA r, r5 rD rC rL r r r r r ) s"
!c s$ e Zd Z� fdd�Zdd� Z� ZS )�UnexpectedElementErrorc s t t| �j� || _d S )N)�superrQ r r )r r )� __class__r r r � s z UnexpectedElementError.__init__c C s
d| j S )NzUnexpected element '%s')r )r r r r �__str__� s z UnexpectedElementError.__str__)rM rN rO r rT �
__classcell__r r )rS r rQ � s rQ c s$ e Zd Z� fdd�Zdd� Z� ZS )�MissingAttributeErrorc s t t| �j� || _|| _d S )N)rR rV r r � attribute)r r rW )rS r r r � s z MissingAttributeError.__init__c C s d| j | jf S )Nz$Element '%s': missing '%s' attribute)r rW )r r r r rT � s z MissingAttributeError.__str__)rM rN rO r rT rU r r )rS r rV � s rV c s$ e Zd Z� fdd�Zdd� Z� ZS )�UnexpectedAttributeErrorc s t t| �j� || _|| _d S )N)rR rX r r rW )r r rW )rS r r r � s z!UnexpectedAttributeError.__init__c C s d| j | jf S )Nz'Element '%s': unexpected attribute '%s')r rW )r r r r rT � s z UnexpectedAttributeError.__str__)rM rN rO r rT rU r r )rS r rX � s rX c @ s4 e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd S ) r c C s || _ d| _d S )Nr )�item�_element)r rY r r r r � s z!IO_Object_ContentHandler.__init__c C s
d| _ d S )Nr )rZ )r r r r �
startDocument� s z&IO_Object_ContentHandler.startDocumentc C s
d| _ d S )Nr )rZ )r r rJ r r r � startElement� s z%IO_Object_ContentHandler.startElementc C s* |dkr| j | j_n|dkr&| j | j_d S )N�short� description)rZ rY r] r^ )r r r r r �
endElement� s z#IO_Object_ContentHandler.endElementc C s | j |jdd�7 _ d S )N�
� )rZ �replace)r �contentr r r �
characters� s z#IO_Object_ContentHandler.charactersN)rM rN rO r r[ r\ r_ rd r r r r r � s
c @ s< e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
S )r c C sN t jjj| � |j| _|j| _i g| _| jd | _ g | _
d| _ d| _ d| _
d S )Nr" zutf-8F���)�sax�handler�ContentHandlerr �write�_write�flushZ_flushZ _ns_contextsZ_current_contextZ_undeclared_ns_mapsZ _encodingZ_pending_start_elementZ_short_empty_elements)r �outr r r r � s z IO_Object_XMLGenerator.__init__c C s* t rdd� |j� D �}tjj| ||� dS )a saxutils.XMLGenerator.startElement() expects name and attrs to be
unicode and bad things happen if any of them is (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
c S s i | ]\}}t |�t |��qS r )r )r# r rF r r r �
<dictcomp> s z7IO_Object_XMLGenerator.startElement.<locals>.<dictcomp>N)r rE �saxutils� XMLGeneratorr\ )r r rJ r r r r\ s z#IO_Object_XMLGenerator.startElementc C s� t rX| jdt|� � x4|j� D ](\}}| jdt|�tjt|��f � q W | jd� nF| jd| � x,|j� D ] \}}| jd|tj|�f � qpW | jd� dS )z* slightly modified startElement()
�<z %s=%sz/>N)r rj r rE rn Z quoteattr)r r rJ rF r r r �
simpleElement s z$IO_Object_XMLGenerator.simpleElementc C s t jj| t|�� dS )z� saxutils.XMLGenerator.endElement() expects name to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro r_ r )r r r r r r_ s z!IO_Object_XMLGenerator.endElementc C s t jj| t|�� dS )z� saxutils.XMLGenerator.characters() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro rd r )r rc r r r rd % s z!IO_Object_XMLGenerator.charactersc C s t jj| t|�� dS )a saxutils.XMLGenerator.ignorableWhitespace() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro �ignorableWhitespacer )r rc r r r rr - s z*IO_Object_XMLGenerator.ignorableWhitespaceN) rM rN rO r r\ rq r_ rd rr r r r r r � s
c C s� t j| �}|dkr$ttjd| ��n`|dkr>ttjd| ��nF|d krXttjd| ��n,t|�dkr�|d |d kr�ttjd| ��d S ) N� z port number in '%s' is too bigr" z'%s' is invalid port rangez port range '%s' is ambiguousr ���re )r Z getPortRanger r
Z INVALID_PORTr= )ZportZ
port_ranger r r r 5 s
c C s | dkrt tjd| ��d S )N�tcp�udp�sctp�dccpz)'%s' not from {'tcp'|'udp'|'sctp'|'dccp'})ru rv rw rx )r r
�INVALID_PROTOCOL)�protocolr r r r D s c C s t j| �sttj| ��d S )N)r Z
checkProtocolr r
ry )rz r r r r J s
c C s$ t j| |�s ttjd|| f ��d S )Nz '%s' is not valid %s address)r r r r
Z INVALID_ADDR)ZipvZaddrr r r r N s )"rP �__all__Zxml.saxrf Zxml.sax.saxutilsrn r �sys� collectionsr
Zfirewallr Zfirewall.functionsr r
Zfirewall.errorsr �versionr �objectr � ExceptionrQ rV rX rg rh r ro r r r r r r r r r �<module> s0
C core/io/__pycache__/zone.cpython-36.opt-1.pyc 0000644 00000031307 15035135172 0014661 0 ustar 00 3
��g�M � @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z m
Z
m Z m Z m
Z
mZmZ ddlmZmZ ddlmZmZmZmZ dd lmZmZmZm Z dd
l m Z dd l m Z dd lm!Z! dd
l"m#Z# G dd � d e�Z$G dd� de�Z%ddd�Z&ddd�Z'dS )�Zone� zone_reader� zone_writer� N)�config)� checkIPnMask�
checkIP6nMask�checkInterface�uniqify�max_zone_name_len�
u2b_if_py2� check_mac)�DEFAULT_ZONE_TARGET� ZONE_TARGETS)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�common_startElement�common_endElement�common_check_config�
common_writer)�rich)�log)�errors)�
FirewallErrorc sf e Zd ZdZd@dAdBdCdDd dgfd
dEgfd dgfdFd
dGgfddgfddgfddgfddgfddHgfdIdJfZdddgZddddgddgdgdgdddgdgdddd gddgdddddd gd gdd �Zdd ddgd gd!d"gd#d$gd%d&d'd#d(gd%d'd(gd)d*gd+gd,gd-� Zed.d/� �Z � fd0d1�Z
d2d3� Z d4d5� Z � fd6d7�Z
� fd8d9�Zd:d;� Z� fd<d=�Zd>d?� Z� ZS )Kr z Zone class �version� �short� description�UNUSEDF�target�services�ports� icmp_blocks�
masquerade�
forward_ports�
interfaces�sources� rules_str� protocols� source_ports�icmp_block_inversion�forward�_�-�/N�name�port�protocol�value�set)r r �zone�servicer1 z
icmp-blockz icmp-typer, z forward-port� interface�rule�source� destinationr2 z source-portr ZauditZaccept�rejectZdropZmark�limitzicmp-block-inversion� immutableZenabledzto-portzto-addr�familyZpriority�address�mac�invert�ipset�prefix�level�typeZburst) r5 r$ z forward-portr8 r9 r: r r; r< c C s8 x&t tj�D ]\}\}}|| kr |S q W ttjd��d S )Nz
index_of())� enumerater �IMPORT_EXPORT_STRUCTUREr r Z
UNKNOWN_ERROR)�element�iZelZdummy� rJ �/usr/lib/python3.6/zone.py�index_ofd s z
Zone.index_ofc s� t t| �j� d| _d| _d| _d| _t| _g | _ g | _
g | _ g | _ d| _
d| _g | _g | _g | _g | _d | _g | _g | _d| _d| _d| _d S )Nr F)�superr �__init__r r r r r
r r! r" r) r# r, r$ r% r* r& r' � fw_config�rulesr( r+ �combined�applied)�self)� __class__rJ rK rN k s, z
Zone.__init__c C s� d| _ d| _d| _d| _t| _| jd d �= | jd d �= | jd d �= | j d d �= d| _
d| _ | j d d �= | j
d d �= | jd d �= | jd d �= d | _| jd d �= | jd d �= d| _d| _d| _d S )Nr F)r r r r r
r r! r" r) r# r, r$ r% r* r& r' rO rP r( r+ rQ rR )rS rJ rJ rK �cleanup� s* z Zone.cleanupc C s� t | j�| _t | j�| _t | j�| _t | j�| _dd� | jD �| _dd� | jD �| _dd� | jD �| _dd� | jD �| _dd� | j D �| _ dd� | j
D �| _
dd� | j D �| _ d d� | j D �| _ d
d� | j
D �| _
d d� | jD �| _d S )
z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |��qS rJ )r )�.0�srJ rJ rK �
<listcomp>� s z'Zone.encode_strings.<locals>.<listcomp>c S s g | ]\}}t |�t |�f�qS rJ )r )rV �po�prrJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rZ rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rI rJ rJ rK rX � s c S s0 g | ](\}}}}t |�t |�t |�t |�f�qS rJ )r )rV Zp1Zp2Zp3Zp4rJ rJ rK rX � s c S s g | ]\}}t |�t |�f�qS rJ )r )rV rY rZ rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rI rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rW rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rW rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rW rJ rJ rK rX � s N)r r r r r r! r" r) r# r% r* r& r' rP r( )rS rJ rJ rK �encode_strings� s zZone.encode_stringsc sN |dkr8dd� |D �| _ tt| �j|dd� | j D �� ntt| �j||� d S )Nr( c S s g | ]}t j|d ��qS ))Zrule_str)r Z Rich_Rule)rV rW rJ rJ rK rX � s z$Zone.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS rJ )�str)rV rW rJ rJ rK rX � s )rP rM r � __setattr__)rS r0 r3 )rT rJ rK r] � s zZone.__setattr__c s t t| �j� }|d= |S )Nr )rM r �export_config_dict)rS Zconf)rT rJ rK r^ � s zZone.export_config_dictc C sL t | |||� |dkr.|tkr*ttj|���n|dkr�xl|D ]d}t|�sTttj|��| jr<xD| jj� D ]6}|| j krvqf|| jj
|�j krfttjdj ||���qfW q<W n�|dk�rHx�|D ]�}t
|� r�t|� r�t|� r�|jd� r�ttj|��| jr�xL| jj� D ]>}|| j k�r�q|| jj
|�jk�rttjdj ||����qW q�W d S )Nr r& z)interface '{}' already bound to zone '{}'r' zipset:z&source '{}' already bound to zone '{}')r r r r �INVALID_TARGETr ZINVALID_INTERFACErO Z get_zonesr0 Zget_zoner& �formatr r r �
startswith� INVALID_ADDRr' )rS r �itemZ
all_configr7 r5 r9 rJ rJ rK �
_check_config� s6
zZone._check_configc s� t t| �j|� |jd�r,ttjd| ��n�|jd�rHttjd| ��n�|jd�dkrhttjd| ��nnd|kr�|d |j d�� }n|}t
|�t � kr�ttjd|t
|�t � | j f ��| j
r�|| j
j� kr�ttjd��d S )Nr/ z'%s' can't start with '/'z'%s' can't end with '/'� zmore than one '/' in '%s'z'Zone of '%s' has %d chars, max is %d %sz+Zones can't have the same name as a policy.)rM r �
check_namera r r � INVALID_NAME�endswith�count�find�lenr
rQ rO Zget_policy_objectsZ
NAME_CONFLICT)rS r0 Z checked_name)rT rJ rK rf � s,
zZone.check_namec
C s� d| _ d | _d| _d| _d| _x$|jD ]}|| jkr&| jj|� q&W x$|jD ]}|| jkrL| jj|� qLW x$|jD ]}|| jkrr| jj|� qrW x$|j D ]}|| j kr�| j j|� q�W x$|j
D ]}|| j
kr�| j
j|� q�W x$|j D ]}|| j kr�| j j|� q�W |j �rd| _ |j
�r d| _
x(|jD ] }|| jk�r&| jj|� �q&W x(|jD ] }|| jk�rP| jj|� �qPW x,|jD ]"} | jj| � | jjt| �� �qzW |j�r�d| _d S )NTr )rQ �filenamer r r r& �appendr' r! r" r) r# r, r$ r% r* rP r( r\ r+ )
rS r5 r7 r9 r6 r1 �protoZicmpr, r8 rJ rJ rK �combine� sL
z Zone.combine)r r )r r )r r )r F)r r )r r )r$ F)r r r r )r r )r+ F)r, F)�__name__�
__module__� __qualname__�__doc__rG ZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRS� staticmethodrL rN rU r[ r] r^ rd rf ro �
__classcell__rJ rJ )rT rK r ( sx
c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�zone_ContentHandlerc C s" t j| |� d | _d| _d | _d S )NF)r rN �_rule� _rule_errorZ _limit_ok)rS rc rJ rJ rK rN s z zone_ContentHandler.__init__c C s� t j| ||� | jrd S | jj||� t| ||�r6d S |dkr�d|krVtjd|d � d|krj|d | j_d|kr�tjd|d � d|kr�|d }|t kr�t
t j |��|dkr�|t
kr�|| j_�n�|d kr�| jjr�tjd
� nd | j_�n�|d k�rh| j�rtjd
� d | _d S d|k�r.tjd� d | _d S |d | jjk�rT| jjj|d � ntjd|d � �n8|dk�rf| j�r | jj�r�tjdt| j�� d | _d S d}d|k�r�|d j� d$k�r�d }d } }}d|k�r�|d }d|k�r�|d }d|k�r|d }tj||||d�| j_d S d|k�rBd|k�rBtjd� d S d|k�rdd|k�rdtjd� d S d |k�r~tjd |d � d|k�r�tjd � d S d|k�r�t|d � �r�t|d � �r�t|d � �r�t
t j|d ��d|k�r$d |d }|| jj k�r| jj j|� ntjd |d � d|k�r�|d }|| jj k�rT| jj j|� ntjd |d � n:|d!k�r�| jj �r�tjd"� nd | j_ ntjd#|� d S d S )%Nr5 r0 z'Ignoring deprecated attribute name='%s'r r= z,Ignoring deprecated attribute immutable='%s'r r r, z Forward already set, ignoring.Tr7 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r9 z:Invalid rule: More than one source in rule '%s', ignoring.FrA �yes�truer? r@ rB )rA z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.r> z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.zicmp-block-inversionz+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s')ry rz ) r � startElementrx rc Zparser_check_element_attrsr r Zwarningr r r r r_ r
r r, rw r& rm r9 r\ �lowerr Z Rich_Sourcer r r rb r' r+ ) rS r0 �attrsr rA Zaddrr@ rB �entryrJ rJ rK r{ & s�
z zone_ContentHandler.startElementc C s t j| |� t| |� d S )N)r �
endElementr )rS r0 rJ rJ rK r � s z zone_ContentHandler.endElementN)rp rq rr rN r{ r rJ rJ rJ rK rv s prv Fc
C s t � }| jd�s ttjd| ��| d d � |_|s>|j|j� | |_||_|j t
j �rZdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd| j� ��W Y d d } ~ X nX W d Q R X ~~t�r|j� |S )
Nz.xmlz'%s' is missing .xml suffix� FTz%s/%s�rbznot a valid zone file: %s���)r rh r r rg r0 rf rl �pathra r �
ETC_FIREWALLDZbuiltin�defaultrv �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZ INVALID_ZONEZ getExceptionr r[ )
rl r� Z
no_check_namer5 �handler�parserr0 �fr9 �msgrJ rJ rK r � s:
(c C s\ |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� i }| j�r| jd k�r| j|d
< | jtk�r*| j|d < |jd |� |jd
� t| |� x8t| j�D ]*} |jd� |jdd| i� |jd
� �qVW x\t| j �D ]N}
|jd� d|
k�r�|jdd|
dd � i� n|jdd|
i� |jd
� �q�W | j �r
|jd� |jdi � |jd
� | j �r2|jd� |jdi � |jd
� |j d � |jd
� |j � |j!� ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r5 �
z r7 r0 zipset:r9 rB � r? zicmp-block-inversionr, )"r� rl r0 �os�exists�shutilZcopy2� Exceptionr �error�dirnamera r r� �mkdir�ior� r Z
startDocumentr r r
r{ ZignorableWhitespacer r r& Z
simpleElementr' r+ r, r Z endDocument�close) r5 r� �_pathr0 r� �dirpathr� r� r} r7 r9 rJ rJ rK r � s`
)F)N)(�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r
r r Zfirewall.core.baser
r Zfirewall.core.io.io_objectr r r r Zfirewall.core.io.policyr r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r rv r r rJ rJ rJ rK �<module> s$
$ x|
core/io/__pycache__/icmptype.cpython-36.pyc 0000644 00000011635 15035135172 0014603 0 ustar 00 3
��g� � @ s� d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZ ddlmZ dd lmZ dd
lmZ G d d � d e �ZG d d
� d
e
�Zdd� Zddd�ZdS )�IcmpType�icmptype_reader�icmptype_writer� N)�config)�
u2b_if_py2)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�errors)�
FirewallErrorc sp e Zd ZdddddgffZdZddgZd d d d
�Zd dgd d
gd�Z� fdd�Zdd� Z dd� Z
dd� Z � Z S )r �version� �short� description� destinationz(sssas)�_�-N)r r �icmptype�name�ipv4�ipv6)r r c s* t t| �j� d| _d| _d| _g | _d S )Nr )�superr �__init__r r r r )�self)� __class__� � /usr/lib/python3.6/icmptype.pyr 8 s
zIcmpType.__init__c C s" d| _ d| _d| _| jd d �= d S )Nr )r r r r )r r r r �cleanup? s zIcmpType.cleanupc C s: t | j�| _t | j�| _t | j�| _dd� | jD �| _dS )z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |��qS r )r )�.0�mr r r �
<listcomp>L s z+IcmpType.encode_strings.<locals>.<listcomp>N)r r r r r )r r r r �encode_stringsE s zIcmpType.encode_stringsc C s2 |dkr.x$|D ] }|dkrt tjd| ��qW d S )Nr r r z '%s' not from {'ipv4'|'ipv6'})r r )r
r ZINVALID_DESTINATION)r r �itemZ
all_configr r r r �
_check_configN s
zIcmpType._check_config)r r )r r )r r )
�__name__�
__module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r r# r% �
__classcell__r r )r r r % s c @ s e Zd Zdd� ZdS )�icmptype_ContentHandlerc C s� t j| ||� | jj||� |dkrTd|kr>tjd|d � d|kr�|d | j_nT|dkr^nJ|dkrhn@|dkr�x6d D ].}||krv|| j� d
krv| jjj t
|�� qvW d S )Nr r z'Ignoring deprecated attribute name='%s'r r r r r r �yes�true)r r )r+ r, ) r � startElementr$ Zparser_check_element_attrsr Zwarningr �lowerr �append�str)r r �attrs�xr r r r- Y s"
z$icmptype_ContentHandler.startElementN)r& r' r( r- r r r r r* X s r* c C s t � }| jd�s ttjd| ��| d d � |_|j|j� | |_||_|j t
j �rVdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd|j� ��W Y d d }~X nX W d Q R X ~~t�r|j� |S )
Nz.xmlz%s is missing .xml suffix� FTz%s/%s�rbz not a valid icmptype file: %s���)r �endswithr
r Z INVALID_NAMEr Z
check_name�filename�path�
startswithr �
ETC_FIREWALLDZbuiltin�defaultr* �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZINVALID_ICMPTYPEZ getExceptionr r# ) r7 r8 r �handler�parserr �f�source�msgr r r r m s8
(c
C s. |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� i }| j�r| jd k�r| j|d
< |jd |� |jd � | j�rt| jd k�rt|jd
� |jdi � |j| j� |jd� |jd � | j�r�| jd k�r�|jd
� |jdi � |j| j� |jd� |jd � | j�r|jd
� i }x| jD ]} d|| < �q�W |jd|� |jd � |jd � |jd � |j � |j � ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r �
z r r r+ r ) r8 r7 r �os�exists�shutilZcopy2� Exceptionr �error�dirnamer9 r r: �mkdir�ior= r
Z
startDocumentr r- ZignorableWhitespacer Z
charactersZ
endElementr r Z
simpleElementZ endDocument�close)
r r8 �_pathr rC �dirpathrA r? r1 r2 r r r r � s\
)N)�__all__Zxml.saxr< rG rN rI Zfirewallr Zfirewall.functionsr Zfirewall.core.io.io_objectr r r r
Zfirewall.core.loggerr r Zfirewall.errorsr
r r* r r r r r r �<module> s
3 core/io/__pycache__/firewalld_conf.cpython-36.opt-1.pyc 0000644 00000016616 15035135172 0016672 0 ustar 00 3
��g�5 �
@ s~ d dl Zd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z ddddd d
d d d
ddddg
Z
G dd� de�ZdS )� N)�config)�log)�b2u�u2b�PY2� DefaultZone� MinimalMark�
CleanupOnExit�CleanupModulesOnExit�Lockdown�
IPv6_rpfilter�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDriftingc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dS )�firewalld_confc C s i | _ g | _|| _| j� d S )N)�_config�_deleted�filename�clear)�selfr � r �$/usr/lib/python3.6/firewalld_conf.py�__init__& s zfirewalld_conf.__init__c C s i | _ g | _d S )N)r r )r r r r r , s zfirewalld_conf.clearc C s | j j� g | _d S )N)r r r )r r r r �cleanup0 s
zfirewalld_conf.cleanupc C s | j j|j� �S )N)r �get�strip)r �keyr r r r 4 s zfirewalld_conf.getc C s8 t |j� �}t |j� �| j|< || jkr4| jj|� d S )N)r r r r �remove)r r �valueZ_keyr r r �set7 s
zfirewalld_conf.setc C sH d}x2| j j� D ]$\}}|r$|d7 }|d||f 7 }qW trDt|�S |S )N� �
z%s=%s)r �itemsr r )r �sr r" r r r �__str__= s zfirewalld_conf.__str__c C s� | j � yt| jd�}W �n8 tk
�rR } �ztjd| j|� | jdtj� | jdt tj
�� | jdtj rpdnd� | jdtj r�dnd� | jd tj
r�dnd� | jd
tjr�dnd� | jd tjr�dnd� | jd tj� | jd
tj� | jdtj� | jdtj�r
dnd� | jdtj�r"dnd� | jdtj�r:dnd� � W Y d d }~X nX � x�|D ]�}|�shP |j� }t|�dk �s\|d d.k�r��q\dd� |jd�D �}t|�dk�r�tjd|j� � �q\nr|d tk�r�tjd|j� � �q\nN|d d k�rtjd |j� � �q\n*| jj|d �d k �r:tjd |j� � �q\|d | j|d < �q\W |j � | jd��s�tjd tj� | jdt tj�� | jd�}y t |� W nP t t fk
�r� |d k �r�tj d |�r�|nd tj
� | jdt tj
�� Y nX | jd�}| �s|j!� d/k�rJ|d k �r2tj d#|�r(|nd tj � | jdtj �rDdnd� | jd�}| �sj|j!� d0k�r�|d k �r�tj d$|�r�|nd tj � | jdtj �r�dnd� | jd �}| �s�|j!� d1k�r|d k �r�tj d%|�r�|nd tj
� | jd tj
�r�dnd� | jd
�}| �s"|j!� d2k�r^|d k �rFtj d&|�r<|nd tj� | jd
tj�rXdnd� | jd �}| �s~|j!� d3k�r�|d k �r�tj d'|�r�|nd tj� | jd tj�r�dnd� | jd �}| �s�|tj"k�r|d k �r�tj d(|tj� | jd t tj�� | jd
�}| �s&|j!� tj#k�r\|d k �rJtj d)|�r@|nd tj� | jd
t tj�� | jd�}| �s~|j!� tj$k�r�|d k �r�tj d*|�r�|nd tj� | jdt tj�� | jd�}| �s�|j!� d4k�r
|d k �r�tj d+|�r�|nd tj� | jdt tj�� | jd�}| �s*|j!� d5k�r`|d k �rNtj d,|�rD|nd tj� | jdt tj�� | jd�}| �s�|j!� d6k�r�|d k �r�tj d-|�r�|nd tj� | jdt tj�� d S )7N�rzFailed to load '%s': %sr r r �yes�nor
r r r
r r r r r r � r �#�;c S s g | ] }|j � �qS r )r )�.0�xr r r �
<listcomp>b s z'firewalld_conf.read.<locals>.<listcomp>�=� z Invalid option definition: '%s'zInvalid option: '%s'r$ zMissing value: '%s'z!Duplicate option definition: '%s'z0DefaultZone is not set, using default value '%s'z7MinimalMark '%s' is not valid, using default value '%d'�false�truez7CleanupOnExit '%s' is not valid, using default value %sz>CleanupModulesOnExit '%s' is not valid, using default value %sz2Lockdown '%s' is not valid, using default value %sz7IPv6_rpfilter '%s' is not valid, using default value %sz9IndividualCalls '%s' is not valid, using default value %sz3LogDenied '%s' is invalid, using default value '%s'z:AutomaticHelpers '%s' is not valid, using default value %sz9FirewallBackend '%s' is not valid, using default value %sz:FlushAllOnReload '%s' is not valid, using default value %sz6RFC3964_IPv4 '%s' is not valid, using default value %sz;AllowZoneDrifting '%s' is not valid, using default value %s)r- r. )r+ r4 r* r5 )r+ r4 r* r5 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )%r �openr � Exceptionr �errorr# r Z
FALLBACK_ZONE�strZFALLBACK_MINIMAL_MARKZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTINGr �len�split�
valid_keysr r �close�int�
ValueError� TypeErrorZwarning�lowerZLOG_DENIED_VALUESZAUTOMATIC_HELPERS_VALUESZFIREWALL_BACKEND_VALUES)r �f�msg�lineZpairr" r r r �readF s
zfirewalld_conf.readc : C s� t | j�dk rd S g }tjjtj�s2tjtjd� y.tj ddtjj
| j � tjj | j �dd�}W n2 t
k
r� } ztjd| � � W Y d d }~X nX d}d}ytj| j dd d
�}W nP t
k
�r } z0tjj| j �r�tjd | j |f � � nd }W Y d d }~X �n6X �x0|D �]&}|�sP |jd �}t |�dk �rH|�s2|jd � d
}n�|d dk�rpd}|j|� |jd � n�|jd�}t |�dk�r�d}|j|d � �q |d j� } |d j� }
| |k�r.| | jk�r�| j| |
k�r�d}|jd| | j| f � d
}n$| | jk�rd
}nd}|j|d � |j| � nd
}�q W t | j�dk�r�x^| jj� D ]P\} }
| |k�rj�qT| dk�rx�qT|�s�|jd � d
}|jd| |
f � d
}�qTW |�r�|j� |j� |�s�tj|j� d S tjj| j ��r@ytj | j d| j � W nB t
k
�r> } z$tj|j� t d| j |f ��W Y d d }~X nX ytj |j| j � W nB t
k
�r� } z$tj|j� t d| j |f ��W Y d d }~X nX tj | j d� d S )Nr, i� Zwtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %sZrtzUTF-8)rF �encodingzFailed to open '%s': %sr% Tr r- r2 r3 z%s=%s
r r z%s.oldzBackup of '%s' failed: %szFailed to create '%s': %si� )r r ) r: r �os�path�existsr Z
ETC_FIREWALLD�mkdir�tempfileZNamedTemporaryFile�basenamer �dirnamer7 r r8 �ior6 r �writer; r �appendr& r= r! �name�shutilZcopy2�IOErrorZmove�chmod) r �doneZ temp_filerC Zmodified�emptyrB rD �pr r" r r r rS � s�
$ $zfirewalld_conf.writeN) �__name__�
__module__� __qualname__r r r r r# r( rE rS r r r r r % s r )Zos.pathrK rR rO rV Zfirewallr Zfirewall.core.loggerr Zfirewall.functionsr r r r< �objectr r r r r �<module> s core/io/__pycache__/icmptype.cpython-36.opt-1.pyc 0000644 00000011635 15035135172 0015542 0 ustar 00 3
��g� � @ s� d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZ ddlmZ dd lmZ dd
lmZ G d d � d e �ZG d d
� d
e
�Zdd� Zddd�ZdS )�IcmpType�icmptype_reader�icmptype_writer� N)�config)�
u2b_if_py2)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�errors)�
FirewallErrorc sp e Zd ZdddddgffZdZddgZd d d d
�Zd dgd d
gd�Z� fdd�Zdd� Z dd� Z
dd� Z � Z S )r �version� �short� description� destinationz(sssas)�_�-N)r r �icmptype�name�ipv4�ipv6)r r c s* t t| �j� d| _d| _d| _g | _d S )Nr )�superr �__init__r r r r )�self)� __class__� � /usr/lib/python3.6/icmptype.pyr 8 s
zIcmpType.__init__c C s" d| _ d| _d| _| jd d �= d S )Nr )r r r r )r r r r �cleanup? s zIcmpType.cleanupc C s: t | j�| _t | j�| _t | j�| _dd� | jD �| _dS )z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |��qS r )r )�.0�mr r r �
<listcomp>L s z+IcmpType.encode_strings.<locals>.<listcomp>N)r r r r r )r r r r �encode_stringsE s zIcmpType.encode_stringsc C s2 |dkr.x$|D ] }|dkrt tjd| ��qW d S )Nr r r z '%s' not from {'ipv4'|'ipv6'})r r )r
r ZINVALID_DESTINATION)r r �itemZ
all_configr r r r �
_check_configN s
zIcmpType._check_config)r r )r r )r r )
�__name__�
__module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r r# r% �
__classcell__r r )r r r % s c @ s e Zd Zdd� ZdS )�icmptype_ContentHandlerc C s� t j| ||� | jj||� |dkrTd|kr>tjd|d � d|kr�|d | j_nT|dkr^nJ|dkrhn@|dkr�x6d D ].}||krv|| j� d
krv| jjj t
|�� qvW d S )Nr r z'Ignoring deprecated attribute name='%s'r r r r r r �yes�true)r r )r+ r, ) r � startElementr$ Zparser_check_element_attrsr Zwarningr �lowerr �append�str)r r �attrs�xr r r r- Y s"
z$icmptype_ContentHandler.startElementN)r& r' r( r- r r r r r* X s r* c C s t � }| jd�s ttjd| ��| d d � |_|j|j� | |_||_|j t
j �rVdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd|j� ��W Y d d }~X nX W d Q R X ~~t�r|j� |S )
Nz.xmlz%s is missing .xml suffix� FTz%s/%s�rbz not a valid icmptype file: %s���)r �endswithr
r Z INVALID_NAMEr Z
check_name�filename�path�
startswithr �
ETC_FIREWALLDZbuiltin�defaultr* �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZINVALID_ICMPTYPEZ getExceptionr r# ) r7 r8 r �handler�parserr �f�source�msgr r r r m s8
(c
C s. |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� i }| j�r| jd k�r| j|d
< |jd |� |jd � | j�rt| jd k�rt|jd
� |jdi � |j| j� |jd� |jd � | j�r�| jd k�r�|jd
� |jdi � |j| j� |jd� |jd � | j�r|jd
� i }x| jD ]} d|| < �q�W |jd|� |jd � |jd � |jd � |j � |j � ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r �
z r r r+ r ) r8 r7 r �os�exists�shutilZcopy2� Exceptionr �error�dirnamer9 r r: �mkdir�ior= r
Z
startDocumentr r- ZignorableWhitespacer Z
charactersZ
endElementr r Z
simpleElementZ endDocument�close)
r r8 �_pathr rC �dirpathrA r? r1 r2 r r r r � s\
)N)�__all__Zxml.saxr< rG rN rI Zfirewallr Zfirewall.functionsr Zfirewall.core.io.io_objectr r r r
Zfirewall.core.loggerr r Zfirewall.errorsr
r r* r r r r r r �<module> s
3 core/io/__pycache__/service.cpython-36.opt-1.pyc 0000644 00000020377 15035135172 0015353 0 ustar 00 3
��g�2 � @ s� d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZmZmZ ddlmZ dd lmZ dd
lmZ G d d � d e �ZG d d
� d
e
�Zdd� Zddd�ZdS )�Service�service_reader�service_writer� N)�config)�
u2b_if_py2)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator�
check_port� check_tcpudp�check_protocol�
check_address)�log)�errors)�
FirewallErrorc s� e Zd Zd d!d"dd#gfddgfdddifddgfd d$gfd
dgfd dgff
Zd d
gZdddd�Zddgddgdgdgddgddgdgdgd�Z� fdd�Zdd� Zd d � Z d d � Z
� Z S )%r �version� �short� description�ports�modules� destination� protocols� source_ports�includes�helpers�_�-N)r r �service�name�port�protocol�value�ipv4�ipv6r )r r! r" �moduler z source-port�include�helperc sN t t| �j� d| _d| _d| _g | _g | _g | _i | _ g | _
g | _ g | _ d S )Nr )
�superr �__init__r r r r r r r r r r )�self)� __class__� � /usr/lib/python3.6/service.pyr* D s zService.__init__c C sh d| _ d| _d| _| jd d �= | jd d �= | jd d �= | jj� | jd d �= | j d d �= | j
d d �= d S )Nr ) r r r r r r r �clearr r r )r+ r- r- r. �cleanupQ s
zService.cleanupc C s� t | j�| _t | j�| _t | j�| _dd� | jD �| _dd� | jD �| _dd� | jj� D �| _dd� | jD �| _dd� | j D �| _ dd� | j
D �| _
d d� | j D �| _ d
S ) z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ]\}}t |�t |�f�qS r- )r )�.0�po�prr- r- r. �
<listcomp>d s z*Service.encode_strings.<locals>.<listcomp>c S s g | ] }t |��qS r- )r )r1 �mr- r- r. r4 e s c S s i | ]\}}t |�t |��qS r- )r )r1 �k�vr- r- r. �
<dictcomp>f s z*Service.encode_strings.<locals>.<dictcomp>c S s g | ] }t |��qS r- )r )r1 r3 r- r- r. r4 g s c S s g | ]\}}t |�t |�f�qS r- )r )r1 r2 r3 r- r- r. r4 h s c S s g | ] }t |��qS r- )r )r1 �sr- r- r. r4 j s c S s g | ] }t |��qS r- )r )r1 r9 r- r- r. r4 k s N) r r r r r r r �itemsr r r r )r+ r- r- r. �encode_strings] s zService.encode_stringsc C s: |dkrJx>|D ]6}|d dkr8t |d � t|d � qt|d � qW n�|dkrjx�|D ] }t|� qXW n�|dkr�x�|D ] }t |d � t|d � qxW n�|dkr�x�|D ]*}|dkr�ttjd
| ��t||| � q�W n^|d k�r6xR|D ]J}|jd ��r|jd d�}d
|k�r|jd
d�}t |�dk r�ttj
|��q�W d S )Nr r r � r r r r$ r% z'%s' not in {'ipv4'|'ipv6'}r �
nf_conntrack_r r � )r$ r% ) r r r
r r ZINVALID_DESTINATIONr �
startswith�replace�lenZINVALID_MODULE)r+ r �itemZ
all_configr! �protor r& r- r- r. �
_check_configm s8
zService._check_config)r r )r r )r r )r r )r r ) �__name__�
__module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr* r0 r; rD �
__classcell__r- r- )r, r. r & s4
c @ s e Zd Zdd� ZdS )�service_ContentHandlerc C s0 t j| ||� | jj||� |dkrTd|kr<tjd|d � d|krP|d | j_�n�|dkr`�n�|dkrl�n�|dk�r$|d dkr�t|d � t|d � |d |d f}|| jj kr�| jj j
|� ntjd
|d |d � nBt |d � |d | jj k�r| jj j
|d � ntjd |d � �n|d k�rtt |d � |d | jj k�r`| jj j
|d � ntjd |d � �n�|d
k�r�t|d � t|d � |d |d f}|| jj
k�r�| jj
j
|� ntjd|d |d � �nN|dk�r>xRd D ]J}||k�r�t||| � || jjk�r&tjd|� n|| | jj|< �q�W n�|dk�r�|d }|jd��r~|jdd�}d|k�r~|jdd�}|| jjk�r�| jjj
|� n tjd|� n�|dk�r�|d | jjk�r�| jjj
|d � ntjd|d � n@|dk�r,|d | jjk�r | jjj
|d � ntjd|d � d S ) Nr r z'Ignoring deprecated attribute name='%s'r r r r! r r" z#Port '%s/%s' already set, ignoring.z$Protocol '%s' already set, ignoring.r# z source-portz)SourcePort '%s/%s' already set, ignoring.r r$ r% z2Destination address for '%s' already set, ignoringr& r= r r z"Module '%s' already set, ignoring.r' z#Include '%s' already set, ignoring.r( z"Helper '%s' already set, ignoring.)r$ r% )r � startElementrB Zparser_check_element_attrsr Zwarningr r r r �appendr
r r r r r? r@ r r r )r+ r �attrs�entry�xr& r- r- r. rJ � s�
z#service_ContentHandler.startElementN)rE rF rG rJ r- r- r- r. rI � s rI c C s t � }| jd�s ttjd| ��| d d � |_|j|j� | |_||_|j t
j �rVdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd|j� ��W Y d d }~X nX W d Q R X ~~t�r|j� |S )
Nz.xmlz'%s' is missing .xml suffix� FTz%s/%s�rbz not a valid service file: %s���)r �endswithr r Z INVALID_NAMEr Z
check_name�filename�pathr? r �
ETC_FIREWALLDZbuiltin�defaultrI �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZINVALID_SERVICEZ getExceptionr r; ) rS rT r �handler�parserr �f�source�msgr- r- r. r � s8
(c C sr |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� i }| j�r| jd k�r| j|d
< |jd |� |jd � | j�rt| jd k�rt|jd
� |jdi � |j| j� |jd� |jd � | j�r�| jd k�r�|jd
� |jdi � |j| j� |jd� |jd � x>| jD ]4} |jd
� |jd| d | d d�� |jd � �q�W x4| j D ]*}
|jd
� |jdd|
i� |jd � �qW x>| j D ]4} |jd
� |jd| d | d d�� |jd � �q<W x4| j D ]*} |jd
� |jdd| i� |jd � �q|W t | j �dk�r�|jd
� |jd| j � |jd � x4| j!D ]*} |jd
� |jdd | i� |jd � �q�W x4| j"D ]*}
|jd
� |jdd|
i� |jd � �qW |jd � |jd � |j#� |j$� ~d S ) Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r �
z r r r! r r< )r! r" r" r# z source-portr& r r r' r( )%rT rS r �os�exists�shutilZcopy2� Exceptionr �error�dirnamer? r rU �mkdir�iorX r
Z
startDocumentr rJ ZignorableWhitespacer Z
charactersZ
endElementr r Z
simpleElementr r r rA r r r Z endDocument�close)r rT �_pathr r^ �dirpathr\ rZ rL r! r" r& r' r( r- r- r. r s�
)N) �__all__Zxml.saxrW rb ri rd Zfirewallr Zfirewall.functionsr Zfirewall.core.io.io_objectr r r r
r r r
r Zfirewall.core.loggerr r Zfirewall.errorsr r rI r r r- r- r- r. �<module> s
( mQ core/io/__pycache__/helper.cpython-36.opt-1.pyc 0000644 00000013451 15035135172 0015165 0 ustar 00 3
��g� � @ s� d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZ ddlmZ dd lmZ dd
lmZ G d d � d e �ZG d d
� d
e
�Zdd� Zddd�ZdS )�Helper�
helper_reader�
helper_writer� N)�config)�
u2b_if_py2)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator�
check_port� check_tcpudp)�log)�errors)�
FirewallErrorc s� e Zd Zdd d d d dd gffZdZd d
gZd d dgd �Zd
ddgddgd�Z� fdd�Zdd� Z dd� Z
dd� Z dd� Z � Z
S )!r �version� �short� description�family�module�portsz (sssssa(ss))�-�.N)r r �helper�name�port�protocol)r r c s6 t t| �j� d| _d| _d| _d| _d| _g | _d S )Nr ) �superr �__init__r r r r r r )�self)� __class__� � /usr/lib/python3.6/helper.pyr ; s zHelper.__init__c C s. d| _ d| _d| _d| _d| _| jd d �= d S )Nr )r r r r r r )r r! r! r" �cleanupD s zHelper.cleanupc C sR t | j�| _t | j�| _t | j�| _t | j�| _t | j�| _dd� | jD �| _dS )z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ]\}}t |�t |�f�qS r! )r )�.0ZpoZprr! r! r" �
<listcomp>U s z)Helper.encode_strings.<locals>.<listcomp>N)r r r r r r r )r r! r! r" �encode_stringsL s zHelper.encode_stringsc C s( ddg}||kr$t tjd||f ��d S )NZipv4Zipv6z'%s' not in '%s')r r Z INVALID_IPV)r ZipvZipvsr! r! r" � check_ipvW s zHelper.check_ipvc C sz |dkr0xl|D ] }t |d � t|d � qW nF|dkrv|jd�sRttjd| ��t|jdd��dk rvttjd| ��d S ) Nr r � r �
nf_conntrack_z('%s' does not start with 'nf_conntrack_'r zModule name '%s' too short)r r �
startswithr r �INVALID_MODULE�len�replace)r r �itemZ
all_configr r! r! r" �
_check_config] s
zHelper._check_config)r r )r r )r r )r r )r r )r r )�__name__�
__module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r# r& r' r/ �
__classcell__r! r! )r r" r & s$
c @ s e Zd Zdd� ZdS )�helper_ContentHandlerc C s> t j| ||� | jj||� |dkr�d|kr8|d | j_d|kr\| jj|d � |d | j_d|kr�|d jd�s�tt j
d|d ��t |d j dd��dk r�tt j
d |d ��|d | j_
nz|d
kr�np|d kr�nf|d k�r:t|d � t|d
� |d |d
f}|| jjk�r$| jjj|� ntjd|d |d
� d S )Nr r r r r) z('%s' does not start with 'nf_conntrack_'r r( zModule name '%s' too shortr r r r z#Port '%s/%s' already set, ignoring.)r � startElementr. Zparser_check_element_attrsr r' r r* r r r+ r, r- r r r r �appendr
Zwarning)r r �attrs�entryr! r! r" r5 n s>
z"helper_ContentHandler.startElementN)r0 r1 r2 r5 r! r! r! r" r4 m s r4 c C s t � }| jd�s ttjd| ��| d d � |_|j|j� | |_||_|j t
j �rVdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd|j� ��W Y d d }~X nX W d Q R X ~~t�r|j� |S )
Nz.xmlz'%s' is missing .xml suffix� FTz%s/%s�rbznot a valid helper file: %s���)r �endswithr r Z INVALID_NAMEr Z
check_name�filename�pathr* r �
ETC_FIREWALLDZbuiltin�defaultr4 �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZINVALID_HELPERZ getExceptionr r& ) r= r> r �handler�parserr �f�source�msgr! r! r" r � s8
(c
C sP |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� i }| j|d < | j�r | jd
k�r | j|d < | j�r<| jd
k�r<| j|d < |jd
|� |jd� | j�r�| jd
k�r�|jd� |jdi � |j| j� |jd� |jd� | j�r�| jd
k�r�|jd� |jdi � |j| j� |jd� |jd� x>| j D ]4} |jd� |j d| d | d d�� |jd� �q�W |jd
� |jd� |j � |j � ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r r �
z r r r r r( )r r ) r> r= r �os�exists�shutilZcopy2� Exceptionr
�error�dirnamer* r r? �mkdir�iorB r
Z
startDocumentr r r r5 ZignorableWhitespacer Z
charactersZ
endElementr r Z
simpleElementZ endDocument�close)
r r> �_pathr rH �dirpathrF rD r7 r r! r! r" r � s\
)N)�__all__Zxml.saxrA rL rS rN Zfirewallr Zfirewall.functionsr Zfirewall.core.io.io_objectr r r r
r r Zfirewall.core.loggerr
r Zfirewall.errorsr r r4 r r r! r! r! r" �<module> s
G# core/io/__pycache__/lockdown_whitelist.cpython-36.opt-1.pyc 0000644 00000022550 15035135172 0017622 0 ustar 00 3
��g�1 � @ s� d dl jZd dlZd dlZd dlZd dlmZ d dlmZm Z m
Z
m Z d dl m
Z
d dlmZmZmZmZmZmZ d dlmZ d dlmZ G dd � d e
�ZG d
d � d e �ZdS ) � N)�config)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�uniqify� checkUser�checkUid� checkCommand� checkContext�
u2b_if_py2)�errors)�
FirewallErrorc @ s e Zd Zdd� Zdd� ZdS )�!lockdown_whitelist_ContentHandlerc C s t j| |� d| _d S )NF)r �__init__� whitelist)�self�item� r �(/usr/lib/python3.6/lockdown_whitelist.pyr % s z*lockdown_whitelist_ContentHandler.__init__c C sV t j| ||� | jj||� |dkr@| jr6ttjd��d| _�n|dkrr| js\tj d� d S |d }| jj
|� n�|dkr�| js�tj d� d S d |kr�yt |d �}W n& t k
r� tj d
|d � d S X | jj
|� nd|kr�| jj|d � n\|d k�r@| j�stj d � d S d
|k�r.tj d� d S | jj|d
� ntj d| � d S d S )Nr zMore than one whitelist.T�commandz)Parse Error: command outside of whitelist�name�userz&Parse Error: user outside of whitelist�idz"Parse Error: %s is not a valid uid�selinuxz)Parse Error: selinux outside of whitelist�contextzParse Error: no contextzUnknown XML element %s)r � startElementr Zparser_check_element_attrsr r r Z PARSE_ERRORr �error� add_command�int�
ValueError�add_uid�add_user� add_context)r r Zattrsr �uidr r r r ) sJ
z.lockdown_whitelist_ContentHandler.startElementN)�__name__�
__module__� __qualname__r r r r r r r $ s r c s4 e Zd ZdZddgfddgfddgfddgffZdZd gZd
d gd
d gd
�Zddd giZ� fdd�Z dd� Z
dd� Z dd� Z dd� Z
dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!dBdC� Z"� Z#S )D�LockdownWhitelistz LockdownWhitelist class �commands� �contexts�users�uidsr z
(asasasai)�_Nr r )r r r r r r c s6 t t| �j� || _d | _g | _g | _g | _g | _d S )N) �superr) r �filename�parserr* r, r- r. )r r1 )� __class__r r r n s zLockdownWhitelist.__init__c C s� |d
kr.x�|D ]}| j ||d d � |� qW nv|dkrLt|�s�ttj|��nX|dkrjt|�s�ttj|��n:|dkr�t|�s�ttj|��n |d kr�t |�s�ttj
|��d S ) Nr* r, r- r. � r r r r% )r* r, r- r. ���) �
_check_configr r r �INVALID_COMMANDr �INVALID_CONTEXTr � INVALID_USERr
� INVALID_UID)r r r Z
all_config�xr r r r6 y s
z LockdownWhitelist._check_configc C s4 | j d d �= | jd d �= | jd d �= | jd d �= d S )N)r* r, r- r. )r r r r �cleanup� s zLockdownWhitelist.cleanupc C s: dd� | j D �| _ dd� | jD �| _dd� | jD �| _dS )z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |��qS r )r
)�.0r; r r r �
<listcomp>� s z4LockdownWhitelist.encode_strings.<locals>.<listcomp>c S s g | ] }t |��qS r )r
)r= r; r r r r> � s c S s g | ] }t |��qS r )r
)r= r; r r r r> � s N)r* r, r- )r r r r �encode_strings� s z LockdownWhitelist.encode_stringsc C s@ t |�sttj|��|| jkr,| jj|� nttjd| ��d S )Nz!Command "%s" already in whitelist)r r r r7 r* �append�ALREADY_ENABLED)r r r r r r � s
z LockdownWhitelist.add_commandc C s, || j kr| j j|� nttjd| ��d S )Nz Command "%s" not in whitelist.)r* �remover r � NOT_ENABLED)r r r r r �remove_command� s
z LockdownWhitelist.remove_commandc C s
|| j kS )N)r* )r r r r r � has_command� s z LockdownWhitelist.has_commandc C sB x<| j D ]2}|jd�r.|j|d d� �r:dS q||krdS qW dS )N�*r4 TFr5 )r* �endswith�
startswith)r r Z_commandr r r �
match_command� s
z LockdownWhitelist.match_commandc C s | j S )N)r* )r r r r � get_commands� s z LockdownWhitelist.get_commandsc C sD t |�sttjt|���|| jkr0| jj|� nttjd| ��d S )Nz Uid "%s" already in whitelist)r
r r r: �strr. r@ rA )r r% r r r r" � s
zLockdownWhitelist.add_uidc C s, || j kr| j j|� nttjd| ��d S )NzUid "%s" not in whitelist.)r. rB r r rC )r r% r r r �
remove_uid� s
z LockdownWhitelist.remove_uidc C s
|| j kS )N)r. )r r% r r r �has_uid� s zLockdownWhitelist.has_uidc C s
|| j kS )N)r. )r r% r r r � match_uid� s zLockdownWhitelist.match_uidc C s | j S )N)r. )r r r r �get_uids� s zLockdownWhitelist.get_uidsc C s@ t |�sttj|��|| jkr,| jj|� nttjd| ��d S )Nz User "%s" already in whitelist)r r r r9 r- r@ rA )r r r r r r# � s
zLockdownWhitelist.add_userc C s, || j kr| j j|� nttjd| ��d S )NzUser "%s" not in whitelist.)r- rB r r rC )r r r r r � remove_user� s
z LockdownWhitelist.remove_userc C s
|| j kS )N)r- )r r r r r �has_user� s zLockdownWhitelist.has_userc C s
|| j kS )N)r- )r r r r r �
match_user� s z LockdownWhitelist.match_userc C s | j S )N)r- )r r r r � get_users� s zLockdownWhitelist.get_usersc C s@ t |�sttj|��|| jkr,| jj|� nttjd| ��d S )Nz!Context "%s" already in whitelist)r r r r8 r, r@ rA )r r r r r r$ " s
z LockdownWhitelist.add_contextc C s, || j kr| j j|� nttjd| ��d S )Nz Context "%s" not in whitelist.)r, rB r r rC )r r r r r �remove_context, s
z LockdownWhitelist.remove_contextc C s
|| j kS )N)r, )r r r r r � has_context3 s z LockdownWhitelist.has_contextc C s
|| j kS )N)r, )r r r r r �
match_context6 s z LockdownWhitelist.match_contextc C s | j S )N)r, )r r r r � get_contexts9 s z LockdownWhitelist.get_contextsc C s� | j � | jjd�s&ttjd| j ��t| �}tj� }|j |� y|j
| j� W n8 tj k
r� } zttj d|j
� ��W Y d d }~X nX ~~tr�| j� d S )Nz.xmlz'%s' is missing .xml suffixzNot a valid file: %s)r< r1 rG r r Z INVALID_NAMEr �saxZ make_parserZsetContentHandler�parseZSAXParseExceptionZ INVALID_TYPEZ getExceptionr r? )r �handlerr2 �msgr r r �read> s"
zLockdownWhitelist.readc C s� t jj| j�r\ytj| jd| j � W n4 tk
rZ } ztd| j|f ��W Y d d }~X nX t jjtj �sxt j
tj d� t j | jddd�}t
|�}|j� |jdi � |jd� x6t| j�D ](}|jd � |jd
d |i� |jd� q�W x:t| j�D ],}|jd � |jd d
t|�i� |jd� q�W x8t| j�D ]*}|jd � |jd d |i� |jd� �q0W x8t| j�D ]*}|jd � |jdd|i� |jd� �qjW |jd� |jd� |j� |j� ~d S )Nz%s.oldzBackup of '%s' failed: %si� ZwtzUTF-8)�mode�encodingr �
z r r r r r r )�os�path�existsr1 �shutilZcopy2� Exception�IOErrorr Z
ETC_FIREWALLD�mkdir�io�openr Z
startDocumentr ZignorableWhitespacer r* Z
simpleElementr. rK r- r, Z
endElementZ endDocument�close)r r[ �frZ r r% r r r r r �writeQ sB $
zLockdownWhitelist.write)$r& r' r( �__doc__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r6 r< r? r rD rE rI rJ r" rL rM rN rO r# rP rQ rR rS r$ rT rU rV rW r\ rk �
__classcell__r r )r3 r r) W sL
1
r) )Zxml.saxrX r` rg rc Zfirewallr Zfirewall.core.io.io_objectr r r r Zfirewall.core.loggerr Zfirewall.functionsr r r
r r r
r Zfirewall.errorsr r r) r r r r �<module> s
3 core/io/__pycache__/policy.cpython-36.pyc 0000644 00000051212 15035135172 0014243 0 ustar 00 3
��gϢ � @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z m
Z
ddlm Z m Z m
Z
ddlmZmZmZ dd lmZmZmZmZmZmZ dd
lmZ dd lm Z dd lm Z dd
l m Z dd� Z dd� Z!dd� Z"dd� Z#dd� Z$G dd � d e�Z%G dd� de�Z&d d d�Z'd d d�Z(dS ) �Policy�
policy_reader�
policy_writer� N)�config)�checkIP�checkIP6)�uniqify�max_policy_name_len�portStr)�DEFAULT_POLICY_TARGET�POLICY_TARGETS�DEFAULT_POLICY_PRIORITY)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator�
check_port� check_tcpudp�check_protocol)�rich)�log)�errors)�
FirewallErrorc C s� |dkr �n�|dkr�n�|dkr�| j r`| j jrJtjdt| j �� d| _dS tj|d �| j _dS |d | jj kr�| jj j
|d � ntjd|d � �n|dk�rN| j r�| j jr�tjdt| j �� d| _dS tj |d |d �| j _dS t |d � t
|d � t|d d
�|d f}|| jjk�r4| jjj
|� ntjd |d |d � �nN|d k�r�| j �r�| j j�r�tjdt| j �� d| _dS tj|d �| j _nBt|d � |d | jjk�r�| jjj
|d � ntjd
|d � �n�|dk�rh| j �r.| j j�rtjdt| j �� d| _dS tj|d �| j _dS |d | jjk�rT| jjj
|d � ntjd|d � �n4|dk�r�| j �r�| j j�r�tjdt| j �� d| _dS tj|d �| j _dS tjd|d � �n�|dk�r2| j �r| j j�rtjdt| j �� d| _dS tj� | j _n | jj�r&tjd� nd| j_�nj|dk�r�d}d|k�rR|d }d}d|k�rh|d }| j �r�| j j�r�tjdt| j �� d| _dS tj|d |d ||�| j _dS t |d � t
|d � |�r�t |� |�r
t|� �r
t|� �r
tt j d| ��t|d d
�|d t|d
�t|�f}|| jj k�rL| jj j
|� n6tjd|d |d |�rld| nd|�r|d| nd� �n|d k�r@| j �r�| j j�r�tjdt| j �� d| _dS tj |d |d �| j _dS t |d � t
|d � t|d d
�|d f}|| jj k�r&| jj j
|� ntjd |d |d � �n\|d k�r�| j �sftjd � d| _dS | j j!�r�tjd t| j �� dS d!}d }d"|k�r�|d" }d }d#|k�r�|d# }d$|k�r�|d$ j"� dLk�r�d}tj#|||�| j _!�n�|dMk�r�| j �stjd+� d| _dS | j j$�r0tjd,� d| _dS |d'k�rHtj%� | j _$nh|d(k�rxd } d-|k�rh|d- } tj&| �| j _$n8|d)k�r�tj'� | j _$n |d*k�r�|d. }
tj(|
�| j _$| j j$| _)�n�|d/k�r^| j �s�tjd0� dS | j j�r�tjd1� dS d } d2|k�r*|d2 } | dNk�r*tjd;� d| _dS d<|k�r<|d< nd } tj*| | �| j _| j j| _)�n>|d=k�r�| j �s~tjd>� dS | j j+�r�tjd?t| j �� d| _dS tj,� | j _+| j j+| _)n�|d@k�r,d }
dA}dB|k�r|dB }
|
dOk�rtjdE|dB � d| _dS dF|k�rt-|dF �}tj.|
|dG�| _ np|dHk�r�| j)�sRtjdI� d| _dS | j)j/�rxtjdJt| j �� d| _dS |d }tj0||j1dK��| j)_/nd!S dS )PN�short� description�servicez;Invalid rule: More than one element in rule '%s', ignoring.T�namez#Service '%s' already set, ignoring.�port�protocol�-z#Port '%s/%s' already set, ignoring.�valuez$Protocol '%s' already set, ignoring.z
icmp-blockz&icmp-block '%s' already set, ignoring.z icmp-typez-Invalid rule: icmp-block '%s' outside of rule�
masqueradez!Masquerade already set, ignoring.z forward-port� zto-portzto-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%sz source-portz*Source port '%s/%s' already set, ignoring.� destinationz)Invalid rule: Destination outside of rulez?Invalid rule: More than one destination in rule '%s', ignoring.F�address�ipset�invert�yes�true�accept�reject�drop�markz$Invalid rule: Action outside of rulez"Invalid rule: More than one action�type�setr z!Invalid rule: Log outside of rulez Invalid rule: More than one log�level�emerg�alert�crit�error�warning�notice�info�debugz Invalid rule: Invalid log level�prefix�auditz#Invalid rule: Audit outside of rulez9Invalid rule: More than one audit in rule '%s', ignoring.�ruler �family�ipv4�ipv6z&Invalid rule: Rule family "%s" invalid�priority)r: r= �limitz4Invalid rule: Limit outside of action, log and auditz9Invalid rule: More than one limit in rule '%s', ignoring.�burst)r& r' )r( r) r* r+ )r/ r0 r1 r2 r3 r4 r5 r6 )r; r< )2�_rule�elementr r3 �str� _rule_errorr � Rich_Service�item�services�append� Rich_Portr r r
�ports�
Rich_Protocolr � protocols�Rich_IcmpBlock� icmp_blocks�
Rich_IcmpType�Rich_Masquerader �Rich_ForwardPortr r r r � INVALID_ADDR�
forward_ports�Rich_SourcePort� source_portsr" �lowerZRich_Destination�action� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� _limit_okZRich_Logr8 Z
Rich_Audit�int� Rich_Ruler> Z
Rich_Limit�get)�objr �attrs�entry�to_portZto_addrr% r# r$ Z_typeZ_setr. r7 r: r= r � rc � /usr/lib/python3.6/policy.py�common_startElement s�
re c C s� |dkr�| j s�y| jj� W n6 tk
rR } ztjd|t| j�� W Y d d }~X nLX t| j�| jjkr�| jj j
| j� | jjj
t| j�� ntjdt| j�� d | _d| _ n|d kr�d | _ d S ) Nr9 z%s: %sz Rule '%s' already set, ignoring.Fr( r) r* r+ r r8 )r( r) r* r+ r r8 ) rC r@ Zcheck� Exceptionr r3 rB rE � rules_str�rulesrG r[ )r_ r �erc rc rd �common_endElement s & rj c C s� t | t�rdnd}|dkrT| jrT| jj� }x$|D ] }||kr0ttjd| ��q0W �n�|dkr�x$|D ] }t|d � t|d � qbW �nb|dkr�x|D ] }t |� q�W �n@|d kr�| jr�| jj
� } x$|D ] }
|
| kr�ttj d
|
��q�W �n�|d k�r�x�|D ]�} t| d � t| d � | d �r>| d
�r>ttj d| ��| d �rTt| d � | d
r�t
| d
� r�t| d
� r�ttjd| d
��q�W �nT|dk�r�x&|D ] }t|d � t|d � �q�W �n |dk�r�x|D �]} tj| d�}
| j�r�|
j�r�t |
jtj��s t |
jtj��r�| jj
� } |
jj| k�rLttj d
|
jj ��nH|
j�r�| jj|
jj�}|j�r�|
j|jk�r�ttj d|
j|
jjf ��nL| j�r�t |
jtj��r�| jj� }|
jj|k�r�ttjdj|| j|
jj����q�W d S )Nr ZZonerF z '%s' not among existing servicesrI r � rK rM z"'%s' not among existing icmp typesrR � � z$'%s' is missing to-port AND to-addr z#to-addr '%s' is not a valid addressrT rg �
rich_rules)�rule_strz3rich rule family '%s' conflicts with icmp type '%s'z){} '{}': '{}' not among existing services)rg rn )�
isinstancer � fw_configZ get_servicesr r ZINVALID_SERVICEr r r Z
get_icmptypesZINVALID_ICMPTYPE�INVALID_FORWARDr r rQ r r] rA rL rN r r: Z get_icmptyper" rD �format)r_ r rE �
all_configZobj_typeZexisting_servicesr r �protoZexisting_icmptypesZicmptype�fwd_portr9 Zobj_richZictrc rc rd �common_check_config2 s�
rw c C s0 d|j i}|j}|d k r ||d< | jd|� d S )Nr r? r> )r r? �
simpleElement)�handlerr> �dr? rc rc rd �_handler_add_rich_limitx s
r{ c C s� | j rF| j dkrF|jd� |jdi � |j| j � |jd� |jd� | jr�| jdkr�|jd� |jdi � |j| j� |jd� |jd� x6t| j�D ](}|jd� |jdd|i� |jd� q�W x@t| j �D ]2}|jd� |jd|d |d
d �� |jd� q�W x8t| j
�D ]*}|jd� |jd d
|i� |jd� �qW x8t| j �D ]*}|jd� |jdd|i� |jd� �qLW | j �r�|jd� |jdi � |jd� x�t| j
�D ]�}|jd� |d |d
d �}|d �r�|d dk�r�|d |d< |d �r|d dk�r|d |d< |jd|� |jd� �q�W xBt| j�D ]4}|jd� |jd|d |d
d �� |jd� �q>W �xT| jD �]H}i }|j�r�|j|d< |jd k�r�t|j�|d< |jd� |jd|� |jd� |j�rVi }|jj�r�|jj|d< |jj�r|jj|d< |jj�r$|jj|d< |jj�r6d |d < |jd � |jd |� |jd� |j�r�i }|jj�rx|jj|d< |jj�r�|jj|d< |jj�r�d |d < |jd � |jd |� |jd� |j�rxd} i }t|j�tj k�r�d} |jj |d< �nbt|j�tj k�r(d} |jj |d< |jj |d < �n0t|j�tj!k�rNd } |jj"|d
< �n
t|j�tj#k�rfd} n�t|j�tj$k�r�d} |jj |d< n�t|j�tj%k�r�d!} |jj |d< n�t|j�tj&k�rd} |jj |d< |jj |d < |jj'dk�r�|jj'|d< |jj(dk�rX|jj(|d< nFt|j�tj)k�rBd} |jj |d< |jj |d < nt*t+j,d"t|j� ��|jd � |j| |� |jd� |j-�r i }|j-j.�r�|j-j.|d#< |j-j/�r�|j-j/|d$< |j-j0�r�|jd � |jd%|� |jd&� t1||j-j0� |jd'� |jd%� n|jd � |jd%|� |jd� |j2�r�i }|j2j0�rx|jd � |jd(i � |jd&� t1||j2j0� |jd'� |jd(� n|jd � |jd(|� |jd� |j3�r�d}
i }t|j3�tj4k�r�d)}
n|t|j3�tj5k�r�d*}
|j3j�r<|j3j|d+< nNt|j3�tj6k�rd,}
n6t|j3�tj7k�r*d-}
|j3j8|d.< nt-j9d/t|j3�� |j3j0�r�|jd � |j|
|� |jd&� t1||j3j0� |jd'� |j|
� n|jd � |j|
|� |jd� |jd� |jd� |jd� �q�W d S )0Nr! z r �
r r r r r rk )r r r r z
icmp-blockr rl zto-portrm zto-addrz forward-portz source-portr: r= r9 r# �macr$ �Truer% z �sourcer" z icmp-typez"Unknown element '%s' in obj_writerr7 r. r z
z
r8 r( r) r, r* r+ r- zUnknown action '%s'):r �ignorableWhitespace� startElementZ
characters�
endElementr r rF rx rI rK rM r rR rT rh r: r= rB r �addrr} r$ r% r" rA r, r rD r rH r r rJ r rO rL rN rP rb �
to_addressrS r r ZINVALID_OBJECTr r7 r. r> r{ r8 rV rW rX rY rZ r- r3 ) r_ ry r r r ZicmpZforwardr` r9 rA rV rc rc rd �
common_writer� s\
r� c sP e Zd Zd7ZdZeZdgZd8d9d:d;d dgfd
d<gfd dgfd=dd>gfddgfddgfdd?gfd@ddgfddgffZdddgZ dddgdgddgdgdgdddgdddd gddgdddddd gd gdgdgd �Z
ddgd d gd!dgd"d#d$d!d%gd"d$d%gd&d'gd(gd)gd*�Z � fd+d,�Z d-d.� Z
� fd/d0�Z� fd1d2�Zd3d4� Z� fd5d6�Z� ZS )Ar i � i� r �versionr! r r �targetrF rI rM r FrR rn rK rT r= �
ingress_zones� egress_zones�_r �/Nr r r r r- )r r �policyr r z
icmp-blockz icmp-typer z forward-portr9 r r" r z source-portr r8 r( r) r* r+ r> z ingress-zonez egress-zonezto-portzto-addrr: r# r} r% r$ r7 r. r, r? )r� z forward-portr9 r r" r r) r> c s� t t| �j� d| _d| _d| _t| _g | _g | _ g | _
g | _ d| _ g | _
g | _d | _g | _g | _d| _| j| _d | _g | _g | _d S )Nr! F)�superr �__init__r� r r r r� rF rI rK rM r rR rT rq rh rg �applied�priority_defaultr= Zderived_from_zoner� r� )�self)� __class__rc rd r� � s( zPolicy.__init__c C s� d| _ d| _d| _t| _| jd d �= | jd d �= | jd d �= | jd d �= d| _ | j
d d �= | j d d �= d | _ | j
d d �= | jd d �= d| _| j| _| jd d �= | jd d �= d S )Nr! F)r� r r r r� rF rI rK rM r rR rT rq rh rg r� r� r= r� r� )r� rc rc rd �cleanup� s$ zPolicy.cleanupc s" |dkr| j S ttt| �|�S d S )Nrn )rg �getattrr� r )r� r )r� rc rd � __getattr__� s zPolicy.__getattr__c sB |dkr,dd� |D �| _ dd� | j D �| _ntt| �j||� d S )Nrn c S s g | ]}t j|d ��qS ))ro )r r] )�.0�src rc rd �
<listcomp>� s z&Policy.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS rc )rB )r� r� rc rc rd r� � s )rh rg r� r � __setattr__)r� r r )r� rc rd r� � s zPolicy.__setattr__c
C s t | |||� |dkr2|tkr.ttjd| ���n�|dkrz|| jksX|| jksX|| jk rvttjd|| j| j| jf ���n�|dk�rhddg}| j r�|| j j
� 7 }x�|D ]�}||kr�ttj d | ��|dkr�t ddg�t |�@ � s�|d k�rt |�t |g� �rttj d
| ��|dkr�|dk�r8d|k�r8d|d k�sT|dkr�d|kr�d|d kr�ttj d ��q�W �n�|d k�r|�rd|k�r�d|d k�r�ttj d
��nxd|k�rd|d k�r�ttj d��xR|d D ]F}|dk�rސq�| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �n�|dk�r4�x�|D �] }tj|d�}|j�r�t|jtj��r�d|k�r|d|d k�r|ttj d
��nxd|k�r,d|d k�r�ttj d��xR|d D ]F}|dk�r��q�| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �q,|j�r�t|jtj��r�d|k�r,d|d k�r@|jj�r�ttjd��nt|d �r,|jj�s`ttjd��d|d k�r,x�|d D ]8}| j j
|�}| j �rxd| j j|�k�rxttj d���qxW nv|j�r,t|jtj��r,d|k�r,xR|d D ]F}|d k�r�q�| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �q,W n�|dk�rx�|D ]�} d|k�rnd|d k�rnttj d��n�d|k�rDd|d k�r�| d �rttjd��nt|d �rD| d �s�ttjd��d|d k�rDxD|d D ]8}| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �qDW d S ) Nr� z'%s' is invalid targetr= zQ%d is invalid priority. Must be in range [%d, %d]. The following are reserved: %sr� r� �ANY�HOSTz '%s' not among existing zonesz>'%s' may only contain one of: many regular zones, ANY, or HOSTzF'HOST' can only appear in either ingress or egress zones, but not bothr z.'masquerade' is invalid for egress zone 'HOST'z/'masquerade' is invalid for ingress zone 'HOST'Z
interfaceszR'masquerade' cannot be used in a policy if an ingress zone has assigned interfacesrn )ro zAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonezS'forward-port' cannot be used in a policy if an egress zone has assigned interfaceszR'mark' action cannot be used in a policy if an egress zone has assigned interfacesrR z1'forward-port' is invalid for ingress zone 'HOST'rm )r� r� )r� r� )r� r� )r� r� )rw r r r �INVALID_TARGET�priority_reserved� priority_max� priority_minZINVALID_PRIORITYrq � get_zonesZ INVALID_ZONEr- Zget_zoneZget_zone_config_dictr r] rA rp rO rP r� rr rV rZ )
r� r rE rt Zexisting_zones�zoneZz_objr9 r_ rv rc rc rd �
_check_config� s�
"
zPolicy._check_configc s� t t| �j|� |jd�r,ttjd| ��n�|jd�rHttjd| ��n�|jd�dkrhttjd| ��njd|kr�|d |j d�� }n|}t
|�t � kr�ttjd|t
|�t � f ��| j r�|| j j
� kr�ttjd��d S )Nr� z'%s' can't start with '/'z'%s' can't end with '/'rk zmore than one '/' in '%s'z&Policy of '%s' has %d chars, max is %dz,Policies can't have the same name as a zone.)r� r �
check_name�
startswithr r � INVALID_NAME�endswith�count�find�lenr rq r� Z
NAME_CONFLICT)r� r Z checked_name)r� rc rd r� , s*
zPolicy.check_namei ���)r� r! )r r! )r r! )r� r! )r! r! )r F)r! r! r! r! )r! r! )r= r )�__name__�
__module__� __qualname__r� r� r
r� r� ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr� r� r� r� r� r� �
__classcell__rc rc )r� rd r Z sr
^c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�policy_ContentHandlerc C s" t j| |� d | _d| _d | _d S )NF)r r� r@ rC r[ )r� rE rc rc rd r� H s z policy_ContentHandler.__init__c C s t j| ||� | jrd S | jj||� t| ||�r6d S |dkr�d|krR|d | j_d|krjt|d �| j_d|kr�|d }|t kr�t
t j |��|r�|| j_
�n^|dkr�|d | jjkr�| jjj|d � ntjd|d � �n |dk�r |d | jjk�r| jjj|d � ntjd |d � n�|d
k�r�| j�sFtjd � d | _d S | jj�rltjd
t| j�� d | _d S d}d|k�r�|d j� dk�r�d }d } }}d|k�r�|d }d|k�r�|d }d|k�r�|d }tj||||d�| j_d S tjd|� d S d S )Nr� r� r= r� z ingress-zoner z(Ingress zone '%s' already set, ignoring.z egress-zonez'Egress zone '%s' already set, ignoring.r z$Invalid rule: Source outside of ruleTz:Invalid rule: More than one source in rule '%s', ignoring.Fr% r& r' r# r} r$ )r% zUnknown XML element '%s')r& r' )r r� rC rE Zparser_check_element_attrsre r� r\ r= r r r r� r� r� rG r r3 r� r@ r rB rU r Z Rich_Source)r� r r` r� r% r� r} r$ rc rc rd r� N sf
z"policy_ContentHandler.startElementc C s t j| |� t| |� d S )N)r r� rj )r� r rc rc rd r� � s z policy_ContentHandler.endElementN)r� r� r� r� r� r� rc rc rc rd r� G s @r� Fc
C s t � }| jd�s ttjd| ��| d d � |_|s>|j|j� | |_||_|j t
j �rZdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd| j� ��W Y d d } ~ X nX W d Q R X ~~|S )
Nz.xmlz'%s' is missing .xml suffix� FTz%s/%s�rbznot a valid policy file: %s���)r r� r r r� r r� �filename�pathr� r �
ETC_FIREWALLDZbuiltin�defaultr� �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZINVALID_POLICYZ getException)
r� r� Z
no_check_namer� ry �parserr �fr �msgrc rc rd r � s6
(c
C s� |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� i }| j�r| jd k�r| j|d
< | j| jk�r0t| j�|d < | j|d < |jd
|� |jd� t| |� x8t| j �D ]*} |jd� |j dd| i� |jd� �qfW x8t| j �D ]*} |jd� |j dd| i� |jd� �q�W |j d
� |jd� |j � |j!� ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr! r� r= r� r� r| z z ingress-zoner z egress-zone)"r� r� r �os�exists�shutilZcopy2rf r r2 �dirnamer� r r� �mkdir�ior� r Z
startDocumentr� r= r� rB r� r� r� r� r r� rx r� r� Z endDocument�close)
r� r� �_pathr r� �dirpathr� ry r` r� rc rc rd r � sN
)F)N))�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r
Zfirewall.core.baser r r
Zfirewall.core.io.io_objectr r r r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr re rj rw r{ r� r r� r r rc rc rc rd �<module> s4
F [ nL
core/io/__pycache__/firewalld_conf.cpython-36.pyc 0000644 00000016616 15035135172 0015733 0 ustar 00 3
��g�5 �
@ s~ d dl Zd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z ddddd d
d d d
ddddg
Z
G dd� de�ZdS )� N)�config)�log)�b2u�u2b�PY2� DefaultZone� MinimalMark�
CleanupOnExit�CleanupModulesOnExit�Lockdown�
IPv6_rpfilter�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDriftingc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dS )�firewalld_confc C s i | _ g | _|| _| j� d S )N)�_config�_deleted�filename�clear)�selfr � r �$/usr/lib/python3.6/firewalld_conf.py�__init__& s zfirewalld_conf.__init__c C s i | _ g | _d S )N)r r )r r r r r , s zfirewalld_conf.clearc C s | j j� g | _d S )N)r r r )r r r r �cleanup0 s
zfirewalld_conf.cleanupc C s | j j|j� �S )N)r �get�strip)r �keyr r r r 4 s zfirewalld_conf.getc C s8 t |j� �}t |j� �| j|< || jkr4| jj|� d S )N)r r r r �remove)r r �valueZ_keyr r r �set7 s
zfirewalld_conf.setc C sH d}x2| j j� D ]$\}}|r$|d7 }|d||f 7 }qW trDt|�S |S )N� �
z%s=%s)r �itemsr r )r �sr r" r r r �__str__= s zfirewalld_conf.__str__c C s� | j � yt| jd�}W �n8 tk
�rR } �ztjd| j|� | jdtj� | jdt tj
�� | jdtj rpdnd� | jdtj r�dnd� | jd tj
r�dnd� | jd
tjr�dnd� | jd tjr�dnd� | jd tj� | jd
tj� | jdtj� | jdtj�r
dnd� | jdtj�r"dnd� | jdtj�r:dnd� � W Y d d }~X nX � x�|D ]�}|�shP |j� }t|�dk �s\|d d.k�r��q\dd� |jd�D �}t|�dk�r�tjd|j� � �q\nr|d tk�r�tjd|j� � �q\nN|d d k�rtjd |j� � �q\n*| jj|d �d k �r:tjd |j� � �q\|d | j|d < �q\W |j � | jd��s�tjd tj� | jdt tj�� | jd�}y t |� W nP t t fk
�r� |d k �r�tj d |�r�|nd tj
� | jdt tj
�� Y nX | jd�}| �s|j!� d/k�rJ|d k �r2tj d#|�r(|nd tj � | jdtj �rDdnd� | jd�}| �sj|j!� d0k�r�|d k �r�tj d$|�r�|nd tj � | jdtj �r�dnd� | jd �}| �s�|j!� d1k�r|d k �r�tj d%|�r�|nd tj
� | jd tj
�r�dnd� | jd
�}| �s"|j!� d2k�r^|d k �rFtj d&|�r<|nd tj� | jd
tj�rXdnd� | jd �}| �s~|j!� d3k�r�|d k �r�tj d'|�r�|nd tj� | jd tj�r�dnd� | jd �}| �s�|tj"k�r|d k �r�tj d(|tj� | jd t tj�� | jd
�}| �s&|j!� tj#k�r\|d k �rJtj d)|�r@|nd tj� | jd
t tj�� | jd�}| �s~|j!� tj$k�r�|d k �r�tj d*|�r�|nd tj� | jdt tj�� | jd�}| �s�|j!� d4k�r
|d k �r�tj d+|�r�|nd tj� | jdt tj�� | jd�}| �s*|j!� d5k�r`|d k �rNtj d,|�rD|nd tj� | jdt tj�� | jd�}| �s�|j!� d6k�r�|d k �r�tj d-|�r�|nd tj� | jdt tj�� d S )7N�rzFailed to load '%s': %sr r r �yes�nor
r r r
r r r r r r � r �#�;c S s g | ] }|j � �qS r )r )�.0�xr r r �
<listcomp>b s z'firewalld_conf.read.<locals>.<listcomp>�=� z Invalid option definition: '%s'zInvalid option: '%s'r$ zMissing value: '%s'z!Duplicate option definition: '%s'z0DefaultZone is not set, using default value '%s'z7MinimalMark '%s' is not valid, using default value '%d'�false�truez7CleanupOnExit '%s' is not valid, using default value %sz>CleanupModulesOnExit '%s' is not valid, using default value %sz2Lockdown '%s' is not valid, using default value %sz7IPv6_rpfilter '%s' is not valid, using default value %sz9IndividualCalls '%s' is not valid, using default value %sz3LogDenied '%s' is invalid, using default value '%s'z:AutomaticHelpers '%s' is not valid, using default value %sz9FirewallBackend '%s' is not valid, using default value %sz:FlushAllOnReload '%s' is not valid, using default value %sz6RFC3964_IPv4 '%s' is not valid, using default value %sz;AllowZoneDrifting '%s' is not valid, using default value %s)r- r. )r+ r4 r* r5 )r+ r4 r* r5 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )%r �openr � Exceptionr �errorr# r Z
FALLBACK_ZONE�strZFALLBACK_MINIMAL_MARKZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTINGr �len�split�
valid_keysr r �close�int�
ValueError� TypeErrorZwarning�lowerZLOG_DENIED_VALUESZAUTOMATIC_HELPERS_VALUESZFIREWALL_BACKEND_VALUES)r �f�msg�lineZpairr" r r r �readF s
zfirewalld_conf.readc : C s� t | j�dk rd S g }tjjtj�s2tjtjd� y.tj ddtjj
| j � tjj | j �dd�}W n2 t
k
r� } ztjd| � � W Y d d }~X nX d}d}ytj| j dd d
�}W nP t
k
�r } z0tjj| j �r�tjd | j |f � � nd }W Y d d }~X �n6X �x0|D �]&}|�sP |jd �}t |�dk �rH|�s2|jd � d
}n�|d dk�rpd}|j|� |jd � n�|jd�}t |�dk�r�d}|j|d � �q |d j� } |d j� }
| |k�r.| | jk�r�| j| |
k�r�d}|jd| | j| f � d
}n$| | jk�rd
}nd}|j|d � |j| � nd
}�q W t | j�dk�r�x^| jj� D ]P\} }
| |k�rj�qT| dk�rx�qT|�s�|jd � d
}|jd| |
f � d
}�qTW |�r�|j� |j� |�s�tj|j� d S tjj| j ��r@ytj | j d| j � W nB t
k
�r> } z$tj|j� t d| j |f ��W Y d d }~X nX ytj |j| j � W nB t
k
�r� } z$tj|j� t d| j |f ��W Y d d }~X nX tj | j d� d S )Nr, i� Zwtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %sZrtzUTF-8)rF �encodingzFailed to open '%s': %sr% Tr r- r2 r3 z%s=%s
r r z%s.oldzBackup of '%s' failed: %szFailed to create '%s': %si� )r r ) r: r �os�path�existsr Z
ETC_FIREWALLD�mkdir�tempfileZNamedTemporaryFile�basenamer �dirnamer7 r r8 �ior6 r �writer; r �appendr& r= r! �name�shutilZcopy2�IOErrorZmove�chmod) r �doneZ temp_filerC Zmodified�emptyrB rD �pr r" r r r rS � s�
$ $zfirewalld_conf.writeN) �__name__�
__module__� __qualname__r r r r r# r( rE rS r r r r r % s r )Zos.pathrK rR rO rV Zfirewallr Zfirewall.core.loggerr Zfirewall.functionsr r r r< �objectr r r r r �<module> s core/io/__pycache__/helper.cpython-36.pyc 0000644 00000013451 15035135172 0014226 0 ustar 00 3
��g� � @ s� d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZ ddlmZ dd lmZ dd
lmZ G d d � d e �ZG d d
� d
e
�Zdd� Zddd�ZdS )�Helper�
helper_reader�
helper_writer� N)�config)�
u2b_if_py2)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator�
check_port� check_tcpudp)�log)�errors)�
FirewallErrorc s� e Zd Zdd d d d dd gffZdZd d
gZd d dgd �Zd
ddgddgd�Z� fdd�Zdd� Z dd� Z
dd� Z dd� Z � Z
S )!r �version� �short� description�family�module�portsz (sssssa(ss))�-�.N)r r �helper�name�port�protocol)r r c s6 t t| �j� d| _d| _d| _d| _d| _g | _d S )Nr ) �superr �__init__r r r r r r )�self)� __class__� � /usr/lib/python3.6/helper.pyr ; s zHelper.__init__c C s. d| _ d| _d| _d| _d| _| jd d �= d S )Nr )r r r r r r )r r! r! r" �cleanupD s zHelper.cleanupc C sR t | j�| _t | j�| _t | j�| _t | j�| _t | j�| _dd� | jD �| _dS )z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ]\}}t |�t |�f�qS r! )r )�.0ZpoZprr! r! r" �
<listcomp>U s z)Helper.encode_strings.<locals>.<listcomp>N)r r r r r r r )r r! r! r" �encode_stringsL s zHelper.encode_stringsc C s( ddg}||kr$t tjd||f ��d S )NZipv4Zipv6z'%s' not in '%s')r r Z INVALID_IPV)r ZipvZipvsr! r! r" � check_ipvW s zHelper.check_ipvc C sz |dkr0xl|D ] }t |d � t|d � qW nF|dkrv|jd�sRttjd| ��t|jdd��dk rvttjd| ��d S ) Nr r � r �
nf_conntrack_z('%s' does not start with 'nf_conntrack_'r zModule name '%s' too short)r r �
startswithr r �INVALID_MODULE�len�replace)r r �itemZ
all_configr r! r! r" �
_check_config] s
zHelper._check_config)r r )r r )r r )r r )r r )r r )�__name__�
__module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r# r& r' r/ �
__classcell__r! r! )r r" r & s$
c @ s e Zd Zdd� ZdS )�helper_ContentHandlerc C s> t j| ||� | jj||� |dkr�d|kr8|d | j_d|kr\| jj|d � |d | j_d|kr�|d jd�s�tt j
d|d ��t |d j dd��dk r�tt j
d |d ��|d | j_
nz|d
kr�np|d kr�nf|d k�r:t|d � t|d
� |d |d
f}|| jjk�r$| jjj|� ntjd|d |d
� d S )Nr r r r r) z('%s' does not start with 'nf_conntrack_'r r( zModule name '%s' too shortr r r r z#Port '%s/%s' already set, ignoring.)r � startElementr. Zparser_check_element_attrsr r' r r* r r r+ r, r- r r r r �appendr
Zwarning)r r �attrs�entryr! r! r" r5 n s>
z"helper_ContentHandler.startElementN)r0 r1 r2 r5 r! r! r! r" r4 m s r4 c C s t � }| jd�s ttjd| ��| d d � |_|j|j� | |_||_|j t
j �rVdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd|j� ��W Y d d }~X nX W d Q R X ~~t�r|j� |S )
Nz.xmlz'%s' is missing .xml suffix� FTz%s/%s�rbznot a valid helper file: %s���)r �endswithr r Z INVALID_NAMEr Z
check_name�filename�pathr* r �
ETC_FIREWALLDZbuiltin�defaultr4 �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZINVALID_HELPERZ getExceptionr r& ) r= r> r �handler�parserr �f�source�msgr! r! r" r � s8
(c
C sP |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� i }| j|d < | j�r | jd
k�r | j|d < | j�r<| jd
k�r<| j|d < |jd
|� |jd� | j�r�| jd
k�r�|jd� |jdi � |j| j� |jd� |jd� | j�r�| jd
k�r�|jd� |jdi � |j| j� |jd� |jd� x>| j D ]4} |jd� |j d| d | d d�� |jd� �q�W |jd
� |jd� |j � |j � ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r r �
z r r r r r( )r r ) r> r= r �os�exists�shutilZcopy2� Exceptionr
�error�dirnamer* r r? �mkdir�iorB r
Z
startDocumentr r r r5 ZignorableWhitespacer Z
charactersZ
endElementr r Z
simpleElementZ endDocument�close)
r r> �_pathr rH �dirpathrF rD r7 r r! r! r" r � s\
)N)�__all__Zxml.saxrA rL rS rN Zfirewallr Zfirewall.functionsr Zfirewall.core.io.io_objectr r r r
r r Zfirewall.core.loggerr
r Zfirewall.errorsr r r4 r r r! r! r! r" �<module> s
G# core/io/__pycache__/ifcfg.cpython-36.opt-1.pyc 0000644 00000007721 15035135172 0014767 0 ustar 00 3
��g� � @ s^ d Z dgZddlZddlZddlZddlZddlmZ ddl m
Z
m Z m Z G dd� de
�ZdS )zifcfg file parser�ifcfg� N)�log)�b2u�u2b�PY2c @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dS )r c C s i | _ g | _|| _| j� d S )N)�_config�_deleted�filename�clear)�selfr � r �/usr/lib/python3.6/ifcfg.py�__init__# s zifcfg.__init__c C s i | _ g | _d S )N)r r )r r r r
r
) s z ifcfg.clearc C s | j j� d S )N)r r
)r r r r
�cleanup- s z
ifcfg.cleanupc C s | j j|j� �S )N)r �get�strip)r �keyr r r
r 0 s z ifcfg.getc C s8 t |j� �}t |j� �| j|< || jkr4| jj|� d S )N)r r r r �remove)r r �valueZ_keyr r r
�set3 s
z ifcfg.setc C sH d}x2| j j� D ]$\}}|r$|d7 }|d||f 7 }qW trDt|�S |S )N� �
z%s=%s)r �itemsr r )r �sr r r r r
�__str__9 s z
ifcfg.__str__c C sB | j � yt| jd�}W n4 tk
rL } ztjd| j|� � W Y d d }~X nX x�|D ]�}|s^P |j� }t|�dk sT|d dkr�qTdd� |jd d�D �}t|�d
kr�qTt|d �d
kr�|d j d �r�|d j
d �r�|d dd� |d< |d d kr�qTn,| j j |d �d k �r tj
d
| j|j� � qT|d | j |d < qTW |j� d S )N�rzFailed to load '%s': %s� r �#�;c S s g | ] }|j � �qS r )r )�.0�xr r r
�
<listcomp>Q s z ifcfg.read.<locals>.<listcomp>�=� �"r z%%s: Duplicate option definition: '%s')r r ���)r
�openr � Exceptionr �errorr �len�split�
startswith�endswithr r Zwarning�close)r �f�msg�lineZpairr r r
�readB s2
z
ifcfg.readc : C s� t | j�dk rd S g }y.tjddtjj| j� tjj| j�dd�}W n2 t k
rv } zt
j d| � � W Y d d }~X nX d}d}yt j
| jddd �}W nN t k
r� } z0tjj| j�r�t
j d
| j|f � � nd }W Y d d }~X �ndX �x^|D �]T}|s�P |jd �}t |�dk �r(|�sD|jd � d }q�|d
dk�rPd}|j|� |jd � q�|jdd�}t |�dk�r~d}|j|d � q�|d
j� } |d j� }
t |
�dk�r�|
jd��r�|
jd��r�|
dd� }
| |k�r@| | jk�r| j| |
k�rd}|jd| | j| f � d }n$| | jk�r"d }nd}|j|d � |j| � q�d }q�W t | j�d
k�r�xF| jj� D ]8\} }
| |k�rz�qd|�s�d }|jd| |
f � d }�qdW |�r�|j� |j� |�s�tj|j� d S tjj| j��r8ytj| jd| j � W nB t k
�r6 } z$tj|j� t d| j|f ��W Y d d }~X nX ytj |j| j� W nB t k
�r� } z$tj|j� t d| j|f ��W Y d d }~X nX tj | jd� d S )Nr Zwtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %sZrtzUTF-8)r2 �encodingzFailed to open '%s': %sr Tr r r" r# r$ z%s=%s
z%s.bakzBackup of '%s' failed: %szFailed to create '%s': %si� r% ) r) r �tempfileZNamedTemporaryFile�os�path�basenamer �dirnamer' r r( �ior& �existsr �writer* r+ r, r �appendr r- r �name�shutilZcopy2�IOErrorZmove�chmod) r �doneZ temp_filer/ Zmodified�emptyr. r0 �pr r r r r
r> _ s�
$ $z ifcfg.writeN) �__name__�
__module__� __qualname__r r
r r r r r1 r> r r r r
r " s )�__doc__�__all__Zos.pathr8 r< r7 rA Zfirewall.core.loggerr Zfirewall.functionsr r r �objectr r r r r
�<module> s core/io/__pycache__/ipset.cpython-36.pyc 0000644 00000025614 15035135172 0014077 0 ustar 00 3
��g�R � @ s d Z dddgZddljZddlZddlZddlZddlmZ ddl m
Z
m Z m Z m
Z
mZmZmZmZmZ ddlmZmZmZmZ dd lmZmZ dd
lm Z m Z m Z m Z dd l m!Z! dd lm"Z" dd
l#m$Z$ G dd� de�Z%G dd� de�Z&dd� Z'ddd�Z(dS )z$ipset io XML handler, reader, writer�IPSet� ipset_reader� ipset_writer� N)�config) �checkIP�checkIP6� checkIPnMask�
checkIP6nMask�
u2b_if_py2� check_mac�
check_port�checkInterface�
checkProtocol)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)� IPSET_TYPES�IPSET_CREATE_OPTIONS)�check_icmp_name�check_icmp_type�check_icmpv6_name�check_icmpv6_type)�log)�errors)�
FirewallErrorc s� e Zd Zd d d d!dddifddgffZdZd d
d d gZd
d
dgdgd
d�Zdgdgd�Z� fdd�Zdd� Z dd� Z
e dd� �Z dd� Z
� fd d �Z� ZS )"r �version� �short� description�type�options�entriesz
(ssssa{ss}as)�_�-�:�.N�name)r r �ipset�option�entry�value)r( r) c s< t t| �j� d| _d| _d| _d| _g | _i | _d| _ d S )Nr F)
�superr �__init__r r r r r" r! �applied)�self)� __class__� �/usr/lib/python3.6/ipset.pyr- C s zIPSet.__init__c C s8 d| _ d| _d| _d| _| jd d �= | jj� d| _d S )Nr F)r r r r r" r! �clearr. )r/ r1 r1 r2 �cleanupM s
z
IPSet.cleanupc C s\ t | j�| _t | j�| _t | j�| _t | j�| _dd� | jj� D �| _dd� | jD �| _dS )z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s i | ]\}}t |�t |��qS r1 )r
)�.0�k�vr1 r1 r2 �
<dictcomp>^ s z(IPSet.encode_strings.<locals>.<dictcomp>c S s g | ] }t |��qS r1 )r
)r5 �er1 r1 r2 �
<listcomp>` s z(IPSet.encode_strings.<locals>.<listcomp>N)r
r r r r r! �itemsr" )r/ r1 r1 r2 �encode_stringsV s zIPSet.encode_stringsc
C s d}d|kr |d dkr d}|j d�s6ttjd| ��|dd � jd�}| jd�}t|�t|�ksnt|�d k r�ttjd
| |f ���xztt|��D �]h}|| }|| }|d k�r�d |ko�|dk�rh|d kr�ttjd
|| |f ��|jd �} t| �dk�rttjd|| ||f ��x�| D ]J}
|dk�r2t|
� �sH|dk�rt |
� �rttjd|
| ||f ���qW nh|dk�r�|dk�r�ttjd|| ||f ��|dk�r�t
} nt} nt } | |��s�ttjd|| ||f ��q�|dk�r@d |k�r�|jd �} t| �dk�rttjd|| ||f ��|dk�r0t| d � �sJ|dk�rft | d � �rfttjd| d | ||f ��|dk�r�t
| d � �s�|dk�r>t | d � �r>ttjd| d | ||f ��n�|j d��r�|dk�o�|dk�o�|dk�s�ttjd|| ||f ��|dk�rt
|� �s&|dk�r�t |� �r�ttjd|| ||f ��q�|dk�rvt
|� �s`|dk�r�ttjd|| f ��q�|dk�r�d|k�r�|jd�} t| �dk�r�ttjd| ��| d d k�r|dk�r�ttjd || f ��t| d � �r�t| d � �r�ttjd | d | f ��n�| d d1k�r~|dk�rDttjd || f ��t| d � �r�t| d � �r�ttjd!| d | f ��n^| d d2k�r�t| d � �r�ttjd&| d | f ��n&t| d ��s�ttjd'| d | f ��n t|��s�ttjd(|| f ��q�|d)k�r�|j d*��rPyt|d+�} W n* tk
�rL ttjd,|| f ��Y nX n8y t|�} W n* tk
�r� ttjd,|| f ��Y nX | dk �s�| d-k�r�ttjd,|| f ��q�|d.k�r�t|� �s�t|�d/k�r�ttjd0|| f ��q�ttjd| ��q�W d S )3NZipv4�family�inet6Zipv6zhash:zipset type '%s' not usable� �,� z)entry '%s' does not match ipset type '%s'Zipr$ z invalid address '%s' in '%s'[%d]� z.invalid address range '%s' in '%s' for %s (%s)z(invalid address '%s' in '%s' for %s (%s)z0.0.0.0r Znetz/0zhash:net,ifaceZmacz00:00:00:00:00:00z invalid mac address '%s' in '%s'Zportr% zinvalid port '%s'Zicmpz(invalid protocol for family '%s' in '%s'z invalid icmp type '%s' in '%s'�icmpv6� ipv6-icmpz invalid icmpv6 type '%s' in '%s'�tcp�sctp�udp�udplitez invalid protocol '%s' in '%s'zinvalid port '%s'in '%s'zinvalid port '%s' in '%s'ZmarkZ0x� zinvalid mark '%s' in '%s'l �� Ziface� z invalid interface '%s' in '%s')rC rD )rE rF rG rH )�
startswithr r �
INVALID_IPSET�split�lenZ
INVALID_ENTRY�ranger r r r �endswithr r r r r r r �int�
ValueErrorr
)
r* r! Z
ipset_typer= �flagsr; �i�flag�itemZsplitsZ_splitZip_checkZint_valr1 r1 r2 � check_entryb s@
zIPSet.check_entryc C s� |dkr |t kr ttjd| ��|dkr�x�|j� D ]�}|tkrNttjd| ��|dkr�yt|| �}W n, tk
r� ttj d||| f ��Y nX |d k r�ttj d
||| f ��q2|d kr2|| dkr2ttj
|| ��q2W d S )Nr z '%s' is not valid ipset typer! zipset invalid option '%s'�timeout�hashsize�maxelemz)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer= �inetr> )rX rY rZ )r[ r> ) r r r � INVALID_TYPE�keysr rL rQ rR �
INVALID_VALUE�INVALID_FAMILY)r/ r rV Z
all_config�key� int_valuer1 r1 r2 �
_check_config s2
zIPSet._check_configc sr d|d kr6|d d dkr6t |d �dkr6ttj��x&|d D ]}tj||d |d � q@W tt| �j|� d S )NrX � �0r? r � )rN r r ZIPSET_WITH_TIMEOUTr rW r, �
import_config)r/ r r* )r0 r1 r2 rf 3 s
zIPSet.import_config)r r )r r )r r )r r )�__name__�
__module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr- r4 r< � staticmethodrW rb rf �
__classcell__r1 r1 )r0 r2 r , s,
7c @ s e Zd Zdd� Zdd� ZdS )�ipset_ContentHandlerc
C s� t j| ||� | jj||� |dkrpd|krX|d tkrLttjd|d ��|d | j_d|krl|d | j_ �nz|dkr|�nn|dkr��nb|dk�r�d}d |kr�|d }|d
dkr�ttj
d|d
��| jjdko�|d
dk� r�ttj
d|d
| jjf ��|d
dk�r&| �r&ttj
d|d
��|d
d k�r�y t |�}W n. t k
�rn ttj
d|d
|f ��Y nX |dk �r�ttj
d|d
|f ��|d
d k�r�|d k�r�ttj|��|d
| jjk�r�|| jj|d
< ntjd|d
� d S ) Nr( r z%sr r r r) r r+ r' r= rX rY rZ zUnknown option '%s'zhash:macz%Unsupported option '%s' for type '%s'z&Missing mandatory value of option '%s'z)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer[ r> z Option %s already set, ignoring.)r= rX rY rZ )r= )r= rX rY rZ )rX rY rZ )r[ r> )r � startElementrV Zparser_check_element_attrsr r r r\ r r ZINVALID_OPTIONrQ rR r^ r_ r! r �warning)r/ r' �attrsr+ ra r1 r1 r2 rm > sd
z!ipset_ContentHandler.startElementc C s( t j| |� |dkr$| jjj| j� d S )Nr* )r �
endElementrV r" �appendZ_element)r/ r' r1 r1 r2 rp u s z ipset_ContentHandler.endElementN)rg rh ri rm rp r1 r1 r1 r2 rl = s 7rl c % C s t � }| jd�s ttjd| ��| d d� |_|j|j� | |_||_|j t
j �rVdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd|j� ��W Y d d }~X nX W d Q R X ~~d |jk�rF|jd d
k�rFt|j�d k�rFt j d |j� |jd d �= d } t � }
x�| t|j�k �r|j| |
k�r�t j d
|j| � |jj | � nry |j |j| |j|j!� W n< tk
�r� } z t j d| � |jj | � W Y d d } ~ X nX |
j"|j| � | d7 } �qRW ~
t#�r|j$� |S )Nz.xmlz'%s' is missing .xml suffixrc FTz%s/%s�rbznot a valid ipset file: %srX rd r z6ipset '%s': timeout option is set, entries are ignoredz Entry %s already set, ignoring.z
%s, ignoring.rA ���)%r rP r r Z INVALID_NAMEr' Z
check_name�filename�pathrK r �
ETC_FIREWALLDZbuiltin�defaultrl �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionrL Z getExceptionr! rN r" r rn �set�poprW r �addr r< ) rt ru r( �handler�parserr' �f�source�msgrT Z entries_setr9 r1 r1 r2 r z s^
( c C s� |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� d | ji}| j�r| jd
k�r| j|d < |jd |� |jd
� | j�rz| jd
k�rz|jd� |jdi � |j| j� |jd� |jd
� | j�r�| jd
k�r�|jd� |jdi � |j| j� |jd� |jd
� xZ| jj � D ]L\} }
|jd� |
d
k�r |j d| |
d�� n|j dd| i� |jd
� �q�W xD| j D ]:} |jd� |jdi � |j| � |jd� |jd
� �q(W |jd � |jd
� |j � |j � ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r( �
z r r r) )r' r+ r' r* )!ru rt r' �os�exists�shutilZcopy2� Exceptionr �error�dirnamerK r rv �mkdir�iory r Z
startDocumentr r rm ZignorableWhitespacer Z
charactersrp r r! r; Z
simpleElementr" Z endDocument�close) r( ru �_pathr' r� �dirpathr� r~ ro r` r+ r* r1 r1 r2 r � sf
)N))�__doc__�__all__Zxml.saxrx r� r� r� Zfirewallr Zfirewall.functionsr r r r r
r r r
r Zfirewall.core.io.io_objectr r r r Zfirewall.core.ipsetr r Zfirewall.core.icmpr r r r Zfirewall.core.loggerr r Zfirewall.errorsr r rl r r r1 r1 r1 r2 �<module> s&
, =5 core/io/__pycache__/functions.cpython-36.pyc 0000644 00000005256 15035135172 0014763 0 ustar 00 3
��gy � @ s� d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl m
Z
d dl m Z d dl
mZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lmZ dd� ZdS )� N)�config)�
FirewallError)�FirewallConfig)� zone_reader)�service_reader)� ipset_reader)�icmptype_reader)�
helper_reader)�
policy_reader)�Direct)�LockdownWhitelist)�firewalld_confc - C s| t | �}t|jtjtjgd�t|jtjtj gd�t
|j tj tj
gd�t|jtjtjgd�t|jtjtjgd�t|jtjtjgd�d�}�x
|j� D � ]�}x�|| d D ]�}tj j |�s�q�x�t tj |��D ]�}|j d�r�yD|| d ||�}|d
k� r�||_!|j"|j#� � || d |� W q� t$k
�rT } z t$|j%d ||j&f ��W Y d d }~X q� t'k
�r� } zt'd ||f ��W Y d d }~X q�X q�W q�W q�W tj j(tj)��r:y$t*tj)�}|j+� |j,|j-� � W np t$k
�r } z t$|j%d tj)|j&f ��W Y d d }~X n6 t'k
�r8 } zt'd tj)|f ��W Y d d }~X nX tj j(tj.��r�y$t/tj.�}|j+� |j,|j-� � W np t$k
�r� } z t$|j%d tj.|j&f ��W Y d d }~X n6 t'k
�r� } zt'd tj.|f ��W Y d d }~X nX tj j(tj0��rxyt1tj0�}|j+� W np t$k
�rB } z t$|j%d tj0|j&f ��W Y d d }~X n6 t'k
�rv } zt'd tj0|f ��W Y d d }~X nX d S ) N)�reader�add�dirs)Zipset�helperZicmptypeZservice�zone�policyr z.xmlr r r r z'%s': %s)r r )2r r Z add_ipsetr ZFIREWALLD_IPSETSZETC_FIREWALLD_IPSETSr Z
add_helperZFIREWALLD_HELPERSZETC_FIREWALLD_HELPERSr Z add_icmptypeZFIREWALLD_ICMPTYPESZETC_FIREWALLD_ICMPTYPESr Z add_serviceZFIREWALLD_SERVICESZETC_FIREWALLD_SERVICESr Zadd_zoneZFIREWALLD_ZONESZETC_FIREWALLD_ZONESr
Zadd_policy_objectZFIREWALLD_POLICIESZETC_FIREWALLD_POLICIES�keys�os�path�isdir�sorted�listdir�endswith� fw_configZcheck_config_dictZexport_config_dictr �code�msg� Exception�isfileZFIREWALLD_DIRECTr �read� check_configZ
export_configZLOCKDOWN_WHITELISTr ZFIREWALLD_CONFr
) �fwr Zreadersr Z_dir�file�obj�errorr � r& � /usr/lib/python3.6/functions.pyr! & sz
&.
($
($
(r! )r Zfirewallr Zfirewall.errorsr Zfirewall.core.fw_configr Zfirewall.core.io.zoner Zfirewall.core.io.servicer Zfirewall.core.io.ipsetr Zfirewall.core.io.icmptyper Zfirewall.core.io.helperr Zfirewall.core.io.policyr
Zfirewall.core.io.directr Z#firewall.core.io.lockdown_whitelistr Z firewall.core.io.firewalld_confr
r! r& r& r& r' �<module> s core/io/__pycache__/io_object.cpython-36.opt-1.pyc 0000644 00000027540 15035135172 0015647 0 ustar 00 3
��g5 � @ s d Z ddddddddgZd d
ljZd d
ljjZd d
lZd d
lZd d lm Z d d l
m Z d d
l m
Z
d dl
mZ d dlmZ ejdk ZG dd� de�ZG dd� de�ZG dd� de�ZG dd� de�ZG dd� dejj�ZG dd� dej �Z dd� Z dd� Z d d� Z d d� Z!d
S ) z5Generic io_object handler, io specific check methods.�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator�
check_port� check_tcpudp�check_protocol�
check_address� N)� OrderedDict)� functions)�b2u)�errors)�
FirewallError�3c @ s| e Zd ZdZf ZdZg Zi Zi Zdd� Z dd� Z
dd� Z d d
� Z d d � Z
d
d� Zdd� Zdd� Zdd� Zdd� Zdd� ZdS )r z; Abstract IO_Object as base for icmptype, service and zone z()c C s" d| _ d| _d| _d| _d| _d S )N� F)�filename�path�name�defaultZbuiltin)�self� r � /usr/lib/python3.6/io_object.py�__init__2 s
zIO_Object.__init__c C s6 g }x(| j D ] }|jtjt| |d ��� q W t|�S )Nr )�IMPORT_EXPORT_STRUCTURE�append�copy�deepcopy�getattr�tuple)r �ret�xr r r �
export_config9 s zIO_Object.export_configc C sX i }t dd� | jD ��}x:|D ]2}t| |�s<tt| |�t�r tjt| |��||< q W |S )Nc S s g | ]}|d |d f�qS )r � r )�.0r r r r �
<listcomp>A s z0IO_Object.export_config_dict.<locals>.<listcomp>)�dictr r �
isinstance�boolr r )r �conf� type_formats�keyr r r �export_config_dict? s
z IO_Object.export_config_dictc C s� | j |� x�t| j�D ]~\}\}}t|| t�r~g }t� }x,|| D ] }||krD|j|� |j|� qDW ~t| |t j
|�� qt| |t j
|| �� qW d S )N) � check_config� enumerater r& �list�setr �add�setattrr r )r r( �i�elementZdummyZ_confZ_setr r r r �
import_configG s
zIO_Object.import_configc C s~ | j |� xn|D ]f}t| |�s0ttjdj|���t|| t�r`t| |tt j
t j || ���� qt| |t j || �� qW d S )Nz-Internal error. '{}' is not a valid attribute)
�check_config_dict�hasattrr r
Z
UNKNOWN_ERROR�formatr& r. r1 r
�fromkeysr r )r r( r* r r r �import_config_dictW s
"z IO_Object.import_config_dictc C sz t |t�s(ttjd|td�t|�f ��t|�dk r@ttjd��x4|D ],}|j� rF|| j krFttjd||f ��qFW d S )Nz'%s' not of type %s, but %sr r" zname can't be emptyz'%s' is not allowed in '%s')
r& �strr r
� INVALID_TYPE�type�lenZ INVALID_NAME�isalnum�ADDITIONAL_ALNUM_CHARS)r r �charr r r �
check_namec s
zIO_Object.check_namec C sj t |�t | j�kr0ttjdt |�t | j�f ��i }x&t| j�D ]\}\}}|| ||< q@W | j|� d S )Nz structure size mismatch %d != %d)r= r r r
r; r- r5 )r r( Z conf_dictr2 r �yr r r r, p s zIO_Object.check_configc C sr t dd� | jD ��}xX|D ]P}|dd� | jD �krDttjdj|���| j|| || � | j|| ||� qW d S )Nc S s g | ]}|d |d f�qS )r r" r )r# r r r r r$ | s z/IO_Object.check_config_dict.<locals>.<listcomp>c S s g | ] \}}|�qS r r )r# r rB r r r r$ ~ s zoption '{}' is not valid)r% r r r
ZINVALID_OPTIONr7 �_check_config_structure�
_check_config)r r( r) r* r r r r5 { s
zIO_Object.check_config_dictc C s d S )Nr )r Zdummy1Zdummy2Zdummy3r r r rD � s zIO_Object._check_configc C s` t |t|��s,ttjd|t|�t|�f ��t |t�rrt|�dkrRttjd| ��x |D ]}| j||d � qXW n�t |t�r�t|�t|�kr�ttjd|t|�f ��x�t |�D ]\}}| j|| |� q�W n�t |t
��r\t|j � �d \}}xn|j � D ]b\}}t |t|���s,ttjd|t|�t|�f ��t |t|��s�ttjd|t|�t|�f ��q�W d S )Nz'%s' not of type %s, but %sr" zlen('%s') != 1r zlen('%s') != %d) r& r< r r
r; r. r= rC r r- r% �items) r r( Z structurer r2 �valueZskeyZsvaluer* r r r rC � s8
z!IO_Object._check_config_structurec C s� |j � }d}|| jkrdd}| j| d k rdx:| j| D ],}||krL|j|� q4ttjd||f ��q4W || jkr�d}x$| j| D ]}||kr~|j|� q~W |s�ttjd| ��x |D ]}ttjd||f ��q�W d S )NFTzMissing attribute %s for %szUnexpected element %sz%s: Unexpected attribute %s)ZgetNames� PARSER_REQUIRED_ELEMENT_ATTRS�remover r
Z PARSE_ERROR� PARSER_OPTIONAL_ELEMENT_ATTRS)r r �attrsZ_attrs�foundr r r r �parser_check_element_attrs� s,
z$IO_Object.parser_check_element_attrsN)�__name__�
__module__� __qualname__�__doc__r ZDBUS_SIGNATUREr? rG rI r r! r+ r4 r9 rA r, r5 rD rC rL r r r r r ) s"
!c s$ e Zd Z� fdd�Zdd� Z� ZS )�UnexpectedElementErrorc s t t| �j� || _d S )N)�superrQ r r )r r )� __class__r r r � s z UnexpectedElementError.__init__c C s
d| j S )NzUnexpected element '%s')r )r r r r �__str__� s z UnexpectedElementError.__str__)rM rN rO r rT �
__classcell__r r )rS r rQ � s rQ c s$ e Zd Z� fdd�Zdd� Z� ZS )�MissingAttributeErrorc s t t| �j� || _|| _d S )N)rR rV r r � attribute)r r rW )rS r r r � s z MissingAttributeError.__init__c C s d| j | jf S )Nz$Element '%s': missing '%s' attribute)r rW )r r r r rT � s z MissingAttributeError.__str__)rM rN rO r rT rU r r )rS r rV � s rV c s$ e Zd Z� fdd�Zdd� Z� ZS )�UnexpectedAttributeErrorc s t t| �j� || _|| _d S )N)rR rX r r rW )r r rW )rS r r r � s z!UnexpectedAttributeError.__init__c C s d| j | jf S )Nz'Element '%s': unexpected attribute '%s')r rW )r r r r rT � s z UnexpectedAttributeError.__str__)rM rN rO r rT rU r r )rS r rX � s rX c @ s4 e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd S ) r c C s || _ d| _d S )Nr )�item�_element)r rY r r r r � s z!IO_Object_ContentHandler.__init__c C s
d| _ d S )Nr )rZ )r r r r �
startDocument� s z&IO_Object_ContentHandler.startDocumentc C s
d| _ d S )Nr )rZ )r r rJ r r r � startElement� s z%IO_Object_ContentHandler.startElementc C s* |dkr| j | j_n|dkr&| j | j_d S )N�short� description)rZ rY r] r^ )r r r r r �
endElement� s z#IO_Object_ContentHandler.endElementc C s | j |jdd�7 _ d S )N�
� )rZ �replace)r �contentr r r �
characters� s z#IO_Object_ContentHandler.charactersN)rM rN rO r r[ r\ r_ rd r r r r r � s
c @ s< e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
S )r c C sN t jjj| � |j| _|j| _i g| _| jd | _ g | _
d| _ d| _ d| _
d S )Nr" zutf-8F���)�sax�handler�ContentHandlerr �write�_write�flushZ_flushZ _ns_contextsZ_current_contextZ_undeclared_ns_mapsZ _encodingZ_pending_start_elementZ_short_empty_elements)r �outr r r r � s z IO_Object_XMLGenerator.__init__c C s* t rdd� |j� D �}tjj| ||� dS )a saxutils.XMLGenerator.startElement() expects name and attrs to be
unicode and bad things happen if any of them is (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
c S s i | ]\}}t |�t |��qS r )r )r# r rF r r r �
<dictcomp> s z7IO_Object_XMLGenerator.startElement.<locals>.<dictcomp>N)r rE �saxutils� XMLGeneratorr\ )r r rJ r r r r\ s z#IO_Object_XMLGenerator.startElementc C s� t rX| jdt|� � x4|j� D ](\}}| jdt|�tjt|��f � q W | jd� nF| jd| � x,|j� D ] \}}| jd|tj|�f � qpW | jd� dS )z* slightly modified startElement()
�<z %s=%sz/>N)r rj r rE rn Z quoteattr)r r rJ rF r r r �
simpleElement s z$IO_Object_XMLGenerator.simpleElementc C s t jj| t|�� dS )z� saxutils.XMLGenerator.endElement() expects name to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro r_ r )r r r r r r_ s z!IO_Object_XMLGenerator.endElementc C s t jj| t|�� dS )z� saxutils.XMLGenerator.characters() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro rd r )r rc r r r rd % s z!IO_Object_XMLGenerator.charactersc C s t jj| t|�� dS )a saxutils.XMLGenerator.ignorableWhitespace() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro �ignorableWhitespacer )r rc r r r rr - s z*IO_Object_XMLGenerator.ignorableWhitespaceN) rM rN rO r r\ rq r_ rd rr r r r r r � s
c C s� t j| �}|dkr$ttjd| ��n`|dkr>ttjd| ��nF|d krXttjd| ��n,t|�dkr�|d |d kr�ttjd| ��d S ) N� z port number in '%s' is too bigr" z'%s' is invalid port rangez port range '%s' is ambiguousr ���re )r Z getPortRanger r
Z INVALID_PORTr= )ZportZ
port_ranger r r r 5 s
c C s | dkrt tjd| ��d S )N�tcp�udp�sctp�dccpz)'%s' not from {'tcp'|'udp'|'sctp'|'dccp'})ru rv rw rx )r r
�INVALID_PROTOCOL)�protocolr r r r D s c C s t j| �sttj| ��d S )N)r Z
checkProtocolr r
ry )rz r r r r J s
c C s$ t j| |�s ttjd|| f ��d S )Nz '%s' is not valid %s address)r r r r
Z INVALID_ADDR)ZipvZaddrr r r r N s )"rP �__all__Zxml.saxrf Zxml.sax.saxutilsrn r �sys� collectionsr
Zfirewallr Zfirewall.functionsr r
Zfirewall.errorsr �versionr �objectr � ExceptionrQ rV rX rg rh r ro r r r r r r r r r �<module> s0
C core/io/__pycache__/lockdown_whitelist.cpython-36.pyc 0000644 00000022550 15035135172 0016663 0 ustar 00 3
��g�1 � @ s� d dl jZd dlZd dlZd dlZd dlmZ d dlmZm Z m
Z
m Z d dl m
Z
d dlmZmZmZmZmZmZ d dlmZ d dlmZ G dd � d e
�ZG d
d � d e �ZdS ) � N)�config)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�uniqify� checkUser�checkUid� checkCommand� checkContext�
u2b_if_py2)�errors)�
FirewallErrorc @ s e Zd Zdd� Zdd� ZdS )�!lockdown_whitelist_ContentHandlerc C s t j| |� d| _d S )NF)r �__init__� whitelist)�self�item� r �(/usr/lib/python3.6/lockdown_whitelist.pyr % s z*lockdown_whitelist_ContentHandler.__init__c C sV t j| ||� | jj||� |dkr@| jr6ttjd��d| _�n|dkrr| js\tj d� d S |d }| jj
|� n�|dkr�| js�tj d� d S d |kr�yt |d �}W n& t k
r� tj d
|d � d S X | jj
|� nd|kr�| jj|d � n\|d k�r@| j�stj d � d S d
|k�r.tj d� d S | jj|d
� ntj d| � d S d S )Nr zMore than one whitelist.T�commandz)Parse Error: command outside of whitelist�name�userz&Parse Error: user outside of whitelist�idz"Parse Error: %s is not a valid uid�selinuxz)Parse Error: selinux outside of whitelist�contextzParse Error: no contextzUnknown XML element %s)r � startElementr Zparser_check_element_attrsr r r Z PARSE_ERRORr �error� add_command�int�
ValueError�add_uid�add_user� add_context)r r Zattrsr �uidr r r r ) sJ
z.lockdown_whitelist_ContentHandler.startElementN)�__name__�
__module__� __qualname__r r r r r r r $ s r c s4 e Zd ZdZddgfddgfddgfddgffZdZd gZd
d gd
d gd
�Zddd giZ� fdd�Z dd� Z
dd� Z dd� Z dd� Z
dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!dBdC� Z"� Z#S )D�LockdownWhitelistz LockdownWhitelist class �commands� �contexts�users�uidsr z
(asasasai)�_Nr r )r r r r r r c s6 t t| �j� || _d | _g | _g | _g | _g | _d S )N) �superr) r �filename�parserr* r, r- r. )r r1 )� __class__r r r n s zLockdownWhitelist.__init__c C s� |d
kr.x�|D ]}| j ||d d � |� qW nv|dkrLt|�s�ttj|��nX|dkrjt|�s�ttj|��n:|dkr�t|�s�ttj|��n |d kr�t |�s�ttj
|��d S ) Nr* r, r- r. � r r r r% )r* r, r- r. ���) �
_check_configr r r �INVALID_COMMANDr �INVALID_CONTEXTr � INVALID_USERr
� INVALID_UID)r r r Z
all_config�xr r r r6 y s
z LockdownWhitelist._check_configc C s4 | j d d �= | jd d �= | jd d �= | jd d �= d S )N)r* r, r- r. )r r r r �cleanup� s zLockdownWhitelist.cleanupc C s: dd� | j D �| _ dd� | jD �| _dd� | jD �| _dS )z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |��qS r )r
)�.0r; r r r �
<listcomp>� s z4LockdownWhitelist.encode_strings.<locals>.<listcomp>c S s g | ] }t |��qS r )r
)r= r; r r r r> � s c S s g | ] }t |��qS r )r
)r= r; r r r r> � s N)r* r, r- )r r r r �encode_strings� s z LockdownWhitelist.encode_stringsc C s@ t |�sttj|��|| jkr,| jj|� nttjd| ��d S )Nz!Command "%s" already in whitelist)r r r r7 r* �append�ALREADY_ENABLED)r r r r r r � s
z LockdownWhitelist.add_commandc C s, || j kr| j j|� nttjd| ��d S )Nz Command "%s" not in whitelist.)r* �remover r � NOT_ENABLED)r r r r r �remove_command� s
z LockdownWhitelist.remove_commandc C s
|| j kS )N)r* )r r r r r � has_command� s z LockdownWhitelist.has_commandc C sB x<| j D ]2}|jd�r.|j|d d� �r:dS q||krdS qW dS )N�*r4 TFr5 )r* �endswith�
startswith)r r Z_commandr r r �
match_command� s
z LockdownWhitelist.match_commandc C s | j S )N)r* )r r r r � get_commands� s z LockdownWhitelist.get_commandsc C sD t |�sttjt|���|| jkr0| jj|� nttjd| ��d S )Nz Uid "%s" already in whitelist)r
r r r: �strr. r@ rA )r r% r r r r" � s
zLockdownWhitelist.add_uidc C s, || j kr| j j|� nttjd| ��d S )NzUid "%s" not in whitelist.)r. rB r r rC )r r% r r r �
remove_uid� s
z LockdownWhitelist.remove_uidc C s
|| j kS )N)r. )r r% r r r �has_uid� s zLockdownWhitelist.has_uidc C s
|| j kS )N)r. )r r% r r r � match_uid� s zLockdownWhitelist.match_uidc C s | j S )N)r. )r r r r �get_uids� s zLockdownWhitelist.get_uidsc C s@ t |�sttj|��|| jkr,| jj|� nttjd| ��d S )Nz User "%s" already in whitelist)r r r r9 r- r@ rA )r r r r r r# � s
zLockdownWhitelist.add_userc C s, || j kr| j j|� nttjd| ��d S )NzUser "%s" not in whitelist.)r- rB r r rC )r r r r r � remove_user� s
z LockdownWhitelist.remove_userc C s
|| j kS )N)r- )r r r r r �has_user� s zLockdownWhitelist.has_userc C s
|| j kS )N)r- )r r r r r �
match_user� s z LockdownWhitelist.match_userc C s | j S )N)r- )r r r r � get_users� s zLockdownWhitelist.get_usersc C s@ t |�sttj|��|| jkr,| jj|� nttjd| ��d S )Nz!Context "%s" already in whitelist)r r r r8 r, r@ rA )r r r r r r$ " s
z LockdownWhitelist.add_contextc C s, || j kr| j j|� nttjd| ��d S )Nz Context "%s" not in whitelist.)r, rB r r rC )r r r r r �remove_context, s
z LockdownWhitelist.remove_contextc C s
|| j kS )N)r, )r r r r r � has_context3 s z LockdownWhitelist.has_contextc C s
|| j kS )N)r, )r r r r r �
match_context6 s z LockdownWhitelist.match_contextc C s | j S )N)r, )r r r r � get_contexts9 s z LockdownWhitelist.get_contextsc C s� | j � | jjd�s&ttjd| j ��t| �}tj� }|j |� y|j
| j� W n8 tj k
r� } zttj d|j
� ��W Y d d }~X nX ~~tr�| j� d S )Nz.xmlz'%s' is missing .xml suffixzNot a valid file: %s)r< r1 rG r r Z INVALID_NAMEr �saxZ make_parserZsetContentHandler�parseZSAXParseExceptionZ INVALID_TYPEZ getExceptionr r? )r �handlerr2 �msgr r r �read> s"
zLockdownWhitelist.readc C s� t jj| j�r\ytj| jd| j � W n4 tk
rZ } ztd| j|f ��W Y d d }~X nX t jjtj �sxt j
tj d� t j | jddd�}t
|�}|j� |jdi � |jd� x6t| j�D ](}|jd � |jd
d |i� |jd� q�W x:t| j�D ],}|jd � |jd d
t|�i� |jd� q�W x8t| j�D ]*}|jd � |jd d |i� |jd� �q0W x8t| j�D ]*}|jd � |jdd|i� |jd� �qjW |jd� |jd� |j� |j� ~d S )Nz%s.oldzBackup of '%s' failed: %si� ZwtzUTF-8)�mode�encodingr �
z r r r r r r )�os�path�existsr1 �shutilZcopy2� Exception�IOErrorr Z
ETC_FIREWALLD�mkdir�io�openr Z
startDocumentr ZignorableWhitespacer r* Z
simpleElementr. rK r- r, Z
endElementZ endDocument�close)r r[ �frZ r r% r r r r r �writeQ sB $
zLockdownWhitelist.write)$r& r' r( �__doc__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r6 r< r? r rD rE rI rJ r" rL rM rN rO r# rP rQ rR rS r$ rT rU rV rW r\ rk �
__classcell__r r )r3 r r) W sL
1
r) )Zxml.saxrX r` rg rc Zfirewallr Zfirewall.core.io.io_objectr r r r Zfirewall.core.loggerr Zfirewall.functionsr r r
r r r
r Zfirewall.errorsr r r) r r r r �<module> s
3 core/io/__pycache__/service.cpython-36.pyc 0000644 00000020377 15035135172 0014414 0 ustar 00 3
��g�2 � @ s� d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZmZmZ ddlmZ dd lmZ dd
lmZ G d d � d e �ZG d d
� d
e
�Zdd� Zddd�ZdS )�Service�service_reader�service_writer� N)�config)�
u2b_if_py2)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator�
check_port� check_tcpudp�check_protocol�
check_address)�log)�errors)�
FirewallErrorc s� e Zd Zd d!d"dd#gfddgfdddifddgfd d$gfd
dgfd dgff
Zd d
gZdddd�Zddgddgdgdgddgddgdgdgd�Z� fdd�Zdd� Zd d � Z d d � Z
� Z S )%r �version� �short� description�ports�modules� destination� protocols� source_ports�includes�helpers�_�-N)r r �service�name�port�protocol�value�ipv4�ipv6r )r r! r" �moduler z source-port�include�helperc sN t t| �j� d| _d| _d| _g | _g | _g | _i | _ g | _
g | _ g | _ d S )Nr )
�superr �__init__r r r r r r r r r r )�self)� __class__� � /usr/lib/python3.6/service.pyr* D s zService.__init__c C sh d| _ d| _d| _| jd d �= | jd d �= | jd d �= | jj� | jd d �= | j d d �= | j
d d �= d S )Nr ) r r r r r r r �clearr r r )r+ r- r- r. �cleanupQ s
zService.cleanupc C s� t | j�| _t | j�| _t | j�| _dd� | jD �| _dd� | jD �| _dd� | jj� D �| _dd� | jD �| _dd� | j D �| _ dd� | j
D �| _
d d� | j D �| _ d
S ) z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ]\}}t |�t |�f�qS r- )r )�.0�po�prr- r- r. �
<listcomp>d s z*Service.encode_strings.<locals>.<listcomp>c S s g | ] }t |��qS r- )r )r1 �mr- r- r. r4 e s c S s i | ]\}}t |�t |��qS r- )r )r1 �k�vr- r- r. �
<dictcomp>f s z*Service.encode_strings.<locals>.<dictcomp>c S s g | ] }t |��qS r- )r )r1 r3 r- r- r. r4 g s c S s g | ]\}}t |�t |�f�qS r- )r )r1 r2 r3 r- r- r. r4 h s c S s g | ] }t |��qS r- )r )r1 �sr- r- r. r4 j s c S s g | ] }t |��qS r- )r )r1 r9 r- r- r. r4 k s N) r r r r r r r �itemsr r r r )r+ r- r- r. �encode_strings] s zService.encode_stringsc C s: |dkrJx>|D ]6}|d dkr8t |d � t|d � qt|d � qW n�|dkrjx�|D ] }t|� qXW n�|dkr�x�|D ] }t |d � t|d � qxW n�|dkr�x�|D ]*}|dkr�ttjd
| ��t||| � q�W n^|d k�r6xR|D ]J}|jd ��r|jd d�}d
|k�r|jd
d�}t |�dk r�ttj
|��q�W d S )Nr r r � r r r r$ r% z'%s' not in {'ipv4'|'ipv6'}r �
nf_conntrack_r r � )r$ r% ) r r r
r r ZINVALID_DESTINATIONr �
startswith�replace�lenZINVALID_MODULE)r+ r �itemZ
all_configr! �protor r& r- r- r. �
_check_configm s8
zService._check_config)r r )r r )r r )r r )r r ) �__name__�
__module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr* r0 r; rD �
__classcell__r- r- )r, r. r & s4
c @ s e Zd Zdd� ZdS )�service_ContentHandlerc C s0 t j| ||� | jj||� |dkrTd|kr<tjd|d � d|krP|d | j_�n�|dkr`�n�|dkrl�n�|dk�r$|d dkr�t|d � t|d � |d |d f}|| jj kr�| jj j
|� ntjd
|d |d � nBt |d � |d | jj k�r| jj j
|d � ntjd |d � �n|d k�rtt |d � |d | jj k�r`| jj j
|d � ntjd |d � �n�|d
k�r�t|d � t|d � |d |d f}|| jj
k�r�| jj
j
|� ntjd|d |d � �nN|dk�r>xRd D ]J}||k�r�t||| � || jjk�r&tjd|� n|| | jj|< �q�W n�|dk�r�|d }|jd��r~|jdd�}d|k�r~|jdd�}|| jjk�r�| jjj
|� n tjd|� n�|dk�r�|d | jjk�r�| jjj
|d � ntjd|d � n@|dk�r,|d | jjk�r | jjj
|d � ntjd|d � d S ) Nr r z'Ignoring deprecated attribute name='%s'r r r r! r r" z#Port '%s/%s' already set, ignoring.z$Protocol '%s' already set, ignoring.r# z source-portz)SourcePort '%s/%s' already set, ignoring.r r$ r% z2Destination address for '%s' already set, ignoringr& r= r r z"Module '%s' already set, ignoring.r' z#Include '%s' already set, ignoring.r( z"Helper '%s' already set, ignoring.)r$ r% )r � startElementrB Zparser_check_element_attrsr Zwarningr r r r �appendr
r r r r r? r@ r r r )r+ r �attrs�entry�xr& r- r- r. rJ � s�
z#service_ContentHandler.startElementN)rE rF rG rJ r- r- r- r. rI � s rI c C s t � }| jd�s ttjd| ��| d d � |_|j|j� | |_||_|j t
j �rVdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd|j� ��W Y d d }~X nX W d Q R X ~~t�r|j� |S )
Nz.xmlz'%s' is missing .xml suffix� FTz%s/%s�rbz not a valid service file: %s���)r �endswithr r Z INVALID_NAMEr Z
check_name�filename�pathr? r �
ETC_FIREWALLDZbuiltin�defaultrI �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZINVALID_SERVICEZ getExceptionr r; ) rS rT r �handler�parserr �f�source�msgr- r- r. r � s8
(c C sr |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� i }| j�r| jd k�r| j|d
< |jd |� |jd � | j�rt| jd k�rt|jd
� |jdi � |j| j� |jd� |jd � | j�r�| jd k�r�|jd
� |jdi � |j| j� |jd� |jd � x>| jD ]4} |jd
� |jd| d | d d�� |jd � �q�W x4| j D ]*}
|jd
� |jdd|
i� |jd � �qW x>| j D ]4} |jd
� |jd| d | d d�� |jd � �q<W x4| j D ]*} |jd
� |jdd| i� |jd � �q|W t | j �dk�r�|jd
� |jd| j � |jd � x4| j!D ]*} |jd
� |jdd | i� |jd � �q�W x4| j"D ]*}
|jd
� |jdd|
i� |jd � �qW |jd � |jd � |j#� |j$� ~d S ) Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r �
z r r r! r r< )r! r" r" r# z source-portr& r r r' r( )%rT rS r �os�exists�shutilZcopy2� Exceptionr �error�dirnamer? r rU �mkdir�iorX r
Z
startDocumentr rJ ZignorableWhitespacer Z
charactersZ
endElementr r Z
simpleElementr r r rA r r r Z endDocument�close)r rT �_pathr r^ �dirpathr\ rZ rL r! r" r& r' r( r- r- r. r s�
)N) �__all__Zxml.saxrW rb ri rd Zfirewallr Zfirewall.functionsr Zfirewall.core.io.io_objectr r r r
r r r
r Zfirewall.core.loggerr r Zfirewall.errorsr r rI r r r- r- r- r. �<module> s
( mQ core/io/__pycache__/zone.cpython-36.pyc 0000644 00000031307 15035135172 0013722 0 ustar 00 3
��g�M � @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z m
Z
m Z m Z m
Z
mZmZ ddlmZmZ ddlmZmZmZmZ dd lmZmZmZm Z dd
l m Z dd l m Z dd lm!Z! dd
l"m#Z# G dd � d e�Z$G dd� de�Z%ddd�Z&ddd�Z'dS )�Zone� zone_reader� zone_writer� N)�config)� checkIPnMask�
checkIP6nMask�checkInterface�uniqify�max_zone_name_len�
u2b_if_py2� check_mac)�DEFAULT_ZONE_TARGET� ZONE_TARGETS)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�common_startElement�common_endElement�common_check_config�
common_writer)�rich)�log)�errors)�
FirewallErrorc sf e Zd ZdZd@dAdBdCdDd dgfd
dEgfd dgfdFd
dGgfddgfddgfddgfddgfddHgfdIdJfZdddgZddddgddgdgdgdddgdgdddd gddgdddddd gd gdd �Zdd ddgd gd!d"gd#d$gd%d&d'd#d(gd%d'd(gd)d*gd+gd,gd-� Zed.d/� �Z � fd0d1�Z
d2d3� Z d4d5� Z � fd6d7�Z
� fd8d9�Zd:d;� Z� fd<d=�Zd>d?� Z� ZS )Kr z Zone class �version� �short� description�UNUSEDF�target�services�ports� icmp_blocks�
masquerade�
forward_ports�
interfaces�sources� rules_str� protocols� source_ports�icmp_block_inversion�forward�_�-�/N�name�port�protocol�value�set)r r �zone�servicer1 z
icmp-blockz icmp-typer, z forward-port� interface�rule�source� destinationr2 z source-portr ZauditZaccept�rejectZdropZmark�limitzicmp-block-inversion� immutableZenabledzto-portzto-addr�familyZpriority�address�mac�invert�ipset�prefix�level�typeZburst) r5 r$ z forward-portr8 r9 r: r r; r< c C s8 x&t tj�D ]\}\}}|| kr |S q W ttjd��d S )Nz
index_of())� enumerater �IMPORT_EXPORT_STRUCTUREr r Z
UNKNOWN_ERROR)�element�iZelZdummy� rJ �/usr/lib/python3.6/zone.py�index_ofd s z
Zone.index_ofc s� t t| �j� d| _d| _d| _d| _t| _g | _ g | _
g | _ g | _ d| _
d| _g | _g | _g | _g | _d | _g | _g | _d| _d| _d| _d S )Nr F)�superr �__init__r r r r r
r r! r" r) r# r, r$ r% r* r& r' � fw_config�rulesr( r+ �combined�applied)�self)� __class__rJ rK rN k s, z
Zone.__init__c C s� d| _ d| _d| _d| _t| _| jd d �= | jd d �= | jd d �= | j d d �= d| _
d| _ | j d d �= | j
d d �= | jd d �= | jd d �= d | _| jd d �= | jd d �= d| _d| _d| _d S )Nr F)r r r r r
r r! r" r) r# r, r$ r% r* r& r' rO rP r( r+ rQ rR )rS rJ rJ rK �cleanup� s* z Zone.cleanupc C s� t | j�| _t | j�| _t | j�| _t | j�| _dd� | jD �| _dd� | jD �| _dd� | jD �| _dd� | jD �| _dd� | j D �| _ dd� | j
D �| _
dd� | j D �| _ d d� | j D �| _ d
d� | j
D �| _
d d� | jD �| _d S )
z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |��qS rJ )r )�.0�srJ rJ rK �
<listcomp>� s z'Zone.encode_strings.<locals>.<listcomp>c S s g | ]\}}t |�t |�f�qS rJ )r )rV �po�prrJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rZ rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rI rJ rJ rK rX � s c S s0 g | ](\}}}}t |�t |�t |�t |�f�qS rJ )r )rV Zp1Zp2Zp3Zp4rJ rJ rK rX � s c S s g | ]\}}t |�t |�f�qS rJ )r )rV rY rZ rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rI rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rW rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rW rJ rJ rK rX � s c S s g | ] }t |��qS rJ )r )rV rW rJ rJ rK rX � s N)r r r r r r! r" r) r# r% r* r& r' rP r( )rS rJ rJ rK �encode_strings� s zZone.encode_stringsc sN |dkr8dd� |D �| _ tt| �j|dd� | j D �� ntt| �j||� d S )Nr( c S s g | ]}t j|d ��qS ))Zrule_str)r Z Rich_Rule)rV rW rJ rJ rK rX � s z$Zone.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS rJ )�str)rV rW rJ rJ rK rX � s )rP rM r � __setattr__)rS r0 r3 )rT rJ rK r] � s zZone.__setattr__c s t t| �j� }|d= |S )Nr )rM r �export_config_dict)rS Zconf)rT rJ rK r^ � s zZone.export_config_dictc C sL t | |||� |dkr.|tkr*ttj|���n|dkr�xl|D ]d}t|�sTttj|��| jr<xD| jj� D ]6}|| j krvqf|| jj
|�j krfttjdj ||���qfW q<W n�|dk�rHx�|D ]�}t
|� r�t|� r�t|� r�|jd� r�ttj|��| jr�xL| jj� D ]>}|| j k�r�q|| jj
|�jk�rttjdj ||����qW q�W d S )Nr r& z)interface '{}' already bound to zone '{}'r' zipset:z&source '{}' already bound to zone '{}')r r r r �INVALID_TARGETr ZINVALID_INTERFACErO Z get_zonesr0 Zget_zoner& �formatr r r �
startswith� INVALID_ADDRr' )rS r �itemZ
all_configr7 r5 r9 rJ rJ rK �
_check_config� s6
zZone._check_configc s� t t| �j|� |jd�r,ttjd| ��n�|jd�rHttjd| ��n�|jd�dkrhttjd| ��nnd|kr�|d |j d�� }n|}t
|�t � kr�ttjd|t
|�t � | j f ��| j
r�|| j
j� kr�ttjd��d S )Nr/ z'%s' can't start with '/'z'%s' can't end with '/'� zmore than one '/' in '%s'z'Zone of '%s' has %d chars, max is %d %sz+Zones can't have the same name as a policy.)rM r �
check_namera r r � INVALID_NAME�endswith�count�find�lenr
rQ rO Zget_policy_objectsZ
NAME_CONFLICT)rS r0 Z checked_name)rT rJ rK rf � s,
zZone.check_namec
C s� d| _ d | _d| _d| _d| _x$|jD ]}|| jkr&| jj|� q&W x$|jD ]}|| jkrL| jj|� qLW x$|jD ]}|| jkrr| jj|� qrW x$|j D ]}|| j kr�| j j|� q�W x$|j
D ]}|| j
kr�| j
j|� q�W x$|j D ]}|| j kr�| j j|� q�W |j �rd| _ |j
�r d| _
x(|jD ] }|| jk�r&| jj|� �q&W x(|jD ] }|| jk�rP| jj|� �qPW x,|jD ]"} | jj| � | jjt| �� �qzW |j�r�d| _d S )NTr )rQ �filenamer r r r& �appendr' r! r" r) r# r, r$ r% r* rP r( r\ r+ )
rS r5 r7 r9 r6 r1 �protoZicmpr, r8 rJ rJ rK �combine� sL
z Zone.combine)r r )r r )r r )r F)r r )r r )r$ F)r r r r )r r )r+ F)r, F)�__name__�
__module__� __qualname__�__doc__rG ZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRS� staticmethodrL rN rU r[ r] r^ rd rf ro �
__classcell__rJ rJ )rT rK r ( sx
c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�zone_ContentHandlerc C s" t j| |� d | _d| _d | _d S )NF)r rN �_rule� _rule_errorZ _limit_ok)rS rc rJ rJ rK rN s z zone_ContentHandler.__init__c C s� t j| ||� | jrd S | jj||� t| ||�r6d S |dkr�d|krVtjd|d � d|krj|d | j_d|kr�tjd|d � d|kr�|d }|t kr�t
t j |��|dkr�|t
kr�|| j_�n�|d kr�| jjr�tjd
� nd | j_�n�|d k�rh| j�rtjd
� d | _d S d|k�r.tjd� d | _d S |d | jjk�rT| jjj|d � ntjd|d � �n8|dk�rf| j�r | jj�r�tjdt| j�� d | _d S d}d|k�r�|d j� d$k�r�d }d } }}d|k�r�|d }d|k�r�|d }d|k�r|d }tj||||d�| j_d S d|k�rBd|k�rBtjd� d S d|k�rdd|k�rdtjd� d S d |k�r~tjd |d � d|k�r�tjd � d S d|k�r�t|d � �r�t|d � �r�t|d � �r�t
t j|d ��d|k�r$d |d }|| jj k�r| jj j|� ntjd |d � d|k�r�|d }|| jj k�rT| jj j|� ntjd |d � n:|d!k�r�| jj �r�tjd"� nd | j_ ntjd#|� d S d S )%Nr5 r0 z'Ignoring deprecated attribute name='%s'r r= z,Ignoring deprecated attribute immutable='%s'r r r, z Forward already set, ignoring.Tr7 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r9 z:Invalid rule: More than one source in rule '%s', ignoring.FrA �yes�truer? r@ rB )rA z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.r> z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.zicmp-block-inversionz+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s')ry rz ) r � startElementrx rc Zparser_check_element_attrsr r Zwarningr r r r r_ r
r r, rw r& rm r9 r\ �lowerr Z Rich_Sourcer r r rb r' r+ ) rS r0 �attrsr rA Zaddrr@ rB �entryrJ rJ rK r{ & s�
z zone_ContentHandler.startElementc C s t j| |� t| |� d S )N)r �
endElementr )rS r0 rJ rJ rK r � s z zone_ContentHandler.endElementN)rp rq rr rN r{ r rJ rJ rJ rK rv s prv Fc
C s t � }| jd�s ttjd| ��| d d � |_|s>|j|j� | |_||_|j t
j �rZdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd| j� ��W Y d d } ~ X nX W d Q R X ~~t�r|j� |S )
Nz.xmlz'%s' is missing .xml suffix� FTz%s/%s�rbznot a valid zone file: %s���)r rh r r rg r0 rf rl �pathra r �
ETC_FIREWALLDZbuiltin�defaultrv �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZ INVALID_ZONEZ getExceptionr r[ )
rl r� Z
no_check_namer5 �handler�parserr0 �fr9 �msgrJ rJ rK r � s:
(c C s\ |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� i }| j�r| jd k�r| j|d
< | jtk�r*| j|d < |jd |� |jd
� t| |� x8t| j�D ]*} |jd� |jdd| i� |jd
� �qVW x\t| j �D ]N}
|jd� d|
k�r�|jdd|
dd � i� n|jdd|
i� |jd
� �q�W | j �r
|jd� |jdi � |jd
� | j �r2|jd� |jdi � |jd
� |j d � |jd
� |j � |j!� ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r5 �
z r7 r0 zipset:r9 rB � r? zicmp-block-inversionr, )"r� rl r0 �os�exists�shutilZcopy2� Exceptionr �error�dirnamera r r� �mkdir�ior� r Z
startDocumentr r r
r{ ZignorableWhitespacer r r& Z
simpleElementr' r+ r, r Z endDocument�close) r5 r� �_pathr0 r� �dirpathr� r� r} r7 r9 rJ rJ rK r � s`
)F)N)(�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r
r r Zfirewall.core.baser
r Zfirewall.core.io.io_objectr r r r Zfirewall.core.io.policyr r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r rv r r rJ rJ rJ rK �<module> s$
$ x|
core/io/__pycache__/ifcfg.cpython-36.pyc 0000644 00000007721 15035135172 0014030 0 ustar 00 3
��g� � @ s^ d Z dgZddlZddlZddlZddlZddlmZ ddl m
Z
m Z m Z G dd� de
�ZdS )zifcfg file parser�ifcfg� N)�log)�b2u�u2b�PY2c @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dS )r c C s i | _ g | _|| _| j� d S )N)�_config�_deleted�filename�clear)�selfr � r �/usr/lib/python3.6/ifcfg.py�__init__# s zifcfg.__init__c C s i | _ g | _d S )N)r r )r r r r
r
) s z ifcfg.clearc C s | j j� d S )N)r r
)r r r r
�cleanup- s z
ifcfg.cleanupc C s | j j|j� �S )N)r �get�strip)r �keyr r r
r 0 s z ifcfg.getc C s8 t |j� �}t |j� �| j|< || jkr4| jj|� d S )N)r r r r �remove)r r �valueZ_keyr r r
�set3 s
z ifcfg.setc C sH d}x2| j j� D ]$\}}|r$|d7 }|d||f 7 }qW trDt|�S |S )N� �
z%s=%s)r �itemsr r )r �sr r r r r
�__str__9 s z
ifcfg.__str__c C sB | j � yt| jd�}W n4 tk
rL } ztjd| j|� � W Y d d }~X nX x�|D ]�}|s^P |j� }t|�dk sT|d dkr�qTdd� |jd d�D �}t|�d
kr�qTt|d �d
kr�|d j d �r�|d j
d �r�|d dd� |d< |d d kr�qTn,| j j |d �d k �r tj
d
| j|j� � qT|d | j |d < qTW |j� d S )N�rzFailed to load '%s': %s� r �#�;c S s g | ] }|j � �qS r )r )�.0�xr r r
�
<listcomp>Q s z ifcfg.read.<locals>.<listcomp>�=� �"r z%%s: Duplicate option definition: '%s')r r ���)r
�openr � Exceptionr �errorr �len�split�
startswith�endswithr r Zwarning�close)r �f�msg�lineZpairr r r
�readB s2
z
ifcfg.readc : C s� t | j�dk rd S g }y.tjddtjj| j� tjj| j�dd�}W n2 t k
rv } zt
j d| � � W Y d d }~X nX d}d}yt j
| jddd �}W nN t k
r� } z0tjj| j�r�t
j d
| j|f � � nd }W Y d d }~X �ndX �x^|D �]T}|s�P |jd �}t |�dk �r(|�sD|jd � d }q�|d
dk�rPd}|j|� |jd � q�|jdd�}t |�dk�r~d}|j|d � q�|d
j� } |d j� }
t |
�dk�r�|
jd��r�|
jd��r�|
dd� }
| |k�r@| | jk�r| j| |
k�rd}|jd| | j| f � d }n$| | jk�r"d }nd}|j|d � |j| � q�d }q�W t | j�d
k�r�xF| jj� D ]8\} }
| |k�rz�qd|�s�d }|jd| |
f � d }�qdW |�r�|j� |j� |�s�tj|j� d S tjj| j��r8ytj| jd| j � W nB t k
�r6 } z$tj|j� t d| j|f ��W Y d d }~X nX ytj |j| j� W nB t k
�r� } z$tj|j� t d| j|f ��W Y d d }~X nX tj | jd� d S )Nr Zwtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %sZrtzUTF-8)r2 �encodingzFailed to open '%s': %sr Tr r r" r# r$ z%s=%s
z%s.bakzBackup of '%s' failed: %szFailed to create '%s': %si� r% ) r) r �tempfileZNamedTemporaryFile�os�path�basenamer �dirnamer' r r( �ior& �existsr �writer* r+ r, r �appendr r- r �name�shutilZcopy2�IOErrorZmove�chmod) r �doneZ temp_filer/ Zmodified�emptyr. r0 �pr r r r r
r> _ s�
$ $z ifcfg.writeN) �__name__�
__module__� __qualname__r r
r r r r r1 r> r r r r
r " s )�__doc__�__all__Zos.pathr8 r< r7 rA Zfirewall.core.loggerr Zfirewall.functionsr r r �objectr r r r r
�<module> s core/io/__pycache__/direct.cpython-36.opt-1.pyc 0000644 00000027263 15035135172 0015166 0 ustar 00 3
��g�= � @ s� d dl jZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z d dl
mZmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZ G d d � d e�ZG d
d� de�ZdS )� N)�config)�LastUpdatedOrderedDict)� splitArgs�joinArgs�
u2b_if_py2)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)� ipXtables)�ebtables)�errors)�
FirewallErrorc @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�direct_ContentHandlerc C s t j| |� d| _d S )NF)r �__init__�direct)�self�item� r � /usr/lib/python3.6/direct.pyr ( s z direct_ContentHandler.__init__c C s� t j| ||� | jj||� |dkr@| jr6ttjd��d| _�n>|dkr�| js\tj d� d S |d }|d }|d }| jj
t |�t |�t |�� n�|dk�r6| js�tj d � d S |d }|dkr�ttj d
| ��|d }|d }yt
|d �}W n( tk
�r tj d|d � d S X t |�t |�t |�|g| _nH|dk�rl| j�sVtj d� d S |d }t |�g| _ntj d| � d S d S )Nr zMore than one direct tag.T�chainz$Parse Error: chain outside of direct�ipv�table�rulez#Parse Error: rule outside of direct�ipv4�ipv6�ebz"'%s' not from {'ipv4'|'ipv6'|'eb'}�priorityz'Parse Error: %s is not a valid priority� passthroughz&Parse Error: command outside of directzUnknown XML element %s)r r r )r � startElementr Zparser_check_element_attrsr r r
Z PARSE_ERRORr
�error� add_chainr � INVALID_IPV�int�
ValueError�_rule� _passthrough)r �nameZattrsr r r r r r r r , sT
z"direct_ContentHandler.startElementc C s� t j| |� |dkrX| jrF| jjdd� t| j�D �� | jj| j� n
tj d� d | _nJ|dkr�| jr�| j
jdd� t| j�D �� | jj | j
� n
tj d � d | _
d S )
Nr c S s g | ] }t |��qS r )r )�.0�xr r r �
<listcomp>d s z4direct_ContentHandler.endElement.<locals>.<listcomp>z2Error: rule does not have any arguments, ignoring.r c S s g | ] }t |��qS r )r )r( r) r r r r* m s z0Error: passthrough does not have any arguments, z ignoring.z9Error: passthrough does not have any arguments, ignoring.) r �
endElementZ_elementr% �appendr r �add_ruler
r r& �add_passthrough)r r' r r r r+ ^ s
z direct_ContentHandler.endElementN)�__name__�
__module__� __qualname__r r r+ r r r r r ' s 2r c s< e Zd ZdZddBgfddddddgfgfdddgfgffZdZdd d
d gd d
d d gd gd
�Zi Z� fdd�Zdd� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!� Z"S )C�Directz Direct class �chains� �rulesr � passthroughsz(a(sss)a(sssias)a(sas))Nr r r r )r r r r c s0 t t| �j� || _t� | _t� | _t� | _d S )N)�superr2 r �filenamer r3 r5 r6 )r r8 )� __class__r r r � s
zDirect.__init__c C s d S )Nr )r �confr Zall_confr r r �
_check_config� s zDirect._check_configc C s g }g }x>| j D ]4}x.| j | D ] }|jtt|�t|g� �� q W qW |j|� g }xR| jD ]H}xB| j| D ]4}|jt|d |d |d |d t|d �f�� qnW q^W |j|� g }x8| jD ].}x(| j| D ]}|jt|t|�f�� q�W q�W |j|� t|�S )Nr � � )r3 r, �tuple�listr5 r6 )r �retr) �keyr r r r r �
export_config� s$ $
zDirect.export_configc C s� | j � | j|� x�t| j�D ]x\}\}}|dkrNx|| D ]}| j|� q<W |dkrrx|| D ]}| j|� q`W |dkr x|| D ]}| j|� q�W q W d S )Nr3 r5 r6 )�cleanupZ check_config� enumerate�IMPORT_EXPORT_STRUCTUREr! r- r. )r r: �i�elementZdummyr) r r r �
import_config� s
zDirect.import_configc C s" | j j� | jj� | jj� d S )N)r3 �clearr5 r6 )r r r r rC � s
zDirect.cleanupc C s� t d� x4| jD ]*}t d|d |d dj| j| �f � qW t d� xZ| jD ]P}t d|d |d |d f � x,| j| D ] \}}t d |d
j|�f � q|W qNW t d � x@| jD ]6}t d | � x$| j| D ]}t d
d
j|� � q�W q�W d S )Nr3 z (%s, %s): %sr r< �,r5 z (%s, %s, %s):r= z (%d, ('%s'))z','r6 z %s:z
('%s'))�printr3 �joinr5 r6 )r rA r �argsr r r �output� s z
Direct.outputc C s* dddg}||kr&t tjd||f ��d S )Nr r r z'%s' not in '%s')r r
r" )r r Zipvsr r r �
_check_ipv� s
zDirect._check_ipvc C sF | j |� |dkr tjj� ntjj� }||krBttjd||f ��d S )Nr r z'%s' not in '%s')r r )rO r ZBUILT_IN_CHAINS�keysr r r
Z
INVALID_TABLE)r r r Ztablesr r r �_check_ipv_table� s
zDirect._check_ipv_tablec C sd | j ||� ||f}|| jkr(g | j|< || j| krH| j| j|� ntjd|||f d � d S )Nz(Chain '%s' for table '%s' with ipv '%s' zalready in list, ignoring)rQ r3 r, r
�warning)r r r r rA r r r r! � s
zDirect.add_chainc C sn | j ||� ||f}|| jkrX|| j| krX| j| j|� t| j| �dkrj| j|= ntd|||f ��d S )Nr z4Chain '%s' with table '%s' with ipv '%s' not in list)rQ r3 �remove�lenr$ )r r r r rA r r r � remove_chain� s
zDirect.remove_chainc C s, | j ||� ||f}|| jko*|| j| kS )N)rQ r3 )r r r r rA r r r � query_chain� s zDirect.query_chainc C s< | j ||� ||f}|| jkr(| j| S td||f ��d S )Nz&No chains for table '%s' with ipv '%s')rQ r3 r$ )r r r rA r r r �
get_chains� s
zDirect.get_chainsc C s | j S )N)r3 )r r r r �get_all_chains s zDirect.get_all_chainsc C s� | j ||� |||f}|| jkr,t� | j|< |t|�f}|| j| krV|| j| |< n*tjddj|�||f d||f d � d S )Nz(Rule '%s' for table '%s' and chain '%s' z',z with ipv '%s' and priority %d zalready in list, ignoring)rQ r5 r r> r
rR rL )r r r r r rM rA �valuer r r r- s
zDirect.add_rulec C s� | j ||� |||f}|t|�f}|| jkrb|| j| krb| j| |= t| j| �dkr�| j|= n$tddj|�||f d||f ��d S )Nr z(Rule '%s' for table '%s' and chain '%s' z',z)with ipv '%s' and priority %d not in list)rQ r> r5 rT r$ rL )r r r r r rM rA rY r r r � remove_rule s
zDirect.remove_rulec C sb | j ||� |||f}|| jkr^x"| j| j� D ]}| j| |= q0W t| j| �dkr^| j|= d S )Nr )rQ r5 rP rT )r r r r rA rY r r r � remove_rules" s
zDirect.remove_rulesc C s: | j ||� |||f}|t|�f}|| jko8|| j| kS )N)rQ r> r5 )r r r r r rM rA rY r r r �
query_rule+ s
zDirect.query_rulec C sF | j ||� |||f}|| jkr*| j| S td||f d| ��d S )Nz'No rules for table '%s' and chain '%s' z
with ipv '%s')rQ r5 r$ )r r r r rA r r r � get_rules1 s
zDirect.get_rulesc C s | j S )N)r5 )r r r r �
get_all_rules: s zDirect.get_all_rulesc C s^ | j |� || jkr g | j|< || j| kr>| j| j|� n tjddj|�|f d � d S )Nz Passthrough '%s' for ipv '%s'z',zalready in list, ignoring)rO r6 r, r
rR rL )r r rM r r r r. ? s
zDirect.add_passthroughc C sl | j |� || jkrN|| j| krN| j| j|� t| j| �dkrh| j|= ntddj|�|f d ��d S )Nr z Passthrough '%s' for ipv '%s'z',z not in list)rO r6 rS rT r$ rL )r r rM r r r �remove_passthroughI s
zDirect.remove_passthroughc C s" | j |� || jko || j| kS )N)rO r6 )r r rM r r r �query_passthroughS s
zDirect.query_passthroughc C s. | j |� || jkr | j| S td| ��d S )Nz No passthroughs for ipv '%s')rO r6 r$ )r r r r r �get_passthroughsW s
zDirect.get_passthroughsc C s | j S )N)r6 )r r r r �get_all_passthroughs^ s zDirect.get_all_passthroughsc C s� | j � | jjd�s&ttjd| j ��t| �}tj� }|j |� t
| jd��b}tj d �}|j |� y|j
|� W n8 tjk
r� } zttjd|j� ��W Y d d }~X nX W d Q R X d S )Nz.xmlz'%s' is missing .xml suffix�rbzNot a valid file: %s)rC r8 �endswithr r
Z INVALID_NAMEr �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZ INVALID_TYPEZ getException)r �handler�parser�f�source�msgr r r �readc s
z Direct.readc
C sB t jj| j�r\ytj| jd| j � W n4 tk
rZ } ztd| j|f ��W Y d d }~X nX t jjtj �sxt j
tj d� t j | jddd�}t
|�}|j� |jdi � |jd� xR| jD ]H}|\}}x:| j| D ],}|jd � |jd
|||d �� |jd� q�W q�W x�| jD ]�}|\}}}xx| j| D ]j\}} t| �d k �r@�q&|jd � |jd
|||d| d�� |jtjjt| ��� |jd
� |jd� �q&W �q W x|| jD ]r}xj| j| D ]\} t| �d k �rȐq�|jd � |jdd|i� |jtjjt| ��� |jd� |jd� �q�W �q�W |jd� |jd� |j� |j � ~d S )Nz%s.oldzBackup of '%s' failed: %si� ZwtzUTF-8)�mode�encodingr �
z r )r r r r< r z%d)r r r r r r ) �os�path�existsr8 �shutilZcopy2� Exception�IOErrorr Z
ETC_FIREWALLD�mkdir�iorf r Z
startDocumentr ZignorableWhitespacer3 Z
simpleElementr5 rT re Zsaxutils�escaper r+ r6 Z endDocument�close)
r rl rj rh rA r r r r rM r r r �writeu sZ $
z Direct.write)r4 r4 r4 )#r/ r0 r1 �__doc__rE ZDBUS_SIGNATUREZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r; rB rH rC rN rO rQ r! rU rV rW rX r- rZ r[ r\ r] r^ r. r_ r` ra rb rm r{ �
__classcell__r r )r9 r r2 u sH
r2 )Zxml.saxre rq rx rt Zfirewallr Zfirewall.fw_typesr Zfirewall.functionsr r r Zfirewall.core.io.io_objectr r r Zfirewall.core.loggerr
Z
firewall.corer r r
Zfirewall.errorsr r r2 r r r r �<module> s
N core/io/__pycache__/__init__.cpython-36.pyc 0000644 00000001227 15035135172 0014504 0 ustar 00 3
��g< � @ sj d dl Z de jkrfd dlmZ eed�s<dd� Zeede� d dlmZ eed�sfd d
� Z eede � dS ) � NZ_xmlplus)�AttributesImpl� __contains__c C s |t | d�kS )NZ_attrs)�getattr)�self�name� r � /usr/lib/python3.6/__init__.py� __AttributesImpl__contains__ s r )� XMLGeneratorZ_writec C s t | d�j|� d S )NZ_out)r �write)r �textr r r �__XMLGenerator_write$ s r
)
Zxml�__file__Zxml.sax.xmlreaderr �hasattrr �setattrZxml.sax.saxutilsr
r
r r r r �<module> s
core/io/__pycache__/__init__.cpython-36.opt-1.pyc 0000644 00000001227 15035135172 0015443 0 ustar 00 3
��g< � @ sj d dl Z de jkrfd dlmZ eed�s<dd� Zeede� d dlmZ eed�sfd d
� Z eede � dS ) � NZ_xmlplus)�AttributesImpl� __contains__c C s |t | d�kS )NZ_attrs)�getattr)�self�name� r � /usr/lib/python3.6/__init__.py� __AttributesImpl__contains__ s r )� XMLGeneratorZ_writec C s t | d�j|� d S )NZ_out)r �write)r �textr r r �__XMLGenerator_write$ s r
)
Zxml�__file__Zxml.sax.xmlreaderr �hasattrr �setattrZxml.sax.saxutilsr
r
r r r r �<module> s
core/io/__pycache__/ipset.cpython-36.opt-1.pyc 0000644 00000025614 15035135172 0015036 0 ustar 00 3
��g�R � @ s d Z dddgZddljZddlZddlZddlZddlmZ ddl m
Z
m Z m Z m
Z
mZmZmZmZmZ ddlmZmZmZmZ dd lmZmZ dd
lm Z m Z m Z m Z dd l m!Z! dd lm"Z" dd
l#m$Z$ G dd� de�Z%G dd� de�Z&dd� Z'ddd�Z(dS )z$ipset io XML handler, reader, writer�IPSet� ipset_reader� ipset_writer� N)�config) �checkIP�checkIP6� checkIPnMask�
checkIP6nMask�
u2b_if_py2� check_mac�
check_port�checkInterface�
checkProtocol)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)� IPSET_TYPES�IPSET_CREATE_OPTIONS)�check_icmp_name�check_icmp_type�check_icmpv6_name�check_icmpv6_type)�log)�errors)�
FirewallErrorc s� e Zd Zd d d d!dddifddgffZdZd d
d d gZd
d
dgdgd
d�Zdgdgd�Z� fdd�Zdd� Z dd� Z
e dd� �Z dd� Z
� fd d �Z� ZS )"r �version� �short� description�type�options�entriesz
(ssssa{ss}as)�_�-�:�.N�name)r r �ipset�option�entry�value)r( r) c s< t t| �j� d| _d| _d| _d| _g | _i | _d| _ d S )Nr F)
�superr �__init__r r r r r" r! �applied)�self)� __class__� �/usr/lib/python3.6/ipset.pyr- C s zIPSet.__init__c C s8 d| _ d| _d| _d| _| jd d �= | jj� d| _d S )Nr F)r r r r r" r! �clearr. )r/ r1 r1 r2 �cleanupM s
z
IPSet.cleanupc C s\ t | j�| _t | j�| _t | j�| _t | j�| _dd� | jj� D �| _dd� | jD �| _dS )z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s i | ]\}}t |�t |��qS r1 )r
)�.0�k�vr1 r1 r2 �
<dictcomp>^ s z(IPSet.encode_strings.<locals>.<dictcomp>c S s g | ] }t |��qS r1 )r
)r5 �er1 r1 r2 �
<listcomp>` s z(IPSet.encode_strings.<locals>.<listcomp>N)r
r r r r r! �itemsr" )r/ r1 r1 r2 �encode_stringsV s zIPSet.encode_stringsc
C s d}d|kr |d dkr d}|j d�s6ttjd| ��|dd � jd�}| jd�}t|�t|�ksnt|�d k r�ttjd
| |f ���xztt|��D �]h}|| }|| }|d k�r�d |ko�|dk�rh|d kr�ttjd
|| |f ��|jd �} t| �dk�rttjd|| ||f ��x�| D ]J}
|dk�r2t|
� �sH|dk�rt |
� �rttjd|
| ||f ���qW nh|dk�r�|dk�r�ttjd|| ||f ��|dk�r�t
} nt} nt } | |��s�ttjd|| ||f ��q�|dk�r@d |k�r�|jd �} t| �dk�rttjd|| ||f ��|dk�r0t| d � �sJ|dk�rft | d � �rfttjd| d | ||f ��|dk�r�t
| d � �s�|dk�r>t | d � �r>ttjd| d | ||f ��n�|j d��r�|dk�o�|dk�o�|dk�s�ttjd|| ||f ��|dk�rt
|� �s&|dk�r�t |� �r�ttjd|| ||f ��q�|dk�rvt
|� �s`|dk�r�ttjd|| f ��q�|dk�r�d|k�r�|jd�} t| �dk�r�ttjd| ��| d d k�r|dk�r�ttjd || f ��t| d � �r�t| d � �r�ttjd | d | f ��n�| d d1k�r~|dk�rDttjd || f ��t| d � �r�t| d � �r�ttjd!| d | f ��n^| d d2k�r�t| d � �r�ttjd&| d | f ��n&t| d ��s�ttjd'| d | f ��n t|��s�ttjd(|| f ��q�|d)k�r�|j d*��rPyt|d+�} W n* tk
�rL ttjd,|| f ��Y nX n8y t|�} W n* tk
�r� ttjd,|| f ��Y nX | dk �s�| d-k�r�ttjd,|| f ��q�|d.k�r�t|� �s�t|�d/k�r�ttjd0|| f ��q�ttjd| ��q�W d S )3NZipv4�family�inet6Zipv6zhash:zipset type '%s' not usable� �,� z)entry '%s' does not match ipset type '%s'Zipr$ z invalid address '%s' in '%s'[%d]� z.invalid address range '%s' in '%s' for %s (%s)z(invalid address '%s' in '%s' for %s (%s)z0.0.0.0r Znetz/0zhash:net,ifaceZmacz00:00:00:00:00:00z invalid mac address '%s' in '%s'Zportr% zinvalid port '%s'Zicmpz(invalid protocol for family '%s' in '%s'z invalid icmp type '%s' in '%s'�icmpv6� ipv6-icmpz invalid icmpv6 type '%s' in '%s'�tcp�sctp�udp�udplitez invalid protocol '%s' in '%s'zinvalid port '%s'in '%s'zinvalid port '%s' in '%s'ZmarkZ0x� zinvalid mark '%s' in '%s'l �� Ziface� z invalid interface '%s' in '%s')rC rD )rE rF rG rH )�
startswithr r �
INVALID_IPSET�split�lenZ
INVALID_ENTRY�ranger r r r �endswithr r r r r r r �int�
ValueErrorr
)
r* r! Z
ipset_typer= �flagsr; �i�flag�itemZsplitsZ_splitZip_checkZint_valr1 r1 r2 � check_entryb s@
zIPSet.check_entryc C s� |dkr |t kr ttjd| ��|dkr�x�|j� D ]�}|tkrNttjd| ��|dkr�yt|| �}W n, tk
r� ttj d||| f ��Y nX |d k r�ttj d
||| f ��q2|d kr2|| dkr2ttj
|| ��q2W d S )Nr z '%s' is not valid ipset typer! zipset invalid option '%s'�timeout�hashsize�maxelemz)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer= �inetr> )rX rY rZ )r[ r> ) r r r � INVALID_TYPE�keysr rL rQ rR �
INVALID_VALUE�INVALID_FAMILY)r/ r rV Z
all_config�key� int_valuer1 r1 r2 �
_check_config s2
zIPSet._check_configc sr d|d kr6|d d dkr6t |d �dkr6ttj��x&|d D ]}tj||d |d � q@W tt| �j|� d S )NrX � �0r? r � )rN r r ZIPSET_WITH_TIMEOUTr rW r, �
import_config)r/ r r* )r0 r1 r2 rf 3 s
zIPSet.import_config)r r )r r )r r )r r )�__name__�
__module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr- r4 r< � staticmethodrW rb rf �
__classcell__r1 r1 )r0 r2 r , s,
7c @ s e Zd Zdd� Zdd� ZdS )�ipset_ContentHandlerc
C s� t j| ||� | jj||� |dkrpd|krX|d tkrLttjd|d ��|d | j_d|krl|d | j_ �nz|dkr|�nn|dkr��nb|dk�r�d}d |kr�|d }|d
dkr�ttj
d|d
��| jjdko�|d
dk� r�ttj
d|d
| jjf ��|d
dk�r&| �r&ttj
d|d
��|d
d k�r�y t |�}W n. t k
�rn ttj
d|d
|f ��Y nX |dk �r�ttj
d|d
|f ��|d
d k�r�|d k�r�ttj|��|d
| jjk�r�|| jj|d
< ntjd|d
� d S ) Nr( r z%sr r r r) r r+ r' r= rX rY rZ zUnknown option '%s'zhash:macz%Unsupported option '%s' for type '%s'z&Missing mandatory value of option '%s'z)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer[ r> z Option %s already set, ignoring.)r= rX rY rZ )r= )r= rX rY rZ )rX rY rZ )r[ r> )r � startElementrV Zparser_check_element_attrsr r r r\ r r ZINVALID_OPTIONrQ rR r^ r_ r! r �warning)r/ r' �attrsr+ ra r1 r1 r2 rm > sd
z!ipset_ContentHandler.startElementc C s( t j| |� |dkr$| jjj| j� d S )Nr* )r �
endElementrV r" �appendZ_element)r/ r' r1 r1 r2 rp u s z ipset_ContentHandler.endElementN)rg rh ri rm rp r1 r1 r1 r2 rl = s 7rl c % C s t � }| jd�s ttjd| ��| d d� |_|j|j� | |_||_|j t
j �rVdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd|j� ��W Y d d }~X nX W d Q R X ~~d |jk�rF|jd d
k�rFt|j�d k�rFt j d |j� |jd d �= d } t � }
x�| t|j�k �r|j| |
k�r�t j d
|j| � |jj | � nry |j |j| |j|j!� W n< tk
�r� } z t j d| � |jj | � W Y d d } ~ X nX |
j"|j| � | d7 } �qRW ~
t#�r|j$� |S )Nz.xmlz'%s' is missing .xml suffixrc FTz%s/%s�rbznot a valid ipset file: %srX rd r z6ipset '%s': timeout option is set, entries are ignoredz Entry %s already set, ignoring.z
%s, ignoring.rA ���)%r rP r r Z INVALID_NAMEr' Z
check_name�filename�pathrK r �
ETC_FIREWALLDZbuiltin�defaultrl �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionrL Z getExceptionr! rN r" r rn �set�poprW r �addr r< ) rt ru r( �handler�parserr' �f�source�msgrT Z entries_setr9 r1 r1 r2 r z s^
( c C s� |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� d | ji}| j�r| jd
k�r| j|d < |jd |� |jd
� | j�rz| jd
k�rz|jd� |jdi � |j| j� |jd� |jd
� | j�r�| jd
k�r�|jd� |jdi � |j| j� |jd� |jd
� xZ| jj � D ]L\} }
|jd� |
d
k�r |j d| |
d�� n|j dd| i� |jd
� �q�W xD| j D ]:} |jd� |jdi � |j| � |jd� |jd
� �q(W |jd � |jd
� |j � |j � ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r( �
z r r r) )r' r+ r' r* )!ru rt r' �os�exists�shutilZcopy2� Exceptionr �error�dirnamerK r rv �mkdir�iory r Z
startDocumentr r rm ZignorableWhitespacer Z
charactersrp r r! r; Z
simpleElementr" Z endDocument�close) r( ru �_pathr' r� �dirpathr� r~ ro r` r+ r* r1 r1 r2 r � sf
)N))�__doc__�__all__Zxml.saxrx r� r� r� Zfirewallr Zfirewall.functionsr r r r r
r r r
r Zfirewall.core.io.io_objectr r r r Zfirewall.core.ipsetr r Zfirewall.core.icmpr r r r Zfirewall.core.loggerr r Zfirewall.errorsr r rl r r r1 r1 r1 r2 �<module> s&
, =5 core/io/__pycache__/direct.cpython-36.pyc 0000644 00000027263 15035135172 0014227 0 ustar 00 3
��g�= � @ s� d dl jZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z d dl
mZmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZ G d d � d e�ZG d
d� de�ZdS )� N)�config)�LastUpdatedOrderedDict)� splitArgs�joinArgs�
u2b_if_py2)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)� ipXtables)�ebtables)�errors)�
FirewallErrorc @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�direct_ContentHandlerc C s t j| |� d| _d S )NF)r �__init__�direct)�self�item� r � /usr/lib/python3.6/direct.pyr ( s z direct_ContentHandler.__init__c C s� t j| ||� | jj||� |dkr@| jr6ttjd��d| _�n>|dkr�| js\tj d� d S |d }|d }|d }| jj
t |�t |�t |�� n�|dk�r6| js�tj d � d S |d }|dkr�ttj d
| ��|d }|d }yt
|d �}W n( tk
�r tj d|d � d S X t |�t |�t |�|g| _nH|dk�rl| j�sVtj d� d S |d }t |�g| _ntj d| � d S d S )Nr zMore than one direct tag.T�chainz$Parse Error: chain outside of direct�ipv�table�rulez#Parse Error: rule outside of direct�ipv4�ipv6�ebz"'%s' not from {'ipv4'|'ipv6'|'eb'}�priorityz'Parse Error: %s is not a valid priority� passthroughz&Parse Error: command outside of directzUnknown XML element %s)r r r )r � startElementr Zparser_check_element_attrsr r r
Z PARSE_ERRORr
�error� add_chainr � INVALID_IPV�int�
ValueError�_rule� _passthrough)r �nameZattrsr r r r r r r r , sT
z"direct_ContentHandler.startElementc C s� t j| |� |dkrX| jrF| jjdd� t| j�D �� | jj| j� n
tj d� d | _nJ|dkr�| jr�| j
jdd� t| j�D �� | jj | j
� n
tj d � d | _
d S )
Nr c S s g | ] }t |��qS r )r )�.0�xr r r �
<listcomp>d s z4direct_ContentHandler.endElement.<locals>.<listcomp>z2Error: rule does not have any arguments, ignoring.r c S s g | ] }t |��qS r )r )r( r) r r r r* m s z0Error: passthrough does not have any arguments, z ignoring.z9Error: passthrough does not have any arguments, ignoring.) r �
endElementZ_elementr% �appendr r �add_ruler
r r& �add_passthrough)r r' r r r r+ ^ s
z direct_ContentHandler.endElementN)�__name__�
__module__� __qualname__r r r+ r r r r r ' s 2r c s< e Zd ZdZddBgfddddddgfgfdddgfgffZdZdd d
d gd d
d d gd gd
�Zi Z� fdd�Zdd� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!� Z"S )C�Directz Direct class �chains� �rulesr � passthroughsz(a(sss)a(sssias)a(sas))Nr r r r )r r r r c s0 t t| �j� || _t� | _t� | _t� | _d S )N)�superr2 r �filenamer r3 r5 r6 )r r8 )� __class__r r r � s
zDirect.__init__c C s d S )Nr )r �confr Zall_confr r r �
_check_config� s zDirect._check_configc C s g }g }x>| j D ]4}x.| j | D ] }|jtt|�t|g� �� q W qW |j|� g }xR| jD ]H}xB| j| D ]4}|jt|d |d |d |d t|d �f�� qnW q^W |j|� g }x8| jD ].}x(| j| D ]}|jt|t|�f�� q�W q�W |j|� t|�S )Nr � � )r3 r, �tuple�listr5 r6 )r �retr) �keyr r r r r �
export_config� s$ $
zDirect.export_configc C s� | j � | j|� x�t| j�D ]x\}\}}|dkrNx|| D ]}| j|� q<W |dkrrx|| D ]}| j|� q`W |dkr x|| D ]}| j|� q�W q W d S )Nr3 r5 r6 )�cleanupZ check_config� enumerate�IMPORT_EXPORT_STRUCTUREr! r- r. )r r: �i�elementZdummyr) r r r �
import_config� s
zDirect.import_configc C s" | j j� | jj� | jj� d S )N)r3 �clearr5 r6 )r r r r rC � s
zDirect.cleanupc C s� t d� x4| jD ]*}t d|d |d dj| j| �f � qW t d� xZ| jD ]P}t d|d |d |d f � x,| j| D ] \}}t d |d
j|�f � q|W qNW t d � x@| jD ]6}t d | � x$| j| D ]}t d
d
j|� � q�W q�W d S )Nr3 z (%s, %s): %sr r< �,r5 z (%s, %s, %s):r= z (%d, ('%s'))z','r6 z %s:z
('%s'))�printr3 �joinr5 r6 )r rA r �argsr r r �output� s z
Direct.outputc C s* dddg}||kr&t tjd||f ��d S )Nr r r z'%s' not in '%s')r r
r" )r r Zipvsr r r �
_check_ipv� s
zDirect._check_ipvc C sF | j |� |dkr tjj� ntjj� }||krBttjd||f ��d S )Nr r z'%s' not in '%s')r r )rO r ZBUILT_IN_CHAINS�keysr r r
Z
INVALID_TABLE)r r r Ztablesr r r �_check_ipv_table� s
zDirect._check_ipv_tablec C sd | j ||� ||f}|| jkr(g | j|< || j| krH| j| j|� ntjd|||f d � d S )Nz(Chain '%s' for table '%s' with ipv '%s' zalready in list, ignoring)rQ r3 r, r
�warning)r r r r rA r r r r! � s
zDirect.add_chainc C sn | j ||� ||f}|| jkrX|| j| krX| j| j|� t| j| �dkrj| j|= ntd|||f ��d S )Nr z4Chain '%s' with table '%s' with ipv '%s' not in list)rQ r3 �remove�lenr$ )r r r r rA r r r � remove_chain� s
zDirect.remove_chainc C s, | j ||� ||f}|| jko*|| j| kS )N)rQ r3 )r r r r rA r r r � query_chain� s zDirect.query_chainc C s< | j ||� ||f}|| jkr(| j| S td||f ��d S )Nz&No chains for table '%s' with ipv '%s')rQ r3 r$ )r r r rA r r r �
get_chains� s
zDirect.get_chainsc C s | j S )N)r3 )r r r r �get_all_chains s zDirect.get_all_chainsc C s� | j ||� |||f}|| jkr,t� | j|< |t|�f}|| j| krV|| j| |< n*tjddj|�||f d||f d � d S )Nz(Rule '%s' for table '%s' and chain '%s' z',z with ipv '%s' and priority %d zalready in list, ignoring)rQ r5 r r> r
rR rL )r r r r r rM rA �valuer r r r- s
zDirect.add_rulec C s� | j ||� |||f}|t|�f}|| jkrb|| j| krb| j| |= t| j| �dkr�| j|= n$tddj|�||f d||f ��d S )Nr z(Rule '%s' for table '%s' and chain '%s' z',z)with ipv '%s' and priority %d not in list)rQ r> r5 rT r$ rL )r r r r r rM rA rY r r r � remove_rule s
zDirect.remove_rulec C sb | j ||� |||f}|| jkr^x"| j| j� D ]}| j| |= q0W t| j| �dkr^| j|= d S )Nr )rQ r5 rP rT )r r r r rA rY r r r � remove_rules" s
zDirect.remove_rulesc C s: | j ||� |||f}|t|�f}|| jko8|| j| kS )N)rQ r> r5 )r r r r r rM rA rY r r r �
query_rule+ s
zDirect.query_rulec C sF | j ||� |||f}|| jkr*| j| S td||f d| ��d S )Nz'No rules for table '%s' and chain '%s' z
with ipv '%s')rQ r5 r$ )r r r r rA r r r � get_rules1 s
zDirect.get_rulesc C s | j S )N)r5 )r r r r �
get_all_rules: s zDirect.get_all_rulesc C s^ | j |� || jkr g | j|< || j| kr>| j| j|� n tjddj|�|f d � d S )Nz Passthrough '%s' for ipv '%s'z',zalready in list, ignoring)rO r6 r, r
rR rL )r r rM r r r r. ? s
zDirect.add_passthroughc C sl | j |� || jkrN|| j| krN| j| j|� t| j| �dkrh| j|= ntddj|�|f d ��d S )Nr z Passthrough '%s' for ipv '%s'z',z not in list)rO r6 rS rT r$ rL )r r rM r r r �remove_passthroughI s
zDirect.remove_passthroughc C s" | j |� || jko || j| kS )N)rO r6 )r r rM r r r �query_passthroughS s
zDirect.query_passthroughc C s. | j |� || jkr | j| S td| ��d S )Nz No passthroughs for ipv '%s')rO r6 r$ )r r r r r �get_passthroughsW s
zDirect.get_passthroughsc C s | j S )N)r6 )r r r r �get_all_passthroughs^ s zDirect.get_all_passthroughsc C s� | j � | jjd�s&ttjd| j ��t| �}tj� }|j |� t
| jd��b}tj d �}|j |� y|j
|� W n8 tjk
r� } zttjd|j� ��W Y d d }~X nX W d Q R X d S )Nz.xmlz'%s' is missing .xml suffix�rbzNot a valid file: %s)rC r8 �endswithr r
Z INVALID_NAMEr �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZ INVALID_TYPEZ getException)r �handler�parser�f�source�msgr r r �readc s
z Direct.readc
C sB t jj| j�r\ytj| jd| j � W n4 tk
rZ } ztd| j|f ��W Y d d }~X nX t jjtj �sxt j
tj d� t j | jddd�}t
|�}|j� |jdi � |jd� xR| jD ]H}|\}}x:| j| D ],}|jd � |jd
|||d �� |jd� q�W q�W x�| jD ]�}|\}}}xx| j| D ]j\}} t| �d k �r@�q&|jd � |jd
|||d| d�� |jtjjt| ��� |jd
� |jd� �q&W �q W x|| jD ]r}xj| j| D ]\} t| �d k �rȐq�|jd � |jdd|i� |jtjjt| ��� |jd� |jd� �q�W �q�W |jd� |jd� |j� |j � ~d S )Nz%s.oldzBackup of '%s' failed: %si� ZwtzUTF-8)�mode�encodingr �
z r )r r r r< r z%d)r r r r r r ) �os�path�existsr8 �shutilZcopy2� Exception�IOErrorr Z
ETC_FIREWALLD�mkdir�iorf r Z
startDocumentr ZignorableWhitespacer3 Z
simpleElementr5 rT re Zsaxutils�escaper r+ r6 Z endDocument�close)
r rl rj rh rA r r r r rM r r r �writeu sZ $
z Direct.write)r4 r4 r4 )#r/ r0 r1 �__doc__rE ZDBUS_SIGNATUREZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r; rB rH rC rN rO rQ r! rU rV rW rX r- rZ r[ r\ r] r^ r. r_ r` ra rb rm r{ �
__classcell__r r )r9 r r2 u sH
r2 )Zxml.saxre rq rx rt Zfirewallr Zfirewall.fw_typesr Zfirewall.functionsr r r Zfirewall.core.io.io_objectr r r Zfirewall.core.loggerr
Z
firewall.corer r r
Zfirewall.errorsr r r2 r r r r �<module> s
N core/io/__pycache__/policy.cpython-36.opt-1.pyc 0000644 00000051212 15035135172 0015202 0 ustar 00 3
��gϢ � @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z m
Z
ddlm Z m Z m
Z
ddlmZmZmZ dd lmZmZmZmZmZmZ dd
lmZ dd lm Z dd lm Z dd
l m Z dd� Z dd� Z!dd� Z"dd� Z#dd� Z$G dd � d e�Z%G dd� de�Z&d d d�Z'd d d�Z(dS ) �Policy�
policy_reader�
policy_writer� N)�config)�checkIP�checkIP6)�uniqify�max_policy_name_len�portStr)�DEFAULT_POLICY_TARGET�POLICY_TARGETS�DEFAULT_POLICY_PRIORITY)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator�
check_port� check_tcpudp�check_protocol)�rich)�log)�errors)�
FirewallErrorc C s� |dkr �n�|dkr�n�|dkr�| j r`| j jrJtjdt| j �� d| _dS tj|d �| j _dS |d | jj kr�| jj j
|d � ntjd|d � �n|dk�rN| j r�| j jr�tjdt| j �� d| _dS tj |d |d �| j _dS t |d � t
|d � t|d d
�|d f}|| jjk�r4| jjj
|� ntjd |d |d � �nN|d k�r�| j �r�| j j�r�tjdt| j �� d| _dS tj|d �| j _nBt|d � |d | jjk�r�| jjj
|d � ntjd
|d � �n�|dk�rh| j �r.| j j�rtjdt| j �� d| _dS tj|d �| j _dS |d | jjk�rT| jjj
|d � ntjd|d � �n4|dk�r�| j �r�| j j�r�tjdt| j �� d| _dS tj|d �| j _dS tjd|d � �n�|dk�r2| j �r| j j�rtjdt| j �� d| _dS tj� | j _n | jj�r&tjd� nd| j_�nj|dk�r�d}d|k�rR|d }d}d|k�rh|d }| j �r�| j j�r�tjdt| j �� d| _dS tj|d |d ||�| j _dS t |d � t
|d � |�r�t |� |�r
t|� �r
t|� �r
tt j d| ��t|d d
�|d t|d
�t|�f}|| jj k�rL| jj j
|� n6tjd|d |d |�rld| nd|�r|d| nd� �n|d k�r@| j �r�| j j�r�tjdt| j �� d| _dS tj |d |d �| j _dS t |d � t
|d � t|d d
�|d f}|| jj k�r&| jj j
|� ntjd |d |d � �n\|d k�r�| j �sftjd � d| _dS | j j!�r�tjd t| j �� dS d!}d }d"|k�r�|d" }d }d#|k�r�|d# }d$|k�r�|d$ j"� dLk�r�d}tj#|||�| j _!�n�|dMk�r�| j �stjd+� d| _dS | j j$�r0tjd,� d| _dS |d'k�rHtj%� | j _$nh|d(k�rxd } d-|k�rh|d- } tj&| �| j _$n8|d)k�r�tj'� | j _$n |d*k�r�|d. }
tj(|
�| j _$| j j$| _)�n�|d/k�r^| j �s�tjd0� dS | j j�r�tjd1� dS d } d2|k�r*|d2 } | dNk�r*tjd;� d| _dS d<|k�r<|d< nd } tj*| | �| j _| j j| _)�n>|d=k�r�| j �s~tjd>� dS | j j+�r�tjd?t| j �� d| _dS tj,� | j _+| j j+| _)n�|d@k�r,d }
dA}dB|k�r|dB }
|
dOk�rtjdE|dB � d| _dS dF|k�rt-|dF �}tj.|
|dG�| _ np|dHk�r�| j)�sRtjdI� d| _dS | j)j/�rxtjdJt| j �� d| _dS |d }tj0||j1dK��| j)_/nd!S dS )PN�short� description�servicez;Invalid rule: More than one element in rule '%s', ignoring.T�namez#Service '%s' already set, ignoring.�port�protocol�-z#Port '%s/%s' already set, ignoring.�valuez$Protocol '%s' already set, ignoring.z
icmp-blockz&icmp-block '%s' already set, ignoring.z icmp-typez-Invalid rule: icmp-block '%s' outside of rule�
masqueradez!Masquerade already set, ignoring.z forward-port� zto-portzto-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%sz source-portz*Source port '%s/%s' already set, ignoring.� destinationz)Invalid rule: Destination outside of rulez?Invalid rule: More than one destination in rule '%s', ignoring.F�address�ipset�invert�yes�true�accept�reject�drop�markz$Invalid rule: Action outside of rulez"Invalid rule: More than one action�type�setr z!Invalid rule: Log outside of rulez Invalid rule: More than one log�level�emerg�alert�crit�error�warning�notice�info�debugz Invalid rule: Invalid log level�prefix�auditz#Invalid rule: Audit outside of rulez9Invalid rule: More than one audit in rule '%s', ignoring.�ruler �family�ipv4�ipv6z&Invalid rule: Rule family "%s" invalid�priority)r: r= �limitz4Invalid rule: Limit outside of action, log and auditz9Invalid rule: More than one limit in rule '%s', ignoring.�burst)r& r' )r( r) r* r+ )r/ r0 r1 r2 r3 r4 r5 r6 )r; r< )2�_rule�elementr r3 �str� _rule_errorr � Rich_Service�item�services�append� Rich_Portr r r
�ports�
Rich_Protocolr � protocols�Rich_IcmpBlock� icmp_blocks�
Rich_IcmpType�Rich_Masquerader �Rich_ForwardPortr r r r � INVALID_ADDR�
forward_ports�Rich_SourcePort� source_portsr" �lowerZRich_Destination�action� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� _limit_okZRich_Logr8 Z
Rich_Audit�int� Rich_Ruler> Z
Rich_Limit�get)�objr �attrs�entry�to_portZto_addrr% r# r$ Z_typeZ_setr. r7 r: r= r � rc � /usr/lib/python3.6/policy.py�common_startElement s�
re c C s� |dkr�| j s�y| jj� W n6 tk
rR } ztjd|t| j�� W Y d d }~X nLX t| j�| jjkr�| jj j
| j� | jjj
t| j�� ntjdt| j�� d | _d| _ n|d kr�d | _ d S ) Nr9 z%s: %sz Rule '%s' already set, ignoring.Fr( r) r* r+ r r8 )r( r) r* r+ r r8 ) rC r@ Zcheck� Exceptionr r3 rB rE � rules_str�rulesrG r[ )r_ r �erc rc rd �common_endElement s & rj c C s� t | t�rdnd}|dkrT| jrT| jj� }x$|D ] }||kr0ttjd| ��q0W �n�|dkr�x$|D ] }t|d � t|d � qbW �nb|dkr�x|D ] }t |� q�W �n@|d kr�| jr�| jj
� } x$|D ] }
|
| kr�ttj d
|
��q�W �n�|d k�r�x�|D ]�} t| d � t| d � | d �r>| d
�r>ttj d| ��| d �rTt| d � | d
r�t
| d
� r�t| d
� r�ttjd| d
��q�W �nT|dk�r�x&|D ] }t|d � t|d � �q�W �n |dk�r�x|D �]} tj| d�}
| j�r�|
j�r�t |
jtj��s t |
jtj��r�| jj
� } |
jj| k�rLttj d
|
jj ��nH|
j�r�| jj|
jj�}|j�r�|
j|jk�r�ttj d|
j|
jjf ��nL| j�r�t |
jtj��r�| jj� }|
jj|k�r�ttjdj|| j|
jj����q�W d S )Nr ZZonerF z '%s' not among existing servicesrI r � rK rM z"'%s' not among existing icmp typesrR � � z$'%s' is missing to-port AND to-addr z#to-addr '%s' is not a valid addressrT rg �
rich_rules)�rule_strz3rich rule family '%s' conflicts with icmp type '%s'z){} '{}': '{}' not among existing services)rg rn )�
isinstancer � fw_configZ get_servicesr r ZINVALID_SERVICEr r r Z
get_icmptypesZINVALID_ICMPTYPE�INVALID_FORWARDr r rQ r r] rA rL rN r r: Z get_icmptyper" rD �format)r_ r rE �
all_configZobj_typeZexisting_servicesr r �protoZexisting_icmptypesZicmptype�fwd_portr9 Zobj_richZictrc rc rd �common_check_config2 s�
rw c C s0 d|j i}|j}|d k r ||d< | jd|� d S )Nr r? r> )r r? �
simpleElement)�handlerr> �dr? rc rc rd �_handler_add_rich_limitx s
r{ c C s� | j rF| j dkrF|jd� |jdi � |j| j � |jd� |jd� | jr�| jdkr�|jd� |jdi � |j| j� |jd� |jd� x6t| j�D ](}|jd� |jdd|i� |jd� q�W x@t| j �D ]2}|jd� |jd|d |d
d �� |jd� q�W x8t| j
�D ]*}|jd� |jd d
|i� |jd� �qW x8t| j �D ]*}|jd� |jdd|i� |jd� �qLW | j �r�|jd� |jdi � |jd� x�t| j
�D ]�}|jd� |d |d
d �}|d �r�|d dk�r�|d |d< |d �r|d dk�r|d |d< |jd|� |jd� �q�W xBt| j�D ]4}|jd� |jd|d |d
d �� |jd� �q>W �xT| jD �]H}i }|j�r�|j|d< |jd k�r�t|j�|d< |jd� |jd|� |jd� |j�rVi }|jj�r�|jj|d< |jj�r|jj|d< |jj�r$|jj|d< |jj�r6d |d < |jd � |jd |� |jd� |j�r�i }|jj�rx|jj|d< |jj�r�|jj|d< |jj�r�d |d < |jd � |jd |� |jd� |j�rxd} i }t|j�tj k�r�d} |jj |d< �nbt|j�tj k�r(d} |jj |d< |jj |d < �n0t|j�tj!k�rNd } |jj"|d
< �n
t|j�tj#k�rfd} n�t|j�tj$k�r�d} |jj |d< n�t|j�tj%k�r�d!} |jj |d< n�t|j�tj&k�rd} |jj |d< |jj |d < |jj'dk�r�|jj'|d< |jj(dk�rX|jj(|d< nFt|j�tj)k�rBd} |jj |d< |jj |d < nt*t+j,d"t|j� ��|jd � |j| |� |jd� |j-�r i }|j-j.�r�|j-j.|d#< |j-j/�r�|j-j/|d$< |j-j0�r�|jd � |jd%|� |jd&� t1||j-j0� |jd'� |jd%� n|jd � |jd%|� |jd� |j2�r�i }|j2j0�rx|jd � |jd(i � |jd&� t1||j2j0� |jd'� |jd(� n|jd � |jd(|� |jd� |j3�r�d}
i }t|j3�tj4k�r�d)}
n|t|j3�tj5k�r�d*}
|j3j�r<|j3j|d+< nNt|j3�tj6k�rd,}
n6t|j3�tj7k�r*d-}
|j3j8|d.< nt-j9d/t|j3�� |j3j0�r�|jd � |j|
|� |jd&� t1||j3j0� |jd'� |j|
� n|jd � |j|
|� |jd� |jd� |jd� |jd� �q�W d S )0Nr! z r �
r r r r r rk )r r r r z
icmp-blockr rl zto-portrm zto-addrz forward-portz source-portr: r= r9 r# �macr$ �Truer% z �sourcer" z icmp-typez"Unknown element '%s' in obj_writerr7 r. r z
z
r8 r( r) r, r* r+ r- zUnknown action '%s'):r �ignorableWhitespace� startElementZ
characters�
endElementr r rF rx rI rK rM r rR rT rh r: r= rB r �addrr} r$ r% r" rA r, r rD r rH r r rJ r rO rL rN rP rb �
to_addressrS r r ZINVALID_OBJECTr r7 r. r> r{ r8 rV rW rX rY rZ r- r3 ) r_ ry r r r ZicmpZforwardr` r9 rA rV rc rc rd �
common_writer� s\
r� c sP e Zd Zd7ZdZeZdgZd8d9d:d;d dgfd
d<gfd dgfd=dd>gfddgfddgfdd?gfd@ddgfddgffZdddgZ dddgdgddgdgdgdddgdddd gddgdddddd gd gdgdgd �Z
ddgd d gd!dgd"d#d$d!d%gd"d$d%gd&d'gd(gd)gd*�Z � fd+d,�Z d-d.� Z
� fd/d0�Z� fd1d2�Zd3d4� Z� fd5d6�Z� ZS )Ar i � i� r �versionr! r r �targetrF rI rM r FrR rn rK rT r= �
ingress_zones� egress_zones�_r �/Nr r r r r- )r r �policyr r z
icmp-blockz icmp-typer z forward-portr9 r r" r z source-portr r8 r( r) r* r+ r> z ingress-zonez egress-zonezto-portzto-addrr: r# r} r% r$ r7 r. r, r? )r� z forward-portr9 r r" r r) r> c s� t t| �j� d| _d| _d| _t| _g | _g | _ g | _
g | _ d| _ g | _
g | _d | _g | _g | _d| _| j| _d | _g | _g | _d S )Nr! F)�superr �__init__r� r r r r� rF rI rK rM r rR rT rq rh rg �applied�priority_defaultr= Zderived_from_zoner� r� )�self)� __class__rc rd r� � s( zPolicy.__init__c C s� d| _ d| _d| _t| _| jd d �= | jd d �= | jd d �= | jd d �= d| _ | j
d d �= | j d d �= d | _ | j
d d �= | jd d �= d| _| j| _| jd d �= | jd d �= d S )Nr! F)r� r r r r� rF rI rK rM r rR rT rq rh rg r� r� r= r� r� )r� rc rc rd �cleanup� s$ zPolicy.cleanupc s" |dkr| j S ttt| �|�S d S )Nrn )rg �getattrr� r )r� r )r� rc rd � __getattr__� s zPolicy.__getattr__c sB |dkr,dd� |D �| _ dd� | j D �| _ntt| �j||� d S )Nrn c S s g | ]}t j|d ��qS ))ro )r r] )�.0�src rc rd �
<listcomp>� s z&Policy.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS rc )rB )r� r� rc rc rd r� � s )rh rg r� r � __setattr__)r� r r )r� rc rd r� � s zPolicy.__setattr__c
C s t | |||� |dkr2|tkr.ttjd| ���n�|dkrz|| jksX|| jksX|| jk rvttjd|| j| j| jf ���n�|dk�rhddg}| j r�|| j j
� 7 }x�|D ]�}||kr�ttj d | ��|dkr�t ddg�t |�@ � s�|d k�rt |�t |g� �rttj d
| ��|dkr�|dk�r8d|k�r8d|d k�sT|dkr�d|kr�d|d kr�ttj d ��q�W �n�|d k�r|�rd|k�r�d|d k�r�ttj d
��nxd|k�rd|d k�r�ttj d��xR|d D ]F}|dk�rސq�| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �n�|dk�r4�x�|D �] }tj|d�}|j�r�t|jtj��r�d|k�r|d|d k�r|ttj d
��nxd|k�r,d|d k�r�ttj d��xR|d D ]F}|dk�r��q�| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �q,|j�r�t|jtj��r�d|k�r,d|d k�r@|jj�r�ttjd��nt|d �r,|jj�s`ttjd��d|d k�r,x�|d D ]8}| j j
|�}| j �rxd| j j|�k�rxttj d���qxW nv|j�r,t|jtj��r,d|k�r,xR|d D ]F}|d k�r�q�| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �q,W n�|dk�rx�|D ]�} d|k�rnd|d k�rnttj d��n�d|k�rDd|d k�r�| d �rttjd��nt|d �rD| d �s�ttjd��d|d k�rDxD|d D ]8}| j j
|�}| j �r�d| j j|�k�r�ttj d���q�W �qDW d S ) Nr� z'%s' is invalid targetr= zQ%d is invalid priority. Must be in range [%d, %d]. The following are reserved: %sr� r� �ANY�HOSTz '%s' not among existing zonesz>'%s' may only contain one of: many regular zones, ANY, or HOSTzF'HOST' can only appear in either ingress or egress zones, but not bothr z.'masquerade' is invalid for egress zone 'HOST'z/'masquerade' is invalid for ingress zone 'HOST'Z
interfaceszR'masquerade' cannot be used in a policy if an ingress zone has assigned interfacesrn )ro zAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonezS'forward-port' cannot be used in a policy if an egress zone has assigned interfaceszR'mark' action cannot be used in a policy if an egress zone has assigned interfacesrR z1'forward-port' is invalid for ingress zone 'HOST'rm )r� r� )r� r� )r� r� )r� r� )rw r r r �INVALID_TARGET�priority_reserved� priority_max� priority_minZINVALID_PRIORITYrq � get_zonesZ INVALID_ZONEr- Zget_zoneZget_zone_config_dictr r] rA rp rO rP r� rr rV rZ )
r� r rE rt Zexisting_zones�zoneZz_objr9 r_ rv rc rc rd �
_check_config� s�
"
zPolicy._check_configc s� t t| �j|� |jd�r,ttjd| ��n�|jd�rHttjd| ��n�|jd�dkrhttjd| ��njd|kr�|d |j d�� }n|}t
|�t � kr�ttjd|t
|�t � f ��| j r�|| j j
� kr�ttjd��d S )Nr� z'%s' can't start with '/'z'%s' can't end with '/'rk zmore than one '/' in '%s'z&Policy of '%s' has %d chars, max is %dz,Policies can't have the same name as a zone.)r� r �
check_name�
startswithr r � INVALID_NAME�endswith�count�find�lenr rq r� Z
NAME_CONFLICT)r� r Z checked_name)r� rc rd r� , s*
zPolicy.check_namei ���)r� r! )r r! )r r! )r� r! )r! r! )r F)r! r! r! r! )r! r! )r= r )�__name__�
__module__� __qualname__r� r� r
r� r� ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr� r� r� r� r� r� �
__classcell__rc rc )r� rd r Z sr
^c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�policy_ContentHandlerc C s" t j| |� d | _d| _d | _d S )NF)r r� r@ rC r[ )r� rE rc rc rd r� H s z policy_ContentHandler.__init__c C s t j| ||� | jrd S | jj||� t| ||�r6d S |dkr�d|krR|d | j_d|krjt|d �| j_d|kr�|d }|t kr�t
t j |��|r�|| j_
�n^|dkr�|d | jjkr�| jjj|d � ntjd|d � �n |dk�r |d | jjk�r| jjj|d � ntjd |d � n�|d
k�r�| j�sFtjd � d | _d S | jj�rltjd
t| j�� d | _d S d}d|k�r�|d j� dk�r�d }d } }}d|k�r�|d }d|k�r�|d }d|k�r�|d }tj||||d�| j_d S tjd|� d S d S )Nr� r� r= r� z ingress-zoner z(Ingress zone '%s' already set, ignoring.z egress-zonez'Egress zone '%s' already set, ignoring.r z$Invalid rule: Source outside of ruleTz:Invalid rule: More than one source in rule '%s', ignoring.Fr% r& r' r# r} r$ )r% zUnknown XML element '%s')r& r' )r r� rC rE Zparser_check_element_attrsre r� r\ r= r r r r� r� r� rG r r3 r� r@ r rB rU r Z Rich_Source)r� r r` r� r% r� r} r$ rc rc rd r� N sf
z"policy_ContentHandler.startElementc C s t j| |� t| |� d S )N)r r� rj )r� r rc rc rd r� � s z policy_ContentHandler.endElementN)r� r� r� r� r� r� rc rc rc rd r� G s @r� Fc
C s t � }| jd�s ttjd| ��| d d � |_|s>|j|j� | |_||_|j t
j �rZdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd| j� ��W Y d d } ~ X nX W d Q R X ~~|S )
Nz.xmlz'%s' is missing .xml suffix� FTz%s/%s�rbznot a valid policy file: %s���)r r� r r r� r r� �filename�pathr� r �
ETC_FIREWALLDZbuiltin�defaultr� �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionZINVALID_POLICYZ getException)
r� r� Z
no_check_namer� ry �parserr �fr �msgrc rc rd r � s6
(c
C s� |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� i }| j�r| jd k�r| j|d
< | j| jk�r0t| j�|d < | j|d < |jd
|� |jd� t| |� x8t| j �D ]*} |jd� |j dd| i� |jd� �qfW x8t| j �D ]*} |jd� |j dd| i� |jd� �q�W |j d
� |jd� |j � |j!� ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr! r� r= r� r� r| z z ingress-zoner z egress-zone)"r� r� r �os�exists�shutilZcopy2rf r r2 �dirnamer� r r� �mkdir�ior� r Z
startDocumentr� r= r� rB r� r� r� r� r r� rx r� r� Z endDocument�close)
r� r� �_pathr r� �dirpathr� ry r` r� rc rc rd r � sN
)F)N))�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r
Zfirewall.core.baser r r
Zfirewall.core.io.io_objectr r r r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr re rj rw r{ r� r r� r r rc rc rc rd �<module> s4
F [ nL
core/io/ipset.py 0000644 00000051205 15035135172 0007606 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2015-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""ipset io XML handler, reader, writer"""
__all__ = [ "IPSet", "ipset_reader", "ipset_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import checkIP, checkIP6, checkIPnMask, \
checkIP6nMask, u2b_if_py2, check_mac, check_port, checkInterface, \
checkProtocol
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator
from firewall.core.ipset import IPSET_TYPES, IPSET_CREATE_OPTIONS
from firewall.core.icmp import check_icmp_name, check_icmp_type, \
check_icmpv6_name, check_icmpv6_type
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class IPSet(IO_Object):
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ), # s
( "short", "" ), # s
( "description", "" ), # s
( "type", "" ), # s
( "options", { "": "", }, ), # a{ss}
( "entries", [ "" ], ), # as
)
DBUS_SIGNATURE = '(ssssa{ss}as)'
ADDITIONAL_ALNUM_CHARS = [ "_", "-", ":", "." ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"ipset": [ "type" ],
"option": [ "name" ],
"entry": None,
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"ipset": [ "version" ],
"option": [ "value" ],
}
def __init__(self):
super(IPSet, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.type = ""
self.entries = [ ]
self.options = { }
self.applied = False
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
self.type = ""
del self.entries[:]
self.options.clear()
self.applied = False
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.version = u2b_if_py2(self.version)
self.short = u2b_if_py2(self.short)
self.description = u2b_if_py2(self.description)
self.type = u2b_if_py2(self.type)
self.options = { u2b_if_py2(k):u2b_if_py2(v)
for k, v in self.options.items() }
self.entries = [ u2b_if_py2(e) for e in self.entries ]
@staticmethod
def check_entry(entry, options, ipset_type):
family = "ipv4"
if "family" in options:
if options["family"] == "inet6":
family = "ipv6"
if not ipset_type.startswith("hash:"):
raise FirewallError(errors.INVALID_IPSET,
"ipset type '%s' not usable" % ipset_type)
flags = ipset_type[5:].split(",")
items = entry.split(",")
if len(flags) != len(items) or len(flags) < 1:
raise FirewallError(
errors.INVALID_ENTRY,
"entry '%s' does not match ipset type '%s'" % \
(entry, ipset_type))
for i in range(len(flags)):
flag = flags[i]
item = items[i]
if flag == "ip":
if "-" in item and family == "ipv4":
# IP ranges only with plain IPs, no masks
if i > 1:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s'[%d]" % \
(item, entry, i))
splits = item.split("-")
if len(splits) != 2:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address range '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
for _split in splits:
if (family == "ipv4" and not checkIP(_split)) or \
(family == "ipv6" and not checkIP6(_split)):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(_split, entry, ipset_type, family))
else:
# IPs with mask only allowed in the first
# position of the type
if family == "ipv4":
if item == "0.0.0.0":
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
if i == 0:
ip_check = checkIPnMask
else:
ip_check = checkIP
else:
ip_check = checkIP6
if not ip_check(item):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
elif flag == "net":
if "-" in item:
# IP ranges only with plain IPs, no masks
splits = item.split("-")
if len(splits) != 2:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address range '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
# First part can only be a plain IP
if (family == "ipv4" and not checkIP(splits[0])) or \
(family == "ipv6" and not checkIP6(splits[0])):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(splits[0], entry, ipset_type, family))
# Second part can also have a mask
if (family == "ipv4" and not checkIPnMask(splits[1])) or \
(family == "ipv6" and not checkIP6nMask(splits[1])):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(splits[1], entry, ipset_type, family))
else:
# IPs with mask allowed in all positions, but no /0
if item.endswith("/0"):
if not (family == "ipv6" and i == 0 and
ipset_type == "hash:net,iface"):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
if (family == "ipv4" and not checkIPnMask(item)) or \
(family == "ipv6" and not checkIP6nMask(item)):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
elif flag == "mac":
# ipset does not allow to add 00:00:00:00:00:00
if not check_mac(item) or item == "00:00:00:00:00:00":
raise FirewallError(
errors.INVALID_ENTRY,
"invalid mac address '%s' in '%s'" % (item, entry))
elif flag == "port":
if ":" in item:
splits = item.split(":")
if len(splits) != 2:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid port '%s'" % (item))
if splits[0] == "icmp":
if family != "ipv4":
raise FirewallError(
errors.INVALID_ENTRY,
"invalid protocol for family '%s' in '%s'" % \
(family, entry))
if not check_icmp_name(splits[1]) and not \
check_icmp_type(splits[1]):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid icmp type '%s' in '%s'" % \
(splits[1], entry))
elif splits[0] in [ "icmpv6", "ipv6-icmp" ]:
if family != "ipv6":
raise FirewallError(
errors.INVALID_ENTRY,
"invalid protocol for family '%s' in '%s'" % \
(family, entry))
if not check_icmpv6_name(splits[1]) and not \
check_icmpv6_type(splits[1]):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid icmpv6 type '%s' in '%s'" % \
(splits[1], entry))
elif splits[0] not in [ "tcp", "sctp", "udp", "udplite" ] \
and not checkProtocol(splits[0]):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid protocol '%s' in '%s'" % (splits[0],
entry))
elif not check_port(splits[1]):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid port '%s'in '%s'" % (splits[1], entry))
else:
if not check_port(item):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid port '%s' in '%s'" % (item, entry))
elif flag == "mark":
if item.startswith("0x"):
try:
int_val = int(item, 16)
except ValueError:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid mark '%s' in '%s'" % (item, entry))
else:
try:
int_val = int(item)
except ValueError:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid mark '%s' in '%s'" % (item, entry))
if int_val < 0 or int_val > 4294967295:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid mark '%s' in '%s'" % (item, entry))
elif flag == "iface":
if not checkInterface(item) or len(item) > 15:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid interface '%s' in '%s'" % (item, entry))
else:
raise FirewallError(errors.INVALID_IPSET,
"ipset type '%s' not usable" % ipset_type)
def _check_config(self, config, item, all_config):
if item == "type":
if config not in IPSET_TYPES:
raise FirewallError(errors.INVALID_TYPE,
"'%s' is not valid ipset type" % config)
if item == "options":
for key in config.keys():
if key not in IPSET_CREATE_OPTIONS:
raise FirewallError(errors.INVALID_IPSET,
"ipset invalid option '%s'" % key)
if key in [ "timeout", "hashsize", "maxelem" ]:
try:
int_value = int(config[key])
except ValueError:
raise FirewallError(
errors.INVALID_VALUE,
"Option '%s': Value '%s' is not an integer" % \
(key, config[key]))
if int_value < 0:
raise FirewallError(
errors.INVALID_VALUE,
"Option '%s': Value '%s' is negative" % \
(key, config[key]))
elif key == "family" and \
config[key] not in [ "inet", "inet6" ]:
raise FirewallError(errors.INVALID_FAMILY, config[key])
def import_config(self, config):
if "timeout" in config[4] and config[4]["timeout"] != "0":
if len(config[5]) != 0:
raise FirewallError(errors.IPSET_WITH_TIMEOUT)
for entry in config[5]:
IPSet.check_entry(entry, config[4], config[3])
super(IPSet, self).import_config(config)
# PARSER
class ipset_ContentHandler(IO_Object_ContentHandler):
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "ipset":
if "type" in attrs:
if attrs["type"] not in IPSET_TYPES:
raise FirewallError(errors.INVALID_TYPE, "%s" % attrs["type"])
self.item.type = attrs["type"]
if "version" in attrs:
self.item.version = attrs["version"]
elif name == "short":
pass
elif name == "description":
pass
elif name == "option":
value = ""
if "value" in attrs:
value = attrs["value"]
if attrs["name"] not in \
[ "family", "timeout", "hashsize", "maxelem" ]:
raise FirewallError(
errors.INVALID_OPTION,
"Unknown option '%s'" % attrs["name"])
if self.item.type == "hash:mac" and attrs["name"] in [ "family" ]:
raise FirewallError(
errors.INVALID_OPTION,
"Unsupported option '%s' for type '%s'" % \
(attrs["name"], self.item.type))
if attrs["name"] in [ "family", "timeout", "hashsize", "maxelem" ] \
and not value:
raise FirewallError(
errors.INVALID_OPTION,
"Missing mandatory value of option '%s'" % attrs["name"])
if attrs["name"] in [ "timeout", "hashsize", "maxelem" ]:
try:
int_value = int(value)
except ValueError:
raise FirewallError(
errors.INVALID_VALUE,
"Option '%s': Value '%s' is not an integer" % \
(attrs["name"], value))
if int_value < 0:
raise FirewallError(
errors.INVALID_VALUE,
"Option '%s': Value '%s' is negative" % \
(attrs["name"], value))
if attrs["name"] == "family" and value not in [ "inet", "inet6" ]:
raise FirewallError(errors.INVALID_FAMILY, value)
if attrs["name"] not in self.item.options:
self.item.options[attrs["name"]] = value
else:
log.warning("Option %s already set, ignoring.", attrs["name"])
# nothing to do for entry and entries here
def endElement(self, name):
IO_Object_ContentHandler.endElement(self, name)
if name == "entry":
self.item.entries.append(self._element)
def ipset_reader(filename, path):
ipset = IPSet()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % filename)
ipset.name = filename[:-4]
ipset.check_name(ipset.name)
ipset.filename = filename
ipset.path = path
ipset.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
ipset.default = ipset.builtin
handler = ipset_ContentHandler(ipset)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_IPSET,
"not a valid ipset file: %s" % \
msg.getException())
del handler
del parser
if "timeout" in ipset.options and ipset.options["timeout"] != "0" and \
len(ipset.entries) > 0:
# no entries visible for ipsets with timeout
log.warning("ipset '%s': timeout option is set, entries are ignored",
ipset.name)
del ipset.entries[:]
i = 0
entries_set = set()
while i < len(ipset.entries):
if ipset.entries[i] in entries_set:
log.warning("Entry %s already set, ignoring.", ipset.entries[i])
ipset.entries.pop(i)
else:
try:
ipset.check_entry(ipset.entries[i], ipset.options, ipset.type)
except FirewallError as e:
log.warning("%s, ignoring.", e)
ipset.entries.pop(i)
else:
entries_set.add(ipset.entries[i])
i += 1
del entries_set
if PY2:
ipset.encode_strings()
return ipset
def ipset_writer(ipset, path=None):
_path = path if path else ipset.path
if ipset.filename:
name = "%s/%s" % (_path, ipset.filename)
else:
name = "%s/%s.xml" % (_path, ipset.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start ipset element
attrs = { "type": ipset.type }
if ipset.version and ipset.version != "":
attrs["version"] = ipset.version
handler.startElement("ipset", attrs)
handler.ignorableWhitespace("\n")
# short
if ipset.short and ipset.short != "":
handler.ignorableWhitespace(" ")
handler.startElement("short", { })
handler.characters(ipset.short)
handler.endElement("short")
handler.ignorableWhitespace("\n")
# description
if ipset.description and ipset.description != "":
handler.ignorableWhitespace(" ")
handler.startElement("description", { })
handler.characters(ipset.description)
handler.endElement("description")
handler.ignorableWhitespace("\n")
# options
for key,value in ipset.options.items():
handler.ignorableWhitespace(" ")
if value != "":
handler.simpleElement("option", { "name": key, "value": value })
else:
handler.simpleElement("option", { "name": key })
handler.ignorableWhitespace("\n")
# entries
for entry in ipset.entries:
handler.ignorableWhitespace(" ")
handler.startElement("entry", { })
handler.characters(entry)
handler.endElement("entry")
handler.ignorableWhitespace("\n")
# end ipset element
handler.endElement('ipset')
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
core/io/policy.py 0000644 00000121317 15035135172 0007763 0 ustar 00 # -*- coding: utf-8 -*-
#
# SPDX-License-Identifier: GPL-2.0-or-later
__all__ = [ "Policy", "policy_reader", "policy_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import checkIP, checkIP6
from firewall.functions import uniqify, max_policy_name_len, portStr
from firewall.core.base import DEFAULT_POLICY_TARGET, POLICY_TARGETS, DEFAULT_POLICY_PRIORITY
from firewall.core.io.io_object import IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \
check_tcpudp, check_protocol
from firewall.core import rich
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
def common_startElement(obj, name, attrs):
if name == "short":
pass
elif name == "description":
pass
elif name == "service":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_Service(attrs["name"])
return True
if attrs["name"] not in obj.item.services:
obj.item.services.append(attrs["name"])
else:
log.warning("Service '%s' already set, ignoring.",
attrs["name"])
elif name == "port":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_Port(attrs["port"],
attrs["protocol"])
return True
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
entry = (portStr(attrs["port"], "-"), attrs["protocol"])
if entry not in obj.item.ports:
obj.item.ports.append(entry)
else:
log.warning("Port '%s/%s' already set, ignoring.",
attrs["port"], attrs["protocol"])
elif name == "protocol":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_Protocol(attrs["value"])
else:
check_protocol(attrs["value"])
if attrs["value"] not in obj.item.protocols:
obj.item.protocols.append(attrs["value"])
else:
log.warning("Protocol '%s' already set, ignoring.",
attrs["value"])
elif name == "icmp-block":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_IcmpBlock(attrs["name"])
return True
if attrs["name"] not in obj.item.icmp_blocks:
obj.item.icmp_blocks.append(attrs["name"])
else:
log.warning("icmp-block '%s' already set, ignoring.",
attrs["name"])
elif name == "icmp-type":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_IcmpType(attrs["name"])
return True
else:
log.warning("Invalid rule: icmp-block '%s' outside of rule",
attrs["name"])
elif name == "masquerade":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_Masquerade()
else:
if obj.item.masquerade:
log.warning("Masquerade already set, ignoring.")
else:
obj.item.masquerade = True
elif name == "forward-port":
to_port = ""
if "to-port" in attrs:
to_port = attrs["to-port"]
to_addr = ""
if "to-addr" in attrs:
to_addr = attrs["to-addr"]
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_ForwardPort(attrs["port"],
attrs["protocol"],
to_port, to_addr)
return True
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
if to_port:
check_port(to_port)
if to_addr:
if not checkIP(to_addr) and not checkIP6(to_addr):
raise FirewallError(errors.INVALID_ADDR,
"to-addr '%s' is not a valid address" \
% to_addr)
entry = (portStr(attrs["port"], "-"), attrs["protocol"],
portStr(to_port, "-"), str(to_addr))
if entry not in obj.item.forward_ports:
obj.item.forward_ports.append(entry)
else:
log.warning("Forward port %s/%s%s%s already set, ignoring.",
attrs["port"], attrs["protocol"],
" >%s" % to_port if to_port else "",
" @%s" % to_addr if to_addr else "")
elif name == "source-port":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_SourcePort(attrs["port"],
attrs["protocol"])
return True
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
entry = (portStr(attrs["port"], "-"), attrs["protocol"])
if entry not in obj.item.source_ports:
obj.item.source_ports.append(entry)
else:
log.warning("Source port '%s/%s' already set, ignoring.",
attrs["port"], attrs["protocol"])
elif name == "destination":
if not obj._rule:
log.warning('Invalid rule: Destination outside of rule')
obj._rule_error = True
return True
if obj._rule.destination:
log.warning("Invalid rule: More than one destination in rule '%s', ignoring.",
str(obj._rule))
return True
invert = False
address = None
if "address" in attrs:
address = attrs["address"]
ipset = None
if "ipset" in attrs:
ipset = attrs["ipset"]
if "invert" in attrs and \
attrs["invert"].lower() in [ "yes", "true" ]:
invert = True
obj._rule.destination = rich.Rich_Destination(address,
ipset,
invert)
elif name in [ "accept", "reject", "drop", "mark" ]:
if not obj._rule:
log.warning('Invalid rule: Action outside of rule')
obj._rule_error = True
return True
if obj._rule.action:
log.warning('Invalid rule: More than one action')
obj._rule_error = True
return True
if name == "accept":
obj._rule.action = rich.Rich_Accept()
elif name == "reject":
_type = None
if "type" in attrs:
_type = attrs["type"]
obj._rule.action = rich.Rich_Reject(_type)
elif name == "drop":
obj._rule.action = rich.Rich_Drop()
elif name == "mark":
_set = attrs["set"]
obj._rule.action = rich.Rich_Mark(_set)
obj._limit_ok = obj._rule.action
elif name == "log":
if not obj._rule:
log.warning('Invalid rule: Log outside of rule')
return True
if obj._rule.log:
log.warning('Invalid rule: More than one log')
return True
level = None
if "level" in attrs:
level = attrs["level"]
if level not in [ "emerg", "alert", "crit", "error",
"warning", "notice", "info", "debug" ]:
log.warning('Invalid rule: Invalid log level')
obj._rule_error = True
return True
prefix = attrs["prefix"] if "prefix" in attrs else None
obj._rule.log = rich.Rich_Log(prefix, level)
obj._limit_ok = obj._rule.log
elif name == "audit":
if not obj._rule:
log.warning('Invalid rule: Audit outside of rule')
return True
if obj._rule.audit:
log.warning("Invalid rule: More than one audit in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.audit = rich.Rich_Audit()
obj._limit_ok = obj._rule.audit
elif name == "rule":
family = None
priority = 0
if "family" in attrs:
family = attrs["family"]
if family not in [ "ipv4", "ipv6" ]:
log.warning('Invalid rule: Rule family "%s" invalid',
attrs["family"])
obj._rule_error = True
return True
if "priority" in attrs:
priority = int(attrs["priority"])
obj._rule = rich.Rich_Rule(family=family, priority=priority)
elif name == "limit":
if not obj._limit_ok:
log.warning('Invalid rule: Limit outside of action, log and audit')
obj._rule_error = True
return True
if obj._limit_ok.limit:
log.warning("Invalid rule: More than one limit in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
value = attrs["value"]
obj._limit_ok.limit = rich.Rich_Limit(value, attrs.get("burst"))
else:
return False
return True
def common_endElement(obj, name):
if name == "rule":
if not obj._rule_error:
try:
obj._rule.check()
except Exception as e:
log.warning("%s: %s", e, str(obj._rule))
else:
if str(obj._rule) not in obj.item.rules_str:
obj.item.rules.append(obj._rule)
obj.item.rules_str.append(str(obj._rule))
else:
log.warning("Rule '%s' already set, ignoring.",
str(obj._rule))
obj._rule = None
obj._rule_error = False
elif name in [ "accept", "reject", "drop", "mark", "log", "audit" ]:
obj._limit_ok = None
def common_check_config(obj, config, item, all_config):
obj_type = "Policy" if isinstance(obj, Policy) else "Zone"
if item == "services" and obj.fw_config:
existing_services = obj.fw_config.get_services()
for service in config:
if service not in existing_services:
raise FirewallError(errors.INVALID_SERVICE,
"'%s' not among existing services" % \
service)
elif item == "ports":
for port in config:
check_port(port[0])
check_tcpudp(port[1])
elif item == "protocols":
for proto in config:
check_protocol(proto)
elif item == "icmp_blocks" and obj.fw_config:
existing_icmptypes = obj.fw_config.get_icmptypes()
for icmptype in config:
if icmptype not in existing_icmptypes:
raise FirewallError(errors.INVALID_ICMPTYPE,
"'%s' not among existing icmp types" % \
icmptype)
elif item == "forward_ports":
for fwd_port in config:
check_port(fwd_port[0])
check_tcpudp(fwd_port[1])
if not fwd_port[2] and not fwd_port[3]:
raise FirewallError(
errors.INVALID_FORWARD,
"'%s' is missing to-port AND to-addr " % fwd_port)
if fwd_port[2]:
check_port(fwd_port[2])
if fwd_port[3]:
if not checkIP(fwd_port[3]) and not checkIP6(fwd_port[3]):
raise FirewallError(
errors.INVALID_ADDR,
"to-addr '%s' is not a valid address" % fwd_port[3])
elif item == "source_ports":
for port in config:
check_port(port[0])
check_tcpudp(port[1])
elif item in ["rules_str", "rich_rules"]:
for rule in config:
obj_rich = rich.Rich_Rule(rule_str=rule)
if obj.fw_config and obj_rich.element and (isinstance(obj_rich.element, rich.Rich_IcmpBlock) or
isinstance(obj_rich.element, rich.Rich_IcmpType)):
existing_icmptypes = obj.fw_config.get_icmptypes()
if obj_rich.element.name not in existing_icmptypes:
raise FirewallError(errors.INVALID_ICMPTYPE,
"'%s' not among existing icmp types" % \
obj_rich.element.name)
elif obj_rich.family:
ict = obj.fw_config.get_icmptype(obj_rich.element.name)
if ict.destination and obj_rich.family not in ict.destination:
raise FirewallError(errors.INVALID_ICMPTYPE,
"rich rule family '%s' conflicts with icmp type '%s'" % \
(obj_rich.family, obj_rich.element.name))
elif obj.fw_config and isinstance(obj_rich.element, rich.Rich_Service):
existing_services = obj.fw_config.get_services()
if obj_rich.element.name not in existing_services:
raise FirewallError(
errors.INVALID_SERVICE,
"{} '{}': '{}' not among existing services".format(
obj_type, obj.name, obj_rich.element.name
),
)
def _handler_add_rich_limit(handler, limit):
d = {"value": limit.value}
burst = limit.burst
if burst is not None:
d["burst"] = burst
handler.simpleElement("limit", d)
def common_writer(obj, handler):
# short
if obj.short and obj.short != "":
handler.ignorableWhitespace(" ")
handler.startElement("short", { })
handler.characters(obj.short)
handler.endElement("short")
handler.ignorableWhitespace("\n")
# description
if obj.description and obj.description != "":
handler.ignorableWhitespace(" ")
handler.startElement("description", { })
handler.characters(obj.description)
handler.endElement("description")
handler.ignorableWhitespace("\n")
# services
for service in uniqify(obj.services):
handler.ignorableWhitespace(" ")
handler.simpleElement("service", { "name": service })
handler.ignorableWhitespace("\n")
# ports
for port in uniqify(obj.ports):
handler.ignorableWhitespace(" ")
handler.simpleElement("port", { "port": port[0], "protocol": port[1] })
handler.ignorableWhitespace("\n")
# protocols
for protocol in uniqify(obj.protocols):
handler.ignorableWhitespace(" ")
handler.simpleElement("protocol", { "value": protocol })
handler.ignorableWhitespace("\n")
# icmp-blocks
for icmp in uniqify(obj.icmp_blocks):
handler.ignorableWhitespace(" ")
handler.simpleElement("icmp-block", { "name": icmp })
handler.ignorableWhitespace("\n")
# masquerade
if obj.masquerade:
handler.ignorableWhitespace(" ")
handler.simpleElement("masquerade", { })
handler.ignorableWhitespace("\n")
# forward-ports
for forward in uniqify(obj.forward_ports):
handler.ignorableWhitespace(" ")
attrs = { "port": forward[0], "protocol": forward[1] }
if forward[2] and forward[2] != "" :
attrs["to-port"] = forward[2]
if forward[3] and forward[3] != "" :
attrs["to-addr"] = forward[3]
handler.simpleElement("forward-port", attrs)
handler.ignorableWhitespace("\n")
# source-ports
for port in uniqify(obj.source_ports):
handler.ignorableWhitespace(" ")
handler.simpleElement("source-port", { "port": port[0],
"protocol": port[1] })
handler.ignorableWhitespace("\n")
# rules
for rule in obj.rules:
attrs = { }
if rule.family:
attrs["family"] = rule.family
if rule.priority != 0:
attrs["priority"] = str(rule.priority)
handler.ignorableWhitespace(" ")
handler.startElement("rule", attrs)
handler.ignorableWhitespace("\n")
# source
if rule.source:
attrs = { }
if rule.source.addr:
attrs["address"] = rule.source.addr
if rule.source.mac:
attrs["mac"] = rule.source.mac
if rule.source.ipset:
attrs["ipset"] = rule.source.ipset
if rule.source.invert:
attrs["invert"] = "True"
handler.ignorableWhitespace(" ")
handler.simpleElement("source", attrs)
handler.ignorableWhitespace("\n")
# destination
if rule.destination:
attrs = { }
if rule.destination.addr:
attrs["address"] = rule.destination.addr
if rule.destination.ipset:
attrs["ipset"] = rule.destination.ipset
if rule.destination.invert:
attrs["invert"] = "True"
handler.ignorableWhitespace(" ")
handler.simpleElement("destination", attrs)
handler.ignorableWhitespace("\n")
# element
if rule.element:
element = ""
attrs = { }
if type(rule.element) == rich.Rich_Service:
element = "service"
attrs["name"] = rule.element.name
elif type(rule.element) == rich.Rich_Port:
element = "port"
attrs["port"] = rule.element.port
attrs["protocol"] = rule.element.protocol
elif type(rule.element) == rich.Rich_Protocol:
element = "protocol"
attrs["value"] = rule.element.value
elif type(rule.element) == rich.Rich_Masquerade:
element = "masquerade"
elif type(rule.element) == rich.Rich_IcmpBlock:
element = "icmp-block"
attrs["name"] = rule.element.name
elif type(rule.element) == rich.Rich_IcmpType:
element = "icmp-type"
attrs["name"] = rule.element.name
elif type(rule.element) == rich.Rich_ForwardPort:
element = "forward-port"
attrs["port"] = rule.element.port
attrs["protocol"] = rule.element.protocol
if rule.element.to_port != "":
attrs["to-port"] = rule.element.to_port
if rule.element.to_address != "":
attrs["to-addr"] = rule.element.to_address
elif type(rule.element) == rich.Rich_SourcePort:
element = "source-port"
attrs["port"] = rule.element.port
attrs["protocol"] = rule.element.protocol
else:
raise FirewallError(
errors.INVALID_OBJECT,
"Unknown element '%s' in obj_writer" % type(rule.element))
handler.ignorableWhitespace(" ")
handler.simpleElement(element, attrs)
handler.ignorableWhitespace("\n")
# rule.element
# log
if rule.log:
attrs = { }
if rule.log.prefix:
attrs["prefix"] = rule.log.prefix
if rule.log.level:
attrs["level"] = rule.log.level
if rule.log.limit:
handler.ignorableWhitespace(" ")
handler.startElement("log", attrs)
handler.ignorableWhitespace("\n ")
_handler_add_rich_limit(handler, rule.log.limit)
handler.ignorableWhitespace("\n ")
handler.endElement("log")
else:
handler.ignorableWhitespace(" ")
handler.simpleElement("log", attrs)
handler.ignorableWhitespace("\n")
# audit
if rule.audit:
attrs = {}
if rule.audit.limit:
handler.ignorableWhitespace(" ")
handler.startElement("audit", { })
handler.ignorableWhitespace("\n ")
_handler_add_rich_limit(handler, rule.audit.limit)
handler.ignorableWhitespace("\n ")
handler.endElement("audit")
else:
handler.ignorableWhitespace(" ")
handler.simpleElement("audit", attrs)
handler.ignorableWhitespace("\n")
# action
if rule.action:
action = ""
attrs = { }
if type(rule.action) == rich.Rich_Accept:
action = "accept"
elif type(rule.action) == rich.Rich_Reject:
action = "reject"
if rule.action.type:
attrs["type"] = rule.action.type
elif type(rule.action) == rich.Rich_Drop:
action = "drop"
elif type(rule.action) == rich.Rich_Mark:
action = "mark"
attrs["set"] = rule.action.set
else:
log.warning("Unknown action '%s'", type(rule.action))
if rule.action.limit:
handler.ignorableWhitespace(" ")
handler.startElement(action, attrs)
handler.ignorableWhitespace("\n ")
_handler_add_rich_limit(handler, rule.action.limit)
handler.ignorableWhitespace("\n ")
handler.endElement(action)
else:
handler.ignorableWhitespace(" ")
handler.simpleElement(action, attrs)
handler.ignorableWhitespace("\n")
handler.ignorableWhitespace(" ")
handler.endElement("rule")
handler.ignorableWhitespace("\n")
class Policy(IO_Object):
priority_min = -32768
priority_max = 32767
priority_default = DEFAULT_POLICY_PRIORITY
priority_reserved = [0]
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ), # s
( "short", "" ), # s
( "description", "" ), # s
( "target", "" ), # s
( "services", [ "", ], ), # as
( "ports", [ ( "", "" ), ], ), # a(ss)
( "icmp_blocks", [ "", ], ), # as
( "masquerade", False ), # b
( "forward_ports", [ ( "", "", "", "" ), ], ), # a(ssss)
( "rich_rules", [ "" ] ), # as
( "protocols", [ "", ], ), # as
( "source_ports", [ ( "", "" ), ], ), # a(ss)
( "priority", 0 ), # i
( "ingress_zones", [ "" ] ), # as
( "egress_zones", [ "" ] ), # as
)
ADDITIONAL_ALNUM_CHARS = [ "_", "-", "/" ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"policy": ["target"],
"service": [ "name" ],
"port": [ "port", "protocol" ],
"icmp-block": [ "name" ],
"icmp-type": [ "name" ],
"masquerade": None,
"forward-port": [ "port", "protocol" ],
"rule": None,
"source": None,
"destination": None,
"protocol": [ "value" ],
"source-port": [ "port", "protocol" ],
"log": None,
"audit": None,
"accept": None,
"reject": None,
"drop": None,
"mark": [ "set" ],
"limit": [ "value" ],
"ingress-zone": [ "name" ],
"egress-zone": [ "name" ],
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"policy": [ "version", "priority" ],
"forward-port": [ "to-port", "to-addr" ],
"rule": [ "family", "priority" ],
"source": [ "address", "mac", "invert", "family", "ipset" ],
"destination": [ "address", "invert", "ipset" ],
"log": [ "prefix", "level" ],
"reject": [ "type" ],
"limit": ["burst"],
}
def __init__(self):
super(Policy, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.target = DEFAULT_POLICY_TARGET
self.services = [ ]
self.ports = [ ]
self.protocols = [ ]
self.icmp_blocks = [ ]
self.masquerade = False
self.forward_ports = [ ]
self.source_ports = [ ]
self.fw_config = None # to be able to check services and a icmp_blocks
self.rules = [ ]
self.rules_str = [ ]
self.applied = False
self.priority = self.priority_default
self.derived_from_zone = None
self.ingress_zones = []
self.egress_zones = []
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
self.target = DEFAULT_POLICY_TARGET
del self.services[:]
del self.ports[:]
del self.protocols[:]
del self.icmp_blocks[:]
self.masquerade = False
del self.forward_ports[:]
del self.source_ports[:]
self.fw_config = None # to be able to check services and a icmp_blocks
del self.rules[:]
del self.rules_str[:]
self.applied = False
self.priority = self.priority_default
del self.ingress_zones[:]
del self.egress_zones[:]
def __getattr__(self, name):
if name == "rich_rules":
return self.rules_str
else:
return getattr(super(Policy, self), name)
def __setattr__(self, name, value):
if name == "rich_rules":
self.rules = [rich.Rich_Rule(rule_str=s) for s in value]
# must convert back to string to get the canonical string.
self.rules_str = [str(s) for s in self.rules]
else:
super(Policy, self).__setattr__(name, value)
def _check_config(self, config, item, all_config):
common_check_config(self, config, item, all_config)
if item == "target":
if config not in POLICY_TARGETS:
raise FirewallError(errors.INVALID_TARGET, "'%s' is invalid target" % (config))
elif item == "priority":
if config in self.priority_reserved or \
config > self.priority_max or \
config < self.priority_min:
raise FirewallError(errors.INVALID_PRIORITY, "%d is invalid priority. Must be in range [%d, %d]. The following are reserved: %s" %
(config, self.priority_min, self.priority_max, self.priority_reserved))
elif item in ["ingress_zones", "egress_zones"]:
existing_zones = ["ANY", "HOST"]
if self.fw_config:
existing_zones += self.fw_config.get_zones()
for zone in config:
if zone not in existing_zones:
raise FirewallError(errors.INVALID_ZONE,
"'%s' not among existing zones" % (zone))
if ((zone not in ["ANY", "HOST"] and (set(["ANY", "HOST"]) & set(config))) or \
(zone in ["ANY", "HOST"] and (set(config) - set([zone])))):
raise FirewallError(errors.INVALID_ZONE,
"'%s' may only contain one of: many regular zones, ANY, or HOST" % (item))
if zone == "HOST" and \
((item == "ingress_zones" and "egress_zones" in all_config and "HOST" in all_config["egress_zones"]) or \
(item == "egress_zones" and "ingress_zones" in all_config and "HOST" in all_config["ingress_zones"])):
raise FirewallError(errors.INVALID_ZONE,
"'HOST' can only appear in either ingress or egress zones, but not both")
elif item == "masquerade" and config:
if "egress_zones" in all_config and "HOST" in all_config["egress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for egress zone 'HOST'")
elif "ingress_zones" in all_config:
if "HOST" in all_config["ingress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for ingress zone 'HOST'")
for zone in all_config["ingress_zones"]:
if zone == "ANY":
continue
z_obj = self.fw_config.get_zone(zone)
if self.fw_config and "interfaces" in self.fw_config.get_zone_config_dict(z_obj):
raise FirewallError(errors.INVALID_ZONE, "'masquerade' cannot be used in a policy if an ingress zone has assigned interfaces")
elif item == "rich_rules":
for rule in config:
obj = rich.Rich_Rule(rule_str=rule)
if obj.element and isinstance(obj.element, rich.Rich_Masquerade):
if "egress_zones" in all_config and "HOST" in all_config["egress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for egress zone 'HOST'")
elif "ingress_zones" in all_config:
if "HOST" in all_config["ingress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for ingress zone 'HOST'")
for zone in all_config["ingress_zones"]:
if zone == "ANY":
continue
z_obj = self.fw_config.get_zone(zone)
if self.fw_config and "interfaces" in self.fw_config.get_zone_config_dict(z_obj):
raise FirewallError(errors.INVALID_ZONE, "'masquerade' cannot be used in a policy if an ingress zone has assigned interfaces")
elif obj.element and isinstance(obj.element, rich.Rich_ForwardPort):
if "egress_zones" in all_config:
if "HOST" in all_config["egress_zones"]:
if obj.element.to_address:
raise FirewallError(errors.INVALID_FORWARD, "A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'")
elif all_config["egress_zones"]:
if not obj.element.to_address:
raise FirewallError(errors.INVALID_FORWARD, "'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone")
if "ANY" not in all_config["egress_zones"]:
for zone in all_config["egress_zones"]:
z_obj = self.fw_config.get_zone(zone)
if self.fw_config and "interfaces" in self.fw_config.get_zone_config_dict(z_obj):
raise FirewallError(errors.INVALID_ZONE, "'forward-port' cannot be used in a policy if an egress zone has assigned interfaces")
elif obj.action and isinstance(obj.action, rich.Rich_Mark):
if "egress_zones" in all_config:
for zone in all_config["egress_zones"]:
if zone in ["ANY", "HOST"]:
continue
z_obj = self.fw_config.get_zone(zone)
if self.fw_config and "interfaces" in self.fw_config.get_zone_config_dict(z_obj):
raise FirewallError(errors.INVALID_ZONE, "'mark' action cannot be used in a policy if an egress zone has assigned interfaces")
elif item == "forward_ports":
for fwd_port in config:
if "ingress_zones" in all_config and "HOST" in all_config["ingress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'forward-port' is invalid for ingress zone 'HOST'")
elif "egress_zones" in all_config:
if "HOST" in all_config["egress_zones"]:
if fwd_port[3]:
raise FirewallError(errors.INVALID_FORWARD, "A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'")
elif all_config["egress_zones"]:
if not fwd_port[3]:
raise FirewallError(errors.INVALID_FORWARD, "'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone")
if "ANY" not in all_config["egress_zones"]:
for zone in all_config["egress_zones"]:
z_obj = self.fw_config.get_zone(zone)
if self.fw_config and "interfaces" in self.fw_config.get_zone_config_dict(z_obj):
raise FirewallError(errors.INVALID_ZONE, "'forward-port' cannot be used in a policy if an egress zone has assigned interfaces")
def check_name(self, name):
super(Policy, self).check_name(name)
if name.startswith('/'):
raise FirewallError(errors.INVALID_NAME,
"'%s' can't start with '/'" % name)
elif name.endswith('/'):
raise FirewallError(errors.INVALID_NAME,
"'%s' can't end with '/'" % name)
elif name.count('/') > 1:
raise FirewallError(errors.INVALID_NAME,
"more than one '/' in '%s'" % name)
else:
if "/" in name:
checked_name = name[:name.find('/')]
else:
checked_name = name
if len(checked_name) > max_policy_name_len():
raise FirewallError(errors.INVALID_NAME,
"Policy of '%s' has %d chars, max is %d" % (
name, len(checked_name),
max_policy_name_len()))
if self.fw_config:
if checked_name in self.fw_config.get_zones():
raise FirewallError(errors.NAME_CONFLICT, "Policies can't have the same name as a zone.")
# PARSER
class policy_ContentHandler(IO_Object_ContentHandler):
def __init__(self, item):
IO_Object_ContentHandler.__init__(self, item)
self._rule = None
self._rule_error = False
self._limit_ok = None
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
if self._rule_error:
return
self.item.parser_check_element_attrs(name, attrs)
if common_startElement(self, name, attrs):
return
elif name == "policy":
if "version" in attrs:
self.item.version = attrs["version"]
if "priority" in attrs:
self.item.priority = int(attrs["priority"])
if "target" in attrs:
target = attrs["target"]
if target not in POLICY_TARGETS:
raise FirewallError(errors.INVALID_TARGET, target)
if target:
self.item.target = target
elif name == "ingress-zone":
if attrs["name"] not in self.item.ingress_zones:
self.item.ingress_zones.append(attrs["name"])
else:
log.warning("Ingress zone '%s' already set, ignoring.", attrs["name"])
elif name == "egress-zone":
if attrs["name"] not in self.item.egress_zones:
self.item.egress_zones.append(attrs["name"])
else:
log.warning("Egress zone '%s' already set, ignoring.", attrs["name"])
elif name == "source":
if not self._rule:
log.warning('Invalid rule: Source outside of rule')
self._rule_error = True
return
if self._rule.source:
log.warning("Invalid rule: More than one source in rule '%s', ignoring.",
str(self._rule))
self._rule_error = True
return
invert = False
if "invert" in attrs and \
attrs["invert"].lower() in [ "yes", "true" ]:
invert = True
addr = mac = ipset = None
if "address" in attrs:
addr = attrs["address"]
if "mac" in attrs:
mac = attrs["mac"]
if "ipset" in attrs:
ipset = attrs["ipset"]
self._rule.source = rich.Rich_Source(addr, mac, ipset,
invert=invert)
return
else:
log.warning("Unknown XML element '%s'", name)
return
def endElement(self, name):
IO_Object_ContentHandler.endElement(self, name)
common_endElement(self, name)
def policy_reader(filename, path, no_check_name=False):
policy = Policy()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % filename)
policy.name = filename[:-4]
if not no_check_name:
policy.check_name(policy.name)
policy.filename = filename
policy.path = path
policy.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
policy.default = policy.builtin
handler = policy_ContentHandler(policy)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_POLICY,
"not a valid policy file: %s" % \
msg.getException())
del handler
del parser
return policy
def policy_writer(policy, path=None):
_path = path if path else policy.path
if policy.filename:
name = "%s/%s" % (_path, policy.filename)
else:
name = "%s/%s.xml" % (_path, policy.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start policy element
attrs = {}
if policy.version and policy.version != "":
attrs["version"] = policy.version
if policy.priority != policy.priority_default:
attrs["priority"] = str(policy.priority)
attrs["target"] = policy.target
handler.startElement("policy", attrs)
handler.ignorableWhitespace("\n")
common_writer(policy, handler)
# ingress-zones
for zone in uniqify(policy.ingress_zones):
handler.ignorableWhitespace(" ")
handler.simpleElement("ingress-zone", { "name": zone })
handler.ignorableWhitespace("\n")
# egress-zones
for zone in uniqify(policy.egress_zones):
handler.ignorableWhitespace(" ")
handler.simpleElement("egress-zone", { "name": zone })
handler.ignorableWhitespace("\n")
# end policy element
handler.endElement("policy")
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
core/io/lockdown_whitelist.py 0000644 00000030647 15035135172 0012405 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator
from firewall.core.logger import log
from firewall.functions import uniqify, checkUser, checkUid, checkCommand, \
checkContext, u2b_if_py2
from firewall import errors
from firewall.errors import FirewallError
class lockdown_whitelist_ContentHandler(IO_Object_ContentHandler):
def __init__(self, item):
IO_Object_ContentHandler.__init__(self, item)
self.whitelist = False
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "whitelist":
if self.whitelist:
raise FirewallError(errors.PARSE_ERROR,
"More than one whitelist.")
self.whitelist = True
elif name == "command":
if not self.whitelist:
log.error("Parse Error: command outside of whitelist")
return
command = attrs["name"]
self.item.add_command(command)
elif name == "user":
if not self.whitelist:
log.error("Parse Error: user outside of whitelist")
return
if "id" in attrs:
try:
uid = int(attrs["id"])
except ValueError:
log.error("Parse Error: %s is not a valid uid" %
attrs["id"])
return
self.item.add_uid(uid)
elif "name" in attrs:
self.item.add_user(attrs["name"])
elif name == "selinux":
if not self.whitelist:
log.error("Parse Error: selinux outside of whitelist")
return
if "context" not in attrs:
log.error("Parse Error: no context")
return
self.item.add_context(attrs["context"])
else:
log.error('Unknown XML element %s' % name)
return
class LockdownWhitelist(IO_Object):
""" LockdownWhitelist class """
IMPORT_EXPORT_STRUCTURE = (
( "commands", [ "" ] ), # as
( "contexts", [ "" ] ), # as
( "users", [ "" ] ), # as
( "uids", [ 0 ] ) # ai
)
DBUS_SIGNATURE = '(asasasai)'
ADDITIONAL_ALNUM_CHARS = [ "_" ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"whitelist": None,
"command": [ "name" ],
"user": None,
# "group": None,
"selinux": [ "context" ],
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"user": [ "id", "name" ],
# "group": [ "id", "name" ],
}
def __init__(self, filename):
super(LockdownWhitelist, self).__init__()
self.filename = filename
self.parser = None
self.commands = [ ]
self.contexts = [ ]
self.users = [ ]
self.uids = [ ]
# self.gids = [ ]
# self.groups = [ ]
def _check_config(self, config, item, all_config):
if item in [ "commands", "contexts", "users", "uids" ]:
for x in config:
self._check_config(x, item[:-1], all_config)
elif item == "command":
if not checkCommand(config):
raise FirewallError(errors.INVALID_COMMAND, config)
elif item == "context":
if not checkContext(config):
raise FirewallError(errors.INVALID_CONTEXT, config)
elif item == "user":
if not checkUser(config):
raise FirewallError(errors.INVALID_USER, config)
elif item == "uid":
if not checkUid(config):
raise FirewallError(errors.INVALID_UID, config)
def cleanup(self):
del self.commands[:]
del self.contexts[:]
del self.users[:]
del self.uids[:]
# del self.gids[:]
# del self.groups[:]
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.commands = [ u2b_if_py2(x) for x in self.commands ]
self.contexts = [ u2b_if_py2(x) for x in self.contexts ]
self.users = [ u2b_if_py2(x) for x in self.users ]
# commands
def add_command(self, command):
if not checkCommand(command):
raise FirewallError(errors.INVALID_COMMAND, command)
if command not in self.commands:
self.commands.append(command)
else:
raise FirewallError(errors.ALREADY_ENABLED,
'Command "%s" already in whitelist' % command)
def remove_command(self, command):
if command in self.commands:
self.commands.remove(command)
else:
raise FirewallError(errors.NOT_ENABLED,
'Command "%s" not in whitelist.' % command)
def has_command(self, command):
return (command in self.commands)
def match_command(self, command):
for _command in self.commands:
if _command.endswith("*"):
if command.startswith(_command[:-1]):
return True
else:
if _command == command:
return True
return False
def get_commands(self):
return self.commands
# user ids
def add_uid(self, uid):
if not checkUid(uid):
raise FirewallError(errors.INVALID_UID, str(uid))
if uid not in self.uids:
self.uids.append(uid)
else:
raise FirewallError(errors.ALREADY_ENABLED,
'Uid "%s" already in whitelist' % uid)
def remove_uid(self, uid):
if uid in self.uids:
self.uids.remove(uid)
else:
raise FirewallError(errors.NOT_ENABLED,
'Uid "%s" not in whitelist.' % uid)
def has_uid(self, uid):
return (uid in self.uids)
def match_uid(self, uid):
return (uid in self.uids)
def get_uids(self):
return self.uids
# users
def add_user(self, user):
if not checkUser(user):
raise FirewallError(errors.INVALID_USER, user)
if user not in self.users:
self.users.append(user)
else:
raise FirewallError(errors.ALREADY_ENABLED,
'User "%s" already in whitelist' % user)
def remove_user(self, user):
if user in self.users:
self.users.remove(user)
else:
raise FirewallError(errors.NOT_ENABLED,
'User "%s" not in whitelist.' % user)
def has_user(self, user):
return (user in self.users)
def match_user(self, user):
return (user in self.users)
def get_users(self):
return self.users
# # group ids
#
# def add_gid(self, gid):
# if gid not in self.gids:
# self.gids.append(gid)
#
# def remove_gid(self, gid):
# if gid in self.gids:
# self.gids.remove(gid)
# else:
# raise FirewallError(errors.NOT_ENABLED,
# 'Gid "%s" not in whitelist.' % gid)
#
# def has_gid(self, gid):
# return (gid in self.gids)
#
# def match_gid(self, gid):
# return (gid in self.gids)
#
# def get_gids(self):
# return self.gids
# # groups
#
# def add_group(self, group):
# if group not in self.groups:
# self.groups.append(group)
#
# def remove_group(self, group):
# if group in self.groups:
# self.groups.remove(group)
# else:
# raise FirewallError(errors.NOT_ENABLED,
# 'Group "%s" not in whitelist.' % group)
#
# def has_group(self, group):
# return (group in self.groups)
#
# def match_group(self, group):
# return (group in self.groups)
#
# def get_groups(self):
# return self.groups
# selinux contexts
def add_context(self, context):
if not checkContext(context):
raise FirewallError(errors.INVALID_CONTEXT, context)
if context not in self.contexts:
self.contexts.append(context)
else:
raise FirewallError(errors.ALREADY_ENABLED,
'Context "%s" already in whitelist' % context)
def remove_context(self, context):
if context in self.contexts:
self.contexts.remove(context)
else:
raise FirewallError(errors.NOT_ENABLED,
'Context "%s" not in whitelist.' % context)
def has_context(self, context):
return (context in self.contexts)
def match_context(self, context):
return (context in self.contexts)
def get_contexts(self):
return self.contexts
# read and write
def read(self):
self.cleanup()
if not self.filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % self.filename)
handler = lockdown_whitelist_ContentHandler(self)
parser = sax.make_parser()
parser.setContentHandler(handler)
try:
parser.parse(self.filename)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_TYPE,
"Not a valid file: %s" % \
msg.getException())
del handler
del parser
if PY2:
self.encode_strings()
def write(self):
if os.path.exists(self.filename):
try:
shutil.copy2(self.filename, "%s.old" % self.filename)
except Exception as msg:
raise IOError("Backup of '%s' failed: %s" % (self.filename, msg))
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
f = io.open(self.filename, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start whitelist element
handler.startElement("whitelist", { })
handler.ignorableWhitespace("\n")
# commands
for command in uniqify(self.commands):
handler.ignorableWhitespace(" ")
handler.simpleElement("command", { "name": command })
handler.ignorableWhitespace("\n")
for uid in uniqify(self.uids):
handler.ignorableWhitespace(" ")
handler.simpleElement("user", { "id": str(uid) })
handler.ignorableWhitespace("\n")
for user in uniqify(self.users):
handler.ignorableWhitespace(" ")
handler.simpleElement("user", { "name": user })
handler.ignorableWhitespace("\n")
# for gid in uniqify(self.gids):
# handler.ignorableWhitespace(" ")
# handler.simpleElement("user", { "id": str(gid) })
# handler.ignorableWhitespace("\n")
# for group in uniqify(self.groups):
# handler.ignorableWhitespace(" ")
# handler.simpleElement("group", { "name": group })
# handler.ignorableWhitespace("\n")
for context in uniqify(self.contexts):
handler.ignorableWhitespace(" ")
handler.simpleElement("selinux", { "context": context })
handler.ignorableWhitespace("\n")
# end whitelist element
handler.endElement("whitelist")
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
core/io/io_object.py 0000644 00000032422 15035135172 0010417 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""Generic io_object handler, io specific check methods."""
__all__ = [ "PY2",
"IO_Object", "IO_Object_ContentHandler", "IO_Object_XMLGenerator",
"check_port", "check_tcpudp", "check_protocol", "check_address" ]
import xml.sax as sax
import xml.sax.saxutils as saxutils
import copy
import sys
from collections import OrderedDict
from firewall import functions
from firewall.functions import b2u
from firewall import errors
from firewall.errors import FirewallError
PY2 = sys.version < '3'
class IO_Object(object):
""" Abstract IO_Object as base for icmptype, service and zone """
IMPORT_EXPORT_STRUCTURE = ( )
DBUS_SIGNATURE = '()'
ADDITIONAL_ALNUM_CHARS = [ ] # additional to alnum
PARSER_REQUIRED_ELEMENT_ATTRS = { }
PARSER_OPTIONAL_ELEMENT_ATTRS = { }
def __init__(self):
self.filename = ""
self.path = ""
self.name = ""
self.default = False
self.builtin = False
def export_config(self):
ret = [ ]
for x in self.IMPORT_EXPORT_STRUCTURE:
ret.append(copy.deepcopy(getattr(self, x[0])))
return tuple(ret)
def export_config_dict(self):
conf = {}
type_formats = dict([(x[0], x[1]) for x in self.IMPORT_EXPORT_STRUCTURE])
for key in type_formats:
if getattr(self, key) or isinstance(getattr(self, key), bool):
conf[key] = copy.deepcopy(getattr(self, key))
return conf
def import_config(self, conf):
self.check_config(conf)
for i,(element,dummy) in enumerate(self.IMPORT_EXPORT_STRUCTURE):
if isinstance(conf[i], list):
# remove duplicates without changing the order
_conf = [ ]
_set = set()
for x in conf[i]:
if x not in _set:
_conf.append(x)
_set.add(x)
del _set
setattr(self, element, copy.deepcopy(_conf))
else:
setattr(self, element, copy.deepcopy(conf[i]))
def import_config_dict(self, conf):
self.check_config_dict(conf)
for key in conf:
if not hasattr(self, key):
raise FirewallError(errors.UNKNOWN_ERROR, "Internal error. '{}' is not a valid attribute".format(key))
if isinstance(conf[key], list):
# maintain list order while removing duplicates
setattr(self, key, list(OrderedDict.fromkeys(copy.deepcopy(conf[key]))))
else:
setattr(self, key, copy.deepcopy(conf[key]))
def check_name(self, name):
if not isinstance(name, str):
raise FirewallError(errors.INVALID_TYPE,
"'%s' not of type %s, but %s" % (name, type(""),
type(name)))
if len(name) < 1:
raise FirewallError(errors.INVALID_NAME, "name can't be empty")
for char in name:
if not char.isalnum() and char not in self.ADDITIONAL_ALNUM_CHARS:
raise FirewallError(
errors.INVALID_NAME,
"'%s' is not allowed in '%s'" % ((char, name)))
def check_config(self, conf):
if len(conf) != len(self.IMPORT_EXPORT_STRUCTURE):
raise FirewallError(
errors.INVALID_TYPE,
"structure size mismatch %d != %d" % \
(len(conf), len(self.IMPORT_EXPORT_STRUCTURE)))
conf_dict = {}
for i,(x,y) in enumerate(self.IMPORT_EXPORT_STRUCTURE):
conf_dict[x] = conf[i]
self.check_config_dict(conf_dict)
def check_config_dict(self, conf):
type_formats = dict([(x[0], x[1]) for x in self.IMPORT_EXPORT_STRUCTURE])
for key in conf:
if key not in [x for (x,y) in self.IMPORT_EXPORT_STRUCTURE]:
raise FirewallError(errors.INVALID_OPTION, "option '{}' is not valid".format(key))
self._check_config_structure(conf[key], type_formats[key])
self._check_config(conf[key], key, conf)
def _check_config(self, dummy1, dummy2, dummy3):
# to be overloaded by sub classes
return
def _check_config_structure(self, conf, structure):
if not isinstance(conf, type(structure)):
raise FirewallError(errors.INVALID_TYPE,
"'%s' not of type %s, but %s" % \
(conf, type(structure), type(conf)))
if isinstance(structure, list):
# same type elements, else struct
if len(structure) != 1:
raise FirewallError(errors.INVALID_TYPE,
"len('%s') != 1" % structure)
for x in conf:
self._check_config_structure(x, structure[0])
elif isinstance(structure, tuple):
if len(structure) != len(conf):
raise FirewallError(errors.INVALID_TYPE,
"len('%s') != %d" % (conf,
len(structure)))
for i,value in enumerate(structure):
self._check_config_structure(conf[i], value)
elif isinstance(structure, dict):
# only one key value pair in structure
(skey, svalue) = list(structure.items())[0]
for (key, value) in conf.items():
if not isinstance(key, type(skey)):
raise FirewallError(errors.INVALID_TYPE,
"'%s' not of type %s, but %s" % (\
key, type(skey), type(key)))
if not isinstance(value, type(svalue)):
raise FirewallError(errors.INVALID_TYPE,
"'%s' not of type %s, but %s" % (\
value, type(svalue), type(value)))
# check required elements and attributes and also optional attributes
def parser_check_element_attrs(self, name, attrs):
_attrs = attrs.getNames()
found = False
if name in self.PARSER_REQUIRED_ELEMENT_ATTRS:
found = True
if self.PARSER_REQUIRED_ELEMENT_ATTRS[name] is not None:
for x in self.PARSER_REQUIRED_ELEMENT_ATTRS[name]:
if x in _attrs:
_attrs.remove(x)
else:
raise FirewallError(
errors.PARSE_ERROR,
"Missing attribute %s for %s" % (x, name))
if name in self.PARSER_OPTIONAL_ELEMENT_ATTRS:
found = True
for x in self.PARSER_OPTIONAL_ELEMENT_ATTRS[name]:
if x in _attrs:
_attrs.remove(x)
if not found:
raise FirewallError(errors.PARSE_ERROR,
"Unexpected element %s" % name)
# raise attributes[0]
for x in _attrs:
raise FirewallError(errors.PARSE_ERROR,
"%s: Unexpected attribute %s" % (name, x))
# PARSER
class UnexpectedElementError(Exception):
def __init__(self, name):
super(UnexpectedElementError, self).__init__()
self.name = name
def __str__(self):
return "Unexpected element '%s'" % (self.name)
class MissingAttributeError(Exception):
def __init__(self, name, attribute):
super(MissingAttributeError, self).__init__()
self.name = name
self.attribute = attribute
def __str__(self):
return "Element '%s': missing '%s' attribute" % \
(self.name, self.attribute)
class UnexpectedAttributeError(Exception):
def __init__(self, name, attribute):
super(UnexpectedAttributeError, self).__init__()
self.name = name
self.attribute = attribute
def __str__(self):
return "Element '%s': unexpected attribute '%s'" % \
(self.name, self.attribute)
class IO_Object_ContentHandler(sax.handler.ContentHandler):
def __init__(self, item):
self.item = item
self._element = ""
def startDocument(self):
self._element = ""
def startElement(self, name, attrs):
self._element = ""
def endElement(self, name):
if name == "short":
self.item.short = self._element
elif name == "description":
self.item.description = self._element
def characters(self, content):
self._element += content.replace('\n', ' ')
class IO_Object_XMLGenerator(saxutils.XMLGenerator):
def __init__(self, out):
# fix memory leak in saxutils.XMLGenerator.__init__:
# out = _gettextwriter(out, encoding)
# creates unbound object results in garbage in gc
#
# saxutils.XMLGenerator.__init__(self, out, "utf-8")
# replaced by modified saxutils.XMLGenerator.__init__ code:
sax.handler.ContentHandler.__init__(self)
self._write = out.write
self._flush = out.flush
self._ns_contexts = [{}] # contains uri -> prefix dicts
self._current_context = self._ns_contexts[-1]
self._undeclared_ns_maps = []
self._encoding = "utf-8"
self._pending_start_element = False
self._short_empty_elements = False
def startElement(self, name, attrs):
""" saxutils.XMLGenerator.startElement() expects name and attrs to be
unicode and bad things happen if any of them is (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
"""
if PY2:
attrs = { b2u(name):b2u(value) for name, value in attrs.items() }
saxutils.XMLGenerator.startElement(self, name, attrs)
def simpleElement(self, name, attrs):
""" slightly modified startElement()
"""
if PY2:
self._write(u'<' + b2u(name))
for (name, value) in attrs.items():
self._write(u' %s=%s' % (b2u(name),
saxutils.quoteattr(b2u(value))))
self._write(u'/>')
else:
self._write('<' + name)
for (name, value) in attrs.items():
self._write(' %s=%s' % (name, saxutils.quoteattr(value)))
self._write('/>')
def endElement(self, name):
""" saxutils.XMLGenerator.endElement() expects name to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
"""
saxutils.XMLGenerator.endElement(self, b2u(name))
def characters(self, content):
""" saxutils.XMLGenerator.characters() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
"""
saxutils.XMLGenerator.characters(self, b2u(content))
def ignorableWhitespace(self, content):
""" saxutils.XMLGenerator.ignorableWhitespace() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
"""
saxutils.XMLGenerator.ignorableWhitespace(self, b2u(content))
def check_port(port):
port_range = functions.getPortRange(port)
if port_range == -2:
raise FirewallError(errors.INVALID_PORT,
"port number in '%s' is too big" % port)
elif port_range == -1:
raise FirewallError(errors.INVALID_PORT,
"'%s' is invalid port range" % port)
elif port_range is None:
raise FirewallError(errors.INVALID_PORT,
"port range '%s' is ambiguous" % port)
elif len(port_range) == 2 and port_range[0] >= port_range[1]:
raise FirewallError(errors.INVALID_PORT,
"'%s' is invalid port range" % port)
def check_tcpudp(protocol):
if protocol not in [ "tcp", "udp", "sctp", "dccp" ]:
raise FirewallError(errors.INVALID_PROTOCOL,
"'%s' not from {'tcp'|'udp'|'sctp'|'dccp'}" % \
protocol)
def check_protocol(protocol):
if not functions.checkProtocol(protocol):
raise FirewallError(errors.INVALID_PROTOCOL, protocol)
def check_address(ipv, addr):
if not functions.check_address(ipv, addr):
raise FirewallError(errors.INVALID_ADDR,
"'%s' is not valid %s address" % (addr, ipv))
core/io/functions.py 0000644 00000011171 15035135172 0010470 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2018 Red Hat, Inc.
#
# Authors:
# Eric Garver <egarver@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import os
from firewall import config
from firewall.errors import FirewallError
from firewall.core.fw_config import FirewallConfig
from firewall.core.io.zone import zone_reader
from firewall.core.io.service import service_reader
from firewall.core.io.ipset import ipset_reader
from firewall.core.io.icmptype import icmptype_reader
from firewall.core.io.helper import helper_reader
from firewall.core.io.policy import policy_reader
from firewall.core.io.direct import Direct
from firewall.core.io.lockdown_whitelist import LockdownWhitelist
from firewall.core.io.firewalld_conf import firewalld_conf
def check_config(fw):
fw_config = FirewallConfig(fw)
readers = {
"ipset": {"reader": ipset_reader,
"add": fw_config.add_ipset,
"dirs": [config.FIREWALLD_IPSETS, config.ETC_FIREWALLD_IPSETS],
},
"helper": {"reader": helper_reader,
"add": fw_config.add_helper,
"dirs": [config.FIREWALLD_HELPERS, config.ETC_FIREWALLD_HELPERS],
},
"icmptype": {"reader": icmptype_reader,
"add": fw_config.add_icmptype,
"dirs": [config.FIREWALLD_ICMPTYPES, config.ETC_FIREWALLD_ICMPTYPES],
},
"service": {"reader": service_reader,
"add": fw_config.add_service,
"dirs": [config.FIREWALLD_SERVICES, config.ETC_FIREWALLD_SERVICES],
},
"zone": {"reader": zone_reader,
"add": fw_config.add_zone,
"dirs": [config.FIREWALLD_ZONES, config.ETC_FIREWALLD_ZONES],
},
"policy": {"reader": policy_reader,
"add": fw_config.add_policy_object,
"dirs": [config.FIREWALLD_POLICIES, config.ETC_FIREWALLD_POLICIES],
},
}
for reader in readers.keys():
for _dir in readers[reader]["dirs"]:
if not os.path.isdir(_dir):
continue
for file in sorted(os.listdir(_dir)):
if file.endswith(".xml"):
try:
obj = readers[reader]["reader"](file, _dir)
if reader in ["zone", "policy"]:
obj.fw_config = fw_config
obj.check_config_dict(obj.export_config_dict())
readers[reader]["add"](obj)
except FirewallError as error:
raise FirewallError(error.code, "'%s': %s" % (file, error.msg))
except Exception as msg:
raise Exception("'%s': %s" % (file, msg))
if os.path.isfile(config.FIREWALLD_DIRECT):
try:
obj = Direct(config.FIREWALLD_DIRECT)
obj.read()
obj.check_config(obj.export_config())
except FirewallError as error:
raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_DIRECT, error.msg))
except Exception as msg:
raise Exception("'%s': %s" % (config.FIREWALLD_DIRECT, msg))
if os.path.isfile(config.LOCKDOWN_WHITELIST):
try:
obj = LockdownWhitelist(config.LOCKDOWN_WHITELIST)
obj.read()
obj.check_config(obj.export_config())
except FirewallError as error:
raise FirewallError(error.code, "'%s': %s" % (config.LOCKDOWN_WHITELIST, error.msg))
except Exception as msg:
raise Exception("'%s': %s" % (config.LOCKDOWN_WHITELIST, msg))
if os.path.isfile(config.FIREWALLD_CONF):
try:
obj = firewalld_conf(config.FIREWALLD_CONF)
obj.read()
except FirewallError as error:
raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_CONF, error.msg))
except Exception as msg:
raise Exception("'%s': %s" % (config.FIREWALLD_CONF, msg))
core/io/zone.py 0000644 00000046600 15035135172 0007440 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "Zone", "zone_reader", "zone_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import checkIPnMask, checkIP6nMask, checkInterface, uniqify, max_zone_name_len, u2b_if_py2, check_mac
from firewall.core.base import DEFAULT_ZONE_TARGET, ZONE_TARGETS
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator
from firewall.core.io.policy import common_startElement, common_endElement, common_check_config, common_writer
from firewall.core import rich
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class Zone(IO_Object):
""" Zone class """
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ), # s
( "short", "" ), # s
( "description", "" ), # s
( "UNUSED", False ), # b
( "target", "" ), # s
( "services", [ "", ], ), # as
( "ports", [ ( "", "" ), ], ), # a(ss)
( "icmp_blocks", [ "", ], ), # as
( "masquerade", False ), # b
( "forward_ports", [ ( "", "", "", "" ), ], ), # a(ssss)
( "interfaces", [ "" ] ), # as
( "sources", [ "" ] ), # as
( "rules_str", [ "" ] ), # as
( "protocols", [ "", ], ), # as
( "source_ports", [ ( "", "" ), ], ), # a(ss)
( "icmp_block_inversion", False ), # b
( "forward", False ), # b
)
ADDITIONAL_ALNUM_CHARS = [ "_", "-", "/" ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"zone": None,
"service": [ "name" ],
"port": [ "port", "protocol" ],
"icmp-block": [ "name" ],
"icmp-type": [ "name" ],
"forward": None,
"forward-port": [ "port", "protocol" ],
"interface": [ "name" ],
"rule": None,
"source": None,
"destination": None,
"protocol": [ "value" ],
"source-port": [ "port", "protocol" ],
"log": None,
"audit": None,
"accept": None,
"reject": None,
"drop": None,
"mark": [ "set" ],
"limit": [ "value" ],
"icmp-block-inversion": None,
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"zone": [ "name", "immutable", "target", "version" ],
"masquerade": [ "enabled" ],
"forward-port": [ "to-port", "to-addr" ],
"rule": [ "family", "priority" ],
"source": [ "address", "mac", "invert", "family", "ipset" ],
"destination": [ "address", "invert", "ipset" ],
"log": [ "prefix", "level" ],
"reject": [ "type" ],
"limit": ["burst"],
}
@staticmethod
def index_of(element):
for i, (el, dummy) in enumerate(Zone.IMPORT_EXPORT_STRUCTURE):
if el == element:
return i
raise FirewallError(errors.UNKNOWN_ERROR, "index_of()")
def __init__(self):
super(Zone, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.UNUSED = False
self.target = DEFAULT_ZONE_TARGET
self.services = [ ]
self.ports = [ ]
self.protocols = [ ]
self.icmp_blocks = [ ]
self.forward = False
self.masquerade = False
self.forward_ports = [ ]
self.source_ports = [ ]
self.interfaces = [ ]
self.sources = [ ]
self.fw_config = None # to be able to check services and a icmp_blocks
self.rules = [ ]
self.rules_str = [ ]
self.icmp_block_inversion = False
self.combined = False
self.applied = False
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
self.UNUSED = False
self.target = DEFAULT_ZONE_TARGET
del self.services[:]
del self.ports[:]
del self.protocols[:]
del self.icmp_blocks[:]
self.forward = False
self.masquerade = False
del self.forward_ports[:]
del self.source_ports[:]
del self.interfaces[:]
del self.sources[:]
self.fw_config = None # to be able to check services and a icmp_blocks
del self.rules[:]
del self.rules_str[:]
self.icmp_block_inversion = False
self.combined = False
self.applied = False
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.version = u2b_if_py2(self.version)
self.short = u2b_if_py2(self.short)
self.description = u2b_if_py2(self.description)
self.target = u2b_if_py2(self.target)
self.services = [u2b_if_py2(s) for s in self.services]
self.ports = [(u2b_if_py2(po),u2b_if_py2(pr)) for (po,pr) in self.ports]
self.protocols = [u2b_if_py2(pr) for pr in self.protocols]
self.icmp_blocks = [u2b_if_py2(i) for i in self.icmp_blocks]
self.forward_ports = [(u2b_if_py2(p1),u2b_if_py2(p2),u2b_if_py2(p3),u2b_if_py2(p4)) for (p1,p2,p3,p4) in self.forward_ports]
self.source_ports = [(u2b_if_py2(po),u2b_if_py2(pr)) for (po,pr)
in self.source_ports]
self.interfaces = [u2b_if_py2(i) for i in self.interfaces]
self.sources = [u2b_if_py2(s) for s in self.sources]
self.rules = [u2b_if_py2(s) for s in self.rules]
self.rules_str = [u2b_if_py2(s) for s in self.rules_str]
def __setattr__(self, name, value):
if name == "rules_str":
self.rules = [rich.Rich_Rule(rule_str=s) for s in value]
# must convert back to string to get the canonical string.
super(Zone, self).__setattr__(name, [str(s) for s in self.rules])
else:
super(Zone, self).__setattr__(name, value)
def export_config_dict(self):
conf = super(Zone, self).export_config_dict()
del conf["UNUSED"]
return conf
def _check_config(self, config, item, all_config):
common_check_config(self, config, item, all_config)
if item == "target":
if config not in ZONE_TARGETS:
raise FirewallError(errors.INVALID_TARGET, config)
elif item == "interfaces":
for interface in config:
if not checkInterface(interface):
raise FirewallError(errors.INVALID_INTERFACE, interface)
if self.fw_config:
for zone in self.fw_config.get_zones():
if zone == self.name:
continue
if interface in self.fw_config.get_zone(zone).interfaces:
raise FirewallError(errors.INVALID_INTERFACE,
"interface '{}' already bound to zone '{}'".format(interface, zone))
elif item == "sources":
for source in config:
if not checkIPnMask(source) and not checkIP6nMask(source) and \
not check_mac(source) and not source.startswith("ipset:"):
raise FirewallError(errors.INVALID_ADDR, source)
if self.fw_config:
for zone in self.fw_config.get_zones():
if zone == self.name:
continue
if source in self.fw_config.get_zone(zone).sources:
raise FirewallError(errors.INVALID_ADDR,
"source '{}' already bound to zone '{}'".format(source, zone))
def check_name(self, name):
super(Zone, self).check_name(name)
if name.startswith('/'):
raise FirewallError(errors.INVALID_NAME,
"'%s' can't start with '/'" % name)
elif name.endswith('/'):
raise FirewallError(errors.INVALID_NAME,
"'%s' can't end with '/'" % name)
elif name.count('/') > 1:
raise FirewallError(errors.INVALID_NAME,
"more than one '/' in '%s'" % name)
else:
if "/" in name:
checked_name = name[:name.find('/')]
else:
checked_name = name
if len(checked_name) > max_zone_name_len():
raise FirewallError(errors.INVALID_NAME,
"Zone of '%s' has %d chars, max is %d %s" % (
name, len(checked_name),
max_zone_name_len(),
self.combined))
if self.fw_config:
if checked_name in self.fw_config.get_policy_objects():
raise FirewallError(errors.NAME_CONFLICT, "Zones can't have the same name as a policy.")
def combine(self, zone):
self.combined = True
self.filename = None
self.version = ""
self.short = ""
self.description = ""
for interface in zone.interfaces:
if interface not in self.interfaces:
self.interfaces.append(interface)
for source in zone.sources:
if source not in self.sources:
self.sources.append(source)
for service in zone.services:
if service not in self.services:
self.services.append(service)
for port in zone.ports:
if port not in self.ports:
self.ports.append(port)
for proto in zone.protocols:
if proto not in self.protocols:
self.protocols.append(proto)
for icmp in zone.icmp_blocks:
if icmp not in self.icmp_blocks:
self.icmp_blocks.append(icmp)
if zone.forward:
self.forward = True
if zone.masquerade:
self.masquerade = True
for forward in zone.forward_ports:
if forward not in self.forward_ports:
self.forward_ports.append(forward)
for port in zone.source_ports:
if port not in self.source_ports:
self.source_ports.append(port)
for rule in zone.rules:
self.rules.append(rule)
self.rules_str.append(str(rule))
if zone.icmp_block_inversion:
self.icmp_block_inversion = True
# PARSER
class zone_ContentHandler(IO_Object_ContentHandler):
def __init__(self, item):
IO_Object_ContentHandler.__init__(self, item)
self._rule = None
self._rule_error = False
self._limit_ok = None
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
if self._rule_error:
return
self.item.parser_check_element_attrs(name, attrs)
if common_startElement(self, name, attrs):
return
elif name == "zone":
if "name" in attrs:
log.warning("Ignoring deprecated attribute name='%s'",
attrs["name"])
if "version" in attrs:
self.item.version = attrs["version"]
if "immutable" in attrs:
log.warning("Ignoring deprecated attribute immutable='%s'",
attrs["immutable"])
if "target" in attrs:
target = attrs["target"]
if target not in ZONE_TARGETS:
raise FirewallError(errors.INVALID_TARGET, target)
if target != "" and target != DEFAULT_ZONE_TARGET:
self.item.target = target
elif name == "forward":
if self.item.forward:
log.warning("Forward already set, ignoring.")
else:
self.item.forward = True
elif name == "interface":
if self._rule:
log.warning('Invalid rule: interface use in rule.')
self._rule_error = True
return
# zone bound to interface
if "name" not in attrs:
log.warning('Invalid interface: Name missing.')
self._rule_error = True
return
if attrs["name"] not in self.item.interfaces:
self.item.interfaces.append(attrs["name"])
else:
log.warning("Interface '%s' already set, ignoring.",
attrs["name"])
elif name == "source":
if self._rule:
if self._rule.source:
log.warning("Invalid rule: More than one source in rule '%s', ignoring.",
str(self._rule))
self._rule_error = True
return
invert = False
if "invert" in attrs and \
attrs["invert"].lower() in [ "yes", "true" ]:
invert = True
addr = mac = ipset = None
if "address" in attrs:
addr = attrs["address"]
if "mac" in attrs:
mac = attrs["mac"]
if "ipset" in attrs:
ipset = attrs["ipset"]
self._rule.source = rich.Rich_Source(addr, mac, ipset,
invert=invert)
return
# zone bound to source
if "address" not in attrs and "ipset" not in attrs:
log.warning('Invalid source: No address no ipset.')
return
if "address" in attrs and "ipset" in attrs:
log.warning('Invalid source: Address and ipset.')
return
if "family" in attrs:
log.warning("Ignoring deprecated attribute family='%s'",
attrs["family"])
if "invert" in attrs:
log.warning('Invalid source: Invertion not allowed here.')
return
if "address" in attrs:
if not checkIPnMask(attrs["address"]) and \
not checkIP6nMask(attrs["address"]) and \
not check_mac(attrs["address"]):
raise FirewallError(errors.INVALID_ADDR, attrs["address"])
if "ipset" in attrs:
entry = "ipset:%s" % attrs["ipset"]
if entry not in self.item.sources:
self.item.sources.append(entry)
else:
log.warning("Source '%s' already set, ignoring.",
attrs["address"])
if "address" in attrs:
entry = attrs["address"]
if entry not in self.item.sources:
self.item.sources.append(entry)
else:
log.warning("Source '%s' already set, ignoring.",
attrs["address"])
elif name == "icmp-block-inversion":
if self.item.icmp_block_inversion:
log.warning("Icmp-Block-Inversion already set, ignoring.")
else:
self.item.icmp_block_inversion = True
else:
log.warning("Unknown XML element '%s'", name)
return
def endElement(self, name):
IO_Object_ContentHandler.endElement(self, name)
common_endElement(self, name)
def zone_reader(filename, path, no_check_name=False):
zone = Zone()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % filename)
zone.name = filename[:-4]
if not no_check_name:
zone.check_name(zone.name)
zone.filename = filename
zone.path = path
zone.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
zone.default = zone.builtin
handler = zone_ContentHandler(zone)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_ZONE,
"not a valid zone file: %s" % \
msg.getException())
del handler
del parser
if PY2:
zone.encode_strings()
return zone
def zone_writer(zone, path=None):
_path = path if path else zone.path
if zone.filename:
name = "%s/%s" % (_path, zone.filename)
else:
name = "%s/%s.xml" % (_path, zone.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start zone element
attrs = {}
if zone.version and zone.version != "":
attrs["version"] = zone.version
if zone.target != DEFAULT_ZONE_TARGET:
attrs["target"] = zone.target
handler.startElement("zone", attrs)
handler.ignorableWhitespace("\n")
common_writer(zone, handler)
# interfaces
for interface in uniqify(zone.interfaces):
handler.ignorableWhitespace(" ")
handler.simpleElement("interface", { "name": interface })
handler.ignorableWhitespace("\n")
# source
for source in uniqify(zone.sources):
handler.ignorableWhitespace(" ")
if "ipset:" in source:
handler.simpleElement("source", { "ipset": source[6:] })
else:
handler.simpleElement("source", { "address": source })
handler.ignorableWhitespace("\n")
# icmp-block-inversion
if zone.icmp_block_inversion:
handler.ignorableWhitespace(" ")
handler.simpleElement("icmp-block-inversion", { })
handler.ignorableWhitespace("\n")
# forward
if zone.forward:
handler.ignorableWhitespace(" ")
handler.simpleElement("forward", { })
handler.ignorableWhitespace("\n")
# end zone element
handler.endElement("zone")
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
core/io/firewalld_conf.py 0000644 00000032774 15035135172 0011452 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2012 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import os.path
import io
import tempfile
import shutil
from firewall import config
from firewall.core.logger import log
from firewall.functions import b2u, u2b, PY2
valid_keys = [ "DefaultZone", "MinimalMark", "CleanupOnExit",
"CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter",
"IndividualCalls", "LogDenied", "AutomaticHelpers",
"FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4",
"AllowZoneDrifting" ]
class firewalld_conf(object):
def __init__(self, filename):
self._config = { }
self._deleted = [ ]
self.filename = filename
self.clear()
def clear(self):
self._config = { }
self._deleted = [ ]
def cleanup(self):
self._config.clear()
self._deleted = [ ]
def get(self, key):
return self._config.get(key.strip())
def set(self, key, value):
_key = b2u(key.strip())
self._config[_key] = b2u(value.strip())
if _key in self._deleted:
self._deleted.remove(_key)
def __str__(self):
s = ""
for (key,value) in self._config.items():
if s:
s += '\n'
s += '%s=%s' % (key, value)
return u2b(s) if PY2 else s
# load self.filename
def read(self):
self.clear()
try:
f = open(self.filename, "r")
except Exception as msg:
log.error("Failed to load '%s': %s", self.filename, msg)
self.set("DefaultZone", config.FALLBACK_ZONE)
self.set("MinimalMark", str(config.FALLBACK_MINIMAL_MARK))
self.set("CleanupOnExit", "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no")
self.set("CleanupModulesOnExit", "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no")
self.set("Lockdown", "yes" if config.FALLBACK_LOCKDOWN else "no")
self.set("IPv6_rpfilter","yes" if config.FALLBACK_IPV6_RPFILTER else "no")
self.set("IndividualCalls", "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no")
self.set("LogDenied", config.FALLBACK_LOG_DENIED)
self.set("AutomaticHelpers", config.FALLBACK_AUTOMATIC_HELPERS)
self.set("FirewallBackend", config.FALLBACK_FIREWALL_BACKEND)
self.set("FlushAllOnReload", "yes" if config.FALLBACK_FLUSH_ALL_ON_RELOAD else "no")
self.set("RFC3964_IPv4", "yes" if config.FALLBACK_RFC3964_IPV4 else "no")
self.set("AllowZoneDrifting", "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no")
raise
for line in f:
if not line:
break
line = line.strip()
if len(line) < 1 or line[0] in ['#', ';']:
continue
# get key/value pair
pair = [ x.strip() for x in line.split("=") ]
if len(pair) != 2:
log.error("Invalid option definition: '%s'", line.strip())
continue
elif pair[0] not in valid_keys:
log.error("Invalid option: '%s'", line.strip())
continue
elif pair[1] == '':
log.error("Missing value: '%s'", line.strip())
continue
elif self._config.get(pair[0]) is not None:
log.error("Duplicate option definition: '%s'", line.strip())
continue
self._config[pair[0]] = pair[1]
f.close()
# check default zone
if not self.get("DefaultZone"):
log.error("DefaultZone is not set, using default value '%s'",
config.FALLBACK_ZONE)
self.set("DefaultZone", str(config.FALLBACK_ZONE))
# check minimal mark
value = self.get("MinimalMark")
try:
int(value)
except (ValueError, TypeError):
if value is not None:
log.warning("MinimalMark '%s' is not valid, using default "
"value '%d'", value if value else '',
config.FALLBACK_MINIMAL_MARK)
self.set("MinimalMark", str(config.FALLBACK_MINIMAL_MARK))
# check cleanup on exit
value = self.get("CleanupOnExit")
if not value or value.lower() not in [ "no", "false", "yes", "true" ]:
if value is not None:
log.warning("CleanupOnExit '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_CLEANUP_ON_EXIT)
self.set("CleanupOnExit", "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no")
# check module cleanup on exit
value = self.get("CleanupModulesOnExit")
if not value or value.lower() not in [ "no", "false", "yes", "true" ]:
if value is not None:
log.warning("CleanupModulesOnExit '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_CLEANUP_MODULES_ON_EXIT)
self.set("CleanupModulesOnExit", "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no")
# check lockdown
value = self.get("Lockdown")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("Lockdown '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_LOCKDOWN)
self.set("Lockdown", "yes" if config.FALLBACK_LOCKDOWN else "no")
# check ipv6_rpfilter
value = self.get("IPv6_rpfilter")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("IPv6_rpfilter '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_IPV6_RPFILTER)
self.set("IPv6_rpfilter","yes" if config.FALLBACK_IPV6_RPFILTER else "no")
# check individual calls
value = self.get("IndividualCalls")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("IndividualCalls '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_INDIVIDUAL_CALLS)
self.set("IndividualCalls", "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no")
# check log denied
value = self.get("LogDenied")
if not value or value not in config.LOG_DENIED_VALUES:
if value is not None:
log.warning("LogDenied '%s' is invalid, using default value '%s'",
value, config.FALLBACK_LOG_DENIED)
self.set("LogDenied", str(config.FALLBACK_LOG_DENIED))
# check automatic helpers
value = self.get("AutomaticHelpers")
if not value or value.lower() not in config.AUTOMATIC_HELPERS_VALUES:
if value is not None:
log.warning("AutomaticHelpers '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_AUTOMATIC_HELPERS)
self.set("AutomaticHelpers", str(config.FALLBACK_AUTOMATIC_HELPERS))
value = self.get("FirewallBackend")
if not value or value.lower() not in config.FIREWALL_BACKEND_VALUES:
if value is not None:
log.warning("FirewallBackend '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_FIREWALL_BACKEND)
self.set("FirewallBackend", str(config.FALLBACK_FIREWALL_BACKEND))
value = self.get("FlushAllOnReload")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("FlushAllOnReload '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_FLUSH_ALL_ON_RELOAD)
self.set("FlushAllOnReload", str(config.FALLBACK_FLUSH_ALL_ON_RELOAD))
value = self.get("RFC3964_IPv4")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("RFC3964_IPv4 '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_RFC3964_IPV4)
self.set("RFC3964_IPv4", str(config.FALLBACK_RFC3964_IPV4))
value = self.get("AllowZoneDrifting")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("AllowZoneDrifting '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_ALLOW_ZONE_DRIFTING)
self.set("AllowZoneDrifting", str(config.FALLBACK_ALLOW_ZONE_DRIFTING))
# save to self.filename if there are key/value changes
def write(self):
if len(self._config) < 1:
# no changes: nothing to do
return
# handled keys
done = [ ]
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
try:
temp_file = tempfile.NamedTemporaryFile(mode='wt',
prefix="%s." % os.path.basename(self.filename),
dir=os.path.dirname(self.filename), delete=False)
except Exception as msg:
log.error("Failed to open temporary file: %s" % msg)
raise
modified = False
empty = False
try:
f= io.open(self.filename, mode='rt', encoding='UTF-8')
except Exception as msg:
if os.path.exists(self.filename):
log.error("Failed to open '%s': %s" % (self.filename, msg))
raise
else:
f = None
else:
for line in f:
if not line:
break
# remove newline
line = line.strip("\n")
if len(line) < 1:
if not empty:
temp_file.write(u"\n")
empty = True
elif line[0] == '#':
empty = False
temp_file.write(line)
temp_file.write(u"\n")
else:
p = line.split("=")
if len(p) != 2:
empty = False
temp_file.write(line+u"\n")
continue
key = p[0].strip()
value = p[1].strip()
# check for modified key/value pairs
if key not in done:
if (key in self._config and \
self._config[key] != value):
empty = False
temp_file.write(u'%s=%s\n' %
(key, self._config[key]))
modified = True
elif key in self._deleted:
modified = True
else:
empty = False
temp_file.write(line+u"\n")
done.append(key)
else:
modified = True
# write remaining key/value pairs
if len(self._config) > 0:
for (key,value) in self._config.items():
if key in done:
continue
if key in ["MinimalMark", "AutomaticHelpers"]: # omit deprecated from new config
continue
if not empty:
temp_file.write(u"\n")
empty = True
temp_file.write(u'%s=%s\n' % (key, value))
modified = True
if f:
f.close()
temp_file.close()
if not modified: # not modified: remove tempfile
os.remove(temp_file.name)
return
# make backup
if os.path.exists(self.filename):
try:
shutil.copy2(self.filename, "%s.old" % self.filename)
except Exception as msg:
os.remove(temp_file.name)
raise IOError("Backup of '%s' failed: %s" % (self.filename, msg))
# copy tempfile
try:
shutil.move(temp_file.name, self.filename)
except Exception as msg:
os.remove(temp_file.name)
raise IOError("Failed to create '%s': %s" % (self.filename, msg))
else:
os.chmod(self.filename, 0o600)
core/io/service.py 0000644 00000031325 15035135172 0010123 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "Service", "service_reader", "service_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import u2b_if_py2
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \
check_tcpudp, check_protocol, check_address
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class Service(IO_Object):
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ),
( "short", "" ),
( "description", "" ),
( "ports", [ ( "", "" ), ], ),
( "modules", [ "", ], ),
( "destination", { "": "", }, ),
( "protocols", [ "", ], ),
( "source_ports", [ ( "", "" ), ], ),
( "includes", [ "" ], ),
( "helpers", [ "", ], ),
)
ADDITIONAL_ALNUM_CHARS = [ "_", "-" ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"service": None,
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"service": [ "name", "version" ],
"port": [ "port", "protocol" ],
"protocol": [ "value" ],
"module": [ "name" ],
"destination": [ "ipv4", "ipv6" ],
"source-port": [ "port", "protocol" ],
"include": [ "service" ],
"helper": [ "name" ],
}
def __init__(self):
super(Service, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.ports = [ ]
self.protocols = [ ]
self.modules = [ ]
self.destination = { }
self.source_ports = [ ]
self.includes = [ ]
self.helpers = [ ]
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
del self.ports[:]
del self.protocols[:]
del self.modules[:]
self.destination.clear()
del self.source_ports[:]
del self.includes[:]
del self.helpers[:]
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.version = u2b_if_py2(self.version)
self.short = u2b_if_py2(self.short)
self.description = u2b_if_py2(self.description)
self.ports = [(u2b_if_py2(po),u2b_if_py2(pr)) for (po,pr) in self.ports]
self.modules = [u2b_if_py2(m) for m in self.modules]
self.destination = {u2b_if_py2(k):u2b_if_py2(v) for k,v in self.destination.items()}
self.protocols = [u2b_if_py2(pr) for pr in self.protocols]
self.source_ports = [(u2b_if_py2(po),u2b_if_py2(pr)) for (po,pr)
in self.source_ports]
self.includes = [u2b_if_py2(s) for s in self.includes]
self.helpers = [u2b_if_py2(s) for s in self.helpers]
def _check_config(self, config, item, all_config):
if item == "ports":
for port in config:
if port[0] != "":
check_port(port[0])
check_tcpudp(port[1])
else:
# only protocol
check_protocol(port[1])
elif item == "protocols":
for proto in config:
check_protocol(proto)
elif item == "source_ports":
for port in config:
check_port(port[0])
check_tcpudp(port[1])
elif item == "destination":
for destination in config:
if destination not in [ "ipv4", "ipv6" ]:
raise FirewallError(errors.INVALID_DESTINATION,
"'%s' not in {'ipv4'|'ipv6'}" % \
destination)
check_address(destination, config[destination])
elif item == "modules":
for module in config:
if module.startswith("nf_conntrack_"):
module = module.replace("nf_conntrack_", "")
if "_" in module:
module = module.replace("_", "-")
if len(module) < 2:
raise FirewallError(errors.INVALID_MODULE, module)
# PARSER
class service_ContentHandler(IO_Object_ContentHandler):
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "service":
if "name" in attrs:
log.warning("Ignoring deprecated attribute name='%s'",
attrs["name"])
if "version" in attrs:
self.item.version = attrs["version"]
elif name == "short":
pass
elif name == "description":
pass
elif name == "port":
if attrs["port"] != "":
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
entry = (attrs["port"], attrs["protocol"])
if entry not in self.item.ports:
self.item.ports.append(entry)
else:
log.warning("Port '%s/%s' already set, ignoring.",
attrs["port"], attrs["protocol"])
else:
check_protocol(attrs["protocol"])
if attrs["protocol"] not in self.item.protocols:
self.item.protocols.append(attrs["protocol"])
else:
log.warning("Protocol '%s' already set, ignoring.",
attrs["protocol"])
elif name == "protocol":
check_protocol(attrs["value"])
if attrs["value"] not in self.item.protocols:
self.item.protocols.append(attrs["value"])
else:
log.warning("Protocol '%s' already set, ignoring.",
attrs["value"])
elif name == "source-port":
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
entry = (attrs["port"], attrs["protocol"])
if entry not in self.item.source_ports:
self.item.source_ports.append(entry)
else:
log.warning("SourcePort '%s/%s' already set, ignoring.",
attrs["port"], attrs["protocol"])
elif name == "destination":
for x in [ "ipv4", "ipv6" ]:
if x in attrs:
check_address(x, attrs[x])
if x in self.item.destination:
log.warning("Destination address for '%s' already set, ignoring",
x)
else:
self.item.destination[x] = attrs[x]
elif name == "module":
module = attrs["name"]
if module.startswith("nf_conntrack_"):
module = module.replace("nf_conntrack_", "")
if "_" in module:
module = module.replace("_", "-")
if module not in self.item.modules:
self.item.modules.append(module)
else:
log.warning("Module '%s' already set, ignoring.",
module)
elif name == "include":
if attrs["service"] not in self.item.includes:
self.item.includes.append(attrs["service"])
else:
log.warning("Include '%s' already set, ignoring.",
attrs["service"])
elif name == "helper":
if attrs["name"] not in self.item.helpers:
self.item.helpers.append(attrs["name"])
else:
log.warning("Helper '%s' already set, ignoring.",
attrs["name"])
def service_reader(filename, path):
service = Service()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % filename)
service.name = filename[:-4]
service.check_name(service.name)
service.filename = filename
service.path = path
service.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
service.default = service.builtin
handler = service_ContentHandler(service)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_SERVICE,
"not a valid service file: %s" % \
msg.getException())
del handler
del parser
if PY2:
service.encode_strings()
return service
def service_writer(service, path=None):
_path = path if path else service.path
if service.filename:
name = "%s/%s" % (_path, service.filename)
else:
name = "%s/%s.xml" % (_path, service.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start service element
attrs = {}
if service.version and service.version != "":
attrs["version"] = service.version
handler.startElement("service", attrs)
handler.ignorableWhitespace("\n")
# short
if service.short and service.short != "":
handler.ignorableWhitespace(" ")
handler.startElement("short", { })
handler.characters(service.short)
handler.endElement("short")
handler.ignorableWhitespace("\n")
# description
if service.description and service.description != "":
handler.ignorableWhitespace(" ")
handler.startElement("description", { })
handler.characters(service.description)
handler.endElement("description")
handler.ignorableWhitespace("\n")
# ports
for port in service.ports:
handler.ignorableWhitespace(" ")
handler.simpleElement("port", { "port": port[0], "protocol": port[1] })
handler.ignorableWhitespace("\n")
# protocols
for protocol in service.protocols:
handler.ignorableWhitespace(" ")
handler.simpleElement("protocol", { "value": protocol })
handler.ignorableWhitespace("\n")
# source ports
for port in service.source_ports:
handler.ignorableWhitespace(" ")
handler.simpleElement("source-port", { "port": port[0],
"protocol": port[1] })
handler.ignorableWhitespace("\n")
# modules
for module in service.modules:
handler.ignorableWhitespace(" ")
handler.simpleElement("module", { "name": module })
handler.ignorableWhitespace("\n")
# destination
if len(service.destination) > 0:
handler.ignorableWhitespace(" ")
handler.simpleElement("destination", service.destination)
handler.ignorableWhitespace("\n")
# includes
for include in service.includes:
handler.ignorableWhitespace(" ")
handler.simpleElement("include", { "service": include })
handler.ignorableWhitespace("\n")
# helpers
for helper in service.helpers:
handler.ignorableWhitespace(" ")
handler.simpleElement("helper", { "name": helper })
handler.ignorableWhitespace("\n")
# end service element
handler.endElement('service')
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
core/prog.py 0000644 00000002746 15035135172 0007030 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import subprocess
__all__ = ["runProg"]
def runProg(prog, argv=None, stdin=None):
if argv is None:
argv = []
args = [prog] + argv
input_string = None
if stdin:
with open(stdin, 'r') as handle:
input_string = handle.read().encode()
env = {'LANG': 'C'}
try:
process = subprocess.Popen(args, stdin=subprocess.PIPE,
stderr=subprocess.STDOUT,
stdout=subprocess.PIPE,
close_fds=True, env=env)
except OSError:
return (255, '')
(output, err_output) = process.communicate(input_string)
output = output.decode('utf-8', 'replace')
return (process.returncode, output)
core/fw_zone.py 0000644 00000131171 15035135172 0007523 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import time
import copy
from firewall.core.base import SHORTCUTS, DEFAULT_ZONE_TARGET, SOURCE_IPSET_TYPES
from firewall.core.fw_transaction import FirewallTransaction
from firewall.core.io.policy import Policy
from firewall.core.logger import log
from firewall.core.rich import Rich_Service, Rich_Port, Rich_Protocol, Rich_SourcePort, Rich_ForwardPort, \
Rich_IcmpBlock, Rich_IcmpType, Rich_Masquerade, Rich_Mark
from firewall.functions import checkIPnMask, checkIP6nMask, check_mac
from firewall import errors
from firewall.errors import FirewallError
from firewall.fw_types import LastUpdatedOrderedDict
class FirewallZone(object):
ZONE_POLICY_PRIORITY = 0
def __init__(self, fw):
self._fw = fw
self._zones = { }
self._zone_policies = { }
def __repr__(self):
return '%s(%r)' % (self.__class__, self._zones)
def cleanup(self):
self._zones.clear()
self._zone_policies.clear()
def new_transaction(self):
return FirewallTransaction(self._fw)
def policy_name_from_zones(self, fromZone, toZone):
return "zone_{fromZone}_{toZone}".format(fromZone=fromZone, toZone=toZone)
# zones
def get_zones(self):
return sorted(self._zones.keys())
def get_active_zones(self):
active_zones = []
for zone in self.get_zones():
if self.list_interfaces(zone) or self.list_sources(zone):
active_zones.append(zone)
return active_zones
def get_zone_of_interface(self, interface):
interface_id = self.__interface_id(interface)
for zone in self._zones:
if interface_id in self._zones[zone].settings["interfaces"]:
# an interface can only be part of one zone
return zone
return None
def get_zone_of_source(self, source):
source_id = self.__source_id(source)
for zone in self._zones:
if source_id in self._zones[zone].settings["sources"]:
# a source_id can only be part of one zone
return zone
return None
def get_zone(self, zone):
z = self._fw.check_zone(zone)
return self._zones[z]
def policy_obj_from_zone_obj(self, z_obj, fromZone, toZone):
p_obj = Policy()
p_obj.derived_from_zone = z_obj.name
p_obj.name = self.policy_name_from_zones(fromZone, toZone)
p_obj.priority = self.ZONE_POLICY_PRIORITY
p_obj.target = z_obj.target
p_obj.ingress_zones = [fromZone]
p_obj.egress_zones = [toZone]
# copy zone permanent config to policy permanent config
# WARN: This assumes the same attribute names.
#
for setting in ["services", "ports",
"masquerade", "forward_ports",
"source_ports",
"icmp_blocks", "rules",
"protocols"]:
if fromZone == z_obj.name and toZone == "HOST" and \
setting in ["services", "ports", "source_ports", "icmp_blocks", "protocols"]:
# zone --> HOST
setattr(p_obj, setting, copy.deepcopy(getattr(z_obj, setting)))
elif fromZone == "ANY" and toZone == z_obj.name and setting in ["masquerade"]:
# any zone --> zone
setattr(p_obj, setting, copy.deepcopy(getattr(z_obj, setting)))
elif fromZone == z_obj.name and toZone == "ANY" and \
setting in ["icmp_blocks", "forward_ports"]:
# zone --> any zone
setattr(p_obj, setting, copy.deepcopy(getattr(z_obj, setting)))
elif setting in ["rules"]:
p_obj.rules = []
for rule in z_obj.rules:
current_policy = self.policy_name_from_zones(fromZone, toZone)
if current_policy in self._rich_rule_to_policies(z_obj.name, rule):
p_obj.rules.append(copy.deepcopy(rule))
return p_obj
def add_zone(self, obj):
obj.settings = { x : LastUpdatedOrderedDict()
for x in ["interfaces", "sources",
"icmp_block_inversion",
"forward"] }
self._zones[obj.name] = obj
self._zone_policies[obj.name] = []
# Create policy objects, will need many:
# - (zone --> HOST) - ports, service, etc
# - (any zone --> zone) - masquerade
# - (zone --> any zone) - ICMP block, icmp block inversion
# - also includes forward-ports because it works on (nat,
# PREROUTING) and therefore applies to redirects to the local
# host or dnat to a different host.
# - also includes rich rule "mark" action for the same reason
#
for fromZone,toZone in [(obj.name, "HOST"),
("ANY", obj.name), (obj.name, "ANY")]:
p_obj = self.policy_obj_from_zone_obj(obj, fromZone, toZone)
self._fw.policy.add_policy(p_obj)
self._zone_policies[obj.name].append(p_obj.name)
self.copy_permanent_to_runtime(obj.name)
def copy_permanent_to_runtime(self, zone):
obj = self._zones[zone]
for arg in obj.interfaces:
self.add_interface(zone, arg, allow_apply=False)
for arg in obj.sources:
self.add_source(zone, arg, allow_apply=False)
if obj.forward:
self.add_forward(zone)
if obj.icmp_block_inversion:
self.add_icmp_block_inversion(zone)
def remove_zone(self, zone):
obj = self._zones[zone]
if obj.applied:
self.unapply_zone_settings(zone)
obj.settings.clear()
del self._zones[zone]
del self._zone_policies[zone]
def apply_zones(self, use_transaction=None):
for zone in self.get_zones():
z_obj = self._zones[zone]
if len(z_obj.interfaces) > 0 or len(z_obj.sources) > 0:
log.debug1("Applying zone '%s'", zone)
self.apply_zone_settings(zone, use_transaction=use_transaction)
def set_zone_applied(self, zone, applied):
obj = self._zones[zone]
obj.applied = applied
# zone from chain
def zone_from_chain(self, chain):
if "_" not in chain:
# no zone chain
return None
splits = chain.split("_")
if len(splits) < 2:
return None
_chain = None
for x in SHORTCUTS:
if splits[0] == SHORTCUTS[x]:
_chain = x
if _chain is not None:
# next part needs to be zone name
if splits[1] not in self.get_zones():
return None
if len(splits) == 2 or \
(len(splits) == 3 and splits[2] in [ "pre", "log", "deny", "allow", "post" ]):
return (splits[1], _chain)
return None
def policy_from_chain(self, chain):
x = self.zone_from_chain(chain)
if x is None:
return None
(zone, _chain) = x
# derived from _get_table_chains_for_zone_dispatch()
if _chain in ["PREROUTING", "FORWARD_IN"]:
fromZone = zone
toZone = "ANY"
elif _chain in ["INPUT"]:
fromZone = zone
toZone = "HOST"
elif _chain in ["POSTROUTING", "FORWARD_OUT"]:
fromZone = "ANY"
toZone = zone
else:
raise FirewallError(errors.INVALID_CHAIN, "chain '%s' can't be mapped to a policy" % (chain))
return (self.policy_name_from_zones(fromZone, toZone), _chain)
def create_zone_base_by_chain(self, ipv, table, chain,
use_transaction=None):
# Create zone base chains if the chain is reserved for a zone
if ipv in [ "ipv4", "ipv6" ]:
x = self.policy_from_chain(chain)
if x is not None:
(policy, _chain) = self.policy_from_chain(chain)
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
self._fw.policy.gen_chain_rules(policy, True, table, _chain,
transaction)
if use_transaction is None:
transaction.execute(True)
# settings
# generate settings record with sender, timeout
def __gen_settings(self, timeout, sender):
ret = {
"date": time.time(),
"sender": sender,
"timeout": timeout,
}
return ret
def get_settings(self, zone):
return self.get_zone(zone).settings
def _zone_settings(self, enable, zone, transaction):
settings = self.get_settings(zone)
for key in settings:
for args in settings[key]:
if key == "interfaces":
self._interface(enable, zone, args, transaction)
elif key == "sources":
self._source(enable, zone, args[0], args[1], transaction)
elif key == "icmp_block_inversion":
continue
elif key == "forward":
# no need to call this when applying the zone as the rules
# will be generated when adding the interfaces/sources
pass
else:
log.warning("Zone '%s': Unknown setting '%s:%s', "
"unable to apply", zone, key, args)
# ICMP-block-inversion is always applied
if enable:
self._icmp_block_inversion(enable, zone, transaction)
def apply_zone_settings(self, zone, use_transaction=None):
_zone = self._fw.check_zone(zone)
obj = self._zones[_zone]
if obj.applied:
return
obj.applied = True
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
for policy in self._zone_policies[_zone]:
log.debug1("Applying policy (%s) derived from zone '%s'", policy, zone)
self._fw.policy.apply_policy_settings(policy, use_transaction=transaction)
self._zone_settings(True, _zone, transaction)
if use_transaction is None:
transaction.execute(True)
def unapply_zone_settings(self, zone, use_transaction=None):
_zone = self._fw.check_zone(zone)
obj = self._zones[_zone]
if not obj.applied:
return
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
for policy in self._zone_policies[_zone]:
self._fw.policy.unapply_policy_settings(policy, use_transaction=transaction)
self._zone_settings(False, _zone, transaction)
if use_transaction is None:
transaction.execute(True)
def get_config_with_settings(self, zone):
"""
:return: exported config updated with runtime settings
"""
obj = self.get_zone(zone)
conf_dict = self.get_config_with_settings_dict(zone)
conf_list = []
for i in range(16): # tuple based API has 16 elements
if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict:
# old API needs the empty elements as well. Grab it from the
# class otherwise we don't know the type.
conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0])))
else:
conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]])
return tuple(conf_list)
def get_config_with_settings_dict(self, zone):
"""
:return: exported config updated with runtime settings
"""
permanent = self.get_zone(zone).export_config_dict()
if permanent["target"] == DEFAULT_ZONE_TARGET:
permanent["target"] = "default"
runtime = { "services": self.list_services(zone),
"ports": self.list_ports(zone),
"icmp_blocks": self.list_icmp_blocks(zone),
"masquerade": self.query_masquerade(zone),
"forward_ports": self.list_forward_ports(zone),
"interfaces": self.list_interfaces(zone),
"sources": self.list_sources(zone),
"rules_str": self.list_rules(zone),
"protocols": self.list_protocols(zone),
"source_ports": self.list_source_ports(zone),
"icmp_block_inversion": self.query_icmp_block_inversion(zone),
"forward": self.query_forward(zone),
}
return self._fw.combine_runtime_with_permanent_settings(permanent, runtime)
def set_config_with_settings_dict(self, zone, settings, sender):
# stupid wrappers to convert rich rule string to rich rule object
from firewall.core.rich import Rich_Rule
def add_rule_wrapper(zone, rule_str, timeout=0, sender=None):
self.add_rule(zone, Rich_Rule(rule_str=rule_str), timeout=0, sender=sender)
def remove_rule_wrapper(zone, rule_str):
self.remove_rule(zone, Rich_Rule(rule_str=rule_str))
setting_to_fn = {
"services": (self.add_service, self.remove_service),
"ports": (self.add_port, self.remove_port),
"icmp_blocks": (self.add_icmp_block, self.remove_icmp_block),
"masquerade": (self.add_masquerade, self.remove_masquerade),
"forward_ports": (self.add_forward_port, self.remove_forward_port),
"interfaces": (self.add_interface, self.remove_interface),
"sources": (self.add_source, self.remove_source),
"rules_str": (add_rule_wrapper, remove_rule_wrapper),
"protocols": (self.add_protocol, self.remove_protocol),
"source_ports": (self.add_source_port, self.remove_source_port),
"icmp_block_inversion": (self.add_icmp_block_inversion, self.remove_icmp_block_inversion),
"forward": (self.add_forward, self.remove_forward),
}
old_settings = self.get_config_with_settings_dict(zone)
(add_settings, remove_settings) = self._fw.get_added_and_removed_settings(old_settings, settings)
for key in remove_settings:
if isinstance(remove_settings[key], list):
for args in remove_settings[key]:
if isinstance(args, tuple):
setting_to_fn[key][1](zone, *args)
else:
setting_to_fn[key][1](zone, args)
else: # bool
setting_to_fn[key][1](zone)
for key in add_settings:
if isinstance(add_settings[key], list):
for args in add_settings[key]:
if key in ["interfaces", "sources"]:
# no timeout arg
setting_to_fn[key][0](zone, args, sender=sender)
else:
if isinstance(args, tuple):
setting_to_fn[key][0](zone, *args, timeout=0, sender=sender)
else:
setting_to_fn[key][0](zone, args, timeout=0, sender=sender)
else: # bool
if key in ["icmp_block_inversion"]:
# no timeout arg
setting_to_fn[key][0](zone, sender=sender)
else:
setting_to_fn[key][0](zone, timeout=0, sender=sender)
# INTERFACES
def check_interface(self, interface):
self._fw.check_interface(interface)
def interface_get_sender(self, zone, interface):
_zone = self._fw.check_zone(zone)
_obj = self._zones[_zone]
interface_id = self.__interface_id(interface)
if interface_id in _obj.settings["interfaces"]:
settings = _obj.settings["interfaces"][interface_id]
if "sender" in settings and settings["sender"] is not None:
return settings["sender"]
return None
def __interface_id(self, interface):
self.check_interface(interface)
return interface
def add_interface(self, zone, interface, sender=None,
use_transaction=None, allow_apply=True):
self._fw.check_panic()
_zone = self._fw.check_zone(zone)
_obj = self._zones[_zone]
interface_id = self.__interface_id(interface)
if interface_id in _obj.settings["interfaces"]:
raise FirewallError(errors.ZONE_ALREADY_SET,
"'%s' already bound to '%s'" % (interface,
zone))
if self.get_zone_of_interface(interface) is not None:
raise FirewallError(errors.ZONE_CONFLICT,
"'%s' already bound to a zone" % interface)
log.debug1("Setting zone of interface '%s' to '%s'" % (interface,
_zone))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if not _obj.applied and allow_apply:
self.apply_zone_settings(zone,
use_transaction=transaction)
transaction.add_fail(self.set_zone_applied, _zone, False)
if allow_apply:
self._interface(True, _zone, interface, transaction)
self.__register_interface(_obj, interface_id, zone, sender)
transaction.add_fail(self.__unregister_interface, _obj,
interface_id)
if use_transaction is None:
transaction.execute(True)
return _zone
def __register_interface(self, _obj, interface_id, zone, sender):
_obj.settings["interfaces"][interface_id] = \
self.__gen_settings(0, sender)
# add information whether we add to default or specific zone
_obj.settings["interfaces"][interface_id]["__default__"] = \
(not zone or zone == "")
def change_zone_of_interface(self, zone, interface, sender=None):
self._fw.check_panic()
_old_zone = self.get_zone_of_interface(interface)
_new_zone = self._fw.check_zone(zone)
if _new_zone == _old_zone:
return _old_zone
if _old_zone is not None:
self.remove_interface(_old_zone, interface)
_zone = self.add_interface(zone, interface, sender)
return _zone
def change_default_zone(self, old_zone, new_zone, use_transaction=None):
self._fw.check_panic()
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
self.apply_zone_settings(new_zone, transaction)
self._interface(True, new_zone, "+", transaction, append=True)
if old_zone is not None and old_zone != "":
self._interface(False, old_zone, "+", transaction, append=True)
if use_transaction is None:
transaction.execute(True)
def remove_interface(self, zone, interface,
use_transaction=None):
self._fw.check_panic()
zoi = self.get_zone_of_interface(interface)
if zoi is None:
raise FirewallError(errors.UNKNOWN_INTERFACE,
"'%s' is not in any zone" % interface)
_zone = zoi if zone == "" else self._fw.check_zone(zone)
if zoi != _zone:
raise FirewallError(errors.ZONE_CONFLICT,
"remove_interface(%s, %s): zoi='%s'" % \
(zone, interface, zoi))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
_obj = self._zones[_zone]
interface_id = self.__interface_id(interface)
transaction.add_post(self.__unregister_interface, _obj, interface_id)
self._interface(False, _zone, interface, transaction)
if use_transaction is None:
transaction.execute(True)
return _zone
def __unregister_interface(self, _obj, interface_id):
if interface_id in _obj.settings["interfaces"]:
del _obj.settings["interfaces"][interface_id]
def query_interface(self, zone, interface):
return self.__interface_id(interface) in self.get_settings(zone)["interfaces"]
def list_interfaces(self, zone):
return self.get_settings(zone)["interfaces"].keys()
# SOURCES
def check_source(self, source, applied=False):
if checkIPnMask(source):
return "ipv4"
elif checkIP6nMask(source):
return "ipv6"
elif check_mac(source):
return ""
elif source.startswith("ipset:"):
self._check_ipset_type_for_source(source[6:])
if applied:
self._check_ipset_applied(source[6:])
return self._ipset_family(source[6:])
else:
raise FirewallError(errors.INVALID_ADDR, source)
def __source_id(self, source, applied=False):
ipv = self.check_source(source, applied=applied)
return (ipv, source)
def add_source(self, zone, source, sender=None, use_transaction=None,
allow_apply=True):
self._fw.check_panic()
_zone = self._fw.check_zone(zone)
_obj = self._zones[_zone]
if check_mac(source):
source = source.upper()
source_id = self.__source_id(source, applied=allow_apply)
if source_id in _obj.settings["sources"]:
raise FirewallError(errors.ZONE_ALREADY_SET,
"'%s' already bound to '%s'" % (source, _zone))
if self.get_zone_of_source(source) is not None:
raise FirewallError(errors.ZONE_CONFLICT,
"'%s' already bound to a zone" % source)
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if not _obj.applied and allow_apply:
self.apply_zone_settings(zone,
use_transaction=transaction)
transaction.add_fail(self.set_zone_applied, _zone, False)
if allow_apply:
self._source(True, _zone, source_id[0], source_id[1], transaction)
self.__register_source(_obj, source_id, zone, sender)
transaction.add_fail(self.__unregister_source, _obj, source_id)
if use_transaction is None:
transaction.execute(True)
return _zone
def __register_source(self, _obj, source_id, zone, sender):
_obj.settings["sources"][source_id] = \
self.__gen_settings(0, sender)
# add information whether we add to default or specific zone
_obj.settings["sources"][source_id]["__default__"] = (not zone or zone == "")
def change_zone_of_source(self, zone, source, sender=None):
self._fw.check_panic()
_old_zone = self.get_zone_of_source(source)
_new_zone = self._fw.check_zone(zone)
if _new_zone == _old_zone:
return _old_zone
if check_mac(source):
source = source.upper()
if _old_zone is not None:
self.remove_source(_old_zone, source)
_zone = self.add_source(zone, source, sender)
return _zone
def remove_source(self, zone, source,
use_transaction=None):
self._fw.check_panic()
if check_mac(source):
source = source.upper()
zos = self.get_zone_of_source(source)
if zos is None:
raise FirewallError(errors.UNKNOWN_SOURCE,
"'%s' is not in any zone" % source)
_zone = zos if zone == "" else self._fw.check_zone(zone)
if zos != _zone:
raise FirewallError(errors.ZONE_CONFLICT,
"remove_source(%s, %s): zos='%s'" % \
(zone, source, zos))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
_obj = self._zones[_zone]
source_id = self.__source_id(source)
transaction.add_post(self.__unregister_source, _obj, source_id)
self._source(False, _zone, source_id[0], source_id[1], transaction)
if use_transaction is None:
transaction.execute(True)
return _zone
def __unregister_source(self, _obj, source_id):
if source_id in _obj.settings["sources"]:
del _obj.settings["sources"][source_id]
def query_source(self, zone, source):
if check_mac(source):
source = source.upper()
return self.__source_id(source) in self.get_settings(zone)["sources"]
def list_sources(self, zone):
return [ k[1] for k in self.get_settings(zone)["sources"].keys() ]
def _interface(self, enable, zone, interface, transaction, append=False):
for backend in self._fw.enabled_backends():
if not backend.policies_supported:
continue
for policy in self._zone_policies[zone]:
for (table, chain) in self._fw.policy._get_table_chains_for_zone_dispatch(policy):
rules = backend.build_zone_source_interface_rules(enable,
zone, policy, interface, table, chain, append)
transaction.add_rules(backend, rules)
# intra zone forward
policy = self.policy_name_from_zones(zone, "ANY")
# Skip adding wildcard/catch-all interface (for default
# zone). Otherwise it would allow forwarding from interface
# in default zone -> interface not in default zone (but in
# a different zone).
if self.get_settings(zone)["forward"] and interface not in ["+", "*"]:
rules = backend.build_zone_forward_rules(enable, zone, policy, "filter", interface=interface)
transaction.add_rules(backend, rules)
# update policy dispatch for any policy using this zone in ingress
# or egress
for policy in self._fw.policy.get_policies_not_derived_from_zone():
if zone not in self._fw.policy.list_ingress_zones(policy) and \
zone not in self._fw.policy.list_egress_zones(policy):
continue
if policy in self._fw.policy.get_active_policies_not_derived_from_zone() and self._fw.policy.get_policy(policy).applied:
# first remove the old set of interfaces using the current zone
# settings.
if not enable and len(self.list_interfaces(zone)) == 1:
self._fw.policy.unapply_policy_settings(policy, use_transaction=transaction)
else:
self._fw.policy._ingress_egress_zones(False, policy, transaction)
# after the transaction ends and therefore the interface
# has been added to the zone's settings, update the
# dependent policies
transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \
self._fw.policy._ingress_egress_zones_transaction(True, p), policy)
elif enable:
transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \
self._fw.policy.apply_policy_settings(p), policy)
# IPSETS
def _ipset_family(self, name):
if self._ipset_type(name) == "hash:mac":
return None
return self._fw.ipset.get_family(name, applied=False)
def _ipset_type(self, name):
return self._fw.ipset.get_type(name, applied=False)
def _ipset_match_flags(self, name, flag):
return ",".join([flag] * self._fw.ipset.get_dimension(name))
def _check_ipset_applied(self, name):
return self._fw.ipset.check_applied(name)
def _check_ipset_type_for_source(self, name):
_type = self._ipset_type(name)
if _type not in SOURCE_IPSET_TYPES:
raise FirewallError(
errors.INVALID_IPSET,
"ipset '%s' with type '%s' not usable as source" % \
(name, _type))
def _source(self, enable, zone, ipv, source, transaction):
# For mac source bindings ipv is an empty string, the mac source will
# be added for ipv4 and ipv6
for backend in [self._fw.get_backend_by_ipv(ipv)] if ipv else self._fw.enabled_backends():
if not backend.policies_supported:
continue
for policy in self._zone_policies[zone]:
for (table, chain) in self._fw.policy._get_table_chains_for_zone_dispatch(policy):
rules = backend.build_zone_source_address_rules(enable, zone,
policy, source, table, chain)
transaction.add_rules(backend, rules)
# intra zone forward
policy = self.policy_name_from_zones(zone, "ANY")
if self.get_settings(zone)["forward"]:
rules = backend.build_zone_forward_rules(enable, zone, policy, "filter", source=source)
transaction.add_rules(backend, rules)
# update policy dispatch for any policy using this zone in ingress
# or egress
for policy in self._fw.policy.get_policies_not_derived_from_zone():
if zone not in self._fw.policy.list_ingress_zones(policy) and \
zone not in self._fw.policy.list_egress_zones(policy):
continue
if policy in self._fw.policy.get_active_policies_not_derived_from_zone() and self._fw.policy.get_policy(policy).applied:
# first remove the old set of sources using the current zone
# settings.
if not enable and len(self.list_sources(zone)) == 1:
self._fw.policy.unapply_policy_settings(policy, use_transaction=transaction)
else:
self._fw.policy._ingress_egress_zones(False, policy, transaction)
# after the transaction ends and therefore the sources
# has been added to the zone's settings, update the
# dependent policies
transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \
self._fw.policy._ingress_egress_zones_transaction(True, p), policy)
elif enable:
transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \
self._fw.policy.apply_policy_settings(p), policy)
def add_service(self, zone, service, timeout=0, sender=None):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.add_service(p_name, service, timeout, sender)
return zone
def remove_service(self, zone, service):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.remove_service(p_name, service)
return zone
def query_service(self, zone, service):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
return self._fw.policy.query_service(p_name, service)
def list_services(self, zone):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
return self._fw.policy.list_services(p_name)
def add_port(self, zone, port, protocol, timeout=0, sender=None):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.add_port(p_name, port, protocol, timeout, sender)
return zone
def remove_port(self, zone, port, protocol):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.remove_port(p_name, port, protocol)
return zone
def query_port(self, zone, port, protocol):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
return self._fw.policy.query_port(p_name, port, protocol)
def list_ports(self, zone):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
return self._fw.policy.list_ports(p_name)
def add_source_port(self, zone, source_port, protocol, timeout=0, sender=None):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.add_source_port(p_name, source_port, protocol, timeout, sender)
return zone
def remove_source_port(self, zone, source_port, protocol):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.remove_source_port(p_name, source_port, protocol)
return zone
def query_source_port(self, zone, source_port, protocol):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
return self._fw.policy.query_source_port(p_name, source_port, protocol)
def list_source_ports(self, zone):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
return self._fw.policy.list_source_ports(p_name)
def _rich_rule_to_policies(self, zone, rule):
zone = self._fw.check_zone(zone)
if type(rule.action) == Rich_Mark:
return [self.policy_name_from_zones(zone, "ANY")]
elif type(rule.element) in [Rich_Service, Rich_Port, Rich_Protocol,
Rich_SourcePort]:
return [self.policy_name_from_zones(zone, "HOST")]
elif type(rule.element) in [Rich_IcmpBlock, Rich_IcmpType]:
return [self.policy_name_from_zones(zone, "HOST"),
self.policy_name_from_zones(zone, "ANY")]
elif type(rule.element) in [Rich_ForwardPort]:
return [self.policy_name_from_zones(zone, "ANY")]
elif type(rule.element) in [Rich_Masquerade]:
return [self.policy_name_from_zones("ANY", zone)]
elif rule.element is None:
return [self.policy_name_from_zones(zone, "HOST")]
else:
raise FirewallError("Rich rule type (%s) not handled." % (type(rule.element)))
def add_rule(self, zone, rule, timeout=0, sender=None):
for p_name in self._rich_rule_to_policies(zone, rule):
self._fw.policy.add_rule(p_name, rule, timeout, sender)
return zone
def remove_rule(self, zone, rule):
for p_name in self._rich_rule_to_policies(zone, rule):
self._fw.policy.remove_rule(p_name, rule)
return zone
def query_rule(self, zone, rule):
ret = True
for p_name in self._rich_rule_to_policies(zone, rule):
ret = ret and self._fw.policy.query_rule(p_name, rule)
return ret
def list_rules(self, zone):
zone = self._fw.check_zone(zone)
ret = set()
for p_name in [self.policy_name_from_zones(zone, "ANY"),
self.policy_name_from_zones(zone, "HOST"),
self.policy_name_from_zones("ANY", zone)]:
ret.update(set(self._fw.policy.list_rules(p_name)))
return list(ret)
def add_protocol(self, zone, protocol, timeout=0, sender=None):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.add_protocol(p_name, protocol, timeout, sender)
return zone
def remove_protocol(self, zone, protocol):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.remove_protocol(p_name, protocol)
return zone
def query_protocol(self, zone, protocol):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
return self._fw.policy.query_protocol(p_name, protocol)
def list_protocols(self, zone):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
return self._fw.policy.list_protocols(p_name)
def add_masquerade(self, zone, timeout=0, sender=None):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones("ANY", zone)
self._fw.policy.add_masquerade(p_name, timeout, sender)
return zone
def remove_masquerade(self, zone):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones("ANY", zone)
self._fw.policy.remove_masquerade(p_name)
return zone
def query_masquerade(self, zone):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones("ANY", zone)
return self._fw.policy.query_masquerade(p_name)
def add_forward_port(self, zone, port, protocol, toport=None,
toaddr=None, timeout=0, sender=None):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "ANY")
self._fw.policy.add_forward_port(p_name, port, protocol, toport, toaddr,
timeout, sender)
return zone
def remove_forward_port(self, zone, port, protocol, toport=None,
toaddr=None):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "ANY")
self._fw.policy.remove_forward_port(p_name, port, protocol, toport, toaddr)
return zone
def query_forward_port(self, zone, port, protocol, toport=None,
toaddr=None):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "ANY")
return self._fw.policy.query_forward_port(p_name, port, protocol, toport,
toaddr)
def list_forward_ports(self, zone):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "ANY")
return self._fw.policy.list_forward_ports(p_name)
def add_icmp_block(self, zone, icmp, timeout=0, sender=None):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.add_icmp_block(p_name, icmp, timeout, sender)
p_name = self.policy_name_from_zones(zone, "ANY")
self._fw.policy.add_icmp_block(p_name, icmp, timeout, sender)
return zone
def remove_icmp_block(self, zone, icmp):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.remove_icmp_block(p_name, icmp)
p_name = self.policy_name_from_zones(zone, "ANY")
self._fw.policy.remove_icmp_block(p_name, icmp)
return zone
def query_icmp_block(self, zone, icmp):
zone = self._fw.check_zone(zone)
p_name_host = self.policy_name_from_zones(zone, "HOST")
p_name_fwd = self.policy_name_from_zones(zone, "ANY")
return self._fw.policy.query_icmp_block(p_name_host, icmp) and \
self._fw.policy.query_icmp_block(p_name_fwd, icmp)
def list_icmp_blocks(self, zone):
zone = self._fw.check_zone(zone)
p_name_host = self.policy_name_from_zones(zone, "HOST")
p_name_fwd = self.policy_name_from_zones(zone, "ANY")
return sorted(set(self._fw.policy.list_icmp_blocks(p_name_host) +
self._fw.policy.list_icmp_blocks(p_name_fwd)))
def add_icmp_block_inversion(self, zone, sender=None):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.add_icmp_block_inversion(p_name, sender)
p_name = self.policy_name_from_zones(zone, "ANY")
self._fw.policy.add_icmp_block_inversion(p_name, sender)
return zone
def _icmp_block_inversion(self, enable, zone, transaction):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy._icmp_block_inversion(enable, p_name, transaction)
p_name = self.policy_name_from_zones(zone, "ANY")
self._fw.policy._icmp_block_inversion(enable, p_name, transaction)
def remove_icmp_block_inversion(self, zone):
zone = self._fw.check_zone(zone)
p_name = self.policy_name_from_zones(zone, "HOST")
self._fw.policy.remove_icmp_block_inversion(p_name)
p_name = self.policy_name_from_zones(zone, "ANY")
self._fw.policy.remove_icmp_block_inversion(p_name)
return zone
def query_icmp_block_inversion(self, zone):
zone = self._fw.check_zone(zone)
p_name_host = self.policy_name_from_zones(zone, "HOST")
p_name_fwd = self.policy_name_from_zones(zone, "ANY")
return self._fw.policy.query_icmp_block_inversion(p_name_host) and \
self._fw.policy.query_icmp_block_inversion(p_name_fwd)
def _forward(self, enable, zone, transaction):
p_name = self.policy_name_from_zones(zone, "ANY")
for interface in self._zones[zone].settings["interfaces"]:
for backend in self._fw.enabled_backends():
if not backend.policies_supported:
continue
rules = backend.build_zone_forward_rules(enable, zone, p_name, "filter", interface=interface)
transaction.add_rules(backend, rules)
for ipv,source in self._zones[zone].settings["sources"]:
for backend in [self._fw.get_backend_by_ipv(ipv)] if ipv else self._fw.enabled_backends():
if not backend.policies_supported:
continue
rules = backend.build_zone_forward_rules(enable, zone, p_name, "filter", source=source)
transaction.add_rules(backend, rules)
def __forward_id(self):
return True
def add_forward(self, zone, timeout=0, sender=None,
use_transaction=None):
_zone = self._fw.check_zone(zone)
self._fw.check_timeout(timeout)
self._fw.check_panic()
_obj = self._zones[_zone]
forward_id = self.__forward_id()
if forward_id in _obj.settings["forward"]:
raise FirewallError(errors.ALREADY_ENABLED,
"forward already enabled in '%s'" % _zone)
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._forward(True, _zone, transaction)
self.__register_forward(_obj, forward_id, timeout, sender)
transaction.add_fail(self.__unregister_forward, _obj, forward_id)
if use_transaction is None:
transaction.execute(True)
return _zone
def __register_forward(self, _obj, forward_id, timeout, sender):
_obj.settings["forward"][forward_id] = \
self.__gen_settings(timeout, sender)
def remove_forward(self, zone, use_transaction=None):
_zone = self._fw.check_zone(zone)
self._fw.check_panic()
_obj = self._zones[_zone]
forward_id = self.__forward_id()
if forward_id not in _obj.settings["forward"]:
raise FirewallError(errors.NOT_ENABLED,
"forward not enabled in '%s'" % _zone)
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._forward(False, _zone, transaction)
transaction.add_post(self.__unregister_forward, _obj, forward_id)
if use_transaction is None:
transaction.execute(True)
return _zone
def __unregister_forward(self, _obj, forward_id):
if forward_id in _obj.settings["forward"]:
del _obj.settings["forward"][forward_id]
def query_forward(self, zone):
return self.__forward_id() in self.get_settings(zone)["forward"]
core/ipXtables.py 0000644 00000170666 15035135172 0010023 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import os.path
import copy
from firewall.core.prog import runProg
from firewall.core.logger import log
from firewall.functions import tempFile, readfile, splitArgs, check_mac, portStr, \
check_single_address, check_address, normalizeIP6
from firewall import config
from firewall.errors import FirewallError, INVALID_PASSTHROUGH, INVALID_RULE, UNKNOWN_ERROR, INVALID_ADDR
from firewall.core.rich import Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark, \
Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock
import string
POLICY_CHAIN_PREFIX = ""
BUILT_IN_CHAINS = {
"security": [ "INPUT", "OUTPUT", "FORWARD" ],
"raw": [ "PREROUTING", "OUTPUT" ],
"mangle": [ "PREROUTING", "POSTROUTING", "INPUT", "OUTPUT", "FORWARD" ],
"nat": [ "PREROUTING", "POSTROUTING", "OUTPUT" ],
"filter": [ "INPUT", "OUTPUT", "FORWARD" ],
}
DEFAULT_REJECT_TYPE = {
"ipv4": "icmp-host-prohibited",
"ipv6": "icmp6-adm-prohibited",
}
ICMP = {
"ipv4": "icmp",
"ipv6": "ipv6-icmp",
}
# ipv ebtables also uses this
#
def common_reverse_rule(args):
""" Inverse valid rule """
replace_args = {
# Append
"-A": "-D",
"--append": "--delete",
# Insert
"-I": "-D",
"--insert": "--delete",
# New chain
"-N": "-X",
"--new-chain": "--delete-chain",
}
ret_args = args[:]
for arg in replace_args:
try:
idx = ret_args.index(arg)
except Exception:
continue
if arg in [ "-I", "--insert" ]:
# With insert rulenum, then remove it if it is a number
# Opt at position idx, chain at position idx+1, [rulenum] at
# position idx+2
try:
int(ret_args[idx+2])
except Exception:
pass
else:
ret_args.pop(idx+2)
ret_args[idx] = replace_args[arg]
return ret_args
def common_reverse_passthrough(args):
""" Reverse valid passthough rule """
replace_args = {
# Append
"-A": "-D",
"--append": "--delete",
# Insert
"-I": "-D",
"--insert": "--delete",
# New chain
"-N": "-X",
"--new-chain": "--delete-chain",
}
ret_args = args[:]
for x in replace_args:
try:
idx = ret_args.index(x)
except ValueError:
continue
if x in [ "-I", "--insert" ]:
# With insert rulenum, then remove it if it is a number
# Opt at position idx, chain at position idx+1, [rulenum] at
# position idx+2
try:
int(ret_args[idx+2])
except ValueError:
pass
else:
ret_args.pop(idx+2)
ret_args[idx] = replace_args[x]
return ret_args
raise FirewallError(INVALID_PASSTHROUGH,
"no '-A', '-I' or '-N' arg")
# ipv ebtables also uses this
#
def common_check_passthrough(args):
""" Check if passthough rule is valid (only add, insert and new chain
rules are allowed) """
args = set(args)
not_allowed = set(["-C", "--check", # check rule
"-D", "--delete", # delete rule
"-R", "--replace", # replace rule
"-L", "--list", # list rule
"-S", "--list-rules", # print rules
"-F", "--flush", # flush rules
"-Z", "--zero", # zero rules
"-X", "--delete-chain", # delete chain
"-P", "--policy", # policy
"-E", "--rename-chain"]) # rename chain)
# intersection of args and not_allowed is not empty, i.e.
# something from args is not allowed
if len(args & not_allowed) > 0:
raise FirewallError(INVALID_PASSTHROUGH,
"arg '%s' is not allowed" %
list(args & not_allowed)[0])
# args need to contain one of -A, -I, -N
needed = set(["-A", "--append",
"-I", "--insert",
"-N", "--new-chain"])
# empty intersection of args and needed, i.e.
# none from args contains any needed command
if len(args & needed) == 0:
raise FirewallError(INVALID_PASSTHROUGH,
"no '-A', '-I' or '-N' arg")
class ip4tables(object):
ipv = "ipv4"
name = "ip4tables"
policies_supported = True
def __init__(self, fw):
self._fw = fw
self._command = config.COMMANDS[self.ipv]
self._restore_command = config.COMMANDS["%s-restore" % self.ipv]
self.wait_option = self._detect_wait_option()
self.restore_wait_option = self._detect_restore_wait_option()
self.fill_exists()
self.available_tables = []
self.rich_rule_priority_counts = {}
self.policy_priority_counts = {}
self.zone_source_index_cache = []
self.our_chains = {} # chains created by firewalld
def fill_exists(self):
self.command_exists = os.path.exists(self._command)
self.restore_command_exists = os.path.exists(self._restore_command)
def __run(self, args):
# convert to string list
if self.wait_option and self.wait_option not in args:
_args = [self.wait_option] + ["%s" % item for item in args]
else:
_args = ["%s" % item for item in args]
log.debug2("%s: %s %s", self.__class__, self._command, " ".join(_args))
(status, ret) = runProg(self._command, _args)
if status != 0:
raise ValueError("'%s %s' failed: %s" % (self._command,
" ".join(_args), ret))
return ret
def _rule_replace(self, rule, pattern, replacement):
try:
i = rule.index(pattern)
except ValueError:
return False
else:
rule[i:i+1] = replacement
return True
def is_chain_builtin(self, ipv, table, chain):
return table in BUILT_IN_CHAINS and \
chain in BUILT_IN_CHAINS[table]
def build_chain_rules(self, add, table, chain):
rule = [ "-t", table ]
if add:
rule.append("-N")
else:
rule.append("-X")
rule.append(chain)
return [rule]
def build_rule(self, add, table, chain, index, args):
rule = [ "-t", table ]
if add:
rule += [ "-I", chain, str(index) ]
else:
rule += [ "-D", chain ]
rule += args
return rule
def reverse_rule(self, args):
return common_reverse_rule(args)
def check_passthrough(self, args):
common_check_passthrough(args)
def reverse_passthrough(self, args):
return common_reverse_passthrough(args)
def passthrough_parse_table_chain(self, args):
table = "filter"
try:
i = args.index("-t")
except ValueError:
pass
else:
if len(args) >= i+1:
table = args[i+1]
chain = None
for opt in [ "-A", "--append",
"-I", "--insert",
"-N", "--new-chain" ]:
try:
i = args.index(opt)
except ValueError:
pass
else:
if len(args) >= i+1:
chain = args[i+1]
return (table, chain)
def _run_replace_zone_source(self, rule, zone_source_index_cache):
try:
i = rule.index("%%ZONE_SOURCE%%")
rule.pop(i)
zone = rule.pop(i)
if "-m" == rule[4]: # ipset/mac
zone_source = (zone, rule[7]) # (zone, address)
else:
zone_source = (zone, rule[5]) # (zone, address)
except ValueError:
try:
i = rule.index("%%ZONE_INTERFACE%%")
rule.pop(i)
zone_source = None
except ValueError:
return
rule_add = True
if rule[0] in ["-D", "--delete"]:
rule_add = False
if zone_source and not rule_add:
if zone_source in zone_source_index_cache:
zone_source_index_cache.remove(zone_source)
elif rule_add:
if zone_source:
# order source based dispatch by zone name
if zone_source not in zone_source_index_cache:
zone_source_index_cache.append(zone_source)
zone_source_index_cache.sort(key=lambda x: x[0])
index = zone_source_index_cache.index(zone_source)
else:
if self._fw._allow_zone_drifting:
index = 0
else:
index = len(zone_source_index_cache)
rule[0] = "-I"
rule.insert(2, "%d" % (index + 1))
def _set_rule_replace_priority(self, rule, priority_counts, token):
"""
Change something like
-t filter -I public_IN %%RICH_RULE_PRIORITY%% 123
or
-t filter -A public_IN %%RICH_RULE_PRIORITY%% 321
into
-t filter -I public_IN 4
or
-t filter -I public_IN
"""
try:
i = rule.index(token)
except ValueError:
pass
else:
rule_add = True
insert = False
insert_add_index = -1
rule.pop(i)
priority = rule.pop(i)
if type(priority) != int:
raise FirewallError(INVALID_RULE, "priority must be followed by a number")
table = "filter"
for opt in [ "-t", "--table" ]:
try:
j = rule.index(opt)
except ValueError:
pass
else:
if len(rule) >= j+1:
table = rule[j+1]
for opt in [ "-A", "--append",
"-I", "--insert",
"-D", "--delete" ]:
try:
insert_add_index = rule.index(opt)
except ValueError:
pass
else:
if len(rule) >= insert_add_index+1:
chain = rule[insert_add_index+1]
if opt in [ "-I", "--insert" ]:
insert = True
if opt in [ "-D", "--delete" ]:
rule_add = False
chain = (table, chain)
# Add the rule to the priority counts. We don't need to store the
# rule, just bump the ref count for the priority value.
if not rule_add:
if chain not in priority_counts or \
priority not in priority_counts[chain] or \
priority_counts[chain][priority] <= 0:
raise FirewallError(UNKNOWN_ERROR, "nonexistent or underflow of priority count")
priority_counts[chain][priority] -= 1
else:
if chain not in priority_counts:
priority_counts[chain] = {}
if priority not in priority_counts[chain]:
priority_counts[chain][priority] = 0
# calculate index of new rule
index = 1
for p in sorted(priority_counts[chain].keys()):
if p == priority and insert:
break
index += priority_counts[chain][p]
if p == priority:
break
priority_counts[chain][priority] += 1
rule[insert_add_index] = "-I"
rule.insert(insert_add_index+2, "%d" % index)
def set_rules(self, rules, log_denied):
temp_file = tempFile()
table_rules = { }
rich_rule_priority_counts = copy.deepcopy(self.rich_rule_priority_counts)
policy_priority_counts = copy.deepcopy(self.policy_priority_counts)
zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache)
for _rule in rules:
rule = _rule[:]
# replace %%REJECT%%
self._rule_replace(rule, "%%REJECT%%", \
["REJECT", "--reject-with", DEFAULT_REJECT_TYPE[self.ipv]])
# replace %%ICMP%%
self._rule_replace(rule, "%%ICMP%%", [ICMP[self.ipv]])
# replace %%LOGTYPE%%
try:
i = rule.index("%%LOGTYPE%%")
except ValueError:
pass
else:
if log_denied == "off":
continue
if log_denied in [ "unicast", "broadcast", "multicast" ]:
rule[i:i+1] = [ "-m", "pkttype", "--pkt-type", log_denied ]
else:
rule.pop(i)
self._set_rule_replace_priority(rule, rich_rule_priority_counts, "%%RICH_RULE_PRIORITY%%")
self._set_rule_replace_priority(rule, policy_priority_counts, "%%POLICY_PRIORITY%%")
self._run_replace_zone_source(rule, zone_source_index_cache)
table = "filter"
# get table form rule
for opt in [ "-t", "--table" ]:
try:
i = rule.index(opt)
except ValueError:
pass
else:
if len(rule) >= i+1:
rule.pop(i)
table = rule.pop(i)
# we can not use joinArgs here, because it would use "'" instead
# of '"' for the start and end of the string, this breaks
# iptables-restore
for i in range(len(rule)):
for c in string.whitespace:
if c in rule[i] and not (rule[i].startswith('"') and
rule[i].endswith('"')):
rule[i] = '"%s"' % rule[i]
table_rules.setdefault(table, []).append(rule)
for table in table_rules:
rules = table_rules[table]
temp_file.write("*%s\n" % table)
for rule in rules:
temp_file.write(" ".join(rule) + "\n")
temp_file.write("COMMIT\n")
temp_file.close()
stat = os.stat(temp_file.name)
log.debug2("%s: %s %s", self.__class__, self._restore_command,
"%s: %d" % (temp_file.name, stat.st_size))
args = [ ]
if self.restore_wait_option:
args.append(self.restore_wait_option)
args.append("-n")
(status, ret) = runProg(self._restore_command, args,
stdin=temp_file.name)
if log.getDebugLogLevel() > 2:
lines = readfile(temp_file.name)
if lines is not None:
i = 1
for line in lines:
log.debug3("%8d: %s" % (i, line), nofmt=1, nl=0)
if not line.endswith("\n"):
log.debug3("", nofmt=1)
i += 1
os.unlink(temp_file.name)
if status != 0:
raise ValueError("'%s %s' failed: %s" % (self._restore_command,
" ".join(args), ret))
self.rich_rule_priority_counts = rich_rule_priority_counts
self.policy_priority_counts = policy_priority_counts
self.zone_source_index_cache = zone_source_index_cache
def set_rule(self, rule, log_denied):
# replace %%REJECT%%
self._rule_replace(rule, "%%REJECT%%", \
["REJECT", "--reject-with", DEFAULT_REJECT_TYPE[self.ipv]])
# replace %%ICMP%%
self._rule_replace(rule, "%%ICMP%%", [ICMP[self.ipv]])
# replace %%LOGTYPE%%
try:
i = rule.index("%%LOGTYPE%%")
except ValueError:
pass
else:
if log_denied == "off":
return ""
if log_denied in [ "unicast", "broadcast", "multicast" ]:
rule[i:i+1] = [ "-m", "pkttype", "--pkt-type", log_denied ]
else:
rule.pop(i)
rich_rule_priority_counts = copy.deepcopy(self.rich_rule_priority_counts)
policy_priority_counts = copy.deepcopy(self.policy_priority_counts)
zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache)
self._set_rule_replace_priority(rule, rich_rule_priority_counts, "%%RICH_RULE_PRIORITY%%")
self._set_rule_replace_priority(rule, policy_priority_counts, "%%POLICY_PRIORITY%%")
self._run_replace_zone_source(rule, zone_source_index_cache)
output = self.__run(rule)
self.rich_rule_priority_counts = rich_rule_priority_counts
self.policy_priority_counts = policy_priority_counts
self.zone_source_index_cache = zone_source_index_cache
return output
def get_available_tables(self, table=None):
ret = []
tables = [ table ] if table else BUILT_IN_CHAINS.keys()
for table in tables:
if table in self.available_tables:
ret.append(table)
else:
try:
self.__run(["-t", table, "-L", "-n"])
self.available_tables.append(table)
ret.append(table)
except ValueError:
log.debug1("%s table '%s' does not exist (or not enough permission to check)." % (self.ipv, table))
return ret
def _detect_wait_option(self):
wait_option = ""
ret = runProg(self._command, ["-w", "-L", "-n"]) # since iptables-1.4.20
if ret[0] == 0:
wait_option = "-w" # wait for xtables lock
ret = runProg(self._command, ["-w10", "-L", "-n"]) # since iptables > 1.4.21
if ret[0] == 0:
wait_option = "-w10" # wait max 10 seconds
log.debug2("%s: %s will be using %s option.", self.__class__, self._command, wait_option)
return wait_option
def _detect_restore_wait_option(self):
temp_file = tempFile()
temp_file.write("#foo")
temp_file.close()
wait_option = ""
for test_option in ["-w", "--wait=2"]:
ret = runProg(self._restore_command, [test_option], stdin=temp_file.name)
if ret[0] == 0 and "invalid option" not in ret[1] \
and "unrecognized option" not in ret[1]:
wait_option = test_option
break
log.debug2("%s: %s will be using %s option.", self.__class__, self._restore_command, wait_option)
os.unlink(temp_file.name)
return wait_option
def build_flush_rules(self):
self.rich_rule_priority_counts = {}
self.policy_priority_counts = {}
self.zone_source_index_cache = []
rules = []
for table in BUILT_IN_CHAINS.keys():
if not self.get_available_tables(table):
continue
# Flush firewall rules: -F
# Delete firewall chains: -X
# Set counter to zero: -Z
for flag in [ "-F", "-X", "-Z" ]:
rules.append(["-t", table, flag])
return rules
def build_set_policy_rules(self, policy):
rules = []
_policy = "DROP" if policy == "PANIC" else policy
for table in BUILT_IN_CHAINS.keys():
if not self.get_available_tables(table):
continue
if table == "nat":
continue
for chain in BUILT_IN_CHAINS[table]:
rules.append(["-t", table, "-P", chain, _policy])
return rules
def supported_icmp_types(self, ipv=None):
"""Return ICMP types that are supported by the iptables/ip6tables command and kernel"""
ret = [ ]
output = ""
try:
output = self.__run(["-p",
"icmp" if self.ipv == "ipv4" else "ipv6-icmp",
"--help"])
except ValueError as ex:
if self.ipv == "ipv4":
log.debug1("iptables error: %s" % ex)
else:
log.debug1("ip6tables error: %s" % ex)
lines = output.splitlines()
in_types = False
for line in lines:
#print(line)
if in_types:
line = line.strip().lower()
splits = line.split()
for split in splits:
if split.startswith("(") and split.endswith(")"):
x = split[1:-1]
else:
x = split
if x not in ret:
ret.append(x)
if self.ipv == "ipv4" and line.startswith("Valid ICMP Types:") or \
self.ipv == "ipv6" and line.startswith("Valid ICMPv6 Types:"):
in_types = True
return ret
def build_default_tables(self):
# nothing to do, they always exist
return []
def build_default_rules(self, log_denied="off"):
default_rules = {}
if self.get_available_tables("security"):
default_rules["security"] = [ ]
self.our_chains["security"] = set()
for chain in BUILT_IN_CHAINS["security"]:
default_rules["security"].append("-N %s_direct" % chain)
default_rules["security"].append("-A %s -j %s_direct" % (chain, chain))
self.our_chains["security"].add("%s_direct" % chain)
if self.get_available_tables("raw"):
default_rules["raw"] = [ ]
self.our_chains["raw"] = set()
for chain in BUILT_IN_CHAINS["raw"]:
default_rules["raw"].append("-N %s_direct" % chain)
default_rules["raw"].append("-A %s -j %s_direct" % (chain, chain))
self.our_chains["raw"].add("%s_direct" % chain)
if chain == "PREROUTING":
for dispatch_suffix in ["POLICIES_pre", "ZONES_SOURCE", "ZONES", "POLICIES_post"] if self._fw._allow_zone_drifting else ["POLICIES_pre", "ZONES", "POLICIES_post"]:
default_rules["raw"].append("-N %s_%s" % (chain, dispatch_suffix))
default_rules["raw"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix))
self.our_chains["raw"].update(set(["%s_%s" % (chain, dispatch_suffix)]))
if self.get_available_tables("mangle"):
default_rules["mangle"] = [ ]
self.our_chains["mangle"] = set()
for chain in BUILT_IN_CHAINS["mangle"]:
default_rules["mangle"].append("-N %s_direct" % chain)
default_rules["mangle"].append("-A %s -j %s_direct" % (chain, chain))
self.our_chains["mangle"].add("%s_direct" % chain)
if chain == "PREROUTING":
for dispatch_suffix in ["POLICIES_pre", "ZONES_SOURCE", "ZONES", "POLICIES_post"] if self._fw._allow_zone_drifting else ["POLICIES_pre", "ZONES", "POLICIES_post"]:
default_rules["mangle"].append("-N %s_%s" % (chain, dispatch_suffix))
default_rules["mangle"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix))
self.our_chains["mangle"].update(set(["%s_%s" % (chain, dispatch_suffix)]))
if self.get_available_tables("nat"):
default_rules["nat"] = [ ]
self.our_chains["nat"] = set()
for chain in BUILT_IN_CHAINS["nat"]:
default_rules["nat"].append("-N %s_direct" % chain)
default_rules["nat"].append("-A %s -j %s_direct" % (chain, chain))
self.our_chains["nat"].add("%s_direct" % chain)
if chain in [ "PREROUTING", "POSTROUTING" ]:
for dispatch_suffix in ["POLICIES_pre", "ZONES_SOURCE", "ZONES", "POLICIES_post"] if self._fw._allow_zone_drifting else ["POLICIES_pre", "ZONES", "POLICIES_post"]:
default_rules["nat"].append("-N %s_%s" % (chain, dispatch_suffix))
default_rules["nat"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix))
self.our_chains["nat"].update(set(["%s_%s" % (chain, dispatch_suffix)]))
default_rules["filter"] = []
self.our_chains["filter"] = set()
default_rules["filter"].append("-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT")
default_rules["filter"].append("-A INPUT -i lo -j ACCEPT")
default_rules["filter"].append("-N INPUT_direct")
default_rules["filter"].append("-A INPUT -j INPUT_direct")
self.our_chains["filter"].update(set("INPUT_direct"))
for dispatch_suffix in ["POLICIES_pre", "ZONES_SOURCE", "ZONES", "POLICIES_post"] if self._fw._allow_zone_drifting else ["POLICIES_pre", "ZONES", "POLICIES_post"]:
default_rules["filter"].append("-N INPUT_%s" % (dispatch_suffix))
default_rules["filter"].append("-A INPUT -j INPUT_%s" % (dispatch_suffix))
self.our_chains["filter"].update(set("INPUT_%s" % (dispatch_suffix)))
if log_denied != "off":
default_rules["filter"].append("-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '")
default_rules["filter"].append("-A INPUT -m conntrack --ctstate INVALID -j DROP")
if log_denied != "off":
default_rules["filter"].append("-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: '")
default_rules["filter"].append("-A INPUT -j %%REJECT%%")
default_rules["filter"].append("-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT")
default_rules["filter"].append("-A FORWARD -i lo -j ACCEPT")
default_rules["filter"].append("-N FORWARD_direct")
default_rules["filter"].append("-A FORWARD -j FORWARD_direct")
self.our_chains["filter"].update(set("FORWARD_direct"))
for dispatch_suffix in ["POLICIES_pre"]:
default_rules["filter"].append("-N FORWARD_%s" % (dispatch_suffix))
default_rules["filter"].append("-A FORWARD -j FORWARD_%s" % (dispatch_suffix))
self.our_chains["filter"].update(set("FORWARD_%s" % (dispatch_suffix)))
for direction in ["IN", "OUT"]:
for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
default_rules["filter"].append("-N FORWARD_%s_%s" % (direction, dispatch_suffix))
default_rules["filter"].append("-A FORWARD -j FORWARD_%s_%s" % (direction, dispatch_suffix))
self.our_chains["filter"].update(set("FORWARD_%s_%s" % (direction, dispatch_suffix)))
for dispatch_suffix in ["POLICIES_post"]:
default_rules["filter"].append("-N FORWARD_%s" % (dispatch_suffix))
default_rules["filter"].append("-A FORWARD -j FORWARD_%s" % (dispatch_suffix))
self.our_chains["filter"].update(set("FORWARD_%s" % (dispatch_suffix)))
if log_denied != "off":
default_rules["filter"].append("-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '")
default_rules["filter"].append("-A FORWARD -m conntrack --ctstate INVALID -j DROP")
if log_denied != "off":
default_rules["filter"].append("-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: '")
default_rules["filter"].append("-A FORWARD -j %%REJECT%%")
default_rules["filter"] += [
"-N OUTPUT_direct",
"-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT",
"-A OUTPUT -o lo -j ACCEPT",
"-A OUTPUT -j OUTPUT_direct",
]
self.our_chains["filter"].update(set("OUTPUT_direct"))
for dispatch_suffix in ["POLICIES_pre"]:
default_rules["filter"].append("-N OUTPUT_%s" % (dispatch_suffix))
default_rules["filter"].append("-A OUTPUT -j OUTPUT_%s" % (dispatch_suffix))
self.our_chains["filter"].update(set("OUTPUT_%s" % (dispatch_suffix)))
for dispatch_suffix in ["POLICIES_post"]:
default_rules["filter"].append("-N OUTPUT_%s" % (dispatch_suffix))
default_rules["filter"].append("-A OUTPUT -j OUTPUT_%s" % (dispatch_suffix))
self.our_chains["filter"].update(set("OUTPUT_%s" % (dispatch_suffix)))
final_default_rules = []
for table in default_rules:
if table not in self.get_available_tables():
continue
for rule in default_rules[table]:
final_default_rules.append(["-t", table] + splitArgs(rule))
return final_default_rules
def get_zone_table_chains(self, table):
if table == "filter":
return { "INPUT", "FORWARD_IN", "FORWARD_OUT" }
if table == "mangle":
if "mangle" in self.get_available_tables():
return { "PREROUTING" }
if table == "nat":
if "nat" in self.get_available_tables():
return { "PREROUTING", "POSTROUTING" }
if table == "raw":
if "raw" in self.get_available_tables():
return { "PREROUTING" }
return {}
def build_policy_ingress_egress_rules(self, enable, policy, table, chain,
ingress_interfaces, egress_interfaces,
ingress_sources, egress_sources):
p_obj = self._fw.policy.get_policy(policy)
chain_suffix = "pre" if p_obj.priority < 0 else "post"
isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT)
ingress_fragments = []
egress_fragments = []
for interface in ingress_interfaces:
ingress_fragments.append(["-i", interface])
for interface in egress_interfaces:
egress_fragments.append(["-o", interface])
for addr in ingress_sources:
ipv = self._fw.zone.check_source(addr)
if ipv in ["ipv4", "ipv6"] and not self.is_ipv_supported(ipv):
continue
ingress_fragments.append(self._rule_addr_fragment("-s", addr))
for addr in egress_sources:
ipv = self._fw.zone.check_source(addr)
if ipv in ["ipv4", "ipv6"] and not self.is_ipv_supported(ipv):
continue
# iptables can not match destination MAC
if check_mac(addr) and chain in ["POSTROUTING", "FORWARD_OUT", "OUTPUT"]:
continue
egress_fragments.append(self._rule_addr_fragment("-d", addr))
def _generate_policy_dispatch_rule(ingress_fragment, egress_fragment):
add_del = {True: "-A", False: "-D" }[enable]
rule = ["-t", table, add_del, "%s_POLICIES_%s" % (chain, chain_suffix),
"%%POLICY_PRIORITY%%", p_obj.priority]
if ingress_fragment:
rule.extend(ingress_fragment)
if egress_fragment:
rule.extend(egress_fragment)
rule.extend(["-j", _policy])
return rule
rules = []
if ingress_fragments:
# zone --> [zone, ANY, HOST]
for ingress_fragment in ingress_fragments:
# zone --> zone
if egress_fragments:
for egress_fragment in egress_fragments:
rules.append(_generate_policy_dispatch_rule(ingress_fragment, egress_fragment))
elif egress_sources:
# if the egress source is not for the current family (there
# are no egress fragments), then avoid creating an invalid
# catch all rule.
pass
else:
rules.append(_generate_policy_dispatch_rule(ingress_fragment, None))
elif ingress_sources:
# if the ingress source is not for the current family (there are no
# ingress fragments), then avoid creating an invalid catch all
# rule.
pass
else: # [ANY, HOST] --> [zone, ANY, HOST]
# [ANY, HOST] --> zone
if egress_fragments:
for egress_fragment in egress_fragments:
rules.append(_generate_policy_dispatch_rule(None, egress_fragment))
elif egress_sources:
# if the egress source is not for the current family (there
# are no egress fragments), then avoid creating an invalid
# catch all rule.
pass
else:
# [ANY, HOST] --> [ANY, HOST]
rules.append(_generate_policy_dispatch_rule(None, None))
return rules
def build_zone_source_interface_rules(self, enable, zone, policy, interface,
table, chain, append=False):
isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT)
opt = {
"PREROUTING": "-i",
"POSTROUTING": "-o",
"INPUT": "-i",
"FORWARD_IN": "-i",
"FORWARD_OUT": "-o",
"OUTPUT": "-o",
}[chain]
action = "-g"
if enable and not append:
rule = [ "-I", "%s_ZONES" % chain, "%%ZONE_INTERFACE%%" ]
elif enable:
rule = [ "-A", "%s_ZONES" % chain ]
else:
rule = [ "-D", "%s_ZONES" % chain ]
if not append:
rule += ["%%ZONE_INTERFACE%%"]
rule += [ "-t", table, opt, interface, action, _policy ]
return [rule]
def _rule_addr_fragment(self, opt, address, invert=False):
if address.startswith("ipset:"):
name = address[6:]
if opt == "-d":
opt = "dst"
else:
opt = "src"
flags = ",".join([opt] * self._fw.ipset.get_dimension(name))
return ["-m", "set", "--match-set", name, flags]
elif check_mac(address):
# outgoing can not be set
if opt == "-d":
raise FirewallError(INVALID_ADDR, "Can't match a destination MAC.")
return ["-m", "mac", "--mac-source", address.upper()]
else:
if check_single_address("ipv6", address):
address = normalizeIP6(address)
elif check_address("ipv6", address):
addr_split = address.split("/")
address = normalizeIP6(addr_split[0]) + "/" + addr_split[1]
return [opt, address]
def build_zone_source_address_rules(self, enable, zone, policy,
address, table, chain):
add_del = { True: "-I", False: "-D" }[enable]
isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT)
opt = {
"PREROUTING": "-s",
"POSTROUTING": "-d",
"INPUT": "-s",
"FORWARD_IN": "-s",
"FORWARD_OUT": "-d",
"OUTPUT": "-d",
}[chain]
if self._fw._allow_zone_drifting:
zone_dispatch_chain = "%s_ZONES_SOURCE" % (chain)
else:
zone_dispatch_chain = "%s_ZONES" % (chain)
# iptables can not match destination MAC
if check_mac(address) and chain in ["POSTROUTING", "FORWARD_OUT", "OUTPUT"]:
return []
rule = [add_del, zone_dispatch_chain, "%%ZONE_SOURCE%%", zone, "-t", table]
rule.extend(self._rule_addr_fragment(opt, address))
rule.extend(["-g", _policy])
return [rule]
def build_policy_chain_rules(self, enable, policy, table, chain):
add_del_chain = { True: "-N", False: "-X" }[enable]
add_del_rule = { True: "-A", False: "-D" }[enable]
isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT)
self.our_chains[table].update(set([_policy,
"%s_log" % _policy,
"%s_deny" % _policy,
"%s_pre" % _policy,
"%s_post" % _policy,
"%s_allow" % _policy]))
rules = []
rules.append([ add_del_chain, _policy, "-t", table ])
rules.append([ add_del_chain, "%s_pre" % _policy, "-t", table ])
rules.append([ add_del_chain, "%s_log" % _policy, "-t", table ])
rules.append([ add_del_chain, "%s_deny" % _policy, "-t", table ])
rules.append([ add_del_chain, "%s_allow" % _policy, "-t", table ])
rules.append([ add_del_chain, "%s_post" % _policy, "-t", table ])
rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_pre" % _policy ])
rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_log" % _policy ])
rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_deny" % _policy ])
rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_allow" % _policy ])
rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_post" % _policy ])
target = self._fw.policy._policies[policy].target
if self._fw.get_log_denied() != "off":
if table == "filter":
if target in [ "REJECT", "%%REJECT%%" ]:
rules.append([ add_del_rule, _policy, "-t", table, "%%LOGTYPE%%",
"-j", "LOG", "--log-prefix",
"\"%s_REJECT: \"" % _policy ])
if target == "DROP":
rules.append([ add_del_rule, _policy, "-t", table, "%%LOGTYPE%%",
"-j", "LOG", "--log-prefix",
"\"%s_DROP: \"" % _policy ])
if table == "filter" and \
target in [ "ACCEPT", "REJECT", "%%REJECT%%", "DROP" ]:
rules.append([ add_del_rule, _policy, "-t", table, "-j", target ])
if not enable:
rules.reverse()
return rules
def _rule_limit(self, limit):
if not limit:
return []
s = ["-m", "limit", "--limit", limit.value]
if limit.burst is not None:
s += ["--limit-burst", limit.burst]
return s
def _rich_rule_chain_suffix(self, rich_rule):
if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock]:
# These are special and don't have an explicit action
pass
elif rich_rule.action:
if type(rich_rule.action) not in [Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark]:
raise FirewallError(INVALID_RULE, "Unknown action %s" % type(rich_rule.action))
else:
raise FirewallError(INVALID_RULE, "No rule action specified.")
if rich_rule.priority == 0:
if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort] or \
type(rich_rule.action) in [Rich_Accept, Rich_Mark]:
return "allow"
elif type(rich_rule.element) in [Rich_IcmpBlock] or \
type(rich_rule.action) in [Rich_Reject, Rich_Drop]:
return "deny"
elif rich_rule.priority < 0:
return "pre"
else:
return "post"
def _rich_rule_chain_suffix_from_log(self, rich_rule):
if not rich_rule.log and not rich_rule.audit:
raise FirewallError(INVALID_RULE, "Not log or audit")
if rich_rule.priority == 0:
return "log"
elif rich_rule.priority < 0:
return "pre"
else:
return "post"
def _rich_rule_priority_fragment(self, rich_rule):
if rich_rule.priority == 0:
return []
return ["%%RICH_RULE_PRIORITY%%", rich_rule.priority]
def _rich_rule_log(self, policy, rich_rule, enable, table, rule_fragment):
if not rich_rule.log:
return []
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
add_del = { True: "-A", False: "-D" }[enable]
chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule)
rule = ["-t", table, add_del, "%s_%s" % (_policy, chain_suffix)]
rule += self._rich_rule_priority_fragment(rich_rule)
rule += rule_fragment + [ "-j", "LOG" ]
if rich_rule.log.prefix:
rule += [ "--log-prefix", "'%s'" % rich_rule.log.prefix ]
if rich_rule.log.level:
rule += [ "--log-level", "%s" % rich_rule.log.level ]
rule += self._rule_limit(rich_rule.log.limit)
return rule
def _rich_rule_audit(self, policy, rich_rule, enable, table, rule_fragment):
if not rich_rule.audit:
return []
add_del = { True: "-A", False: "-D" }[enable]
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule)
rule = ["-t", table, add_del, "%s_%s" % (_policy, chain_suffix)]
rule += self._rich_rule_priority_fragment(rich_rule)
rule += rule_fragment
if type(rich_rule.action) == Rich_Accept:
_type = "accept"
elif type(rich_rule.action) == Rich_Reject:
_type = "reject"
elif type(rich_rule.action) == Rich_Drop:
_type = "drop"
else:
_type = "unknown"
rule += [ "-j", "AUDIT", "--type", _type ]
rule += self._rule_limit(rich_rule.audit.limit)
return rule
def _rich_rule_action(self, policy, rich_rule, enable, table, rule_fragment):
if not rich_rule.action:
return []
add_del = { True: "-A", False: "-D" }[enable]
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
chain_suffix = self._rich_rule_chain_suffix(rich_rule)
chain = "%s_%s" % (_policy, chain_suffix)
if type(rich_rule.action) == Rich_Accept:
rule_action = [ "-j", "ACCEPT" ]
elif type(rich_rule.action) == Rich_Reject:
rule_action = [ "-j", "REJECT" ]
if rich_rule.action.type:
rule_action += [ "--reject-with", rich_rule.action.type ]
elif type(rich_rule.action) == Rich_Drop:
rule_action = [ "-j", "DROP" ]
elif type(rich_rule.action) == Rich_Mark:
table = "mangle"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
chain = "%s_%s" % (_policy, chain_suffix)
rule_action = [ "-j", "MARK", "--set-xmark", rich_rule.action.set ]
else:
raise FirewallError(INVALID_RULE,
"Unknown action %s" % type(rich_rule.action))
rule = ["-t", table, add_del, chain]
rule += self._rich_rule_priority_fragment(rich_rule)
rule += rule_fragment + rule_action
rule += self._rule_limit(rich_rule.action.limit)
return rule
def _rich_rule_destination_fragment(self, rich_dest):
if not rich_dest:
return []
rule_fragment = []
if rich_dest.addr:
if rich_dest.invert:
rule_fragment.append("!")
if check_single_address("ipv6", rich_dest.addr):
rule_fragment += [ "-d", normalizeIP6(rich_dest.addr) ]
elif check_address("ipv6", rich_dest.addr):
addr_split = rich_dest.addr.split("/")
rule_fragment += [ "-d", normalizeIP6(addr_split[0]) + "/" + addr_split[1] ]
else:
rule_fragment += [ "-d", rich_dest.addr ]
elif rich_dest.ipset:
rule_fragment += [ "-m", "set" ]
if rich_dest.invert:
rule_fragment.append("!")
flags = self._fw.zone._ipset_match_flags(rich_dest.ipset, "dst")
rule_fragment += [ "--match-set", rich_dest.ipset, flags ]
return rule_fragment
def _rich_rule_source_fragment(self, rich_source):
if not rich_source:
return []
rule_fragment = []
if rich_source.addr:
if rich_source.invert:
rule_fragment.append("!")
if check_single_address("ipv6", rich_source.addr):
rule_fragment += [ "-s", normalizeIP6(rich_source.addr) ]
elif check_address("ipv6", rich_source.addr):
addr_split = rich_source.addr.split("/")
rule_fragment += [ "-s", normalizeIP6(addr_split[0]) + "/" + addr_split[1] ]
else:
rule_fragment += [ "-s", rich_source.addr ]
elif hasattr(rich_source, "mac") and rich_source.mac:
rule_fragment += [ "-m", "mac" ]
if rich_source.invert:
rule_fragment.append("!")
rule_fragment += [ "--mac-source", rich_source.mac ]
elif hasattr(rich_source, "ipset") and rich_source.ipset:
rule_fragment += [ "-m", "set" ]
if rich_source.invert:
rule_fragment.append("!")
flags = self._fw.zone._ipset_match_flags(rich_source.ipset, "src")
rule_fragment += [ "--match-set", rich_source.ipset, flags ]
return rule_fragment
def build_policy_ports_rules(self, enable, policy, proto, port, destination=None, rich_rule=None):
add_del = { True: "-A", False: "-D" }[enable]
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
rule_fragment = [ "-p", proto ]
if port:
rule_fragment += [ "--dport", "%s" % portStr(port) ]
if destination:
rule_fragment += [ "-d", destination ]
if rich_rule:
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
if not rich_rule or type(rich_rule.action) != Rich_Mark:
rule_fragment += [ "-m", "conntrack", "--ctstate", "NEW,UNTRACKED" ]
rules = []
if rich_rule:
rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment))
rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment))
rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment))
else:
rules.append([add_del, "%s_allow" % (_policy), "-t", table] +
rule_fragment + [ "-j", "ACCEPT" ])
return rules
def build_policy_protocol_rules(self, enable, policy, protocol, destination=None, rich_rule=None):
add_del = { True: "-A", False: "-D" }[enable]
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
rule_fragment = [ "-p", protocol ]
if destination:
rule_fragment += [ "-d", destination ]
if rich_rule:
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
if not rich_rule or type(rich_rule.action) != Rich_Mark:
rule_fragment += [ "-m", "conntrack", "--ctstate", "NEW,UNTRACKED" ]
rules = []
if rich_rule:
rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment))
rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment))
rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment))
else:
rules.append([add_del, "%s_allow" % (_policy), "-t", table] +
rule_fragment + [ "-j", "ACCEPT" ])
return rules
def build_policy_source_ports_rules(self, enable, policy, proto, port,
destination=None, rich_rule=None):
add_del = { True: "-A", False: "-D" }[enable]
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
rule_fragment = [ "-p", proto ]
if port:
rule_fragment += [ "--sport", "%s" % portStr(port) ]
if destination:
rule_fragment += [ "-d", destination ]
if rich_rule:
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
if not rich_rule or type(rich_rule.action) != Rich_Mark:
rule_fragment += [ "-m", "conntrack", "--ctstate", "NEW,UNTRACKED" ]
rules = []
if rich_rule:
rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment))
rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment))
rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment))
else:
rules.append([add_del, "%s_allow" % (_policy), "-t", table] +
rule_fragment + [ "-j", "ACCEPT" ])
return rules
def build_policy_helper_ports_rules(self, enable, policy, proto, port,
destination, helper_name, module_short_name):
table = "raw"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
add_del = { True: "-A", False: "-D" }[enable]
rule = [ add_del, "%s_allow" % (_policy), "-t", "raw", "-p", proto ]
if port:
rule += [ "--dport", "%s" % portStr(port) ]
if destination:
rule += [ "-d", destination ]
rule += [ "-j", "CT", "--helper", module_short_name ]
return [rule]
def build_zone_forward_rules(self, enable, zone, policy, table, interface=None, source=None):
add_del = { True: "-A", False: "-D" }[enable]
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
rules = []
if interface:
rules.append(["-t", "filter", add_del, "%s_allow" % _policy,
"-o", interface, "-j", "ACCEPT"])
else: # source
# iptables can not match destination MAC
if check_mac(source):
return []
rules.append(["-t", "filter", add_del, "%s_allow" % _policy]
+ self._rule_addr_fragment("-d", source) +
["-j", "ACCEPT"])
return rules
def build_policy_masquerade_rules(self, enable, policy, rich_rule=None):
table = "nat"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=True)
add_del = { True: "-A", False: "-D" }[enable]
rule_fragment = []
if rich_rule:
chain_suffix = self._rich_rule_chain_suffix(rich_rule)
rule_fragment += self._rich_rule_priority_fragment(rich_rule)
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
else:
chain_suffix = "allow"
rules = []
rules.append(["-t", "nat", add_del, "%s_%s" % (_policy, chain_suffix)]
+ rule_fragment +
[ "!", "-o", "lo", "-j", "MASQUERADE" ])
rule_fragment = []
if rich_rule:
chain_suffix = self._rich_rule_chain_suffix(rich_rule)
rule_fragment += self._rich_rule_priority_fragment(rich_rule)
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
else:
chain_suffix = "allow"
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
rules.append(["-t", "filter", add_del, "%s_%s" % (_policy, chain_suffix)]
+ rule_fragment +
["-m", "conntrack", "--ctstate", "NEW,UNTRACKED", "-j", "ACCEPT" ])
return rules
def build_policy_forward_port_rules(self, enable, policy, port,
protocol, toport, toaddr, rich_rule=None):
table = "nat"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
add_del = { True: "-A", False: "-D" }[enable]
to = ""
if toaddr:
if check_single_address("ipv6", toaddr):
to += "[%s]" % normalizeIP6(toaddr)
else:
to += toaddr
if toport and toport != "":
to += ":%s" % portStr(toport, "-")
rule_fragment = []
if rich_rule:
chain_suffix = self._rich_rule_chain_suffix(rich_rule)
rule_fragment = self._rich_rule_priority_fragment(rich_rule)
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
else:
chain_suffix = "allow"
rules = []
if rich_rule:
rules.append(self._rich_rule_log(policy, rich_rule, enable, "nat", rule_fragment))
rules.append(["-t", "nat", add_del, "%s_%s" % (_policy, chain_suffix)]
+ rule_fragment +
["-p", protocol, "--dport", portStr(port),
"-j", "DNAT", "--to-destination", to])
return rules
def build_policy_icmp_block_rules(self, enable, policy, ict, rich_rule=None):
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
add_del = { True: "-A", False: "-D" }[enable]
if self.ipv == "ipv4":
proto = [ "-p", "icmp" ]
match = [ "-m", "icmp", "--icmp-type", ict.name ]
else:
proto = [ "-p", "ipv6-icmp" ]
match = [ "-m", "icmp6", "--icmpv6-type", ict.name ]
rules = []
if self._fw.policy.query_icmp_block_inversion(policy):
final_chain = "%s_allow" % (_policy)
final_target = "ACCEPT"
else:
final_chain = "%s_deny" % (_policy)
final_target = "%%REJECT%%"
rule_fragment = []
if rich_rule:
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
rule_fragment += proto + match
if rich_rule:
rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment))
rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment))
if rich_rule.action:
rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment))
else:
chain_suffix = self._rich_rule_chain_suffix(rich_rule)
rules.append(["-t", table, add_del, "%s_%s" % (_policy, chain_suffix)]
+ self._rich_rule_priority_fragment(rich_rule)
+ rule_fragment +
[ "-j", "%%REJECT%%" ])
else:
if self._fw.get_log_denied() != "off" and final_target != "ACCEPT":
rules.append([ add_del, final_chain, "-t", table ]
+ rule_fragment +
[ "%%LOGTYPE%%", "-j", "LOG",
"--log-prefix", "\"%s_ICMP_BLOCK: \"" % policy ])
rules.append([ add_del, final_chain, "-t", table ]
+ rule_fragment +
[ "-j", final_target ])
return rules
def build_policy_icmp_block_inversion_rules(self, enable, policy):
table = "filter"
_policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
rules = []
rule_idx = 6
if self._fw.policy.query_icmp_block_inversion(policy):
ibi_target = "%%REJECT%%"
if self._fw.get_log_denied() != "off":
if enable:
rule = [ "-I", _policy, str(rule_idx) ]
else:
rule = [ "-D", _policy ]
rule = rule + [ "-t", table, "-p", "%%ICMP%%",
"%%LOGTYPE%%",
"-j", "LOG", "--log-prefix",
"\"%s_ICMP_BLOCK: \"" % _policy ]
rules.append(rule)
rule_idx += 1
else:
ibi_target = "ACCEPT"
if enable:
rule = [ "-I", _policy, str(rule_idx) ]
else:
rule = [ "-D", _policy ]
rule = rule + [ "-t", table, "-p", "%%ICMP%%", "-j", ibi_target ]
rules.append(rule)
return rules
def build_policy_rich_source_destination_rules(self, enable, policy, rich_rule):
table = "filter"
rule_fragment = []
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
rules = []
rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment))
rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment))
rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment))
return rules
def is_ipv_supported(self, ipv):
return ipv == self.ipv
class ip6tables(ip4tables):
ipv = "ipv6"
name = "ip6tables"
def build_rpfilter_rules(self, log_denied=False):
rules = []
rules.append([ "-I", "PREROUTING", "-t", "mangle",
"-m", "rpfilter", "--invert", "--validmark",
"-j", "DROP" ])
if log_denied != "off":
rules.append([ "-I", "PREROUTING", "-t", "mangle",
"-m", "rpfilter", "--invert", "--validmark",
"-j", "LOG",
"--log-prefix", "rpfilter_DROP: " ])
rules.append([ "-I", "PREROUTING", "-t", "mangle",
"-p", "ipv6-icmp",
"--icmpv6-type=neighbour-solicitation",
"-j", "ACCEPT" ]) # RHBZ#1575431, kernel bug in 4.16-4.17
rules.append([ "-I", "PREROUTING", "-t", "mangle",
"-p", "ipv6-icmp",
"--icmpv6-type=router-advertisement",
"-j", "ACCEPT" ]) # RHBZ#1058505
return rules
def build_rfc3964_ipv4_rules(self):
daddr_list = [
"::0.0.0.0/96", # IPv4 compatible
"::ffff:0.0.0.0/96", # IPv4 mapped
"2002:0000::/24", # 0.0.0.0/8 (the system has no address assigned yet)
"2002:0a00::/24", # 10.0.0.0/8 (private)
"2002:7f00::/24", # 127.0.0.0/8 (loopback)
"2002:ac10::/28", # 172.16.0.0/12 (private)
"2002:c0a8::/32", # 192.168.0.0/16 (private)
"2002:a9fe::/32", # 169.254.0.0/16 (IANA Assigned DHCP link-local)
"2002:e000::/19", # 224.0.0.0/4 (multicast), 240.0.0.0/4 (reserved and broadcast)
]
chain_name = "RFC3964_IPv4"
self.our_chains["filter"].add(chain_name)
rules = []
rules.append(["-t", "filter", "-N", chain_name])
for daddr in daddr_list:
rules.append(["-t", "filter", "-I", chain_name,
"-d", daddr, "-j", "REJECT", "--reject-with",
"addr-unreach"])
if self._fw._log_denied in ["unicast", "all"]:
rules.append(["-t", "filter", "-I", chain_name,
"-d", daddr, "-j", "LOG",
"--log-prefix", "\"RFC3964_IPv4_REJECT: \""])
# Inject into FORWARD and OUTPUT chains
rules.append(["-t", "filter", "-I", "OUTPUT", "4",
"-j", chain_name])
rules.append(["-t", "filter", "-I", "FORWARD", "4",
"-j", chain_name])
return rules
core/modules.py 0000644 00000007356 15035135173 0007534 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""modules backend"""
__all__ = [ "modules" ]
from firewall.core.prog import runProg
from firewall.core.logger import log
from firewall.config import COMMANDS
class modules(object):
def __init__(self):
self._load_command = COMMANDS["modprobe"]
# Use rmmod instead of modprobe -r (RHBZ#1031102)
self._unload_command = COMMANDS["rmmod"]
def __repr__(self):
return '%s' % (self.__class__)
def loaded_modules(self):
""" get all loaded kernel modules and their dependencies """
mods = [ ]
deps = { }
try:
with open("/proc/modules", "r") as f:
for line in f:
if not line:
break
line = line.strip()
splits = line.split()
mods.append(splits[0])
if splits[3] != "-":
deps[splits[0]] = splits[3].split(",")[:-1]
else:
deps[splits[0]] = [ ]
except FileNotFoundError:
pass
return mods, deps # [loaded modules], {module:[dependants]}
def load_module(self, module):
log.debug2("%s: %s %s", self.__class__, self._load_command, module)
return runProg(self._load_command, [ module ])
def unload_module(self, module):
log.debug2("%s: %s %s", self.__class__, self._unload_command, module)
return runProg(self._unload_command, [ module ])
def get_deps(self, module, deps, ret):
""" get all dependants of a module """
if module not in deps:
return
for mod in deps[module]:
self.get_deps(mod, deps, ret)
if mod not in ret:
ret.append(mod)
if module not in ret:
ret.append(module)
def get_firewall_modules(self):
""" get all loaded firewall-related modules """
mods = [ ]
(mods2, deps) = self.loaded_modules()
self.get_deps("nf_conntrack", deps, mods)
# these modules don't have dependants listed in /proc/modules
for bad_bad_module in ["nf_conntrack_ipv4", "nf_conntrack_ipv6"]:
if bad_bad_module in mods:
# move them to end of list, so we'll remove them later
mods.remove(bad_bad_module)
mods.insert(-1, bad_bad_module)
for mod in mods2:
if mod in [ "ip_tables", "ip6_tables", "ebtables" ] or \
mod.startswith("iptable_") or mod.startswith("ip6table_") or \
mod.startswith("nf_") or mod.startswith("xt_") or \
mod.startswith("ipt_") or mod.startswith("ip6t_") :
self.get_deps(mod, deps, mods)
return mods
def unload_firewall_modules(self):
""" unload all firewall-related modules """
for module in self.get_firewall_modules():
(status, ret) = self.unload_module(module)
if status != 0:
log.debug1("Failed to unload module '%s': %s" %(module, ret))
core/__pycache__/fw_config.cpython-36.opt-1.pyc 0000644 00000077161 15035135173 0015251 0 ustar 00 3
��g� � @ s� d gZ ddlZddlZddlZddlZddlmZ ddlmZ ddl m
Z
m Z m Z ddl
mZmZmZ ddlmZmZmZ ddlmZmZmZ dd lmZmZm Z dd
l m Z m Z m Z dd lm!Z! dd l"m#Z# G d
d � d e$�Z%dS )�FirewallConfig� N)�config)�log)�IcmpType�icmptype_reader�icmptype_writer)�Service�service_reader�service_writer)�Zone� zone_reader� zone_writer)�IPSet� ipset_reader� ipset_writer)�Helper�
helper_reader�
helper_writer)�Policy�
policy_reader�
policy_writer)�errors)�
FirewallErrorc @ s$ e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z!d?d@� Z"dAdB� Z#dCdD� Z$dEdF� Z%dGdH� Z&dIdJ� Z'dKdL� Z(dMdN� Z)dOdP� Z*dQdR� Z+dSdT� Z,dUdV� Z-dWdX� Z.dYdZ� Z/d[d\� Z0d]d^� Z1d_d`� Z2dadb� Z3dcdd� Z4dedf� Z5dgdh� Z6didj� Z7dkdl� Z8dmdn� Z9dodp� Z:dqdr� Z;dsdt� Z<dudv� Z=dwdx� Z>dydz� Z?d{d|� Z@d}d~� ZAdd�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�� Z`d�d�� Zad�d�� Zbd�d Zcd�dĄ Zdd�dƄ Zed�S )�r c C s || _ | j� d S )N)�_fw�_FirewallConfig__init_vars)�self�fw� r � /usr/lib/python3.6/fw_config.py�__init__( s zFirewallConfig.__init__c C sH d| j | j| j| j| j| j| j| j| j| j | j
| j | j | j
| j| jf S )Nz>%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__�_ipsets�
_icmptypes� _services�_zones�_helpersZpolicy_objects�_builtin_ipsets�_builtin_icmptypes�_builtin_services�_builtin_zones�_builtin_helpers�_builtin_policy_objects�_firewalld_conf� _policies�_direct)r r r r �__repr__, s zFirewallConfig.__repr__c C s^ i | _ i | _i | _i | _i | _i | _i | _i | _i | _i | _ i | _
i | _ d | _ d | _
d | _d S )N)r! r" r# r$ r% �_policy_objectsr& r' r( r) r* r+ r, r- r. )r r r r Z __init_vars6 s zFirewallConfig.__init_varsc C s4 x,t | jj� �D ]}| j| j� | j|= qW x,t | jj� �D ]}| j| j� | j|= q>W x,t | jj� �D ]}| j| j� | j|= qlW x,t | jj� �D ]}| j| j� | j|= q�W x,t | jj� �D ]}| j| j� | j|= q�W x,t | jj� �D ]}| j| j� | j|= q�W x.t | j j� �D ] }| j | j� | j |= �q$W x.t | j
j� �D ] }| j
| j� | j
|= �qTW x.t | j j� �D ] }| j | j� | j |= �q�W x.t | j j� �D ] }| j | j� | j |= �q�W | j
�r�| j
j� | `
d | _
| j�r | jj� | `d | _| j�r(| jj� | `d | _| j� d S )N)�listr& �keys�cleanupr! r' r" r( r# r) r$ r* r% r, r- r. r )r �xr r r r3 G sV
zFirewallConfig.cleanupc C s | j jj� S )N)r �policiesZquery_lockdown)r r r r �lockdown_enabled~ s z FirewallConfig.lockdown_enabledc C s | j jj||�S )N)r r5 � access_check)r �key�valuer r r r7 � s zFirewallConfig.access_checkc C s
|| _ d S )N)r, )r �confr r r �set_firewalld_conf� s z!FirewallConfig.set_firewalld_confc C s | j S )N)r, )r r r r �get_firewalld_conf� s z!FirewallConfig.get_firewalld_confc C s( t jjtj�s| jj� n
| jj� d S )N)�os�path�existsr ZFIREWALLD_CONFr, �clear�read)r r r r �update_firewalld_conf� s z$FirewallConfig.update_firewalld_confc C s
|| _ d S )N)r- )r r5 r r r � set_policies� s zFirewallConfig.set_policiesc C s | j S )N)r- )r r r r � get_policies� s zFirewallConfig.get_policiesc C s, t jjtj�s | jjj� n | jjj� d S )N) r= r> r? r ZLOCKDOWN_WHITELISTr- Zlockdown_whitelistr3 rA )r r r r �update_lockdown_whitelist� s z(FirewallConfig.update_lockdown_whitelistc C s
|| _ d S )N)r. )r Zdirectr r r �
set_direct� s zFirewallConfig.set_directc C s | j S )N)r. )r r r r �
get_direct� s zFirewallConfig.get_directc C s( t jjtj�s| jj� n
| jj� d S )N)r= r> r? r ZFIREWALLD_DIRECTr. r3 rA )r r r r �
update_direct� s z FirewallConfig.update_directc C s$ t tt| jj� �t| jj� � ��S )N)�sorted�setr1 r! r2 r& )r r r r �
get_ipsets� s zFirewallConfig.get_ipsetsc C s$ |j r|| j|j< n || j|j< d S )N)�builtinr& �namer! )r �objr r r � add_ipset� s zFirewallConfig.add_ipsetc C s8 || j kr| j | S || jkr(| j| S ttj|��d S )N)r! r& r r �
INVALID_IPSET)r rM r r r � get_ipset� s
zFirewallConfig.get_ipsetc C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._ipsets[%s] != objz'%s' not a built-in ipset)rM r! r r � NO_DEFAULTSr& �
_remove_ipset)r rN r r r �load_ipset_defaults� s
z"FirewallConfig.load_ipset_defaultsc C s |j � S )N)�
export_config)r rN r r r �get_ipset_config� s z FirewallConfig.get_ipset_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL �copy�
import_configr �ETC_FIREWALLD_IPSETSr> �defaultrO r )r rN r: r4 r r r �set_ipset_config� s
z FirewallConfig.set_ipset_configc C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_ipset(): '%s'z%s.xmlFT)r! r& r r �
NAME_CONFLICTr �
check_namerX rM �filenamer rY r> rL rZ r rO )r rM r: r4 r r r � new_ipset� s
zFirewallConfig.new_ipsetc C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) N�update�removezLoading ipset file '%s'z"Failed to load ipset file '%s': %s�new)NN)NN)NN)NN)NN)r= r> �basename�dirnamer? r rY r! r2 r^ rM r& r �debug1r � Exception�errorrO rZ )r rM r^ r> r4 rN �msgr r r �update_ipset_from_path� sP
z%FirewallConfig.update_ipset_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r! r r rP r> r rY �INVALID_DIRECTORY�shutil�moverf r rg r= ra )r rN rM rh r r r rS 8 s z FirewallConfig._remove_ipsetc C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in ipset)rL rZ r r Z
BUILTIN_IPSETrM )r rN r r r �check_builtin_ipsetI s z"FirewallConfig.check_builtin_ipsetc C s | j |� | j|� d S )N)rm rS )r rN r r r � remove_ipsetN s
zFirewallConfig.remove_ipsetc C s$ | j |� | j||�}| j|� |S )N)rm � _copy_ipsetrS )r rN rM r_ r r r � rename_ipsetR s
zFirewallConfig.rename_ipsetc C s | j ||j� �S )N)r_ rU )r rN rM r r r ro X s zFirewallConfig._copy_ipsetc C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r" r2 r' )r r r r �
get_icmptypes] s z FirewallConfig.get_icmptypesc C s$ |j r|| j|j< n || j|j< d S )N)rL r' rM r" )r rN r r r � add_icmptypea s zFirewallConfig.add_icmptypec C s8 || j kr| j | S || jkr(| j| S ttj|��d S )N)r" r' r r �INVALID_ICMPTYPE)r rM r r r � get_icmptypeg s
zFirewallConfig.get_icmptypec C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._icmptypes[%s] != objz '%s' not a built-in icmptype)rM r" r r rR r' �_remove_icmptype)r rN r r r �load_icmptype_defaultsn s
z%FirewallConfig.load_icmptype_defaultsc C s |j � S )N)rU )r rN r r r �get_icmptype_configz s z"FirewallConfig.get_icmptype_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL rW rX r �ETC_FIREWALLD_ICMPTYPESr> rZ rr r )r rN r: r4 r r r �set_icmptype_config} s
z"FirewallConfig.set_icmptype_configc C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_icmptype(): '%s'z%s.xmlFT)r" r' r r r\ r r] rX rM r^ r rx r> rL rZ r rr )r rM r: r4 r r r � new_icmptype� s
zFirewallConfig.new_icmptypec C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) Nr` ra zLoading icmptype file '%s'z%Failed to load icmptype file '%s': %srb )NN)NN)NN)NN)NN)r= r> rc rd r? r rx r" r2 r^ rM r' r re r rf rg rr rZ )r rM r^ r> r4 rN rh r r r �update_icmptype_from_path� sP
z(FirewallConfig.update_icmptype_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r" r r rs r> r rx rj rk rl rf r rg r= ra )r rN rM rh r r r ru � s z FirewallConfig._remove_icmptypec C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in icmp type)rL rZ r r ZBUILTIN_ICMPTYPErM )r rN r r r �check_builtin_icmptype� s z%FirewallConfig.check_builtin_icmptypec C s | j |� | j|� d S )N)r| ru )r rN r r r �remove_icmptype� s
z FirewallConfig.remove_icmptypec C s$ | j |� | j||�}| j|� |S )N)r| �_copy_icmptyperu )r rN rM rz r r r �rename_icmptype� s
z FirewallConfig.rename_icmptypec C s | j ||j� �S )N)rz rU )r rN rM r r r r~ s z FirewallConfig._copy_icmptypec C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r# r2 r( )r r r r � get_services
s zFirewallConfig.get_servicesc C s$ |j r|| j|j< n || j|j< d S )N)rL r( rM r# )r rN r r r � add_service s zFirewallConfig.add_servicec C s< || j kr| j | S || jkr(| j| S ttjd| ��d S )Nzget_service(): '%s')r# r( r r �INVALID_SERVICE)r rM r r r � get_service s
zFirewallConfig.get_servicec C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._services[%s] != objz'%s' not a built-in service)rM r# r r rR r( �_remove_service)r rN r r r �load_service_defaults s
z$FirewallConfig.load_service_defaultsc C sr |j � }g }x\td�D ]P}|j| d |krN|jtjt||j| d ��� q|j||j| d � qW t|�S )N� r )�export_config_dict�range�IMPORT_EXPORT_STRUCTURE�appendrW �deepcopy�getattr�tuple)r rN � conf_dict� conf_list�ir r r �get_service_config' s " z!FirewallConfig.get_service_configc C s |j � S )N)r� )r rN r r r �get_service_config_dict3 s z&FirewallConfig.get_service_config_dictc C s� i }x&t |�D ]\}}|||j| d < qW |jr|tj|�}|j|� tj|_d|_|j|jkrfd|_| j |� t
|� |S |j|� t
|� |S d S )Nr F) � enumerater� rL rW �import_config_dictr �ETC_FIREWALLD_SERVICESr> rZ r� r
)r rN r: r� r� r9 r4 r r r �set_service_config6 s
z!FirewallConfig.set_service_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL rW r� r r� r> rZ r� r
)r rN r: r4 r r r �set_service_config_dictJ s
z&FirewallConfig.set_service_config_dictc C s� || j ks|| jkr$ttjd| ��i }x&t|�D ]\}}||tj| d < q2W t� }|j|� |j |� ||_
d| |_ t j
|_d|_d|_t|� | j|� |S )Nznew_service(): '%s'r z%s.xmlFT)r# r( r r r\ r� r r� r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r� r� r9 r4 r r r � new_serviceZ s"
zFirewallConfig.new_servicec C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_service(): '%s'z%s.xmlFT)r# r( r r r\ r r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r4 r r r �new_service_dictq s
z FirewallConfig.new_service_dictc C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) Nr` ra zLoading service file '%s'z$Failed to load service file '%s': %srb )NN)NN)NN)NN)NN)r= r> rc rd r? r r� r# r2 r^ rM r( r re r rf rg r� rZ )r rM r^ r> r4 rN rh r r r �update_service_from_path� sP
z'FirewallConfig.update_service_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r# r r r� r> r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� � s z FirewallConfig._remove_servicec C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in service)rL rZ r r ZBUILTIN_SERVICErM )r rN r r r �check_builtin_service� s z$FirewallConfig.check_builtin_servicec C s | j |� | j|� d S )N)r� r� )r rN r r r �remove_service� s
z FirewallConfig.remove_servicec C s$ | j |� | j||�}| j|� |S )N)r� �
_copy_servicer� )r rN rM r� r r r �rename_service� s
z FirewallConfig.rename_servicec C s | j ||j� �S )N)r� r� )r rN rM r r r r� � s z FirewallConfig._copy_servicec C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r$ r2 r) )r r r r � get_zones� s zFirewallConfig.get_zonesc C s$ |j r|| j|j< n || j|j< d S )N)rL r) rM r$ )r rN r r r �add_zone� s zFirewallConfig.add_zonec C s( || j kr| j |= || jkr$| j|= d S )N)r) r$ )r rM r r r � forget_zone� s
zFirewallConfig.forget_zonec C s< || j kr| j | S || jkr(| j| S ttjd| ��d S )Nzget_zone(): %s)r$ r) r r � INVALID_ZONE)r rM r r r �get_zone� s
zFirewallConfig.get_zonec C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._zones[%s] != objz'%s' not a built-in zone)rM r$ r r rR r) � _remove_zone)r rN r r r �load_zone_defaults s
z!FirewallConfig.load_zone_defaultsc C sr |j � }g }x\td�D ]P}|j| d |krN|jtjt||j| d ��� q|j||j| d � qW t|�S )N� r )r� r� r� r� rW r� r� r� )r rN r� r� r� r r r �get_zone_config s " z FirewallConfig.get_zone_configc C s |j � S )N)r� )r rN r r r �get_zone_config_dict s z#FirewallConfig.get_zone_config_dictc C s� i }x&t |�D ]\}}|||j| d < qW |jr�tj|�}| |_|j|� tj|_d|_|j|jkrld|_ | j
|� t |� |S | |_|j|� t |� |S d S )Nr F) r� r� rL rW � fw_configr� r �ETC_FIREWALLD_ZONESr> rZ r� r
)r rN r: r� r� r9 r4 r r r �set_zone_config s$
z FirewallConfig.set_zone_configc C sv |j rVtj|�}| |_|j|� tj|_d|_ |j|jkr@d|_| j|� t |� |S | |_|j|� t |� |S d S )NF)
rL rW r� r� r r� r> rZ r� r
)r rN r: r4 r r r �set_zone_config_dict6 s
z#FirewallConfig.set_zone_config_dictc C s� || j ks|| jkr$ttjd| ��i }x&t|�D ]\}}||tj| d < q2W t� }| |_|j |� |j
|� ||_ d| |_ t
j|_d|_d|_t|� | j|� |S )Nznew_zone(): '%s'r z%s.xmlFT)r$ r) r r r\ r� r r� r� r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r� r� r9 r4 r r r �new_zoneH s"
zFirewallConfig.new_zonec C s~ || j ks|| jkr$ttjd| ��t� }| |_|j|� |j|� ||_ d| |_
t j |_
d|_d|_t|� | j|� |S )Nznew_zone(): '%s'z%s.xmlFT)r$ r) r r r\ r r� r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r4 r r r �
new_zone_dict_ s
z FirewallConfig.new_zone_dictc C s t jj|�}t jj|�}t jj|�s�|jtj�r�x�| jj � D ]D}| j| }|j
|kr<| j|= |j | j krxd| j |j fS d|fS q<W nHxF| j j � D ]8}| j | }|j
|kr�| j |= |j | jkr�d|fS d S q�W d
S t
jd|� yt||�}W n0 tk
�r } zt
jd||� d S d }~X nX | |_|jtj��rlt|�ttj�k�rldt jj|�t jj|�dd � f |_ |j | j k�r�|j | jk�r�| j|� d|fS |jtj��r�|j | jk�r�| j|j j|_|| j|j < d|fS |j | j k�r| j |j = || j |j < |j | jk�rd|fS d
S dS )Nr` ra zLoading zone file '%s'z!Failed to load zone file '%s': %sz%s/%sr � rb )NN)NN)NN���)NN)NN)r= r> rc rd r? �
startswithr r� r$ r2 r^ rM r) r re r rf rg r� �lenr� rZ )r rM r^ r> r4 rN rh r r r �update_zone_from_pathr sZ
z$FirewallConfig.update_zone_from_pathc C s� |j | jkrttj|j ��|jjtj�s@ttj d|jtjf ��d|j|j f }yt
j |d| � W n: t k
r� } z t
jd||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' doesn't start with '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r$ r r r� r> r� r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� � s zFirewallConfig._remove_zonec C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in zone)rL rZ r r Z BUILTIN_ZONErM )r rN r r r �check_builtin_zone� s z!FirewallConfig.check_builtin_zonec C s | j |� | j|� d S )N)r� r� )r rN r r r � remove_zone� s
zFirewallConfig.remove_zonec C sN | j |� |j� }| j|� y| j||�}W n | j|j|� � Y nX |S )N)r� r� r� r� rM )r rN rM Zobj_confr� r r r � rename_zone� s
zFirewallConfig.rename_zonec C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r0 r2 r+ )r r r r �get_policy_objects� s z!FirewallConfig.get_policy_objectsc C s$ |j r|| j|j< n || j|j< d S )N)rL r+ rM r0 )r rN r r r �add_policy_object� s z FirewallConfig.add_policy_objectc C s< || j kr| j | S || jkr(| j| S ttjd| ��d S )Nzget_policy_object(): %s)r0 r+ r r �INVALID_POLICY)r rM r r r �get_policy_object� s
z FirewallConfig.get_policy_objectc C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nz self._policy_objects[%s] != objz'%s' not a built-in policy)rM r0 r r rR r+ �_remove_policy_object)r rN r r r �load_policy_object_defaults� s
z*FirewallConfig.load_policy_object_defaultsc C s |j � S )N)r� )r rN r r r � get_policy_object_config_dict s z,FirewallConfig.get_policy_object_config_dictc C sv |j rVtj|�}| |_|j|� tj|_d|_ |j|jkr@d|_| j|� t |� |S | |_|j|� t |� |S d S )NF)
rL rW r� r� r �ETC_FIREWALLD_POLICIESr> rZ r� r )r rN r: r4 r r r � set_policy_object_config_dict s
z,FirewallConfig.set_policy_object_config_dictc C s~ || j ks|| jkr$ttjd| ��t� }| |_|j|� |j|� ||_ d| |_
t j |_
d|_d|_t|� | j|� |S )Nznew_policy_object(): '%s'z%s.xmlFT)r0 r+ r r r\ r r� r] r� rM r^ r r� r> rL rZ r r� )r rM r: r4 r r r �new_policy_object_dict s
z%FirewallConfig.new_policy_object_dictc C s t jj|�}t jj|�}t jj|�s�|jtj�r�x�| jj � D ]D}| j| }|j
|kr<| j|= |j | j krxd| j |j fS d|fS q<W nHxF| j j � D ]8}| j | }|j
|kr�| j |= |j | jkr�d|fS d S q�W d
S t
jd|� yt||�}W n0 tk
�r } zt
jd||� d S d }~X nX | |_|jtj��rlt|�ttj�k�rldt jj|�t jj|�dd � f |_ |j | j k�r�|j | jk�r�| j|� d|fS |jtj��r�|j | jk�r�| j|j j|_|| j|j < d|fS |j | j k�r| j |j = || j |j < |j | jk�rd|fS d
S dS )Nr` ra zLoading policy file '%s'z#Failed to load policy file '%s': %sz%s/%sr r� rb )NN)NN)NNr� )NN)NN)r= r> rc rd r? r� r r� r0 r2 r^ rM r+ r re r rf rg r� r� r� rZ )r rM r^ r> r4 rN rh r r r � update_policy_object_from_path, sZ
z-FirewallConfig.update_policy_object_from_pathc C s� |j | jkrttj|j ��|jjtj�s@ttj d|jtjf ��d|j|j f }yt
j |d| � W n: t k
r� } z t
jd||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' doesn't start with '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r0 r r r� r> r� r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� y s z$FirewallConfig._remove_policy_objectc C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in policy)rL rZ r r ZBUILTIN_POLICYrM )r rN r r r �check_builtin_policy_object� s z*FirewallConfig.check_builtin_policy_objectc C s | j |� | j|� d S )N)r� r� )r rN r r r �remove_policy_object� s
z#FirewallConfig.remove_policy_objectc C s$ | j |� | j||�}| j|� |S )N)r� �_copy_policy_objectr� )r rN rM Znew_policy_objectr r r �rename_policy_object� s
z#FirewallConfig.rename_policy_objectc C s | j ||j� �S )N)r� r� )r rN rM r r r r� � s z"FirewallConfig._copy_policy_objectc C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r% r2 r* )r r r r � get_helpers� s zFirewallConfig.get_helpersc C s$ |j r|| j|j< n || j|j< d S )N)rL r* rM r% )r rN r r r �
add_helper� s zFirewallConfig.add_helperc C s8 || j kr| j | S || jkr(| j| S ttj|��d S )N)r% r* r r �INVALID_HELPER)r rM r r r �
get_helper� s
zFirewallConfig.get_helperc C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._helpers[%s] != objz'%s' not a built-in helper)rM r% r r rR r* �_remove_helper)r rN r r r �load_helper_defaults� s
z#FirewallConfig.load_helper_defaultsc C s |j � S )N)rU )r rN r r r �get_helper_config� s z FirewallConfig.get_helper_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL rW rX r �ETC_FIREWALLD_HELPERSr> rZ r� r )r rN r: r4 r r r �set_helper_config� s
z FirewallConfig.set_helper_configc C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_helper(): '%s'z%s.xmlFT)r% r* r r r\ r r] rX rM r^ r r� r> rL rZ r r� )r rM r: r4 r r r �
new_helper� s
zFirewallConfig.new_helperc C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) Nr` ra zLoading helper file '%s'z#Failed to load helper file '%s': %srb )NN)NN)NN)NN)NN)r= r> rc rd r? r r� r% r2 r^ rM r* r re r rf rg r� rZ )r rM r^ r> r4 rN rh r r r �update_helper_from_path� sP
z&FirewallConfig.update_helper_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r% r r r� r> r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� & s z FirewallConfig._remove_helperc C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in helper)rL rZ r r ZBUILTIN_HELPERrM )r rN r r r �check_builtin_helper7 s z#FirewallConfig.check_builtin_helperc C s | j |� | j|� d S )N)r� r� )r rN r r r �
remove_helper< s
z FirewallConfig.remove_helperc C s$ | j |� | j||�}| j|� |S )N)r� � _copy_helperr� )r rN rM r� r r r �
rename_helper@ s
z FirewallConfig.rename_helperc C s | j ||j� �S )N)r� rU )r rN rM r r r r� F s zFirewallConfig._copy_helperN)f�__name__�
__module__� __qualname__r r/ r r3 r6 r7 r; r< rB rC rD rE rF rG rH rK rO rQ rT rV r[ r_ ri rS rm rn rp ro rq rr rt rv rw ry rz r{ ru r| r} r r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r ' s�
7 E E E M M E)&�__all__rW r= Zos.pathrk Zfirewallr Zfirewall.core.loggerr Zfirewall.core.io.icmptyper r r Zfirewall.core.io.servicer r r
Zfirewall.core.io.zoner r r
Zfirewall.core.io.ipsetr r r Zfirewall.core.io.helperr r r Zfirewall.core.io.policyr r r r Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/ipXtables.cpython-36.opt-1.pyc 0000644 00000104137 15035135173 0015235 0 ustar 00 3
��g�� � @ s( d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m
Z
m Z m Z m
Z
mZmZ d dlmZ d dlmZmZmZmZmZ d dlmZmZmZm Z m Z m Z m Z d dl Z dZ!d d
d gd d
gd d
d d
d gd d
d
gd d
d gd�Z"ddd�Z#ddd�Z$dd� Z%dd� Z&dd� Z'G dd� de(�Z)G d d � d e)�Z*dS ) � N)�runProg)�log)�tempFile�readfile� splitArgs� check_mac�portStr�check_single_address�
check_address� normalizeIP6)�config)�
FirewallError�INVALID_PASSTHROUGH� INVALID_RULE�
UNKNOWN_ERROR� INVALID_ADDR)� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock� �INPUT�OUTPUT�FORWARD�
PREROUTING� POSTROUTING)�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited)�ipv4�ipv6�icmpz ipv6-icmpc C s� ddddddd�}| dd� }x~|D ]v}y|j |�}W n tk
rL w$Y nX |d
kr�yt||d � W n tk
r~ Y nX |j|d � || ||< q$W |S ) z Inverse valid rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insert� )r' r( )�index� Exception�int�pop)�args� replace_args�ret_args�arg�idx� r3 � /usr/lib/python3.6/ipXtables.py�common_reverse_rule9 s(
r5 c C s� ddddddd�}| dd� }x�|D ]x}y|j |�}W n tk
rL w$Y nX |d kr�yt||d � W n tk
r~ Y nX |j|d � || ||< |S W ttd
��dS ) z Reverse valid passthough rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insertr) zno '-A', '-I' or '-N' arg)r6 r7 )r* �
ValueErrorr, r- r
r )r. r/ r0 �xr2 r3 r3 r4 �common_reverse_passthrough^ s,
r: c C s� t | �} t ddddddddd d
d d d
dddddddg�}t| |@ �dkrbttdt| |@ �d ��t dddddd g�}t| |@ �dkr�ttd ��d S ) zZ Check if passthough rule is valid (only add, insert and new chain
rules are allowed) z-Cz--checkz-Dz--deletez-Rz --replacez-Lz--listz-Sz --list-rulesz-Fz--flushz-Zz--zeroz-Xz--delete-chainz-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedz-Az--appendz-Iz--insertz-Nz --new-chainzno '-A', '-I' or '-N' argN)�set�lenr
r �list)r. Z not_allowedZneededr3 r3 r4 �common_check_passthrough� s*
r> c @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d
� Z d d � Z
d
d� Z dd� Z dd� Z
dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zdhd"d#�Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zdid,d-�Zd.d/� Zdjd1d2�Z d3d4� Z d5d6� Z dkd8d9�Z dld:d;�Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dmdRdS�Z,dndTdU�Z-dodVdW�Z.dXdY� Z/dpdZd[�Z0dqd\d]�Z1drd^d_�Z2dsd`da�Z3dbdc� Z4ddde� Z5dfdg� Z6d!S )t� ip4tablesr$ Tc C sd || _ tj| j | _tjd| j | _| j� | _| j� | _ | j
� g | _ i | _ i | _
g | _i | _d S )Nz
%s-restore)�_fwr ZCOMMANDS�ipv�_command�_restore_command�_detect_wait_option� wait_option�_detect_restore_wait_option�restore_wait_option� fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache�
our_chains)�self�fwr3 r3 r4 �__init__� s
zip4tables.__init__c C s$ t jj| j�| _t jj| j�| _d S )N)�os�path�existsrB Zcommand_existsrC Zrestore_command_exists)rN r3 r3 r4 rH � s zip4tables.fill_existsc C s� | j r(| j |kr(| j gdd� |D � }ndd� |D �}tjd| j| jdj|�� t| j|�\}}|dkr�td| jdj|�|f ��|S )Nc S s g | ] }d | �qS )z%sr3 )�.0�itemr3 r3 r4 �
<listcomp>� s z#ip4tables.__run.<locals>.<listcomp>c S s g | ] }d | �qS )z%sr3 )rT rU r3 r3 r4 rV � s z %s: %s %s� r z'%s %s' failed: %s)rE r �debug2� __class__rB �joinr r8 )rN r. Z_args�status�retr3 r3 r4 Z__run� s zip4tables.__runc
C s< y|j |�}W n tk
r" dS X ||||d �< dS d S )NF� T)r* r8 )rN �rule�patternZ replacement�ir3 r3 r4 �
_rule_replace� s zip4tables._rule_replacec C s |t ko|t | kS )N)�BUILT_IN_CHAINS)rN rA �table�chainr3 r3 r4 �is_chain_builtin� s zip4tables.is_chain_builtinc C s2 d|g}|r|j d� n
|j d� |j |� |gS )Nz-tz-Nz-X)�append)rN �addrc rd r^ r3 r3 r4 �build_chain_rules� s
zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nz-tz-Iz-D)�str)rN rg rc rd r* r. r^ r3 r3 r4 �
build_rule� s zip4tables.build_rulec C s t |�S )N)r5 )rN r. r3 r3 r4 � reverse_rule� s zip4tables.reverse_rulec C s t |� d S )N)r> )rN r. r3 r3 r4 �check_passthrough� s zip4tables.check_passthroughc C s t |�S )N)r: )rN r. r3 r3 r4 �reverse_passthrough� s z ip4tables.reverse_passthroughc C s� d}y|j d�}W n tk
r& Y n X t|�|d krD||d }d }xLd
D ]D}y|j |�}W n tk
rt Y qNX t|�|d krN||d }qNW ||fS ) Nr# z-tr] �-A�--append�-I�--insert�-N� --new-chain)rn ro rp rq rr rs )r* r8 r< )rN r. rc r` rd �optr3 r3 r4 � passthrough_parse_table_chain� s$ z'ip4tables.passthrough_parse_table_chainc C s4 yH|j d�}|j|� |j|�}d|d kr:||d f}n ||d f}W nF tk
r� y |j d�}|j|� d }W n tk
r� d S X Y nX d}|d dkr�d }|r�| r�||kr�|j|� nn|�r0|� r�||kr�|j|� |jd d
� d� |j |�}n| jj�r d}nt|�}d|d< |j dd|d � d S )Nz%%ZONE_SOURCE%%z-m� � � z%%ZONE_INTERFACE%%Tr �-D�--deleteFc S s | d S )Nr r3 )r9 r3 r3 r4 �<lambda>& s z4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyz-Ir) z%dr] )ry rz )
r* r- r8 �removerf �sortr@ �_allow_zone_driftingr< �insert)rN r^ rL r` �zoneZ zone_source�rule_addr* r3 r3 r4 �_run_replace_zone_source s>
z"ip4tables._run_replace_zone_sourcec C s y|j |�}W n tk
r$ Y �n�X d}d}d}|j|� |j|�}t|�tkr\ttd��d} xLdD ]D}
y|j |
�} W n tk
r� Y qfX t|�| d krf|| d } qfW xhdD ]`}
y|j |
�}W n tk
r� Y q�X t|�|d k� r�||d } |
dk�rd}|
dkr�d}q�W | | f} |�sp| |k�sP||| k�sP|| | dk�rZttd��|| | d8 < n�| |k�r�i || < ||| k�r�d|| |< d}
xHt || j
� �D ]4}||k�r�|�r�P |
|| | 7 }
||k�r�P �q�W || | d7 < d
||< |j |d d|
� dS )a
Change something like
-t filter -I public_IN %%RICH_RULE_PRIORITY%% 123
or
-t filter -A public_IN %%RICH_RULE_PRIORITY%% 321
into
-t filter -I public_IN 4
or
-t filter -I public_IN
TFr] z%priority must be followed by a numberr# �-t�--table�-A�--append�-I�--insert�-D�--deleter z*nonexistent or underflow of priority countr) z%dN���)r� r� )r� r� r� r� r� r� )r� r� )r� r� ) r* r8 r- �typer, r
r r< r �sorted�keysr� )rN r^ Zpriority_counts�tokenr` r� r� Zinsert_add_index�priorityrc rt �jrd r* �pr3 r3 r4 �_set_rule_replace_priority2 sj
z$ip4tables._set_rule_replace_priorityc C sP t � }i }tj| j�}tj| j�}tj| j�}�x�|D �]�}|d d � } | j| dddt| j g� | j| dt | j g� y| j
d�}
W n t k
r� Y n8X |dkr�q6|d$kr�d
d d |g| |
|
d
�< n
| j |
� | j
| |d� | j
| |d� | j| |� d} xZd%D ]R} y| j
| �}
W n t k
�r, Y n(X t| �|
d
k�r| j |
� | j |
�} �qW xhtt| ��D ]X}
xPtjD ]F}
|
| |
k�rt| |
jd��o�| |
jd� �rtd| |
| |
< �qtW �qhW |j| g �j| � q6W xR|D ]J} || }|jd| � x"|D ]} |jdj| �d � �q W |jd� �q�W |j� tj|j �}t j d| j | j d|j |j!f � g }| j"�rz|j| j"� |jd� t#| j ||j d �\}}t j$� d k�r
t%|j �}|d k �r
d
}
xH|D ]@}t j&d |
|f d
d d � |jd��s�t j&d!d
d"� |
d
7 }
�q�W tj'|j � |d k�r:t d#| j dj|�|f ��|| _|| _|| _d S )&Nz
%%REJECT%%�REJECTz
--reject-withz%%ICMP%%z %%LOGTYPE%%�off�unicast� broadcast� multicastz-m�pkttypez
--pkt-typer] z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%r# �-t�--table�"z"%s"z*%s
rW �
zCOMMIT
z %s: %s %sz%s: %dz-n)�stdinr) z%8d: %sr )�nofmt�nlr )r� z'%s %s' failed: %s)r� r� r� )r� r� )(r �copy�deepcopyrJ rK rL ra �DEFAULT_REJECT_TYPErA �ICMPr* r8 r- r� r� r< �range�stringZ
whitespace�
startswith�endswith�
setdefaultrf �writerZ �closerQ �stat�namer rX rY rC �st_sizerG r ZgetDebugLogLevelr Zdebug3�unlink)rN �rules�
log_denied� temp_fileZ table_rulesrJ rK rL Z_ruler^ r` rc rt �cr� r. r[ r\ �lines�liner3 r3 r4 � set_rules� s�
zip4tables.set_rulesc
C s� | j |dddt| j g� | j |dt| j g� y|jd�}W n tk
rR Y n:X |dkr`dS |dkr�d d d
|g|||d �< n
|j|� tj| j �}tj| j
�}tj| j �}| j ||d� | j ||d� | j
||� | j|�}|| _ || _
|| _ |S )Nz
%%REJECT%%r� z
--reject-withz%%ICMP%%z %%LOGTYPE%%r� r r� r� r� z-mr� z
--pkt-typer] z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%)r� r� r� )ra r� rA r� r* r8 r- r� r� rJ rK rL r� r� �_ip4tables__run)rN r^ r� r` rJ rK rL �outputr3 r3 r4 �set_rule� s.
zip4tables.set_ruleNc C s� g }|r|gnt j� }xx|D ]p}|| jkr6|j|� q y,| jd|ddg� | jj|� |j|� W q tk
r� tjd| j|f � Y q X q W |S )Nz-tz-Lz-nzA%s table '%s' does not exist (or not enough permission to check).) rb r� rI rf r� r8 r �debug1rA )rN rc r\ Ztablesr3 r3 r4 �get_available_tables s
z ip4tables.get_available_tablesc C s` d}t | jdddg�}|d dkr\d}t | jdddg�}|d dkrHd}tjd| j| j|� |S )Nr z-wz-Lz-nr z-w10z %s: %s will be using %s option.)r rB r rX rY )rN rE r\ r3 r3 r4 rD s z ip4tables._detect_wait_optionc C s� t � }|jd� |j� d}xJd D ]B}t| j|g|jd�}|d dkr"d|d kr"d |d kr"|}P q"W tjd
| j| j|� t j
|j� |S ) Nz#foor �-w�--wait=2)r� r zinvalid optionr] zunrecognized optionz %s: %s will be using %s option.)r� r� ) r r� r� r rC r� r rX rY rQ r� )rN r� rE Z test_optionr\ r3 r3 r4 rF " s
z%ip4tables._detect_restore_wait_optionc C sV i | _ i | _g | _g }x:tj� D ].}| j|�s0q x dD ]}|jd||g� q6W q W |S )N�-F�-X�-Zz-t)r� r� r� )rJ rK rL rb r� r� rf )rN r� rc �flagr3 r3 r4 �build_flush_rules5 s
zip4tables.build_flush_rulesc C sf g }|dkrdn|}xLt j� D ]@}| j|�s.q |dkr8q x$t | D ]}|jd|d||g� qBW q W |S )NZPANIC�DROPr" z-tz-P)rb r� r� rf )rN �policyr� �_policyrc rd r3 r3 r4 �build_set_policy_rulesD s
z ip4tables.build_set_policy_rulesc C s g }d}y"| j d| jdkr dnddg�}W nJ tk
rt } z.| jdkrVtjd| � ntjd| � W Y d d }~X nX |j� }d
}x�|D ]�}|r�|j� j� }|j� }xD|D ]<} | j d �r�| j
d �r�| d
d� }
n| }
|
|kr�|j |
� q�W | jdko�|j d��s| jdkr�|j d�r�d}q�W |S )zQReturn ICMP types that are supported by the iptables/ip6tables command and kernelr z-pr$ r& z ipv6-icmpz--helpziptables error: %szip6tables error: %sNF�(�)r] zValid ICMP Types:r% zValid ICMPv6 Types:Tr� ) r� rA r8 r r� �
splitlines�strip�lower�splitr� r� rf ) rN rA r\ r� Zexr� Zin_typesr� Zsplitsr� r9 r3 r3 r4 �supported_icmp_typesP s4
z ip4tables.supported_icmp_typesc C s g S )Nr3 )rN r3 r3 r4 �build_default_tablesq s z ip4tables.build_default_tablesr� c C s i }| j d�rpg |d< t� | jd< xLtd D ]@}|d jd| � |d jd||f � | jd jd| � q,W | j d��r\g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dkr�xt| jjr�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �qW q�W | j d��rNg |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dk�r�xv| jj�r�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �q�W �q�W | j d��r@g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |d9k�rxxv| jj�r�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �q�W �qxW g |d< t� | jd< |d jd� |d jd� |d jd� |d jd� | jd jtd�� xf| jj�r�ddd d
gndd d
gD ]B}|d jd| � |d jd| � | jd jtd| �� �q�W |dk�r |d jd� |d jd � |dk�rF|d jd � |d jd � |d jd � |d jd � |d jd!� |d jd"� | jd jtd#�� xJd:D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �q�W xzd;D ]r}xj| jj�r
dd gnd gD ]N}|d jd)||f � |d jd*||f � | jd jtd+||f �� �qW �q�W xJd<D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �qnW |dk�r�|d jd,� |d jd-� |dk�r�|d jd.� |d jd/� |d d0d1d2d3g7 < | jd jtd4�� xJd=D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q2W xJd>D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q~W g }xJ|D ]B}|| j � k�r�q�x(|| D ] }|jd8|gt |� � �q�W �q�W |S )?Nr z -N %s_directz-A %s -j %s_directz %s_directr r � POLICIES_preZ ZONES_SOURCEZZONES�
POLICIES_postz-N %s_%sz-A %s -j %s_%sz%s_%sr! r" r r# zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%sz-A INPUT -j INPUT_%szINPUT_%sr� z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_directz
-N FORWARD_%sz-A FORWARD -j FORWARD_%sz
FORWARD_%s�IN�OUTz-N FORWARD_%s_%sz-A FORWARD -j FORWARD_%s_%sz
FORWARD_%s_%sz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ
OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sz-t)r r )r� )r� r� )r� )r� )r� )
r� r; rM rb rf rg r@ r �updater ) rN r� Z
default_rulesrd Zdispatch_suffix� directionZfinal_default_rulesrc r^ r3 r3 r4 �build_default_rulesu s�
$(
&*
&* &
(
"z ip4tables.build_default_rulesc C sf |dkrdddhS |dkr,d| j � kr,dhS |dkrHd| j � krHddhS |d krbd | j � krbdhS i S )
Nr# r �
FORWARD_IN� FORWARD_OUTr! r r" r r )r� )rN rc r3 r3 r4 �get_zone_table_chains� s
z ip4tables.get_zone_table_chainsc s� | j jj|���jdk r dnd��dkr4�dkr4dnd} | j jj|�t| �� g }
g } x|D ]} |
jd| g� qZW x|D ]} | jd | g� qvW xB|D ]:}
| j jj|
�}|dkr�| j |� r�q�|
j| j
d |
�� q�W x\|D ]T}
| j jj|
�}|dk�r| j |� �rq�t |
��r�dk�rq�| j| j
d|
�� q�W � �����fdd�}g }|
�r�x�|
D ]F}| �r�x8| D ]}|j|||�� �qdW n|�r�n|j||d �� �qTW nH|�r�n@| �r�x8| D ]}|j|d |�� �q�W n|�r�n|j|d d �� |S )Nr �pre�postr" r TFz-iz-or$ r% z-sr� r z-dc sV ddd�� }d�|d��f d�j g}| r6|j| � |rD|j|� |jd� g� |S )Nz-Az-D)TFz-tz%s_POLICIES_%sz%%POLICY_PRIORITY%%z-j)r� �extend)�ingress_fragment�egress_fragment�add_delr^ )r� rd � chain_suffix�enable�p_objrc r3 r4 � _generate_policy_dispatch_rule s
zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule)r$ r% )r$ r% )r r� r ) r@ r� Z
get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXrf r� Z check_source�is_ipv_supported�_rule_addr_fragmentr )rN r� r� rc rd Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragments� interface�addrrA r� r� r� r� r3 )r� rd r� r� r� rc r4 �!build_policy_ingress_egress_rules� sR
z+ip4tables.build_policy_ingress_egress_rulesFc
C s� |dkr|dkrdnd}| j jj||t|d�} ddddddd�| }
d } |rb| rbd
d | d g} n,|rtd
d | g} ndd | g} |s�| d g7 } | d||
|| | g7 } | gS )Nr" r TF)r� z-iz-o)r r r r� r� r z-gz-Iz%s_ZONESz%%ZONE_INTERFACE%%z-Az-Dz-t)r@ r� r� r� )
rN r� r� r� r� rc rd rf r� r� rt �actionr^ r3 r3 r4 �!build_zone_source_interface_rulesK s&
z+ip4tables.build_zone_source_interface_rulesc C s� |j d�rP|dd � }|dkr$d}nd}dj|g| jjj|� �}ddd ||gS t|�rz|dkrjttd
��dd d |j� gS t d
|�r�t
|�}n,t d
|�r�|j d�}t
|d �d |d }||gS d S )Nzipset:� z-d�dst�src�,z-mr; z --match-setz Can't match a destination MAC.�macz --mac-sourcer% �/r r] )
r� rZ r@ �ipsetZ
get_dimensionr r
r �upperr r r
r� )rN rt �address�invertr� �flags�
addr_splitr3 r3 r4 r� e s"
z ip4tables._rule_addr_fragmentc
C s� ddd�| }|dkr"|dkr"dnd}| j jj||t|d�} d d
d d d
d
d �| }
| j jrdd | } nd
| } t|�r�|dkr�g S || d|d|g} | j| j|
|�� | jd| g� | gS )Nz-Iz-D)TFr" r TF)r� z-sz-d)r r r r� r� r z%s_ZONES_SOURCEz%s_ZONESr� r z%%ZONE_SOURCE%%z-tz-g)r r� r )r@ r� r� r� r r r� r� )
rN r� r� r� r� rc rd r� r� r� rt Zzone_dispatch_chainr^ r3 r3 r4 � build_zone_source_address_rules{ s&
z)ip4tables.build_zone_source_address_rulesc C s> ddd�| }ddd�| }|dkr0|dkr0dnd }| j jj||t|d
�}| j| jt|d | d | d
| d| d| g�� g } | j||d|g� | j|d
| d|g� | j|d | d|g� | j|d | d|g� | j|d| d|g� | j|d| d|g� | j||d|dd
| g� | j||d|dd | g� | j||d|dd | g� | j||d|dd| g� | j||d|dd| g� | j jj| j }
| j j
� dk�r|dk�r|
d k�r�| j||d|ddddd| g � |
dk�r| j||d|ddddd| g � |dk�r,|
d k�r,| j||d|d|
g� |�s:| j � | S ) Nz-Nz-X)TFz-Az-Dr" r TF)r� z%s_logz%s_denyz%s_prez%s_postz%s_allowz-tz-jr� r# r� �
%%REJECT%%z %%LOGTYPE%%�LOGz --log-prefixz
"%s_REJECT: "r� z "%s_DROP: "�ACCEPT)r� r� )r� r� r� r� ) r@ r� r� r� rM r� r; rf Z _policies�target�get_log_denied�reverse) rN r� r� rc rd Z
add_del_chainZ add_del_ruler� r� r� r� r3 r3 r4 �build_policy_chain_rules� sN
z"ip4tables.build_policy_chain_rulesc C s2 |sg S ddd|j g}|jd k r.|d|jg7 }|S )Nz-m�limitz--limitz
--limit-burst)�valueZburst)rN r �sr3 r3 r4 � _rule_limit� s
zip4tables._rule_limitc C s� t |j�tttgkrn<|jrHt |j�tttt gkrRt
t dt |j� ��n
t
t d��|j dkr�t |j�ttgks�t |j�tt gkr�dS t |j�tgks�t |j�ttgkr�dS n|j dk r�dS dS d S )NzUnknown action %szNo rule action specified.r �allowZdenyr� r� )
r� �elementr r r r� r r r r r
r r� )rN � rich_ruler3 r3 r4 �_rich_rule_chain_suffix� s
z!ip4tables._rich_rule_chain_suffixc C s> |j r|j rttd��|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r� r� )r �auditr
r r� )rN r r3 r3 r4 � _rich_rule_chain_suffix_from_log� s
z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr z%%RICH_RULE_PRIORITY%%)r� )rN r r3 r3 r4 � _rich_rule_priority_fragment� s
z&ip4tables._rich_rule_priority_fragmentc
C s� |j s
g S | jjj||t�}ddd�| }| j|�}d||d||f g} | | j|�7 } | |ddg 7 } |j jr�| dd |j j g7 } |j jr�| d
d |j j g7 } | | j |j j
�7 } | S ) Nz-Az-D)TFz-tz%s_%sz-jr� z --log-prefixz'%s'z --log-levelz%s) r r@ r� r� r� r r �prefix�levelr r )
rN r� r r� rc �
rule_fragmentr� r� r� r^ r3 r3 r4 �_rich_rule_log� s
zip4tables._rich_rule_logc C s� |j s
g S ddd�| }| jjj||t�}| j|�}d||d||f g} | | j|�7 } | |7 } t|j�t krrd}
n,t|j�t
kr�d}
nt|j�t kr�d}
nd }
| d
d d |
g7 } | | j |j j
�7 } | S )
Nz-Az-D)TFz-tz%s_%sZacceptZrejectZdrop�unknownz-jZAUDITz--type)r
r@ r� r� r� r r r� r� r r r r r ) rN r� r r� rc r r� r� r� r^ Z_typer3 r3 r4 �_rich_rule_audit s$
zip4tables._rich_rule_auditc C s2 |j s
g S ddd�| }| jjj||t�}| j|�}d||f } t|j �tkrXddg}
n�t|j �tkr�ddg}
|j jr�|
d|j jg7 }
nnt|j �t kr�dd g}
nVt|j �t
kr�d
}| jjj||t�}d||f } dd d |j j g}
nt t
d
t|j � ��d||| g} | | j|�7 } | ||
7 } | | j|j j�7 } | S )Nz-Az-D)TFz%s_%sz-jr� r� z
--reject-withr� r! �MARKz --set-xmarkzUnknown action %sz-t)r� r@ r� r� r� r r� r r r r r; r
r r r r ) rN r� r r� rc r r� r� r� rd Z rule_actionr^ r3 r3 r4 �_rich_rule_action$ s4
zip4tables._rich_rule_actionc C s� |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }q�td|j �r||j jd�}|dt|d �d |d g7 }q�|d|j g7 }nD|jr�|ddg7 }|jr�|jd� | jj j
|jd �}|d
|j|g7 }|S ) N�!r% z-dr� r r] z-mr; r� z --match-set) r� r� rf r r r
r� r� r@ r� �_ipset_match_flags)rN Z rich_destr r� r� r3 r3 r4 � _rich_rule_destination_fragmentF s&
"
z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }nHtd|j �r||j jd�}|dt|d �d |d g7 }n|d|j g7 }n�t|d�r�|jr�|ddg7 }|jr�|jd� |d |jg7 }nPt|d
�o�|j �r|dd g7 }|jr�|jd� | j
j j |j d �}|d
|j |g7 }|S )Nr r% z-sr� r r] r� z-mz --mac-sourcer� r; r� z --match-set)
r� r� rf r r r
r� �hasattrr� r� r@ r� r )rN Z rich_sourcer r� r� r3 r3 r4 �_rich_rule_source_fragment^ s0
"
z$ip4tables._rich_rule_source_fragmentc C s ddd�| }d}| j jj||t�} d|g}
|rD|
ddt|� g7 }
|rT|
d|g7 }
|rx|
| j|j�7 }
|
| j|j�7 }
| s�t |j
�t kr�|
d d
d d g7 }
g } |r�| j | j
|||||
�� | j | j|||||
�� | j | j|||||
�� n"| j |d
| d|g|
ddg � | S )Nz-Az-D)TFr# z-pz--dportz%sz-dz-m� conntrackz --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r � destinationr �sourcer� r� r rf r r r ) rN r� r� �proto�portr r r� rc r� r r� r3 r3 r4 �build_policy_ports_rules{ s* z"ip4tables.build_policy_ports_rulesc C s� ddd�| }d}| j jj||t�}d|g} |r<| d|g7 } |r`| | j|j�7 } | | j|j�7 } | stt|j �t
kr�| ddd d
g7 } g }
|r�|
j | j ||||| �� |
j | j
||||| �� |
j | j||||| �� n"|
j |d | d |g| d
dg � |
S )Nz-Az-D)TFr# z-pz-dz-mr z --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r r r r� r� r rf r r r ) rN r� r� �protocolr r r� rc r� r r� r3 r3 r4 �build_policy_protocol_rules� s& z%ip4tables.build_policy_protocol_rulesc C s ddd�| }d}| j jj||t�} d|g}
|rD|
ddt|� g7 }
|rT|
d|g7 }
|rx|
| j|j�7 }
|
| j|j�7 }
| s�t |j
�t kr�|
d d
d d g7 }
g } |r�| j | j
|||||
�� | j | j|||||
�� | j | j|||||
�� n"| j |d
| d|g|
ddg � | S )Nz-Az-D)TFr# z-pz--sportz%sz-dz-mr z --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r r r r r� r� r rf r r r ) rN r� r� r r r r r� rc r� r r� r3 r3 r4 � build_policy_source_ports_rules� s* z)ip4tables.build_policy_source_ports_rulesc C sv d}| j jj||t�} ddd�| }
|
d| ddd|g} |rP| dd t|� g7 } |r`| d
|g7 } | d d d
|g7 } | gS )Nr z-Az-D)TFz%s_allowz-tz-pz--dportz%sz-dz-jZCTz--helper)r@ r� r� r� r ) rN r� r� r r r Z helper_nameZmodule_short_namerc r� r� r^ r3 r3 r4 � build_policy_helper_ports_rules� s z)ip4tables.build_policy_helper_ports_rulesc
C s� ddd�| }| j jj||t�}g } |rH| jdd|d| d|dd g� n6t|�rTg S | jdd|d| g| jd
|� dd g � | S ) Nz-Az-D)TFz-tr# z%s_allowz-oz-jr� z-d)r@ r� r� r� rf r r� )
rN r� r� r� rc r� r r� r� r� r3 r3 r4 �build_zone_forward_rules� s z"ip4tables.build_zone_forward_rulesc
C s, d}| j jj||tdd�}ddd�| }g }|rj| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}g } | j
dd|d ||f g| d
d d d
dg � g }|r�| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}d}| j jj||t�}| j
dd|d ||f g| ddddd
dg � | S )Nr" T)r� z-Az-D)TFr z-tz%s_%sr z-o�loz-jZ
MASQUERADEr# z-mr z --ctstatez
NEW,UNTRACKEDr� ) r@ r� r� r� r r r r r r rf )
rN r� r� r rc r� r� r r� r� r3 r3 r4 � build_policy_masquerade_rules� s6
z'ip4tables.build_policy_masquerade_rulesc
C s
d}| j jj||t�} ddd�| }
d} |rPtd|�rH| dt|� 7 } n| |7 } |rn|dkrn| dt|d � 7 } g } |r�| j|�}
| j|�} | | j |j
�7 } | | j |j �7 } nd
}
g }|r�|j
| j|||d| �� |j
d d|
d | |
f g| d
|dt|�ddd| g � |S )Nr" z-Az-D)TFr r% z[%s]z:%s�-r z-tz%s_%sz-pz--dportz-jZDNATz--to-destination)r@ r� r� r� r r r r r r r r r rf r )rN r� r� r r ZtoportZtoaddrr rc r� r� Ztor r� r� r3 r3 r4 � build_policy_forward_port_rules s2
z)ip4tables.build_policy_forward_port_rulesc C s� d}| j jj||t�}ddd�| }| jdkrFddg}ddd |jg} ndd
g}dd d |jg} g }
| j jj|�r|d
| } d} n d| } d} g }
|r�|
| j|j�7 }
|
| j |j
�7 }
|
|| 7 }
|�rP|
j | j |||||
�� |
j | j
|||||
�� |j�r|
j | j|||||
�� n:| j|�}|
j d||d||f g| j|� |
ddg � n`| j j� dk�r�| dk�r�|
j || d|g|
ddddd| g � |
j || d|g|
d| g � |
S )Nr# z-Az-D)TFr$ z-pr& z-mz --icmp-typez ipv6-icmpZicmp6z
--icmpv6-typez%s_allowr� z%s_denyz
%%REJECT%%z-tz%s_%sz-jr� z %%LOGTYPE%%r� z --log-prefixz"%s_ICMP_BLOCK: ")r@ r� r� r� rA r� �query_icmp_block_inversionr r r r rf r r r� r r r r� )rN r� r� Zictr rc r� r� r �matchr� Z final_chainZ final_targetr r� r3 r3 r4 � build_policy_icmp_block_rules3 sJ
z'ip4tables.build_policy_icmp_block_rulesc C s� d}| j jj||t�}g }d}| j jj|�r�d}| j j� dkr�|rRd|t|�g}nd|g}|d|dd d
d d d
d| g }|j|� |d7 }nd}|r�d|t|�g}nd|g}|d|dd d |g }|j|� |S )Nr# r� z
%%REJECT%%r� z-Iz-Dz-tz-pz%%ICMP%%z %%LOGTYPE%%z-jr� z --log-prefixz"%s_ICMP_BLOCK: "r] r� )r@ r� r� r� r) r� ri rf ) rN r� r� rc r� r� Zrule_idxZ
ibi_targetr^ r3 r3 r4 �'build_policy_icmp_block_inversion_rulesd s.
z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| j |j�7 }|| j|j�7 }g }|j| j|||||�� |j| j|||||�� |j| j|||||�� |S )Nr# )r r r r rf r r r )rN r� r� r rc r r� r3 r3 r4 �*build_policy_rich_source_destination_rules� s z4ip4tables.build_policy_rich_source_destination_rulesc C s
|| j kS )N)rA )rN rA r3 r3 r4 r� � s zip4tables.is_ipv_supported)N)N)r� )F)F)NN)NN)NN)NN)N)N)N)7�__name__�
__module__� __qualname__rA r� Zpolicies_supportedrP rH r� ra re rh rj rk rl rm ru r� r� r� r� r� rD rF r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r r! r" r# r$ r& r( r+ r, r- r� r3 r3 r3 r4 r? � sh
)Pa#
!
zN
0 "
&
!
1"r? c @ s& e Zd ZdZd Zddd�Zdd� ZdS ) � ip6tablesr% Fc
C s� g }|j ddddddddd d
g
� |d krL|j ddddddddd d d
dg � |j dddddddd dg � |j dddddddd dg � |S )Nz-Ir z-tr! z-mZrpfilterz--invertz --validmarkz-jr� r� r� z --log-prefixzrpfilter_DROP: z-pz ipv6-icmpz$--icmpv6-type=neighbour-solicitationr� z"--icmpv6-type=router-advertisement)rf )rN r� r� r3 r3 r4 �build_rpfilter_rules� s$
z ip6tables.build_rpfilter_rulesc C s� ddddddddd g }d
}| j d j|� g }|jd d d
|g� xT|D ]L}|jd d d|d|ddddg
� | jjd krF|jd d d|d|ddddg
� qFW |jd d dddd|g� |jd d dddd|g� |S ) Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r# z-tz-Nz-Iz-dz-jr� z
--reject-withz addr-unreachr� �allr� z --log-prefixz"RFC3964_IPv4_REJECT: "r �4r )r� r3 )rM rg rf r@ Z _log_denied)rN Z
daddr_listZ
chain_namer� Zdaddrr3 r3 r4 �build_rfc3964_ipv4_rules� s4
z"ip6tables.build_rfc3964_ipv4_rulesN)F)r. r/ r0 rA r� r2 r5 r3 r3 r3 r4 r1 � s
r1 )+Zos.pathrQ r� Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r
r Zfirewallr Zfirewall.errorsr
r r r r Zfirewall.core.richr r r r r r r r� r� rb r� r� r5 r: r> �objectr? r1 r3 r3 r3 r4 �<module> s@ ( $ %* x core/__pycache__/fw_config.cpython-36.pyc 0000644 00000077161 15035135173 0014312 0 ustar 00 3
��g� � @ s� d gZ ddlZddlZddlZddlZddlmZ ddlmZ ddl m
Z
m Z m Z ddl
mZmZmZ ddlmZmZmZ ddlmZmZmZ dd lmZmZm Z dd
l m Z m Z m Z dd lm!Z! dd l"m#Z# G d
d � d e$�Z%dS )�FirewallConfig� N)�config)�log)�IcmpType�icmptype_reader�icmptype_writer)�Service�service_reader�service_writer)�Zone� zone_reader� zone_writer)�IPSet� ipset_reader� ipset_writer)�Helper�
helper_reader�
helper_writer)�Policy�
policy_reader�
policy_writer)�errors)�
FirewallErrorc @ s$ e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z!d?d@� Z"dAdB� Z#dCdD� Z$dEdF� Z%dGdH� Z&dIdJ� Z'dKdL� Z(dMdN� Z)dOdP� Z*dQdR� Z+dSdT� Z,dUdV� Z-dWdX� Z.dYdZ� Z/d[d\� Z0d]d^� Z1d_d`� Z2dadb� Z3dcdd� Z4dedf� Z5dgdh� Z6didj� Z7dkdl� Z8dmdn� Z9dodp� Z:dqdr� Z;dsdt� Z<dudv� Z=dwdx� Z>dydz� Z?d{d|� Z@d}d~� ZAdd�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�� Z`d�d�� Zad�d�� Zbd�d Zcd�dĄ Zdd�dƄ Zed�S )�r c C s || _ | j� d S )N)�_fw�_FirewallConfig__init_vars)�self�fw� r � /usr/lib/python3.6/fw_config.py�__init__( s zFirewallConfig.__init__c C sH d| j | j| j| j| j| j| j| j| j| j | j
| j | j | j
| j| jf S )Nz>%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__�_ipsets�
_icmptypes� _services�_zones�_helpersZpolicy_objects�_builtin_ipsets�_builtin_icmptypes�_builtin_services�_builtin_zones�_builtin_helpers�_builtin_policy_objects�_firewalld_conf� _policies�_direct)r r r r �__repr__, s zFirewallConfig.__repr__c C s^ i | _ i | _i | _i | _i | _i | _i | _i | _i | _i | _ i | _
i | _ d | _ d | _
d | _d S )N)r! r" r# r$ r% �_policy_objectsr& r' r( r) r* r+ r, r- r. )r r r r Z __init_vars6 s zFirewallConfig.__init_varsc C s4 x,t | jj� �D ]}| j| j� | j|= qW x,t | jj� �D ]}| j| j� | j|= q>W x,t | jj� �D ]}| j| j� | j|= qlW x,t | jj� �D ]}| j| j� | j|= q�W x,t | jj� �D ]}| j| j� | j|= q�W x,t | jj� �D ]}| j| j� | j|= q�W x.t | j j� �D ] }| j | j� | j |= �q$W x.t | j
j� �D ] }| j
| j� | j
|= �qTW x.t | j j� �D ] }| j | j� | j |= �q�W x.t | j j� �D ] }| j | j� | j |= �q�W | j
�r�| j
j� | `
d | _
| j�r | jj� | `d | _| j�r(| jj� | `d | _| j� d S )N)�listr& �keys�cleanupr! r' r" r( r# r) r$ r* r% r, r- r. r )r �xr r r r3 G sV
zFirewallConfig.cleanupc C s | j jj� S )N)r �policiesZquery_lockdown)r r r r �lockdown_enabled~ s z FirewallConfig.lockdown_enabledc C s | j jj||�S )N)r r5 � access_check)r �key�valuer r r r7 � s zFirewallConfig.access_checkc C s
|| _ d S )N)r, )r �confr r r �set_firewalld_conf� s z!FirewallConfig.set_firewalld_confc C s | j S )N)r, )r r r r �get_firewalld_conf� s z!FirewallConfig.get_firewalld_confc C s( t jjtj�s| jj� n
| jj� d S )N)�os�path�existsr ZFIREWALLD_CONFr, �clear�read)r r r r �update_firewalld_conf� s z$FirewallConfig.update_firewalld_confc C s
|| _ d S )N)r- )r r5 r r r � set_policies� s zFirewallConfig.set_policiesc C s | j S )N)r- )r r r r � get_policies� s zFirewallConfig.get_policiesc C s, t jjtj�s | jjj� n | jjj� d S )N) r= r> r? r ZLOCKDOWN_WHITELISTr- Zlockdown_whitelistr3 rA )r r r r �update_lockdown_whitelist� s z(FirewallConfig.update_lockdown_whitelistc C s
|| _ d S )N)r. )r Zdirectr r r �
set_direct� s zFirewallConfig.set_directc C s | j S )N)r. )r r r r �
get_direct� s zFirewallConfig.get_directc C s( t jjtj�s| jj� n
| jj� d S )N)r= r> r? r ZFIREWALLD_DIRECTr. r3 rA )r r r r �
update_direct� s z FirewallConfig.update_directc C s$ t tt| jj� �t| jj� � ��S )N)�sorted�setr1 r! r2 r& )r r r r �
get_ipsets� s zFirewallConfig.get_ipsetsc C s$ |j r|| j|j< n || j|j< d S )N)�builtinr& �namer! )r �objr r r � add_ipset� s zFirewallConfig.add_ipsetc C s8 || j kr| j | S || jkr(| j| S ttj|��d S )N)r! r& r r �
INVALID_IPSET)r rM r r r � get_ipset� s
zFirewallConfig.get_ipsetc C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._ipsets[%s] != objz'%s' not a built-in ipset)rM r! r r � NO_DEFAULTSr& �
_remove_ipset)r rN r r r �load_ipset_defaults� s
z"FirewallConfig.load_ipset_defaultsc C s |j � S )N)�
export_config)r rN r r r �get_ipset_config� s z FirewallConfig.get_ipset_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL �copy�
import_configr �ETC_FIREWALLD_IPSETSr> �defaultrO r )r rN r: r4 r r r �set_ipset_config� s
z FirewallConfig.set_ipset_configc C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_ipset(): '%s'z%s.xmlFT)r! r& r r �
NAME_CONFLICTr �
check_namerX rM �filenamer rY r> rL rZ r rO )r rM r: r4 r r r � new_ipset� s
zFirewallConfig.new_ipsetc C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) N�update�removezLoading ipset file '%s'z"Failed to load ipset file '%s': %s�new)NN)NN)NN)NN)NN)r= r> �basename�dirnamer? r rY r! r2 r^ rM r& r �debug1r � Exception�errorrO rZ )r rM r^ r> r4 rN �msgr r r �update_ipset_from_path� sP
z%FirewallConfig.update_ipset_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r! r r rP r> r rY �INVALID_DIRECTORY�shutil�moverf r rg r= ra )r rN rM rh r r r rS 8 s z FirewallConfig._remove_ipsetc C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in ipset)rL rZ r r Z
BUILTIN_IPSETrM )r rN r r r �check_builtin_ipsetI s z"FirewallConfig.check_builtin_ipsetc C s | j |� | j|� d S )N)rm rS )r rN r r r � remove_ipsetN s
zFirewallConfig.remove_ipsetc C s$ | j |� | j||�}| j|� |S )N)rm � _copy_ipsetrS )r rN rM r_ r r r � rename_ipsetR s
zFirewallConfig.rename_ipsetc C s | j ||j� �S )N)r_ rU )r rN rM r r r ro X s zFirewallConfig._copy_ipsetc C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r" r2 r' )r r r r �
get_icmptypes] s z FirewallConfig.get_icmptypesc C s$ |j r|| j|j< n || j|j< d S )N)rL r' rM r" )r rN r r r � add_icmptypea s zFirewallConfig.add_icmptypec C s8 || j kr| j | S || jkr(| j| S ttj|��d S )N)r" r' r r �INVALID_ICMPTYPE)r rM r r r � get_icmptypeg s
zFirewallConfig.get_icmptypec C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._icmptypes[%s] != objz '%s' not a built-in icmptype)rM r" r r rR r' �_remove_icmptype)r rN r r r �load_icmptype_defaultsn s
z%FirewallConfig.load_icmptype_defaultsc C s |j � S )N)rU )r rN r r r �get_icmptype_configz s z"FirewallConfig.get_icmptype_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL rW rX r �ETC_FIREWALLD_ICMPTYPESr> rZ rr r )r rN r: r4 r r r �set_icmptype_config} s
z"FirewallConfig.set_icmptype_configc C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_icmptype(): '%s'z%s.xmlFT)r" r' r r r\ r r] rX rM r^ r rx r> rL rZ r rr )r rM r: r4 r r r � new_icmptype� s
zFirewallConfig.new_icmptypec C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) Nr` ra zLoading icmptype file '%s'z%Failed to load icmptype file '%s': %srb )NN)NN)NN)NN)NN)r= r> rc rd r? r rx r" r2 r^ rM r' r re r rf rg rr rZ )r rM r^ r> r4 rN rh r r r �update_icmptype_from_path� sP
z(FirewallConfig.update_icmptype_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r" r r rs r> r rx rj rk rl rf r rg r= ra )r rN rM rh r r r ru � s z FirewallConfig._remove_icmptypec C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in icmp type)rL rZ r r ZBUILTIN_ICMPTYPErM )r rN r r r �check_builtin_icmptype� s z%FirewallConfig.check_builtin_icmptypec C s | j |� | j|� d S )N)r| ru )r rN r r r �remove_icmptype� s
z FirewallConfig.remove_icmptypec C s$ | j |� | j||�}| j|� |S )N)r| �_copy_icmptyperu )r rN rM rz r r r �rename_icmptype� s
z FirewallConfig.rename_icmptypec C s | j ||j� �S )N)rz rU )r rN rM r r r r~ s z FirewallConfig._copy_icmptypec C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r# r2 r( )r r r r � get_services
s zFirewallConfig.get_servicesc C s$ |j r|| j|j< n || j|j< d S )N)rL r( rM r# )r rN r r r � add_service s zFirewallConfig.add_servicec C s< || j kr| j | S || jkr(| j| S ttjd| ��d S )Nzget_service(): '%s')r# r( r r �INVALID_SERVICE)r rM r r r � get_service s
zFirewallConfig.get_servicec C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._services[%s] != objz'%s' not a built-in service)rM r# r r rR r( �_remove_service)r rN r r r �load_service_defaults s
z$FirewallConfig.load_service_defaultsc C sr |j � }g }x\td�D ]P}|j| d |krN|jtjt||j| d ��� q|j||j| d � qW t|�S )N� r )�export_config_dict�range�IMPORT_EXPORT_STRUCTURE�appendrW �deepcopy�getattr�tuple)r rN � conf_dict� conf_list�ir r r �get_service_config' s " z!FirewallConfig.get_service_configc C s |j � S )N)r� )r rN r r r �get_service_config_dict3 s z&FirewallConfig.get_service_config_dictc C s� i }x&t |�D ]\}}|||j| d < qW |jr|tj|�}|j|� tj|_d|_|j|jkrfd|_| j |� t
|� |S |j|� t
|� |S d S )Nr F) � enumerater� rL rW �import_config_dictr �ETC_FIREWALLD_SERVICESr> rZ r� r
)r rN r: r� r� r9 r4 r r r �set_service_config6 s
z!FirewallConfig.set_service_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL rW r� r r� r> rZ r� r
)r rN r: r4 r r r �set_service_config_dictJ s
z&FirewallConfig.set_service_config_dictc C s� || j ks|| jkr$ttjd| ��i }x&t|�D ]\}}||tj| d < q2W t� }|j|� |j |� ||_
d| |_ t j
|_d|_d|_t|� | j|� |S )Nznew_service(): '%s'r z%s.xmlFT)r# r( r r r\ r� r r� r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r� r� r9 r4 r r r � new_serviceZ s"
zFirewallConfig.new_servicec C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_service(): '%s'z%s.xmlFT)r# r( r r r\ r r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r4 r r r �new_service_dictq s
z FirewallConfig.new_service_dictc C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) Nr` ra zLoading service file '%s'z$Failed to load service file '%s': %srb )NN)NN)NN)NN)NN)r= r> rc rd r? r r� r# r2 r^ rM r( r re r rf rg r� rZ )r rM r^ r> r4 rN rh r r r �update_service_from_path� sP
z'FirewallConfig.update_service_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r# r r r� r> r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� � s z FirewallConfig._remove_servicec C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in service)rL rZ r r ZBUILTIN_SERVICErM )r rN r r r �check_builtin_service� s z$FirewallConfig.check_builtin_servicec C s | j |� | j|� d S )N)r� r� )r rN r r r �remove_service� s
z FirewallConfig.remove_servicec C s$ | j |� | j||�}| j|� |S )N)r� �
_copy_servicer� )r rN rM r� r r r �rename_service� s
z FirewallConfig.rename_servicec C s | j ||j� �S )N)r� r� )r rN rM r r r r� � s z FirewallConfig._copy_servicec C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r$ r2 r) )r r r r � get_zones� s zFirewallConfig.get_zonesc C s$ |j r|| j|j< n || j|j< d S )N)rL r) rM r$ )r rN r r r �add_zone� s zFirewallConfig.add_zonec C s( || j kr| j |= || jkr$| j|= d S )N)r) r$ )r rM r r r � forget_zone� s
zFirewallConfig.forget_zonec C s< || j kr| j | S || jkr(| j| S ttjd| ��d S )Nzget_zone(): %s)r$ r) r r � INVALID_ZONE)r rM r r r �get_zone� s
zFirewallConfig.get_zonec C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._zones[%s] != objz'%s' not a built-in zone)rM r$ r r rR r) � _remove_zone)r rN r r r �load_zone_defaults s
z!FirewallConfig.load_zone_defaultsc C sr |j � }g }x\td�D ]P}|j| d |krN|jtjt||j| d ��� q|j||j| d � qW t|�S )N� r )r� r� r� r� rW r� r� r� )r rN r� r� r� r r r �get_zone_config s " z FirewallConfig.get_zone_configc C s |j � S )N)r� )r rN r r r �get_zone_config_dict s z#FirewallConfig.get_zone_config_dictc C s� i }x&t |�D ]\}}|||j| d < qW |jr�tj|�}| |_|j|� tj|_d|_|j|jkrld|_ | j
|� t |� |S | |_|j|� t |� |S d S )Nr F) r� r� rL rW � fw_configr� r �ETC_FIREWALLD_ZONESr> rZ r� r
)r rN r: r� r� r9 r4 r r r �set_zone_config s$
z FirewallConfig.set_zone_configc C sv |j rVtj|�}| |_|j|� tj|_d|_ |j|jkr@d|_| j|� t |� |S | |_|j|� t |� |S d S )NF)
rL rW r� r� r r� r> rZ r� r
)r rN r: r4 r r r �set_zone_config_dict6 s
z#FirewallConfig.set_zone_config_dictc C s� || j ks|| jkr$ttjd| ��i }x&t|�D ]\}}||tj| d < q2W t� }| |_|j |� |j
|� ||_ d| |_ t
j|_d|_d|_t|� | j|� |S )Nznew_zone(): '%s'r z%s.xmlFT)r$ r) r r r\ r� r r� r� r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r� r� r9 r4 r r r �new_zoneH s"
zFirewallConfig.new_zonec C s~ || j ks|| jkr$ttjd| ��t� }| |_|j|� |j|� ||_ d| |_
t j |_
d|_d|_t|� | j|� |S )Nznew_zone(): '%s'z%s.xmlFT)r$ r) r r r\ r r� r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r4 r r r �
new_zone_dict_ s
z FirewallConfig.new_zone_dictc C s t jj|�}t jj|�}t jj|�s�|jtj�r�x�| jj � D ]D}| j| }|j
|kr<| j|= |j | j krxd| j |j fS d|fS q<W nHxF| j j � D ]8}| j | }|j
|kr�| j |= |j | jkr�d|fS d S q�W d
S t
jd|� yt||�}W n0 tk
�r } zt
jd||� d S d }~X nX | |_|jtj��rlt|�ttj�k�rldt jj|�t jj|�dd � f |_ |j | j k�r�|j | jk�r�| j|� d|fS |jtj��r�|j | jk�r�| j|j j|_|| j|j < d|fS |j | j k�r| j |j = || j |j < |j | jk�rd|fS d
S dS )Nr` ra zLoading zone file '%s'z!Failed to load zone file '%s': %sz%s/%sr � rb )NN)NN)NN���)NN)NN)r= r> rc rd r? �
startswithr r� r$ r2 r^ rM r) r re r rf rg r� �lenr� rZ )r rM r^ r> r4 rN rh r r r �update_zone_from_pathr sZ
z$FirewallConfig.update_zone_from_pathc C s� |j | jkrttj|j ��|jjtj�s@ttj d|jtjf ��d|j|j f }yt
j |d| � W n: t k
r� } z t
jd||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' doesn't start with '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r$ r r r� r> r� r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� � s zFirewallConfig._remove_zonec C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in zone)rL rZ r r Z BUILTIN_ZONErM )r rN r r r �check_builtin_zone� s z!FirewallConfig.check_builtin_zonec C s | j |� | j|� d S )N)r� r� )r rN r r r � remove_zone� s
zFirewallConfig.remove_zonec C sN | j |� |j� }| j|� y| j||�}W n | j|j|� � Y nX |S )N)r� r� r� r� rM )r rN rM Zobj_confr� r r r � rename_zone� s
zFirewallConfig.rename_zonec C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r0 r2 r+ )r r r r �get_policy_objects� s z!FirewallConfig.get_policy_objectsc C s$ |j r|| j|j< n || j|j< d S )N)rL r+ rM r0 )r rN r r r �add_policy_object� s z FirewallConfig.add_policy_objectc C s< || j kr| j | S || jkr(| j| S ttjd| ��d S )Nzget_policy_object(): %s)r0 r+ r r �INVALID_POLICY)r rM r r r �get_policy_object� s
z FirewallConfig.get_policy_objectc C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nz self._policy_objects[%s] != objz'%s' not a built-in policy)rM r0 r r rR r+ �_remove_policy_object)r rN r r r �load_policy_object_defaults� s
z*FirewallConfig.load_policy_object_defaultsc C s |j � S )N)r� )r rN r r r � get_policy_object_config_dict s z,FirewallConfig.get_policy_object_config_dictc C sv |j rVtj|�}| |_|j|� tj|_d|_ |j|jkr@d|_| j|� t |� |S | |_|j|� t |� |S d S )NF)
rL rW r� r� r �ETC_FIREWALLD_POLICIESr> rZ r� r )r rN r: r4 r r r � set_policy_object_config_dict s
z,FirewallConfig.set_policy_object_config_dictc C s~ || j ks|| jkr$ttjd| ��t� }| |_|j|� |j|� ||_ d| |_
t j |_
d|_d|_t|� | j|� |S )Nznew_policy_object(): '%s'z%s.xmlFT)r0 r+ r r r\ r r� r] r� rM r^ r r� r> rL rZ r r� )r rM r: r4 r r r �new_policy_object_dict s
z%FirewallConfig.new_policy_object_dictc C s t jj|�}t jj|�}t jj|�s�|jtj�r�x�| jj � D ]D}| j| }|j
|kr<| j|= |j | j krxd| j |j fS d|fS q<W nHxF| j j � D ]8}| j | }|j
|kr�| j |= |j | jkr�d|fS d S q�W d
S t
jd|� yt||�}W n0 tk
�r } zt
jd||� d S d }~X nX | |_|jtj��rlt|�ttj�k�rldt jj|�t jj|�dd � f |_ |j | j k�r�|j | jk�r�| j|� d|fS |jtj��r�|j | jk�r�| j|j j|_|| j|j < d|fS |j | j k�r| j |j = || j |j < |j | jk�rd|fS d
S dS )Nr` ra zLoading policy file '%s'z#Failed to load policy file '%s': %sz%s/%sr r� rb )NN)NN)NNr� )NN)NN)r= r> rc rd r? r� r r� r0 r2 r^ rM r+ r re r rf rg r� r� r� rZ )r rM r^ r> r4 rN rh r r r � update_policy_object_from_path, sZ
z-FirewallConfig.update_policy_object_from_pathc C s� |j | jkrttj|j ��|jjtj�s@ttj d|jtjf ��d|j|j f }yt
j |d| � W n: t k
r� } z t
jd||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' doesn't start with '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r0 r r r� r> r� r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� y s z$FirewallConfig._remove_policy_objectc C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in policy)rL rZ r r ZBUILTIN_POLICYrM )r rN r r r �check_builtin_policy_object� s z*FirewallConfig.check_builtin_policy_objectc C s | j |� | j|� d S )N)r� r� )r rN r r r �remove_policy_object� s
z#FirewallConfig.remove_policy_objectc C s$ | j |� | j||�}| j|� |S )N)r� �_copy_policy_objectr� )r rN rM Znew_policy_objectr r r �rename_policy_object� s
z#FirewallConfig.rename_policy_objectc C s | j ||j� �S )N)r� r� )r rN rM r r r r� � s z"FirewallConfig._copy_policy_objectc C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r% r2 r* )r r r r � get_helpers� s zFirewallConfig.get_helpersc C s$ |j r|| j|j< n || j|j< d S )N)rL r* rM r% )r rN r r r �
add_helper� s zFirewallConfig.add_helperc C s8 || j kr| j | S || jkr(| j| S ttj|��d S )N)r% r* r r �INVALID_HELPER)r rM r r r �
get_helper� s
zFirewallConfig.get_helperc C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._helpers[%s] != objz'%s' not a built-in helper)rM r% r r rR r* �_remove_helper)r rN r r r �load_helper_defaults� s
z#FirewallConfig.load_helper_defaultsc C s |j � S )N)rU )r rN r r r �get_helper_config� s z FirewallConfig.get_helper_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL rW rX r �ETC_FIREWALLD_HELPERSr> rZ r� r )r rN r: r4 r r r �set_helper_config� s
z FirewallConfig.set_helper_configc C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_helper(): '%s'z%s.xmlFT)r% r* r r r\ r r] rX rM r^ r r� r> rL rZ r r� )r rM r: r4 r r r �
new_helper� s
zFirewallConfig.new_helperc C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) Nr` ra zLoading helper file '%s'z#Failed to load helper file '%s': %srb )NN)NN)NN)NN)NN)r= r> rc rd r? r r� r% r2 r^ rM r* r re r rf rg r� rZ )r rM r^ r> r4 rN rh r r r �update_helper_from_path� sP
z&FirewallConfig.update_helper_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r% r r r� r> r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� & s z FirewallConfig._remove_helperc C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in helper)rL rZ r r ZBUILTIN_HELPERrM )r rN r r r �check_builtin_helper7 s z#FirewallConfig.check_builtin_helperc C s | j |� | j|� d S )N)r� r� )r rN r r r �
remove_helper< s
z FirewallConfig.remove_helperc C s$ | j |� | j||�}| j|� |S )N)r� � _copy_helperr� )r rN rM r� r r r �
rename_helper@ s
z FirewallConfig.rename_helperc C s | j ||j� �S )N)r� rU )r rN rM r r r r� F s zFirewallConfig._copy_helperN)f�__name__�
__module__� __qualname__r r/ r r3 r6 r7 r; r< rB rC rD rE rF rG rH rK rO rQ rT rV r[ r_ ri rS rm rn rp ro rq rr rt rv rw ry rz r{ ru r| r} r r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r ' s�
7 E E E M M E)&�__all__rW r= Zos.pathrk Zfirewallr Zfirewall.core.loggerr Zfirewall.core.io.icmptyper r r Zfirewall.core.io.servicer r r
Zfirewall.core.io.zoner r r
Zfirewall.core.io.ipsetr r r Zfirewall.core.io.helperr r r Zfirewall.core.io.policyr r r r Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw.cpython-36.pyc 0000644 00000066115 15035135173 0012762 0 ustar 00 3
��g�� � @ s� d gZ ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl
m Z ddl
m
Z
ddl
mZ dd l
mZ dd
lmZ dd lmZ dd lmZ dd
lmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl m!Z! ddl"m#Z# ddl$m%Z%m&Z& ddl'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2m3Z3 ddl4m5Z5 dd l6m7Z7 dd l8m9Z9 dd l:m;Z; dd lm<Z< dd l=m>Z> G d!d � d e?�Z@dS )"�Firewall� N)�config)� functions)� ipXtables)�ebtables)�nftables)�ipset)�modules)�FirewallIcmpType)�FirewallService)� FirewallZone)�FirewallDirect)�FirewallConfig)�FirewallPolicies)�
FirewallIPSet)�FirewallTransaction)�FirewallHelper)�FirewallPolicy)�nm_get_bus_name�nm_get_interfaces_in_zone)�log)�firewalld_conf)�Direct)�service_reader)�icmptype_reader)� zone_reader�Zone)� ipset_reader)� IPSET_TYPES)�
helper_reader)�
policy_reader)�errors)�
FirewallErrorc @ s� e Zd Zdedd�Zdd� Zdd� Zdd � Zd
d � Zdfd d
�Zdd� Z dgdd�Z
dd� Z dd� Z dd� Z
dd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zdhd)d*�Zdid+d,�Zd-d.� Zdjd/d0�Zdkd1d2�Zdld3d4�Zd5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z!dAdB� Z"dCdD� Z#dEdF� Z$dGdH� Z%dIdJ� Z&dKdL� Z'dMdN� Z(dmdOdP�Z)dQdR� Z*dSdT� Z+dUdV� Z,dWdX� Z-dYdZ� Z.d[d\� Z/d]d^� Z0d_d`� Z1dadb� Z2dcdd� Z3d(S )nr Fc C s t tj�| _|| _| jr>d| _d| _d| _d| _t | _
d| _ nrt j
| �| _d| _g | _t j| �| _d| _g | _tj� | _d| _tj� | _d| _g | _
tj| �| _d| _ tj� | _t| �| _ t | �| _ t | �| _ t!| �| _"t#| �| _t$� | _%t&| �| _t'| �| _(t)| �| _*| j+� d S )NFT),r r �FIREWALLD_CONF�_firewalld_conf�_offline�ip4tables_enabled�ip6tables_enabled�ebtables_enabled�
ipset_enabledr �ipset_supported_types�nftables_enabledr � ip4tables�ip4tables_backend�ipv4_supported_icmp_types� ip6tables�ip6tables_backend�ipv6_supported_icmp_typesr �ebtables_backendr �
ipset_backendr �nftables_backendr �modules_backendr
�icmptyper �servicer �zoner
�directr r �policiesr r �helperr �policy�_Firewall__init_vars)�selfZoffline� r? �/usr/lib/python3.6/fw.py�__init__C sB
zFirewall.__init__c C sD d| j | j| j| j| j| j| j| j| j| j | j
| j | j | j
| jf S )Nz:%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__r& r' r( �_state�_panic�
_default_zone�_module_refcount�_marks�cleanup_on_exit�cleanup_modules_on_exit�ipv6_rpfilter_enabledr) �_individual_calls� _log_denied)r> r? r? r@ �__repr__k s zFirewall.__repr__c C sj d| _ d| _d| _i | _g | _tj| _tj| _ tj
| _ tj | _
tj| _tj| _tj| _tj| _tj| _d S )NZINITF� )rC rD rE rF rG r ZFALLBACK_CLEANUP_ON_EXITrH Z FALLBACK_CLEANUP_MODULES_ON_EXITrI ZFALLBACK_IPV6_RPFILTERrJ ZFALLBACK_INDIVIDUAL_CALLSrK ZFALLBACK_LOG_DENIEDrL ZFALLBACK_FIREWALL_BACKEND�_firewall_backendZ FALLBACK_FLUSH_ALL_ON_RELOAD�_flush_all_on_reloadZFALLBACK_RFC3964_IPV4�
_rfc3964_ipv4Z FALLBACK_ALLOW_ZONE_DRIFTING�_allow_zone_drifting)r> r? r? r@ Z __init_varst s zFirewall.__init_varsc C s� | j r$d| jj� kr$tjd� d| _ | jrHd| jj� krHtjd� d| _| jrld| jj� krltjd� d| _| j r�| j r�| j r�tj
d� t j d� d S )N�filterziptables is not usable.Fzip6tables is not usable.zebtables is not usable.zNo IPv4 and IPv6 firewall.� )
r& r- �get_available_tablesr �info1r' r0 r( r2 r+ �fatal�sys�exit)r> r? r? r@ �
_check_tables� s
zFirewall._check_tablesc C sz y| j j� W n* tk
r8 tjd� d| _g | _Y nX | j j� | _| jj � | jj
s|| jj rltjd� ntjd� d| _ | j
r�| jjd�| _n| j r�| jj� | _ng | _| jj � | jj
s�| jj r�tjd� ntjd� d| _| j
r�| jjd�| _n | j�r| jj� | _ng | _| jj � | jj
�sN| jj �r>tjd � ntjd
� d| _| j�rv| j �rv| jj �rvtjd � d S ) Nz4ipset not usable, disabling ipset usage in firewall.FzFiptables-restore is missing, using individual calls for IPv4 firewall.zCiptables-restore and iptables are missing, disabling IPv4 firewall.�ipv4zGip6tables-restore is missing, using individual calls for IPv6 firewall.zEip6tables-restore and ip6tables are missing, disabling IPv6 firewall.�ipv6zHebtables-restore is missing, using individual calls for bridge firewall.zEebtables-restore and ebtables are missing, disabling bridge firewall.zSebtables-restore is not supporting the --noflush option, will therefore not be used)r3 Zset_list�
ValueErrorr �warningr) r* Zset_supported_typesr- Z fill_exists�restore_command_existsZcommand_existsr& r+ r4 Zsupported_icmp_typesr. r0 r' r1 r2 r( rK �restore_noflush_option�debug1)r> r? r? r@ � _start_check� sL
zFirewall._start_checkc > C s� t j}tjdt j� y| jj� W n8 tk
rZ } ztj|� tjd� W Y d d }~X �n"X | jj d�rt| jj d�}| jj d�r�| jj d�}|d k r�|j
� dBkr�d| _ tjd| j � | jj d ��r| jj d �}|d k r�|j
� dCkr�d | _ |d k �r|j
� dDk�rd| _ tjd
| j � | jj d��rv| jj d�}|d k �rv|j
� dEk�rvtjd� y| j
j� W n tk
�rt Y nX | jj d��r�| jj d�}|d k �r�|j
� dFk�r�d| _|j
� dGk�r�d | _| j�r�tjd� n
tjd� | jj d��r"| jj d�}|d k �r"|j
� dHk�r"tjd� d | _| jj d��rt| jj d�}|d k�sT|j
� dk�r\d| _n|j
� | _tjd| j� | jj d��r�| jj d�| _tjd| j� | jj d��r�| jj d�}|j
� dIk�r�d| _nd | _tjd| j� | jj d ��r&| jj d �}|j
� dJk�rd| _nd | _tjd | j� | jj d ��r|| jj d �}|j
� dKk�rVd| _nd | _| j�sntjd � tjd | j� | j jtj| j�� | j| j� | j�s�| j � tjd!� y| j
j j� W nZ tk
�r } z<| j
j � �r�tj d"| j
j j |� ntjd"| j
j j |� W Y d d }~X nX | j j!tj| j
�� | j"t j#d#� | j"t j$d#� | j"t j%d$� | j"t j&d$� t'| j(j)� �d%k�r�tj d&� | j"t j*d'� | j"t j+d'� | j"t j,d(� | j"t j-d(� t'| j.j/� �d%k�r�tj d)� | j"t j0d*� | j"t j1d*� t'| j2j3� �d%k�r&tj4d+� t5j6d,� | j"t j7d-� | j"t j8d-� d}x.dLD ]&}|| j2j3� k�rLtj4d1|� d }�qLW |�r�t5j6d,� || j2j3� k�r�d2| j2j3� k�r�d2}nd3| j2j3� k�r�d3}nd.}tj d4||� |}n tjd5|� t9t j:�} t;j<j=t j:��rRtjd6t j: � y | j� W n4 tk
�rP } ztj d7t j:|� W Y d d }~X nX | j>j?| � | j j@tj| �� | jA|�| _B| j�r�d S | jC� tjD� d%k�r�tEjE� }
tF| �} |�s�| jG| d8� |�r�|�s�| jH�r�| jIjJ� �r�| jKd � | jL� |�r|�rtjd9� | jMjN� | jO| d8� | jKd � | jL� | jH�rX| jIjJ� �rXtjd:� | jIjP� tjd;� | jQ| d8� tjd<� | j2jR| d8� | j2jSd | jB| d8� tjd=� | jTjU| d8� | jKd � | jL� | j>jV� �rVtjd>� | j>jW| � y| jKd � | jL� W nX tk
�r> } z$t| jXd?| jY�r&| jYnd@ ��W Y d d } ~ X n tk
�rT � Y nX ~ tjD� d,k�r�tEjE� }
tjZdA|
|
� d S )MNz"Loading firewalld config file '%s'z0Using fallback firewalld configuration settings.� DefaultZoneZ
CleanupOnExit�no�falseFz CleanupOnExit is set to '%s'ZCleanupModulesOnExit�yes�trueTz#CleanupModulesOnExit is set to '%s'ZLockdownzLockdown is enabledZ
IPv6_rpfilterzIPv6 rpfilter is enabledzIPV6 rpfilter is disabledZIndividualCallszIndividualCalls is enabled� LogDeniedZoffzLogDenied is set to '%s'ZFirewallBackendz FirewallBackend is set to '%s'ZFlushAllOnReloadz FlushAllOnReload is set to '%s'Z RFC3964_IPv4zRFC3964_IPv4 is set to '%s'ZAllowZoneDriftingz�AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.z AllowZoneDrifting is set to '%s'zLoading lockdown whitelistz*Failed to load lockdown whitelist '%s': %sr r6 r zNo icmptypes found.r; r7 zNo services found.r8 zNo zones found.rT r< �block�drop�trustedzZone '%s' is not available.ZpublicZexternalz+Default zone '%s' is not valid. Using '%s'.zUsing default zone '%s'z Loading direct rules file '%s'z)Failed to load direct rules file '%s': %s)�use_transactionzUnloading firewall moduleszApplying ipsetszApplying default rule setzApplying used zoneszApplying used policiesz2Applying direct chains rules and passthrough rulesz
Direct: %srN z%Flushing and applying took %f seconds)rd re )rf rg )rd re )rf rg )rd re )rf rg )rf rg )rd re )rd re )rd re )ri rj rk )[r Z
FALLBACK_ZONEr ra r# r$ �read� Exceptionr^ �get�lowerrH rI r: Zenable_lockdownr" rJ rK rL rO rP rQ rR r% Zset_firewalld_conf�copy�deepcopy�_select_firewall_backendrb Zlockdown_whitelistZquery_lockdown�error�filenameZ set_policies�_loaderZFIREWALLD_IPSETSZETC_FIREWALLD_IPSETSZFIREWALLD_ICMPTYPESZETC_FIREWALLD_ICMPTYPES�lenr6 �
get_icmptypesZFIREWALLD_HELPERSZETC_FIREWALLD_HELPERSZFIREWALLD_SERVICESZETC_FIREWALLD_SERVICESr7 � get_servicesZFIREWALLD_ZONESZETC_FIREWALLD_ZONESr8 � get_zonesrW rX rY ZFIREWALLD_POLICIESZETC_FIREWALLD_POLICIESr ZFIREWALLD_DIRECT�os�path�existsr9 Zset_permanent_configZ
set_direct�
check_zonerE rZ ZgetDebugLogLevel�timer �flushr) r Z
has_ipsets�execute�clearr5 �unload_firewall_modules�apply_default_tablesZ apply_ipsets�apply_default_rulesZ apply_zones�change_default_zoner< Zapply_policiesZhas_configurationZ apply_direct�code�msgZdebug2)r> �reload�complete_reloadZ default_zoner� �valuert �zr8 �objZtm1� transaction�eZtm2r? r? r@ �_start� st
.zFirewall._startc C sH y | j � W n& tk
r2 d| _| jd� � Y nX d| _| jd� d S )N�FAILED�ACCEPT�RUNNING)r� rn rC �
set_policy)r> r? r? r@ �start� s
zFirewall.startc C sh t jj|�sd S |rZ|jtj�rV|dkrVt� }t jj|�|_|j |j� ||_d|_
nd}�x|t t j |��D �]h}|j
d�s�|jtj�rl|dkrlt jjd||f �rl| jd||f |dd� qld||f }tjd||� �y�|dk�r�t||�}|j| jj� k�r8| jj|j�}tjd ||j|j|j� | jj|j� n|jjtj��rNd|_
y| jj|� W n< tk
�r� } z tjd
|jt| �f � W Y d d } ~ X nX | jjtj |�� �n�|d k�rFt ||�}|j| j j � k�r| j j |j�}tjd ||j|j|j� | j j!|j� n|jjtj��r$d|_
| j j"|� | jj"tj |�� �n.|dk�rnt#|||d �}|�r�dt jj|�t jj|�d
d� f |_|j |j� tj |�}
|j| j$j%� k�r| j$j&|j�}| j$j'|j� |j(�r�tjd||j||� |j)|� ntjd ||j|j|j� n |jjtj��r,d|_
d|
_
| jj*|
� |�r^tjd||j||� |j)|� n | j$j*|� �n|dk�rDt+||�}|j| j,j-� k�r�| j,j.|j�}tjd ||j|j|j� | j,j/|j� n|jjtj��r�d|_
y| j,j0|� W n< tk
�r, } z tj1d
|jt| �f � W Y d d } ~ X nX | jj0tj |�� �n0|dk�r�t2||�}|j| j3j4� k�r�| j3j5|j�}tjd ||j|j|j� | j3j6|j� n|jjtj��r�d|_
| j3j7|� | jj7tj |�� n�|dk�rht8||�}|j| j9j:� k�r2| j9j;|j�}tjd ||j|j|j� | j9j<|j� n|jjtj��rHd|_
| j9j=|� | jj>tj |�� n tj?d|� W ql tk
�r� } ztj@d||| � W Y d d } ~ X ql tAk
�r� tj@d||� tjB� Y qlX qlW |�rd|j(�rd|j| j$j%� k�rX| j$j&|j�}tjd||j|j|j� y| j$j'|j� W n tAk
�rH Y nX | jjC|j� | j$j*|� d S )Nr8 Fz.xmlz%s/%sT)�combinezLoading %s file '%s'r6 z Overloads %s '%s' ('%s/%s')z %s: %s, ignoring for run-time.r7 )Z
no_check_namer � z Combining %s '%s' ('%s/%s')r r; r< zUnknown reader type %sz Failed to load %s file '%s': %sz Failed to load %s file '%s':z0 Overloading and deactivating %s '%s' ('%s/%s')���)Dr{ r| �isdir�
startswithr Z
ETC_FIREWALLDr �basename�nameZ
check_name�default�sorted�listdir�endswithrv r ra r r6 rx Z get_icmptyperu Zremove_icmptypeZ add_icmptyper" rV �strrq rr r r7 ry Z get_serviceZremove_serviceZ add_servicer r8 rz Zget_zoneZ remove_zone�combinedr� Zadd_zoner r �
get_ipsets� get_ipsetZ remove_ipset� add_ipsetr^ r r; Z get_helpersZ
get_helperZ
remove_helperZ
add_helperr r< � get_policiesZ
get_policyZ
remove_policyZ
add_policyZadd_policy_objectrW rt rn Z exceptionZ forget_zone) r> r| Z reader_typer� Z
combined_zoneru r� r� Zorig_objrt Z
config_objr� r? r? r@ rv s
$
$
zFirewall._loaderc C sp | j j� | jj� | jj� | jj� | jj� | jj� | jj� | jj� | j j� | j
j� | j � d S )N) r6 �cleanupr7 r8 r r; r r9 r: r< r$ r= )r> r? r? r@ r� � s
zFirewall.cleanupc C sN | j sB| jr(| j� | jj� | jd� | jrBtjd� | jj � | j
� d S )Nr� z!Unloading firewall kernel modules) r% rH r� r r� rI r ra r5 r� r� )r> r? r? r@ �stop� s
z
Firewall.stopc C s� d}d}x�t |�D ]�\}}|r0| jj|�\}}n$| j| dkrDd}n| jj|�\}}|dkrn|d7 }||7 }q|r�| jj|d� | j| d7 < q|| jkr| j| d8 < | j| dkr| j|= qW ||fS )Nr rN rT )� enumerater5 � load_modulerF Z
unload_module�
setdefault) r> Z_modules�enableZ
num_failedZ
error_msgs�i�moduleZstatusr� r? r? r@ �handle_modules� s(
zFirewall.handle_modulesc C s |dkrd| _ d S )Nr F)r+ )r> �backendr? r? r@ rs � s z!Firewall._select_firewall_backendc C s4 x | j � D ]}|j|kr
|S q
W ttjd| ��d S )Nz'%s' backend does not exist)� all_backendsr� r" r! Z
UNKNOWN_ERROR)r> r� r� r? r? r@ �get_backend_by_name� s
z Firewall.get_backend_by_namec C s\ | j r | jS |dkr | jr | jS |dkr4| jr4| jS |dkrH| jrH| jS tt j
d| ��d S )Nr[ r\ �ebz-'%s' is not a valid backend or is unavailable) r+ r4 r& r- r' r0 r( r2 r" r! � INVALID_IPV)r> �ipvr? r? r@ �get_backend_by_ipv� s zFirewall.get_backend_by_ipvc C sP |dkr| j r| jS |dkr(| jr(| jS |dkr<| jr<| jS ttjd| ��d S )Nr[ r\ r� z-'%s' is not a valid backend or is unavailable) r& r- r' r0 r( r2 r" r! r� )r> r� r? r? r@ �get_direct_backend_by_ipv� s z"Firewall.get_direct_backend_by_ipvc C s< |dkr| j S |dkr | jS |dkr*| jS |dkr8| jS dS )Nr, r/ r r F)r& r' r( r+ )r> r� r? r? r@ �is_backend_enabled� s zFirewall.is_backend_enabledc C s8 | j r
dS |dkr| jS |dkr&| jS |dkr4| jS dS )NTr[ r\ r� F)r+ r& r' r( )r> r� r? r? r@ �is_ipv_enabled s zFirewall.is_ipv_enabledc C sR g }| j r|j| j� n6| jr*|j| j� | jr<|j| j� | jrN|j| j� |S )N) r+ �appendr4 r& r- r' r0 r( r2 )r> �backendsr? r? r@ �enabled_backends s zFirewall.enabled_backendsc C sP g }| j r|j| j� | jr(|j| j� | jr:|j| j� | jrL|j| j� |S )N) r& r� r- r' r0 r( r2 r+ r4 )r> r� r? r? r@ r� s zFirewall.all_backendsNc C sN |d krt | �}n|}x | j� D ]}|j||j� � q W |d krJ|jd� d S )NT)r r� � add_rulesZbuild_default_tablesr� )r> rl r� r� r? r? r@ r� $ s
z Firewall.apply_default_tablesc C s� |d krt | �}n|}x(| j� D ] }|j| j�}|j||� q W | jd�r~| jd�}d|j� kr~| jr~|j | j�}|j||� | jd�r�| j
r�|j � }|j||� |d kr�|j d� d S )Nr\ �rawT)
r r� Zbuild_default_rulesrL r� r� r� rU rJ Zbuild_rpfilter_rulesrQ Zbuild_rfc3964_ipv4_rulesr� )r> rl r� r� �rulesZ ipv6_backendr? r? r@ r� 0 s"
z Firewall.apply_default_rulesc C s | j r| jj� rdS dS )NTF)r+ r9 Zhas_runtime_configuration)r> r? r? r@ � may_skip_flush_direct_backendsH s z'Firewall.may_skip_flush_direct_backendsc C s` |d krt | �}n|}x2| j� D ]&}|| j� kr2q |j� }|j||� q W |d kr\|jd� d S )NT)r r� r� �build_flush_rulesr� r� )r> rl r� r� r� r? r? r@ �flush_direct_backendsN s
z Firewall.flush_direct_backendsc C sp |d krt | �}n|}tjd� | j� s4| j|d� x$| j� D ]}|j� }|j||� q>W |d krl|jd� d S )NzFlushing rule set)rl T) r r ra r� r� r� r� r� r� )r> rl r� r� r� r? r? r@ r� ] s
zFirewall.flushc C s` |d krt | �}n|}tjd|� x&| j� D ]}|j|�}|j||� q,W |d kr\|jd� d S )NzSetting policy to '%s'T)r r ra r� Zbuild_set_policy_rulesr� r� )r> r< rl r� r� r� r? r? r@ r� o s
zFirewall.set_policyc C sB |sdS | j |�}|s&ttjd| ��| j|�s4dS |j|| j�S )NrN z'%s' is not a valid backend)r� r" r! r� r� �set_rulerL )r> � backend_name�ruler� r? r? r@ r� � s
z
Firewall.rulec C s" t td |��}| j|�}|s,ttjd| ��| j|�s:d S | js\|j s\|dkoX| j j
�rx�t |�D ]�\}}y|j || j
� W qf tk
�r } zjtjtj� � tj|� xFt|d |� �D ]2}y|j |j|�| j
� W q� tk
r� Y q�X q�W |�W Y d d }~X qfX qfW n|j|| j
� d S )Nz'%s' is not a valid backendr )�listrS r� r" r! r� r� rK r_ r2 r` r� r� rL rn r ra � traceback�
format_excrt �reversedZ reverse_ruleZ set_rules)r> r� r� Z_rulesr� r� r� r� r? r? r@ r� � s.
zFirewall.rulesc C s | j rttj��d S )N)rD r" r! Z
PANIC_MODE)r> r? r? r@ � check_panic� s zFirewall.check_panicc C s" |}|| j j� kr ttj|��|S )N)r< r� r" r! ZINVALID_POLICY)r> r< Z_policyr? r? r@ � check_policy� s zFirewall.check_policyc C s8 |}| s|dkr| j � }|| jj� kr4ttj|��|S )NrN )�get_default_zoner8 rz r" r! Z INVALID_ZONE)r> r8 �_zoner? r? r@ r~ � s zFirewall.check_zonec C s t j|�sttj|��d S )N)r ZcheckInterfacer" r! ZINVALID_INTERFACE)r> � interfacer? r? r@ �check_interface� s
zFirewall.check_interfacec C s | j j|� d S )N)r7 �
check_service)r> r7 r? r? r@ r� � s zFirewall.check_servicec C s t j|�sttj|��d S )N)r �
check_portr" r! Z INVALID_PORT)r> Zportr? r? r@ r� � s
zFirewall.check_portc C s* |st tj��|dkr&t tjd| ��d S )N�tcp�udp�sctp�dccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r� r� r� r� )r" r! ZMISSING_PROTOCOLZINVALID_PROTOCOL)r> Zprotocolr? r? r@ � check_tcpudp� s
zFirewall.check_tcpudpc C s t j|�sttj|��d S )N)r ZcheckIPr" r! � INVALID_ADDR)r> Zipr? r? r@ �check_ip� s
zFirewall.check_ipc C sP |dkr t j|�sLttj|��n,|dkr@t j|�sLttj|��n ttjd��d S )Nr[ r\ z'%s' not in {'ipv4'|'ipv6'})r Z checkIPnMaskr" r! r� Z
checkIP6nMaskr� )r> r� �sourcer? r? r@ �
check_address� s
zFirewall.check_addressc C s | j j|� d S )N)r6 �check_icmptype)r> Zicmpr? r? r@ r� � s zFirewall.check_icmptypec C s> t |t�s td|t|�f ��t|�dk r:ttjd| ��d S )Nz%s is %s, expected intr z#timeout '%d' is not positive number)�
isinstance�int� TypeError�typer" r! �
INVALID_VALUE)r> Ztimeoutr? r? r@ �
check_timeout� s
zFirewall.check_timeoutc C s` | j }| j}|sNi }x&| jj� D ]}| jj|�d ||< q W | jj� }| j� }g }x$| jj � D ]} |j
| jj | �� q^W |s�| j d� | j
� | j� d }
y| jd|d� W n& tk
r� } z
| }
W Y d d } ~ X nX |�r(xL|D ]D} | jj| j�s�x0| jj� D ]"}
|
jdk�r� q�|
j| j� � q�W q�W |�s�| j� }||k�r�||k�rRi ||< xFt|| j� �D ]2\}}|d �rd|| | || |< || |= �qdW xb| jj� D ]T}||k�r�x.|| D ]"}| jj|||| | d � �q�W ||= n tjd|� �q�W t|�d k�r6x(t|j� �D ]}tjd
|� ||= �qW ~x�|D ]�} | jj| j��r�xx| j D ]R}y| jj | j|� W n6 t k
�r� } z|j t j!k�r�|�W Y d d }~X nX �qZW n| jj"| � | jj#| j� �q>W | jj$|� t%� }|�r,x@| jj� d g D ],}x$t&|�D ]}| jj|||d � �q
W �q�W || _ | j �sD| j d
� |
�rVd| _'|
�nd| _'d S )N�
interfacesZDROPT)r� r� r � __default__�senderzNew zone '%s'.r z(Lost zone '%s', zone interfaces dropped.rN )r� r� r� r� )(rD rP r8 rz � get_settingsr9 Zget_runtime_configr� r r� r� r� r� r� r� r� rn Z query_ipsetr� r� Z set_destroyr� �items�change_zone_of_interfacer rV rw �keysZentriesZ add_entryr" r� r! �ALREADY_ENABLEDr� Z apply_ipsetZ
set_configr r rC )r> r� rD Z flush_allZ_zone_interfacesr8 Z_direct_config�_old_dzZ _ipset_objs�_nameZstart_exceptionr� r� r� Z_new_dz�iface�settingsZ interface_id�entryr� Z nm_bus_namer� r? r? r@ r� � s�
zFirewall.reloadc C s | j S )N)rC )r> r? r? r@ � get_statea s zFirewall.get_statec C sZ | j rttjd��y| jd� W n. tk
rN } zttj|��W Y d d }~X nX d| _ d S )Nzpanic mode already enabledZPANICT)rD r" r! r� r� rn �COMMAND_FAILED)r> r� r? r? r@ �enable_panic_modef s zFirewall.enable_panic_modec C sZ | j sttjd��y| jd� W n. tk
rN } zttj|��W Y d d }~X nX d| _ d S )Nzpanic mode is not enabledr� F)rD r" r! Z NOT_ENABLEDr� rn r� )r> r� r? r? r@ �disable_panic_modeq s zFirewall.disable_panic_modec C s | j S )N)rD )r> r? r? r@ �query_panic_mode| s zFirewall.query_panic_modec C s | j S )N)rL )r> r? r? r@ �get_log_denied� s zFirewall.get_log_deniedc C sb |t jkr&ttjd|djt j�f ��|| j� krR|| _| jj d|� | jj
� n ttj |��d S )Nz'%s', choose from '%s'z','rh ) r ZLOG_DENIED_VALUESr" r! r� �joinr� rL r$ �set�writeZ ALREADY_SET)r> r� r? r? r@ �set_log_denied� s
zFirewall.set_log_deniedc C s | j S )N)rE )r> r? r? r@ r� � s zFirewall.get_default_zonec C s� | j |�}|| jkr�| j}|| _| jjd|� | jj� | jj||� | jj|�}x@t|d j � �D ] \}}|d rd| jj
d|� qdW n t t j
|��d S )Nrc r� r� rN )r~ rE r$ r� r� r8 r� r� r� r� r� r" r! ZZONE_ALREADY_SET)r> r8 r� r� Z_old_dz_settingsr� r� r? r? r@ �set_default_zone� s
zFirewall.set_default_zonec C sH |j � }x:|j� D ].\}}|s(t|t�r2|||< q||kr||= qW |S )N)rq r� r� �bool)r> Z permanentZruntimer� �keyr� r? r? r@ �'combine_runtime_with_permanent_settings� s
z0Firewall.combine_runtime_with_permanent_settingsc C s i }i }x�t |j� �t |j� �B D ]�}||kr"t|| t�r�t ||krN|| ng �}tt || �| �||< t|t || �A |@ �||< q"t|| t�s�t|| t�r�|| r�|| r�d||< q�|| r�|| r�d||< q"ttjdj t
|| �|���q"W ||fS )NTFz Unhandled setting type {} key {}) r� r� r� r� r� r� r" r! ZINVALID_SETTING�formatr� )r> Z old_settingsZ new_settingsZ add_settingsZremove_settingsr� �oldr? r? r@ � get_added_and_removed_settings� s
z'Firewall.get_added_and_removed_settings)F)FF)F)N)N)N)N)N)F)4�__name__�
__module__� __qualname__rA rM r= rZ rb r� r� rv r� r� r� rs r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r? r? r? r@ r B sh
( ;
s )A�__all__Zos.pathr{ rX rq r r� Zfirewallr r Z
firewall.corer r r r r Zfirewall.core.fw_icmptyper
Zfirewall.core.fw_servicer Zfirewall.core.fw_zoner Zfirewall.core.fw_directr
Zfirewall.core.fw_configr Zfirewall.core.fw_policiesr Zfirewall.core.fw_ipsetr Z firewall.core.fw_transactionr Zfirewall.core.fw_helperr Zfirewall.core.fw_policyr Zfirewall.core.fw_nmr r Zfirewall.core.loggerr Z firewall.core.io.firewalld_confr Zfirewall.core.io.directr Zfirewall.core.io.servicer Zfirewall.core.io.icmptyper Zfirewall.core.io.zoner r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr Zfirewall.core.io.helperr Zfirewall.core.io.policyr r! Zfirewall.errorsr" �objectr r? r? r? r@ �<module> sH core/__pycache__/fw_icmptype.cpython-36.pyc 0000644 00000004205 15035135173 0014664 0 ustar 00 3
��g� � @ s> d gZ ddlmZ ddlmZ ddlmZ G dd � d e�ZdS )�FirewallIcmpType� )�log)�errors)�
FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dS )r c C s || _ i | _d S )N)�_fw�
_icmptypes)�self�fw� r
�!/usr/lib/python3.6/fw_icmptype.py�__init__ s zFirewallIcmpType.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r r
r
r �__repr__! s zFirewallIcmpType.__repr__c C s | j j� d S )N)r �clear)r r
r
r �cleanup$ s zFirewallIcmpType.cleanupc C s t | jj� �S )N)�sortedr �keys)r r
r
r �
get_icmptypes) s z FirewallIcmpType.get_icmptypesc C s || j krttj|��d S )N)r r r ZINVALID_ICMPTYPE)r �icmptyper
r
r �check_icmptype, s
z FirewallIcmpType.check_icmptypec C s | j |� | j| S )N)r r )r r r
r
r � get_icmptype0 s
z FirewallIcmpType.get_icmptypec C s� |j }t|�dkrddg}x�|D ]z}|dkrL| jj rB| jj rBq | jj}n,|dkrt| jj rj| jj rjq | jj}ng }|jj � |kr t
j d|j|f � q W || j |j< d S )Nr Zipv4Zipv6z5ICMP type '%s' is not supported by the kernel for %s.)
Z destination�lenr Zip4tables_enabledZnftables_enabledZipv4_supported_icmp_typesZip6tables_enabledZipv6_supported_icmp_types�name�lowerr Zinfo1r )r �objZ orig_ipvsZipvZsupported_icmpsr
r
r � add_icmptype4 s
z FirewallIcmpType.add_icmptypec C s | j |� | j|= d S )N)r r )r r r
r
r �remove_icmptypeG s
z FirewallIcmpType.remove_icmptypeN) �__name__�
__module__� __qualname__r r r r r r r r r
r
r
r r s N) �__all__Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r
r
r
r �<module> s core/__pycache__/fw_helper.cpython-36.opt-1.pyc 0000644 00000003705 15035135173 0015254 0 ustar 00 3
��g) � @ s6 d Z dgZddlmZ ddlmZ G dd� de�ZdS )zhelper backend�FirewallHelper� )�errors)�
FirewallErrorc @ s\ e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dS )r c C s || _ i | _d S )N)Z_fw�_helpers)�self�fw� r � /usr/lib/python3.6/fw_helper.py�__init__ s zFirewallHelper.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r r r r �__repr__" s zFirewallHelper.__repr__c C s | j j� d S )N)r �clear)r r r r �cleanup' s zFirewallHelper.cleanupc C s || j � krttj|��d S )N)� get_helpersr r �INVALID_HELPER)r �namer r r � check_helper* s zFirewallHelper.check_helperc C s || j � kS )N)r )r r r r r � query_helper. s zFirewallHelper.query_helperc C s t | jj� �S )N)�sortedr �keys)r r r r r 1 s zFirewallHelper.get_helpersc C s t | j�dkS )Nr )�lenr )r r r r � has_helpers4 s zFirewallHelper.has_helpersc C s | j |� | j| S )N)r r )r r r r r �
get_helper7 s
zFirewallHelper.get_helperc C s || j |j< d S )N)r r )r �objr r r �
add_helper; s zFirewallHelper.add_helperc C s" || j krttj|��| j |= d S )N)r r r r )r r r r r �
remove_helper> s
z FirewallHelper.remove_helperN)
�__name__�
__module__� __qualname__r
r r r r r r r r r r r r r r s N)�__doc__�__all__Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_ipset.cpython-36.pyc 0000644 00000016503 15035135173 0014162 0 ustar 00 3
��g�% � @ sf d Z dgZddlmZ ddlmZmZmZm Z ddl
m Z ddl m
Z
ddlmZ G dd� de�Zd S )
z
ipset backend�
FirewallIPSet� )�log)� remove_default_create_options�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�IPSet)�errors)�
FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z d4dd�Z
dd� Z dd� Z d5dd�Z
dd� Zdd� Zd d � Zd6d d �Zd!d"� Zd#d$� Zd%d&� Zd7d'd(�Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3S )8r c C s || _ i | _d S )N)�_fw�_ipsets)�self�fw� r � /usr/lib/python3.6/fw_ipset.py�__init__# s zFirewallIPSet.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r
r r r �__repr__' s zFirewallIPSet.__repr__c C s | j j� d S )N)r �clear)r
r r r �cleanup, s zFirewallIPSet.cleanupc C s || j � krttj|��d S )N)�
get_ipsetsr
r Z
INVALID_IPSET)r
�namer r r � check_ipset/ s zFirewallIPSet.check_ipsetc C s || j � kS )N)r )r
r r r r � query_ipset3 s zFirewallIPSet.query_ipsetc C s t | jj� �S )N)�sortedr �keys)r
r r r r 6 s zFirewallIPSet.get_ipsetsc C s t | j�dkS )Nr )�lenr )r
r r r �
has_ipsets9 s zFirewallIPSet.has_ipsetsFc C s& | j |� | j| }|r"| j|� |S )N)r r �check_applied_obj)r
r �applied�objr r r � get_ipset< s
zFirewallIPSet.get_ipsetc C s4 g }| j jr|j| j j� | j jr0|j| j j� |S )N)r Znftables_enabled�appendZnftables_backendZ
ipset_enabledZ
ipset_backend)r
�backendsr r r r# C s zFirewallIPSet.backendsc C s0 |j | jjkr ttjd|j ��|| j|j< d S )Nz '%s' is not supported by ipset.)�typer Zipset_supported_typesr
r Z INVALID_TYPEr r )r
r r r r � add_ipsetK s zFirewallIPSet.add_ipsetc C s� | j | }|jrh| rhy x| j� D ]}|j|� q"W W qt tk
rd } zttj|��W Y d d }~X qtX n tj d|� | j |= d S )Nz,Keeping ipset '%s' because of timeout option)
r r r# � set_destroy� Exceptionr
r �COMMAND_FAILEDr �debug1)r
r Zkeepr �backend�msgr r r � remove_ipsetQ s
zFirewallIPSet.remove_ipsetc < C s$ | j | }�x| j� D �]}|jdkr�|j� }||kr�d|jksv|jd dksv|j|| d ksvt|j�|| d kr�y|j|� W n. tk
r� } zt t
j |��W Y d d }~X nX | j j
�r�y|j|j|j|j� W n0 tk
�r } zt t
j |��W Y d d }~X n&X d|_d|jk�r,|jd dk�r,qy|j|j� W n0 tk
�rl } zt t
j |��W Y d d }~X nX x�|jD ]J}y|j|j|� W n0 tk
�r� } zt t
j |��W Y d d }~X nX �qvW qy |j|j|j|j|jd � W n0 tk
�r } zt t
j |��W Y d d }~X qX d|_qW d S )N�ipset�timeout�0r � T)r r# r Zset_get_active_terse�optionsr$ �rm_def_cr_optsr& r' r
r r( r �_individual_callsZ
set_creater � set_flush�entries�set_add� set_restore)r
r r r* Zactiver+ �entryr r r � apply_ipset] sL
&
zFirewallIPSet.apply_ipsetc C s> x8| j � D ],}| j| }d|_tjd| � | j|� q
W d S )NFzApplying ipset '%s')r r r r r) r9 )r
r r r r r � apply_ipsets� s
zFirewallIPSet.apply_ipsetsc C s� xz| j � D ]n}|jdkrq
x\| j� D ]P}y| j|� |j|� W q$ tk
rr } z|jtjkrb|�W Y d d }~X q$X q$W q
W d S )NZnftables) r# r r �
check_appliedr& r
�coder � NOT_APPLIED)r
r* r- r+ r r r �flush� s
zFirewallIPSet.flushTc C s | j ||d�jS )N)r )r! r$ )r
r r r r r �get_type� s zFirewallIPSet.get_typec C s t | j|dd�jjd��S )NT)r �,)r r! r$ �split)r
r r r r �
get_dimension� s zFirewallIPSet.get_dimensionc C s | j |�}| j|� d S )N)r! r )r
r r r r r r; � s
zFirewallIPSet.check_appliedc C s |j sttj|j��d S )N)r r
r r= r )r
r r r r r � s z FirewallIPSet.check_applied_objc C s. | j ||d�}d|jkr*|jd dkr*dS dS )N)r ZfamilyZinet6Zipv6Zipv4)r! r1 )r
r r r r r r �
get_family� s
zFirewallIPSet.get_familyc C s� | j |dd�}t|�}tj||j|j� ||jkrFttj d||f ��t
||j� y$x | j � D ]}|j |j
|� q^W W n. tk
r� } zttj|��W Y d d }~X n&X d|jks�|jd dkr�|jj|� d S )NT)r z'%s' already is in '%s'r. r/ )r! r r � check_entryr1 r$ r5 r
r ZALREADY_ENABLEDr r# r6 r r' r( r" )r
r r8 r r* r+ r r r � add_entry� s
zFirewallIPSet.add_entryc C s� | j |dd�}t|�}||jkr4ttjd||f ��y$x | j� D ]}|j|j|� q@W W n. t k
r� } zttj
|��W Y d d }~X n&X d|j ks�|j d dkr�|jj |� d S )NT)r z'%s' not in '%s'r. r/ )
r! r r5 r
r Z NOT_ENABLEDr# Z
set_deleter r' r( r1 �remove)r
r r8 r r* r+ r r r � remove_entry� s
zFirewallIPSet.remove_entryc C sD | j |dd�}t|�}d|jkr:|jd dkr:ttj|��||jkS )NT)r r. r/ )r! r r1 r
r ZIPSET_WITH_TIMEOUTr5 )r
r r8 r r r r � query_entry� s
zFirewallIPSet.query_entryc C s | j |dd�}|jS )NT)r )r! r5 )r
r r r r r � get_entries� s zFirewallIPSet.get_entriesc C s@ | j |dd�}t|� x |D ]}tj||j|j� q W d|jksN|jd dkrT||_y"x | j� D ]}|j|j � q`W W n. t
k
r� } zt t j
|��W Y d d }~X nX d|_yXxR| j� D ]F}| jjr�x8|jD ]}|j|j |� q�W q�|j|j |j|j|jd � q�W W n0 t
k
�r4 } zt t j
|��W Y d d }~X nX d|_d S )NT)r r. r/ )r! r r rD r1 r$ r5 r# r4 r r' r
r r( r r r3 r6 r7 )r
r r5 r r8 r* r+ r r r � set_entries� s.
zFirewallIPSet.set_entriesN)F)F)T)T)�__name__�
__module__� __qualname__r r r r r r r r! r# r% r, r9 r: r> r? rB r; r rC rE rG rH rI rJ r r r r r " s0
1
N)�__doc__�__all__Zfirewall.core.loggerr Zfirewall.core.ipsetr r2 r r r Zfirewall.core.io.ipsetr Zfirewallr Zfirewall.errorsr
�objectr r r r r �<module> s core/__pycache__/logger.cpython-36.pyc 0000644 00000055135 15035135173 0013625 0 ustar 00 3
��g>y � @ s� d dddgZ ddlZddlZddlZddlZddlZddlZddlZddlZddl Z
ddl
Z
G dd � d e �Z G dd� de �Z
G d d
� d
e
�ZG d d � d e �ZG d
d� de �ZG dd� de �Ze� ZdS )� LogTarget�FileLog�Logger�log� Nc @ s2 e Zd ZdZdd� Zd dd�Zdd� Zd d
� Zd S )
r z% Abstract class for logging targets. c C s
d | _ d S )N)�fd)�self� r � /usr/lib/python3.6/logger.py�__init__( s zLogTarget.__init__r c C s t d��d S )Nz%LogTarget.write is an abstract method)�NotImplementedError)r �data�level�logger�is_debugr r r �write+ s zLogTarget.writec C s t d��d S )Nz%LogTarget.flush is an abstract method)r )r r r r �flush. s zLogTarget.flushc C s t d��d S )Nz%LogTarget.close is an abstract method)r )r r r r �close1 s zLogTarget.closeN)r )�__name__�
__module__� __qualname__�__doc__r
r r r r r r r r & s
c @ s. e Zd Zdd� Zd dd�Zdd� Zdd � Zd
S ) �
_StdoutLogc C s t j| � tj| _d S )N)r r
�sys�stdoutr )r r r r r
8 s
z_StdoutLog.__init__r c C s | j j|� | j� d S )N)r r r )r r r
r r r r r r < s z_StdoutLog.writec C s | j � d S )N)r )r r r r r A s z_StdoutLog.closec C s | j j� d S )N)r r )r r r r r D s z_StdoutLog.flushN)r )r r r r
r r r r r r r r 7 s
r c @ s e Zd Zdd� ZdS )�
_StderrLogc C s t j| � tj| _d S )N)r r
r �stderrr )r r r r r
K s
z_StderrLog.__init__N)r r r r
r r r r r J s r c @ s. e Zd Zdd� Zd dd�Zdd� Zdd � Zd
S ) �
_SyslogLogc C s. t j| � tjtjjtjd �tj tj
� d S )Nr ) r r
�syslogZopenlog�os�path�basenamer �argvZLOG_PIDZ
LOG_DAEMON)r r r r r
S s
z_SyslogLog.__init__r c C s� d }|rt j}nF||jkr"t j}n4||jkr4t j}n"||jkrFt j}n||jkrVt j }|j
d�rt|d t |�d � }t |�dkr�|d kr�t j |� n t j ||� d S )N�
� r ) r Z LOG_DEBUG�INFO1ZLOG_INFO�WARNINGZ LOG_WARNING�ERRORZLOG_ERR�FATALZLOG_CRIT�endswith�len)r r r
r r Zpriorityr r r r a s"
z_SyslogLog.writec C s t j� d S )N)r Zcloselog)r r r r r w s z_SyslogLog.closec C s d S )Nr )r r r r r z s z_SyslogLog.flushN)r )r r r r
r r r r r r r r R s
r c @ s< e Zd ZdZddd�Zdd� Zddd �Zd
d � Zd d
� ZdS )r z< FileLog class.
File will be opened on the first write. �wc C s t j| � || _|| _d S )N)r r
�filename�mode)r r+ r, r r r r
� s
zFileLog.__init__c C sv | j r
d S tjtjB }| jjd�r,|tjO }tj| j|d�| _ tj | j d� tj
| j | j�| _ t j | j t j t j
� d S )N�ai� )r r �O_CREAT�O_WRONLYr, �
startswith�O_APPEND�openr+ �fchmod�fdopen�fcntlZF_SETFDZ
FD_CLOEXEC)r �flagsr r r r2 � s
z FileLog.openr c C s( | j s| j� | j j|� | j j� d S )N)r r2 r r )r r r
r r r r r r � s z
FileLog.writec C s | j s
d S | j j� d | _ d S )N)r r )r r r r r � s
z
FileLog.closec C s | j s
d S | j j� d S )N)r r )r r r r r � s z
FileLog.flushN)r* )r ) r r r r r
r2 r r r r r r r r s
c @ s� e Zd ZdZd[Zd\Zd]Zd^Zd_ZdZ e
� Z e � Z
e� Zd`d d
�Zd d � Zdadd�Zdbdd�Zdcdd�Zdddd�Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zed"fd#d$�Z ed"fd%d&�Z ed"fd'd(�Z ed"fd)d*�Z ed"fd+d,�Z ed"fd-d.�Z!d/d0� Z"d1d2� Z#d3d4� Z$d5d6� Z%d7d8� Z&d9d:� Z'd;d<� Z(d=d>� Z)d?d@� Z*dAdB� Z+dCdD� Z,dedEdF�Z-dGdH� Z.dfdIdJ�Z/ed"dfdKdL�Z0ed"dfdMdN�Z1ed"dfdOdP�Z2dgdQdR�Z3dSdT� Z4dUdV� Z5dWdX� Z6dhdYdZ�Z7d"S )ir aL
Format string:
%(class)s Calling class the function belongs to, else empty
%(date)s Date using Logger.date_format, see time module
%(domain)s Full Domain: %(module)s.%(class)s.%(function)s
%(file)s Filename of the module
%(function)s Function name, empty in __main__
%(label)s Label according to log function call from Logger.label
%(level)d Internal logging level
%(line)d Line number in module
%(module)s Module name
%(message)s Log message
Standard levels:
FATAL Fatal error messages
ERROR Error messages
WARNING Warning messages
INFOx, x in [1..5] Information
DEBUGy, y in [1..10] Debug messages
NO_INFO No info output
NO_DEBUG No debug output
INFO_MAX Maximum info level
DEBUG_MAX Maximum debug level
x and y depend on info_max and debug_max from Logger class
initialization. See __init__ function.
Default logging targets:
stdout Logs to stdout
stderr Logs to stderr
syslog Logs to syslog
Additional arguments for logging functions (fatal, error, warning, info
and debug):
nl Disable newline at the end with nl=0, default is nl=1.
fmt Format string for this logging entry, overloads global format
string. Example: fmt="%(file)s:%(line)d %(message)s"
nofmt Only output message with nofmt=1. The nofmt argument wins over
the fmt argument.
Example:
from logger import log
log.setInfoLogLevel(log.INFO1)
log.setDebugLogLevel(log.DEBUG1)
for i in range(1, log.INFO_MAX+1):
log.setInfoLogLabel(i, "INFO%d: " % i)
log.setFormat("%(date)s %(module)s:%(line)d [%(domain)s] %(label)s: "
"%(level)d %(message)s")
log.setDateFormat("%Y-%m-%d %H:%M:%S")
fl = FileLog("/tmp/log", "a")
log.addInfoLogging("*", fl)
log.addDebugLogging("*", fl)
log.addInfoLogging("*", log.syslog, fmt="%(label)s%(message)s")
log.debug3("debug3")
log.debug2("debug2")
log.debug1("debug1")
log.info2("info2")
log.info1("info1")
log.warning("warning\n", nl=0)
log.error("error\n", nl=0)
log.fatal("fatal")
log.info(log.INFO1, "nofmt info", nofmt=1)
� � � � r# r �
c C s� i | _ i | _d| _d| _i | _i | _i | _i | _i | _i | _ |dk rPt
d| ��|dk rdt
d| ��| j | _ || _
d| _|| _| j| jd� | j| jd� | j| jd� | j| j d� xNtd| j
d �D ]:}t| d | |� | j|d� t| d
| d d � | |�� q�W xTtd| jd �D ]@}t| d
| |� | j|d| � t| d| dd � | |�� �qW | j| j� | j| j� | jd� | jd� | j d| j | j| j| j g� | j d| j dd� t| j| j
d �D �� | j d| j dd� td| jd �D �� dS )z Logger class initialization � r# z Logger: info_max %d is too lowr z Logger: debug_max %d is too lowz
FATAL ERROR: zERROR: z WARNING: zINFO%dzinfo%dc s � �fdd�S )Nc s � j �| f|�|�S )N)�info)�message�args�kwargs)r �xr r �<lambda> s z3Logger.__init__.<locals>.<lambda>.<locals>.<lambda>r )r rA r )r rA r rB s z!Logger.__init__.<locals>.<lambda>zDEBUG%dz DEBUG%d: zdebug%dc s � �fdd�S )Nc s � j �| f|�|�S )N)�debug)r> r? r@ )r rA r r rB ) s z3Logger.__init__.<locals>.<lambda>.<locals>.<lambda>r )r rA r )r rA r rB ( s z%(label)s%(message)sz%d %b %Y %H:%M:%S�*c S s g | ]}|�qS r r )�.0�ir r r �
<listcomp>4 s z#Logger.__init__.<locals>.<listcomp>c S s g | ]}|�qS r r )rE rF r r r rG 6 s N) �_level� _debug_level�_format� _date_format�_label� _debug_label�_logging�_debug_logging�_domains�_debug_domains�
ValueErrorr% �NO_INFO�INFO_MAX�NO_DEBUG� DEBUG_MAX�setInfoLogLabelr' � TRACEBACKr& �range�setattr�setDebugLogLabel�setInfoLogLevelr$ �setDebugLogLevel� setFormat�
setDateFormat�setInfoLoggingr r �setDebugLogging)r Zinfo_maxZ debug_maxrH r r r r
� sX
zLogger.__init__c C sN xHt | j| jd �D ]2}|| jkr$qx | j| D ]\}}}|j� q0W qW dS )z Close all logging targets r# N)rY r' rV rN r )r r
�dummy�targetr r r r 8 s
z Logger.closerD c C s$ | j |� || jkr | j| S | jS )z Get info log level. )� _checkDomainrH �NOTHING)r �domainr r r �getInfoLogLevel@ s
zLogger.getInfoLogLevelc C s8 | j |� || jk r| j}|| jkr*| j}|| j|< dS )z% Set log level [NOTHING .. INFO_MAX] N)rd re rT rH )r r
rf r r r r\ G s
zLogger.setInfoLogLevelc C s* | j |� || jkr$| j| | j S | jS )z Get debug log level. )rd rI rU )r rf r r r �getDebugLogLevelP s
zLogger.getDebugLogLevelc C s: | j |� |dk rd}|| jkr&| j}|| j | j|< dS )z- Set debug log level [NO_DEBUG .. DEBUG_MAX] r N)rd rV rU rI )r r
rf r r r r] W s
zLogger.setDebugLogLevelc C s | j S )N)rJ )r r r r � getFormat` s zLogger.getFormatc C s
|| _ d S )N)rJ )r rJ r r r r^ c s zLogger.setFormatc C s | j S )N)rK )r r r r �
getDateFormatf s zLogger.getDateFormatc C s
|| _ d S )N)rK )r rJ r r r r_ i s zLogger.setDateFormatc C s: | j |�}x*|D ]"}| j|| j| jd� || j|< qW dS )zU Set log label for level. Level can be a single level or an array
of levels. )� min_level� max_levelN)�
_getLevels�_checkLogLevelr' rT rL )r r
�label�levelsr r r rW l s
zLogger.setInfoLogLabelc C s> | j |dd�}x*|D ]"}| j|| j| jd� || j|< qW dS )zU Set log label for level. Level can be a single level or an array
of levels. r# )r )rk rl N)rm rn r$ rV rM )r r
ro rp r r r r[ u s
zLogger.setDebugLogLabelNc C s | j ||||dd� dS )z� Set info log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r )r N)� _setLogging)r rf rc r
�fmtr r r r` ~ s zLogger.setInfoLoggingc C s | j ||||dd� dS )z� Set debug log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r# )r N)rq )r rf rc r
rr r r r ra � s zLogger.setDebugLoggingc C s | j ||||dd� dS )z� Add info log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r )r N)� _addLogging)r rf rc r
rr r r r �addInfoLogging� s zLogger.addInfoLoggingc C s | j ||||dd� dS )z� Add debg log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r# )r N)rs )r rf rc r
rr r r r �addDebugLogging� s zLogger.addDebugLoggingc C s | j ||||dd� dS )z� Delete info log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r )r N)� _delLogging)r rf rc r
rr r r r �delInfoLogging� s zLogger.delInfoLoggingc C s | j ||||dd� dS )z� Delete debug log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r# )r N)rv )r rf rc r
rr r r r �delDebugLogging� s zLogger.delDebugLoggingc C s | j |dd�S )zN Is there currently any info logging for this log level (and
domain)? r )r )�_isLoggingHere)r r
r r r �isInfoLoggingHere� s zLogger.isInfoLoggingHerec C s | j |dd�S )zO Is there currently any debug logging for this log level (and
domain)? r# )r )ry )r r
r r r �isDebugLoggingHere� s zLogger.isDebugLoggingHerec O s, | j |� d|d< | j| j|f|�|� dS )z Fatal error log. r r N)� _checkKWargs�_logr' )r rJ r? r@ r r r �fatal� s
z Logger.fatalc O s, | j |� d|d< | j| j|f|�|� dS )z Error log. r r N)r| r} r& )r rJ r? r@ r r r �error� s
z Logger.errorc O s, | j |� d|d< | j| j|f|�|� dS )z Warning log. r r N)r| r} r% )r rJ r? r@ r r r �warning� s
zLogger.warningc O sB | j |d| jd� | j|� d|d< | j|| j |f|�|� dS )z� Information log using info level [1..info_max].
There are additional infox functions according to info_max from
__init__r# )rk rl r r N)rn rT r| r} rS )r r
rJ r? r@ r r r r= � s
z Logger.infoc O s< | j |d| jd� | j|� d|d< | j||f|�|� dS )z� Debug log using debug level [1..debug_max].
There are additional debugx functions according to debug_max
from __init__r# )rk rl r N)rn rV r| r} )r r
rJ r? r@ r r r rC � s
z Logger.debugc C s | j | jtj� g i d� d S )N)r? r@ )r} rX � traceback�
format_exc)r r r r � exception� s zLogger.exceptionc C s& ||k s||kr"t d|||f ��d S )Nz*Level %d out of range, should be [%d..%d].)rR )r r
rk rl r r r rn � s zLogger._checkLogLevelc C s2 |sd S x$|j � D ]}|dkrtd| ��qW d S )N�nlrr �nofmtz0Key '%s' is not allowed as argument for logging.)r� rr r� )�keysrR )r r@ �keyr r r r| � s
zLogger._checkKWargsc C s | s|dkrt d| ��d S )Nr< zDomain '%s' is not valid.)rR )r rf r r r rd � s zLogger._checkDomainc C s� || j krft|t�s t|t�r$|}n|g}xp|D ]0}|rL| j|d| jd� q0| j|| j| jd� q0W n6|r�dd� t| j | j�D �}ndd� t| j| j�D �}|S )z Generate log level array. r# )rk rl c S s g | ]}|�qS r r )rE rF r r r rG � s z%Logger._getLevels.<locals>.<listcomp>c S s g | ]}|�qS r r )rE rF r r r rG � s )
�ALL�
isinstance�list�tuplern rV r' rT rY ZDEBUG1)r r
r rp r r r rm � s
zLogger._getLevelsc C sN t |t�st |t�r|}n|g}x(|D ] }t|jt�s&td|jj ��q&W |S )z Generate target array. z '%s' is no valid logging target.)r� r� r� �
issubclass� __class__r rR r )r rc �targetsZ_targetr r r � _getTargets� s
zLogger._getTargetsc C s� |r | j }| j}d| jd f}n | j}| j}| j| jd f}t|�dkrP|j� xVt |d |d �D ]@}||krrqdx0|| D ]$\}}}||kr||j
|g �j |� q|W qdW dS )z% Generate dict with domain by level. r# r N) rQ rO rV rP rN r' rT r) �clearrY �
setdefault�append)r r rP rN Z_ranger
rf rb r r r � _genDomains s zLogger._genDomainsc C sl | j |� | j||�}| j|�}|r,| j}n| j}x*|D ]"}x |D ]}|||fg||< qBW q8W | j|� d S )N)rd rm r� rO rN r� ) r rf rc r
rr r rp r� rN r r r rq s
zLogger._setLoggingc C st | j |� | j||�}| j|�}|r,| j}n| j}x2|D ]*}x$|D ] }|j|g �j|||f� qBW q8W | j|� d S )N)rd rm r� rO rN r� r� r� ) r rf rc r
rr r rp r� rN r r r rs - s
zLogger._addLoggingc
C s� | j |� | j||�}| j|�}|r,| j}n| j}x�|D ]|} xv|D ]n}| |krPqB|||f|| kr�|| j|||f� t|| �dkr�|| = qB|| jkrBtd| ||j j
|f ��qBW q8W | j |� d S )Nr zDNo mathing logging for level %d, domain %s, target %s and format %s.) rd rm r� rO rN �remover) r� rR r� r r� )
r rf rc r
rr r rp r� rN rH r r r rv < s&
zLogger._delLoggingc C st | j ||�}|sdS |d d }|r,| j}n| j}x<|| D ]0\}}}|dksh|j|�shtj|d |�r<dS q<W dS )NFrf �.rD T)�_genDictrO rN r0 �fnmatch� fnmatchcase)r r
r �_dict� point_domainrN rf rb r r r ry U s
zLogger._isLoggingHerec C s� |j jdkrD|j jd }||jkrD|j| }| j|j|j �}|rD|S tj|j �}|j }|j|j kr�t
|j |j d�r�|j |j j |kr�dS xT|j j � D ]F\}}t
|tj�r�t
||j�r�t||j�}t
|tj�r�|j |kr�|S q�W dS )z7 Function to get calling class. Returns class or None. r Z func_codeN)�f_code� co_argcount� co_varnames�f_locals�
_getClass2r� �inspectZ getmodule�co_name�__dict__�hasattr�__code__�itemsr� �typesZ ClassType�getattr� FunctionType) r �frameZselfname�_self�obj�module�coderb �valuer r r � _getClassi s*
zLogger._getClassc C sV x,|j j� D ] }t|tj�r |j|kr |S q W x"|jD ]}| j||�}|r6|S q6W dS )z@ Internal function to get calling class. Returns class or None. N)r� �valuesr� r� r� r� � __bases__r� )r r� r� r� �baseZ_objr r r r� � s
zLogger._getClass2c O sl d}d|kr|d }d}d|kr(|d }d}d|kr<|d }| j ||�}|sPd S t|�dkrj|| |d< n&t|�dkr�||d |d< n||d< |d d } |r�| j}
n| j}
g } x�|
| D ]�\} }
}|
| kr�q�| d ks�| j| d �s�tj|d | �r�|�s| j}d
|k�r|d
}|�r0|
j|d || |� n|
j|| || |� |�rZ|
jd || |� | j |
� q�W d S ) Nr r r# r� r� r> rf r� rD rr r" )
r� r) rO rN r0 r� r� rJ r r� )r r
rJ r? r@ r r� r� r� r� rN Z used_targetsrf rc r r r r} � sL
z Logger._logc C s g }d}|r | j }| j}| j}n| j}| j}| j}xN|D ]F}|dkrh|| |kr~d}t|�dkrdg }P q8|| |kr8|j|� q8W | r�t|�dk r�dS ||kr�dS tj � } x$| r�| j
r�| j d | j kr�| j
} q�W | s�t
d��| j d }
|
d } x |D ]}| j|�r�g }P q�W | j} t|
�}
xx|| D ]l}|jd�}|dk�rD�q&n |dk�r\|d|� }n|}|
t|�k�r�|
j|��s�dS n|j|
��s&dS �q&W d
}||k�r�|| }| j| j|
d
| jd
||tj| jtj� �d � }|d d
k�r�d
|d < d}x&|| D ]}|dk�r�q�d}P �q�W | jjd�dk�sR| jjd�dk�sR|�sRt|�dk�rl| j| �}|�rl|j|d< d
|d |d< |d d
k�r�|d d |d 7 < |d d
k�r�|d d |d 7 < t|�dk �r�|S |d d }x0|D ](}|j|��stj |d |��r�|S �q�W dS )z Internal function. FrD Tr r# Nr z Frame information not available.r� r< ) �file�liner� �class�functionrf ro r
Zdater� �?z %(domain)z%(class)r� r� rf ) rI rQ rM rH rP rL r) r� r� Z currentframe�f_back� f_globalsr rR r0 r� �find� co_filename�f_linenor� �timeZstrftimerK Z localtimerJ r� r r� r� )r r
r Z
check_domainsZ simple_matchr� rP rL rf �fZ module_nameZ point_module�co�_lenrF �dZ level_strZ
domain_neededr� r� r r r r� � s�
zLogger._genDict���������������)r7 r; )rD )rD )rD )rD )r )r )r )r )8r r r r r� re r' rX r& r% r r r r r r r
r rg r\ rh r] ri r^ rj r_ rW r[ r` ra rt ru rw rx rz r{ r~ r r� r= rC r� rn r| rd rm r� r� rq rs rv ry r� r� r} r� r r r r r � sd G
;
4)�__all__r r� r� r� r� r r� r5 Zos.pathr �objectr r r r r r r r r r r �<module> s. -( *4 core/__pycache__/fw_transaction.cpython-36.pyc 0000644 00000011650 15035135173 0015361 0 ustar 00 3
��g� � @ sJ d Z dgZddlZddlmZ ddlmZ ddlmZ G dd� de �Z
dS )z!Transaction classes for firewalld�FirewallTransaction� N)�log)�errors)�
FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#S )$r c C s( || _ i | _g | _g | _g | _g | _d S )N)�fw�rules� pre_funcs�
post_funcs�
fail_funcs�modules)�selfr � r
�$/usr/lib/python3.6/fw_transaction.py�__init__! s z FirewallTransaction.__init__c C s2 | j j� | jd d �= | jd d �= | jd d �= d S )N)r �clearr r r
)r r
r
r r ) s
zFirewallTransaction.clearc C s | j j|jg �j|� d S )N)r �
setdefault�name�append)r �backend�ruler
r
r �add_rule/ s z FirewallTransaction.add_rulec C s x|D ]}| j ||� qW d S )N)r )r r r r r
r
r � add_rules2 s
z FirewallTransaction.add_rulesc C s |j | jko|| j|j kS )N)r r )r r r r
r
r �
query_rule6 s z FirewallTransaction.query_rulec C s2 |j | jkr.|| j|j kr.| j|j j|� d S )N)r r �remove)r r r r
r
r � remove_rule9 s z FirewallTransaction.remove_rulec G s | j j||f� d S )N)r r )r �func�argsr
r
r �add_pre= s zFirewallTransaction.add_prec G s | j j||f� d S )N)r r )r r r r
r
r �add_post@ s z FirewallTransaction.add_postc G s | j j||f� d S )N)r
r )r r r r
r
r �add_failC s z FirewallTransaction.add_failc C s || j kr| j j|� d S )N)r r )r �moduler
r
r �
add_moduleF s
z FirewallTransaction.add_modulec C s || j kr| j j|� d S )N)r r )r r r
r
r �
remove_moduleJ s
z!FirewallTransaction.remove_modulec C s x|D ]}| j |� qW d S )N)r! )r r r r
r
r � add_modulesN s
z FirewallTransaction.add_modulesc C s x|D ]}| j |� qW d S )N)r" )r r r r
r
r �remove_modulesR s
z"FirewallTransaction.remove_modulesc C s� t jdt| �|df � i }|sjxp| jD ]<}x6t| j| �D ]$}|j|g �j| jj|�j |�� q<W q(W n(x&| jD ] }|j|g �j
| j| � qrW || j fS )Nz%s.prepare(%s, %s)z...) r �debug4�typer �reversedr r r �get_backend_by_name� reverse_rule�extendr )r �enabler � backend_namer r
r
r �prepareV s zFirewallTransaction.preparec C s t jdt| �|f � | j|�\}}| j� d}d}g }xp|D ]h}y| jj||| � W nB tk
r� } z&d}|}t jt j
� � t j |� W Y d d }~X q>X |j |� q>W |s�| jj
||�} | r�| \}
}|
r�t j|� |�ri } xH|D ]@}g | |< x2t|| �D ]"} | | j | jj|�j| �� �q W q�W xb| D ]Z}y| jj|| | � W n< tk
�r� } z t jt j
� � t j |� W Y d d }~X nX �q0W xh| jD ]^\}
}y |
|� W nF tk
�r� } z(t jt j
� � t j d|
||f � W Y d d }~X nX �q�W ttj|��| j� d S )Nz%s.execute(%s)F� Tz#Calling fail func %s(%s) failed: %s)r r% r& r- �prer r � Exception�debug1� traceback�
format_exc�errorr Zhandle_modulesr' r( r) r
r r ZCOMMAND_FAILED�post)r r+ r r r4 ZerrorMsg�doner, �msgZ
module_returnZstatusZ
undo_rulesr r r r
r
r �executef sV
" & zFirewallTransaction.executec C s| t jdt| � � xd| jD ]Z\}}y ||� W q tk
rr } z(t jtj� � t jd|||f � W Y d d }~X qX qW d S )Nz%s.pre()z"Calling pre func %s(%s) failed: %s) r r% r& r r0 r1 r2 r3 r4 )r r r r7 r
r
r r/ � s zFirewallTransaction.prec C s| t jdt| � � xd| jD ]Z\}}y ||� W q tk
rr } z(t jtj� � t jd|||f � W Y d d }~X qX qW d S )Nz %s.post()z#Calling post func %s(%s) failed: %s) r r% r& r r0 r1 r2 r3 r4 )r r r r7 r
r
r r5 � s zFirewallTransaction.postN)�__name__�
__module__� __qualname__r r r r r r r r r r! r" r# r$ r- r8 r/ r5 r
r
r
r r s" @ ) �__doc__�__all__r2 Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r
r
r
r �<module> s core/__pycache__/icmp.cpython-36.pyc 0000644 00000004265 15035135173 0013274 0 ustar 00 3
��g � # @ s� d dddgZ ddddddd d
d d d
dddddddddddddddd d d d d d!d"d#d$�"Zd%d&d'd(d)dddd*d+d,d,d-d-d.d/d0d0d1d1d2d3�Zd4d5� Zd6d� Zd7d8� Zd9d� Zd:S );�
ICMP_TYPES� ICMPV6_TYPES�check_icmp_type�check_icmpv6_typez0/0z3/0z3/1z3/2z3/3z3/4z3/5z3/6z3/7z3/9z3/10z3/11z3/12z3/13z3/14z3/15z4/0z5/0z5/1z5/2z5/3z8/0z9/0z10/0z11/0z11/1z12/0z12/1z13/0z14/0z17/0z18/0)"z
echo-reply�pongznetwork-unreachablezhost-unreachablezprotocol-unreachablezport-unreachablezfragmentation-neededzsource-route-failedznetwork-unknownz host-unknownznetwork-prohibitedzhost-prohibitedzTOS-network-unreachablezTOS-host-unreachablezcommunication-prohibitedzhost-precedence-violationzprecedence-cutoffz
source-quenchznetwork-redirectz
host-redirectzTOS-network-redirectzTOS-host-redirectz echo-request�pingzrouter-advertisementzrouter-solicitationzttl-zero-during-transitzttl-zero-during-reassemblyz
ip-header-badzrequired-option-missingztimestamp-requestztimestamp-replyzaddress-mask-requestzaddress-mask-replyz1/0z1/1z1/3z1/4z2/0z4/1z4/2z128/0z129/0z133/0z134/0z135/0z136/0z137/0)zno-routezcommunication-prohibitedzaddress-unreachablezport-unreachablezpacket-too-bigzttl-zero-during-transitzttl-zero-during-reassemblyz
bad-headerzunknown-header-typezunknown-optionz echo-requestr z
echo-replyr zrouter-solicitationzrouter-advertisementzneighbour-solicitationzneigbour-solicitationzneighbour-advertisementzneigbour-advertisementZredirectc C s | t kr dS dS )NTF)r )�_name� r �/usr/lib/python3.6/icmp.py�check_icmp_nameV s r
c C s | t j� krdS dS )NTF)r �values)�_typer r r r [ s c C s | t kr dS dS )NTF)r )r r r r �check_icmpv6_name` s r
c C s | t j� krdS dS )NTF)r r )r r r r r e s N)�__all__r r r
r r
r r r r r �<module> sx core/__pycache__/rich.cpython-36.opt-1.pyc 0000644 00000050640 15035135173 0014226 0 ustar 00 3
��g8� � @ s� d ddddddddd d
d d d
ddddgZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd � d e
�Z G dd� de
�Z G dd� de
�Z
G dd� de
�ZG d d� de�ZG d d� de
�ZG d d� de
�ZG d d� de
�ZG d d� de
�ZG d!d � d e
�ZG d"d
� d
e
�ZG d#d � d e
�ZG d$d � d e
�ZG d%d
� d
e
�ZG d&d� de�ZG d'd� de
�Zd(d)d/d1d+�ZG d,d� de
�Z G d-d� de
�Z d.S )2� Rich_Source�Rich_Destination� Rich_Service� Rich_Port�
Rich_Protocol�Rich_Masquerade�Rich_IcmpBlock�
Rich_IcmpType�Rich_SourcePort�Rich_ForwardPort�Rich_Log�
Rich_Audit� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�
Rich_Limit� Rich_Rule� )� functions)�check_ipset_name)� REJECT_TYPES)�errors)�
FirewallErrorc @ s e Zd Zddd�Zdd� ZdS )r Fc C s� || _ | j dkrd | _ || _| jdks0| jd kr8d | _n| jd k rN| jj� | _|| _| jdkrdd | _|| _| j d kr�| jd kr�| jd kr�ttjd��d S )N� zno address, mac and ipset)�addr�mac�upper�ipset�invertr r � INVALID_RULE)�selfr r r r � r! �/usr/lib/python3.6/rich.py�__init__$ s
zRich_Source.__init__c C sj d| j r dnd }| jd k r*|d| j S | jd k rB|d| j S | jd k rZ|d| j S ttjd��d S )Nz source%s z NOTr z address="%s"zmac="%s"z
ipset="%s"zno address, mac and ipset)r r r r r r r )r �retr! r! r" �__str__5 s
zRich_Source.__str__N)F)�__name__�
__module__� __qualname__r# r% r! r! r! r" r # s
c @ s e Zd Zddd�Zdd� ZdS )r Fc C sV || _ | j dkrd | _ || _| jdkr,d | _|| _| j d krR| jd krRttjd��d S )Nr zno address and ipset)r r r r r r )r r r r r! r! r" r# B s
zRich_Destination.__init__c C sR d| j r dnd }| jd k r*|d| j S | jd k rB|d| j S ttjd��d S )Nzdestination%s z NOTr z address="%s"z
ipset="%s"zno address and ipset)r r r r r r )r r$ r! r! r" r% N s
zRich_Destination.__str__N)F)r& r' r( r# r% r! r! r! r" r A s
c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)�name)r r) r! r! r" r# Y s zRich_Service.__init__c C s
d| j S )Nzservice name="%s")r) )r r! r! r" r% \ s zRich_Service.__str__N)r& r' r( r# r% r! r! r! r" r X s c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ || _d S )N)�port�protocol)r r* r+ r! r! r" r# ` s zRich_Port.__init__c C s d| j | jf S )Nz port port="%s" protocol="%s")r* r+ )r r! r! r" r% d s zRich_Port.__str__N)r& r' r( r# r% r! r! r! r" r _ s c @ s e Zd Zdd� ZdS )r c C s d| j | jf S )Nz#source-port port="%s" protocol="%s")r* r+ )r r! r! r" r% h s zRich_SourcePort.__str__N)r& r' r( r% r! r! r! r" r g s c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)�value)r r, r! r! r" r# m s zRich_Protocol.__init__c C s
d| j S )Nzprotocol value="%s")r, )r r! r! r" r% p s zRich_Protocol.__str__N)r& r' r( r# r% r! r! r! r" r l s c @ s e Zd Zdd� Zdd� ZdS )r c C s d S )Nr! )r r! r! r" r# t s zRich_Masquerade.__init__c C s dS )N�
masquerader! )r r! r! r" r% w s zRich_Masquerade.__str__N)r& r' r( r# r% r! r! r! r" r s s c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)r) )r r) r! r! r" r# { s zRich_IcmpBlock.__init__c C s
d| j S )Nzicmp-block name="%s")r) )r r! r! r" r% ~ s zRich_IcmpBlock.__str__N)r& r' r( r# r% r! r! r! r" r z s c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)r) )r r) r! r! r" r# � s zRich_IcmpType.__init__c C s
d| j S )Nzicmp-type name="%s")r) )r r! r! r" r% � s zRich_IcmpType.__str__N)r& r' r( r# r% r! r! r! r" r � s c @ s e Zd Zdd� Zdd� ZdS )r
c C s< || _ || _|| _|| _| jd kr(d| _| jd kr8d| _d S )Nr )r* r+ �to_port�
to_address)r r* r+ r. r/ r! r! r" r# � s
zRich_ForwardPort.__init__c C s< d| j | j| jdkr d| j nd| jdkr4d| j ndf S )Nz(forward-port port="%s" protocol="%s"%s%sr z
to-port="%s"z
to-addr="%s")r* r+ r. r/ )r r! r! r" r% � s zRich_ForwardPort.__str__N)r& r' r( r# r% r! r! r! r" r
� s c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ || _|| _d S )N)�prefix�level�limit)r r0 r1 r2 r! r! r" r# � s zRich_Log.__init__c C s> d| j rd| j nd| jr$d| j nd| jr6d| j ndf S )Nz log%s%s%sz prefix="%s"r z level="%s"z %s)r0 r1 r2 )r r! r! r" r% � s zRich_Log.__str__)NNN)r& r' r( r# r% r! r! r! r" r � s
c @ s e Zd Zddd�Zdd� ZdS )r Nc C s
|| _ d S )N)r2 )r r2 r! r! r" r# � s zRich_Audit.__init__c C s d| j rd| j nd S )Nzaudit%sz %sr )r2 )r r! r! r" r% � s zRich_Audit.__str__)N)r& r' r( r# r% r! r! r! r" r � s
c @ s e Zd Zddd�Zdd� ZdS )r
Nc C s
|| _ d S )N)r2 )r r2 r! r! r" r# � s zRich_Accept.__init__c C s d| j rd| j nd S )Nzaccept%sz %sr )r2 )r r! r! r" r% � s zRich_Accept.__str__)N)r& r' r( r# r% r! r! r! r" r
� s
c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S )N)�typer2 )r Z_typer2 r! r! r" r# � s zRich_Reject.__init__c C s, d| j rd| j nd| jr$d| j ndf S )Nz
reject%s%sz
type="%s"r z %s)r3 r2 )r r! r! r" r% � s zRich_Reject.__str__c C sT | j rP|sttjd��|dkrP| j t| krPdjt| �}ttjd| j |f ��d S )Nz9When using reject type you must specify also rule family.�ipv4�ipv6z, z%Wrong reject type %s.
Use one of: %s.)r4 r5 )r3 r r r r �join)r �familyZ valid_typesr! r! r" �check� s zRich_Reject.check)NN)r& r' r( r# r% r8 r! r! r! r" r � s
c @ s e Zd Zdd� ZdS )r c C s d| j rd| j nd S )Nzdrop%sz %sr )r2 )r r! r! r" r% � s zRich_Drop.__str__N)r& r' r( r% r! r! r! r" r � s c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S )N)�setr2 )r Z_setr2 r! r! r" r# � s zRich_Mark.__init__c C s d| j | jrd| j ndf S )Nz
mark set=%s%sz %sr )r9 r2 )r r! r! r" r% � s zRich_Mark.__str__c C s� | j d k r| j }n ttjd��d|krv|jd�}t|�dkrHttj|��tj|d � shtj|d � r�ttj|��ntj|�s�ttj|��d S )Nz no value set�/� r � )r9 r r Z INVALID_MARK�split�lenr Z checkUINT32)r �x�splitsr! r! r" r8 � s
zRich_Mark.check)N)r& r' r( r# r% r8 r! r! r! r" r � s
r< �< � )�s�m�h�dc @ s� e Zd Zddd�Zdd� Zedd� �Zejdd� �Zed d
� �Zejd d
� �Ze d d
� �Z
dd� Z e dd� �Z dd� Z
dd� ZdS )r Nc C s || _ || _d S )N)r, �burst)r r, rG r! r! r" r# � s zRich_Limit.__init__c C s | j � | j� d S )N)� value_parse� burst_parse)r r! r! r" r8 � s zRich_Limit.checkc C s | j S )N)�_value)r r! r! r" r, � s zRich_Limit.valuec C sf |d krd | _ d S y| j|�\}}W n tk
r< |}Y nX |� d|� �}t| dd �|krb|| _ d S )Nr: rJ )rJ � _value_parser �getattr)r r, �rate�duration�vr! r! r" r, � s
c C s | j S )N)�_burst)r r! r! r" rG s zRich_Limit.burstc C s\ |d krd | _ d S y| j|�}W n tk
r8 |}Y n
X t|�}t| dd �|krX|| _ d S )NrP )rP � _burst_parser �strrL )r rG �br! r! r" rG s
c C s� d }d| kr| j d�}| s(t|�dkr4ttj| ��|\}}y t|�}W n ttj| ��Y nX |dkrv|d d� }|dk s�|dkr�ttj| ��d t| | d
kr�ttjd| f ��|dkr�|d kr�ttjd| f ��||fS )Nr: r; �second�minute�hour�dayr< rC rD rE rF i' r z %s too fastz %s too slow)rT rU rV rW )rC rD rE rF )r= r> r r �
INVALID_LIMIT�int�DURATION_TO_MULT)r, r@ rM rN r! r! r" rK s&
zRich_Limit._value_parsec C s | j | j�S )N)rK rJ )r r! r! r" rH : s zRich_Limit.value_parsec C sR | d kr d S y t | �}W n ttj| ��Y nX |dk sB|dkrNttj| ��|S )Nr< i��� )rY r r rX )rG rS r! r! r" rQ = s zRich_Limit._burst_parsec C s | j | j�S )N)rQ rP )r r! r! r" rI K s zRich_Limit.burst_parsec C s, d| j � d�}| jd k r(|d| j� �7 }|S )Nz
limit value="�"z burst=)rJ rP )r rC r! r! r" r% N s
zRich_Limit.__str__)N)r& r' r( r# r8 �propertyr, �setterrG � staticmethodrK rH rQ rI r% r! r! r! r" r � s
c @ s> e Zd ZdZdZddd�Zdd� Zd d
� Zd d � Zd
d� Z dS )r i � i� Nr c C sV |d k rt |�| _nd | _|| _d | _d | _d | _d | _d | _d | _|rR| j |� d S )N)
rR r7 �priority�source� destination�element�log�audit�action�_import_from_string)r r7 �rule_strr_ r! r! r" r# X s zRich_Rule.__init__c C s� g }x|t j|�D ]n}d|krp|jd�}t|�dksF|d sF|d rVttjd| ��|j|d |d d�� q|jd|i� qW |jddi� |S ) z Lexical analysis �=r; r r< z internal error in _lexer(): %s)� attr_name�
attr_valuerb �EOL)r Z splitArgsr= r> r r r �append)r rg �tokens�r�attrr! r! r" �_lexeri s
zRich_Rule._lexerc C s� |st tjd��tj|�}d| _d | _d | _d | _d | _ d | _
d | _ d | _ | j
|�}|rv|d jd�dkrvt tjd��i }g }d}�x`|| jd�dko�|dgk�s�|| jd�}|| jd�}|| jd�}|� r�|dHk�r�t tjd| ��� n�|dIk�r�|dk�r | j�r t tjd+��n�|dk�r<| j�r<t tjd,��n�|dJk�rf| j �rft tjd-|| j f ��nh|d"k�r�| j
�r�t tjd.��nH|d#k�r�| j �r�t tjd/��n(|dKk�r�| j �r�t tjd0|| j f ��nt tjd1| ��t|�dk�r�|t|�d2 nd3} | d3k�r�| �r`|�r`|d k�r2t tjd4��n,|dk�rJt tjd5��nt tjd6||f ��n*d|k�r�t tjd7||f ��n
|jd� �nL| dk�rD|d k�r�|dLk�r�t tjd:| ��|| _n||dk�ryt|�| _W n& tk
�r t tjd;| ��Y nX n:|�r6|dk�r d<}
n d=||f }
t tj|
��n
|j|� �n�| dk�r�|dMk�rb|||< nV|dNk�rvd>|d
< nBt|jd
�|jd �|jd �|jd
d?��| _|j� |j� |d2 }�n | dk�r,|dOk�r�|||< nN|dPk�r�d>|d
< n:t|jd
�|jd �|jd
d?��| _|j� |j� |d2 }�n�| dk�rd|dk�rTt|�| _ |j� n t tjd@���nv| d k�r�|dk�r�t|�| _ |j� n t tjdA���n>| dk�r�|dQk�r�|||< n0t|jd�|jd��| _ |j� |j� |d2 }�n�| d k�r&|dk�rt|�| _ |j� n t tjdB���n�| d k�r^|dk�rNt |�| _ |j� n t tjdC���n|| d k�r�t � | _ |j� |j� |d2 }�nN| d k�r�|dRk�r�|||< n@t |jd�|jd�|jd�|jd��| _ |j� |j� |d2 }�n�| d!k�r@|dSk�r |||< n0t |jd�|jd��| _ |j� |j� |d2 }�n�| d"k�r�|dTk�r^|||< nN|d(k�rt|jd(� n8t |jd�|jd�|jd(��| _
|j� |j� |d2 }�n*| d#k�r�|d(k�r�|jd(� n(t!|jd(��| _ |j� |j� |d2 }�n�| d$k�rH|d(k�r |jd(� n(t"|jd(��| _ |j� |j� |d2 }�n�| d%k�r�|d(k�rh|jd(� n(t#|jd(��| _ |j� |j� |d2 }�nF| d&k�r�|dk�r�|||< nF|d(k�r�|jd(� n0t$|jd�|jd(��| _ |j� |j� |d2 }n�| d'k�r`|dk�r|||< nF|d(k�r.|jd(� n0t%|jd�|jd(��| _ |j� |j� |d2 }nz| d(k�r�|dUk�r�||dD|� �< nVdE|k�r�t tjdF��t&|dE |jdG��|d(< |jdEd � |jdGd � |j� |d2 }|d2 }q�W | j'� d S )VNz
empty ruler rb rk �ruleri rj r_ r7 �addressr r r r, r* r+ �to-port�to-addrr) r0 r1 r3 r9 rG zbad attribute '%s'r` ra �service�
icmp-block� icmp-typer- � forward-port� source-portrc rd �accept�drop�reject�markr2 �not�NOTz more than one 'source' elementz#more than one 'destination' elementzFmore than one element. There cannot be both '%s' and '%s' in one rule.zmore than one 'log' elementz more than one 'audit' elementzOmore than one 'action' element. There cannot be both '%s' and '%s' in one rule.zunknown element %sr< r z0'family' outside of rule. Use 'rule family=...'.z4'priority' outside of rule. Use 'rule priority=...'.z:'%s' outside of any element. Use 'rule <element> %s= ...'.z,'%s' outside of rule. Use 'rule ... %s ...'.r4 r5 zH'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead.z(invalid 'priority' attribute value '%s'.zdwrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'.zDattribute '%s' outside of any element. Use 'rule <element> %s= ...'.TFzinvalid 'protocol' elementzinvalid 'service' elementz invalid 'icmp-block' elementzinvalid 'icmp-type' elementzlimit.z limit.valuezinvalid 'limit' elementz limit.burst)r_ r7 rr r r r r, r* r+ rs rt r) r0 r1 r3 r9 rG )rq r` ra r+ ru r* rv rw r- rx ry rc rd rz r{ r| r} r2 r~ r rk )r+ ru r* rv rw r- rx ry )rz r{ r| r} )r4 r5 )rr r r r )r~ r )rr r r )r~ r )r* r+ )r* r+ rs rt )r* r+ )r0 r1 )r, rG )(r r r r ZstripNonPrintableCharactersr_ r7 r` ra rb rc rd re rp �getr> rl rY �
ValueError�INVALID_PRIORITYr �pop�clearr r r r r r r r
r r r r
r r r r r8 ) r rg rm ZattrsZ in_elements�indexrb ri rj Z
in_elementZerr_msgr! r! r" rf z s�
" "
*
"
(
z Rich_Rule._import_from_stringc C s` | j d k r"| j d kr"ttj| j ��| j d krn| jd k rB| jjd k sL| jd k rVttj��t| j �t
krnttj��| j | j k s�| j | j
kr�ttjd| j | j
f ��| j d ko�| jd ks�| jd k o�| j dk�r
| jd kr�ttjd��| jd ko�| jd ko�| j dk�r
ttjd��t| j �tt
tgk�rP| jd k�rP| jd k�rP| jd k�rPttjd��| jd k �rj| jjd k �r�| j d k�r�ttj��| jjd k �r�ttjd��| jjd k �r�ttjd ��tj| j | jj��sjttjt| jj���n�| jjd k �r,| jjd k �rttjd
��tj| jj��sjttj t| jj���n>| jjd k �r^t | jj��sjttj t| jj���n ttjd ��| jd k �r | jjd k �r�| j d k�r�ttj��| jjd k �r�ttj d ��tj| j | jj��s ttjt| jj���n>| jjd k �rt | jj��s ttj t| jj���n ttjd ��t| j �t k�rd| j j!d k�sLt"| j j!�d
k �r`ttj#t| j j!����n�t| j �t$k�r�tj%| j j&��s�ttj'| j j&��| j j(d!k�r`ttj)| j j(���n�t| j �t*k�r�tj+| j j,��s`ttj)| j j,���nvt| j �tk�r<| jd k �rttjd��| jd k �r`| jjd k �r`ttjd���n$t| j �tk�r�| j j!d k�slt"| j j!�d
k �r�ttj-t| j j!���| j�r`ttjd���n�t| j �t.k�r�| j j!d k�s�t"| j j!�d
k �r`ttj-t| j j!����n�t| j �t
k�r�tj%| j j&��sttj'| j j&��| j j(d"k�r.ttj)| j j(��| j j/dk�rZ| j j0dk�rZttj'| j j/��| j j/dk�r�tj%| j j/� �r�ttj'| j j/��| j j0dk�r�tj1| j | j j0� �r�ttj| j j0��| j d k�r�ttj��| jd k �r`ttjd��nrt| j �t2k�r>tj%| j j&��s ttj'| j j&��| j j(d#k�r`ttj)| j j(��n"| j d k �r`ttjdt| j � ��| jd k �r�| jj3�r�| jj3d$k�r�ttj4| jj3��| jj5d k �r�| jj5j6� | jd k �r�t| j�t7t8t9gk�r�ttj:t| j���| jj5d k �r�| jj5j6� | jd k �r\t| j�t8k�r(| jj6| j � nt| j�t;k�rB| jj6� | jj5d k �r\| jj5j6� d S )%Nr4 r5 z/'priority' attribute must be between %d and %d.r zno element, no actionz%no element, no source, no destinationzno action, no log, no auditzaddress and maczaddress and ipsetz
mac and ipsetzinvalid sourcezinvalid destinationr< �tcp�udp�sctp�dccpzmasquerade and actionzmasquerade and mac sourcezicmp-block and actionr zforward-port and actionzUnknown element %s�emerg�alert�crit�error�warning�notice�info�debug)r4 r5 )r� r� r� r� )r� r� r� r� )r� r� r� r� )r� r� r� r� r� r� r� r� )<r7 r r ZINVALID_FAMILYr` r ra ZMISSING_FAMILYr3 rb r
r_ � priority_min� priority_maxr� rc re r r r rd r r r Z
check_addressZ INVALID_ADDRrR Z check_macZ INVALID_MACr Z
INVALID_IPSETZINVALID_DESTINATIONr r) r> ZINVALID_SERVICEr Z
check_portr* Z INVALID_PORTr+ ZINVALID_PROTOCOLr Z
checkProtocolr, ZINVALID_ICMPTYPEr r. r/ Zcheck_single_addressr r1 ZINVALID_LOG_LEVELr2 r8 r
r r ZINVALID_AUDIT_TYPEr )r r! r! r" r8 h s�
zRich_Rule.checkc C s� d}| j r|d| j 7 }| jr,|d| j 7 }| jr@|d| j 7 }| jrT|d| j 7 }| jrh|d| j 7 }| jr||d| j 7 }| jr�|d| j 7 }| jr�|d| j 7 }tj r�tj
|�S |S )Nrq z priority="%d"z family="%s"z %s) r_ r7 r` ra rb rc rd re r ZPY2Zu2b)r r$ r! r! r" r% s$ zRich_Rule.__str__i ���)NNr )
r& r' r( r� r� r# rp rf r8 r% r! r! r! r" r T s
o -Ni i� i�Q ) �__all__Zfirewallr Zfirewall.core.ipsetr Zfirewall.core.baser r Zfirewall.errorsr �objectr r r r r r r r r r
r r r
r r r rZ r r r! r! r! r" �<module> s@
d core/__pycache__/modules.cpython-36.opt-1.pyc 0000644 00000005500 15035135173 0014744 0 ustar 00 3
��g� � @ sB d Z dgZddlmZ ddlmZ ddlmZ G dd� de�Z dS )zmodules backend�modules� )�runProg)�log)�COMMANDSc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dS )r c C s t d | _t d | _d S )NZmodprobeZrmmod)r �
_load_command�_unload_command)�self� r � /usr/lib/python3.6/modules.py�__init__ s
zmodules.__init__c C s
d| j S )Nz%s)� __class__)r r r r
�__repr__$ s zmodules.__repr__c C s� g }i }y�t dd��p}xh|D ]`}|s&P |j� }|j� }|j|d � |d dkrp|d jd�dd � ||d < q g ||d < q W W dQ R X W n tk
r� Y nX ||fS )
z6 get all loaded kernel modules and their dependencies z
/proc/modules�rr � �-�,N� ���)�open�strip�split�append�FileNotFoundError)r �mods�deps�f�lineZsplitsr r r
�loaded_modules' s
zmodules.loaded_modulesc C s" t jd| j| j|� t| j|g�S )Nz %s: %s %s)r �debug2r r r )r �moduler r r
� load_module< s zmodules.load_modulec C s" t jd| j| j|� t| j|g�S )Nz %s: %s %s)r r r r r )r r r r r
�
unload_module@ s zmodules.unload_modulec C sT ||kr dS x0|| D ]$}| j |||� ||kr|j|� qW ||krP|j|� dS )z get all dependants of a module N)�get_depsr )r r r �ret�modr r r
r" D s zmodules.get_depsc C s� g }| j � \}}| jd||� x*dD ]"}||kr$|j|� |jd|� q$W x^|D ]V}|dks�|jd�s�|jd �s�|jd
�s�|jd �s�|jd �s�|jd
�rP| j|||� qPW |S )z) get all loaded firewall-related modules Z nf_conntrack�nf_conntrack_ipv4�nf_conntrack_ipv6r � ip_tables�
ip6_tables�ebtablesZiptable_Z ip6table_Znf_Zxt_Zipt_Zip6t_)r% r& r )r' r( r) )r r" �remove�insert�
startswith)r r Zmods2r Zbad_bad_moduler$ r r r
�get_firewall_modulesO s
z modules.get_firewall_modulesc C s> x8| j � D ],}| j|�\}}|dkr
tjd||f � q
W dS )z% unload all firewall-related modules r z Failed to unload module '%s': %sN)r- r! r Zdebug1)r r Zstatusr# r r r
�unload_firewall_modulesd s z modules.unload_firewall_modulesN) �__name__�
__module__� __qualname__r r
r r r! r" r- r. r r r r
r s N)
�__doc__�__all__Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.configr �objectr r r r r
�<module> s
core/__pycache__/helper.cpython-36.opt-1.pyc 0000644 00000000256 15035135173 0014556 0 ustar 00 3
��g$ � @ s d Z dZdS )zThe helper maxnamelen� N)�__doc__ZHELPER_MAXNAMELEN� r r � /usr/lib/python3.6/helper.py�<module> s core/__pycache__/fw_icmptype.cpython-36.opt-1.pyc 0000644 00000004205 15035135173 0015623 0 ustar 00 3
��g� � @ s> d gZ ddlmZ ddlmZ ddlmZ G dd � d e�ZdS )�FirewallIcmpType� )�log)�errors)�
FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dS )r c C s || _ i | _d S )N)�_fw�
_icmptypes)�self�fw� r
�!/usr/lib/python3.6/fw_icmptype.py�__init__ s zFirewallIcmpType.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r r
r
r �__repr__! s zFirewallIcmpType.__repr__c C s | j j� d S )N)r �clear)r r
r
r �cleanup$ s zFirewallIcmpType.cleanupc C s t | jj� �S )N)�sortedr �keys)r r
r
r �
get_icmptypes) s z FirewallIcmpType.get_icmptypesc C s || j krttj|��d S )N)r r r ZINVALID_ICMPTYPE)r �icmptyper
r
r �check_icmptype, s
z FirewallIcmpType.check_icmptypec C s | j |� | j| S )N)r r )r r r
r
r � get_icmptype0 s
z FirewallIcmpType.get_icmptypec C s� |j }t|�dkrddg}x�|D ]z}|dkrL| jj rB| jj rBq | jj}n,|dkrt| jj rj| jj rjq | jj}ng }|jj � |kr t
j d|j|f � q W || j |j< d S )Nr Zipv4Zipv6z5ICMP type '%s' is not supported by the kernel for %s.)
Z destination�lenr Zip4tables_enabledZnftables_enabledZipv4_supported_icmp_typesZip6tables_enabledZipv6_supported_icmp_types�name�lowerr Zinfo1r )r �objZ orig_ipvsZipvZsupported_icmpsr
r
r � add_icmptype4 s
z FirewallIcmpType.add_icmptypec C s | j |� | j|= d S )N)r r )r r r
r
r �remove_icmptypeG s
z FirewallIcmpType.remove_icmptypeN) �__name__�
__module__� __qualname__r r r r r r r r r
r
r
r r s N) �__all__Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r
r
r
r �<module> s core/__pycache__/prog.cpython-36.opt-1.pyc 0000644 00000001266 15035135173 0014250 0 ustar 00 3
��g� � @ s d dl Z dgZddd�ZdS )� N�runProgc
C s� |d kr g }| g| }d }|r@t |d��}|j� j� }W d Q R X ddi}y tj|tjtjtjd|d�}W n tk
r| d
S X |j|�\}} |j dd �}|j
|fS ) N�rZLANG�CT)�stdin�stderr�stdoutZ close_fds�env� � zutf-8�replace)r r
) �open�read�encode�
subprocess�Popen�PIPEZSTDOUT�OSErrorZ communicate�decode�
returncode)
�prog�argvr �argsZ input_stringZhandler Zprocess�outputZ
err_output� r �/usr/lib/python3.6/prog.pyr s$
)NN)r �__all__r r r r r �<module> s core/__pycache__/fw_nm.cpython-36.opt-1.pyc 0000644 00000011713 15035135173 0014405 0 ustar 00 3
��g � @ s d Z ddddddddgZd d
lZd d lmZ yejd d
� W n ek
rT dZY n8X yd dlmZ dZW n e eej
fk
r� dZY nX d
a d dl m
Z
d dlmZ d dlmZ d d
lZdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d� Z d"d� Z d#d� Z d
S )$z(Functions for NetworkManager interaction�check_nm_imported�nm_is_imported�nm_get_zone_of_connection�nm_set_zone_of_connection�nm_get_connections� nm_get_connection_of_interface�nm_get_bus_name�nm_get_dbus_interface� N)�GLib�NMz1.0F)r T)�errors)�
FirewallError)�logc C s t sttjd��dS )zNCheck function to raise a MISSING_IMPORT error if the import of NM failed
zgi.repository.NM = 1.0N)� _nm_importedr
r ZMISSING_IMPORT� r r �/usr/lib/python3.6/fw_nm.pyr 0 s c C s t S )znReturns true if NM has been properly imported
@return True if import was successful, False otherwirse
)r r r r r r 6 s c C s t stjjd�a t S )z�Returns the NM client object or None if the import of NM failed
@return NM.Client instance if import was successful, None otherwise
N)�
_nm_clientr ZClient�newr r r r �
nm_get_client< s r c C s� t � t� j| �}|dkr dS |j� }|dkr2dS y |j� tjjtjjB @ rPdS W n t k
rr |j
� rndS Y nX |j � }|dkr�d}|S )z�Get zone of connection from NM
@param connection name
@return zone string setting of connection, empty string if not set, None if connection is unknown
N� ) r r �get_connection_by_uuid�get_setting_connection� get_flagsr �SettingsConnectionFlags� NM_GENERATED� NM_VOLATILE�AttributeError� get_unsavedZget_zone)�
connection�con� setting_con�zoner r r r E s$
c C sV t � t� j|�}|dkr dS |j� }|dkr2dS | dkr>d} |jd| � |jdd�S )zSet the zone for a connection
@param zone name
@param connection name
@return True if zone was set, else False
NFr r! T)r r r r Z set_propertyZcommit_changes)r! r r r r r r r c s c C s~ | j � |j � t� t� j� }xX|D ]P}|j� r4q&|j� }|j� }|j� }|||< x |D ]}|j� }|rZ|| |< qZW q&W dS )znGet active connections from NM
@param connections return dict
@param connections_name return dict
N) �clearr r �get_active_connections�get_vpnZget_id�get_uuid� get_devices� get_ip_iface) Z connectionsZconnections_nameZactive_connections�
active_con�nameZuuidZdevices�dev�ip_ifacer r r r x s
c C s� t � g } x�t� j� D ]|}|j� r$qy&|j� }|j� tjjtjj B @ rHwW n t
k
rh |j � rdwY nX x&|j � D ]}|j
� }|rt| j|� qtW qW | S )zGGet active interfaces from NM
@returns list of interface names
)r r r# r$ �get_connectionr r r r r r r r& r' �append)Zactive_interfacesr( r r* r+ r r r �nm_get_interfaces� s$ r. c C s6 g }x,t � D ]"}t|�}| t|�kr |j|� q W |S )N)r. r r r- )r! Z
interfaces� interfaceZconnr r r �nm_get_interfaces_in_zone� s r0 c C s< t � x0t� j� D ]"}|j� }|dkr(q|| kr|S qW dS )zzGet device from NM which has the given IP interface
@param interface name
@returns NM.Device instance or None
N)r r r& r' )r/ �devicer+ r r r �nm_get_device_by_ip_iface� s r2 c C sx t � t| �}|dkrdS |j� }|dkr.dS y |j� }|j� tjj@ rLdS W n tk
rn |j � rjdS Y nX |j
� S )z�Get connection from NM that is using the interface
@param interface name
@returns connection that is using interface or None
N) r r2 Zget_active_connectionr, r r r r r r r% )r/ r1 r( r r r r r � s
c C sR t sd S y&tj� } | jtjtj�}|j}~~ |S tk
rL t j
d� Y nX d S )Nz(Failed to get bus name of NetworkManager) r �dbusZ SystemBusZ
get_objectr �DBUS_INTERFACEZ DBUS_PATHZbus_name� Exceptionr Zdebug2)Zbus�objr) r r r r � s c C s t sdS tjS )Nr )r r r4 r r r r r � s ) �__doc__�__all__ZgiZ
gi.repositoryr
Zrequire_version�
ValueErrorr r � ImportError�Errorr Zfirewallr Zfirewall.errorsr
Zfirewall.core.loggerr r3 r r r r r r r. r0 r2 r r r r r r r �<module> s@
core/__pycache__/fw_ifcfg.cpython-36.pyc 0000644 00000002613 15035135173 0014111 0 ustar 00 3
��g
� @ sT d Z ddgZddlZddlZddlmZ ddlmZ ddlm Z dd� Z
d d� Z dS )
z.Functions to search for and change ifcfg files�search_ifcfg_of_interface�ifcfg_set_zone_of_interface� N)�config)�log)�ifcfgc C s� t jjtj�sdS xttt jtj��D ]`}|jd�s4q$xd
D ]}|j|�r:q:q:W d |krXq$t d
tj|f �}|j
� |j d �| kr$|S q$W d tj| f }t jj|�r�t |�}|j
� |S dS )z6search ifcfg file for the interface in config.IFCFGDIRNzifcfg-�.bak�.orig�.rpmnew�.rpmorig�.rpmsave�-range�.z%s/%sZDEVICEz %s/ifcfg-%s)r r r r
r r ) �os�path�existsr ZIFCFGDIR�sorted�listdir�
startswith�endswithr �read�get)� interface�filenameZignored�
ifcfg_file� r � /usr/lib/python3.6/fw_ifcfg.pyr ! s*
c C sn | dkr d} t |�}|dk rj|jd�| krj|jd�dko>| dk rjtjd| |jf � |jd| � |j� dS )zYSet zone (ZONE=<zone>) in the ifcfg file that uses the interface
(DEVICE=<interface>)N� ZZONEzSetting ZONE=%s in '%s')r r r Zdebug1r �set�write)Zzoner r r r r r ? s ) �__doc__�__all__r Zos.pathZfirewallr Zfirewall.core.loggerr Zfirewall.core.io.ifcfgr r r r r r r �<module> s core/__pycache__/watcher.cpython-36.pyc 0000644 00000005256 15035135173 0014002 0 ustar 00 3
��g� � @ s* d gZ ddlmZmZ G dd � d e�ZdS )�Watcher� )�Gio�GLibc @ sd e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dS )r c C s" || _ || _i | _i | _g | _d S )N)� _callback�_timeout� _monitors� _timeouts�_blocked)�self�callbackZtimeout� r � /usr/lib/python3.6/watcher.py�__init__ s
zWatcher.__init__c C s: t jj|�}|jt jjd �| j|< | j| jd| j� d S )N�changed) r �File� new_for_pathZmonitor_directory�FileMonitorFlags�NONEr �connect�_file_changed_cb)r
Z directory�gfiler r r
�
add_watch_dir" s zWatcher.add_watch_dirc C s: t jj|�}|jt jjd �| j|< | j| jd| j� d S )Nr ) r r r Z monitor_filer r r r r )r
�filenamer r r r
�add_watch_file( s zWatcher.add_watch_filec C s
| j j� S )N)r �keys)r
r r r
� get_watches. s zWatcher.get_watchesc C s
|| j kS )N)r )r
r r r r
� has_watch1 s zWatcher.has_watchc C s | j |= d S )N)r )r
r r r r
� remove_watch4 s zWatcher.remove_watchc C s || j kr| j j|� d S )N)r �append)r
r r r r
� block_source7 s
zWatcher.block_sourcec C s || j kr| j j|� d S )N)r �remove)r
r r r r
�unblock_source; s
zWatcher.unblock_sourcec C s4 x.t | jj� �D ] }tj| j| � | j|= qW d S )N)�listr r r �
source_remove)r
r r r r
�clear_timeouts? s zWatcher.clear_timeoutsc C s || j kr| j|� | j|= d S )N)r r r )r
r r r r
�_call_callbackD s
zWatcher._call_callbackc C s� |j � }|| jkr8|| jkr4tj| j| � | j|= d S |tjjksh|tjjksh|tjj ksh|tjj
kr�|| jkr�tj| j| � | j|= tj | j | j
|�| j|< d S )N)Zget_parse_namer r r r# r ZFileMonitorEventZCHANGEDZCREATEDZDELETEDZATTRIBUTE_CHANGEDZtimeout_add_secondsr r% )r
ZmonitorZgio_fileZgio_other_fileZeventr r r r
r I s
zWatcher._file_changed_cbN)�__name__�
__module__� __qualname__r r r r r r r r! r$ r% r r r r r
r s N)�__all__Z
gi.repositoryr r �objectr r r r r
�<module> s core/__pycache__/fw_ipset.cpython-36.opt-1.pyc 0000644 00000016503 15035135173 0015121 0 ustar 00 3
��g�% � @ sf d Z dgZddlmZ ddlmZmZmZm Z ddl
m Z ddl m
Z
ddlmZ G dd� de�Zd S )
z
ipset backend�
FirewallIPSet� )�log)� remove_default_create_options�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�IPSet)�errors)�
FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z d4dd�Z
dd� Z dd� Z d5dd�Z
dd� Zdd� Zd d � Zd6d d �Zd!d"� Zd#d$� Zd%d&� Zd7d'd(�Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3S )8r c C s || _ i | _d S )N)�_fw�_ipsets)�self�fw� r � /usr/lib/python3.6/fw_ipset.py�__init__# s zFirewallIPSet.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r
r r r �__repr__' s zFirewallIPSet.__repr__c C s | j j� d S )N)r �clear)r
r r r �cleanup, s zFirewallIPSet.cleanupc C s || j � krttj|��d S )N)�
get_ipsetsr
r Z
INVALID_IPSET)r
�namer r r � check_ipset/ s zFirewallIPSet.check_ipsetc C s || j � kS )N)r )r
r r r r � query_ipset3 s zFirewallIPSet.query_ipsetc C s t | jj� �S )N)�sortedr �keys)r
r r r r 6 s zFirewallIPSet.get_ipsetsc C s t | j�dkS )Nr )�lenr )r
r r r �
has_ipsets9 s zFirewallIPSet.has_ipsetsFc C s& | j |� | j| }|r"| j|� |S )N)r r �check_applied_obj)r
r �applied�objr r r � get_ipset< s
zFirewallIPSet.get_ipsetc C s4 g }| j jr|j| j j� | j jr0|j| j j� |S )N)r Znftables_enabled�appendZnftables_backendZ
ipset_enabledZ
ipset_backend)r
�backendsr r r r# C s zFirewallIPSet.backendsc C s0 |j | jjkr ttjd|j ��|| j|j< d S )Nz '%s' is not supported by ipset.)�typer Zipset_supported_typesr
r Z INVALID_TYPEr r )r
r r r r � add_ipsetK s zFirewallIPSet.add_ipsetc C s� | j | }|jrh| rhy x| j� D ]}|j|� q"W W qt tk
rd } zttj|��W Y d d }~X qtX n tj d|� | j |= d S )Nz,Keeping ipset '%s' because of timeout option)
r r r# � set_destroy� Exceptionr
r �COMMAND_FAILEDr �debug1)r
r Zkeepr �backend�msgr r r � remove_ipsetQ s
zFirewallIPSet.remove_ipsetc < C s$ | j | }�x| j� D �]}|jdkr�|j� }||kr�d|jksv|jd dksv|j|| d ksvt|j�|| d kr�y|j|� W n. tk
r� } zt t
j |��W Y d d }~X nX | j j
�r�y|j|j|j|j� W n0 tk
�r } zt t
j |��W Y d d }~X n&X d|_d|jk�r,|jd dk�r,qy|j|j� W n0 tk
�rl } zt t
j |��W Y d d }~X nX x�|jD ]J}y|j|j|� W n0 tk
�r� } zt t
j |��W Y d d }~X nX �qvW qy |j|j|j|j|jd � W n0 tk
�r } zt t
j |��W Y d d }~X qX d|_qW d S )N�ipset�timeout�0r � T)r r# r Zset_get_active_terse�optionsr$ �rm_def_cr_optsr& r' r
r r( r �_individual_callsZ
set_creater � set_flush�entries�set_add� set_restore)r
r r r* Zactiver+ �entryr r r � apply_ipset] sL
&
zFirewallIPSet.apply_ipsetc C s> x8| j � D ],}| j| }d|_tjd| � | j|� q
W d S )NFzApplying ipset '%s')r r r r r) r9 )r
r r r r r � apply_ipsets� s
zFirewallIPSet.apply_ipsetsc C s� xz| j � D ]n}|jdkrq
x\| j� D ]P}y| j|� |j|� W q$ tk
rr } z|jtjkrb|�W Y d d }~X q$X q$W q
W d S )NZnftables) r# r r �
check_appliedr& r
�coder � NOT_APPLIED)r
r* r- r+ r r r �flush� s
zFirewallIPSet.flushTc C s | j ||d�jS )N)r )r! r$ )r
r r r r r �get_type� s zFirewallIPSet.get_typec C s t | j|dd�jjd��S )NT)r �,)r r! r$ �split)r
r r r r �
get_dimension� s zFirewallIPSet.get_dimensionc C s | j |�}| j|� d S )N)r! r )r
r r r r r r; � s
zFirewallIPSet.check_appliedc C s |j sttj|j��d S )N)r r
r r= r )r
r r r r r � s z FirewallIPSet.check_applied_objc C s. | j ||d�}d|jkr*|jd dkr*dS dS )N)r ZfamilyZinet6Zipv6Zipv4)r! r1 )r
r r r r r r �
get_family� s
zFirewallIPSet.get_familyc C s� | j |dd�}t|�}tj||j|j� ||jkrFttj d||f ��t
||j� y$x | j � D ]}|j |j
|� q^W W n. tk
r� } zttj|��W Y d d }~X n&X d|jks�|jd dkr�|jj|� d S )NT)r z'%s' already is in '%s'r. r/ )r! r r � check_entryr1 r$ r5 r
r ZALREADY_ENABLEDr r# r6 r r' r( r" )r
r r8 r r* r+ r r r � add_entry� s
zFirewallIPSet.add_entryc C s� | j |dd�}t|�}||jkr4ttjd||f ��y$x | j� D ]}|j|j|� q@W W n. t k
r� } zttj
|��W Y d d }~X n&X d|j ks�|j d dkr�|jj |� d S )NT)r z'%s' not in '%s'r. r/ )
r! r r5 r
r Z NOT_ENABLEDr# Z
set_deleter r' r( r1 �remove)r
r r8 r r* r+ r r r � remove_entry� s
zFirewallIPSet.remove_entryc C sD | j |dd�}t|�}d|jkr:|jd dkr:ttj|��||jkS )NT)r r. r/ )r! r r1 r
r ZIPSET_WITH_TIMEOUTr5 )r
r r8 r r r r � query_entry� s
zFirewallIPSet.query_entryc C s | j |dd�}|jS )NT)r )r! r5 )r
r r r r r � get_entries� s zFirewallIPSet.get_entriesc C s@ | j |dd�}t|� x |D ]}tj||j|j� q W d|jksN|jd dkrT||_y"x | j� D ]}|j|j � q`W W n. t
k
r� } zt t j
|��W Y d d }~X nX d|_yXxR| j� D ]F}| jjr�x8|jD ]}|j|j |� q�W q�|j|j |j|j|jd � q�W W n0 t
k
�r4 } zt t j
|��W Y d d }~X nX d|_d S )NT)r r. r/ )r! r r rD r1 r$ r5 r# r4 r r' r
r r( r r r3 r6 r7 )r
r r5 r r8 r* r+ r r r � set_entries� s.
zFirewallIPSet.set_entriesN)F)F)T)T)�__name__�
__module__� __qualname__r r r r r r r r! r# r% r, r9 r: r> r? rB r; r rC rE rG rH rI rJ r r r r r " s0
1
N)�__doc__�__all__Zfirewall.core.loggerr Zfirewall.core.ipsetr r2 r r r Zfirewall.core.io.ipsetr Zfirewallr Zfirewall.errorsr
�objectr r r r r �<module> s core/__pycache__/ipXtables.cpython-36.pyc 0000644 00000104137 15035135173 0014276 0 ustar 00 3
��g�� � @ s( d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m
Z
m Z m Z m
Z
mZmZ d dlmZ d dlmZmZmZmZmZ d dlmZmZmZm Z m Z m Z m Z d dl Z dZ!d d
d gd d
gd d
d d
d gd d
d
gd d
d gd�Z"ddd�Z#ddd�Z$dd� Z%dd� Z&dd� Z'G dd� de(�Z)G d d � d e)�Z*dS ) � N)�runProg)�log)�tempFile�readfile� splitArgs� check_mac�portStr�check_single_address�
check_address� normalizeIP6)�config)�
FirewallError�INVALID_PASSTHROUGH� INVALID_RULE�
UNKNOWN_ERROR� INVALID_ADDR)� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock� �INPUT�OUTPUT�FORWARD�
PREROUTING� POSTROUTING)�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited)�ipv4�ipv6�icmpz ipv6-icmpc C s� ddddddd�}| dd� }x~|D ]v}y|j |�}W n tk
rL w$Y nX |d
kr�yt||d � W n tk
r~ Y nX |j|d � || ||< q$W |S ) z Inverse valid rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insert� )r' r( )�index� Exception�int�pop)�args� replace_args�ret_args�arg�idx� r3 � /usr/lib/python3.6/ipXtables.py�common_reverse_rule9 s(
r5 c C s� ddddddd�}| dd� }x�|D ]x}y|j |�}W n tk
rL w$Y nX |d kr�yt||d � W n tk
r~ Y nX |j|d � || ||< |S W ttd
��dS ) z Reverse valid passthough rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insertr) zno '-A', '-I' or '-N' arg)r6 r7 )r* �
ValueErrorr, r- r
r )r. r/ r0 �xr2 r3 r3 r4 �common_reverse_passthrough^ s,
r: c C s� t | �} t ddddddddd d
d d d
dddddddg�}t| |@ �dkrbttdt| |@ �d ��t dddddd g�}t| |@ �dkr�ttd ��d S ) zZ Check if passthough rule is valid (only add, insert and new chain
rules are allowed) z-Cz--checkz-Dz--deletez-Rz --replacez-Lz--listz-Sz --list-rulesz-Fz--flushz-Zz--zeroz-Xz--delete-chainz-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedz-Az--appendz-Iz--insertz-Nz --new-chainzno '-A', '-I' or '-N' argN)�set�lenr
r �list)r. Z not_allowedZneededr3 r3 r4 �common_check_passthrough� s*
r> c @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d
� Z d d � Z
d
d� Z dd� Z dd� Z
dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zdhd"d#�Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zdid,d-�Zd.d/� Zdjd1d2�Z d3d4� Z d5d6� Z dkd8d9�Z dld:d;�Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dmdRdS�Z,dndTdU�Z-dodVdW�Z.dXdY� Z/dpdZd[�Z0dqd\d]�Z1drd^d_�Z2dsd`da�Z3dbdc� Z4ddde� Z5dfdg� Z6d!S )t� ip4tablesr$ Tc C sd || _ tj| j | _tjd| j | _| j� | _| j� | _ | j
� g | _ i | _ i | _
g | _i | _d S )Nz
%s-restore)�_fwr ZCOMMANDS�ipv�_command�_restore_command�_detect_wait_option� wait_option�_detect_restore_wait_option�restore_wait_option� fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache�
our_chains)�self�fwr3 r3 r4 �__init__� s
zip4tables.__init__c C s$ t jj| j�| _t jj| j�| _d S )N)�os�path�existsrB Zcommand_existsrC Zrestore_command_exists)rN r3 r3 r4 rH � s zip4tables.fill_existsc C s� | j r(| j |kr(| j gdd� |D � }ndd� |D �}tjd| j| jdj|�� t| j|�\}}|dkr�td| jdj|�|f ��|S )Nc S s g | ] }d | �qS )z%sr3 )�.0�itemr3 r3 r4 �
<listcomp>� s z#ip4tables.__run.<locals>.<listcomp>c S s g | ] }d | �qS )z%sr3 )rT rU r3 r3 r4 rV � s z %s: %s %s� r z'%s %s' failed: %s)rE r �debug2� __class__rB �joinr r8 )rN r. Z_args�status�retr3 r3 r4 Z__run� s zip4tables.__runc
C s< y|j |�}W n tk
r" dS X ||||d �< dS d S )NF� T)r* r8 )rN �rule�patternZ replacement�ir3 r3 r4 �
_rule_replace� s zip4tables._rule_replacec C s |t ko|t | kS )N)�BUILT_IN_CHAINS)rN rA �table�chainr3 r3 r4 �is_chain_builtin� s zip4tables.is_chain_builtinc C s2 d|g}|r|j d� n
|j d� |j |� |gS )Nz-tz-Nz-X)�append)rN �addrc rd r^ r3 r3 r4 �build_chain_rules� s
zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nz-tz-Iz-D)�str)rN rg rc rd r* r. r^ r3 r3 r4 �
build_rule� s zip4tables.build_rulec C s t |�S )N)r5 )rN r. r3 r3 r4 � reverse_rule� s zip4tables.reverse_rulec C s t |� d S )N)r> )rN r. r3 r3 r4 �check_passthrough� s zip4tables.check_passthroughc C s t |�S )N)r: )rN r. r3 r3 r4 �reverse_passthrough� s z ip4tables.reverse_passthroughc C s� d}y|j d�}W n tk
r& Y n X t|�|d krD||d }d }xLd
D ]D}y|j |�}W n tk
rt Y qNX t|�|d krN||d }qNW ||fS ) Nr# z-tr] �-A�--append�-I�--insert�-N� --new-chain)rn ro rp rq rr rs )r* r8 r< )rN r. rc r` rd �optr3 r3 r4 � passthrough_parse_table_chain� s$ z'ip4tables.passthrough_parse_table_chainc C s4 yH|j d�}|j|� |j|�}d|d kr:||d f}n ||d f}W nF tk
r� y |j d�}|j|� d }W n tk
r� d S X Y nX d}|d dkr�d }|r�| r�||kr�|j|� nn|�r0|� r�||kr�|j|� |jd d
� d� |j |�}n| jj�r d}nt|�}d|d< |j dd|d � d S )Nz%%ZONE_SOURCE%%z-m� � � z%%ZONE_INTERFACE%%Tr �-D�--deleteFc S s | d S )Nr r3 )r9 r3 r3 r4 �<lambda>& s z4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyz-Ir) z%dr] )ry rz )
r* r- r8 �removerf �sortr@ �_allow_zone_driftingr< �insert)rN r^ rL r` �zoneZ zone_source�rule_addr* r3 r3 r4 �_run_replace_zone_source s>
z"ip4tables._run_replace_zone_sourcec C s y|j |�}W n tk
r$ Y �n�X d}d}d}|j|� |j|�}t|�tkr\ttd��d} xLdD ]D}
y|j |
�} W n tk
r� Y qfX t|�| d krf|| d } qfW xhdD ]`}
y|j |
�}W n tk
r� Y q�X t|�|d k� r�||d } |
dk�rd}|
dkr�d}q�W | | f} |�sp| |k�sP||| k�sP|| | dk�rZttd��|| | d8 < n�| |k�r�i || < ||| k�r�d|| |< d}
xHt || j
� �D ]4}||k�r�|�r�P |
|| | 7 }
||k�r�P �q�W || | d7 < d
||< |j |d d|
� dS )a
Change something like
-t filter -I public_IN %%RICH_RULE_PRIORITY%% 123
or
-t filter -A public_IN %%RICH_RULE_PRIORITY%% 321
into
-t filter -I public_IN 4
or
-t filter -I public_IN
TFr] z%priority must be followed by a numberr# �-t�--table�-A�--append�-I�--insert�-D�--deleter z*nonexistent or underflow of priority countr) z%dN���)r� r� )r� r� r� r� r� r� )r� r� )r� r� ) r* r8 r- �typer, r
r r< r �sorted�keysr� )rN r^ Zpriority_counts�tokenr` r� r� Zinsert_add_index�priorityrc rt �jrd r* �pr3 r3 r4 �_set_rule_replace_priority2 sj
z$ip4tables._set_rule_replace_priorityc C sP t � }i }tj| j�}tj| j�}tj| j�}�x�|D �]�}|d d � } | j| dddt| j g� | j| dt | j g� y| j
d�}
W n t k
r� Y n8X |dkr�q6|d$kr�d
d d |g| |
|
d
�< n
| j |
� | j
| |d� | j
| |d� | j| |� d} xZd%D ]R} y| j
| �}
W n t k
�r, Y n(X t| �|
d
k�r| j |
� | j |
�} �qW xhtt| ��D ]X}
xPtjD ]F}
|
| |
k�rt| |
jd��o�| |
jd� �rtd| |
| |
< �qtW �qhW |j| g �j| � q6W xR|D ]J} || }|jd| � x"|D ]} |jdj| �d � �q W |jd� �q�W |j� tj|j �}t j d| j | j d|j |j!f � g }| j"�rz|j| j"� |jd� t#| j ||j d �\}}t j$� d k�r
t%|j �}|d k �r
d
}
xH|D ]@}t j&d |
|f d
d d � |jd��s�t j&d!d
d"� |
d
7 }
�q�W tj'|j � |d k�r:t d#| j dj|�|f ��|| _|| _|| _d S )&Nz
%%REJECT%%�REJECTz
--reject-withz%%ICMP%%z %%LOGTYPE%%�off�unicast� broadcast� multicastz-m�pkttypez
--pkt-typer] z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%r# �-t�--table�"z"%s"z*%s
rW �
zCOMMIT
z %s: %s %sz%s: %dz-n)�stdinr) z%8d: %sr )�nofmt�nlr )r� z'%s %s' failed: %s)r� r� r� )r� r� )(r �copy�deepcopyrJ rK rL ra �DEFAULT_REJECT_TYPErA �ICMPr* r8 r- r� r� r< �range�stringZ
whitespace�
startswith�endswith�
setdefaultrf �writerZ �closerQ �stat�namer rX rY rC �st_sizerG r ZgetDebugLogLevelr Zdebug3�unlink)rN �rules�
log_denied� temp_fileZ table_rulesrJ rK rL Z_ruler^ r` rc rt �cr� r. r[ r\ �lines�liner3 r3 r4 � set_rules� s�
zip4tables.set_rulesc
C s� | j |dddt| j g� | j |dt| j g� y|jd�}W n tk
rR Y n:X |dkr`dS |dkr�d d d
|g|||d �< n
|j|� tj| j �}tj| j
�}tj| j �}| j ||d� | j ||d� | j
||� | j|�}|| _ || _
|| _ |S )Nz
%%REJECT%%r� z
--reject-withz%%ICMP%%z %%LOGTYPE%%r� r r� r� r� z-mr� z
--pkt-typer] z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%)r� r� r� )ra r� rA r� r* r8 r- r� r� rJ rK rL r� r� �_ip4tables__run)rN r^ r� r` rJ rK rL �outputr3 r3 r4 �set_rule� s.
zip4tables.set_ruleNc C s� g }|r|gnt j� }xx|D ]p}|| jkr6|j|� q y,| jd|ddg� | jj|� |j|� W q tk
r� tjd| j|f � Y q X q W |S )Nz-tz-Lz-nzA%s table '%s' does not exist (or not enough permission to check).) rb r� rI rf r� r8 r �debug1rA )rN rc r\ Ztablesr3 r3 r4 �get_available_tables s
z ip4tables.get_available_tablesc C s` d}t | jdddg�}|d dkr\d}t | jdddg�}|d dkrHd}tjd| j| j|� |S )Nr z-wz-Lz-nr z-w10z %s: %s will be using %s option.)r rB r rX rY )rN rE r\ r3 r3 r4 rD s z ip4tables._detect_wait_optionc C s� t � }|jd� |j� d}xJd D ]B}t| j|g|jd�}|d dkr"d|d kr"d |d kr"|}P q"W tjd
| j| j|� t j
|j� |S ) Nz#foor �-w�--wait=2)r� r zinvalid optionr] zunrecognized optionz %s: %s will be using %s option.)r� r� ) r r� r� r rC r� r rX rY rQ r� )rN r� rE Z test_optionr\ r3 r3 r4 rF " s
z%ip4tables._detect_restore_wait_optionc C sV i | _ i | _g | _g }x:tj� D ].}| j|�s0q x dD ]}|jd||g� q6W q W |S )N�-F�-X�-Zz-t)r� r� r� )rJ rK rL rb r� r� rf )rN r� rc �flagr3 r3 r4 �build_flush_rules5 s
zip4tables.build_flush_rulesc C sf g }|dkrdn|}xLt j� D ]@}| j|�s.q |dkr8q x$t | D ]}|jd|d||g� qBW q W |S )NZPANIC�DROPr" z-tz-P)rb r� r� rf )rN �policyr� �_policyrc rd r3 r3 r4 �build_set_policy_rulesD s
z ip4tables.build_set_policy_rulesc C s g }d}y"| j d| jdkr dnddg�}W nJ tk
rt } z.| jdkrVtjd| � ntjd| � W Y d d }~X nX |j� }d
}x�|D ]�}|r�|j� j� }|j� }xD|D ]<} | j d �r�| j
d �r�| d
d� }
n| }
|
|kr�|j |
� q�W | jdko�|j d��s| jdkr�|j d�r�d}q�W |S )zQReturn ICMP types that are supported by the iptables/ip6tables command and kernelr z-pr$ r& z ipv6-icmpz--helpziptables error: %szip6tables error: %sNF�(�)r] zValid ICMP Types:r% zValid ICMPv6 Types:Tr� ) r� rA r8 r r� �
splitlines�strip�lower�splitr� r� rf ) rN rA r\ r� Zexr� Zin_typesr� Zsplitsr� r9 r3 r3 r4 �supported_icmp_typesP s4
z ip4tables.supported_icmp_typesc C s g S )Nr3 )rN r3 r3 r4 �build_default_tablesq s z ip4tables.build_default_tablesr� c C s i }| j d�rpg |d< t� | jd< xLtd D ]@}|d jd| � |d jd||f � | jd jd| � q,W | j d��r\g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dkr�xt| jjr�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �qW q�W | j d��rNg |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dk�r�xv| jj�r�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �q�W �q�W | j d��r@g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |d9k�rxxv| jj�r�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �q�W �qxW g |d< t� | jd< |d jd� |d jd� |d jd� |d jd� | jd jtd�� xf| jj�r�ddd d
gndd d
gD ]B}|d jd| � |d jd| � | jd jtd| �� �q�W |dk�r |d jd� |d jd � |dk�rF|d jd � |d jd � |d jd � |d jd � |d jd!� |d jd"� | jd jtd#�� xJd:D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �q�W xzd;D ]r}xj| jj�r
dd gnd gD ]N}|d jd)||f � |d jd*||f � | jd jtd+||f �� �qW �q�W xJd<D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �qnW |dk�r�|d jd,� |d jd-� |dk�r�|d jd.� |d jd/� |d d0d1d2d3g7 < | jd jtd4�� xJd=D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q2W xJd>D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q~W g }xJ|D ]B}|| j � k�r�q�x(|| D ] }|jd8|gt |� � �q�W �q�W |S )?Nr z -N %s_directz-A %s -j %s_directz %s_directr r � POLICIES_preZ ZONES_SOURCEZZONES�
POLICIES_postz-N %s_%sz-A %s -j %s_%sz%s_%sr! r" r r# zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%sz-A INPUT -j INPUT_%szINPUT_%sr� z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_directz
-N FORWARD_%sz-A FORWARD -j FORWARD_%sz
FORWARD_%s�IN�OUTz-N FORWARD_%s_%sz-A FORWARD -j FORWARD_%s_%sz
FORWARD_%s_%sz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ
OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sz-t)r r )r� )r� r� )r� )r� )r� )
r� r; rM rb rf rg r@ r �updater ) rN r� Z
default_rulesrd Zdispatch_suffix� directionZfinal_default_rulesrc r^ r3 r3 r4 �build_default_rulesu s�
$(
&*
&* &
(
"z ip4tables.build_default_rulesc C sf |dkrdddhS |dkr,d| j � kr,dhS |dkrHd| j � krHddhS |d krbd | j � krbdhS i S )
Nr# r �
FORWARD_IN� FORWARD_OUTr! r r" r r )r� )rN rc r3 r3 r4 �get_zone_table_chains� s
z ip4tables.get_zone_table_chainsc s� | j jj|���jdk r dnd��dkr4�dkr4dnd} | j jj|�t| �� g }
g } x|D ]} |
jd| g� qZW x|D ]} | jd | g� qvW xB|D ]:}
| j jj|
�}|dkr�| j |� r�q�|
j| j
d |
�� q�W x\|D ]T}
| j jj|
�}|dk�r| j |� �rq�t |
��r�dk�rq�| j| j
d|
�� q�W � �����fdd�}g }|
�r�x�|
D ]F}| �r�x8| D ]}|j|||�� �qdW n|�r�n|j||d �� �qTW nH|�r�n@| �r�x8| D ]}|j|d |�� �q�W n|�r�n|j|d d �� |S )Nr �pre�postr" r TFz-iz-or$ r% z-sr� r z-dc sV ddd�� }d�|d��f d�j g}| r6|j| � |rD|j|� |jd� g� |S )Nz-Az-D)TFz-tz%s_POLICIES_%sz%%POLICY_PRIORITY%%z-j)r� �extend)�ingress_fragment�egress_fragment�add_delr^ )r� rd � chain_suffix�enable�p_objrc r3 r4 � _generate_policy_dispatch_rule s
zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule)r$ r% )r$ r% )r r� r ) r@ r� Z
get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXrf r� Z check_source�is_ipv_supported�_rule_addr_fragmentr )rN r� r� rc rd Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragments� interface�addrrA r� r� r� r� r3 )r� rd r� r� r� rc r4 �!build_policy_ingress_egress_rules� sR
z+ip4tables.build_policy_ingress_egress_rulesFc
C s� |dkr|dkrdnd}| j jj||t|d�} ddddddd�| }
d } |rb| rbd
d | d g} n,|rtd
d | g} ndd | g} |s�| d g7 } | d||
|| | g7 } | gS )Nr" r TF)r� z-iz-o)r r r r� r� r z-gz-Iz%s_ZONESz%%ZONE_INTERFACE%%z-Az-Dz-t)r@ r� r� r� )
rN r� r� r� r� rc rd rf r� r� rt �actionr^ r3 r3 r4 �!build_zone_source_interface_rulesK s&
z+ip4tables.build_zone_source_interface_rulesc C s� |j d�rP|dd � }|dkr$d}nd}dj|g| jjj|� �}ddd ||gS t|�rz|dkrjttd
��dd d |j� gS t d
|�r�t
|�}n,t d
|�r�|j d�}t
|d �d |d }||gS d S )Nzipset:� z-d�dst�src�,z-mr; z --match-setz Can't match a destination MAC.�macz --mac-sourcer% �/r r] )
r� rZ r@ �ipsetZ
get_dimensionr r
r �upperr r r
r� )rN rt �address�invertr� �flags�
addr_splitr3 r3 r4 r� e s"
z ip4tables._rule_addr_fragmentc
C s� ddd�| }|dkr"|dkr"dnd}| j jj||t|d�} d d
d d d
d
d �| }
| j jrdd | } nd
| } t|�r�|dkr�g S || d|d|g} | j| j|
|�� | jd| g� | gS )Nz-Iz-D)TFr" r TF)r� z-sz-d)r r r r� r� r z%s_ZONES_SOURCEz%s_ZONESr� r z%%ZONE_SOURCE%%z-tz-g)r r� r )r@ r� r� r� r r r� r� )
rN r� r� r� r� rc rd r� r� r� rt Zzone_dispatch_chainr^ r3 r3 r4 � build_zone_source_address_rules{ s&
z)ip4tables.build_zone_source_address_rulesc C s> ddd�| }ddd�| }|dkr0|dkr0dnd }| j jj||t|d
�}| j| jt|d | d | d
| d| d| g�� g } | j||d|g� | j|d
| d|g� | j|d | d|g� | j|d | d|g� | j|d| d|g� | j|d| d|g� | j||d|dd
| g� | j||d|dd | g� | j||d|dd | g� | j||d|dd| g� | j||d|dd| g� | j jj| j }
| j j
� dk�r|dk�r|
d k�r�| j||d|ddddd| g � |
dk�r| j||d|ddddd| g � |dk�r,|
d k�r,| j||d|d|
g� |�s:| j � | S ) Nz-Nz-X)TFz-Az-Dr" r TF)r� z%s_logz%s_denyz%s_prez%s_postz%s_allowz-tz-jr� r# r� �
%%REJECT%%z %%LOGTYPE%%�LOGz --log-prefixz
"%s_REJECT: "r� z "%s_DROP: "�ACCEPT)r� r� )r� r� r� r� ) r@ r� r� r� rM r� r; rf Z _policies�target�get_log_denied�reverse) rN r� r� rc rd Z
add_del_chainZ add_del_ruler� r� r� r� r3 r3 r4 �build_policy_chain_rules� sN
z"ip4tables.build_policy_chain_rulesc C s2 |sg S ddd|j g}|jd k r.|d|jg7 }|S )Nz-m�limitz--limitz
--limit-burst)�valueZburst)rN r �sr3 r3 r4 � _rule_limit� s
zip4tables._rule_limitc C s� t |j�tttgkrn<|jrHt |j�tttt gkrRt
t dt |j� ��n
t
t d��|j dkr�t |j�ttgks�t |j�tt gkr�dS t |j�tgks�t |j�ttgkr�dS n|j dk r�dS dS d S )NzUnknown action %szNo rule action specified.r �allowZdenyr� r� )
r� �elementr r r r� r r r r r
r r� )rN � rich_ruler3 r3 r4 �_rich_rule_chain_suffix� s
z!ip4tables._rich_rule_chain_suffixc C s> |j r|j rttd��|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r� r� )r �auditr
r r� )rN r r3 r3 r4 � _rich_rule_chain_suffix_from_log� s
z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr z%%RICH_RULE_PRIORITY%%)r� )rN r r3 r3 r4 � _rich_rule_priority_fragment� s
z&ip4tables._rich_rule_priority_fragmentc
C s� |j s
g S | jjj||t�}ddd�| }| j|�}d||d||f g} | | j|�7 } | |ddg 7 } |j jr�| dd |j j g7 } |j jr�| d
d |j j g7 } | | j |j j
�7 } | S ) Nz-Az-D)TFz-tz%s_%sz-jr� z --log-prefixz'%s'z --log-levelz%s) r r@ r� r� r� r r �prefix�levelr r )
rN r� r r� rc �
rule_fragmentr� r� r� r^ r3 r3 r4 �_rich_rule_log� s
zip4tables._rich_rule_logc C s� |j s
g S ddd�| }| jjj||t�}| j|�}d||d||f g} | | j|�7 } | |7 } t|j�t krrd}
n,t|j�t
kr�d}
nt|j�t kr�d}
nd }
| d
d d |
g7 } | | j |j j
�7 } | S )
Nz-Az-D)TFz-tz%s_%sZacceptZrejectZdrop�unknownz-jZAUDITz--type)r
r@ r� r� r� r r r� r� r r r r r ) rN r� r r� rc r r� r� r� r^ Z_typer3 r3 r4 �_rich_rule_audit s$
zip4tables._rich_rule_auditc C s2 |j s
g S ddd�| }| jjj||t�}| j|�}d||f } t|j �tkrXddg}
n�t|j �tkr�ddg}
|j jr�|
d|j jg7 }
nnt|j �t kr�dd g}
nVt|j �t
kr�d
}| jjj||t�}d||f } dd d |j j g}
nt t
d
t|j � ��d||| g} | | j|�7 } | ||
7 } | | j|j j�7 } | S )Nz-Az-D)TFz%s_%sz-jr� r� z
--reject-withr� r! �MARKz --set-xmarkzUnknown action %sz-t)r� r@ r� r� r� r r� r r r r r; r
r r r r ) rN r� r r� rc r r� r� r� rd Z rule_actionr^ r3 r3 r4 �_rich_rule_action$ s4
zip4tables._rich_rule_actionc C s� |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }q�td|j �r||j jd�}|dt|d �d |d g7 }q�|d|j g7 }nD|jr�|ddg7 }|jr�|jd� | jj j
|jd �}|d
|j|g7 }|S ) N�!r% z-dr� r r] z-mr; r� z --match-set) r� r� rf r r r
r� r� r@ r� �_ipset_match_flags)rN Z rich_destr r� r� r3 r3 r4 � _rich_rule_destination_fragmentF s&
"
z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }nHtd|j �r||j jd�}|dt|d �d |d g7 }n|d|j g7 }n�t|d�r�|jr�|ddg7 }|jr�|jd� |d |jg7 }nPt|d
�o�|j �r|dd g7 }|jr�|jd� | j
j j |j d �}|d
|j |g7 }|S )Nr r% z-sr� r r] r� z-mz --mac-sourcer� r; r� z --match-set)
r� r� rf r r r
r� �hasattrr� r� r@ r� r )rN Z rich_sourcer r� r� r3 r3 r4 �_rich_rule_source_fragment^ s0
"
z$ip4tables._rich_rule_source_fragmentc C s ddd�| }d}| j jj||t�} d|g}
|rD|
ddt|� g7 }
|rT|
d|g7 }
|rx|
| j|j�7 }
|
| j|j�7 }
| s�t |j
�t kr�|
d d
d d g7 }
g } |r�| j | j
|||||
�� | j | j|||||
�� | j | j|||||
�� n"| j |d
| d|g|
ddg � | S )Nz-Az-D)TFr# z-pz--dportz%sz-dz-m� conntrackz --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r � destinationr �sourcer� r� r rf r r r ) rN r� r� �proto�portr r r� rc r� r r� r3 r3 r4 �build_policy_ports_rules{ s* z"ip4tables.build_policy_ports_rulesc C s� ddd�| }d}| j jj||t�}d|g} |r<| d|g7 } |r`| | j|j�7 } | | j|j�7 } | stt|j �t
kr�| ddd d
g7 } g }
|r�|
j | j ||||| �� |
j | j
||||| �� |
j | j||||| �� n"|
j |d | d |g| d
dg � |
S )Nz-Az-D)TFr# z-pz-dz-mr z --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r r r r� r� r rf r r r ) rN r� r� �protocolr r r� rc r� r r� r3 r3 r4 �build_policy_protocol_rules� s& z%ip4tables.build_policy_protocol_rulesc C s ddd�| }d}| j jj||t�} d|g}
|rD|
ddt|� g7 }
|rT|
d|g7 }
|rx|
| j|j�7 }
|
| j|j�7 }
| s�t |j
�t kr�|
d d
d d g7 }
g } |r�| j | j
|||||
�� | j | j|||||
�� | j | j|||||
�� n"| j |d
| d|g|
ddg � | S )Nz-Az-D)TFr# z-pz--sportz%sz-dz-mr z --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r r r r r� r� r rf r r r ) rN r� r� r r r r r� rc r� r r� r3 r3 r4 � build_policy_source_ports_rules� s* z)ip4tables.build_policy_source_ports_rulesc C sv d}| j jj||t�} ddd�| }
|
d| ddd|g} |rP| dd t|� g7 } |r`| d
|g7 } | d d d
|g7 } | gS )Nr z-Az-D)TFz%s_allowz-tz-pz--dportz%sz-dz-jZCTz--helper)r@ r� r� r� r ) rN r� r� r r r Z helper_nameZmodule_short_namerc r� r� r^ r3 r3 r4 � build_policy_helper_ports_rules� s z)ip4tables.build_policy_helper_ports_rulesc
C s� ddd�| }| j jj||t�}g } |rH| jdd|d| d|dd g� n6t|�rTg S | jdd|d| g| jd
|� dd g � | S ) Nz-Az-D)TFz-tr# z%s_allowz-oz-jr� z-d)r@ r� r� r� rf r r� )
rN r� r� r� rc r� r r� r� r� r3 r3 r4 �build_zone_forward_rules� s z"ip4tables.build_zone_forward_rulesc
C s, d}| j jj||tdd�}ddd�| }g }|rj| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}g } | j
dd|d ||f g| d
d d d
dg � g }|r�| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}d}| j jj||t�}| j
dd|d ||f g| ddddd
dg � | S )Nr" T)r� z-Az-D)TFr z-tz%s_%sr z-o�loz-jZ
MASQUERADEr# z-mr z --ctstatez
NEW,UNTRACKEDr� ) r@ r� r� r� r r r r r r rf )
rN r� r� r rc r� r� r r� r� r3 r3 r4 � build_policy_masquerade_rules� s6
z'ip4tables.build_policy_masquerade_rulesc
C s
d}| j jj||t�} ddd�| }
d} |rPtd|�rH| dt|� 7 } n| |7 } |rn|dkrn| dt|d � 7 } g } |r�| j|�}
| j|�} | | j |j
�7 } | | j |j �7 } nd
}
g }|r�|j
| j|||d| �� |j
d d|
d | |
f g| d
|dt|�ddd| g � |S )Nr" z-Az-D)TFr r% z[%s]z:%s�-r z-tz%s_%sz-pz--dportz-jZDNATz--to-destination)r@ r� r� r� r r r r r r r r r rf r )rN r� r� r r ZtoportZtoaddrr rc r� r� Ztor r� r� r3 r3 r4 � build_policy_forward_port_rules s2
z)ip4tables.build_policy_forward_port_rulesc C s� d}| j jj||t�}ddd�| }| jdkrFddg}ddd |jg} ndd
g}dd d |jg} g }
| j jj|�r|d
| } d} n d| } d} g }
|r�|
| j|j�7 }
|
| j |j
�7 }
|
|| 7 }
|�rP|
j | j |||||
�� |
j | j
|||||
�� |j�r|
j | j|||||
�� n:| j|�}|
j d||d||f g| j|� |
ddg � n`| j j� dk�r�| dk�r�|
j || d|g|
ddddd| g � |
j || d|g|
d| g � |
S )Nr# z-Az-D)TFr$ z-pr& z-mz --icmp-typez ipv6-icmpZicmp6z
--icmpv6-typez%s_allowr� z%s_denyz
%%REJECT%%z-tz%s_%sz-jr� z %%LOGTYPE%%r� z --log-prefixz"%s_ICMP_BLOCK: ")r@ r� r� r� rA r� �query_icmp_block_inversionr r r r rf r r r� r r r r� )rN r� r� Zictr rc r� r� r �matchr� Z final_chainZ final_targetr r� r3 r3 r4 � build_policy_icmp_block_rules3 sJ
z'ip4tables.build_policy_icmp_block_rulesc C s� d}| j jj||t�}g }d}| j jj|�r�d}| j j� dkr�|rRd|t|�g}nd|g}|d|dd d
d d d
d| g }|j|� |d7 }nd}|r�d|t|�g}nd|g}|d|dd d |g }|j|� |S )Nr# r� z
%%REJECT%%r� z-Iz-Dz-tz-pz%%ICMP%%z %%LOGTYPE%%z-jr� z --log-prefixz"%s_ICMP_BLOCK: "r] r� )r@ r� r� r� r) r� ri rf ) rN r� r� rc r� r� Zrule_idxZ
ibi_targetr^ r3 r3 r4 �'build_policy_icmp_block_inversion_rulesd s.
z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| j |j�7 }|| j|j�7 }g }|j| j|||||�� |j| j|||||�� |j| j|||||�� |S )Nr# )r r r r rf r r r )rN r� r� r rc r r� r3 r3 r4 �*build_policy_rich_source_destination_rules� s z4ip4tables.build_policy_rich_source_destination_rulesc C s
|| j kS )N)rA )rN rA r3 r3 r4 r� � s zip4tables.is_ipv_supported)N)N)r� )F)F)NN)NN)NN)NN)N)N)N)7�__name__�
__module__� __qualname__rA r� Zpolicies_supportedrP rH r� ra re rh rj rk rl rm ru r� r� r� r� r� rD rF r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r r! r" r# r$ r& r( r+ r, r- r� r3 r3 r3 r4 r? � sh
)Pa#
!
zN
0 "
&
!
1"r? c @ s& e Zd ZdZd Zddd�Zdd� ZdS ) � ip6tablesr% Fc
C s� g }|j ddddddddd d
g
� |d krL|j ddddddddd d d
dg � |j dddddddd dg � |j dddddddd dg � |S )Nz-Ir z-tr! z-mZrpfilterz--invertz --validmarkz-jr� r� r� z --log-prefixzrpfilter_DROP: z-pz ipv6-icmpz$--icmpv6-type=neighbour-solicitationr� z"--icmpv6-type=router-advertisement)rf )rN r� r� r3 r3 r4 �build_rpfilter_rules� s$
z ip6tables.build_rpfilter_rulesc C s� ddddddddd g }d
}| j d j|� g }|jd d d
|g� xT|D ]L}|jd d d|d|ddddg
� | jjd krF|jd d d|d|ddddg
� qFW |jd d dddd|g� |jd d dddd|g� |S ) Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r# z-tz-Nz-Iz-dz-jr� z
--reject-withz addr-unreachr� �allr� z --log-prefixz"RFC3964_IPv4_REJECT: "r �4r )r� r3 )rM rg rf r@ Z _log_denied)rN Z
daddr_listZ
chain_namer� Zdaddrr3 r3 r4 �build_rfc3964_ipv4_rules� s4
z"ip6tables.build_rfc3964_ipv4_rulesN)F)r. r/ r0 rA r� r2 r5 r3 r3 r3 r4 r1 � s
r1 )+Zos.pathrQ r� Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r
r Zfirewallr Zfirewall.errorsr
r r r r Zfirewall.core.richr r r r r r r r� r� rb r� r� r5 r: r> �objectr? r1 r3 r3 r3 r4 �<module> s@ ( $ %* x core/__pycache__/fw_policy.cpython-36.pyc 0000644 00000154111 15035135173 0014333 0 ustar 00 3
��g=V � @ s� d dl Z d dlZd dlmZ d dlmZmZmZmZm Z m
Z
m Z m Z m
Z
mZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlm Z d dl m Z d dl m Z d dl!m"Z" d d l#m$Z$ G d
d � d e%�Z&dS ) � N)�log)
�portStr� checkIPnMask�
checkIP6nMask�
checkProtocol�enable_ip_forwarding�check_single_address�portInPortRange�get_nf_conntrack_short_name�coalescePortRange�breakPortRange) � Rich_Rule� Rich_Accept� Rich_Service� Rich_Port�
Rich_Protocol�Rich_Masquerade�Rich_ForwardPort�Rich_SourcePort�Rich_IcmpBlock�
Rich_IcmpType� Rich_Mark)�FirewallTransaction)�errors)�
FirewallError)�LastUpdatedOrderedDict)�SOURCE_IPSET_TYPESc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
�d dd�Zdd� Zd d � Zd d � Z�d d d!�Z�d
d"d#�Z�dd$d%�Zd&d'� Zd(d)� Zd*d+� Zd,d-� Z�dd0d1�Zd2d3� Z�dd4d5�Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z �dd@dA�Z!dBdC� Z"�ddDdE�Z#dFdG� Z$dHdI� Z%dJdK� Z&dLdM� Z'dNdO� Z(dPdQ� Z)dRdS� Z*�ddTdU�Z+dVdW� Z,�ddXdY�Z-dZd[� Z.d\d]� Z/d^d_� Z0d`da� Z1dbdc� Z2�dddde�Z3dfdg� Z4�ddhdi�Z5djdk� Z6dldm� Z7dndo� Z8dpdq� Z9drds� Z:dtdu� Z;dvdw� Z<�ddxdy�Z=dzd{� Z>�dd|d}�Z?d~d� Z@d�d�� ZAd�d�� ZBd�d�� ZCd�d�� ZD�dd�d��ZEd�d�� ZF�dd�d��ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZK�dd�d��ZLd�d�� ZM�d d�d��ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZR�d d�d��ZSd�d�� ZT�d d�d��ZUd�d�� ZVd�d�� ZW�d d�d��ZX�d d�d��ZY�d!d�d��ZZd�d�� Z[�d"d�d��Z\d�d�� Z]�d#d�d��Z^d�d�� Z_d�d�� Z`d�d�� Za�d$d�dÄZbd�dń Zc�d%d�dDŽZdd�dɄ Zed�d˄ Zfd�d̈́ Zgd�dτ Zh�d&d�dфZid�dӄ Zjd�dՄ Zk�d'd�dׄZld�dل Zmd�dۄ Znd�d݄ Zod�d߄ Zpd�d� Zqd�d� Zrd�d� Zsd�d� Ztd�d� Zu�d(d�d�Zv�d)d�d�Zwd�d� Zxd�d� Zyd�d� Zzd�d�� Z{�d*d�d��Z|d�d�� Z}d�d�� Z~d�d�� Zd�d�� Z��d �d� Z��d�d� Z��d�d� Z��d�d� Z��d+�d �d
�Z�dS (, �FirewallPolicyc C s || _ i | _i | _d S )N)�_fw�_chains� _policies)�self�fw� r# � /usr/lib/python3.6/fw_policy.py�__init__ s zFirewallPolicy.__init__c C s d| j | j| jf S )Nz
%s(%r, %r))� __class__r r )r! r# r# r$ �__repr__ s zFirewallPolicy.__repr__c C s | j j� | jj� d S )N)r �clearr )r! r# r# r$ �cleanup s
zFirewallPolicy.cleanupc C s
t | j�S )N)r r )r! r# r# r$ �new_transaction$ s z FirewallPolicy.new_transactionc C s t | jj� �S )N)�sortedr �keys)r! r# r# r$ � get_policies) s zFirewallPolicy.get_policiesc C s8 g }x*| j � D ] }| j|�}|js|j|� qW t|�S )N)r- �
get_policy�derived_from_zone�appendr+ )r! Zpolicies�p�p_objr# r# r$ �"get_policies_not_derived_from_zone, s
z1FirewallPolicy.get_policies_not_derived_from_zonec C s~ g }xt| j � D ]h}| j|�}t|d �t| jjj� �tddg�B @ rt|d �t| jjj� �tddg�B @ r|j|� qW |S )N�
ingress_zones�HOST�ANY� egress_zones)r3 � get_settings�setr �zoneZget_active_zonesr0 )r! Zactive_policies�policy�settingsr# r# r$ �)get_active_policies_not_derived_from_zone4 s
((z8FirewallPolicy.get_active_policies_not_derived_from_zonec C s | j j|�}| j| S )N)r � check_policyr )r! r; r1 r# r# r$ r. > s zFirewallPolicy.get_policyc C s, dd� dD �|_ || j|j< | j|j� d S )Nc S s i | ] }t � |�qS r# )r )�.0�xr# r# r$ �
<dictcomp>C s z-FirewallPolicy.add_policy.<locals>.<dictcomp>�services�ports�
masquerade�
forward_ports� source_ports� icmp_blocks�rules� protocols�icmp_block_inversionr4 r7 ) rB rC rD rE rF rG rH rI rJ r4 r7 )r< r �name�copy_permanent_to_runtime)r! �objr# r# r$ �
add_policyB s
zFirewallPolicy.add_policyc C s0 | j | }|jr| j|� |jj� | j |= d S )N)r �applied�unapply_policy_settingsr< r( )r! r; rM r# r# r$ �
remove_policyN s
z FirewallPolicy.remove_policyc C s� | j | }|jrd S x |jD ]}| j||dd� q W x |jD ]}| j||dd� q<W x|jD ]}| j||� q\W x |jD ]}| j |f|�� qxW x|j
D ]}| j ||� q�W xf|j D ]\}y| j
|f|�� W q� tk
�r } z$|jtjgkr�tj|� n|�W Y d d }~X q�X q�W x |jD ]}| j||� �q W xj|jD ]`}y| j|f|�� W nD tk
�r� } z&|jtjgk�r�tj|� n|�W Y d d }~X nX �q:W x |jD ]}| j||� �q�W |j�r�| j|� d S )NF)� allow_apply) r rO r4 �add_ingress_zoner7 �add_egress_zonerG �add_icmp_blockrE �add_forward_portrB � add_servicerC �add_portr �coder �ALREADY_ENABLEDr �warningrI � add_protocolrF �add_source_portrH �add_rulerD �add_masquerade)r! r; rM �args�errorr# r# r$ rL U sB
z(FirewallPolicy.copy_permanent_to_runtimeNc C sN xH| j � D ]<}| j| }|jr q
|| j� kr
tjd|� | j||d� q
W d S )NzApplying policy '%s')�use_transaction)r- r r/ r= r Zdebug1�apply_policy_settings)r! rb r; r2 r# r# r$ �apply_policies| s
z FirewallPolicy.apply_policiesc C s | j | }||_d S )N)r rO )r! r; rO rM r# r# r$ �set_policy_applied� s
z!FirewallPolicy.set_policy_appliedc C s t j � ||d�}|S )N)Zdate�sender�timeout)�time)r! rg rf �retr# r# r$ Z__gen_settings� s z FirewallPolicy.__gen_settingsc C s | j |�jS )N)r. r< )r! r; r# r# r$ r8 � s zFirewallPolicy.get_settingsc C sj | j j|�}| j| }|r |js.| r2|j r2d S |r<d|_|d krN| j� }n|}|r�x8|jsh| j|�n| j|�D ]\}}| j|d|||� qrW | j |�} |js�| j
|||� �xV| D �]L}
�xD| |
D �]6} |
dkr�| j ||| |� q�|
dkr�q�q�|
dk�r| j |||f| �� q�|
dk�r0| j
||| |� q�|
dk�rV| j||| d | d |� q�|
d k�rr| j||| |� q�|
d
k�r�| j||| d | d |� q�|
d k�r�| j|||� q�|
d k�r�| j||t| d
�|� q�|
dk�r�q�q�|
dk�r�q�q�tjd||
| � q�W q�W |�sRx<|j�s"| j|�n| j|�D ] \}}| j|d|||� �q,W d|_|d k�rf|j|� d S )NTrG rJ rE rB rC r � rI rF rD rH )�rule_strr4 r7 z5Policy '%s': Unknown setting '%s:%s', unable to applyF)r r> r rO r* r/ �%_get_table_chains_for_policy_dispatch�#_get_table_chains_for_zone_dispatch�gen_chain_rulesr8 �_ingress_egress_zones� _icmp_block�
_forward_port�_service�_port� _protocol� _source_port� _masquerade�_FirewallPolicy__ruler
r r[ �execute) r! �enabler; rb �_policyrM � transaction�table�chainr< �keyr` r# r# r$ �_policy_settings� sj
z FirewallPolicy._policy_settingsc C s | j d||d� d S )NT)rb )r )r! r; rb r# r# r$ rc � s z$FirewallPolicy.apply_policy_settingsc C s | j d||d� d S )NF)rb )r )r! r; rb r# r# r$ rP � s z&FirewallPolicy.unapply_policy_settingsc C sr | j |�j� }| j|�| j|�| j|�| j|�| j|�| j|�| j|�| j |�| j
|�| j |�d�
}| j j
||�S )zH
:return: exported config updated with runtime settings
)
rB rC rG rD rE �
rich_rulesrI rF r4 r7 )r. Zexport_config_dict�
list_services�
list_ports�list_icmp_blocks�query_masquerade�list_forward_ports�
list_rules�list_protocols�list_source_ports�list_ingress_zones�list_egress_zonesr Z'combine_runtime_with_permanent_settings)r! r; Z permanentZruntimer# r# r$ � get_config_with_settings_dict� s z,FirewallPolicy.get_config_with_settings_dictc s� ddl m� d
� �fdd� }� �fdd�}�j�jf�j�jf�j�jf�j�j f�j
�j f||f�j �j
f�j�jf�j�jf�j�jfd�
}�j|�}�jj||�\}} xt| D ]l}
t| |
t��rxV| |
D ]8} t| t�r�||
d |f| �� q�||
d || � q�W q�||
d |� q�W x�|D ]�}
t||
t��r�xn||
D ]J} t| t��rv||
d |f| �d|d �� n||
d || d|d � �qFW n||
d |d|d � �q(W d S ) Nr )r
c s �j | � |d�d|d� d S )N)rk r )rg rf )r^ )r; rk rg rf )r
r! r# r$ �add_rule_wrapper� s zFFirewallPolicy.set_config_with_settings_dict.<locals>.add_rule_wrapperc s �j | � |d�� d S )N)rk )� remove_rule)r; rk )r
r! r# r$ �remove_rule_wrapper� s zIFirewallPolicy.set_config_with_settings_dict.<locals>.remove_rule_wrapper)
rB rC rG rD rE r� rI rF r4 r7 rj )rg rf )r N)�firewall.core.richr
rW �remove_servicerX � remove_portrU �remove_icmp_blockr_ �remove_masqueraderV �remove_forward_portr\ �remove_protocolr] �remove_source_portrS �remove_ingress_zonerT �remove_egress_zoner� r Z get_added_and_removed_settings�
isinstance�list�tuple) r! r; r< rf r� r� Z
setting_to_fnZ old_settingsZ add_settingsZremove_settingsr~ r` r# )r
r! r$ � set_config_with_settings_dict� s:
z,FirewallPolicy.set_config_with_settings_dictc C s& |st tj��|dkr"| jj|� d S )Nr5 r6 )r5 r6 )r r � INVALID_ZONEr �
check_zone)r! r: r# r# r$ �check_ingress_zone s
z!FirewallPolicy.check_ingress_zonec C s | j |� |S )N)r� )r! r: r# r# r$ Z__ingress_zone_id" s
z FirewallPolicy.__ingress_zone_idr Tc C s� | j j|�}| j j|� | j j� | j| }| j|�} | |jd krXttj d||f ��d|jd ks�d|jd ks�|d kr�|jd r�ttj
d��|dkr�d|jd kr�ttj
d��|d kr�| j � }
n|}
|�rJ|j r�| j
d||
� | j|| ||� |
j| j|| � |j �s:|| j� k�rH| j||
d � |
j| j|d� n| j
d
||
� n | j|| ||� |
j| j|| � |d k�r~|
jd
� d S ) Nr4 z'%s' already in '%s'r6 r5 zI'ingress-zones' may only contain one of: many regular zones, ANY, or HOSTr7 zF'HOST' can only appear in either ingress or egress zones, but not bothF)rb T)r6 r5 )r r> �
check_timeout� check_panicr � _FirewallPolicy__ingress_zone_idr< r r rZ r� r* rO ro �&_FirewallPolicy__register_ingress_zone�add_fail�(_FirewallPolicy__unregister_ingress_zoner= rc re rx ) r! r; r: rg rf rb rR rz �_obj�zone_idr{ r# r# r$ rS & s<
z FirewallPolicy.add_ingress_zonec C s | j ||�|jd |< d S )Nr4 )� _FirewallPolicy__gen_settingsr< )r! r� r� rg rf r# r# r$ Z__register_ingress_zoneS s z&FirewallPolicy.__register_ingress_zonec C s� | j j|�}| j j� | j| }| j|�}||jd krLttjd||f ��|d kr^| j � }n|}|j
r�t |jd �dkr�| j ||� n| j
d||� | j||� |j| j||d d � || j� kr�| j
d||� n|j| j||� |d kr�|jd� |S )Nr4 z'%s' not in '%s'rj FT)r r> r� r r� r< r r � NOT_ENABLEDr* rO �lenrP ro r� r� r� r= �add_postrx )r! r; r: rb rz r� r� r{ r# r# r$ r� V s,
z"FirewallPolicy.remove_ingress_zonec C s ||j d kr|j d |= d S )Nr4 )r< )r! r� r� r# r# r$ Z__unregister_ingress_zoney s z(FirewallPolicy.__unregister_ingress_zonec C s | j |�| j|�d kS )Nr4 )r� r8 )r! r; r: r# r# r$ �query_ingress_zone} s z!FirewallPolicy.query_ingress_zonec C s t | j|�d j� �S )Nr4 )r� r8 r, )r! r; r# r# r$ r� � s z!FirewallPolicy.list_ingress_zonesc C s& |st tj��|dkr"| jj|� d S )Nr5 r6 )r5 r6 )r r r� r r� )r! r: r# r# r$ �check_egress_zone� s
z FirewallPolicy.check_egress_zonec C s | j |� |S )N)r� )r! r: r# r# r$ Z__egress_zone_id� s
z FirewallPolicy.__egress_zone_idc C s� | j j|�}| j j|� | j j� | j| }| j|�} | |jd krXttj d||f ��d|jd ks�d|jd ks�|d kr�|jd r�ttj
d��|dkr�d|jd kr�ttj
d��|d kr�| j � }
n|}
|�rJ|j r�| j
d||
� | j|| ||� |
j| j|| � |j �s:|| j� k�rH| j||
d � |
j| j|d� n| j
d
||
� n | j|| ||� |
j| j|| � |d k�r~|
jd
� d S ) Nr7 z'%s' already in '%s'r6 r5 zH'egress-zones' may only contain one of: many regular zones, ANY, or HOSTr4 zF'HOST' can only appear in either ingress or egress zones, but not bothF)rb T)r6 r5 )r r> r� r� r � _FirewallPolicy__egress_zone_idr< r r rZ r� r* rO ro �%_FirewallPolicy__register_egress_zoner� �'_FirewallPolicy__unregister_egress_zoner= rc re rx ) r! r; r: rg rf rb rR rz r� r� r{ r# r# r$ rT � s<
z FirewallPolicy.add_egress_zonec C s | j ||�|jd |< d S )Nr7 )r� r< )r! r� r� rg rf r# r# r$ Z__register_egress_zone� s z%FirewallPolicy.__register_egress_zonec C s� | j j|�}| j j� | j| }| j|�}||jd krLttjd||f ��|d kr^| j � }n|}|j
r�t |jd �dkr�| j ||� n| j
d||� | j||� |j| j||d d � || j� kr�| j
d||� n|j| j||� |d kr�|jd� |S )Nr7 z'%s' not in '%s'rj FT)r r> r� r r� r< r r r� r* rO r� rP ro r� r� r� r= r� rx )r! r; r: rb rz r� r� r{ r# r# r$ r� � s,
z!FirewallPolicy.remove_egress_zonec C s ||j d kr|j d |= d S )Nr7 )r< )r! r� r� r# r# r$ Z__unregister_egress_zone� s z'FirewallPolicy.__unregister_egress_zonec C s | j |�| j|�d kS )Nr7 )r� r8 )r! r; r: r# r# r$ �query_egress_zone� s z FirewallPolicy.query_egress_zonec C s t | j|�d j� �S )Nr7 )r� r8 r, )r! r; r# r# r$ r� � s z FirewallPolicy.list_egress_zonesc C s |j � d S )N)Zcheck)r! �ruler# r# r$ �
check_rule� s zFirewallPolicy.check_rulec C s | j |� t|�S )N)r� �str)r! r� r# r# r$ Z __rule_id� s
zFirewallPolicy.__rule_idc C sx |sd S |j r,t|j �r dS t|j �rtdS nHt|d�r@|jr@dS t|d�rt|jrt| j|j� | j|j� | j|j�S d S )N�ipv4�ipv6�mac� �ipset) Zaddrr r �hasattrr� r� � _check_ipset_type_for_source�_check_ipset_applied�
_ipset_family)r! �sourcer# r# r$ �_rule_source_ipv� s
z FirewallPolicy._rule_source_ipvc C s | j ||||� d S )N)�
_rule_prepare)r! ry r; r� r{ r# r# r$ Z__rule s zFirewallPolicy.__rulec C sL | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j
d|| f ��|j�s�|j r�t |j t
�r�d|jd kr�tt jd��d|jd kr�tt jd��x6|jd D ](}
|
dkr�q�| j jj|
�r�tt jd ��q�W |j �r�t |j t��r�d|jd k�r,|j j�r�tt jd
��nb|jd �r�|j j�sNtt jd ��x>|jd D ]0}
|
dk�rl�qZ| j jj|
��rZtt jd ���qZW |j�r�t |jt��r�x>|jd D ]0}
|
dk�rq�| j jj|
��r�tt jd
���q�W |d k�r�| j� } n|} |j�r| jd||| � | j||||� | j| j||� |d k�rH| j d� |S )NrH z'%s' already in '%s'r5 r7 z.'masquerade' is invalid for egress zone 'HOST'r4 z/'masquerade' is invalid for ingress zone 'HOST'r6 zR'masquerade' cannot be used in a policy if an ingress zone has assigned interfaceszAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonezS'forward-port' cannot be used in a policy if an egress zone has assigned interfaceszR'mark' action cannot be used in a policy if an egress zone has assigned interfacesT)r6 r5 ) r r> r� r� r �_FirewallPolicy__rule_idr< r/ r r rZ �elementr� r r� r: �list_interfacesr �
to_address�INVALID_FORWARD�actionr r* rO rw � _FirewallPolicy__register_ruler� � _FirewallPolicy__unregister_rulerx ) r! r; r� rg rf rb rz r� �rule_id�_namer: r{ r# r# r$ r^
s`
zFirewallPolicy.add_rulec C s | j ||�|jd |< d S )NrH )r� r< )r! r� r� rg rf r# r# r$ Z__register_ruleE s z FirewallPolicy.__register_rulec C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j
� }n|}|j r�| j d|||� |j
| j||� |d kr�|jd� |S )NrH z'%s' not in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rw r� r� rx ) r! r; r� rb rz r� r� r� r{ r# r# r$ r� I s"
zFirewallPolicy.remove_rulec C s ||j d kr|j d |= d S )NrH )r< )r! r� r� r# r# r$ Z__unregister_ruled s z FirewallPolicy.__unregister_rulec C s | j |�| j|�d kS )NrH )r� r8 )r! r; r� r# r# r$ �
query_ruleh s zFirewallPolicy.query_rulec C s t | j|�d j� �S )NrH )r� r8 r, )r! r; r# r# r$ r� k s zFirewallPolicy.list_rulesc C s | j j|� d S )N)r �
check_service)r! �servicer# r# r$ r� p s z FirewallPolicy.check_servicec C s | j |� |S )N)r� )r! r� r# r# r$ Z __service_ids s
zFirewallPolicy.__service_idc C s� | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j
d|| f ��|d krz| j � }
n|}
|j r�| j
d|||
� | j||||� |
j| j||� |d kr�|
jd� |S )NrB z'%s' already in '%s'T)r r> r� r� r �_FirewallPolicy__service_idr< r/ r r rZ r* rO rr �!_FirewallPolicy__register_servicer� �#_FirewallPolicy__unregister_servicerx ) r! r; r� rg rf rb rz r� �
service_idr� r{ r# r# r$ rW w s&
zFirewallPolicy.add_servicec C s | j ||�|jd |< d S )NrB )r� r< )r! r� r� rg rf r# r# r$ Z__register_service� s z!FirewallPolicy.__register_servicec C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j
� }n|}|j r�| j d|||� |j
| j||� |d kr�|jd� |S )NrB z'%s' not in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rr r� r� rx ) r! r; r� rb rz r� r� r� r{ r# r# r$ r� � s"
z FirewallPolicy.remove_servicec C s ||j d kr|j d |= d S )NrB )r< )r! r� r� r# r# r$ Z__unregister_service� s z#FirewallPolicy.__unregister_servicec C s | j |�| j|�d kS )NrB )r� r8 )r! r; r� r# r# r$ �
query_service� s z FirewallPolicy.query_servicec C s | j |�d j� S )NrB )r8 r, )r! r; r# r# r$ r� � s z FirewallPolicy.list_servicesc C sT g }xJ|D ]B}y| j jj|�}W n tk
r@ ttj|��Y nX |j|� q
W |S )N)r �helper�
get_helperr r �INVALID_HELPERr0 )r! �helpers�_helpersr� �_helperr# r# r$ � get_helpers_for_service_helpers� s
z.FirewallPolicy.get_helpers_for_service_helpersc C s� g }x�|D ]�}y| j jj|�}W n tk
r@ ttj|��Y nX t|j�dk r�t|j �}y | j jj|�}|j
|� W q� tk
r� |r�t j d| � w
Y q�X q
|j
|� q
W |S )Nrj z Helper '%s' is not available)
r r� r� r r r� r� rC r
�moduler0 r r[ )r! �modulesry r� r� r� �_module_short_namer� r# r# r$ � get_helpers_for_service_modules� s"
z.FirewallPolicy.get_helpers_for_service_modulesc C s | j j|� | j j|� d S )N)r �
check_port� check_tcpudp)r! �port�protocolr# r# r$ r� � s zFirewallPolicy.check_portc C s | j ||� t|d�|fS )N�-)r� r )r! r� r� r# r# r$ Z __port_id� s zFirewallPolicy.__port_idc s� | j j|�}| j j|� | j j� | j| }tt� fdd�|jd ��} x@| D ]8}
t||
d �rN|j rl|j n|} t
t j d|� | f ��qNW t
|dd� | D ��\} }
|d kr�| j� }n|}|j�r x$| D ] }| jd|t|d �� |� q�W x$|
D ] }| jd
|t|d �� |� q�W x:| D ]2}| j|� �}
| j||
||� |j| j||
� �qW x*|
D ]"}| j|� �}
|j| j||
� �qNW |d k�r�|jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ �<lambda>� s z)FirewallPolicy.add_port.<locals>.<lambda>rC r z'%s:%s' already in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ �
<listcomp>� s z+FirewallPolicy.add_port.<locals>.<listcomp>Tr� F)r r> r� r� r r� �filterr< r r/ r r rZ r r* rO rs r �_FirewallPolicy__port_id� _FirewallPolicy__register_portr� � _FirewallPolicy__unregister_portr� rx )r! r; r� r� rg rf rb rz r� �existing_port_ids�port_idr� � added_ranges�removed_rangesr{ �ranger# )r� r$ rX � s:
zFirewallPolicy.add_portc C s | j ||�|jd |< d S )NrC )r� r< )r! r� r� rg rf r# r# r$ Z__register_port s z FirewallPolicy.__register_portc s� | j j|�}| j j� | j| }tt� fdd�|jd ��}xB|D ]}t||d �rBP qBW |jrf|jn|} t t
j d|� | f ��t |dd� |D ��\}
} |d kr�| j
� } n|} |j�rx$|
D ] }
| jd|t|
d �� | � q�W x$| D ] }
| jd
|t|
d �� | � q�W x:|
D ]2}
| j|
� �}| j||dd � | j| j||� �qW x*| D ]"}
| j|
� �}| j| j||� �qDW |d k�r~| jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ r� s z,FirewallPolicy.remove_port.<locals>.<lambda>rC r z'%s:%s' not in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ r� # s z.FirewallPolicy.remove_port.<locals>.<listcomp>Tr� F)r r> r� r r� r� r< r r/ r r r� r r* rO rs r r� r� r� r� r� rx )r! r; r� r� rb rz r� r� r� r� r� r� r{ r� r# )r� r$ r� s:
zFirewallPolicy.remove_portc C s ||j d kr|j d |= d S )NrC )r< )r! r� r� r# r# r$ Z__unregister_port= s z FirewallPolicy.__unregister_portc C s6 x0| j |�d D ] \}}t||�r||krdS qW dS )NrC TF)r8 r )r! r; r� r� rs rt r# r# r$ �
query_portA s zFirewallPolicy.query_portc C s t | j|�d j� �S )NrC )r� r8 r, )r! r; r# r# r$ r� H s zFirewallPolicy.list_portsc C s t |�sttj|��d S )N)r r r ZINVALID_PROTOCOL)r! r� r# r# r$ �check_protocolM s z FirewallPolicy.check_protocolc C s | j |� |S )N)r� )r! r� r# r# r$ Z
__protocol_idQ s
z FirewallPolicy.__protocol_idc C s� | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j
d|| f ��|d krz| j � }
n|}
|j r�| j
d|||
� | j||||� |
j| j||� |d kr�|
jd� |S )NrI z'%s' already in '%s'T)r r> r� r� r � _FirewallPolicy__protocol_idr< r/ r r rZ r* rO rt �"_FirewallPolicy__register_protocolr� �$_FirewallPolicy__unregister_protocolrx ) r! r; r� rg rf rb rz r� � protocol_idr� r{ r# r# r$ r\ U s&
zFirewallPolicy.add_protocolc C s | j ||�|jd |< d S )NrI )r� r< )r! r� r� rg rf r# r# r$ Z__register_protocolr s z"FirewallPolicy.__register_protocolc C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j
� }n|}|j r�| j d|||� |j
| j||� |d kr�|jd� |S )NrI z'%s' not in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rt r� r� rx ) r! r; r� rb rz r� r� r� r{ r# r# r$ r� v s$
z FirewallPolicy.remove_protocolc C s ||j d kr|j d |= d S )NrI )r< )r! r� r� r# r# r$ Z__unregister_protocol� s z$FirewallPolicy.__unregister_protocolc C s | j |�| j|�d kS )NrI )r� r8 )r! r; r� r# r# r$ �query_protocol� s z FirewallPolicy.query_protocolc C s t | j|�d j� �S )NrI )r� r8 r, )r! r; r# r# r$ r� � s z FirewallPolicy.list_protocolsc C s | j ||� t|d�|fS )Nr� )r� r )r! r� r� r# r# r$ Z__source_port_id� s z FirewallPolicy.__source_port_idc s� | j j|�}| j j|� | j j� | j| }tt� fdd�|jd ��} x@| D ]8}
t||
d �rN|j rl|j n|} t
t j d|� | f ��qNW t
|dd� | D ��\} }
|d kr�| j� }n|}|j�r x$| D ] }| jd|t|d �� |� q�W x$|
D ] }| jd
|t|d �� |� q�W x:| D ]2}| j|� �}
| j||
||� |j| j||
� �qW x*|
D ]"}| j|� �}
|j| j||
� �qNW |d k�r�|jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ r� � s z0FirewallPolicy.add_source_port.<locals>.<lambda>rF r z'%s:%s' already in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ r� � s z2FirewallPolicy.add_source_port.<locals>.<listcomp>Tr� F)r r> r� r� r r� r� r< r r/ r r rZ r r* rO ru r � _FirewallPolicy__source_port_id�%_FirewallPolicy__register_source_portr� �'_FirewallPolicy__unregister_source_portr� rx )r! r; r� r� rg rf rb rz r� r� r� r� r� r� r{ r� r# )r� r$ r] � s:
z FirewallPolicy.add_source_portc C s | j ||�|jd |< d S )NrF )r� r< )r! r� r� rg rf r# r# r$ Z__register_source_port� s z%FirewallPolicy.__register_source_portc s� | j j|�}| j j� | j| }tt� fdd�|jd ��}xB|D ]}t||d �rBP qBW |jrf|jn|} t t
j d|� | f ��t |dd� |D ��\}
} |d kr�| j
� } n|} |j�rx$|
D ] }
| jd|t|
d �� | � q�W x$| D ] }
| jd
|t|
d �� | � q�W x:|
D ]2}
| j|
� �}| j||dd � | j| j||� �qW x*| D ]"}
| j|
� �}| j| j||� �qDW |d k�r~| jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ r� � s z3FirewallPolicy.remove_source_port.<locals>.<lambda>rF r z'%s:%s' not in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ r� � s z5FirewallPolicy.remove_source_port.<locals>.<listcomp>Tr� F)r r> r� r r� r� r< r r/ r r r� r r* rO ru r r� r� r� r� r� rx )r! r; r� r� rb rz r� r� r� r� r� r� r{ r� r# )r� r$ r� � s:
z!FirewallPolicy.remove_source_portc C s ||j d kr|j d |= d S )NrF )r< )r! r� r� r# r# r$ Z__unregister_source_port� s z'FirewallPolicy.__unregister_source_portc C s6 x0| j |�d D ] \}}t||�r||krdS qW dS )NrF TF)r8 r )r! r; r� r� rs rt r# r# r$ �query_source_port� s z FirewallPolicy.query_source_portc C s t | j|�d j� �S )NrF )r� r8 r, )r! r; r# r# r$ r� s z FirewallPolicy.list_source_portsc C s dS )NTr# )r! r# r# r$ Z__masquerade_id s z FirewallPolicy.__masquerade_idc C s8 | j j|�}| j j|� | j j� | j| }| j� }||jd krb|jrN|jn|}tt j
d| ��|js�d|jd kr�tt j d��d|jd kr�tt j d��x6|jd D ](} | dkr�q�| j j j
| �r�tt j d ��q�W |d kr�| j� }
n|}
|j�r | jd
||
� | j||||� |
j| j||� |d k�r4|
jd
� |S ) NrD z"masquerade already enabled in '%s'r5 r7 z.'masquerade' is invalid for egress zone 'HOST'r4 z/'masquerade' is invalid for ingress zone 'HOST'r6 zR'masquerade' cannot be used in a policy if an ingress zone has assigned interfacesT)r r> r� r� r � _FirewallPolicy__masquerade_idr< r/ r r rZ r� r: r� r* rO rv �$_FirewallPolicy__register_masquerader� �&_FirewallPolicy__unregister_masqueraderx ) r! r; rg rf rb rz r� �
masquerade_idr� r: r{ r# r# r$ r_
s:
z FirewallPolicy.add_masqueradec C s | j ||�|jd |< d S )NrD )r� r< )r! r� r� rg rf r# r# r$ Z__register_masquerade2 s z$FirewallPolicy.__register_masqueradec C s� | j j|�}| j j� | j| }| j� }||jd krV|jrB|jn|}ttj d| ��|d krh| j
� }n|}|j r�| j d||� |j
| j||� |d kr�|jd� |S )NrD z masquerade not enabled in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rv r� r� rx )r! r; rb rz r� r� r� r{ r# r# r$ r� 6 s"
z FirewallPolicy.remove_masqueradec C s ||j d kr|j d |= d S )NrD )r< )r! r� r� r# r# r$ Z__unregister_masqueradeP s z&FirewallPolicy.__unregister_masqueradec C s | j � | j|�d kS )NrD )r� r8 )r! r; r# r# r$ r� T s z FirewallPolicy.query_masqueradec C s^ | j j|� | j j|� |r(| j j|� |rBt||�sBttj|��| rZ| rZttjd��d S )Nz.port-forwarding is missing to-port AND to-addr)r r� r� r r r Z INVALID_ADDRr� )r! �ipvr� r� �toport�toaddrr# r# r$ �check_forward_portY s
z!FirewallPolicy.check_forward_portc C sL t d|�r | jd||||� n| jd||||� t|d�|t|d�t|�fS )Nr� r� r� )r r r r� )r! r� r� r� r� r# r# r$ Z__forward_port_idf s
z FirewallPolicy.__forward_port_idc C sZ | j j|�} | j j|� | j j� | j| }
| j||||�} | |
jd krt|
jrV|
jn| } tt j
d||||| f ��|
js�d|
jd kr�|r�tt j d��nR|
jd r�|s�tt j d��x6|
jd D ](}
|
dkr�q�| j j j
|
�r�tt jd��q�W |d k�r | j� }n|}|
j�r"| jd | |||||� | j|
| ||� |j| j|
| � |d k�rV|jd � | S )
NrE z '%s:%s:%s:%s' already in '%s'r5 r7 zAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zoner6 zS'forward-port' cannot be used in a policy if an egress zone has assigned interfacesT)r r> r� r� r � _FirewallPolicy__forward_port_idr< r/ r r rZ r� r: r� r� r* rO rq �&_FirewallPolicy__register_forward_portr� �(_FirewallPolicy__unregister_forward_portrx )r! r; r� r� r� r� rg rf rb rz r� �
forward_idr� r: r{ r# r# r$ rV n sB
z FirewallPolicy.add_forward_portc C s | j ||�|jd |< d S )NrE )r� r< )r! r� r rg rf r# r# r$ Z__register_forward_port� s z&FirewallPolicy.__register_forward_portc C s� | j j|�}| j j� | j| }| j||||�} | |jd krh|jrJ|jn|}
ttj d|||||
f ��|d krz| j
� } n|} |j r�| j d|| ||||� | j
| j|| � |d kr�| jd� |S )NrE z'%s:%s:%s:%s' not in '%s'FT)r r> r� r r r< r/ r r r� r* rO rq r� r rx ) r! r; r� r� r� r� rb rz r� r r� r{ r# r# r$ r� � s&
z"FirewallPolicy.remove_forward_portc C s ||j d kr|j d |= d S )NrE )r< )r! r� r r# r# r$ Z__unregister_forward_port� s z(FirewallPolicy.__unregister_forward_portc C s" | j ||||�}|| j|�d kS )NrE )r r8 )r! r; r� r� r� r� r r# r# r$ �query_forward_port� s z!FirewallPolicy.query_forward_portc C s t | j|�d j� �S )NrE )r� r8 r, )r! r; r# r# r$ r� � s z!FirewallPolicy.list_forward_portsc C s | j j|� d S )N)r Zcheck_icmptype)r! �icmpr# r# r$ �check_icmp_block� s z FirewallPolicy.check_icmp_blockc C s | j |� |S )N)r )r! r r# r# r$ Z__icmp_block_id� s
z FirewallPolicy.__icmp_block_idc C s� | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j
d|| f ��|d krz| j � }
n|}
|j r�| j
d|||
� | j||||� |
j| j||� |d kr�|
jd� |S )NrG z'%s' already in '%s'T)r r> r� r� r � _FirewallPolicy__icmp_block_idr< r/ r r rZ r* rO rp �$_FirewallPolicy__register_icmp_blockr� �&_FirewallPolicy__unregister_icmp_blockrx ) r! r; r rg rf rb rz r� �icmp_idr� r{ r# r# r$ rU � s&
z FirewallPolicy.add_icmp_blockc C s | j ||�|jd |< d S )NrG )r� r< )r! r� r rg rf r# r# r$ Z__register_icmp_block� s z$FirewallPolicy.__register_icmp_blockc C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j
� }n|}|j r�| j d|||� |j
| j||� |d kr�|jd� |S )NrG z'%s' not in '%s'FT)r r> r� r r r< r/ r r r� r* rO rp r� r
rx ) r! r; r rb rz r� r r� r{ r# r# r$ r� � s"
z FirewallPolicy.remove_icmp_blockc C s ||j d kr|j d |= d S )NrG )r< )r! r� r r# r# r$ Z__unregister_icmp_block s z&FirewallPolicy.__unregister_icmp_blockc C s | j |�| j|�d kS )NrG )r r8 )r! r; r r# r# r$ �query_icmp_block s z FirewallPolicy.query_icmp_blockc C s | j |�d j� S )NrG )r8 r, )r! r; r# r# r$ r� s z FirewallPolicy.list_icmp_blocksc C s dS )NTr# )r! r# r# r$ Z__icmp_block_inversion_id s z(FirewallPolicy.__icmp_block_inversion_idc
C s | j j|�}| j j� | j| }| j� }||jd krV|jrB|jn|}ttj d| ��|d krh| j
� }n|}|j r�x&| j |�d D ]} | j
d|| |� q�W | jd||� | j|||� |j| j|||� |j �rx&| j |�d D ]} | j
d|| |� q�W | jd||� |d k�r|jd� |S )NrJ z,icmp-block-inversion already enabled in '%s'rG FT)r r> r� r �(_FirewallPolicy__icmp_block_inversion_idr< r/ r r rZ r* rO r8 rp �_icmp_block_inversion�._FirewallPolicy__register_icmp_block_inversionr� �*_FirewallPolicy__undo_icmp_block_inversionrx )
r! r; rf rb rz r� �icmp_block_inversion_idr� r{ r` r# r# r$ �add_icmp_block_inversion s6
z'FirewallPolicy.add_icmp_block_inversionc C s | j d|�|jd |< d S )Nr rJ )r� r< )r! r� r rf r# r# r$ Z __register_icmp_block_inversionE s z.FirewallPolicy.__register_icmp_block_inversionc C s� | j � }|jr6x&| j|�d D ]}| jd|||� q W ||jd krP|jd |= |jr~x&| j|�d D ]}| jd|||� qfW |jd� d S )NrG FrJ T)r* rO r8 rp r< rx )r! rz r� r r{ r` r# r# r$ Z__undo_icmp_block_inversionJ s z*FirewallPolicy.__undo_icmp_block_inversionc C s | j j|�}| j j� | j| }| j� }||jd krV|jrB|jn|}ttj d| ��|d krh| j
� }n|}|j r�x&| j |�d D ]}| j
d|||� q�W | jd||� | j||� |j| j||d � |j �rx&| j |�d D ]}| j
d|||� q�W | jd||� |d k�r|jd� |S )NrJ z(icmp-block-inversion not enabled in '%s'rG FT)r r> r� r r
r< r/ r r r� r* rO r8 rp r �0_FirewallPolicy__unregister_icmp_block_inversionr� r rx ) r! r; rb rz r� r r� r{ r` r# r# r$ �remove_icmp_block_inversion\ s6
z*FirewallPolicy.remove_icmp_block_inversionc C s ||j d kr|j d |= d S )NrJ )r< )r! r� r r# r# r$ Z!__unregister_icmp_block_inversion� s z0FirewallPolicy.__unregister_icmp_block_inversionc C s | j � | j|�d kS )NrJ )r
r8 )r! r; r# r# r$ �query_icmp_block_inversion� s z)FirewallPolicy.query_icmp_block_inversionc
C s� | j jj|�}|jr*| j jj|j d }n|}|rT|| jkrt||f| j| krtd S n || jksp||f| j| krtd S x@| j j� D ]2}|jr�||j � kr�|j
||||�} |j || � q�W | j ||||fg� |j
| j || ||fg� d S )Nr )r r; r. r/ r: Z_zone_policiesr �enabled_backends�policies_supportedZget_available_tablesZbuild_policy_chain_rules� add_rules�_register_chainsr� )
r! r; �creater| r} r{ rM Ztracking_policy�backendrH r# r# r$ rn � s$
z FirewallPolicy.gen_chain_rulesc C sb x\|D ]T\}}|r,| j j|g �j||f� q| j | j||f� t| j | �dkr| j |= qW d S )Nr )r �
setdefaultr0 �remover� )r! r; r Ztablesr| r} r# r# r$ r � s z FirewallPolicy._register_chainsc C s$ | j jj|�dkrd S | j jj|�S )Nzhash:mac)r r� �get_typeZ
get_family)r! rK r# r# r$ r� � s z FirewallPolicy._ipset_familyc C s | j jj|�S )N)r r� r )r! rK r# r# r$ Z __ipset_type� s zFirewallPolicy.__ipset_typec C s dj |g| jjj|� �S )N�,)�joinr r� Z
get_dimension)r! rK �flagr# r# r$ �_ipset_match_flags� s z!FirewallPolicy._ipset_match_flagsc C s | j jj|�S )N)r r� Z
check_applied)r! rK r# r# r$ r� � s z#FirewallPolicy._check_ipset_appliedc C s* | j |�}|tkr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)�_FirewallPolicy__ipset_typer r r Z
INVALID_IPSET)r! rK Z_typer# r# r$ r� � s
z+FirewallPolicy._check_ipset_type_for_sourcec s� t |j�tkr��jjj|jj�}|d kr2|jjg}xR|jD ]H}||krHq:�j|� |j |� t
j |�}||j_�j |||||d� q:W g } |j
r�|j
g} nH|jr�t|jt�s�t|jt�r�jjj|jj�� � jr� fdd�dD �} �j|j�}
|
�r&|j
�r |j
|
k�r&ttjd|
|j
f ��n|
g} | �s4ddg} �fdd�| D �} | |_�x2t�fdd�| D ��D �]} t |j�tk�r��jjj|jj�}g } t|j�d k�r�|j�r�ttjd
��xB| D ].}
|
|jk�r�| j |
��r�| j |j|
� �q�W n
| j d � �x~| D �]�}t |j �t k�r�j |j |�}|�j!|j"�7 }t#t|�d d � d
�}g }x�|D ]�}|j$}t%|�}|j&dd�}|j |� |j
dk�r�| j |j
� �r��qTt|j'�dk �r�|j |� n:x8|j'D ].\}}| j(||||||j|�}|j)| |� �q�W �qTW |j*|� x4|j'D ]*\}}| j+||||||�}|j)| |� �q
W x.|j,D ]$}| j-|||||�}|j)| |� �q@W x4|j.D ]*\}}| j/||||||�}|j)| |� �qpW �qW �qft |j�t0k�r�|jj1}|jj2}�j3||� | j+||||d |�}|j)| |� �qft |j�t4k�r<|jj5}�j6|� | j-|||d |�}|j)| |� �qft |j�t7k�r�|�rzx&| D ] }
| j |
��rX|j8t9|
� �qXW | j:|||�}|j)| |� �qft |j�t;k�r4|jj1}|jj2}|jj<}|jj=}xD| D ]<}
| j |
��r�j>|
||||� |�r�|�r�|j8t9|
� �q�W | j?|||||||�}|j)| |� �qft |j�t@k�r�|jj1}|jj2}�j3||� | j/||||d |�}|j)| |� n�t |j�tk�s�t |j�tk�r>�jjj|jj�� |j
�r� j�r�|j
� jk�r�ttjAd|j
|jjf ��t |j�tk�r |j �r t |j �t k�r ttjd��| jB||� |�}|j)| |� n>|jd k�rf| jC|||�}|j)| |� nttjdt |j� ���qfW d S )N)�included_servicesc s g | ]}|� j kr|�qS r# )� destination)r? r� )�ictr# r$ r� � s z0FirewallPolicy._rule_prepare.<locals>.<listcomp>r� r� z;Source address family '%s' conflicts with rule family '%s'.c s g | ]}� j j|�r|�qS r# )r �is_ipv_enabled)r? r� )r! r# r$ r� � s c s g | ]}� j j|��qS r# )r �get_backend_by_ipv)r? r@ )r! r# r$ r� � s r z"Destination conflict with service.c S s | j S )N)rK )r@ r# r# r$ r� s z.FirewallPolicy._rule_prepare.<locals>.<lambda>)r~ � conntrack�natr� rj z3rich rule family '%s' conflicts with icmp type '%s'z'IcmpBlock not usable with accept actionzUnknown element %s)r� r� )D�typer� r r r� � get_servicerK �includesr� r0 �copy�deepcopyr� �familyr� r r �config� get_icmptyper% r� r� r r Z INVALID_RULE�ipvsr9 r� �is_ipv_supportedr� r r� r� r� r� r+ r� r
�replacerC � build_policy_helper_ports_rulesr Z add_modules�build_policy_ports_rulesrI �build_policy_protocol_rulesrF � build_policy_source_ports_rulesr r� r� r� r �valuer� r r� r � build_policy_masquerade_rulesr Zto_portr� r � build_policy_forward_port_rulesr ZINVALID_ICMPTYPE� build_policy_icmp_block_rulesZ*build_policy_rich_source_destination_rules)r! ry r; r� r{ r$ �svc�includeZ_ruler3 Z
source_ipvr Z destinationsr� r% r� r� r� r� r� �
nat_moduler� �protorH r� r� r� r# )r& r! r$ r� � s
z FirewallPolicy._rule_preparec C sb | j jj|�}| j|j|�}|| j|j�7 }tt|�dd� d�}|d krN|g}x@|j D ]6}||krdqV| j
|� |j |� | j |||||d� qVW g } xnd D ]f}
| j j
|
�s�q�| j j|
�} t|j�dkr�|
|jkr�| j | |j|
f� q�| d f| kr�| j | d f� q�W �xV| D �]L\} } x�|D ]�}
|
j}t|�}|
jjdd �}|j|� |
jd
k�rf| j|
j� �rf�q t|
j�d k �r�|j|� n:x8|
jD ].\}}| j||||| |
j|�}|j| |� �q�W �q W x2|jD ](\}}| j||||| �}|j| |� �q�W x,|j D ]"}| j |||| �}|j| |� �q�W x2|j D ](\}}| j ||||| �}|j| |� �q,W �q W d S )
Nc S s | j S )N)rK )r@ r# r# r$ r� � s z)FirewallPolicy._service.<locals>.<lambda>)r~ )r$ r� r� r r) r* r� rj )r� r� ) r r� r, r� r� r� r� r+ r9 r- r� r0 rr r' r( r� r% r� r
r5 Z
add_moduler0 r4 rC r6 rK r r7 rI r8 rF r9 )r! ry r; r� r{ r$ r> r� r? Z backends_ipvr� r r% r� r� r� r@ r� rA rH r� r# r# r$ rr � sb
zFirewallPolicy._servicec C s< x6| j j� D ](}|jsq |j||||�}|j||� q W d S )N)r r r r7 r )r! ry r; r� r� r{ r rH r# r# r$ rs � s
zFirewallPolicy._portc C s: x4| j j� D ]&}|jsq |j|||�}|j||� q W d S )N)r r r r8 r )r! ry r; r� r{ r rH r# r# r$ rt � s
zFirewallPolicy._protocolc C s< x6| j j� D ](}|jsq |j||||�}|j||� q W d S )N)r r r r9 r )r! ry r; r� r� r{ r rH r# r# r$ ru � s
zFirewallPolicy._source_portc C s8 d}|j t|� | jj|�}|j||�}|j||� d S )Nr� )r� r r r( r; r )r! ry r; r{ r� r rH r# r# r$ rv � s
zFirewallPolicy._masqueradec C sX t d|�rd}nd}|r(|r(|jt|� | jj|�} | j||||||�}
|j| |
� d S )Nr� r� )r r� r r r( r< r ) r! ry r; r{ r� r� r� r� r� r rH r# r# r$ rq � s
z FirewallPolicy._forward_portc
C s� | j jj|�}xl| j j� D ]^}|js&qd}|jrXx&dD ] }||jkr6|j|�s6d}P q6W |r^q|j|||�} |j|| � qW d S )NFr� r� T)r� r� ) r r1 r2 r r r% r4 r= r )
r! ry r; r r{ r& r Z skip_backendr� rH r# r# r$ rp � s
zFirewallPolicy._icmp_blockc C sh | j | j}|dkrd S | j|� r0|dkr0d S x2| jj� D ]$}|jsHq<|j||�}|j||� q<W d S )N�DROP�
%%REJECT%%�REJECTZACCEPT)rB rC rD )r �targetr r r r Z'build_policy_icmp_block_inversion_rulesr )r! ry r; r{ rE r rH r# r# r$ r s z$FirewallPolicy._icmp_block_inversionc C s� x|D ]}| j |� qW x|D ]}| j|� q W d|ks@d|krXt|�dkrXttjd��d|kshd|kr�t|�dkr�ttjd��|s�|r�| r�| r�d|kr�d|kr�ttjd| ��|s�|r�| r�| r�d|kr�d|kr�ttjd| ��d S )Nr6 r5 rj zI'ingress-zones' may only contain one of: many regular zones, ANY, or HOSTzH'egress-zones' may only contain one of: many regular zones, ANY, or HOSTzpolicy "%s" has no ingresszpolicy "%s" has no egress)r� r� r� r r r� ) r! r; r4 r7 �ingress_interfaces�egress_interfaces�ingress_sources�egress_sourcesr: r# r# r$ �check_ingress_egress" s$
z#FirewallPolicy.check_ingress_egressc
C s� |dkr&|dkr�|r�t tjd| ��n�|dkrtd|krFt tjd| ��d|kr^t tjd| ��|r�t tjd| ��n||d kr�d|kr�t tjd| ��d|kr�t tjd| ��nB|d
kr�d|kr�t tjd | ��n |d kr�d|kr�t tjd
| ��d S )N�
PREROUTING�rawzFpolicy "%s" egress-zones may not include a zone with added interfaces.� POSTROUTINGr5 z/policy "%s" ingress-zones may not include HOST.z.policy "%s" egress-zones may not include HOST.zGpolicy "%s" ingress-zones may not include a zone with added interfaces.�FORWARD�INPUTz0policy "%s" egress-zones must include only HOST.�OUTPUTz1policy "%s" ingress-zones must include only HOST.)r r r� )
r! r; r| r} r4 r7 rF rG rH rI r# r# r$ �check_ingress_egress_chain< s, z)FirewallPolicy.check_ingress_egress_chainc C s$ | j � }| j|||� |jd� d S )NT)r* ro rx )r! ry r; r{ r# r# r$ �!_ingress_egress_zones_transactionY s z0FirewallPolicy._ingress_egress_zones_transactionc C sL | j | }|jd }|jd }t� }t� }t� } t� }
xB|D ]:} | dkrJq<|t| jjj| ��O }| t| jjj| ��O } q<W xB|D ]:} | dkr�q�|t| jjj| ��O }|
t| jjj| ��O }
q�W | j|||||| |
� xr| jj� D ]d} | j s�q�xV| j
|�D ]H\}
}| j ||
|||||| |
� | j |||
|||| |
�}|j
| |� � q�W q�W d S )Nr4 r7 r6 r5 )r6 r5 )r6 r5 )r r< r9 r r: r� Z list_sourcesrJ r r rl rQ Z!build_policy_ingress_egress_rulesr )r! ry r; r{ rM r4 r7 rF rG rH rI r: r r| r} rH r# r# r$ ro ^ s@
z$FirewallPolicy._ingress_egress_zonesc C s6 | j | }d|jd krFd|jd krFdddg}| jjsB|jd� |S d|jd krpdg}| jjsl|jd� |S d|jd kr�dgS d|jd ko�d|jd k� r�ddddg}| jj� s�|jd� |S d|jd k�r.d d d g}| jj� s�|jd � x4|jd D ] }| jjj|�d �r P �q W |jd � |S d|jd k�r�d!d"g}| jj�sZ|jd#� x>|jd D ] }| jjj|�d �rfP �qfW |jd$� |jd%� |S d&g}| jj�s�|jd'� x4|jd D ] }| jjj|�d �r�P �q�W |jd(� x>|jd D ] }| jjj|�d �r�P �q�W |jd)� |jd*� |S dS )+z:Create a list of (table, chain) needed for policy dispatchr6 r4 r5 r7 r� rO r* rK �manglerL rP rN rM Z
interfacesN)r� rO )r* rK )rS rK )rL rK )r� rO )rL rK )r� rP )r� rN )r* rK )r* rM )rS rK )rL rK )r� rN )r* rK )rS rK )rL rK )r* rM )r� rN )r* rM )rL rK )r* rK )rS rK )r� rN )rL rK )r* rM )r* rK )rS rK )r r< r �nftables_enabledr0 r: r8 )r! r; rM �tcr: r# r# r$ rl � sj
z4FirewallPolicy._get_table_chains_for_policy_dispatchc C sr | j | }d|jd kr4dg}| jjs0|jd� |S d|jd krLdddgS d|jd krbddgS td| �S dS )z8Create a list of (table, chain) needed for zone dispatchr5 r7 r� rO rL rK r6 �
FORWARD_INr* rS r4 � FORWARD_OUTrM zInvalid policy: %sN)r� rO )rL rK )r� rV )r* rK )rS rK )r� rW )r* rM )r r< r rT r0 r )r! r; rM rU r# r# r$ rm � s
z2FirewallPolicy._get_table_chains_for_zone_dispatchFc C s� | j jj|�}|jr |j}n|| }d|jd krl|dkrBd| S |dkrRd| S |jsh|dkrhd| S �nJd|jd kr�|js�|dkr�d
| S �n"d |jd k� r�|dkr�|jr�d | S d
| S n0|dkr�|r�d| S d| S n|dk�r�d| S n�d |jd k�rh|dk�r*|j�r d| S d
| S n<|dk�rL|�rBd| S d| S n|dk�r�|j�s�d| S nN|j�s�|dk�r�d
| S |dk�r�|�r�d| S d| S n|dk�r�d| S td|||f �S )Nr5 r7 r� ZIN_rL ZPRE_rS r* r4 ZOUT_r6 ZFWDI_ZFWD_ZPOST_ZFWDO_z.Can't convert policy to chain name: %s, %s, %s)rS r* )rS rL )rS rL )rS rL )r r; r. r/ r< r )r! r; r| Z
policy_prefixZisSNATrM �suffixr# r# r$ �policy_base_chain_name� sb
z%FirewallPolicy.policy_base_chain_name)N)N)N)N)r NNT)N)r NNT)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)NN)NN)NNr NN)NNN)NN)r NN)N)NN)N)N)N)NN)F)��__name__�
__module__� __qualname__r% r' r) r* r- r3 r= r. rN rQ rL rd re r� r8 r rc rP r� r� r� r� rS r� r� r� r� r� r� r� rT r� r� r� r� r� r� r� r� rw r^ r� r� r� r� r� r� r� rW r� r� r� r� r� r� r� r� r� rX r� r� r� r� r� r� r� r\ r� r� r� r� r� r� r] r� r� r� r� r� r� r_ r� r� r� r� r r rV r r� r r r� r r rU r r� r
r r� r
r r r r r r rn r r� r# r" r� r� r� rr rs rt ru rv rq rp r rJ rQ rR ro rl rm rY r# r# r# r$ r s$
' ? . , # , # :
' ( ' ( '
+ ) ) @ @ ( P r )'rh r. Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r
r r r� r
r r r r r r r r r r Z firewall.core.fw_transactionr Zfirewallr Zfirewall.errorsr Zfirewall.fw_typesr Zfirewall.core.baser �objectr r# r# r# r$ �<module> s 04 core/__pycache__/icmp.cpython-36.opt-1.pyc 0000644 00000004265 15035135173 0014233 0 ustar 00 3
��g � # @ s� d dddgZ ddddddd d
d d d
dddddddddddddddd d d d d d!d"d#d$�"Zd%d&d'd(d)dddd*d+d,d,d-d-d.d/d0d0d1d1d2d3�Zd4d5� Zd6d� Zd7d8� Zd9d� Zd:S );�
ICMP_TYPES� ICMPV6_TYPES�check_icmp_type�check_icmpv6_typez0/0z3/0z3/1z3/2z3/3z3/4z3/5z3/6z3/7z3/9z3/10z3/11z3/12z3/13z3/14z3/15z4/0z5/0z5/1z5/2z5/3z8/0z9/0z10/0z11/0z11/1z12/0z12/1z13/0z14/0z17/0z18/0)"z
echo-reply�pongznetwork-unreachablezhost-unreachablezprotocol-unreachablezport-unreachablezfragmentation-neededzsource-route-failedznetwork-unknownz host-unknownznetwork-prohibitedzhost-prohibitedzTOS-network-unreachablezTOS-host-unreachablezcommunication-prohibitedzhost-precedence-violationzprecedence-cutoffz
source-quenchznetwork-redirectz
host-redirectzTOS-network-redirectzTOS-host-redirectz echo-request�pingzrouter-advertisementzrouter-solicitationzttl-zero-during-transitzttl-zero-during-reassemblyz
ip-header-badzrequired-option-missingztimestamp-requestztimestamp-replyzaddress-mask-requestzaddress-mask-replyz1/0z1/1z1/3z1/4z2/0z4/1z4/2z128/0z129/0z133/0z134/0z135/0z136/0z137/0)zno-routezcommunication-prohibitedzaddress-unreachablezport-unreachablezpacket-too-bigzttl-zero-during-transitzttl-zero-during-reassemblyz
bad-headerzunknown-header-typezunknown-optionz echo-requestr z
echo-replyr zrouter-solicitationzrouter-advertisementzneighbour-solicitationzneigbour-solicitationzneighbour-advertisementzneigbour-advertisementZredirectc C s | t kr dS dS )NTF)r )�_name� r �/usr/lib/python3.6/icmp.py�check_icmp_nameV s r
c C s | t j� krdS dS )NTF)r �values)�_typer r r r [ s c C s | t kr dS dS )NTF)r )r r r r �check_icmpv6_name` s r
c C s | t j� krdS dS )NTF)r r )r r r r r e s N)�__all__r r r
r r
r r r r r �<module> sx core/__pycache__/helper.cpython-36.pyc 0000644 00000000256 15035135173 0013617 0 ustar 00 3
��g$ � @ s d Z dZdS )zThe helper maxnamelen� N)�__doc__ZHELPER_MAXNAMELEN� r r � /usr/lib/python3.6/helper.py�<module> s core/__pycache__/fw_service.cpython-36.pyc 0000644 00000003201 15035135173 0014465 0 ustar 00 3
��gg � @ s2 d gZ ddlmZ ddlmZ G dd � d e�ZdS )�FirewallService� )�errors)�
FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dS )r c C s || _ i | _d S )N)Z_fw� _services)�self�fw� r � /usr/lib/python3.6/fw_service.py�__init__ s zFirewallService.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r r r r �__repr__ s zFirewallService.__repr__c C s | j j� d S )N)r �clear)r r r r �cleanup# s zFirewallService.cleanupc C s t | jj� �S )N)�sortedr �keys)r r r r � get_services( s z FirewallService.get_servicesc C s || j krttj|��d S )N)r r r ZINVALID_SERVICE)r �servicer r r �
check_service+ s
z FirewallService.check_servicec C s | j |� | j| S )N)r r )r r r r r � get_service/ s
zFirewallService.get_servicec C s || j |j< d S )N)r �name)r �objr r r � add_service3 s zFirewallService.add_servicec C s | j |� | j|= d S )N)r r )r r r r r �remove_service6 s
z FirewallService.remove_serviceN) �__name__�
__module__� __qualname__r
r r r r r r r r r r r r s N)�__all__Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/ipset.cpython-36.pyc 0000644 00000021161 15035135173 0013462 0 ustar 00 3
��gq2 � @ s� d Z dddgZddlZddlZddlmZ ddlmZ ddl m
Z
dd l m Z dd
l
mZmZ dd lmZ d Zd
ddddddddddg Zddddd�Zd d d d �ZG d d� de�Zd!d� Zd"d� Zd#d$� Zd%d&� Zd'd(� Z dS ))zThe ipset command wrapper�ipset�check_ipset_name� remove_default_create_options� N)�errors)�
FirewallError)�runProg)�log)�tempFile�readfile)�COMMANDS� zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz
inet|inet6�valuez
value in secs)�family�hashsize�maxelem�timeoutZinetZ1024Z65536)r r r c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd'd
d�Z dd� Z
dd� Z dd� Z d(dd�Z
d)dd�Zdd� Zd*dd �Zd+d d �Zd d � Zd!d"� Zd#d$� Zd%d&� Zd S ),r zipset command wrapper classc C s t d | _d| _d S )Nr )r �_command�name)�self� r �/usr/lib/python3.6/ipset.py�__init__K s
zipset.__init__c C s^ dd� |D �}t jd| j| jdj|�� t| j|�\}}|dkrZtd| jdj|�|f ��|S )zCall ipset with argsc S s g | ] }d | �qS )z%sr )�.0�itemr r r �
<listcomp>R s z ipset.__run.<locals>.<listcomp>z %s: %s %s� r z'%s %s' failed: %s)r �debug2� __class__r �joinr �
ValueError)r �argsZ_args�status�retr r r Z__runO s z ipset.__runc C s t |�tkr ttjd| ��dS )zCheck ipset namez ipset name '%s' is not validN)�len�IPSET_MAXNAMELENr r Z INVALID_NAME)r r r r r �
check_nameZ s zipset.check_namec C s� g }d}y| j dg�}W n0 tk
rH } ztjd| � W Y dd}~X nX |j� }d}xT|D ]L}|r�|j� jdd�}|d |kr�|d tkr�|j|d � |j d�r\d }q\W |S )
z?Return types that are supported by the ipset command and kernel� z--helpzipset error: %sNF� r zSupported set types:T)
� _ipset__runr r Zdebug1�
splitlines�strip�split� IPSET_TYPES�append�
startswith)r r" �outputZex�linesZin_types�line�splitsr r r �set_supported_types` s
zipset.set_supported_typesc C s( t |�tks|tkr$ttjd| ��dS )zCheck ipset typez!ipset type name '%s' is not validN)r# r$ r, r r Z INVALID_TYPE)r � type_namer r r �
check_typeu s zipset.check_typeNc C sd | j |� | j|� d||g}t|t�rZx0|j� D ]$\}}|j|� |dkr2|j|� q2W | j|�S )z+Create an ipset with name, type and options�creater& )r% r5 �
isinstance�dict�itemsr- r( )r �set_namer4 �optionsr �key�valr r r �
set_create{ s
zipset.set_createc C s | j |� | jd|g�S )NZdestroy)r% r( )r r: r r r � set_destroy� s
zipset.set_destroyc C s d||g}| j |�S )N�add)r( )r r: �entryr r r r �set_add� s
z
ipset.set_addc C s d||g}| j |�S )N�del)r( )r r: rA r r r r �
set_delete� s
zipset.set_deletec C s, d||g}|r"|j ddj|� � | j|�S )N�testz%sr )r- r r( )r r: rA r; r r r r rE � s
z
ipset.testc C s2 dg}|r|j |� |r"|j|� | j|�jd�S )N�list�
)r- �extendr( r+ )r r: r; r r r r �set_list� s
zipset.set_listc C s< | j dgd�}i }d }}i }�x|D �] }t|�dk r:q&dd� |jdd�D �}t|�dkr`q&q&|d d
krv|d }q&|d d kr�|d }q&|d d kr&|d j� }d } x^| t|�k �r|| }
|
dk� r�t|�| kr�| d7 } || ||
< ntjd|� i S | d7 } q�W |�r$|�r$|t|�f||< d }}|j� q&W |S )z" Get active ipsets (only headers) z-terse)r; N� c S s g | ] }|j � �qS r )r* )r �xr r r r � s z.ipset.set_get_active_terse.<locals>.<listcomp>�:r' r �NameZTypeZHeaderr r r r �netmaskz&Malformed ipset list -terse output: %s)r r r r rN )rI r# r+ r �errorr �clear) r r0 r" �_nameZ_type�_optionsr1 Zpairr2 �i�optr r r �set_get_active_terse� sD
zipset.set_get_active_tersec C s dg}|r|j |� | j|�S )N�save)r- r( )r r: r r r r rV � s
z
ipset.savec C s� | j |� | j|� t� }d|kr*d| }d||dg}|rlx0|j� D ]$\}} |j|� | dkrD|j| � qDW |jddj|� � |jd| � xN|D ]F}
d|
kr�d|
}
|r�|jd||
dj|�f � q�|jd ||
f � q�W |j� tj |j
�} t j d
| j
| jd |j
| jf � d g}t| j||j
d
�\} }
t j� dk�r�yt|j
� W n tk
�r` Y nVX d}xNt|j
�D ]@}t jd||f ddd� |jd��s�t jddd� |d7 }�qrW tj|j
� | dk�r�td| jdj|�|
f ��|
S )Nr z'%s'r6 z-existr& z%s
z flush %s
z
add %s %s %s
z
add %s %s
z%s: %s restore %sz%s: %dZrestore)�stdinr' rJ z%8d: %sr )�nofmt�nlrG )rX z'%s %s' failed: %s)r% r5 r r9 r- �writer �close�os�statr r r r r �st_sizer ZgetDebugLogLevelr
� ExceptionZdebug3�endswith�unlinkr )r r: r4 �entriesZcreate_optionsZ
entry_optionsZ temp_filer r< r= rA r] r! r" rS r1 r r r � set_restore� sV
zipset.set_restorec C s dg}|r|j |� | j|�S )N�flush)r- r( )r r: r r r r � set_flush s
zipset.set_flushc C s | j d||g�S )N�rename)r( )r Z old_set_nameZ new_set_namer r r rf
s z ipset.renamec C s | j d||g�S )N�swap)r( )r Z
set_name_1Z
set_name_2r r r rg s z
ipset.swapc C s | j dg�S )N�version)r( )r r r r rh s z
ipset.version)N)N)NN)N)NN)�__name__�
__module__� __qualname__�__doc__r r( r% r3 r5 r> r? rB rD rE rI rU rV rc re rf rg rh r r r r r H s&
'
7c C s t | �tkrdS dS )z"Return true if ipset name is validFT)r# r$ )r r r r r s c C s8 | j � }x*tD ]"}||krt| || kr||= qW |S )z( Return only non default create options )�copy� IPSET_DEFAULT_CREATE_OPTIONS)r; rR rT r r r r s
c
C sh g }xX| j d�D ]J}y&|jd� |jttj|dd��� W q tk
rX |j|� Y qX qW dj|�S )z! Normalize IP addresses in entry �,�/F)�strict)r+ �indexr- �str� ipaddress�
ip_networkr r )rA Z_entryZ_partr r r �normalize_ipset_entry& s
rv c C sx t | jd��dkrdS ytj| dd�}W n tk
r< dS X x4|D ],}|jtj|dd��rDttjdj | |���qDW dS )z: Check if entry overlaps any entry in the list of entries ro rJ NF)rq z,Entry '{}' overlaps with existing entry '{}')
r# r+ rt ru r �overlapsr r �
INVALID_ENTRY�format)rA rb Z
entry_networkZitrr r r � check_entry_overlaps_existing2 s
rz c C s~ ydd� | D �} W n t k
r& dS X t| �dkr8dS | j� | jd�}x.| D ]&}|j|�rrttjdj||���|}qPW dS )z> Check if any entry overlaps any entry in the list of entries c S s g | ]}t j|d d��qS )F)rq )rt ru )r rK r r r r E s z1check_for_overlapping_entries.<locals>.<listcomp>Nr z Entry '{}' overlaps entry '{}') r r# �sort�poprw r r rx ry )rb Z prev_networkZcurrent_networkr r r � check_for_overlapping_entriesB s 2
r} ) rl �__all__Zos.pathr\ rt Zfirewallr Zfirewall.errorsr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r
Zfirewall.configr r$ r, ZIPSET_CREATE_OPTIONSrn �objectr r r rv rz r} r r r r �<module> sF
P core/__pycache__/nftables.cpython-36.pyc 0000644 00000130376 15035135173 0014145 0 ustar 00 3
��g� � % @ sl d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m
Z
m Z m Z d dl
mZmZmZmZmZmZmZ d dlmZmZmZmZmZmZm Z d dl m Z dZ e d d
Z d Z!d Z"i d
ddCe" fiddDe" fdde" fd�dd e" fdd e" fdd e" fdd e" fd�d�Z#dEdd�Z$e$ddd �e$dd�e$dd �e$dd �e$ddd �e$ddd �e$ddd �e$dd!d"�e$ddd#�e$ddd"�e$dd$d"�e$ddd%�e$dd!d �e$ddd&�e$ddd �e$dd$�e$ddd'�e$ddd(�e$ddd)�e$dd!�e$dd$d"�e$dd*�e$dd+�e$dd,�e$ddd-�e$dd.�e$dd/�e$dd0�e$dd!d'�e$ddd1�e$dd!d)�e$ddd2�e$dd.d"�e$dd.d �d3�"e$d4dd'�e$d4d$d �e$d4dd)�e$d4dd"�e$d4d�e$d4d �e$d4d �e$d4dd-�e$d4d5�e$d4d6�e$d4d7�e$d4d8�e$d4d9�e$d4d:�e$d4dd �e$d4d;�e$d4d$�e$d4dd �e$d4d<�e$d4dd&�e$d4d=�e$d4d>�e$d4d.�e$d4d.d"�e$d4d.d �e$d4d$d"�e$d4d$d)�d?�d@�Z%G dAdB� dBe&�Z'dS )F� )�absolute_importN)�log)� check_mac� getPortRange� normalizeIP6�check_single_address�
check_address)�
FirewallError�
UNKNOWN_ERROR� INVALID_RULE�INVALID_ICMPTYPE� INVALID_TYPE�
INVALID_ENTRY� INVALID_PORT)� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock)�NftablesZ firewalld�_Z policy_dropZpolicy_�
�
PREROUTING�
prerouting� �d Z postrouting)r � POSTROUTING�input�forward�output)r �INPUT�FORWARD�OUTPUT)�raw�mangle�nat�filterc C sH dd| dd�id|d�ig}|d k rD|j dd| dd�id|d�i� |S )N�match�payload�type)�protocol�fieldz==)�left�op�right�code)�append)r, r+ r1 � fragments� r4 � /usr/lib/python3.6/nftables.py�_icmp_types_fragmentsS s r6 �icmpzdestination-unreachable�
z
echo-replyz echo-request� � �redirect� � zparameter-problem� � � � � zrouter-advertisementzrouter-solicitationz
source-quench� z
time-exceededztimestamp-replyztimestamp-request� � )"zcommunication-prohibitedzdestination-unreachablez
echo-replyz echo-requestzfragmentation-neededzhost-precedence-violationzhost-prohibitedz
host-redirectz host-unknownzhost-unreachablez
ip-header-badznetwork-prohibitedznetwork-redirectznetwork-unknownznetwork-unreachablezparameter-problemzport-unreachablezprecedence-cutoffzprotocol-unreachabler; zrequired-option-missingzrouter-advertisementzrouter-solicitationz
source-quenchzsource-route-failedz
time-exceededztimestamp-replyztimestamp-requestztos-host-redirectztos-host-unreachableztos-network-redirectztos-network-unreachablezttl-zero-during-reassemblyzttl-zero-during-transit�icmpv6zmld-listener-donezmld-listener-queryzmld-listener-reportzmld2-listener-reportznd-neighbor-advertznd-neighbor-solicitzpacket-too-bigz nd-redirectznd-router-advertznd-router-solicit)zaddress-unreachablez
bad-headerz beyond-scopezcommunication-prohibitedzdestination-unreachablez
echo-replyz echo-requestz
failed-policyzmld-listener-donezmld-listener-queryzmld-listener-reportzmld2-listener-reportzneighbour-advertisementzneighbour-solicitationzno-routezpacket-too-bigzparameter-problemzport-unreachabler; z reject-routezrouter-advertisementzrouter-solicitationz
time-exceededzttl-zero-during-reassemblyzttl-zero-during-transitzunknown-header-typezunknown-option)�ipv4�ipv6c @ s` e Zd Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Z d d
� Z
dd� Z d�dd�Z dd� Z
dd� Zdd� Zdd� Zd�dd �Zd d � Zd�d d!�Zd"d#� Zd�d%d&�Zd�d(d)�Zd�d*d+�Zd�d,d-�Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&d�dJdK�Z'dLdM� Z(dNdO� Z)dPdQ� Z*dRdS� Z+d�dTdU�Z,d�dVdW�Z-d�dXdY�Z.dZd[� Z/d�d\d]�Z0d�d^d_�Z1d�d`da�Z2d�dbdc�Z3d�ddde�Z4dfdg� Z5d�dhdi�Z6djdk� Z7d�dldm�Z8dndo� Z9dpdq� Z:drds� Z;dtdu� Z<d�dvdw�Z=d�dxdy�Z>dzd{� Z?d�d|d}�Z@d~d� ZAd�d�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�d��ZHdS )��nftablesTc C sb || _ d| _g | _i | _i | _i | _i | _i | _g g g d�| _t � | _
| j
j d� | j
j d� d S )NT)�inet�ip�ip6)
�_fwZrestore_command_existsZavailable_tables�rule_to_handle�rule_ref_count�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache�created_tablesr rI Zset_echo_outputZset_handle_output)�self�fwr4 r4 r5 �__init__� s znftables.__init__c C s� xdD ]}||krP qW d|| d kr`|| d d d || d d d f}|| d d= n(d|| d kr�d }|| d d= nd S || d d }|r�|dkr�||kr�||| kr�|| j |� n�|dk�r�||kr�g ||< |�r(||| k�r|| j|� || jd
d � d � || j|�}n | jj�r8d
}n t|| �}|| }||= |d
k�rf||d< n |d8 }||d< ||d d d< d S )N�add�insert�deletez%%ZONE_SOURCE%%�rule�zone�addressz%%ZONE_INTERFACE%%�familyc S s | d S )Nr r4 )�xr4 r4 r5 �<lambda>� s z3nftables._run_replace_zone_source.<locals>.<lambda>)�keyr r< �index)rW rX rY )�remover2 �sortra rM �_allow_zone_drifting�len)rT rZ rR �verbZ zone_sourcer] ra �
_verb_snippetr4 r4 r5 �_run_replace_zone_source� sD
z!nftables._run_replace_zone_sourcec C sB d|krdt j|d �iS d|kr4dt j|d �iS ttd��d S )NrX rY rW zFailed to reverse rule)�copy�deepcopyr r
)rT �dictr4 r4 r5 � reverse_rule� s
znftables.reverse_rulec
C s� xd D ]}||krP qW ||| d k�r�|| d | }|| d |= t |�tkr^ttd��|| d d || d d f}|dkr�||ks�||| ks�|| | dkr�ttd ��|| | d
8 < n�||kr�i ||< ||| kr�d|| |< d}xVt|| j� �D ]B}||k�r"|dk�r"P ||| | 7 }||k�r|dk�rP �qW || | d
7 < || } ||= |dk�r�| |d< n |d
8 }| |d< ||d d d < d S )
NrW rX rY rZ z%priority must be followed by a numberr] �chainr z*nonexistent or underflow of priority countr< ra )rW rX rY )r+ �intr r r
�sorted�keys)
rT rZ Zpriority_counts�tokenrf �priorityrm ra �prg r4 r4 r5 �_set_rule_replace_priority� sD
z#nftables._set_rule_replace_priorityc C sf x`d
D ]X}||krd|| krt j|| d �}xd D ]}||kr6||= q6W tj|dd �}|S qW d S ) NrW rX rY rZ ra �handle�positionT)Z sort_keys)rW rX rY )ra ru rv )ri rj �json�dumps)rT rZ rf �rule_keyZnon_keyr4 r4 r5 �
_get_rule_key s
znftables._get_rule_keyc C sL dddddg}dddg}g }g }t j| j�}t j| j�}t j| j�} | jj � }
�x�|D �]�} t| �tkrvtt d| ��x|D ]} | | kr|P q|W | | kr�tt
d| ��| j | �}
|
|
k�rDt j
d| j|
|
|
� | dkr�|
|
d 7 < qVnX|
|
d k�r |
|
d 8 < qVn6|
|
d k�r,|
|
d 8 < ntt d
|
|
|
f ��n|
�r\| dk�r\d |
|
< |j| � t j| �}|
�rttd || d d ��|| d d < | j||d
� | j||d� | j|| � | dk�rdd |d d d |d d d |d d d | j|
d�ii}|j|� qVW dddd iig| i}t j� dk�rVt jd| jtj|�� | jj|�\}}}|dk�r�tdd|tj|�f ��|| _|| _| | _|
| _d}x�|D ]�} |d 7 }| j | �}
|
�s̐q�d| k�r�| j|
= | j|
= �q�x"|D ]} | |d | k�r�P �q�W | |d | k�r$�q�|d | | d d | j|
< �q�W d S ) NrW rX rY �flush�replacez#rule must be a dictionary, rule: %sz no valid verb found, rule: %sz %s: prev rule ref cnt %d, %sr< z)rule ref count bug: rule_key '%s', cnt %drZ �exprz%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%r] �tablerm )r] r~ rm ru rI ZmetainfoZjson_schema_versionr@ z.%s: calling python-nftables with JSON blob: %sr z '%s' failed: %s
JSON blob:
%szpython-nftablesru ) ri rj rP rQ rR rO r+ rk r r
r rz r Zdebug2� __class__r2 �listr( rt rh rN ZgetDebugLogLevelZdebug3rw rx rI Zjson_cmd�
ValueError)rT �rules�
log_deniedZ _valid_verbsZ_valid_add_verbsZ_deduplicated_rulesZ_executed_rulesrP rQ rR rO rZ rf ry Z_ruleZ json_blobZrcr! �errorra r4 r4 r5 � set_rules+ s�
&
znftables.set_rulesc C s | j |g|� dS )N� )r� )rT rZ r� r4 r4 r5 �set_rule� s znftables.set_ruleNc C s |r
|gS t j� S )N)�IPTABLES_TO_NFT_HOOKrp )rT r~ r4 r4 r5 �get_available_tables� s z nftables.get_available_tablesc C sF g }x<dD ]4}|j dd||d�ii� |j dd||d�ii� q
W |S ) NrJ rK rL rW r~ )r] �namerY )rJ rK rL )r2 )rT r~ r� r] r4 r4 r5 �_build_delete_table_rules� s
z"nftables._build_delete_table_rulesc C s� i }i }xB| j d�D ]4}| j|�}|| jkr| j| ||< | j| ||< qW || _|| _i | _i | _i | _x*dD ]"}t| j| krp| j| j t� qpW | j
t�S )NTrJ rK rL )rJ rK rL ) � _build_set_policy_rules_ct_rulesrz rN rO rP rQ rR �
TABLE_NAMErS rb r� )rT Zsaved_rule_to_handleZsaved_rule_ref_countrZ �
policy_keyr] r4 r4 r5 �build_flush_rules� s
znftables.build_flush_rulesc
C sl ddd�| }g }xTdD ]L}|j |ddtd d
|f d d d
diiddddgid�idd igd�ii� qW |S )NrW rY )TFr r r! rZ rJ z%s_%sr( r) �ctr` �state�in�set� established�related)r. r/ r0 �accept)r] r~ rm r} )r r r! )r2 �TABLE_NAME_POLICY)rT �enable�add_delr� �hookr4 r4 r5 r� � s
z)nftables._build_set_policy_rules_ct_rulesc C st g }|dkrt|j dddtd�ii� | jd j t� x>dD ]6}|j dddtd d
|f d |dt d
dd�ii� q:W |dk� r�|j dddtd�ii� | jd j t� x>dD ]6}|j dddtd d |f d |dt d
dd�ii� q�W || jd�7 }nz|dk�rfx4| jd�D ]&}| j|�}|| jk�r |j |� �q W || jt�7 }t| jd k�rp| jd jt� n
t t
d� |S )NZPANICrW r~ rJ )r] r� r r! rm z%s_%sr% r( i, r< �drop)r] r~ r� r+ r� �prio�policy�DROPr r r T�ACCEPTFznot implemented)r r! i���)r r r! ) r2 r� rS �NFT_HOOK_OFFSETr� rz rN r� rb r r
)rT r� r� r� rZ r� r4 r4 r5 �build_set_policy_rules� sH
z nftables.build_set_policy_rulesc C s< t � }x,|r|gntj� D ]}|jt| j� � qW t|�S )N)r� �ICMP_TYPES_FRAGMENTSrp �updater� )rT �ipvZ supportedZ_ipvr4 r4 r5 �supported_icmp_types� s z nftables.supported_icmp_typesc C s> g }x4dD ],}|j dd|td�ii� | j| j t� q
W |S )NrJ rK rL rW r~ )r] r� )rJ rK rL )r2 r� rS )rT Zdefault_tablesr] r4 r4 r5 �build_default_tables s
z nftables.build_default_tables�offc C s� g }x�t d j� D ]�}|jdddtd| ddt d | d t d | d d
�ii� xz| jjrld d d
dgnd d
dgD ]X}|jdddtd||f d�ii� |jdddtd| ddd||f iigd�ii� qvW qW x�d?D ]�}x�t d j� D ]�}|jdd|td| ddt d | d t d | d d
�ii� x~| jj�rJd d d
dgnd d
dgD ]Z}|jdd|td||f d�ii� |jdd|td| ddd||f iigd�ii� �qTW q�W q�W xVt d j� D ]F}|jdddtd| ddt d | d t d | d d
�ii� �q�W |jdddtdd d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtdd d d d d&iid d'd$�id%d igd�ii� |jdddtdd d d(d d)iid*d+d$�id%d igd�ii� x~| jj�r�d d d
dgnd d
dgD ]Z}|jdddtd,d|f d�ii� |jdddtdd ddd,d|f iigd�ii� �q�W |d-k�r�|jdddtdd d d d d iid d!d.gid$�i| j|�d/d0d1iigd�ii� |jdddtdd d d d d iid d!d.gid$�id2d igd�ii� |d-k�r$|jdddtdd | j|�d/d0d3iigd�ii� |jdddtdd d4d5d6d7�igd�ii� |jdddtdd8 d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtdd8 d d d d&iid d'd$�id%d igd�ii� |jdddtdd8 d d(d d)iid*d+d$�id%d igd�ii� xbd@D ]Z}|jdddtd,d8|f d�ii� |jdddtdd8 ddd,d8|f iigd�ii� �qW x�dAD ]�}xz| jj�r�d d
gnd
gD ]^}|jdddtd;d8||f d�ii� |jdddtdd8 ddd;d8||f iigd�ii� �q�W �qvW xbdBD ]Z}|jdddtd,d8|f d�ii� |jdddtdd8 ddd,d8|f iigd�ii� �qW |d-k�r�|jdddtdd8 d d d d iid d!d.gid$�i| j|�d/d0d1iigd�ii� |jdddtdd8 d d d d iid d!d.gid$�id2d igd�ii� |d-k�r6|jdddtdd8 | j|�d/d0d3iigd�ii� |jdddtdd8 d4d5d6d7�igd�ii� |jdddtdd< d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtd=d d(d d>iid*d+d$�id%d igd�ii� xbdCD ]Z}|jdddtd,d<|f d�ii� |jdddtdd< ddd,d<|f iigd�ii� �q�W xbdDD ]Z}|jdddtd,d<|f d�ii� |jdddtdd< ddd,d<|f iigd�ii� �qHW |S )ENr& rW rm rJ z mangle_%sr( z%sr r< )r] r~ r� r+ r� r� � POLICIES_preZ ZONES_SOURCEZZONES�
POLICIES_postz mangle_%s_%s)r] r~ r� rZ �jump�target)r] r~ rm r} rK rL r' znat_%sz nat_%s_%sz filter_%sr" r) r� r` r� r� r� r� r� )r. r/ r0 r� Zstatus�dnat�meta�iifnamez==�loz filter_%s_%sr� Zinvalidr �prefixzSTATE_INVALID_DROP: r� zFINAL_REJECT: �reject�icmpxzadmin-prohibited)r+ r} r# �IN�OUTzfilter_%s_%s_%sr$ �
filter_OUTPUT�oifname)rK rL )r� )r� r� )r� )r� )r� )r� rp r2 r� rM rd �_pkttype_match_fragment)rT r� Z
default_rulesrm Zdispatch_suffixr] � directionr4 r4 r5 �build_default_rules s�
$
(
&
.
&
&
&
.
&
&
&z nftables.build_default_rulesc C s4 |dkrdddgS |dkr dgS |dkr0ddgS g S ) Nr( r" �
FORWARD_IN� FORWARD_OUTr& r r' r r4 )rT r~ r4 r4 r5 �get_zone_table_chains� s
z nftables.get_zone_table_chainsrJ c
s� �dkr\�dkr\g }
|
j �j�|��||||dd� � |
j �j�|��||||dd� � |
S �jjj|���jdk rxdnd��dkr��d kr�d
nd } �jjj|�t| �� g } g }
|r�| jd d
ddiiddt |�id�i� |�r|
jd d
ddiiddt |�id�i� ddd�}|�rlxT|D ]L}�dk�rT�jj
j |�}||k�rT�|| k�rT�q | j�j d|�� �q W |�r�xT|D ]L}�dk�r��jj
j |�}||k�r��|| k�r��qx|
j�j d|�� �qxW � �������fdd�}g }
| �rHx�| D ]P}|
�r xB|
D ]}|
j|||�� �qW n"�dk�r0|�r0n|
j||d �� �q�W n\�dk�rZ|�rZnJ|
�r�xB|
D ]}|
j|d |�� �qfW n"�dk�r�|�r�n|
j|d d �� |
S )Nr' rJ rK )r] rL r �pre�postr TFr) r� r` r� z==r� )r. r/ r0 r� )rG rH �saddr�daddrc s� g }| r|j | � |r |j |� |j ddd�� f ii� �td���f |d�}|j�j��� �rrdd|iiS dd|iiS d S ) Nr� r� z%s_%sz%s_%s_POLICIES_%s)r] r~ rm r} rW rZ rY )r2 r� r� �_policy_priority_fragment)�ingress_fragment�egress_fragment�expr_fragmentsrZ )�_policyrm � chain_suffixr� r] �p_objrT r~ r4 r5 � _generate_policy_dispatch_rule s
zRnftables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule)
�extend�!build_policy_ingress_egress_rulesrM r� Z
get_policyrr �policy_base_chain_name�POLICY_CHAIN_PREFIXr2 r� r[ Z check_source�_rule_addr_fragment)rT r� r� r~ rm Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesr] r� �isSNATZingress_fragmentsZegress_fragmentsZ
ipv_to_family�srcr� �dstr� r� r� r4 )r� rm r� r� r] r� rT r~ r5 r� � sv
z*nftables.build_policy_ingress_egress_rulesFc
C s� |dkrT|dkrTg } | j | j|||||||d�� | j | j|||||||d�� | S |dkrh|dkrhdnd}
| jjj||t|
d�} d d
d d d
d
d �| } |t|�d d
kr�|d t|�d � d }d}
|dkr�|
dd|| f iig}n,ddd| iid|d�i|
dd|| f iig}|�rL| �rLd}|td||f |d�}|j| j � � nP|�rnd}|td||f |d�}n.d}|td||f |d�}|�s�|j| j � � |d |iigS ) Nr' rJ rK rL r TF)r� r� r� )r r r" r� r� r$ r< �+�*�gotor� z%s_%sr) r� r` z==)r. r/ r0 rX z %s_%s_ZONES)r] r~ rm r} rW rY rZ )
r� �!build_zone_source_interface_rulesrM r� r� r� re r� r� �_zone_interface_fragment)rT r� r[ r� � interfacer~ rm r2 r] r� r� r� �opt�actionr� rf rZ r4 r4 r5 r� Q s\
z*nftables.build_zone_source_interface_rulesc C sn |dkr�|dkr�g }|j d�r6| j|td�d � �} nd } td|�sTt|�sT| dkrp|j| j||||||d�� td|�s�t|�s�| dkr�|j| j||||||d�� |S |dkr�|dkr�d nd
}
| jjj ||t
|
d �} d d
d�| } ddddddd�| }
| jj �rd||f }n d||f }d}|t || j
|
|�|dd|| f iigd�}|j| j||�� | d|iigS )Nr' rJ zipset:rG rK rH rL r TF)r� rX rY )TFr� r� )r r r" r� r� r$ z%s_%s_ZONES_SOURCEz %s_%s_ZONESr� r� z%s_%s)r] r~ rm r} rZ )�
startswith�_set_get_familyre r r r� � build_zone_source_address_rulesrM r� r� r� rd r� r� r� �_zone_source_fragment)rT r� r[ r� r\ r~ rm r] r� Z ipset_familyr� r� r� r� Zzone_dispatch_chainr� rZ r4 r4 r5 r� � sB
z(nftables.build_zone_source_address_rulesc
C s |dkrH|dkrHg }|j | j||||d�� |j | j||||d�� |S ddd�| }|dkrj|dkrjd nd
}| jjj||t|d �} g }|j|d |td
|| f d�ii� x0d!D ](}
|j|d |td|| |
f d�ii� q�W xDd"D ]<}
|j|d|td
|| f ddd|| |
f iigd�ii� q�W | jjj| j } | jj
� dk�r�|dk�r�| d#k�r�| } | d k�rhd} |j|d|td
|| f | j | jj
� �dd d | | f iigd�ii� |dk�r| d$k�r| d%k�r�| j � }
n | j
� d i}
|j|d|td
|| f |
gd�ii� |�s|j� |S )&Nr' rJ rK rL rW rY )TFr TF)r� rm z%s_%s)r] r~ r� r� r �deny�allowr� z%s_%s_%srZ r� r� )r] r~ rm r} r� r( �REJECT�
%%REJECT%%r� r� z"filter_%s_%s: "r� )r� r r� r� r� )r� r r� r� r� )r� r� r� )r� r� r� r� )r� r� )r� �build_policy_chain_rulesrM r� r� r� r2 r� Z _policiesr� �get_log_deniedr� �_reject_fragment�lower�reverse)rT r� r� r~ rm r] r� r� r� r� r� r� Z
log_suffix�target_fragmentr4 r4 r5 r� � sZ
&
z!nftables.build_policy_chain_rulesc C s< |dkr i S |d kr,ddddiid |d
�iS t td |��d S )
N�all�unicast� broadcast� multicastr) r� r` �pkttypez==)r. r/ r0 zInvalid pkttype "%s")r� r� r� )r r )rT r� r4 r4 r5 r� � s
z nftables._pkttype_match_fragmentc C s dddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�iddd d�iddd d�iddd
d�iddd
d�idd d
d�iddd d�iddd d�iddd
d�iddd
d�idddd�idddd�idddiidddiid�}|| S )Nr� r7 zhost-prohibited)r+ r} znet-prohibitedzadmin-prohibitedrF znet-unreachablezhost-unreachablezport-unreachabler� zprot-unreachablezaddr-unreachablezno-router+ z tcp reset)zicmp-host-prohibitedz host-prohibzicmp-net-prohibitedz
net-prohibzicmp-admin-prohibitedz admin-prohibzicmp6-adm-prohibitedzadm-prohibitedzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachablezicmp6-port-unreachablez port-unreachzicmp-proto-unreachablez
proto-unreachzicmp6-addr-unreachablez addr-unreachzicmp6-no-routezno-routez tcp-resetztcp-rstr4 )rT Z reject_typeZfragsr4 r4 r5 �_reject_types_fragment� s0
z nftables._reject_types_fragmentc C s dddd�iS )Nr� r� zadmin-prohibited)r+ r} r4 )rT r4 r4 r5 r� s znftables._reject_fragmentc C s ddddiiddddgid �iS )
Nr) r� r` �l4protoz==r� r7 rF )r. r/ r0 r4 )rT r4 r4 r5 �_icmp_match_fragment" s z nftables._icmp_match_fragmentc C sP |si S ddddd�}|j � \}}||| d�}|j� }|d k rH||d< d|iS ) N�secondZminuteZhourZday)�s�m�h�d)�rateZper�burst�limit)Z value_parseZ burst_parse)rT r� Z rich_to_nftr� Zdurationr� r� r4 r4 r5 �_rich_rule_limit_fragment' s z"nftables._rich_rule_limit_fragmentc C s� t |j�tttgkrn<|jrHt |j�tttt gkrRt
t dt |j� ��n
t
t d��|j dkr�t |j�ttgks�t |j�tt gkr�dS t |j�tgks�t |j�ttgkr�dS n|j dk r�dS dS d S )NzUnknown action %szNo rule action specified.r r� r� r� r� )
r+ �elementr r r r� r r r r r r rr )rT � rich_ruler4 r4 r5 �_rich_rule_chain_suffix? s
z nftables._rich_rule_chain_suffixc C s> |j r|j rttd��|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r� r� )r �auditr r rr )rT r� r4 r4 r5 � _rich_rule_chain_suffix_from_logU s
z)nftables._rich_rule_chain_suffix_from_logc C s dd iS )Nz%%ZONE_INTERFACE%%r4 )rT r4 r4 r5 r� ` s z!nftables._zone_interface_fragmentc C sN t d|�rt|�}n,td|�r@|jd�}t|d �d |d }d||d�iS )NrH �/r r< z%%ZONE_SOURCE%%)r[ r\ )r r r �split)rT r[ r\ Z
addr_splitr4 r4 r5 r� c s
z nftables._zone_source_fragmentc C s
d|j iS )Nz%%POLICY_PRIORITY%%)rr )rT r� r4 r4 r5 r� k s z"nftables._policy_priority_fragmentc C s | s|j dkri S d|j iS )Nr z%%RICH_RULE_PRIORITY%%)rr )rT r� r4 r4 r5 � _rich_rule_priority_fragmentn s z%nftables._rich_rule_priority_fragmentc C s� |j s
i S | jjj||t�}ddd�| }| j|�}i } |j jrPd|j j | d< |j jr|d|j jkrhdn|j j}
d|
| d< d td
|||f || j |j j
�d | ig d �} | j | j |�� |d
| iiS )NrW rY )TFz%sr� Zwarning�warn�levelrJ z%s_%s_%sr )r] r~ rm r} rZ )
r rM r� r� r� r� r� r r� r� r� r� r� ) rT r� r� r� r~ r� r� r� r� Z log_optionsr rZ r4 r4 r5 �_rich_rule_logs s&
znftables._rich_rule_logc
C s� |j s
i S | jjj||t�}ddd�| }| j|�}dtd|||f || j|j j�dddiig d �} | j | j
|�� |d
| iiS ) NrW rY )TFrJ z%s_%s_%sr r r� )r] r~ rm r} rZ ) r� rM r� r� r� r� r� r� r� r� r� )
rT r� r� r� r~ r� r� r� r� rZ r4 r4 r5 �_rich_rule_audit� s
znftables._rich_rule_auditc
C s� |j s
i S | jjj||t�}ddd�| }| j|�}d|||f } t|j �tkr\dd i}
�n t|j �tkr�|j jr�| j |j j�}
ndd i}
n�t|j �t
kr�dd i}
n�t|j �t k�rHd}| jjj||t�}d|||f } |j j j
d �} t| �d
k�r,dd d d
iiddd d d
ii| d
gi| d gid�i}
ndd d d
ii| d d�i}
nttdt|j � ��dt| || j|j j�|
g d�} | j| j|�� |d| iiS )NrW rY )TFz%s_%s_%sr� r� r� r& r� r< r� r` �mark�^�&r )r` �valuezUnknown action %srJ )r] r~ rm r} rZ )r� rM r� r� r� r� r+ r r r� r r r� r� re r r r� r� r� r� r� )
rT r� r� r� r~ r� r� r� r� rm Z rule_actionr rZ r4 r4 r5 �_rich_rule_action� sB
, znftables._rich_rule_actionc C s� |j d�r0| j|td�d � d|kr(dnd|�S t|�r>d}n�td|�rNd}nvtd|�r�d}tj|dd�}d |jj |j
d
�i}nDtd |�r�d }t |�}n,d }|j d
�}d t |d �t
|d �d
�i}dd||d�i|r�dnd|d�iS d S )Nzipset:r� TF�etherrG rK )�strictr� )�addrre rH rL r� r r< r) r* )r, r- z!=z==)r. r/ r0 )r� �_set_match_fragmentre r r r � ipaddressZ IPv4NetworkZnetwork_addressZ
compressedZ prefixlenr r� rn )rT Z
addr_fieldr\ �invertr] Znormalized_addressZaddr_lenr4 r4 r5 r� � s(
&
z nftables._rule_addr_fragmentc C s6 |si S |d
kr t td| ��ddddiid|d �iS ) NrG rH zInvalid familyr) r� r` �nfprotoz==)r. r/ r0 )rG rH )r r )rT Z rich_familyr4 r4 r5 �_rich_rule_family_fragment� s
z#nftables._rich_rule_family_fragmentc C s8 |si S |j r|j }n|jr&d|j }| jd||jd�S )Nzipset:r� )r )r �ipsetr� r )rT Z rich_destr\ r4 r4 r5 � _rich_rule_destination_fragment� s
z(nftables._rich_rule_destination_fragmentc C sZ |si S |j r|j }n2t|d�r.|jr.|j}nt|d�rH|jrHd|j }| jd||jd�S )N�macr zipset:r� )r )r �hasattrr r r� r )rT Z rich_sourcer\ r4 r4 r5 �_rich_rule_source_fragment� s
z#nftables._rich_rule_source_fragmentc C sP t |�}t|t�r$|dk r$tt��n(t|�dkr8|d S d|d |d giS d S )Nr r< �range)r �
isinstancern r r re )rT �portr r4 r4 r5 �_port_fragment s
znftables._port_fragmentc C sb ddd�| }d}| j jj||t�} g }
|r>|
j| j|j�� |rT|
j| jd|�� |r||
j| j|j �� |
j| j
|j �� |
jdd|dd �id
| j |�d �i� | s�t
|j�tkr�|
jdd d
diiddddgid �i� g } |�r0| j| j|||||
�� | j| j|||||
�� | j| j|||||
�� n.| j|ddtd|| f |
dd ig d�ii� | S )NrW rY )TFr( r� r) r* �dport)r, r- z==)r. r/ r0 r� r` r� r� r� �new� untrackedrZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r � destinationr �sourcer r+ r� r r r r r� ) rT r� r� �protor r r� r� r~ r� r� r� r4 r4 r5 �build_policy_ports_rules s:
z!nftables.build_policy_ports_rulesc C sZ ddd�| }d}| j jj||t�}g } |r>| j| j|j�� |rT| j| jd|�� |r|| j| j|j �� | j| j
|j �� | jdddd iid
|d �i� | s�t |j
�tkr�| jdd dd
iiddddgid �i� g }
|�r(|
j| j||||| �� |
j| j||||| �� |
j| j||||| �� n.|
j|ddtd||f | dd ig d�ii� |
S )NrW rY )TFr( r� r) r� r` r� z==)r. r/ r0 r� r� r� r� r r rZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r r r r r+ r� r r r r r� ) rT r� r� r, r r� r� r~ r� r� r� r4 r4 r5 �build_policy_protocol_rules2 s8
z$nftables.build_policy_protocol_rulesc C sb ddd�| }d}| j jj||t�} g }
|r>|
j| j|j�� |rT|
j| jd|�� |r||
j| j|j �� |
j| j
|j �� |
jdd|dd �id
| j |�d �i� | s�t
|j�tkr�|
jdd d
diiddddgid �i� g } |�r0| j| j|||||
�� | j| j|||||
�� | j| j|||||
�� n.| j|ddtd|| f |
dd ig d�ii� | S )NrW rY )TFr( r� r) r* �sport)r, r- z==)r. r/ r0 r� r` r� r� r� r r rZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r r r r r r+ r� r r r r r� ) rT r� r� r r r r� r� r~ r� r� r� r4 r4 r5 � build_policy_source_ports_rulesU s:
z(nftables.build_policy_source_ports_rulesc
C s� d}| j jj||t�} ddd�| }
g } |rR| jdddtd||f ||d�ii� g } |rl| j| jd |�� | jd
d |d d
�id| j|�d�i� | jdd||f i� | j|
ddtd| | d�ii� | S )Nr( rW rY )TFz ct helperrJ z helper-%s-%s)r] r~ r� r+ r, r� r) r* r )r, r- z==)r. r/ r0 rZ zfilter_%s_allow)r] r~ rm r} )rM r� r� r� r2 r� r� r )
rT r� r� r r r Z helper_nameZmodule_short_namer~ r� r� r� r� r4 r4 r5 � build_policy_helper_ports_rulesz s.
z(nftables.build_policy_helper_ports_rulesc C s� ddd�| }| j jj||t�}g } |rv|t|�d dkrT|d t|�d � d }ddd d
iid |d �id
d ig}
n| jd|�d
d ig}
dtd| |
d�} | j|d| ii� | S )NrW rY )TFr< r� r� r) r� r` r� z==)r. r/ r0 r� r� rJ zfilter_%s_allow)r] r~ rm r} rZ )rM r� r� r� re r� r� r2 ) rT r� r[ r� r~ r� r r� r� r� r} rZ r4 r4 r5 �build_zone_forward_rules� s" z!nftables.build_zone_forward_rulesc C s� d}| j jj||tdd�}ddd�| }g }|r`|j| j|j�� |j| j|j�� | j |�} nd} |t
d|| f |d d
d d iid
dd�idd ig d�}
|
j | j |�� |d|
iigS )Nr' T)r� rW rY )TFr� z nat_%s_%sr) r� r` r� z!=r� )r. r/ r0 Z
masquerade)r] r~ rm r} rZ )
rM r� r� r� r2 r r r r r� r� r� r� ) rT r� r� r] r� r~ r� r� r� r� rZ r4 r4 r5 �"_build_policy_masquerade_nat_rules� s&
z+nftables._build_policy_masquerade_nat_rulesc
C s^ g }|rD|j r|j dks,|jrDtd|jj�rD|j| j||d|�� nV|r�|j rX|j dksl|jr�td|jj�r�|j| j||d|�� n|j| j||d|�� d}| jjj||t �}ddd�| }g }|r�|j
| j |j �� |j
| j
|j�� | j|�} nd } d
td || f |d d
ddiiddddgid�idd ig d�}
|
j| j|�� |j
|d|
ii� |S )NrH rL rG rK r( rW rY )TFr� rJ z filter_%s_%sr) r� r` r� r� r� r r )r. r/ r0 r� )r] r~ rm r} rZ )r] r r r r� r& rM r� r� r� r2 r r r r� r� r� r� ) rT r� r� r� r� r~ r� r� r� r� rZ r4 r4 r5 � build_policy_masquerade_rules� s8
z&nftables.build_policy_masquerade_rulesc C s$ d} | j jj|| t�}
ddd�| } g } |r\| j| j|j�� | j| j|j�� | j |�}
nd}
| jdd|dd �id
| j
|�d �i� |r�t d |�r�t |�}|r�|d
kr�| jd|| j
|�d�i� q�| jdd|ii� n| jdd| j
|�ii� |t
d|
|
f | d�}|j| j|�� | d|iigS )Nr' rW rY )TFr� r) r* r )r, r- z==)r. r/ r0 rH r� r� )r r r r; r z nat_%s_%s)r] r~ rm r} rZ )rM r� r� r� r2 r r r r r� r r r r� r� r� )rT r� r� r r, �toaddr�toportr] r� r~ r� r� r� r� rZ r4 r4 r5 �$_build_policy_forward_port_nat_rules� s4
z-nftables._build_policy_forward_port_nat_rulesc
C s� g }|rF|j r|j dks&|rFtd|�rF|j| j||||||d|�� n�|r�|j rZ|j dksh|r�td|�r�|j| j||||||d|�� nL|r�td|�r�|j| j||||||d|�� n |j| j||||||d|�� |S )NrH rL rG rK )r] r r� r* ) rT r� r� r r, r) r( r� r� r4 r4 r5 � build_policy_forward_port_rules s z(nftables.build_policy_forward_port_rulesc C s2 |t | krt | | S ttd|| j|f ��d S )Nz)ICMP type '%s' not supported by %s for %s)r� r r r� )rT r� Z icmp_typer4 r4 r5 � _icmp_types_to_nft_fragments( s z%nftables._icmp_types_to_nft_fragmentsc C sB d}| j jj||t�}ddd�| }|r6|jr6|j}n<|jrjg }d|jkrT|jd� d|jkrr|jd� nddg}g } �x�|D �]�}
| j jj|�r�d||f } dd i} nd ||f } | j� } g }
|r�|
j| j |j
�� |
j| j |j�� |
j| j |j
�� |
j| j|
|j�� |�r�| j| j|||||
�� | j| j|||||
�� |j�rf| j| j|||||
�� nN| j|�}d
td |||f |
| j� g d �}|j| j|�� | j|d
|ii� q~| j j� dk�r| j jj|� �r| j|d
d
t| |
| j| j j� �ddd||f iig d �ii� | j|d
d
t| |
| g d �ii� q~W | S )Nr( rW rY )TFrG rH z %s_%s_allowr� z
%s_%s_denyrJ z%s_%s_%s)r] r~ rm r} rZ r� r r� z"%s_%s_ICMP_BLOCK: ")rM r� r� r� �ipvsr r2 �query_icmp_block_inversionr� r r] r r r r� r, r� r r r� r r� r� r� r� r� r� )rT r� r� Zictr� r~ r� r� r- r� r� Z final_chainr� r� r� rZ r4 r4 r5 � build_policy_icmp_block_rules/ sb
"
"
z&nftables.build_policy_icmp_block_rulesc C s� d}| j jj||t�}g }ddd�| }| j jj|�r@| j� }ndd i}|j|ddtd||f d | j� |gd
�ii� | j j � d kr�| j jj|�r�|j|ddtd||f d | j� | j
| j j � �d d
d||f iigd
�ii� |S )Nr( rW rY )TFr� rZ rJ z%s_%sr9 )r] r~ rm ra r} r� r r� z%s_%s_ICMP_BLOCK: ) rM r� r� r� r. r� r2 r� r� r� r� )rT r� r� r~ r� r� r� r� r4 r4 r5 �'build_policy_icmp_block_inversion_rulesk s,
z0nftables.build_policy_icmp_block_inversion_rulesc C s� g }ddddiiddd�iddd d
d gd d
�iddd�ig}|dkrV|j dddii� |j dd i� |j dddtd|d�ii� |j dddtdddddd �idd d d gid�id d igd�ii� |S )!Nr) r� r` r z==rH )r. r/ r0 Zfibr� Ziifr Zoif)�flags�resultFr� r r� zrpfilter_DROP: r� rX rZ rJ Zfilter_PREROUTING)r] r~ rm r} r* rF r+ )r, r- r� znd-router-advertznd-neighbor-solicitr� )r2 r� )rT r� r� r� r4 r4 r5 �build_rpfilter_rules� s0
z nftables.build_rpfilter_rulesc C s� ddddddddd g }d
d � |D �}d d
ddd�idd|id�ig}| j jd"krb|jdddii� |j| jd�� g }|jddd td d |d �ii� |jddd td d!|d �ii� |S )#Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19c S s2 g | ]*}d |j d�d t|j d�d �d�i�qS )r� r� r r< )r re )r� rn )�.0r^ r4 r4 r5 �
<listcomp>� s z5nftables.build_rfc3964_ipv4_rules.<locals>.<listcomp>r) r* rL r� )r, r- z==r� )r. r/ r0 r� r� r r� zRFC3964_IPv4_REJECT: z addr-unreachrW rZ rJ r� r< )r] r~ rm ra r} Zfilter_FORWARDrB )r� r� )rM Z _log_deniedr2 r� r� )rT Z daddr_setr� r� r4 r4 r5 �build_rfc3964_ipv4_rules� s:
z!nftables.build_rfc3964_ipv4_rulesc C s� d}g }|j | j|j�� |j | j|j�� |j | j|j�� g }|j | j|||||�� |j | j|||||�� |j | j |||||�� |S )Nr( )
r2 r r] r r r r r r r )rT r� r� r� r~ r� r� r4 r4 r5 �*build_policy_rich_source_destination_rules� s z3nftables.build_policy_rich_source_destination_rulesc C s |dkr dS dS )NrG rH �ebTF)rG rH r8 r4 )rT r� r4 r4 r5 �is_ipv_supported� s znftables.is_ipv_supportedc
C s� ddd�}|| || ddg|| dd|| g|| dd|| g|| dg|| || || g|| ddg|| dd|| g|| dgdd � }||kr�|| S t td
| ��d S ) NZ ipv4_addrZ ipv6_addr)rG rH Z
inet_protoZ inet_servicer ZifnameZ
ether_addr) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz!ipset type name '%s' is not valid)r r
)rT r� r+ Zipv_addr�typesr4 r4 r5 �_set_type_list� s"
znftables._set_type_listc
C s� |r d|kr |d dkr d}nd}t || j||�d�}x0|jd�d jd�D ]}|dkrLd g|d
< P qLW |r�d|kr�|d |d< d|kr�|d |d< g }x0dD ](}d|i} | j|� |jdd| ii� q�W |S )Nr] �inet6rH rG )r~ r� r+ �:r< �,rK �netr Zintervalr1 ZtimeoutZmaxelem�sizerJ rL rW r� )rK r? r )rJ rK rL )r� r; r� r� r2 )
rT r� r+ �optionsr� Zset_dict�tr� r] Z rule_dictr4 r4 r5 �build_set_create_rules� s*
z nftables.build_set_create_rulesc C s$ | j |||�}| j|| jj� � d S )N)rC r� rM r� )rT r� r+ rA r� r4 r4 r5 �
set_create s znftables.set_createc C s8 x2dD ]*}dd|t |d�ii}| j|| jj� � qW d S )NrJ rK rL rY r� )r] r~ r� )rJ rK rL )r� r� rM r� )rT r� r] rZ r4 r4 r5 � set_destroy s
znftables.set_destroyc C s6 | j jj|�jjd�d jd�}g }x�tt|��D ]�}|| dkrr|jdddii� |jdd |rdd
nd d �i� q2|| d kr�|jd| j|�|r�dndd �i� q2|| dkr�|jdd|r�dndii� q2|| dkr�|jdddii� q2t d|| ��q2W dt|�dk�rd|in|d |�r&dndd | d �iS ) Nr= r< r> r r� r` r� r* Zthr r" )r, r- rK r? r r� r� Zifacer� r� r z-Unsupported ipset type for match fragment: %sr) �concatr z!=z==�@)r. r/ r0 )rK r? r )
rM r � get_ipsetr+ r� r re r2 r� r )rT r� Z
match_destr � type_formatr3 �ir4 r4 r5 r s$ z nftables._set_match_fragmentc C sN | j jj|�}|jjd�d jd�}|jd�}t|�t|�krHttd��g }�x�tt|��D �]�}|| dk�r,y|| j d�}W n& t
k
r� |j d� || } Y n,X |j || d |� � || |d d � } y| j d�}W n t
k
�r |j | � Y n(X |j d| d |� | |d d � gi� q\|| dk�r d|| k�rb|j d|| jd�i� n�y|| j d �}W nL t
k
�r� || }
d |j k�r�|j d d
k�r�t
|
�}
|j |
� Y n^X || d |� }
d |j k�r�|j d d
k�r�t
|
�}
|j d|
t|| |d d � �d�i� q\|j || � q\W t|�dk�rJd|igS |S )Nr= r< r> z+Number of values does not match ipset type.r Ztcp�-r rK r? r� r] r< r� )r re rF )rK r? )rM r rH r+ r� re r r r ra r� r2 rA r rn ) rT r� �entry�objrI Z entry_tokensZfragmentrJ ra Zport_strr r4 r4 r5 �_set_entry_fragment7 sL
( "z nftables._set_entry_fragmentc C s> g }| j ||�}x(dD ] }|jdd|t||d�ii� qW |S )NrJ rK rL rW r� )r] r~ r� �elem)rJ rK rL )rN r2 r� )rT r� rL r� r� r] r4 r4 r5 �build_set_add_rulesk s
z nftables.build_set_add_rulesc C s" | j ||�}| j|| jj� � d S )N)rP r� rM r� )rT r� rL r� r4 r4 r5 �set_addu s znftables.set_addc C sF | j ||�}x4dD ],}dd|t||d�ii}| j|| jj� � qW d S )NrJ rK rL rY r� )r] r~ r� rO )rJ rK rL )rN r� r� rM r� )rT r� rL r� r] rZ r4 r4 r5 �
set_deletey s
znftables.set_deletec C s4 g }x*dD ]"}dd|t |d�ii}|j|� q
W |S )NrJ rK rL r{ r� )r] r~ r� )rJ rK rL )r� r2 )rT r� r� r] rZ r4 r4 r5 �build_set_flush_rules� s
z nftables.build_set_flush_rulesc C s | j |�}| j|| jj� � d S )N)rS r� rM r� )rT r� r� r4 r4 r5 � set_flush� s
znftables.set_flushc C sJ | j jj|�}|jdkr d}n(|jrBd|jkrB|jd dkrBd}nd}|S )Nzhash:macr r] r< rL rK )rM r rH r+ rA )rT r� r r] r4 r4 r5 r� � s
znftables._set_get_familyc C s� g }|j | j|||�� |j | j|�� d}x^|D ]D}|j | j||�� |d7 }|dkr2| j|| jj� � |j� d}q2W | j|| jj� � d S )Nr r< i� )r� rC rS rP r� rM r� �clear) rT Zset_nameZ type_nameZentriesZcreate_optionsZ
entry_optionsr� �chunkrL r4 r4 r5 � set_restore� s
znftables.set_restore)N)N)r� )rJ )FrJ )rJ )rJ )F)NN)NN)NN)NN)N)N)N)N)N)F)N)N)F)NN)I�__name__�
__module__� __qualname__r� Zpolicies_supportedrV rh rl rt rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r� r r r r r r! r# r$ r% r& r' r* r+ r, r/ r0 r3 r6 r7 r9 r; rC rD rE r rN rP rQ rR rS rT r� rW r4 r4 r4 r5 rI � s� /.`
4
R
i
;
-
9
+
$
$
$
'
$
<
#
4
rI ij���i����)N)(Z
__future__r ri rw r
Zfirewall.core.loggerr Zfirewall.functionsr r r r r Zfirewall.errorsr r
r r r
r r Zfirewall.core.richr r r r r r r Znftables.nftablesr r� r� r� r� r� r6 r� �objectrI r4 r4 r4 r5 �<module> s� $$
core/__pycache__/fw_policies.cpython-36.pyc 0000644 00000004432 15035135173 0014643 0 ustar 00 3
��g�
� @ sV d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd � d e
�Z dS ) �FirewallPolicies� )�config)�log)�LockdownWhitelist)�errors)�
FirewallErrorc @ sD e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dS )r c C s d| _ ttj�| _d S )NF)� _lockdownr r ZLOCKDOWN_WHITELIST�lockdown_whitelist)�self� r �!/usr/lib/python3.6/fw_policies.py�__init__ s zFirewallPolicies.__init__c C s d| j | j| jf S )Nz
%s(%r, %r))� __class__r r )r
r r r �__repr__# s
zFirewallPolicies.__repr__c C s d| _ | jj� d S )NF)r r �cleanup)r
r r r r ' s zFirewallPolicies.cleanupc C s� |dkr2t jd| � | jj|�r�t jd� dS n�|dkrdt jd| � | jj|�r�t jd� dS nb|dkr�t jd | � | jj|�r�t jd
� dS n0|d kr�t jd | � | jj|�r�t jd
� dS dS )N�contextz#Doing access check for context "%s"zcontext matches.TZuidz Doing access check for uid %dz uid matches.�userz Doing access check for user "%s"z
user matches.Zcommandz#Doing access check for command "%s"zcommand matches.F)r Zdebug2r Z
match_contextZdebug3Z match_uidZ
match_userZ
match_command)r
�key�valuer r r � access_check- s*
z FirewallPolicies.access_checkc C s | j rttjd��d| _ d S )Nzenable_lockdown()T)r r r ZALREADY_ENABLED)r
r r r �enable_lockdownD s z FirewallPolicies.enable_lockdownc C s | j sttjd��d| _ d S )Nzdisable_lockdown()F)r r r Z NOT_ENABLED)r
r r r �disable_lockdownI s z!FirewallPolicies.disable_lockdownc C s | j S )N)r )r
r r r �query_lockdownN s z FirewallPolicies.query_lockdownN)
�__name__�
__module__� __qualname__r
r r r r r r r r r r r s N) �__all__Zfirewallr Zfirewall.core.loggerr Z#firewall.core.io.lockdown_whitelistr r Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_zone.cpython-36.opt-1.pyc 0000644 00000077522 15035135173 0014760 0 ustar 00 3
��gy� � @ s� d dl Z d dlZd dlmZmZmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZ d d l m Z d d
l m Z G d d � d e �Z!dS )
� N)� SHORTCUTS�DEFAULT_ZONE_TARGET�SOURCE_IPSET_TYPES)�FirewallTransaction)�Policy)�log) � Rich_Service� Rich_Port�
Rich_Protocol�Rich_SourcePort�Rich_ForwardPort�Rich_IcmpBlock�
Rich_IcmpType�Rich_Masquerade� Rich_Mark)� checkIPnMask�
checkIP6nMask� check_mac)�errors)�
FirewallError)�LastUpdatedOrderedDictc @ sN e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� Zd d � Zd�d d �Zd!d"� Zd#d$� Zd%d&� Zd�d'd(�Zd)d*� Zd+d,� Zd-d.� Zd�d/d0�Zd�d1d2�Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z!d�d@dA�Z"dBdC� Z#d�dDdE�Z$d�dFdG�Z%d�dHdI�Z&dJdK� Z'dLdM� Z(dNdO� Z)d�dQdR�Z*d�dSdT�Z+d�dUdV�Z,dWdX� Z-d�dYdZ�Z.d�d[d\�Z/d]d^� Z0d_d`� Z1dadb� Z2d�dcdd�Z3dedf� Z4dgdh� Z5didj� Z6dkdl� Z7dmdn� Z8dodp� Z9d�dqdr�Z:dsdt� Z;dudv� Z<dwdx� Z=d�dydz�Z>d{d|� Z?d}d~� Z@dd�� ZAd�d�d��ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�d��ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�d��ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�d��ZOd�d�� ZPd�d�� ZQd�d�d��ZRd�d�d��ZSd�d�d��ZTd�d�� ZUd�d�d��ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�d��ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�d��Z`d�d�� Zad�d�dZbd�dĄ Zcd�dƄ Zdd S )�� FirewallZoner c C s || _ i | _i | _d S )N)�_fw�_zones�_zone_policies)�self�fw� r � /usr/lib/python3.6/fw_zone.py�__init__& s zFirewallZone.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r r r r �__repr__+ s zFirewallZone.__repr__c C s | j j� | jj� d S )N)r �clearr )r r r r �cleanup. s
zFirewallZone.cleanupc C s
t | j�S )N)r r )r r r r �new_transaction2 s z FirewallZone.new_transactionc C s dj ||d�S )Nzzone_{fromZone}_{toZone})�fromZone�toZone)�format)r r% r& r r r �policy_name_from_zones5 s z#FirewallZone.policy_name_from_zonesc C s t | jj� �S )N)�sortedr �keys)r r r r � get_zones: s zFirewallZone.get_zonesc C s8 g }x.| j � D ]"}| j|�s&| j|�r|j|� qW |S )N)r+ �list_interfaces� list_sources�append)r Z active_zones�zoner r r �get_active_zones= s
z FirewallZone.get_active_zonesc C s6 | j |�}x&| jD ] }|| j| jd kr|S qW d S )N�
interfaces)�_FirewallZone__interface_idr �settings)r � interface� interface_idr/ r r r �get_zone_of_interfaceD s
z"FirewallZone.get_zone_of_interfacec C s6 | j |�}x&| jD ] }|| j| jd kr|S qW d S )N�sources)�_FirewallZone__source_idr r3 )r �source� source_idr/ r r r �get_zone_of_sourceL s
z FirewallZone.get_zone_of_sourcec C s | j j|�}| j| S )N)r �
check_zoner )r r/ �zr r r �get_zoneT s zFirewallZone.get_zonec C sB t � }|j|_| j||�|_| j|_|j|_|g|_|g|_� x�d D � ]�}||jkr~|d kr~|d kr~t ||t
j t ||��� qD|d
kr�||jkr�|d
kr�t ||t
j t ||��� qD||jko�|d
ko�|dk� r�t ||t
j t ||��� qD|dkrDg |_
xB|j
D ]8}| j||�}|| j|j|�k� r�|j
jt
j |�� � q�W qDW |S )N�services�ports�
masquerade�
forward_ports� source_ports� icmp_blocks�rules� protocols�HOST�ANY)r? r@ rA rB rC rD rE rF )r? r@ rC rD rF )rA )rD rB )rE )r �nameZderived_from_zoner( �ZONE_POLICY_PRIORITYZpriority�targetZ
ingress_zonesZ egress_zones�setattr�copy�deepcopy�getattrrE �_rich_rule_to_policiesr. )r �z_objr% r& �p_objZsetting�ruleZcurrent_policyr r r �policy_obj_from_zone_objX s6
z%FirewallZone.policy_obj_from_zone_objc C s� dd� d D �|_ || j|j< g | j|j< xX|jdfd|jf|jdfgD ]8\}}| j|||�}| jjj|� | j|j j|j� qFW | j |j� d S )
Nc S s i | ] }t � |�qS r )r )�.0�xr r r �
<dictcomp> s z)FirewallZone.add_zone.<locals>.<dictcomp>r1 r7 �icmp_block_inversion�forwardrG rH )r1 r7 rX rY )
r3 r rI r rT r �policyZ
add_policyr. �copy_permanent_to_runtime)r �objr% r& rR r r r �add_zone~ s
zFirewallZone.add_zonec C sn | j | }x |jD ]}| j||dd� qW x |jD ]}| j||dd� q2W |jrZ| j|� |jrj| j|� d S )NF)� allow_apply) r r1 �
add_interfacer7 �
add_sourcerY � add_forwardrX �add_icmp_block_inversion)r r/ r\ �argr r r r[ � s
z&FirewallZone.copy_permanent_to_runtimec C s8 | j | }|jr| j|� |jj� | j |= | j|= d S )N)r �applied�unapply_zone_settingsr3 r" r )r r/ r\ r r r � remove_zone� s
zFirewallZone.remove_zoneNc C sV xP| j � D ]D}| j| }t|j�dks4t|j�dkr
tjd|� | j||d� q
W d S )Nr zApplying zone '%s')�use_transaction)r+ r �lenr1 r7 r �debug1�apply_zone_settings)r rg r/ rQ r r r � apply_zones� s
zFirewallZone.apply_zonesc C s | j | }||_d S )N)r rd )r r/ rd r\ r r r �set_zone_applied� s
z FirewallZone.set_zone_appliedc C s� d|kr d S |j d�}t|�dk r&d S d }x tD ]}|d t| kr0|}q0W |d k r�|d | j� krhd S t|�dks�t|�dkr�|d d kr�|d |fS d S ) N�_� r � � �prer �deny�allow�post)rq r rr rs rt )�splitrh r r+ )r �chainZsplits�_chainrV r r r �zone_from_chain� s
z FirewallZone.zone_from_chainc C st | j |�}|d krd S |\}}|d kr0|}d}n4|d
krB|}d}n"|d krTd}|}nttjd| ��| j||�|fS ) N�
PREROUTING�
FORWARD_INrH �INPUTrG � POSTROUTING� FORWARD_OUTz&chain '%s' can't be mapped to a policy)ry rz )r{ )r| r} )rx r r Z
INVALID_CHAINr( )r rv rV r/ rw r% r& r r r �policy_from_chain� s
z FirewallZone.policy_from_chainc C sj |dkrf| j |�}|d k rf| j |�\}}|d kr:| j� }n|}| jjj|d|||� |d krf|jd� d S )N�ipv4�ipv6T)r r� )r~ r$ r rZ Zgen_chain_rules�execute) r �ipv�tablerv rg rV rZ rw � transactionr r r �create_zone_base_by_chain� s
z&FirewallZone.create_zone_base_by_chainc C s t j � ||d�}|S )N)Zdate�sender�timeout)�time)r r� r� �retr r r Z__gen_settings� s zFirewallZone.__gen_settingsc C s | j |�jS )N)r> r3 )r r/ r r r � get_settings� s zFirewallZone.get_settingsc C s� | j |�}x�|D ]z}xt|| D ]h}|dkr<| j||||� q |dkr`| j|||d |d |� q |dkrlq q |dkrvq tjd|||� q W qW |r�| j|||� d S )Nr1 r7 r ro rX rY z3Zone '%s': Unknown setting '%s:%s', unable to apply)r� �
_interface�_sourcer Zwarning�_icmp_block_inversion)r �enabler/ r� r3 �key�argsr r r �_zone_settings s
zFirewallZone._zone_settingsc C s� | j j|�}| j| }|jr d S d|_|d kr8| j� }n|}x2| j| D ]$}tjd||� | j jj ||d� qHW | j
d||� |d kr�|j d� d S )NTz+Applying policy (%s) derived from zone '%s')rg ) r r< r rd r$ r r ri rZ �apply_policy_settingsr� r� )r r/ rg �_zoner\ r� rZ r r r rj s
z FirewallZone.apply_zone_settingsc C s� | j j|�}| j| }|js d S |d kr2| j� }n|}x$| j| D ]}| j jj||d� qBW | jd||� |d kr||j d� d S )N)rg FT)
r r< r rd r$ r rZ �unapply_policy_settingsr� r� )r r/ rg r� r\ r� rZ r r r re , s
z"FirewallZone.unapply_zone_settingsc C s~ | j |�}| j|�}g }x\td�D ]P}|j| d |krZ|jtjt||j| d ��� q"|j||j| d � q"W t|�S )zH
:return: exported config updated with runtime settings
� r ) r> � get_config_with_settings_dict�rangeZIMPORT_EXPORT_STRUCTUREr. rM rN rO �tuple)r r/ r\ Z conf_dictZ conf_list�ir r r �get_config_with_settings? s
" z%FirewallZone.get_config_with_settingsc
C s� | j |�j� }|d tkr"d|d< | j|�| j|�| j|�| j|�| j|�| j|�| j |�| j
|�| j |�| j |�| j
|�| j|�d� }| jj||�S )zH
:return: exported config updated with runtime settings
rK �default) r? r@ rD rA rB r1 r7 � rules_strrF rC rX rY )r> Zexport_config_dictr �
list_services�
list_ports�list_icmp_blocks�query_masquerade�list_forward_portsr, r- �
list_rules�list_protocols�list_source_ports�query_icmp_block_inversion�
query_forwardr Z'combine_runtime_with_permanent_settings)r r/ Z permanentZruntimer r r r� O s z*FirewallZone.get_config_with_settings_dictc
s ddl m� d� �fdd� }� �fdd�}�j�jf�j�jf�j�jf�j�j f�j
�j f�j �j
f�j�jf||f�j�jf�j�jf�j�jf�j�jfd� }�j|�}�jj||�\}} xv| D ]n}
t| |
t ��r$xX| |
D ]:} t| t ��r ||
d |f| �� q�||
d || � q�W q�||
d |� q�W x�|D ]�}
t||
t ��r�x�||
D ]l} |
dk�r�||
d || |d � nDt| t ��r�||
d |f| �d|d �� n||
d || d|d � �q\W n6|
dk�r�||
d ||d � n||
d |d|d � �q>W d S )Nr )� Rich_Rulec s �j | � |d�d|d� d S )N)�rule_strr )r� r� )�add_rule)r/ r� r� r� )r� r r r �add_rule_wrapperh s zDFirewallZone.set_config_with_settings_dict.<locals>.add_rule_wrapperc s �j | � |d�� d S )N)r� )� remove_rule)r/ r� )r� r r r �remove_rule_wrapperj s zGFirewallZone.set_config_with_settings_dict.<locals>.remove_rule_wrapper) r? r@ rD rA rB r1 r7 r� rF rC rX rY ro r1 r7 )r� )r� r� rX )r N)r1 r7 )rX ) �firewall.core.richr� � add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_portr_ �remove_interfacer` �
remove_source� add_protocol�remove_protocol�add_source_port�remove_source_portrb �remove_icmp_block_inversionra �remove_forwardr� r Z get_added_and_removed_settings�
isinstance�listr� ) r r/ r3 r� r� r� Z
setting_to_fnZ old_settingsZ add_settingsZremove_settingsr� r� r )r� r r � set_config_with_settings_dicte sF
z*FirewallZone.set_config_with_settings_dictc C s | j j|� d S )N)r �check_interface)r r4 r r r r� � s z FirewallZone.check_interfacec C s\ | j j|�}| j| }| j|�}||jd krX|jd | }d|krX|d d k rX|d S d S )Nr1 r� )r r< r r2 r3 )r r/ r4 r� �_objr5 r3 r r r �interface_get_sender� s
z!FirewallZone.interface_get_senderc C s | j |� |S )N)r� )r r4 r r r Z__interface_id� s
zFirewallZone.__interface_idTc
C s | j j� | j j|�}| j| }| j|�}||jd krLttjd||f ��| j |�d k rjttj
d| ��t j d||f � |d kr�| j
� } n|} |j r�|r�| j|| d� | j| j|d� |r�| jd||| � | j||||� | j| j||� |d k�r| jd� |S )Nr1 z'%s' already bound to '%s'z '%s' already bound to a zonez&Setting zone of interface '%s' to '%s')rg FT)r � check_panicr< r r2 r3 r r �ZONE_ALREADY_SETr6 �
ZONE_CONFLICTr ri r$ rd rj �add_failrl r� �!_FirewallZone__register_interface�#_FirewallZone__unregister_interfacer� )
r r/ r4 r� rg r^ r� r� r5 r� r r r r_ � s8
zFirewallZone.add_interfacec C s6 | j d|�|jd |< | p"|dk|jd | d< d S )Nr r1 � � __default__)�_FirewallZone__gen_settingsr3 )r r� r5 r/ r� r r r Z__register_interface� s z!FirewallZone.__register_interfacec C sR | j j� | j|�}| j j|�}||kr,|S |d k r@| j||� | j|||�}|S )N)r r� r6 r< r� r_ )r r/ r4 r� � _old_zone� _new_zoner� r r r �change_zone_of_interface� s
z%FirewallZone.change_zone_of_interfacec C sz | j j� |d kr | j� }n|}| j||� | jd|d|dd� |d k rd|dkrd| jd|d|dd� |d krv|jd� d S )NT�+)r. r� F)r r� r$ rj r� r� )r Zold_zoneZnew_zonerg r� r r r �change_default_zone� s
z FirewallZone.change_default_zonec C s� | j j� | j|�}|d kr,ttjd| ��|dkr8|n
| j j|�}||krbttjd|||f ��|d krt| j� }n|}| j | }| j
|�}|j | j ||� | j
d|||� |d kr�|jd� |S )Nz'%s' is not in any zoner� z"remove_interface(%s, %s): zoi='%s'FT)r r� r6 r r ZUNKNOWN_INTERFACEr< r� r$ r r2 �add_postr� r� r� ) r r/ r4 rg Zzoir� r� r� r5 r r r r� � s(
z FirewallZone.remove_interfacec C s ||j d kr|j d |= d S )Nr1 )r3 )r r� r5 r r r Z__unregister_interface s z#FirewallZone.__unregister_interfacec C s | j |�| j|�d kS )Nr1 )r2 r� )r r/ r4 r r r �query_interface s z FirewallZone.query_interfacec C s | j |�d j� S )Nr1 )r� r* )r r/ r r r r, " s z FirewallZone.list_interfacesFc C sx t |�r dS t|�rdS t|�r$dS |jd�rh| j|dd � � |rV| j|dd � � | j|dd � �S ttj |��d S )Nr r� r� zipset:� )
r r r �
startswith� _check_ipset_type_for_source�_check_ipset_applied�
_ipset_familyr r Z INVALID_ADDR)r r9 rd r r r � check_source' s
zFirewallZone.check_sourcec C s | j ||d�}||fS )N)rd )r� )r r9 rd r� r r r Z __source_id6 s zFirewallZone.__source_idc
C s | j j� | j j|�}| j| }t|�r0|j� }| j||d�}||jd kr`tt j
d||f ��| j |�d k r~tt j d| ��|d kr�| j
� } n|} |j r�|r�| j|| d� | j| j|d� |r�| jd||d |d | � | j||||� | j| j||� |d k�r| jd� |S )
N)rd r7 z'%s' already bound to '%s'z '%s' already bound to a zone)rg FTr ro )r r� r< r r �upperr8 r3 r r r� r; r� r$ rd rj r� rl r� � _FirewallZone__register_source� _FirewallZone__unregister_sourcer� )
r r/ r9 r� rg r^ r� r� r: r� r r r r` : s4
zFirewallZone.add_sourcec C s6 | j d|�|jd |< | p"|dk|jd | d< d S )Nr r7 r� r� )r� r3 )r r� r: r/ r� r r r Z__register_sourcea s z FirewallZone.__register_sourcec C sb | j j� | j|�}| j j|�}||kr,|S t|�r<|j� }|d k rP| j||� | j|||�}|S )N)r r� r; r< r r� r� r` )r r/ r9 r� r� r� r� r r r �change_zone_of_sourceg s
z"FirewallZone.change_zone_of_sourcec C s� | j j� t|�r|j� }| j|�}|d kr<ttjd| ��|dkrH|n
| j j|�}||krrttj d|||f ��|d kr�| j
� }n|}| j | }| j |�}|j
| j||� | jd||d |d |� |d kr�|jd� |S )Nz'%s' is not in any zoner� z remove_source(%s, %s): zos='%s'Fr ro T)r r� r r� r; r r ZUNKNOWN_SOURCEr< r� r$ r r8 r� r� r� r� ) r r/ r9 rg Zzosr� r� r� r: r r r r� y s,
zFirewallZone.remove_sourcec C s ||j d kr|j d |= d S )Nr7 )r3 )r r� r: r r r Z__unregister_source� s z FirewallZone.__unregister_sourcec C s( t |�r|j� }| j|�| j|�d kS )Nr7 )r r� r8 r� )r r/ r9 r r r � query_source� s zFirewallZone.query_sourcec C s dd� | j |�d j� D �S )Nc S s g | ] }|d �qS )ro r )rU �kr r r �
<listcomp>� s z-FirewallZone.list_sources.<locals>.<listcomp>r7 )r� r* )r r/ r r r r- � s zFirewallZone.list_sourcesc s� x�� j j� D ]�}|jsq xP� j| D ]B}x<� j jj|�D ]*\}} |j|||||| |�}
|j||
� q8W q$W � j|d�}� j |�d r |d
kr |j
|||d|d�}
|j||
� q W xΈ j jj � D ]�}|� j jj |�kr�|� j jj
|�kr�q�|� j jj� k�rd� j jj|�j�rd| �r<t� j|��dk�r<� j jj||d� n&� j jjd ||� |j� fd
d �|� q�|r�|j� fd d �|� q�W d S )NrH rY r� �*�filter)r4 ro )rg Fc s | � j jj� ko � j jjd| �S )NT)r rZ �)get_active_policies_not_derived_from_zone�!_ingress_egress_zones_transaction)�p)r r r �<lambda>� s z)FirewallZone._interface.<locals>.<lambda>c s | � j jj� ko � j jj| �S )N)r rZ r� r� )r� )r r r r� � s )r� r� )r �enabled_backends�policies_supportedr rZ �#_get_table_chains_for_zone_dispatchZ!build_zone_source_interface_rules� add_rulesr( r� �build_zone_forward_rules�"get_policies_not_derived_from_zone�list_ingress_zones�list_egress_zonesr� �
get_policyrd rh r, r� �_ingress_egress_zonesr� ) r r� r/ r4 r� r. �backendrZ r� rv rE r )r r r� � s2 $ zFirewallZone._interfacec C s$ | j |�dkrd S | jjj|dd�S )Nzhash:macF)rd )� _ipset_typer �ipsetZ
get_family)r rI r r r r� � s zFirewallZone._ipset_familyc C s | j jj|dd�S )NF)rd )r r� Zget_type)r rI r r r r� � s zFirewallZone._ipset_typec C s dj |g| jjj|� �S )N�,)�joinr r� Z
get_dimension)r rI �flagr r r �_ipset_match_flags� s z FirewallZone._ipset_match_flagsc C s | j jj|�S )N)r r� Z
check_applied)r rI r r r r� � s z!FirewallZone._check_ipset_appliedc C s* | j |�}|tkr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)r� r r r Z
INVALID_IPSET)r rI Z_typer r r r� � s
z)FirewallZone._check_ipset_type_for_sourcec
s� x�|r� j j|�gn� j j� D ]�}|js*q xN� j| D ]@}x:� j jj|�D ](\}} |j|||||| �}
|j||
� qJW q6W � j |d�}� j
|�d r |j |||d|d�}
|j||
� q W xΈ j jj � D ]�}|� j jj
|�kr�|� j jj|�kr�q�|� j jj� k�rl� j jj|�j�rl| �rDt� j|��dk�rD� j jj||d� n&� j jjd||� |j� fdd �|� q�|r�|j� fd
d �|� q�W d S ) NrH rY r� )r9 ro )rg Fc s | � j jj� ko � j jjd| �S )NT)r rZ r� r� )r� )r r r r� s z&FirewallZone._source.<locals>.<lambda>c s | � j jj� ko � j jj| �S )N)r rZ r� r� )r� )r r r r�
s )r �get_backend_by_ipvr� r� r rZ r� Z build_zone_source_address_rulesr� r( r� r� r� r� r� r� r� rd rh r- r� r� r� ) r r� r/ r� r9 r� r� rZ r� rv rE r )r r r� � s2 " $ zFirewallZone._sourcec C s0 | j j|�}| j|d�}| j jj||||� |S )NrG )r r< r( rZ r� )r r/ �servicer� r� �p_namer r r r�
s zFirewallZone.add_servicec C s, | j j|�}| j|d�}| j jj||� |S )NrG )r r< r( rZ r� )r r/ r� r� r r r r� s zFirewallZone.remove_servicec C s( | j j|�}| j|d�}| j jj||�S )NrG )r r< r( rZ �
query_service)r r/ r� r� r r r r� s zFirewallZone.query_servicec C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� s zFirewallZone.list_servicesc C s2 | j j|�}| j|d�}| j jj|||||� |S )NrG )r r< r( rZ r� )r r/ �port�protocolr� r� r� r r r r� # s zFirewallZone.add_portc C s. | j j|�}| j|d�}| j jj|||� |S )NrG )r r< r( rZ r� )r r/ r� r� r� r r r r� ) s zFirewallZone.remove_portc C s* | j j|�}| j|d�}| j jj|||�S )NrG )r r< r( rZ �
query_port)r r/ r� r� r� r r r r / s zFirewallZone.query_portc C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� 4 s zFirewallZone.list_portsc C s2 | j j|�}| j|d�}| j jj|||||� |S )NrG )r r< r( rZ r� )r r/ � source_portr� r� r� r� r r r r� 9 s z FirewallZone.add_source_portc C s. | j j|�}| j|d�}| j jj|||� |S )NrG )r r< r( rZ r� )r r/ r r� r� r r r r� ? s z FirewallZone.remove_source_portc C s* | j j|�}| j|d�}| j jj|||�S )NrG )r r< r( rZ �query_source_port)r r/ r r� r� r r r r E s z FirewallZone.query_source_portc C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� J s z FirewallZone.list_source_portsc C s� | j j|�}t|j�tkr(| j|d�gS t|j�ttt t
gkrL| j|d�gS t|j�t t gkrv| j|d�| j|d�gS t|j�t
gkr�| j|d�gS t|j�tgkr�| jd|�gS |jd kr�| j|d�gS tdt|j� ��d S )NrH rG z Rich rule type (%s) not handled.)r r< �type�actionr r( �elementr r r
r r
r r r r )r r/ rS r r r rP O s
z#FirewallZone._rich_rule_to_policiesc C s. x(| j ||�D ]}| jjj||||� qW |S )N)rP r rZ r� )r r/ rS r� r� r� r r r r� b s zFirewallZone.add_rulec C s* x$| j ||�D ]}| jjj||� qW |S )N)rP r rZ r� )r r/ rS r� r r r r� g s zFirewallZone.remove_rulec C s2 d}x(| j ||�D ]}|o(| jjj||�}qW |S )NT)rP r rZ �
query_rule)r r/ rS r� r� r r r r l s zFirewallZone.query_rulec C s^ | j j|�}t� }xB| j|d�| j|d�| jd|�gD ] }|jt| j jj|��� q6W t|�S )NrH rG )r r< �setr( �updaterZ r� r� )r r/ r� r� r r r r� r s
zFirewallZone.list_rulesc C s0 | j j|�}| j|d�}| j jj||||� |S )NrG )r r< r( rZ r� )r r/ r� r� r� r� r r r r� { s zFirewallZone.add_protocolc C s, | j j|�}| j|d�}| j jj||� |S )NrG )r r< r( rZ r� )r r/ r� r� r r r r� � s z FirewallZone.remove_protocolc C s( | j j|�}| j|d�}| j jj||�S )NrG )r r< r( rZ �query_protocol)r r/ r� r� r r r r � s zFirewallZone.query_protocolc C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� � s zFirewallZone.list_protocolsc C s. | j j|�}| jd|�}| j jj|||� |S )NrH )r r< r( rZ r� )r r/ r� r� r� r r r r� � s zFirewallZone.add_masqueradec C s* | j j|�}| jd|�}| j jj|� |S )NrH )r r< r( rZ r� )r r/ r� r r r r� � s z FirewallZone.remove_masqueradec C s& | j j|�}| jd|�}| j jj|�S )NrH )r r< r( rZ r� )r r/ r� r r r r� � s z FirewallZone.query_masqueradec C s6 | j j|�}| j|d�}| j jj|||||||� |S )NrH )r r< r( rZ r� ) r r/ r� r� �toport�toaddrr� r� r� r r r r� � s
z FirewallZone.add_forward_portc C s2 | j j|�}| j|d�}| j jj|||||� |S )NrH )r r< r( rZ r� )r r/ r� r� r
r r� r r r r� � s z FirewallZone.remove_forward_portc C s. | j j|�}| j|d�}| j jj|||||�S )NrH )r r< r( rZ �query_forward_port)r r/ r� r� r
r r� r r r r � s z FirewallZone.query_forward_portc C s& | j j|�}| j|d�}| j jj|�S )NrH )r r< r( rZ r� )r r/ r� r r r r� � s z FirewallZone.list_forward_portsc C sP | j j|�}| j|d�}| j jj||||� | j|d�}| j jj||||� |S )NrG rH )r r< r( rZ r� )r r/ �icmpr� r� r� r r r r� � s zFirewallZone.add_icmp_blockc C sH | j j|�}| j|d�}| j jj||� | j|d�}| j jj||� |S )NrG rH )r r< r( rZ r� )r r/ r
r� r r r r� � s z FirewallZone.remove_icmp_blockc C sD | j j|�}| j|d�}| j|d�}| j jj||�oB| j jj||�S )NrG rH )r r< r( rZ �query_icmp_block)r r/ r
� p_name_host�
p_name_fwdr r r r � s
z FirewallZone.query_icmp_blockc C sH | j j|�}| j|d�}| j|d�}tt| j jj|�| j jj|� ��S )NrG rH )r r< r( r) r rZ r� )r r/ r r r r r r� � s
z FirewallZone.list_icmp_blocksc C sH | j j|�}| j|d�}| j jj||� | j|d�}| j jj||� |S )NrG rH )r r< r( rZ rb )r r/ r� r� r r r rb � s z%FirewallZone.add_icmp_block_inversionc C sL | j j|�}| j|d�}| j jj|||� | j|d�}| j jj|||� d S )NrG rH )r r< r( rZ r� )r r� r/ r� r� r r r r� � s
z"FirewallZone._icmp_block_inversionc C sD | j j|�}| j|d�}| j jj|� | j|d�}| j jj|� |S )NrG rH )r r< r( rZ r� )r r/ r� r r r r� � s z(FirewallZone.remove_icmp_block_inversionc C s@ | j j|�}| j|d�}| j|d�}| j jj|�o>| j jj|�S )NrG rH )r r< r( rZ r� )r r/ r r r r r r� � s
z'FirewallZone.query_icmp_block_inversionc
C s� | j |d�}xT| j| jd D ]@}x:| jj� D ],}|js:q.|j|||d|d�}|j||� q.W q W xj| j| jd D ]V\}} xL|r�| jj|�gn| jj� D ],}|js�q�|j|||d| d�}|j||� q�W qtW d S )NrH r1 r� )r4 r7 )r9 ) r( r r3 r r� r� r� r� r� )
r r� r/ r� r� r4 r� rE r� r9 r r r �_forward� s "zFirewallZone._forwardc C s dS )NTr )r r r r Z __forward_id s zFirewallZone.__forward_idc C s� | j j|�}| j j|� | j j� | j| }| j� }||jd krRttj d| ��|d krd| j
� }n|}|j r|| j d||� | j
||||� |j| j||� |d kr�|jd� |S )NrY z forward already enabled in '%s'T)r r< Z
check_timeoutr� r �_FirewallZone__forward_idr3 r r ZALREADY_ENABLEDr$ rd r � _FirewallZone__register_forwardr� �!_FirewallZone__unregister_forwardr� ) r r/ r� r� rg r� r� �
forward_idr� r r r ra s$
zFirewallZone.add_forwardc C s | j ||�|jd |< d S )NrY )r� r3 )r r� r r� r� r r r Z__register_forward. s z FirewallZone.__register_forwardc C s� | j j|�}| j j� | j| }| j� }||jd krFttjd| ��|d krX| j � }n|}|j
rp| j d||� |j | j
||� |d kr�|jd� |S )NrY zforward not enabled in '%s'FT)r r< r� r r r3 r r Z NOT_ENABLEDr$ rd r r� r r� )r r/ rg r� r� r r� r r r r� 2 s
zFirewallZone.remove_forwardc C s ||j d kr|j d |= d S )NrY )r3 )r r� r r r r Z__unregister_forwardK s z!FirewallZone.__unregister_forwardc C s | j � | j|�d kS )NrY )r r� )r r/ r r r r� O s zFirewallZone.query_forward)N)N)N)N)NNT)N)N)N)F)F)NNT)N)N)F)r N)r N)r N)r N)r N)r N)NNr N)NN)NN)r N)N)r NN)N)e�__name__�
__module__� __qualname__rJ r r! r# r$ r( r+ r0 r6 r; r> rT r] r[ rf rk rl rx r~ r� r� r� r� rj re r� r� r� r� r� r2 r_ r� r� r� r� r� r� r, r� r8 r` r� r� r� r� r� r- r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r� r r� rP r� r� r r� r� r� r r� r� r� r� r� r� r r� r� r� r r� rb r� r� r� r r ra r r� r r� r r r r r # s� &
8
(
&
,(
r )"r� rM Zfirewall.core.baser r r Z firewall.core.fw_transactionr Zfirewall.core.io.policyr Zfirewall.core.loggerr r� r r r
r r r
r r r Zfirewall.functionsr r r Zfirewallr Zfirewall.errorsr Zfirewall.fw_typesr �objectr r r r r �<module> s , core/__pycache__/ebtables.cpython-36.pyc 0000644 00000016336 15035135173 0014127 0 ustar 00 3
��g�$ � @ s& d gZ ddlZddlmZ ddlmZ ddlmZm Z m
Z
ddl m Z ddl
mZ ddlmZmZ ddlZd gd
d d gd
d dgd�Zi Zi Zi Zx�ej� D ]tZg ee< e� ee< x\ee D ]PZee jde � ee jdeef � ee jde � ee j de � q�W q�W G dd � d e �Z dS )�ebtables� N)�runProg)�log)�tempFile�readfile� splitArgs)�COMMANDS)� ipXtables)�
FirewallError� INVALID_IPVZBROUTINGZ
PREROUTINGZ POSTROUTINGZOUTPUTZINPUTZFORWARD)ZbrouteZnat�filterz -N %s_directz-I %s 1 -j %s_directz-I %s_direct 1 -j RETURNz %s_directc @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d
� Z d d � Z
d
d� Z dd� Z dd� Z
dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd/d d!�Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd0d+d,�Zd-d.� Zd S )1r ZebFc C sB t | j | _t d| j | _| j� | _| j� | _| j� g | _ d S )Nz
%s-restore)
r �ipv�_command�_restore_command� _detect_restore_noflush_optionZrestore_noflush_option�_detect_concurrent_option�concurrent_option� fill_exists�available_tables)�self� r � /usr/lib/python3.6/ebtables.py�__init__9 s
zebtables.__init__c C s$ t jj| j�| _t jj| j�| _d S )N)�os�path�existsr Zcommand_existsr Zrestore_command_exists)r r r r r A s zebtables.fill_existsc C s( d}t | jddg�}|d dkr$d}|S )N� z --concurrentz-Lr )r r )r r �retr r r r E s
z"ebtables._detect_concurrent_optionc C s. g }y| j |d� W n tk
r( dS X dS )N�offFT)� set_rules�
ValueError)r �rulesr r r r O s z'ebtables._detect_restore_noflush_optionc C s� g }| j r | j |kr |j| j � |dd� |D �7 }tjd| j| jdj|�� t| j|�\}}|dkr~td| jdj|�|f ��|S )Nc S s g | ] }d | �qS )z%sr )�.0�itemr r r �
<listcomp>^ s z"ebtables.__run.<locals>.<listcomp>z %s: %s %s� r z'%s %s' failed: %s) r �appendr �debug2� __class__r �joinr r )r �argsZ_args�statusr r r r Z__runY s zebtables.__runc C s( x"dD ]}||krt td| ��qW d S )N�
%%REJECT%%�%%ICMP%%� %%LOGTYPE%%z'%s' invalid for ebtables)r, r- r. )r
r )r �rule�strr r r �_rule_validatef s
zebtables._rule_validatec C s |t ko|t | kS )N)�BUILT_IN_CHAINS)r r
�table�chainr r r �is_chain_builtinl s zebtables.is_chain_builtinc C sJ g }|r4|j d|d|g� |j d|d|dddg� n|j d|d|g� |S )Nz-tz-Nz-I�1z-jZRETURNz-X)r& )r �addr3 r4 r! r r r �build_chain_rulesp s zebtables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nz-tz-Iz-D)r0 )r r7 r3 r4 �indexr* r/ r r r �
build_rule{ s zebtables.build_rulec C s
t j|�S )N)r Zcommon_reverse_rule)r r* r r r � reverse_rule� s zebtables.reverse_rulec C s t j|� d S )N)r Zcommon_check_passthrough)r r* r r r �check_passthrough� s zebtables.check_passthroughc C s
t j|�S )N)r Zcommon_reverse_passthrough)r r* r r r �reverse_passthrough� s z ebtables.reverse_passthroughc
C s< t � }d}i }x�|D ]�}|d d � }| j|� xTdD ]L}y|j|�} W n tk
rZ Y q4X t|�| d kr4|j| � |j| �}q4W x^tt|��D ]N} xHtjD ]>}
|
|| kr�|| j d�o�|| j
d� r�d|| || < q�W q�W |j |g �j |� qW xD|D ]<}|j
d| � x&|| D ]}|j
dj|�d � �q W �q W |j� tj|j�} tjd
| j| jd |j| jf � g } | j d � t| j| |jd
�\}
}tj� dk�rt|j�}|d k �rd} xH|D ]@}tjd| |f ddd� |j
d ��s�tjddd� | d7 } �q�W tj |j� |
dk�r8td| jdj| �|f ��d S )Nr �-t�--table� �"z"%s"z*%s
r% �
z %s: %s %sz%s: %dz --noflush)�stdin� z%8d: %sr )�nofmt�nlr )rE z'%s %s' failed: %s)r> r? ) r r1 r9 r �len�pop�range�stringZ
whitespace�
startswith�endswith�
setdefaultr& �writer) �closer �stat�namer r' r( r �st_sizer ZgetDebugLogLevelr Zdebug3�unlink)r r! �
log_deniedZ temp_filer3 Z table_rulesZ_ruler/ �opt�i�crP r* r+ r �lines�liner r r r � sZ
zebtables.set_rulesc C s | j |� | j|�S )N)r1 �_ebtables__run)r r/ rT r r r �set_rule� s
zebtables.set_ruleNc C s� g }|r|gnt j� }xp|D ]h}|| jkr6|j|� q y*| jd|dg� | jj|� |j|� W q tk
r� tjd| � Y q X q W |S )Nz-tz-Lz#ebtables table '%s' does not exist.)r2 �keysr r& rZ r r Zdebug1)r r3 r Ztablesr r r �get_available_tables� s
z ebtables.get_available_tablesc C s i S )Nr )r r3 r r r �get_zone_table_chains� s z ebtables.get_zone_table_chainsc C sF g }x<t j� D ]0}|| j� kr qx dD ]}|jd||g� q&W qW |S )N�-F�-X�-Zz-t)r_ r` ra )r2 r\ r] r& )r r! r3 �flagr r r �build_flush_rules� s
zebtables.build_flush_rulesc C s^ g }|dkrdn|}xDt j� D ]8}|| j� kr0q x$t | D ]}|jd|d||g� q:W q W |S )NZPANICZDROPz-tz-P)r2 r\ r] r& )r Zpolicyr! Z_policyr3 r4 r r r �build_set_policy_rules� s z ebtables.build_set_policy_rulesc C s g S )Nr )r r r r �build_default_tables� s z ebtables.build_default_tablesr c C s� g }x�t D ]�}|| j� kr q
t | d d � }|dkrJ|tkrJ|jt| � d|g}x:|D ]2}t|�tkrx|j|| � qX|j|t|� � qXW q
W |S )Nr z-t)�
DEFAULT_RULESr] � LOG_RULES�extend�type�listr& r )r rT Z
default_rulesr3 Z_default_rules�prefixr/ r r r �build_default_rules� s
z ebtables.build_default_rulesc C s
|| j kS )N)r
)r r
r r r �is_ipv_supported s zebtables.is_ipv_supported)N)r )�__name__�
__module__� __qualname__r
rQ Zpolicies_supportedr r r r rZ r1 r5 r8 r: r; r< r= r r[ r] r^ rc rd re rl rm r r r r r 4 s0
@
) �__all__Zos.pathr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r Zfirewall.configr Z
firewall.corer Zfirewall.errorsr
r rJ r2 rf rg Z
OUR_CHAINSr\ r3 �setr4 r& r7 �objectr r r r r �<module> s.
core/__pycache__/fw_policy.cpython-36.opt-1.pyc 0000644 00000154111 15035135173 0015272 0 ustar 00 3
��g=V � @ s� d dl Z d dlZd dlmZ d dlmZmZmZmZm Z m
Z
m Z m Z m
Z
mZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlm Z d dl m Z d dl m Z d dl!m"Z" d d l#m$Z$ G d
d � d e%�Z&dS ) � N)�log)
�portStr� checkIPnMask�
checkIP6nMask�
checkProtocol�enable_ip_forwarding�check_single_address�portInPortRange�get_nf_conntrack_short_name�coalescePortRange�breakPortRange) � Rich_Rule� Rich_Accept� Rich_Service� Rich_Port�
Rich_Protocol�Rich_Masquerade�Rich_ForwardPort�Rich_SourcePort�Rich_IcmpBlock�
Rich_IcmpType� Rich_Mark)�FirewallTransaction)�errors)�
FirewallError)�LastUpdatedOrderedDict)�SOURCE_IPSET_TYPESc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
�d dd�Zdd� Zd d � Zd d � Z�d d d!�Z�d
d"d#�Z�dd$d%�Zd&d'� Zd(d)� Zd*d+� Zd,d-� Z�dd0d1�Zd2d3� Z�dd4d5�Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z �dd@dA�Z!dBdC� Z"�ddDdE�Z#dFdG� Z$dHdI� Z%dJdK� Z&dLdM� Z'dNdO� Z(dPdQ� Z)dRdS� Z*�ddTdU�Z+dVdW� Z,�ddXdY�Z-dZd[� Z.d\d]� Z/d^d_� Z0d`da� Z1dbdc� Z2�dddde�Z3dfdg� Z4�ddhdi�Z5djdk� Z6dldm� Z7dndo� Z8dpdq� Z9drds� Z:dtdu� Z;dvdw� Z<�ddxdy�Z=dzd{� Z>�dd|d}�Z?d~d� Z@d�d�� ZAd�d�� ZBd�d�� ZCd�d�� ZD�dd�d��ZEd�d�� ZF�dd�d��ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZK�dd�d��ZLd�d�� ZM�d d�d��ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZR�d d�d��ZSd�d�� ZT�d d�d��ZUd�d�� ZVd�d�� ZW�d d�d��ZX�d d�d��ZY�d!d�d��ZZd�d�� Z[�d"d�d��Z\d�d�� Z]�d#d�d��Z^d�d�� Z_d�d�� Z`d�d�� Za�d$d�dÄZbd�dń Zc�d%d�dDŽZdd�dɄ Zed�d˄ Zfd�d̈́ Zgd�dτ Zh�d&d�dфZid�dӄ Zjd�dՄ Zk�d'd�dׄZld�dل Zmd�dۄ Znd�d݄ Zod�d߄ Zpd�d� Zqd�d� Zrd�d� Zsd�d� Ztd�d� Zu�d(d�d�Zv�d)d�d�Zwd�d� Zxd�d� Zyd�d� Zzd�d�� Z{�d*d�d��Z|d�d�� Z}d�d�� Z~d�d�� Zd�d�� Z��d �d� Z��d�d� Z��d�d� Z��d�d� Z��d+�d �d
�Z�dS (, �FirewallPolicyc C s || _ i | _i | _d S )N)�_fw�_chains� _policies)�self�fw� r# � /usr/lib/python3.6/fw_policy.py�__init__ s zFirewallPolicy.__init__c C s d| j | j| jf S )Nz
%s(%r, %r))� __class__r r )r! r# r# r$ �__repr__ s zFirewallPolicy.__repr__c C s | j j� | jj� d S )N)r �clearr )r! r# r# r$ �cleanup s
zFirewallPolicy.cleanupc C s
t | j�S )N)r r )r! r# r# r$ �new_transaction$ s z FirewallPolicy.new_transactionc C s t | jj� �S )N)�sortedr �keys)r! r# r# r$ � get_policies) s zFirewallPolicy.get_policiesc C s8 g }x*| j � D ] }| j|�}|js|j|� qW t|�S )N)r- �
get_policy�derived_from_zone�appendr+ )r! Zpolicies�p�p_objr# r# r$ �"get_policies_not_derived_from_zone, s
z1FirewallPolicy.get_policies_not_derived_from_zonec C s~ g }xt| j � D ]h}| j|�}t|d �t| jjj� �tddg�B @ rt|d �t| jjj� �tddg�B @ r|j|� qW |S )N�
ingress_zones�HOST�ANY� egress_zones)r3 � get_settings�setr �zoneZget_active_zonesr0 )r! Zactive_policies�policy�settingsr# r# r$ �)get_active_policies_not_derived_from_zone4 s
((z8FirewallPolicy.get_active_policies_not_derived_from_zonec C s | j j|�}| j| S )N)r � check_policyr )r! r; r1 r# r# r$ r. > s zFirewallPolicy.get_policyc C s, dd� dD �|_ || j|j< | j|j� d S )Nc S s i | ] }t � |�qS r# )r )�.0�xr# r# r$ �
<dictcomp>C s z-FirewallPolicy.add_policy.<locals>.<dictcomp>�services�ports�
masquerade�
forward_ports� source_ports� icmp_blocks�rules� protocols�icmp_block_inversionr4 r7 ) rB rC rD rE rF rG rH rI rJ r4 r7 )r< r �name�copy_permanent_to_runtime)r! �objr# r# r$ �
add_policyB s
zFirewallPolicy.add_policyc C s0 | j | }|jr| j|� |jj� | j |= d S )N)r �applied�unapply_policy_settingsr< r( )r! r; rM r# r# r$ �
remove_policyN s
z FirewallPolicy.remove_policyc C s� | j | }|jrd S x |jD ]}| j||dd� q W x |jD ]}| j||dd� q<W x|jD ]}| j||� q\W x |jD ]}| j |f|�� qxW x|j
D ]}| j ||� q�W xf|j D ]\}y| j
|f|�� W q� tk
�r } z$|jtjgkr�tj|� n|�W Y d d }~X q�X q�W x |jD ]}| j||� �q W xj|jD ]`}y| j|f|�� W nD tk
�r� } z&|jtjgk�r�tj|� n|�W Y d d }~X nX �q:W x |jD ]}| j||� �q�W |j�r�| j|� d S )NF)� allow_apply) r rO r4 �add_ingress_zoner7 �add_egress_zonerG �add_icmp_blockrE �add_forward_portrB � add_servicerC �add_portr �coder �ALREADY_ENABLEDr �warningrI � add_protocolrF �add_source_portrH �add_rulerD �add_masquerade)r! r; rM �args�errorr# r# r$ rL U sB
z(FirewallPolicy.copy_permanent_to_runtimeNc C sN xH| j � D ]<}| j| }|jr q
|| j� kr
tjd|� | j||d� q
W d S )NzApplying policy '%s')�use_transaction)r- r r/ r= r Zdebug1�apply_policy_settings)r! rb r; r2 r# r# r$ �apply_policies| s
z FirewallPolicy.apply_policiesc C s | j | }||_d S )N)r rO )r! r; rO rM r# r# r$ �set_policy_applied� s
z!FirewallPolicy.set_policy_appliedc C s t j � ||d�}|S )N)Zdate�sender�timeout)�time)r! rg rf �retr# r# r$ Z__gen_settings� s z FirewallPolicy.__gen_settingsc C s | j |�jS )N)r. r< )r! r; r# r# r$ r8 � s zFirewallPolicy.get_settingsc C sj | j j|�}| j| }|r |js.| r2|j r2d S |r<d|_|d krN| j� }n|}|r�x8|jsh| j|�n| j|�D ]\}}| j|d|||� qrW | j |�} |js�| j
|||� �xV| D �]L}
�xD| |
D �]6} |
dkr�| j ||| |� q�|
dkr�q�q�|
dk�r| j |||f| �� q�|
dk�r0| j
||| |� q�|
dk�rV| j||| d | d |� q�|
d k�rr| j||| |� q�|
d
k�r�| j||| d | d |� q�|
d k�r�| j|||� q�|
d k�r�| j||t| d
�|� q�|
dk�r�q�q�|
dk�r�q�q�tjd||
| � q�W q�W |�sRx<|j�s"| j|�n| j|�D ] \}}| j|d|||� �q,W d|_|d k�rf|j|� d S )NTrG rJ rE rB rC r � rI rF rD rH )�rule_strr4 r7 z5Policy '%s': Unknown setting '%s:%s', unable to applyF)r r> r rO r* r/ �%_get_table_chains_for_policy_dispatch�#_get_table_chains_for_zone_dispatch�gen_chain_rulesr8 �_ingress_egress_zones� _icmp_block�
_forward_port�_service�_port� _protocol� _source_port� _masquerade�_FirewallPolicy__ruler
r r[ �execute) r! �enabler; rb �_policyrM � transaction�table�chainr< �keyr` r# r# r$ �_policy_settings� sj
z FirewallPolicy._policy_settingsc C s | j d||d� d S )NT)rb )r )r! r; rb r# r# r$ rc � s z$FirewallPolicy.apply_policy_settingsc C s | j d||d� d S )NF)rb )r )r! r; rb r# r# r$ rP � s z&FirewallPolicy.unapply_policy_settingsc C sr | j |�j� }| j|�| j|�| j|�| j|�| j|�| j|�| j|�| j |�| j
|�| j |�d�
}| j j
||�S )zH
:return: exported config updated with runtime settings
)
rB rC rG rD rE �
rich_rulesrI rF r4 r7 )r. Zexport_config_dict�
list_services�
list_ports�list_icmp_blocks�query_masquerade�list_forward_ports�
list_rules�list_protocols�list_source_ports�list_ingress_zones�list_egress_zonesr Z'combine_runtime_with_permanent_settings)r! r; Z permanentZruntimer# r# r$ � get_config_with_settings_dict� s z,FirewallPolicy.get_config_with_settings_dictc s� ddl m� d
� �fdd� }� �fdd�}�j�jf�j�jf�j�jf�j�j f�j
�j f||f�j �j
f�j�jf�j�jf�j�jfd�
}�j|�}�jj||�\}} xt| D ]l}
t| |
t��rxV| |
D ]8} t| t�r�||
d |f| �� q�||
d || � q�W q�||
d |� q�W x�|D ]�}
t||
t��r�xn||
D ]J} t| t��rv||
d |f| �d|d �� n||
d || d|d � �qFW n||
d |d|d � �q(W d S ) Nr )r
c s �j | � |d�d|d� d S )N)rk r )rg rf )r^ )r; rk rg rf )r
r! r# r$ �add_rule_wrapper� s zFFirewallPolicy.set_config_with_settings_dict.<locals>.add_rule_wrapperc s �j | � |d�� d S )N)rk )� remove_rule)r; rk )r
r! r# r$ �remove_rule_wrapper� s zIFirewallPolicy.set_config_with_settings_dict.<locals>.remove_rule_wrapper)
rB rC rG rD rE r� rI rF r4 r7 rj )rg rf )r N)�firewall.core.richr
rW �remove_servicerX � remove_portrU �remove_icmp_blockr_ �remove_masqueraderV �remove_forward_portr\ �remove_protocolr] �remove_source_portrS �remove_ingress_zonerT �remove_egress_zoner� r Z get_added_and_removed_settings�
isinstance�list�tuple) r! r; r< rf r� r� Z
setting_to_fnZ old_settingsZ add_settingsZremove_settingsr~ r` r# )r
r! r$ � set_config_with_settings_dict� s:
z,FirewallPolicy.set_config_with_settings_dictc C s& |st tj��|dkr"| jj|� d S )Nr5 r6 )r5 r6 )r r � INVALID_ZONEr �
check_zone)r! r: r# r# r$ �check_ingress_zone s
z!FirewallPolicy.check_ingress_zonec C s | j |� |S )N)r� )r! r: r# r# r$ Z__ingress_zone_id" s
z FirewallPolicy.__ingress_zone_idr Tc C s� | j j|�}| j j|� | j j� | j| }| j|�} | |jd krXttj d||f ��d|jd ks�d|jd ks�|d kr�|jd r�ttj
d��|dkr�d|jd kr�ttj
d��|d kr�| j � }
n|}
|�rJ|j r�| j
d||
� | j|| ||� |
j| j|| � |j �s:|| j� k�rH| j||
d � |
j| j|d� n| j
d
||
� n | j|| ||� |
j| j|| � |d k�r~|
jd
� d S ) Nr4 z'%s' already in '%s'r6 r5 zI'ingress-zones' may only contain one of: many regular zones, ANY, or HOSTr7 zF'HOST' can only appear in either ingress or egress zones, but not bothF)rb T)r6 r5 )r r> �
check_timeout� check_panicr � _FirewallPolicy__ingress_zone_idr< r r rZ r� r* rO ro �&_FirewallPolicy__register_ingress_zone�add_fail�(_FirewallPolicy__unregister_ingress_zoner= rc re rx ) r! r; r: rg rf rb rR rz �_obj�zone_idr{ r# r# r$ rS & s<
z FirewallPolicy.add_ingress_zonec C s | j ||�|jd |< d S )Nr4 )� _FirewallPolicy__gen_settingsr< )r! r� r� rg rf r# r# r$ Z__register_ingress_zoneS s z&FirewallPolicy.__register_ingress_zonec C s� | j j|�}| j j� | j| }| j|�}||jd krLttjd||f ��|d kr^| j � }n|}|j
r�t |jd �dkr�| j ||� n| j
d||� | j||� |j| j||d d � || j� kr�| j
d||� n|j| j||� |d kr�|jd� |S )Nr4 z'%s' not in '%s'rj FT)r r> r� r r� r< r r � NOT_ENABLEDr* rO �lenrP ro r� r� r� r= �add_postrx )r! r; r: rb rz r� r� r{ r# r# r$ r� V s,
z"FirewallPolicy.remove_ingress_zonec C s ||j d kr|j d |= d S )Nr4 )r< )r! r� r� r# r# r$ Z__unregister_ingress_zoney s z(FirewallPolicy.__unregister_ingress_zonec C s | j |�| j|�d kS )Nr4 )r� r8 )r! r; r: r# r# r$ �query_ingress_zone} s z!FirewallPolicy.query_ingress_zonec C s t | j|�d j� �S )Nr4 )r� r8 r, )r! r; r# r# r$ r� � s z!FirewallPolicy.list_ingress_zonesc C s& |st tj��|dkr"| jj|� d S )Nr5 r6 )r5 r6 )r r r� r r� )r! r: r# r# r$ �check_egress_zone� s
z FirewallPolicy.check_egress_zonec C s | j |� |S )N)r� )r! r: r# r# r$ Z__egress_zone_id� s
z FirewallPolicy.__egress_zone_idc C s� | j j|�}| j j|� | j j� | j| }| j|�} | |jd krXttj d||f ��d|jd ks�d|jd ks�|d kr�|jd r�ttj
d��|dkr�d|jd kr�ttj
d��|d kr�| j � }
n|}
|�rJ|j r�| j
d||
� | j|| ||� |
j| j|| � |j �s:|| j� k�rH| j||
d � |
j| j|d� n| j
d
||
� n | j|| ||� |
j| j|| � |d k�r~|
jd
� d S ) Nr7 z'%s' already in '%s'r6 r5 zH'egress-zones' may only contain one of: many regular zones, ANY, or HOSTr4 zF'HOST' can only appear in either ingress or egress zones, but not bothF)rb T)r6 r5 )r r> r� r� r � _FirewallPolicy__egress_zone_idr< r r rZ r� r* rO ro �%_FirewallPolicy__register_egress_zoner� �'_FirewallPolicy__unregister_egress_zoner= rc re rx ) r! r; r: rg rf rb rR rz r� r� r{ r# r# r$ rT � s<
z FirewallPolicy.add_egress_zonec C s | j ||�|jd |< d S )Nr7 )r� r< )r! r� r� rg rf r# r# r$ Z__register_egress_zone� s z%FirewallPolicy.__register_egress_zonec C s� | j j|�}| j j� | j| }| j|�}||jd krLttjd||f ��|d kr^| j � }n|}|j
r�t |jd �dkr�| j ||� n| j
d||� | j||� |j| j||d d � || j� kr�| j
d||� n|j| j||� |d kr�|jd� |S )Nr7 z'%s' not in '%s'rj FT)r r> r� r r� r< r r r� r* rO r� rP ro r� r� r� r= r� rx )r! r; r: rb rz r� r� r{ r# r# r$ r� � s,
z!FirewallPolicy.remove_egress_zonec C s ||j d kr|j d |= d S )Nr7 )r< )r! r� r� r# r# r$ Z__unregister_egress_zone� s z'FirewallPolicy.__unregister_egress_zonec C s | j |�| j|�d kS )Nr7 )r� r8 )r! r; r: r# r# r$ �query_egress_zone� s z FirewallPolicy.query_egress_zonec C s t | j|�d j� �S )Nr7 )r� r8 r, )r! r; r# r# r$ r� � s z FirewallPolicy.list_egress_zonesc C s |j � d S )N)Zcheck)r! �ruler# r# r$ �
check_rule� s zFirewallPolicy.check_rulec C s | j |� t|�S )N)r� �str)r! r� r# r# r$ Z __rule_id� s
zFirewallPolicy.__rule_idc C sx |sd S |j r,t|j �r dS t|j �rtdS nHt|d�r@|jr@dS t|d�rt|jrt| j|j� | j|j� | j|j�S d S )N�ipv4�ipv6�mac� �ipset) Zaddrr r �hasattrr� r� � _check_ipset_type_for_source�_check_ipset_applied�
_ipset_family)r! �sourcer# r# r$ �_rule_source_ipv� s
z FirewallPolicy._rule_source_ipvc C s | j ||||� d S )N)�
_rule_prepare)r! ry r; r� r{ r# r# r$ Z__rule s zFirewallPolicy.__rulec C sL | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j
d|| f ��|j�s�|j r�t |j t
�r�d|jd kr�tt jd��d|jd kr�tt jd��x6|jd D ](}
|
dkr�q�| j jj|
�r�tt jd ��q�W |j �r�t |j t��r�d|jd k�r,|j j�r�tt jd
��nb|jd �r�|j j�sNtt jd ��x>|jd D ]0}
|
dk�rl�qZ| j jj|
��rZtt jd ���qZW |j�r�t |jt��r�x>|jd D ]0}
|
dk�rq�| j jj|
��r�tt jd
���q�W |d k�r�| j� } n|} |j�r| jd||| � | j||||� | j| j||� |d k�rH| j d� |S )NrH z'%s' already in '%s'r5 r7 z.'masquerade' is invalid for egress zone 'HOST'r4 z/'masquerade' is invalid for ingress zone 'HOST'r6 zR'masquerade' cannot be used in a policy if an ingress zone has assigned interfaceszAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonezS'forward-port' cannot be used in a policy if an egress zone has assigned interfaceszR'mark' action cannot be used in a policy if an egress zone has assigned interfacesT)r6 r5 ) r r> r� r� r �_FirewallPolicy__rule_idr< r/ r r rZ �elementr� r r� r: �list_interfacesr �
to_address�INVALID_FORWARD�actionr r* rO rw � _FirewallPolicy__register_ruler� � _FirewallPolicy__unregister_rulerx ) r! r; r� rg rf rb rz r� �rule_id�_namer: r{ r# r# r$ r^
s`
zFirewallPolicy.add_rulec C s | j ||�|jd |< d S )NrH )r� r< )r! r� r� rg rf r# r# r$ Z__register_ruleE s z FirewallPolicy.__register_rulec C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j
� }n|}|j r�| j d|||� |j
| j||� |d kr�|jd� |S )NrH z'%s' not in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rw r� r� rx ) r! r; r� rb rz r� r� r� r{ r# r# r$ r� I s"
zFirewallPolicy.remove_rulec C s ||j d kr|j d |= d S )NrH )r< )r! r� r� r# r# r$ Z__unregister_ruled s z FirewallPolicy.__unregister_rulec C s | j |�| j|�d kS )NrH )r� r8 )r! r; r� r# r# r$ �
query_ruleh s zFirewallPolicy.query_rulec C s t | j|�d j� �S )NrH )r� r8 r, )r! r; r# r# r$ r� k s zFirewallPolicy.list_rulesc C s | j j|� d S )N)r �
check_service)r! �servicer# r# r$ r� p s z FirewallPolicy.check_servicec C s | j |� |S )N)r� )r! r� r# r# r$ Z __service_ids s
zFirewallPolicy.__service_idc C s� | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j
d|| f ��|d krz| j � }
n|}
|j r�| j
d|||
� | j||||� |
j| j||� |d kr�|
jd� |S )NrB z'%s' already in '%s'T)r r> r� r� r �_FirewallPolicy__service_idr< r/ r r rZ r* rO rr �!_FirewallPolicy__register_servicer� �#_FirewallPolicy__unregister_servicerx ) r! r; r� rg rf rb rz r� �
service_idr� r{ r# r# r$ rW w s&
zFirewallPolicy.add_servicec C s | j ||�|jd |< d S )NrB )r� r< )r! r� r� rg rf r# r# r$ Z__register_service� s z!FirewallPolicy.__register_servicec C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j
� }n|}|j r�| j d|||� |j
| j||� |d kr�|jd� |S )NrB z'%s' not in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rr r� r� rx ) r! r; r� rb rz r� r� r� r{ r# r# r$ r� � s"
z FirewallPolicy.remove_servicec C s ||j d kr|j d |= d S )NrB )r< )r! r� r� r# r# r$ Z__unregister_service� s z#FirewallPolicy.__unregister_servicec C s | j |�| j|�d kS )NrB )r� r8 )r! r; r� r# r# r$ �
query_service� s z FirewallPolicy.query_servicec C s | j |�d j� S )NrB )r8 r, )r! r; r# r# r$ r� � s z FirewallPolicy.list_servicesc C sT g }xJ|D ]B}y| j jj|�}W n tk
r@ ttj|��Y nX |j|� q
W |S )N)r �helper�
get_helperr r �INVALID_HELPERr0 )r! �helpers�_helpersr� �_helperr# r# r$ � get_helpers_for_service_helpers� s
z.FirewallPolicy.get_helpers_for_service_helpersc C s� g }x�|D ]�}y| j jj|�}W n tk
r@ ttj|��Y nX t|j�dk r�t|j �}y | j jj|�}|j
|� W q� tk
r� |r�t j d| � w
Y q�X q
|j
|� q
W |S )Nrj z Helper '%s' is not available)
r r� r� r r r� r� rC r
�moduler0 r r[ )r! �modulesry r� r� r� �_module_short_namer� r# r# r$ � get_helpers_for_service_modules� s"
z.FirewallPolicy.get_helpers_for_service_modulesc C s | j j|� | j j|� d S )N)r �
check_port� check_tcpudp)r! �port�protocolr# r# r$ r� � s zFirewallPolicy.check_portc C s | j ||� t|d�|fS )N�-)r� r )r! r� r� r# r# r$ Z __port_id� s zFirewallPolicy.__port_idc s� | j j|�}| j j|� | j j� | j| }tt� fdd�|jd ��} x@| D ]8}
t||
d �rN|j rl|j n|} t
t j d|� | f ��qNW t
|dd� | D ��\} }
|d kr�| j� }n|}|j�r x$| D ] }| jd|t|d �� |� q�W x$|
D ] }| jd
|t|d �� |� q�W x:| D ]2}| j|� �}
| j||
||� |j| j||
� �qW x*|
D ]"}| j|� �}
|j| j||
� �qNW |d k�r�|jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ �<lambda>� s z)FirewallPolicy.add_port.<locals>.<lambda>rC r z'%s:%s' already in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ �
<listcomp>� s z+FirewallPolicy.add_port.<locals>.<listcomp>Tr� F)r r> r� r� r r� �filterr< r r/ r r rZ r r* rO rs r �_FirewallPolicy__port_id� _FirewallPolicy__register_portr� � _FirewallPolicy__unregister_portr� rx )r! r; r� r� rg rf rb rz r� �existing_port_ids�port_idr� � added_ranges�removed_rangesr{ �ranger# )r� r$ rX � s:
zFirewallPolicy.add_portc C s | j ||�|jd |< d S )NrC )r� r< )r! r� r� rg rf r# r# r$ Z__register_port s z FirewallPolicy.__register_portc s� | j j|�}| j j� | j| }tt� fdd�|jd ��}xB|D ]}t||d �rBP qBW |jrf|jn|} t t
j d|� | f ��t |dd� |D ��\}
} |d kr�| j
� } n|} |j�rx$|
D ] }
| jd|t|
d �� | � q�W x$| D ] }
| jd
|t|
d �� | � q�W x:|
D ]2}
| j|
� �}| j||dd � | j| j||� �qW x*| D ]"}
| j|
� �}| j| j||� �qDW |d k�r~| jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ r� s z,FirewallPolicy.remove_port.<locals>.<lambda>rC r z'%s:%s' not in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ r� # s z.FirewallPolicy.remove_port.<locals>.<listcomp>Tr� F)r r> r� r r� r� r< r r/ r r r� r r* rO rs r r� r� r� r� r� rx )r! r; r� r� rb rz r� r� r� r� r� r� r{ r� r# )r� r$ r� s:
zFirewallPolicy.remove_portc C s ||j d kr|j d |= d S )NrC )r< )r! r� r� r# r# r$ Z__unregister_port= s z FirewallPolicy.__unregister_portc C s6 x0| j |�d D ] \}}t||�r||krdS qW dS )NrC TF)r8 r )r! r; r� r� rs rt r# r# r$ �
query_portA s zFirewallPolicy.query_portc C s t | j|�d j� �S )NrC )r� r8 r, )r! r; r# r# r$ r� H s zFirewallPolicy.list_portsc C s t |�sttj|��d S )N)r r r ZINVALID_PROTOCOL)r! r� r# r# r$ �check_protocolM s z FirewallPolicy.check_protocolc C s | j |� |S )N)r� )r! r� r# r# r$ Z
__protocol_idQ s
z FirewallPolicy.__protocol_idc C s� | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j
d|| f ��|d krz| j � }
n|}
|j r�| j
d|||
� | j||||� |
j| j||� |d kr�|
jd� |S )NrI z'%s' already in '%s'T)r r> r� r� r � _FirewallPolicy__protocol_idr< r/ r r rZ r* rO rt �"_FirewallPolicy__register_protocolr� �$_FirewallPolicy__unregister_protocolrx ) r! r; r� rg rf rb rz r� � protocol_idr� r{ r# r# r$ r\ U s&
zFirewallPolicy.add_protocolc C s | j ||�|jd |< d S )NrI )r� r< )r! r� r� rg rf r# r# r$ Z__register_protocolr s z"FirewallPolicy.__register_protocolc C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j
� }n|}|j r�| j d|||� |j
| j||� |d kr�|jd� |S )NrI z'%s' not in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rt r� r� rx ) r! r; r� rb rz r� r� r� r{ r# r# r$ r� v s$
z FirewallPolicy.remove_protocolc C s ||j d kr|j d |= d S )NrI )r< )r! r� r� r# r# r$ Z__unregister_protocol� s z$FirewallPolicy.__unregister_protocolc C s | j |�| j|�d kS )NrI )r� r8 )r! r; r� r# r# r$ �query_protocol� s z FirewallPolicy.query_protocolc C s t | j|�d j� �S )NrI )r� r8 r, )r! r; r# r# r$ r� � s z FirewallPolicy.list_protocolsc C s | j ||� t|d�|fS )Nr� )r� r )r! r� r� r# r# r$ Z__source_port_id� s z FirewallPolicy.__source_port_idc s� | j j|�}| j j|� | j j� | j| }tt� fdd�|jd ��} x@| D ]8}
t||
d �rN|j rl|j n|} t
t j d|� | f ��qNW t
|dd� | D ��\} }
|d kr�| j� }n|}|j�r x$| D ] }| jd|t|d �� |� q�W x$|
D ] }| jd
|t|d �� |� q�W x:| D ]2}| j|� �}
| j||
||� |j| j||
� �qW x*|
D ]"}| j|� �}
|j| j||
� �qNW |d k�r�|jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ r� � s z0FirewallPolicy.add_source_port.<locals>.<lambda>rF r z'%s:%s' already in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ r� � s z2FirewallPolicy.add_source_port.<locals>.<listcomp>Tr� F)r r> r� r� r r� r� r< r r/ r r rZ r r* rO ru r � _FirewallPolicy__source_port_id�%_FirewallPolicy__register_source_portr� �'_FirewallPolicy__unregister_source_portr� rx )r! r; r� r� rg rf rb rz r� r� r� r� r� r� r{ r� r# )r� r$ r] � s:
z FirewallPolicy.add_source_portc C s | j ||�|jd |< d S )NrF )r� r< )r! r� r� rg rf r# r# r$ Z__register_source_port� s z%FirewallPolicy.__register_source_portc s� | j j|�}| j j� | j| }tt� fdd�|jd ��}xB|D ]}t||d �rBP qBW |jrf|jn|} t t
j d|� | f ��t |dd� |D ��\}
} |d kr�| j
� } n|} |j�rx$|
D ] }
| jd|t|
d �� | � q�W x$| D ] }
| jd
|t|
d �� | � q�W x:|
D ]2}
| j|
� �}| j||dd � | j| j||� �qW x*| D ]"}
| j|
� �}| j| j||� �qDW |d k�r~| jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ r� � s z3FirewallPolicy.remove_source_port.<locals>.<lambda>rF r z'%s:%s' not in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ r� � s z5FirewallPolicy.remove_source_port.<locals>.<listcomp>Tr� F)r r> r� r r� r� r< r r/ r r r� r r* rO ru r r� r� r� r� r� rx )r! r; r� r� rb rz r� r� r� r� r� r� r{ r� r# )r� r$ r� � s:
z!FirewallPolicy.remove_source_portc C s ||j d kr|j d |= d S )NrF )r< )r! r� r� r# r# r$ Z__unregister_source_port� s z'FirewallPolicy.__unregister_source_portc C s6 x0| j |�d D ] \}}t||�r||krdS qW dS )NrF TF)r8 r )r! r; r� r� rs rt r# r# r$ �query_source_port� s z FirewallPolicy.query_source_portc C s t | j|�d j� �S )NrF )r� r8 r, )r! r; r# r# r$ r� s z FirewallPolicy.list_source_portsc C s dS )NTr# )r! r# r# r$ Z__masquerade_id s z FirewallPolicy.__masquerade_idc C s8 | j j|�}| j j|� | j j� | j| }| j� }||jd krb|jrN|jn|}tt j
d| ��|js�d|jd kr�tt j d��d|jd kr�tt j d��x6|jd D ](} | dkr�q�| j j j
| �r�tt j d ��q�W |d kr�| j� }
n|}
|j�r | jd
||
� | j||||� |
j| j||� |d k�r4|
jd
� |S ) NrD z"masquerade already enabled in '%s'r5 r7 z.'masquerade' is invalid for egress zone 'HOST'r4 z/'masquerade' is invalid for ingress zone 'HOST'r6 zR'masquerade' cannot be used in a policy if an ingress zone has assigned interfacesT)r r> r� r� r � _FirewallPolicy__masquerade_idr< r/ r r rZ r� r: r� r* rO rv �$_FirewallPolicy__register_masquerader� �&_FirewallPolicy__unregister_masqueraderx ) r! r; rg rf rb rz r� �
masquerade_idr� r: r{ r# r# r$ r_
s:
z FirewallPolicy.add_masqueradec C s | j ||�|jd |< d S )NrD )r� r< )r! r� r� rg rf r# r# r$ Z__register_masquerade2 s z$FirewallPolicy.__register_masqueradec C s� | j j|�}| j j� | j| }| j� }||jd krV|jrB|jn|}ttj d| ��|d krh| j
� }n|}|j r�| j d||� |j
| j||� |d kr�|jd� |S )NrD z masquerade not enabled in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rv r� r� rx )r! r; rb rz r� r� r� r{ r# r# r$ r� 6 s"
z FirewallPolicy.remove_masqueradec C s ||j d kr|j d |= d S )NrD )r< )r! r� r� r# r# r$ Z__unregister_masqueradeP s z&FirewallPolicy.__unregister_masqueradec C s | j � | j|�d kS )NrD )r� r8 )r! r; r# r# r$ r� T s z FirewallPolicy.query_masqueradec C s^ | j j|� | j j|� |r(| j j|� |rBt||�sBttj|��| rZ| rZttjd��d S )Nz.port-forwarding is missing to-port AND to-addr)r r� r� r r r Z INVALID_ADDRr� )r! �ipvr� r� �toport�toaddrr# r# r$ �check_forward_portY s
z!FirewallPolicy.check_forward_portc C sL t d|�r | jd||||� n| jd||||� t|d�|t|d�t|�fS )Nr� r� r� )r r r r� )r! r� r� r� r� r# r# r$ Z__forward_port_idf s
z FirewallPolicy.__forward_port_idc C sZ | j j|�} | j j|� | j j� | j| }
| j||||�} | |
jd krt|
jrV|
jn| } tt j
d||||| f ��|
js�d|
jd kr�|r�tt j d��nR|
jd r�|s�tt j d��x6|
jd D ](}
|
dkr�q�| j j j
|
�r�tt jd��q�W |d k�r | j� }n|}|
j�r"| jd | |||||� | j|
| ||� |j| j|
| � |d k�rV|jd � | S )
NrE z '%s:%s:%s:%s' already in '%s'r5 r7 zAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zoner6 zS'forward-port' cannot be used in a policy if an egress zone has assigned interfacesT)r r> r� r� r � _FirewallPolicy__forward_port_idr< r/ r r rZ r� r: r� r� r* rO rq �&_FirewallPolicy__register_forward_portr� �(_FirewallPolicy__unregister_forward_portrx )r! r; r� r� r� r� rg rf rb rz r� �
forward_idr� r: r{ r# r# r$ rV n sB
z FirewallPolicy.add_forward_portc C s | j ||�|jd |< d S )NrE )r� r< )r! r� r rg rf r# r# r$ Z__register_forward_port� s z&FirewallPolicy.__register_forward_portc C s� | j j|�}| j j� | j| }| j||||�} | |jd krh|jrJ|jn|}
ttj d|||||
f ��|d krz| j
� } n|} |j r�| j d|| ||||� | j
| j|| � |d kr�| jd� |S )NrE z'%s:%s:%s:%s' not in '%s'FT)r r> r� r r r< r/ r r r� r* rO rq r� r rx ) r! r; r� r� r� r� rb rz r� r r� r{ r# r# r$ r� � s&
z"FirewallPolicy.remove_forward_portc C s ||j d kr|j d |= d S )NrE )r< )r! r� r r# r# r$ Z__unregister_forward_port� s z(FirewallPolicy.__unregister_forward_portc C s" | j ||||�}|| j|�d kS )NrE )r r8 )r! r; r� r� r� r� r r# r# r$ �query_forward_port� s z!FirewallPolicy.query_forward_portc C s t | j|�d j� �S )NrE )r� r8 r, )r! r; r# r# r$ r� � s z!FirewallPolicy.list_forward_portsc C s | j j|� d S )N)r Zcheck_icmptype)r! �icmpr# r# r$ �check_icmp_block� s z FirewallPolicy.check_icmp_blockc C s | j |� |S )N)r )r! r r# r# r$ Z__icmp_block_id� s
z FirewallPolicy.__icmp_block_idc C s� | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j
d|| f ��|d krz| j � }
n|}
|j r�| j
d|||
� | j||||� |
j| j||� |d kr�|
jd� |S )NrG z'%s' already in '%s'T)r r> r� r� r � _FirewallPolicy__icmp_block_idr< r/ r r rZ r* rO rp �$_FirewallPolicy__register_icmp_blockr� �&_FirewallPolicy__unregister_icmp_blockrx ) r! r; r rg rf rb rz r� �icmp_idr� r{ r# r# r$ rU � s&
z FirewallPolicy.add_icmp_blockc C s | j ||�|jd |< d S )NrG )r� r< )r! r� r rg rf r# r# r$ Z__register_icmp_block� s z$FirewallPolicy.__register_icmp_blockc C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j
� }n|}|j r�| j d|||� |j
| j||� |d kr�|jd� |S )NrG z'%s' not in '%s'FT)r r> r� r r r< r/ r r r� r* rO rp r� r
rx ) r! r; r rb rz r� r r� r{ r# r# r$ r� � s"
z FirewallPolicy.remove_icmp_blockc C s ||j d kr|j d |= d S )NrG )r< )r! r� r r# r# r$ Z__unregister_icmp_block s z&FirewallPolicy.__unregister_icmp_blockc C s | j |�| j|�d kS )NrG )r r8 )r! r; r r# r# r$ �query_icmp_block s z FirewallPolicy.query_icmp_blockc C s | j |�d j� S )NrG )r8 r, )r! r; r# r# r$ r� s z FirewallPolicy.list_icmp_blocksc C s dS )NTr# )r! r# r# r$ Z__icmp_block_inversion_id s z(FirewallPolicy.__icmp_block_inversion_idc
C s | j j|�}| j j� | j| }| j� }||jd krV|jrB|jn|}ttj d| ��|d krh| j
� }n|}|j r�x&| j |�d D ]} | j
d|| |� q�W | jd||� | j|||� |j| j|||� |j �rx&| j |�d D ]} | j
d|| |� q�W | jd||� |d k�r|jd� |S )NrJ z,icmp-block-inversion already enabled in '%s'rG FT)r r> r� r �(_FirewallPolicy__icmp_block_inversion_idr< r/ r r rZ r* rO r8 rp �_icmp_block_inversion�._FirewallPolicy__register_icmp_block_inversionr� �*_FirewallPolicy__undo_icmp_block_inversionrx )
r! r; rf rb rz r� �icmp_block_inversion_idr� r{ r` r# r# r$ �add_icmp_block_inversion s6
z'FirewallPolicy.add_icmp_block_inversionc C s | j d|�|jd |< d S )Nr rJ )r� r< )r! r� r rf r# r# r$ Z __register_icmp_block_inversionE s z.FirewallPolicy.__register_icmp_block_inversionc C s� | j � }|jr6x&| j|�d D ]}| jd|||� q W ||jd krP|jd |= |jr~x&| j|�d D ]}| jd|||� qfW |jd� d S )NrG FrJ T)r* rO r8 rp r< rx )r! rz r� r r{ r` r# r# r$ Z__undo_icmp_block_inversionJ s z*FirewallPolicy.__undo_icmp_block_inversionc C s | j j|�}| j j� | j| }| j� }||jd krV|jrB|jn|}ttj d| ��|d krh| j
� }n|}|j r�x&| j |�d D ]}| j
d|||� q�W | jd||� | j||� |j| j||d � |j �rx&| j |�d D ]}| j
d|||� q�W | jd||� |d k�r|jd� |S )NrJ z(icmp-block-inversion not enabled in '%s'rG FT)r r> r� r r
r< r/ r r r� r* rO r8 rp r �0_FirewallPolicy__unregister_icmp_block_inversionr� r rx ) r! r; rb rz r� r r� r{ r` r# r# r$ �remove_icmp_block_inversion\ s6
z*FirewallPolicy.remove_icmp_block_inversionc C s ||j d kr|j d |= d S )NrJ )r< )r! r� r r# r# r$ Z!__unregister_icmp_block_inversion� s z0FirewallPolicy.__unregister_icmp_block_inversionc C s | j � | j|�d kS )NrJ )r
r8 )r! r; r# r# r$ �query_icmp_block_inversion� s z)FirewallPolicy.query_icmp_block_inversionc
C s� | j jj|�}|jr*| j jj|j d }n|}|rT|| jkrt||f| j| krtd S n || jksp||f| j| krtd S x@| j j� D ]2}|jr�||j � kr�|j
||||�} |j || � q�W | j ||||fg� |j
| j || ||fg� d S )Nr )r r; r. r/ r: Z_zone_policiesr �enabled_backends�policies_supportedZget_available_tablesZbuild_policy_chain_rules� add_rules�_register_chainsr� )
r! r; �creater| r} r{ rM Ztracking_policy�backendrH r# r# r$ rn � s$
z FirewallPolicy.gen_chain_rulesc C sb x\|D ]T\}}|r,| j j|g �j||f� q| j | j||f� t| j | �dkr| j |= qW d S )Nr )r �
setdefaultr0 �remover� )r! r; r Ztablesr| r} r# r# r$ r � s z FirewallPolicy._register_chainsc C s$ | j jj|�dkrd S | j jj|�S )Nzhash:mac)r r� �get_typeZ
get_family)r! rK r# r# r$ r� � s z FirewallPolicy._ipset_familyc C s | j jj|�S )N)r r� r )r! rK r# r# r$ Z __ipset_type� s zFirewallPolicy.__ipset_typec C s dj |g| jjj|� �S )N�,)�joinr r� Z
get_dimension)r! rK �flagr# r# r$ �_ipset_match_flags� s z!FirewallPolicy._ipset_match_flagsc C s | j jj|�S )N)r r� Z
check_applied)r! rK r# r# r$ r� � s z#FirewallPolicy._check_ipset_appliedc C s* | j |�}|tkr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)�_FirewallPolicy__ipset_typer r r Z
INVALID_IPSET)r! rK Z_typer# r# r$ r� � s
z+FirewallPolicy._check_ipset_type_for_sourcec s� t |j�tkr��jjj|jj�}|d kr2|jjg}xR|jD ]H}||krHq:�j|� |j |� t
j |�}||j_�j |||||d� q:W g } |j
r�|j
g} nH|jr�t|jt�s�t|jt�r�jjj|jj�� � jr� fdd�dD �} �j|j�}
|
�r&|j
�r |j
|
k�r&ttjd|
|j
f ��n|
g} | �s4ddg} �fdd�| D �} | |_�x2t�fdd�| D ��D �]} t |j�tk�r��jjj|jj�}g } t|j�d k�r�|j�r�ttjd
��xB| D ].}
|
|jk�r�| j |
��r�| j |j|
� �q�W n
| j d � �x~| D �]�}t |j �t k�r�j |j |�}|�j!|j"�7 }t#t|�d d � d
�}g }x�|D ]�}|j$}t%|�}|j&dd�}|j |� |j
dk�r�| j |j
� �r��qTt|j'�dk �r�|j |� n:x8|j'D ].\}}| j(||||||j|�}|j)| |� �q�W �qTW |j*|� x4|j'D ]*\}}| j+||||||�}|j)| |� �q
W x.|j,D ]$}| j-|||||�}|j)| |� �q@W x4|j.D ]*\}}| j/||||||�}|j)| |� �qpW �qW �qft |j�t0k�r�|jj1}|jj2}�j3||� | j+||||d |�}|j)| |� �qft |j�t4k�r<|jj5}�j6|� | j-|||d |�}|j)| |� �qft |j�t7k�r�|�rzx&| D ] }
| j |
��rX|j8t9|
� �qXW | j:|||�}|j)| |� �qft |j�t;k�r4|jj1}|jj2}|jj<}|jj=}xD| D ]<}
| j |
��r�j>|
||||� |�r�|�r�|j8t9|
� �q�W | j?|||||||�}|j)| |� �qft |j�t@k�r�|jj1}|jj2}�j3||� | j/||||d |�}|j)| |� n�t |j�tk�s�t |j�tk�r>�jjj|jj�� |j
�r� j�r�|j
� jk�r�ttjAd|j
|jjf ��t |j�tk�r |j �r t |j �t k�r ttjd��| jB||� |�}|j)| |� n>|jd k�rf| jC|||�}|j)| |� nttjdt |j� ���qfW d S )N)�included_servicesc s g | ]}|� j kr|�qS r# )� destination)r? r� )�ictr# r$ r� � s z0FirewallPolicy._rule_prepare.<locals>.<listcomp>r� r� z;Source address family '%s' conflicts with rule family '%s'.c s g | ]}� j j|�r|�qS r# )r �is_ipv_enabled)r? r� )r! r# r$ r� � s c s g | ]}� j j|��qS r# )r �get_backend_by_ipv)r? r@ )r! r# r$ r� � s r z"Destination conflict with service.c S s | j S )N)rK )r@ r# r# r$ r� s z.FirewallPolicy._rule_prepare.<locals>.<lambda>)r~ � conntrack�natr� rj z3rich rule family '%s' conflicts with icmp type '%s'z'IcmpBlock not usable with accept actionzUnknown element %s)r� r� )D�typer� r r r� � get_servicerK �includesr� r0 �copy�deepcopyr� �familyr� r r �config� get_icmptyper% r� r� r r Z INVALID_RULE�ipvsr9 r� �is_ipv_supportedr� r r� r� r� r� r+ r� r
�replacerC � build_policy_helper_ports_rulesr Z add_modules�build_policy_ports_rulesrI �build_policy_protocol_rulesrF � build_policy_source_ports_rulesr r� r� r� r �valuer� r r� r � build_policy_masquerade_rulesr Zto_portr� r � build_policy_forward_port_rulesr ZINVALID_ICMPTYPE� build_policy_icmp_block_rulesZ*build_policy_rich_source_destination_rules)r! ry r; r� r{ r$ �svc�includeZ_ruler3 Z
source_ipvr Z destinationsr� r% r� r� r� r� r� �
nat_moduler� �protorH r� r� r� r# )r& r! r$ r� � s
z FirewallPolicy._rule_preparec C sb | j jj|�}| j|j|�}|| j|j�7 }tt|�dd� d�}|d krN|g}x@|j D ]6}||krdqV| j
|� |j |� | j |||||d� qVW g } xnd D ]f}
| j j
|
�s�q�| j j|
�} t|j�dkr�|
|jkr�| j | |j|
f� q�| d f| kr�| j | d f� q�W �xV| D �]L\} } x�|D ]�}
|
j}t|�}|
jjdd �}|j|� |
jd
k�rf| j|
j� �rf�q t|
j�d k �r�|j|� n:x8|
jD ].\}}| j||||| |
j|�}|j| |� �q�W �q W x2|jD ](\}}| j||||| �}|j| |� �q�W x,|j D ]"}| j |||| �}|j| |� �q�W x2|j D ](\}}| j ||||| �}|j| |� �q,W �q W d S )
Nc S s | j S )N)rK )r@ r# r# r$ r� � s z)FirewallPolicy._service.<locals>.<lambda>)r~ )r$ r� r� r r) r* r� rj )r� r� ) r r� r, r� r� r� r� r+ r9 r- r� r0 rr r' r( r� r% r� r
r5 Z
add_moduler0 r4 rC r6 rK r r7 rI r8 rF r9 )r! ry r; r� r{ r$ r> r� r? Z backends_ipvr� r r% r� r� r� r@ r� rA rH r� r# r# r$ rr � sb
zFirewallPolicy._servicec C s< x6| j j� D ](}|jsq |j||||�}|j||� q W d S )N)r r r r7 r )r! ry r; r� r� r{ r rH r# r# r$ rs � s
zFirewallPolicy._portc C s: x4| j j� D ]&}|jsq |j|||�}|j||� q W d S )N)r r r r8 r )r! ry r; r� r{ r rH r# r# r$ rt � s
zFirewallPolicy._protocolc C s< x6| j j� D ](}|jsq |j||||�}|j||� q W d S )N)r r r r9 r )r! ry r; r� r� r{ r rH r# r# r$ ru � s
zFirewallPolicy._source_portc C s8 d}|j t|� | jj|�}|j||�}|j||� d S )Nr� )r� r r r( r; r )r! ry r; r{ r� r rH r# r# r$ rv � s
zFirewallPolicy._masqueradec C sX t d|�rd}nd}|r(|r(|jt|� | jj|�} | j||||||�}
|j| |
� d S )Nr� r� )r r� r r r( r< r ) r! ry r; r{ r� r� r� r� r� r rH r# r# r$ rq � s
z FirewallPolicy._forward_portc
C s� | j jj|�}xl| j j� D ]^}|js&qd}|jrXx&dD ] }||jkr6|j|�s6d}P q6W |r^q|j|||�} |j|| � qW d S )NFr� r� T)r� r� ) r r1 r2 r r r% r4 r= r )
r! ry r; r r{ r& r Z skip_backendr� rH r# r# r$ rp � s
zFirewallPolicy._icmp_blockc C sh | j | j}|dkrd S | j|� r0|dkr0d S x2| jj� D ]$}|jsHq<|j||�}|j||� q<W d S )N�DROP�
%%REJECT%%�REJECTZACCEPT)rB rC rD )r �targetr r r r Z'build_policy_icmp_block_inversion_rulesr )r! ry r; r{ rE r rH r# r# r$ r s z$FirewallPolicy._icmp_block_inversionc C s� x|D ]}| j |� qW x|D ]}| j|� q W d|ks@d|krXt|�dkrXttjd��d|kshd|kr�t|�dkr�ttjd��|s�|r�| r�| r�d|kr�d|kr�ttjd| ��|s�|r�| r�| r�d|kr�d|kr�ttjd| ��d S )Nr6 r5 rj zI'ingress-zones' may only contain one of: many regular zones, ANY, or HOSTzH'egress-zones' may only contain one of: many regular zones, ANY, or HOSTzpolicy "%s" has no ingresszpolicy "%s" has no egress)r� r� r� r r r� ) r! r; r4 r7 �ingress_interfaces�egress_interfaces�ingress_sources�egress_sourcesr: r# r# r$ �check_ingress_egress" s$
z#FirewallPolicy.check_ingress_egressc
C s� |dkr&|dkr�|r�t tjd| ��n�|dkrtd|krFt tjd| ��d|kr^t tjd| ��|r�t tjd| ��n||d kr�d|kr�t tjd| ��d|kr�t tjd| ��nB|d
kr�d|kr�t tjd | ��n |d kr�d|kr�t tjd
| ��d S )N�
PREROUTING�rawzFpolicy "%s" egress-zones may not include a zone with added interfaces.� POSTROUTINGr5 z/policy "%s" ingress-zones may not include HOST.z.policy "%s" egress-zones may not include HOST.zGpolicy "%s" ingress-zones may not include a zone with added interfaces.�FORWARD�INPUTz0policy "%s" egress-zones must include only HOST.�OUTPUTz1policy "%s" ingress-zones must include only HOST.)r r r� )
r! r; r| r} r4 r7 rF rG rH rI r# r# r$ �check_ingress_egress_chain< s, z)FirewallPolicy.check_ingress_egress_chainc C s$ | j � }| j|||� |jd� d S )NT)r* ro rx )r! ry r; r{ r# r# r$ �!_ingress_egress_zones_transactionY s z0FirewallPolicy._ingress_egress_zones_transactionc C sL | j | }|jd }|jd }t� }t� }t� } t� }
xB|D ]:} | dkrJq<|t| jjj| ��O }| t| jjj| ��O } q<W xB|D ]:} | dkr�q�|t| jjj| ��O }|
t| jjj| ��O }
q�W | j|||||| |
� xr| jj� D ]d} | j s�q�xV| j
|�D ]H\}
}| j ||
|||||| |
� | j |||
|||| |
�}|j
| |� � q�W q�W d S )Nr4 r7 r6 r5 )r6 r5 )r6 r5 )r r< r9 r r: r� Z list_sourcesrJ r r rl rQ Z!build_policy_ingress_egress_rulesr )r! ry r; r{ rM r4 r7 rF rG rH rI r: r r| r} rH r# r# r$ ro ^ s@
z$FirewallPolicy._ingress_egress_zonesc C s6 | j | }d|jd krFd|jd krFdddg}| jjsB|jd� |S d|jd krpdg}| jjsl|jd� |S d|jd kr�dgS d|jd ko�d|jd k� r�ddddg}| jj� s�|jd� |S d|jd k�r.d d d g}| jj� s�|jd � x4|jd D ] }| jjj|�d �r P �q W |jd � |S d|jd k�r�d!d"g}| jj�sZ|jd#� x>|jd D ] }| jjj|�d �rfP �qfW |jd$� |jd%� |S d&g}| jj�s�|jd'� x4|jd D ] }| jjj|�d �r�P �q�W |jd(� x>|jd D ] }| jjj|�d �r�P �q�W |jd)� |jd*� |S dS )+z:Create a list of (table, chain) needed for policy dispatchr6 r4 r5 r7 r� rO r* rK �manglerL rP rN rM Z
interfacesN)r� rO )r* rK )rS rK )rL rK )r� rO )rL rK )r� rP )r� rN )r* rK )r* rM )rS rK )rL rK )r� rN )r* rK )rS rK )rL rK )r* rM )r� rN )r* rM )rL rK )r* rK )rS rK )r� rN )rL rK )r* rM )r* rK )rS rK )r r< r �nftables_enabledr0 r: r8 )r! r; rM �tcr: r# r# r$ rl � sj
z4FirewallPolicy._get_table_chains_for_policy_dispatchc C sr | j | }d|jd kr4dg}| jjs0|jd� |S d|jd krLdddgS d|jd krbddgS td| �S dS )z8Create a list of (table, chain) needed for zone dispatchr5 r7 r� rO rL rK r6 �
FORWARD_INr* rS r4 � FORWARD_OUTrM zInvalid policy: %sN)r� rO )rL rK )r� rV )r* rK )rS rK )r� rW )r* rM )r r< r rT r0 r )r! r; rM rU r# r# r$ rm � s
z2FirewallPolicy._get_table_chains_for_zone_dispatchFc C s� | j jj|�}|jr |j}n|| }d|jd krl|dkrBd| S |dkrRd| S |jsh|dkrhd| S �nJd|jd kr�|js�|dkr�d
| S �n"d |jd k� r�|dkr�|jr�d | S d
| S n0|dkr�|r�d| S d| S n|dk�r�d| S n�d |jd k�rh|dk�r*|j�r d| S d
| S n<|dk�rL|�rBd| S d| S n|dk�r�|j�s�d| S nN|j�s�|dk�r�d
| S |dk�r�|�r�d| S d| S n|dk�r�d| S td|||f �S )Nr5 r7 r� ZIN_rL ZPRE_rS r* r4 ZOUT_r6 ZFWDI_ZFWD_ZPOST_ZFWDO_z.Can't convert policy to chain name: %s, %s, %s)rS r* )rS rL )rS rL )rS rL )r r; r. r/ r< r )r! r; r| Z
policy_prefixZisSNATrM �suffixr# r# r$ �policy_base_chain_name� sb
z%FirewallPolicy.policy_base_chain_name)N)N)N)N)r NNT)N)r NNT)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)NN)NN)NNr NN)NNN)NN)r NN)N)NN)N)N)N)NN)F)��__name__�
__module__� __qualname__r% r' r) r* r- r3 r= r. rN rQ rL rd re r� r8 r rc rP r� r� r� r� rS r� r� r� r� r� r� r� rT r� r� r� r� r� r� r� r� rw r^ r� r� r� r� r� r� r� rW r� r� r� r� r� r� r� r� r� rX r� r� r� r� r� r� r� r\ r� r� r� r� r� r� r] r� r� r� r� r� r� r_ r� r� r� r� r r rV r r� r r r� r r rU r r� r
r r� r
r r r r r r rn r r� r# r" r� r� r� rr rs rt ru rv rq rp r rJ rQ rR ro rl rm rY r# r# r# r$ r s$
' ? . , # , # :
' ( ' ( '
+ ) ) @ @ ( P r )'rh r. Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r
r r r� r
r r r r r r r r r r Z firewall.core.fw_transactionr Zfirewallr Zfirewall.errorsr Zfirewall.fw_typesr Zfirewall.core.baser �objectr r# r# r# r$ �<module> s 04 core/__pycache__/fw_nm.cpython-36.pyc 0000644 00000011713 15035135173 0013446 0 ustar 00 3
��g � @ s d Z ddddddddgZd d
lZd d lmZ yejd d
� W n ek
rT dZY n8X yd dlmZ dZW n e eej
fk
r� dZY nX d
a d dl m
Z
d dlmZ d dlmZ d d
lZdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d� Z d"d� Z d#d� Z d
S )$z(Functions for NetworkManager interaction�check_nm_imported�nm_is_imported�nm_get_zone_of_connection�nm_set_zone_of_connection�nm_get_connections� nm_get_connection_of_interface�nm_get_bus_name�nm_get_dbus_interface� N)�GLib�NMz1.0F)r T)�errors)�
FirewallError)�logc C s t sttjd��dS )zNCheck function to raise a MISSING_IMPORT error if the import of NM failed
zgi.repository.NM = 1.0N)� _nm_importedr
r ZMISSING_IMPORT� r r �/usr/lib/python3.6/fw_nm.pyr 0 s c C s t S )znReturns true if NM has been properly imported
@return True if import was successful, False otherwirse
)r r r r r r 6 s c C s t stjjd�a t S )z�Returns the NM client object or None if the import of NM failed
@return NM.Client instance if import was successful, None otherwise
N)�
_nm_clientr ZClient�newr r r r �
nm_get_client< s r c C s� t � t� j| �}|dkr dS |j� }|dkr2dS y |j� tjjtjjB @ rPdS W n t k
rr |j
� rndS Y nX |j � }|dkr�d}|S )z�Get zone of connection from NM
@param connection name
@return zone string setting of connection, empty string if not set, None if connection is unknown
N� ) r r �get_connection_by_uuid�get_setting_connection� get_flagsr �SettingsConnectionFlags� NM_GENERATED� NM_VOLATILE�AttributeError� get_unsavedZget_zone)�
connection�con� setting_con�zoner r r r E s$
c C sV t � t� j|�}|dkr dS |j� }|dkr2dS | dkr>d} |jd| � |jdd�S )zSet the zone for a connection
@param zone name
@param connection name
@return True if zone was set, else False
NFr r! T)r r r r Z set_propertyZcommit_changes)r! r r r r r r r c s c C s~ | j � |j � t� t� j� }xX|D ]P}|j� r4q&|j� }|j� }|j� }|||< x |D ]}|j� }|rZ|| |< qZW q&W dS )znGet active connections from NM
@param connections return dict
@param connections_name return dict
N) �clearr r �get_active_connections�get_vpnZget_id�get_uuid� get_devices� get_ip_iface) Z connectionsZconnections_nameZactive_connections�
active_con�nameZuuidZdevices�dev�ip_ifacer r r r x s
c C s� t � g } x�t� j� D ]|}|j� r$qy&|j� }|j� tjjtjj B @ rHwW n t
k
rh |j � rdwY nX x&|j � D ]}|j
� }|rt| j|� qtW qW | S )zGGet active interfaces from NM
@returns list of interface names
)r r r# r$ �get_connectionr r r r r r r r& r' �append)Zactive_interfacesr( r r* r+ r r r �nm_get_interfaces� s$ r. c C s6 g }x,t � D ]"}t|�}| t|�kr |j|� q W |S )N)r. r r r- )r! Z
interfaces� interfaceZconnr r r �nm_get_interfaces_in_zone� s r0 c C s< t � x0t� j� D ]"}|j� }|dkr(q|| kr|S qW dS )zzGet device from NM which has the given IP interface
@param interface name
@returns NM.Device instance or None
N)r r r& r' )r/ �devicer+ r r r �nm_get_device_by_ip_iface� s r2 c C sx t � t| �}|dkrdS |j� }|dkr.dS y |j� }|j� tjj@ rLdS W n tk
rn |j � rjdS Y nX |j
� S )z�Get connection from NM that is using the interface
@param interface name
@returns connection that is using interface or None
N) r r2 Zget_active_connectionr, r r r r r r r% )r/ r1 r( r r r r r � s
c C sR t sd S y&tj� } | jtjtj�}|j}~~ |S tk
rL t j
d� Y nX d S )Nz(Failed to get bus name of NetworkManager) r �dbusZ SystemBusZ
get_objectr �DBUS_INTERFACEZ DBUS_PATHZbus_name� Exceptionr Zdebug2)Zbus�objr) r r r r � s c C s t sdS tjS )Nr )r r r4 r r r r r � s ) �__doc__�__all__ZgiZ
gi.repositoryr
Zrequire_version�
ValueErrorr r � ImportError�Errorr Zfirewallr Zfirewall.errorsr
Zfirewall.core.loggerr r3 r r r r r r r. r0 r2 r r r r r r r �<module> s@
core/__pycache__/fw_zone.cpython-36.pyc 0000644 00000077522 15035135173 0014021 0 ustar 00 3
��gy� � @ s� d dl Z d dlZd dlmZmZmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZ d d l m Z d d
l m Z G d d � d e �Z!dS )
� N)� SHORTCUTS�DEFAULT_ZONE_TARGET�SOURCE_IPSET_TYPES)�FirewallTransaction)�Policy)�log) � Rich_Service� Rich_Port�
Rich_Protocol�Rich_SourcePort�Rich_ForwardPort�Rich_IcmpBlock�
Rich_IcmpType�Rich_Masquerade� Rich_Mark)� checkIPnMask�
checkIP6nMask� check_mac)�errors)�
FirewallError)�LastUpdatedOrderedDictc @ sN e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� Zd d � Zd�d d �Zd!d"� Zd#d$� Zd%d&� Zd�d'd(�Zd)d*� Zd+d,� Zd-d.� Zd�d/d0�Zd�d1d2�Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z!d�d@dA�Z"dBdC� Z#d�dDdE�Z$d�dFdG�Z%d�dHdI�Z&dJdK� Z'dLdM� Z(dNdO� Z)d�dQdR�Z*d�dSdT�Z+d�dUdV�Z,dWdX� Z-d�dYdZ�Z.d�d[d\�Z/d]d^� Z0d_d`� Z1dadb� Z2d�dcdd�Z3dedf� Z4dgdh� Z5didj� Z6dkdl� Z7dmdn� Z8dodp� Z9d�dqdr�Z:dsdt� Z;dudv� Z<dwdx� Z=d�dydz�Z>d{d|� Z?d}d~� Z@dd�� ZAd�d�d��ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�d��ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�d��ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�d��ZOd�d�� ZPd�d�� ZQd�d�d��ZRd�d�d��ZSd�d�d��ZTd�d�� ZUd�d�d��ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�d��ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�d��Z`d�d�� Zad�d�dZbd�dĄ Zcd�dƄ Zdd S )�� FirewallZoner c C s || _ i | _i | _d S )N)�_fw�_zones�_zone_policies)�self�fw� r � /usr/lib/python3.6/fw_zone.py�__init__& s zFirewallZone.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r r r r �__repr__+ s zFirewallZone.__repr__c C s | j j� | jj� d S )N)r �clearr )r r r r �cleanup. s
zFirewallZone.cleanupc C s
t | j�S )N)r r )r r r r �new_transaction2 s z FirewallZone.new_transactionc C s dj ||d�S )Nzzone_{fromZone}_{toZone})�fromZone�toZone)�format)r r% r& r r r �policy_name_from_zones5 s z#FirewallZone.policy_name_from_zonesc C s t | jj� �S )N)�sortedr �keys)r r r r � get_zones: s zFirewallZone.get_zonesc C s8 g }x.| j � D ]"}| j|�s&| j|�r|j|� qW |S )N)r+ �list_interfaces� list_sources�append)r Z active_zones�zoner r r �get_active_zones= s
z FirewallZone.get_active_zonesc C s6 | j |�}x&| jD ] }|| j| jd kr|S qW d S )N�
interfaces)�_FirewallZone__interface_idr �settings)r � interface� interface_idr/ r r r �get_zone_of_interfaceD s
z"FirewallZone.get_zone_of_interfacec C s6 | j |�}x&| jD ] }|| j| jd kr|S qW d S )N�sources)�_FirewallZone__source_idr r3 )r �source� source_idr/ r r r �get_zone_of_sourceL s
z FirewallZone.get_zone_of_sourcec C s | j j|�}| j| S )N)r �
check_zoner )r r/ �zr r r �get_zoneT s zFirewallZone.get_zonec C sB t � }|j|_| j||�|_| j|_|j|_|g|_|g|_� x�d D � ]�}||jkr~|d kr~|d kr~t ||t
j t ||��� qD|d
kr�||jkr�|d
kr�t ||t
j t ||��� qD||jko�|d
ko�|dk� r�t ||t
j t ||��� qD|dkrDg |_
xB|j
D ]8}| j||�}|| j|j|�k� r�|j
jt
j |�� � q�W qDW |S )N�services�ports�
masquerade�
forward_ports� source_ports� icmp_blocks�rules� protocols�HOST�ANY)r? r@ rA rB rC rD rE rF )r? r@ rC rD rF )rA )rD rB )rE )r �nameZderived_from_zoner( �ZONE_POLICY_PRIORITYZpriority�targetZ
ingress_zonesZ egress_zones�setattr�copy�deepcopy�getattrrE �_rich_rule_to_policiesr. )r �z_objr% r& �p_objZsetting�ruleZcurrent_policyr r r �policy_obj_from_zone_objX s6
z%FirewallZone.policy_obj_from_zone_objc C s� dd� d D �|_ || j|j< g | j|j< xX|jdfd|jf|jdfgD ]8\}}| j|||�}| jjj|� | j|j j|j� qFW | j |j� d S )
Nc S s i | ] }t � |�qS r )r )�.0�xr r r �
<dictcomp> s z)FirewallZone.add_zone.<locals>.<dictcomp>r1 r7 �icmp_block_inversion�forwardrG rH )r1 r7 rX rY )
r3 r rI r rT r �policyZ
add_policyr. �copy_permanent_to_runtime)r �objr% r& rR r r r �add_zone~ s
zFirewallZone.add_zonec C sn | j | }x |jD ]}| j||dd� qW x |jD ]}| j||dd� q2W |jrZ| j|� |jrj| j|� d S )NF)� allow_apply) r r1 �
add_interfacer7 �
add_sourcerY � add_forwardrX �add_icmp_block_inversion)r r/ r\ �argr r r r[ � s
z&FirewallZone.copy_permanent_to_runtimec C s8 | j | }|jr| j|� |jj� | j |= | j|= d S )N)r �applied�unapply_zone_settingsr3 r" r )r r/ r\ r r r � remove_zone� s
zFirewallZone.remove_zoneNc C sV xP| j � D ]D}| j| }t|j�dks4t|j�dkr
tjd|� | j||d� q
W d S )Nr zApplying zone '%s')�use_transaction)r+ r �lenr1 r7 r �debug1�apply_zone_settings)r rg r/ rQ r r r � apply_zones� s
zFirewallZone.apply_zonesc C s | j | }||_d S )N)r rd )r r/ rd r\ r r r �set_zone_applied� s
z FirewallZone.set_zone_appliedc C s� d|kr d S |j d�}t|�dk r&d S d }x tD ]}|d t| kr0|}q0W |d k r�|d | j� krhd S t|�dks�t|�dkr�|d d kr�|d |fS d S ) N�_� r � � �prer �deny�allow�post)rq r rr rs rt )�splitrh r r+ )r �chainZsplits�_chainrV r r r �zone_from_chain� s
z FirewallZone.zone_from_chainc C st | j |�}|d krd S |\}}|d kr0|}d}n4|d
krB|}d}n"|d krTd}|}nttjd| ��| j||�|fS ) N�
PREROUTING�
FORWARD_INrH �INPUTrG � POSTROUTING� FORWARD_OUTz&chain '%s' can't be mapped to a policy)ry rz )r{ )r| r} )rx r r Z
INVALID_CHAINr( )r rv rV r/ rw r% r& r r r �policy_from_chain� s
z FirewallZone.policy_from_chainc C sj |dkrf| j |�}|d k rf| j |�\}}|d kr:| j� }n|}| jjj|d|||� |d krf|jd� d S )N�ipv4�ipv6T)r r� )r~ r$ r rZ Zgen_chain_rules�execute) r �ipv�tablerv rg rV rZ rw � transactionr r r �create_zone_base_by_chain� s
z&FirewallZone.create_zone_base_by_chainc C s t j � ||d�}|S )N)Zdate�sender�timeout)�time)r r� r� �retr r r Z__gen_settings� s zFirewallZone.__gen_settingsc C s | j |�jS )N)r> r3 )r r/ r r r � get_settings� s zFirewallZone.get_settingsc C s� | j |�}x�|D ]z}xt|| D ]h}|dkr<| j||||� q |dkr`| j|||d |d |� q |dkrlq q |dkrvq tjd|||� q W qW |r�| j|||� d S )Nr1 r7 r ro rX rY z3Zone '%s': Unknown setting '%s:%s', unable to apply)r� �
_interface�_sourcer Zwarning�_icmp_block_inversion)r �enabler/ r� r3 �key�argsr r r �_zone_settings s
zFirewallZone._zone_settingsc C s� | j j|�}| j| }|jr d S d|_|d kr8| j� }n|}x2| j| D ]$}tjd||� | j jj ||d� qHW | j
d||� |d kr�|j d� d S )NTz+Applying policy (%s) derived from zone '%s')rg ) r r< r rd r$ r r ri rZ �apply_policy_settingsr� r� )r r/ rg �_zoner\ r� rZ r r r rj s
z FirewallZone.apply_zone_settingsc C s� | j j|�}| j| }|js d S |d kr2| j� }n|}x$| j| D ]}| j jj||d� qBW | jd||� |d kr||j d� d S )N)rg FT)
r r< r rd r$ r rZ �unapply_policy_settingsr� r� )r r/ rg r� r\ r� rZ r r r re , s
z"FirewallZone.unapply_zone_settingsc C s~ | j |�}| j|�}g }x\td�D ]P}|j| d |krZ|jtjt||j| d ��� q"|j||j| d � q"W t|�S )zH
:return: exported config updated with runtime settings
� r ) r> � get_config_with_settings_dict�rangeZIMPORT_EXPORT_STRUCTUREr. rM rN rO �tuple)r r/ r\ Z conf_dictZ conf_list�ir r r �get_config_with_settings? s
" z%FirewallZone.get_config_with_settingsc
C s� | j |�j� }|d tkr"d|d< | j|�| j|�| j|�| j|�| j|�| j|�| j |�| j
|�| j |�| j |�| j
|�| j|�d� }| jj||�S )zH
:return: exported config updated with runtime settings
rK �default) r? r@ rD rA rB r1 r7 � rules_strrF rC rX rY )r> Zexport_config_dictr �
list_services�
list_ports�list_icmp_blocks�query_masquerade�list_forward_portsr, r- �
list_rules�list_protocols�list_source_ports�query_icmp_block_inversion�
query_forwardr Z'combine_runtime_with_permanent_settings)r r/ Z permanentZruntimer r r r� O s z*FirewallZone.get_config_with_settings_dictc
s ddl m� d� �fdd� }� �fdd�}�j�jf�j�jf�j�jf�j�j f�j
�j f�j �j
f�j�jf||f�j�jf�j�jf�j�jf�j�jfd� }�j|�}�jj||�\}} xv| D ]n}
t| |
t ��r$xX| |
D ]:} t| t ��r ||
d |f| �� q�||
d || � q�W q�||
d |� q�W x�|D ]�}
t||
t ��r�x�||
D ]l} |
dk�r�||
d || |d � nDt| t ��r�||
d |f| �d|d �� n||
d || d|d � �q\W n6|
dk�r�||
d ||d � n||
d |d|d � �q>W d S )Nr )� Rich_Rulec s �j | � |d�d|d� d S )N)�rule_strr )r� r� )�add_rule)r/ r� r� r� )r� r r r �add_rule_wrapperh s zDFirewallZone.set_config_with_settings_dict.<locals>.add_rule_wrapperc s �j | � |d�� d S )N)r� )� remove_rule)r/ r� )r� r r r �remove_rule_wrapperj s zGFirewallZone.set_config_with_settings_dict.<locals>.remove_rule_wrapper) r? r@ rD rA rB r1 r7 r� rF rC rX rY ro r1 r7 )r� )r� r� rX )r N)r1 r7 )rX ) �firewall.core.richr� � add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_portr_ �remove_interfacer` �
remove_source� add_protocol�remove_protocol�add_source_port�remove_source_portrb �remove_icmp_block_inversionra �remove_forwardr� r Z get_added_and_removed_settings�
isinstance�listr� ) r r/ r3 r� r� r� Z
setting_to_fnZ old_settingsZ add_settingsZremove_settingsr� r� r )r� r r � set_config_with_settings_dicte sF
z*FirewallZone.set_config_with_settings_dictc C s | j j|� d S )N)r �check_interface)r r4 r r r r� � s z FirewallZone.check_interfacec C s\ | j j|�}| j| }| j|�}||jd krX|jd | }d|krX|d d k rX|d S d S )Nr1 r� )r r< r r2 r3 )r r/ r4 r� �_objr5 r3 r r r �interface_get_sender� s
z!FirewallZone.interface_get_senderc C s | j |� |S )N)r� )r r4 r r r Z__interface_id� s
zFirewallZone.__interface_idTc
C s | j j� | j j|�}| j| }| j|�}||jd krLttjd||f ��| j |�d k rjttj
d| ��t j d||f � |d kr�| j
� } n|} |j r�|r�| j|| d� | j| j|d� |r�| jd||| � | j||||� | j| j||� |d k�r| jd� |S )Nr1 z'%s' already bound to '%s'z '%s' already bound to a zonez&Setting zone of interface '%s' to '%s')rg FT)r � check_panicr< r r2 r3 r r �ZONE_ALREADY_SETr6 �
ZONE_CONFLICTr ri r$ rd rj �add_failrl r� �!_FirewallZone__register_interface�#_FirewallZone__unregister_interfacer� )
r r/ r4 r� rg r^ r� r� r5 r� r r r r_ � s8
zFirewallZone.add_interfacec C s6 | j d|�|jd |< | p"|dk|jd | d< d S )Nr r1 � � __default__)�_FirewallZone__gen_settingsr3 )r r� r5 r/ r� r r r Z__register_interface� s z!FirewallZone.__register_interfacec C sR | j j� | j|�}| j j|�}||kr,|S |d k r@| j||� | j|||�}|S )N)r r� r6 r< r� r_ )r r/ r4 r� � _old_zone� _new_zoner� r r r �change_zone_of_interface� s
z%FirewallZone.change_zone_of_interfacec C sz | j j� |d kr | j� }n|}| j||� | jd|d|dd� |d k rd|dkrd| jd|d|dd� |d krv|jd� d S )NT�+)r. r� F)r r� r$ rj r� r� )r Zold_zoneZnew_zonerg r� r r r �change_default_zone� s
z FirewallZone.change_default_zonec C s� | j j� | j|�}|d kr,ttjd| ��|dkr8|n
| j j|�}||krbttjd|||f ��|d krt| j� }n|}| j | }| j
|�}|j | j ||� | j
d|||� |d kr�|jd� |S )Nz'%s' is not in any zoner� z"remove_interface(%s, %s): zoi='%s'FT)r r� r6 r r ZUNKNOWN_INTERFACEr< r� r$ r r2 �add_postr� r� r� ) r r/ r4 rg Zzoir� r� r� r5 r r r r� � s(
z FirewallZone.remove_interfacec C s ||j d kr|j d |= d S )Nr1 )r3 )r r� r5 r r r Z__unregister_interface s z#FirewallZone.__unregister_interfacec C s | j |�| j|�d kS )Nr1 )r2 r� )r r/ r4 r r r �query_interface s z FirewallZone.query_interfacec C s | j |�d j� S )Nr1 )r� r* )r r/ r r r r, " s z FirewallZone.list_interfacesFc C sx t |�r dS t|�rdS t|�r$dS |jd�rh| j|dd � � |rV| j|dd � � | j|dd � �S ttj |��d S )Nr r� r� zipset:� )
r r r �
startswith� _check_ipset_type_for_source�_check_ipset_applied�
_ipset_familyr r Z INVALID_ADDR)r r9 rd r r r � check_source' s
zFirewallZone.check_sourcec C s | j ||d�}||fS )N)rd )r� )r r9 rd r� r r r Z __source_id6 s zFirewallZone.__source_idc
C s | j j� | j j|�}| j| }t|�r0|j� }| j||d�}||jd kr`tt j
d||f ��| j |�d k r~tt j d| ��|d kr�| j
� } n|} |j r�|r�| j|| d� | j| j|d� |r�| jd||d |d | � | j||||� | j| j||� |d k�r| jd� |S )
N)rd r7 z'%s' already bound to '%s'z '%s' already bound to a zone)rg FTr ro )r r� r< r r �upperr8 r3 r r r� r; r� r$ rd rj r� rl r� � _FirewallZone__register_source� _FirewallZone__unregister_sourcer� )
r r/ r9 r� rg r^ r� r� r: r� r r r r` : s4
zFirewallZone.add_sourcec C s6 | j d|�|jd |< | p"|dk|jd | d< d S )Nr r7 r� r� )r� r3 )r r� r: r/ r� r r r Z__register_sourcea s z FirewallZone.__register_sourcec C sb | j j� | j|�}| j j|�}||kr,|S t|�r<|j� }|d k rP| j||� | j|||�}|S )N)r r� r; r< r r� r� r` )r r/ r9 r� r� r� r� r r r �change_zone_of_sourceg s
z"FirewallZone.change_zone_of_sourcec C s� | j j� t|�r|j� }| j|�}|d kr<ttjd| ��|dkrH|n
| j j|�}||krrttj d|||f ��|d kr�| j
� }n|}| j | }| j |�}|j
| j||� | jd||d |d |� |d kr�|jd� |S )Nz'%s' is not in any zoner� z remove_source(%s, %s): zos='%s'Fr ro T)r r� r r� r; r r ZUNKNOWN_SOURCEr< r� r$ r r8 r� r� r� r� ) r r/ r9 rg Zzosr� r� r� r: r r r r� y s,
zFirewallZone.remove_sourcec C s ||j d kr|j d |= d S )Nr7 )r3 )r r� r: r r r Z__unregister_source� s z FirewallZone.__unregister_sourcec C s( t |�r|j� }| j|�| j|�d kS )Nr7 )r r� r8 r� )r r/ r9 r r r � query_source� s zFirewallZone.query_sourcec C s dd� | j |�d j� D �S )Nc S s g | ] }|d �qS )ro r )rU �kr r r �
<listcomp>� s z-FirewallZone.list_sources.<locals>.<listcomp>r7 )r� r* )r r/ r r r r- � s zFirewallZone.list_sourcesc s� x�� j j� D ]�}|jsq xP� j| D ]B}x<� j jj|�D ]*\}} |j|||||| |�}
|j||
� q8W q$W � j|d�}� j |�d r |d
kr |j
|||d|d�}
|j||
� q W xΈ j jj � D ]�}|� j jj |�kr�|� j jj
|�kr�q�|� j jj� k�rd� j jj|�j�rd| �r<t� j|��dk�r<� j jj||d� n&� j jjd ||� |j� fd
d �|� q�|r�|j� fd d �|� q�W d S )NrH rY r� �*�filter)r4 ro )rg Fc s | � j jj� ko � j jjd| �S )NT)r rZ �)get_active_policies_not_derived_from_zone�!_ingress_egress_zones_transaction)�p)r r r �<lambda>� s z)FirewallZone._interface.<locals>.<lambda>c s | � j jj� ko � j jj| �S )N)r rZ r� r� )r� )r r r r� � s )r� r� )r �enabled_backends�policies_supportedr rZ �#_get_table_chains_for_zone_dispatchZ!build_zone_source_interface_rules� add_rulesr( r� �build_zone_forward_rules�"get_policies_not_derived_from_zone�list_ingress_zones�list_egress_zonesr� �
get_policyrd rh r, r� �_ingress_egress_zonesr� ) r r� r/ r4 r� r. �backendrZ r� rv rE r )r r r� � s2 $ zFirewallZone._interfacec C s$ | j |�dkrd S | jjj|dd�S )Nzhash:macF)rd )� _ipset_typer �ipsetZ
get_family)r rI r r r r� � s zFirewallZone._ipset_familyc C s | j jj|dd�S )NF)rd )r r� Zget_type)r rI r r r r� � s zFirewallZone._ipset_typec C s dj |g| jjj|� �S )N�,)�joinr r� Z
get_dimension)r rI �flagr r r �_ipset_match_flags� s z FirewallZone._ipset_match_flagsc C s | j jj|�S )N)r r� Z
check_applied)r rI r r r r� � s z!FirewallZone._check_ipset_appliedc C s* | j |�}|tkr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)r� r r r Z
INVALID_IPSET)r rI Z_typer r r r� � s
z)FirewallZone._check_ipset_type_for_sourcec
s� x�|r� j j|�gn� j j� D ]�}|js*q xN� j| D ]@}x:� j jj|�D ](\}} |j|||||| �}
|j||
� qJW q6W � j |d�}� j
|�d r |j |||d|d�}
|j||
� q W xΈ j jj � D ]�}|� j jj
|�kr�|� j jj|�kr�q�|� j jj� k�rl� j jj|�j�rl| �rDt� j|��dk�rD� j jj||d� n&� j jjd||� |j� fdd �|� q�|r�|j� fd
d �|� q�W d S ) NrH rY r� )r9 ro )rg Fc s | � j jj� ko � j jjd| �S )NT)r rZ r� r� )r� )r r r r� s z&FirewallZone._source.<locals>.<lambda>c s | � j jj� ko � j jj| �S )N)r rZ r� r� )r� )r r r r�
s )r �get_backend_by_ipvr� r� r rZ r� Z build_zone_source_address_rulesr� r( r� r� r� r� r� r� r� rd rh r- r� r� r� ) r r� r/ r� r9 r� r� rZ r� rv rE r )r r r� � s2 " $ zFirewallZone._sourcec C s0 | j j|�}| j|d�}| j jj||||� |S )NrG )r r< r( rZ r� )r r/ �servicer� r� �p_namer r r r�
s zFirewallZone.add_servicec C s, | j j|�}| j|d�}| j jj||� |S )NrG )r r< r( rZ r� )r r/ r� r� r r r r� s zFirewallZone.remove_servicec C s( | j j|�}| j|d�}| j jj||�S )NrG )r r< r( rZ �
query_service)r r/ r� r� r r r r� s zFirewallZone.query_servicec C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� s zFirewallZone.list_servicesc C s2 | j j|�}| j|d�}| j jj|||||� |S )NrG )r r< r( rZ r� )r r/ �port�protocolr� r� r� r r r r� # s zFirewallZone.add_portc C s. | j j|�}| j|d�}| j jj|||� |S )NrG )r r< r( rZ r� )r r/ r� r� r� r r r r� ) s zFirewallZone.remove_portc C s* | j j|�}| j|d�}| j jj|||�S )NrG )r r< r( rZ �
query_port)r r/ r� r� r� r r r r / s zFirewallZone.query_portc C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� 4 s zFirewallZone.list_portsc C s2 | j j|�}| j|d�}| j jj|||||� |S )NrG )r r< r( rZ r� )r r/ � source_portr� r� r� r� r r r r� 9 s z FirewallZone.add_source_portc C s. | j j|�}| j|d�}| j jj|||� |S )NrG )r r< r( rZ r� )r r/ r r� r� r r r r� ? s z FirewallZone.remove_source_portc C s* | j j|�}| j|d�}| j jj|||�S )NrG )r r< r( rZ �query_source_port)r r/ r r� r� r r r r E s z FirewallZone.query_source_portc C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� J s z FirewallZone.list_source_portsc C s� | j j|�}t|j�tkr(| j|d�gS t|j�ttt t
gkrL| j|d�gS t|j�t t gkrv| j|d�| j|d�gS t|j�t
gkr�| j|d�gS t|j�tgkr�| jd|�gS |jd kr�| j|d�gS tdt|j� ��d S )NrH rG z Rich rule type (%s) not handled.)r r< �type�actionr r( �elementr r r
r r
r r r r )r r/ rS r r r rP O s
z#FirewallZone._rich_rule_to_policiesc C s. x(| j ||�D ]}| jjj||||� qW |S )N)rP r rZ r� )r r/ rS r� r� r� r r r r� b s zFirewallZone.add_rulec C s* x$| j ||�D ]}| jjj||� qW |S )N)rP r rZ r� )r r/ rS r� r r r r� g s zFirewallZone.remove_rulec C s2 d}x(| j ||�D ]}|o(| jjj||�}qW |S )NT)rP r rZ �
query_rule)r r/ rS r� r� r r r r l s zFirewallZone.query_rulec C s^ | j j|�}t� }xB| j|d�| j|d�| jd|�gD ] }|jt| j jj|��� q6W t|�S )NrH rG )r r< �setr( �updaterZ r� r� )r r/ r� r� r r r r� r s
zFirewallZone.list_rulesc C s0 | j j|�}| j|d�}| j jj||||� |S )NrG )r r< r( rZ r� )r r/ r� r� r� r� r r r r� { s zFirewallZone.add_protocolc C s, | j j|�}| j|d�}| j jj||� |S )NrG )r r< r( rZ r� )r r/ r� r� r r r r� � s z FirewallZone.remove_protocolc C s( | j j|�}| j|d�}| j jj||�S )NrG )r r< r( rZ �query_protocol)r r/ r� r� r r r r � s zFirewallZone.query_protocolc C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� � s zFirewallZone.list_protocolsc C s. | j j|�}| jd|�}| j jj|||� |S )NrH )r r< r( rZ r� )r r/ r� r� r� r r r r� � s zFirewallZone.add_masqueradec C s* | j j|�}| jd|�}| j jj|� |S )NrH )r r< r( rZ r� )r r/ r� r r r r� � s z FirewallZone.remove_masqueradec C s& | j j|�}| jd|�}| j jj|�S )NrH )r r< r( rZ r� )r r/ r� r r r r� � s z FirewallZone.query_masqueradec C s6 | j j|�}| j|d�}| j jj|||||||� |S )NrH )r r< r( rZ r� ) r r/ r� r� �toport�toaddrr� r� r� r r r r� � s
z FirewallZone.add_forward_portc C s2 | j j|�}| j|d�}| j jj|||||� |S )NrH )r r< r( rZ r� )r r/ r� r� r
r r� r r r r� � s z FirewallZone.remove_forward_portc C s. | j j|�}| j|d�}| j jj|||||�S )NrH )r r< r( rZ �query_forward_port)r r/ r� r� r
r r� r r r r � s z FirewallZone.query_forward_portc C s& | j j|�}| j|d�}| j jj|�S )NrH )r r< r( rZ r� )r r/ r� r r r r� � s z FirewallZone.list_forward_portsc C sP | j j|�}| j|d�}| j jj||||� | j|d�}| j jj||||� |S )NrG rH )r r< r( rZ r� )r r/ �icmpr� r� r� r r r r� � s zFirewallZone.add_icmp_blockc C sH | j j|�}| j|d�}| j jj||� | j|d�}| j jj||� |S )NrG rH )r r< r( rZ r� )r r/ r
r� r r r r� � s z FirewallZone.remove_icmp_blockc C sD | j j|�}| j|d�}| j|d�}| j jj||�oB| j jj||�S )NrG rH )r r< r( rZ �query_icmp_block)r r/ r
� p_name_host�
p_name_fwdr r r r � s
z FirewallZone.query_icmp_blockc C sH | j j|�}| j|d�}| j|d�}tt| j jj|�| j jj|� ��S )NrG rH )r r< r( r) r rZ r� )r r/ r r r r r r� � s
z FirewallZone.list_icmp_blocksc C sH | j j|�}| j|d�}| j jj||� | j|d�}| j jj||� |S )NrG rH )r r< r( rZ rb )r r/ r� r� r r r rb � s z%FirewallZone.add_icmp_block_inversionc C sL | j j|�}| j|d�}| j jj|||� | j|d�}| j jj|||� d S )NrG rH )r r< r( rZ r� )r r� r/ r� r� r r r r� � s
z"FirewallZone._icmp_block_inversionc C sD | j j|�}| j|d�}| j jj|� | j|d�}| j jj|� |S )NrG rH )r r< r( rZ r� )r r/ r� r r r r� � s z(FirewallZone.remove_icmp_block_inversionc C s@ | j j|�}| j|d�}| j|d�}| j jj|�o>| j jj|�S )NrG rH )r r< r( rZ r� )r r/ r r r r r r� � s
z'FirewallZone.query_icmp_block_inversionc
C s� | j |d�}xT| j| jd D ]@}x:| jj� D ],}|js:q.|j|||d|d�}|j||� q.W q W xj| j| jd D ]V\}} xL|r�| jj|�gn| jj� D ],}|js�q�|j|||d| d�}|j||� q�W qtW d S )NrH r1 r� )r4 r7 )r9 ) r( r r3 r r� r� r� r� r� )
r r� r/ r� r� r4 r� rE r� r9 r r r �_forward� s "zFirewallZone._forwardc C s dS )NTr )r r r r Z __forward_id s zFirewallZone.__forward_idc C s� | j j|�}| j j|� | j j� | j| }| j� }||jd krRttj d| ��|d krd| j
� }n|}|j r|| j d||� | j
||||� |j| j||� |d kr�|jd� |S )NrY z forward already enabled in '%s'T)r r< Z
check_timeoutr� r �_FirewallZone__forward_idr3 r r ZALREADY_ENABLEDr$ rd r � _FirewallZone__register_forwardr� �!_FirewallZone__unregister_forwardr� ) r r/ r� r� rg r� r� �
forward_idr� r r r ra s$
zFirewallZone.add_forwardc C s | j ||�|jd |< d S )NrY )r� r3 )r r� r r� r� r r r Z__register_forward. s z FirewallZone.__register_forwardc C s� | j j|�}| j j� | j| }| j� }||jd krFttjd| ��|d krX| j � }n|}|j
rp| j d||� |j | j
||� |d kr�|jd� |S )NrY zforward not enabled in '%s'FT)r r< r� r r r3 r r Z NOT_ENABLEDr$ rd r r� r r� )r r/ rg r� r� r r� r r r r� 2 s
zFirewallZone.remove_forwardc C s ||j d kr|j d |= d S )NrY )r3 )r r� r r r r Z__unregister_forwardK s z!FirewallZone.__unregister_forwardc C s | j � | j|�d kS )NrY )r r� )r r/ r r r r� O s zFirewallZone.query_forward)N)N)N)N)NNT)N)N)N)F)F)NNT)N)N)F)r N)r N)r N)r N)r N)r N)NNr N)NN)NN)r N)N)r NN)N)e�__name__�
__module__� __qualname__rJ r r! r# r$ r( r+ r0 r6 r; r> rT r] r[ rf rk rl rx r~ r� r� r� r� rj re r� r� r� r� r� r2 r_ r� r� r� r� r� r� r, r� r8 r` r� r� r� r� r� r- r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r� r r� rP r� r� r r� r� r� r r� r� r� r� r� r� r r� r� r� r r� rb r� r� r� r r ra r r� r r� r r r r r # s� &
8
(
&
,(
r )"r� rM Zfirewall.core.baser r r Z firewall.core.fw_transactionr Zfirewall.core.io.policyr Zfirewall.core.loggerr r� r r r
r r r
r r r Zfirewall.functionsr r r Zfirewallr Zfirewall.errorsr Zfirewall.fw_typesr �objectr r r r r �<module> s , core/__pycache__/fw_direct.cpython-36.pyc 0000644 00000031230 15035135173 0014302 0 ustar 00 3
��g�W � @ sn d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl
m Z ddl m
Z
G d d � d e�Zd
S ) �FirewallDirect� )�LastUpdatedOrderedDict)� ipXtables)�ebtables)�FirewallTransaction)�log)�errors)�
FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dNdd�Z dd� Z dd� Z
dOdd�Zdd� Zd d � Zd d � Zd d!� ZdPd"d#�ZdQd$d%�Zd&d'� Zd(d)� Zd*d+� ZdRd,d-�ZdSd.d/�Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z dTd<d=�Z dUd>d?�Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dLdM� Z(dS )Vr c C s || _ | j� d S )N)�_fw�_FirewallDirect__init_vars)�self�fw� r � /usr/lib/python3.6/fw_direct.py�__init__' s zFirewallDirect.__init__c C s d| j | j| j| jf S )Nz%s(%r, %r, %r))� __class__�_chains�_rules�_rule_priority_positions)r r r r �__repr__+ s zFirewallDirect.__repr__c C s" i | _ i | _i | _i | _d | _d S )N)r r r �
_passthroughs�_obj)r r r r Z __init_vars/ s
zFirewallDirect.__init_varsc C s | j � d S )N)r )r r r r �cleanup6 s zFirewallDirect.cleanupc C s
t | j�S )N)r r
)r r r r �new_transaction; s z FirewallDirect.new_transactionc C s
|| _ d S )N)r )r �objr r r �set_permanent_config@ s z#FirewallDirect.set_permanent_configc C s* t | j�t | j� t | j� dkr&dS dS )Nr TF)�lenr r r )r r r r �has_runtime_configurationC s "z(FirewallDirect.has_runtime_configurationc C sB | j � r dS t| jj� �t| jj� � t| jj� � dkr>dS dS )NTr F)r r r �get_all_chains�
get_all_rules�get_all_passthroughs)r r r r �has_configurationH s z FirewallDirect.has_configurationNc C sP |d kr| j � }n|}| j| jj� | jj� | jj� f|� |d krL|jd� d S )NT)r �
set_configr r r r �execute)r �use_transaction� transactionr r r � apply_directQ s
zFirewallDirect.apply_directc C s i }i }i }xL| j D ]B}|\}}x4| j | D ]&}| jj|||�s,|j|g �j|� q,W qW xf| jD ]\}|\}}}xL| j| D ]>\} }
| jj|||| |
�s|||kr�t� ||< | || | |
f< q|W qbW xP| jD ]F}x@| j| D ]2}
| jj ||
�s�||k� r�g ||< || j|
� q�W q�W |||fS )N)
r r � query_chain�
setdefault�appendr �
query_ruler r �query_passthrough) r Zchains�rulesZ passthroughs�table_id�ipv�table�chain�chain_id�priority�argsr r r �get_runtime_configb s,
z!FirewallDirect.get_runtime_configc C s | j | j| jfS )N)r r r )r r r r �
get_config� s zFirewallDirect.get_configc C s� |d kr| j � }n|}|\}}}x||D ]t}|\}} xf|| D ]Z}
| j|| |
�s<y| j|| |
|d� W q< tk
r� } ztjt| �� W Y d d } ~ X q<X q<W q&W x�|D ]�} | \}} }
xt|| D ]h\}
}| j|| |
|
|�s�y| j|| |
|
||d� W q� tk
�r" } ztjt| �� W Y d d } ~ X q�X q�W q�W xx|D ]p}xh|| D ]\}| j ||��s@y| j
|||d� W n2 tk
�r� } ztjt| �� W Y d d } ~ X nX �q@W �q2W |d k�r�|j d� d S )N)r$ T) r r' � add_chainr r Zwarning�strr* �add_ruler+ �add_passthroughr# )r Zconfr$ r% r r r r- r. r/ r0 �errorr1 r2 r3 r r r r" � s@
(
(
,
zFirewallDirect.set_configc C s* dddg}||kr&t tjd||f ��d S )N�ipv4�ipv6Zebz'%s' not in '%s')r r Z INVALID_IPV)r r. Zipvsr r r �
_check_ipv� s
zFirewallDirect._check_ipvc C sF | j |� |dkr tjj� ntjj� }||krBttjd||f ��d S )Nr; r< z'%s' not in '%s')r; r< )r= r �BUILT_IN_CHAINS�keysr r r Z
INVALID_TABLE)r r. r/ Ztablesr r r �_check_ipv_table� s
z FirewallDirect._check_ipv_tablec C s� |dkr4t j| }| jjr i }qH| jj|�j| }ntj| }tj| }||kr`tt j
d| ��||krxtt j
d| ��|dkr�| jj j |�d k r�tt j
d| ��d S )Nr; r< z chain '%s' is built-in chainzchain '%s' is reservedzChain '%s' is reserved)r; r< )r; r< )r r> r
�nftables_enabled�get_direct_backend_by_ipv�
our_chainsr Z
OUR_CHAINSr r Z
BUILTIN_CHAIN�zoneZzone_from_chainZ
INVALID_CHAIN)r r. r/ r0 Zbuilt_in_chainsrC r r r �_check_builtin_chain� s"
z#FirewallDirect._check_builtin_chainc C sH |r| j j|g �j|� n*| j | j|� t| j | �dkrD| j |= d S )Nr )r r( r) �remover )r r- r0 �addr r r �_register_chain� s
z FirewallDirect._register_chainc C sV |d kr| j � }n|}| jj� r.|j| jj� | jd||||� |d krR|jd� d S )NT)r r
� may_skip_flush_direct_backends�add_pre�flush_direct_backends�_chainr# )r r. r/ r0 r$ r% r r r r6 � s
zFirewallDirect.add_chainc C s> |d kr| j � }n|}| jd||||� |d kr:|jd� d S )NFT)r rL r# )r r. r/ r0 r$ r% r r r � remove_chain� s
zFirewallDirect.remove_chainc C s: | j ||� | j|||� ||f}|| jko8|| j| kS )N)r@ rE r )r r. r/ r0 r- r r r r' � s
zFirewallDirect.query_chainc C s, | j ||� ||f}|| jkr(| j| S g S )N)r@ r )r r. r/ r- r r r �
get_chains� s
zFirewallDirect.get_chainsc C sD g }x:| j D ]0}|\}}x"| j | D ]}|j|||f� q$W q W |S )N)r r) )r �r�keyr. r/ r0 r r r r s z FirewallDirect.get_all_chainsc C sZ |d kr| j � }n|}| jj� r.|j| jj� | jd||||||� |d krV|jd� d S )NT)r r
rI rJ rK �_ruler# )r r. r/ r0 r2 r3 r$ r% r r r r8 s
zFirewallDirect.add_rulec C sB |d kr| j � }n|}| jd||||||� |d kr>|jd� d S )NFT)r rQ r# )r r. r/ r0 r2 r3 r$ r% r r r � remove_rule s
zFirewallDirect.remove_rulec C s2 | j ||� |||f}|| jko0||f| j| kS )N)r@ r )r r. r/ r0 r2 r3 r1 r r r r* # s
zFirewallDirect.query_rulec C s6 | j ||� |||f}|| jkr2t| j| j� �S g S )N)r@ r �listr? )r r. r/ r0 r1 r r r � get_rules) s
zFirewallDirect.get_rulesc C sR g }xH| j D ]>}|\}}}x.| j | D ] \}}|j||||t|�f� q&W q W |S )N)r r) rS )r rO rP r. r/ r0 r2 r3 r r r r 0 s
z FirewallDirect.get_all_rulesc C s� |rr|| j krt� | j |< || j | |< || jkr<i | j|< || j| krb| j| | |7 < q�|| j| |< n<| j | |= t| j | �dkr�| j |= | j| | |8 < d S )Nr )r r r r )r �rule_idr1 r2 �enable�countr r r �_register_rule8 s
z FirewallDirect._register_rulec C sV y| j j| j j|�j|�S tk
rP } z tj|� ttj |��W Y d d }~X nX d S )N)
r
�rulerB �name� Exceptionr Zdebug2r r ZCOMMAND_FAILED)r r. r3 �msgr r r � passthroughL s
zFirewallDirect.passthroughc C sX |r*|| j krg | j |< | j | j|� n*| j | j|� t| j | �dkrT| j |= d S )Nr )r r) rF r )r r. r3 rV r r r �_register_passthroughT s
z$FirewallDirect._register_passthroughc C sX |d kr| j � }n|}| jj� r.|j| jj� | jd|t|�|� |d krT|jd� d S )NT)r r
rI rJ rK � _passthroughrS r# )r r. r3 r$ r% r r r r9 ^ s
z FirewallDirect.add_passthroughc C s@ |d kr| j � }n|}| jd|t|�|� |d kr<|jd� d S )NFT)r r_ rS r# )r r. r3 r$ r% r r r �remove_passthroughl s
z!FirewallDirect.remove_passthroughc C s || j kot|�| j | kS )N)r �tuple)r r. r3 r r r r+ w s
z FirewallDirect.query_passthroughc C s> g }x4| j D ]*}x$| j | D ]}|j|t|�f� q W q W |S )N)r r) rS )r rO r. r3 r r r r { s
z#FirewallDirect.get_all_passthroughsc C s4 g }|| j kr0x | j | D ]}|jt|�� qW |S )N)r r) rS )r r. rO r3 r r r �get_passthroughs� s
z FirewallDirect.get_passthroughsc C s� g }x�|D ]�}d}x�|D ]�}y|j |�}W n tk
r> Y qX t|�|krd||d krd}||d jd�}x.|D ]&} |dd� }
| |
|d < |j|
� qxW qW |s
|j|� q
W |S )z5Split values combined with commas for options in optsF�,� TN)�index�
ValueErrorr �splitr) ) r r, ZoptsZ out_rulesrY Z processed�opt�i�items�itemrQ r r r � split_value� s$
zFirewallDirect.split_valuec
C s* | j ||� | jj r2|dkr2| jjj||||� |}| jj|�} | jj rd| j|||�rdd| }n:| jjr�|dd � dkr�| j|||d d� �r�|d d� }|||f}
||f} |r�|
| jkr�| | j|
kr�tt j
d||||f ��nB|
| jk�s| | j|
k�rtt j d||||f ��| j|
| }d} d }
|
| j k�r�t
| j |
j� �}d }x@|t|�k �r�||| k�r�| | j |
|| 7 } |d7 }�qTW t|�g}| j|d
d g�}| j|d d
g�}x<|D ]4}|j| | j|||| t|��� | d7 } |
d7 }
�q�W | j| |
|||
� |j| j| |
|| |
� d S )Nr; r< z %s_direct� Z_directz"rule '%s' already is in '%s:%s:%s'z rule '%s' is not in '%s:%s:%s'rd r z-sz--sourcez-dz
--destination)r; r< i����i����i����)r@ r
rA rD �create_zone_base_by_chainrB Zis_chain_builtinr r r �ALREADY_ENABLED� NOT_ENABLEDr �sortedr? r rS rl r8 Z
build_rulera rX �add_fail)r rV r. r/ r0 r2 r3 r% rL �backendr1 rU re rW Z positions�jZ args_list�_argsr r r rQ � sZ
(
zFirewallDirect._rulec C s� | j ||� | j|||� ||f}|rV|| jkr�|| j| kr�ttjd|||f ��n.|| jksn|| j| kr�ttjd|||f ��| jj|�}|j ||j
|||�� | j |||� |j | j ||| � d S )Nz chain '%s' already is in '%s:%s'z chain '%s' is not in '%s:%s')
r@ rE r r r ro rp r
rB Z add_rulesZbuild_chain_rulesrH rr )r rG r. r/ r0 r% r- rs r r r rL s$
zFirewallDirect._chainc
C s� | j |� t|�}|rD|| jkrp|| j| krpttjd||f ��n,|| jks\|| j| krpttjd||f ��| jj|�}|r�|j |� |dkr�|j
|�\}}|r�|r�| jj j |||� |} n
|j
|�} |j|| � | j|||� |j| j||| � d S )Nzpassthrough '%s', '%s'r; r< )r; r< )r= ra r r r ro rp r
rB Zcheck_passthroughZ passthrough_parse_table_chainrD rn Zreverse_passthroughr8 r^ rr )
r rV r. r3 r% Z
tuple_argsrs r/ r0 ru r r r r_ ' s0
zFirewallDirect._passthrough)N)N)N)N)N)N)N)N))�__name__�
__module__� __qualname__r r r r r r r r! r& r4 r5 r" r= r@ rE rH r6 rM r' rN r r8 rR r* rT r rX r] r^ r9 r` r+ r rb rl rQ rL r_ r r r r r & sL
'
jN)�__all__Zfirewall.fw_typesr Z
firewall.corer r Z firewall.core.fw_transactionr Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/modules.cpython-36.pyc 0000644 00000005500 15035135173 0014005 0 ustar 00 3
��g� � @ sB d Z dgZddlmZ ddlmZ ddlmZ G dd� de�Z dS )zmodules backend�modules� )�runProg)�log)�COMMANDSc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dS )r c C s t d | _t d | _d S )NZmodprobeZrmmod)r �
_load_command�_unload_command)�self� r � /usr/lib/python3.6/modules.py�__init__ s
zmodules.__init__c C s
d| j S )Nz%s)� __class__)r r r r
�__repr__$ s zmodules.__repr__c C s� g }i }y�t dd��p}xh|D ]`}|s&P |j� }|j� }|j|d � |d dkrp|d jd�dd � ||d < q g ||d < q W W dQ R X W n tk
r� Y nX ||fS )
z6 get all loaded kernel modules and their dependencies z
/proc/modules�rr � �-�,N� ���)�open�strip�split�append�FileNotFoundError)r �mods�deps�f�lineZsplitsr r r
�loaded_modules' s
zmodules.loaded_modulesc C s" t jd| j| j|� t| j|g�S )Nz %s: %s %s)r �debug2r r r )r �moduler r r
� load_module< s zmodules.load_modulec C s" t jd| j| j|� t| j|g�S )Nz %s: %s %s)r r r r r )r r r r r
�
unload_module@ s zmodules.unload_modulec C sT ||kr dS x0|| D ]$}| j |||� ||kr|j|� qW ||krP|j|� dS )z get all dependants of a module N)�get_depsr )r r r �ret�modr r r
r" D s zmodules.get_depsc C s� g }| j � \}}| jd||� x*dD ]"}||kr$|j|� |jd|� q$W x^|D ]V}|dks�|jd�s�|jd �s�|jd
�s�|jd �s�|jd �s�|jd
�rP| j|||� qPW |S )z) get all loaded firewall-related modules Z nf_conntrack�nf_conntrack_ipv4�nf_conntrack_ipv6r � ip_tables�
ip6_tables�ebtablesZiptable_Z ip6table_Znf_Zxt_Zipt_Zip6t_)r% r& r )r' r( r) )r r" �remove�insert�
startswith)r r Zmods2r Zbad_bad_moduler$ r r r
�get_firewall_modulesO s
z modules.get_firewall_modulesc C s> x8| j � D ],}| j|�\}}|dkr
tjd||f � q
W dS )z% unload all firewall-related modules r z Failed to unload module '%s': %sN)r- r! r Zdebug1)r r Zstatusr# r r r
�unload_firewall_modulesd s z modules.unload_firewall_modulesN) �__name__�
__module__� __qualname__r r
r r r! r" r- r. r r r r
r s N)
�__doc__�__all__Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.configr �objectr r r r r
�<module> s
core/__pycache__/fw_service.cpython-36.opt-1.pyc 0000644 00000003201 15035135173 0015424 0 ustar 00 3
��gg � @ s2 d gZ ddlmZ ddlmZ G dd � d e�ZdS )�FirewallService� )�errors)�
FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dS )r c C s || _ i | _d S )N)Z_fw� _services)�self�fw� r � /usr/lib/python3.6/fw_service.py�__init__ s zFirewallService.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r r r r �__repr__ s zFirewallService.__repr__c C s | j j� d S )N)r �clear)r r r r �cleanup# s zFirewallService.cleanupc C s t | jj� �S )N)�sortedr �keys)r r r r � get_services( s z FirewallService.get_servicesc C s || j krttj|��d S )N)r r r ZINVALID_SERVICE)r �servicer r r �
check_service+ s
z FirewallService.check_servicec C s | j |� | j| S )N)r r )r r r r r � get_service/ s
zFirewallService.get_servicec C s || j |j< d S )N)r �name)r �objr r r � add_service3 s zFirewallService.add_servicec C s | j |� | j|= d S )N)r r )r r r r r �remove_service6 s
z FirewallService.remove_serviceN) �__name__�
__module__� __qualname__r
r r r r r r r r r r r r s N)�__all__Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_policies.cpython-36.opt-1.pyc 0000644 00000004432 15035135173 0015602 0 ustar 00 3
��g�
� @ sV d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd � d e
�Z dS ) �FirewallPolicies� )�config)�log)�LockdownWhitelist)�errors)�
FirewallErrorc @ sD e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dS )r c C s d| _ ttj�| _d S )NF)� _lockdownr r ZLOCKDOWN_WHITELIST�lockdown_whitelist)�self� r �!/usr/lib/python3.6/fw_policies.py�__init__ s zFirewallPolicies.__init__c C s d| j | j| jf S )Nz
%s(%r, %r))� __class__r r )r
r r r �__repr__# s
zFirewallPolicies.__repr__c C s d| _ | jj� d S )NF)r r �cleanup)r
r r r r ' s zFirewallPolicies.cleanupc C s� |dkr2t jd| � | jj|�r�t jd� dS n�|dkrdt jd| � | jj|�r�t jd� dS nb|dkr�t jd | � | jj|�r�t jd
� dS n0|d kr�t jd | � | jj|�r�t jd
� dS dS )N�contextz#Doing access check for context "%s"zcontext matches.TZuidz Doing access check for uid %dz uid matches.�userz Doing access check for user "%s"z
user matches.Zcommandz#Doing access check for command "%s"zcommand matches.F)r Zdebug2r Z
match_contextZdebug3Z match_uidZ
match_userZ
match_command)r
�key�valuer r r � access_check- s*
z FirewallPolicies.access_checkc C s | j rttjd��d| _ d S )Nzenable_lockdown()T)r r r ZALREADY_ENABLED)r
r r r �enable_lockdownD s z FirewallPolicies.enable_lockdownc C s | j sttjd��d| _ d S )Nzdisable_lockdown()F)r r r Z NOT_ENABLED)r
r r r �disable_lockdownI s z!FirewallPolicies.disable_lockdownc C s | j S )N)r )r
r r r �query_lockdownN s z FirewallPolicies.query_lockdownN)
�__name__�
__module__� __qualname__r
r r r r r r r r r r r s N) �__all__Zfirewallr Zfirewall.core.loggerr Z#firewall.core.io.lockdown_whitelistr r Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/rich.cpython-36.pyc 0000644 00000050640 15035135173 0013267 0 ustar 00 3
��g8� � @ s� d ddddddddd d
d d d
ddddgZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd � d e
�Z G dd� de
�Z G dd� de
�Z
G dd� de
�ZG d d� de�ZG d d� de
�ZG d d� de
�ZG d d� de
�ZG d d� de
�ZG d!d � d e
�ZG d"d
� d
e
�ZG d#d � d e
�ZG d$d � d e
�ZG d%d
� d
e
�ZG d&d� de�ZG d'd� de
�Zd(d)d/d1d+�ZG d,d� de
�Z G d-d� de
�Z d.S )2� Rich_Source�Rich_Destination� Rich_Service� Rich_Port�
Rich_Protocol�Rich_Masquerade�Rich_IcmpBlock�
Rich_IcmpType�Rich_SourcePort�Rich_ForwardPort�Rich_Log�
Rich_Audit� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�
Rich_Limit� Rich_Rule� )� functions)�check_ipset_name)� REJECT_TYPES)�errors)�
FirewallErrorc @ s e Zd Zddd�Zdd� ZdS )r Fc C s� || _ | j dkrd | _ || _| jdks0| jd kr8d | _n| jd k rN| jj� | _|| _| jdkrdd | _|| _| j d kr�| jd kr�| jd kr�ttjd��d S )N� zno address, mac and ipset)�addr�mac�upper�ipset�invertr r � INVALID_RULE)�selfr r r r � r! �/usr/lib/python3.6/rich.py�__init__$ s
zRich_Source.__init__c C sj d| j r dnd }| jd k r*|d| j S | jd k rB|d| j S | jd k rZ|d| j S ttjd��d S )Nz source%s z NOTr z address="%s"zmac="%s"z
ipset="%s"zno address, mac and ipset)r r r r r r r )r �retr! r! r" �__str__5 s
zRich_Source.__str__N)F)�__name__�
__module__� __qualname__r# r% r! r! r! r" r # s
c @ s e Zd Zddd�Zdd� ZdS )r Fc C sV || _ | j dkrd | _ || _| jdkr,d | _|| _| j d krR| jd krRttjd��d S )Nr zno address and ipset)r r r r r r )r r r r r! r! r" r# B s
zRich_Destination.__init__c C sR d| j r dnd }| jd k r*|d| j S | jd k rB|d| j S ttjd��d S )Nzdestination%s z NOTr z address="%s"z
ipset="%s"zno address and ipset)r r r r r r )r r$ r! r! r" r% N s
zRich_Destination.__str__N)F)r& r' r( r# r% r! r! r! r" r A s
c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)�name)r r) r! r! r" r# Y s zRich_Service.__init__c C s
d| j S )Nzservice name="%s")r) )r r! r! r" r% \ s zRich_Service.__str__N)r& r' r( r# r% r! r! r! r" r X s c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ || _d S )N)�port�protocol)r r* r+ r! r! r" r# ` s zRich_Port.__init__c C s d| j | jf S )Nz port port="%s" protocol="%s")r* r+ )r r! r! r" r% d s zRich_Port.__str__N)r& r' r( r# r% r! r! r! r" r _ s c @ s e Zd Zdd� ZdS )r c C s d| j | jf S )Nz#source-port port="%s" protocol="%s")r* r+ )r r! r! r" r% h s zRich_SourcePort.__str__N)r& r' r( r% r! r! r! r" r g s c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)�value)r r, r! r! r" r# m s zRich_Protocol.__init__c C s
d| j S )Nzprotocol value="%s")r, )r r! r! r" r% p s zRich_Protocol.__str__N)r& r' r( r# r% r! r! r! r" r l s c @ s e Zd Zdd� Zdd� ZdS )r c C s d S )Nr! )r r! r! r" r# t s zRich_Masquerade.__init__c C s dS )N�
masquerader! )r r! r! r" r% w s zRich_Masquerade.__str__N)r& r' r( r# r% r! r! r! r" r s s c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)r) )r r) r! r! r" r# { s zRich_IcmpBlock.__init__c C s
d| j S )Nzicmp-block name="%s")r) )r r! r! r" r% ~ s zRich_IcmpBlock.__str__N)r& r' r( r# r% r! r! r! r" r z s c @ s e Zd Zdd� Zdd� ZdS )r c C s
|| _ d S )N)r) )r r) r! r! r" r# � s zRich_IcmpType.__init__c C s
d| j S )Nzicmp-type name="%s")r) )r r! r! r" r% � s zRich_IcmpType.__str__N)r& r' r( r# r% r! r! r! r" r � s c @ s e Zd Zdd� Zdd� ZdS )r
c C s< || _ || _|| _|| _| jd kr(d| _| jd kr8d| _d S )Nr )r* r+ �to_port�
to_address)r r* r+ r. r/ r! r! r" r# � s
zRich_ForwardPort.__init__c C s< d| j | j| jdkr d| j nd| jdkr4d| j ndf S )Nz(forward-port port="%s" protocol="%s"%s%sr z
to-port="%s"z
to-addr="%s")r* r+ r. r/ )r r! r! r" r% � s zRich_ForwardPort.__str__N)r& r' r( r# r% r! r! r! r" r
� s c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ || _|| _d S )N)�prefix�level�limit)r r0 r1 r2 r! r! r" r# � s zRich_Log.__init__c C s> d| j rd| j nd| jr$d| j nd| jr6d| j ndf S )Nz log%s%s%sz prefix="%s"r z level="%s"z %s)r0 r1 r2 )r r! r! r" r% � s zRich_Log.__str__)NNN)r& r' r( r# r% r! r! r! r" r � s
c @ s e Zd Zddd�Zdd� ZdS )r Nc C s
|| _ d S )N)r2 )r r2 r! r! r" r# � s zRich_Audit.__init__c C s d| j rd| j nd S )Nzaudit%sz %sr )r2 )r r! r! r" r% � s zRich_Audit.__str__)N)r& r' r( r# r% r! r! r! r" r � s
c @ s e Zd Zddd�Zdd� ZdS )r
Nc C s
|| _ d S )N)r2 )r r2 r! r! r" r# � s zRich_Accept.__init__c C s d| j rd| j nd S )Nzaccept%sz %sr )r2 )r r! r! r" r% � s zRich_Accept.__str__)N)r& r' r( r# r% r! r! r! r" r
� s
c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S )N)�typer2 )r Z_typer2 r! r! r" r# � s zRich_Reject.__init__c C s, d| j rd| j nd| jr$d| j ndf S )Nz
reject%s%sz
type="%s"r z %s)r3 r2 )r r! r! r" r% � s zRich_Reject.__str__c C sT | j rP|sttjd��|dkrP| j t| krPdjt| �}ttjd| j |f ��d S )Nz9When using reject type you must specify also rule family.�ipv4�ipv6z, z%Wrong reject type %s.
Use one of: %s.)r4 r5 )r3 r r r r �join)r �familyZ valid_typesr! r! r" �check� s zRich_Reject.check)NN)r& r' r( r# r% r8 r! r! r! r" r � s
c @ s e Zd Zdd� ZdS )r c C s d| j rd| j nd S )Nzdrop%sz %sr )r2 )r r! r! r" r% � s zRich_Drop.__str__N)r& r' r( r% r! r! r! r" r � s c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S )N)�setr2 )r Z_setr2 r! r! r" r# � s zRich_Mark.__init__c C s d| j | jrd| j ndf S )Nz
mark set=%s%sz %sr )r9 r2 )r r! r! r" r% � s zRich_Mark.__str__c C s� | j d k r| j }n ttjd��d|krv|jd�}t|�dkrHttj|��tj|d � shtj|d � r�ttj|��ntj|�s�ttj|��d S )Nz no value set�/� r � )r9 r r Z INVALID_MARK�split�lenr Z checkUINT32)r �x�splitsr! r! r" r8 � s
zRich_Mark.check)N)r& r' r( r# r% r8 r! r! r! r" r � s
r< �< � )�s�m�h�dc @ s� e Zd Zddd�Zdd� Zedd� �Zejdd� �Zed d
� �Zejd d
� �Ze d d
� �Z
dd� Z e dd� �Z dd� Z
dd� ZdS )r Nc C s || _ || _d S )N)r, �burst)r r, rG r! r! r" r# � s zRich_Limit.__init__c C s | j � | j� d S )N)� value_parse� burst_parse)r r! r! r" r8 � s zRich_Limit.checkc C s | j S )N)�_value)r r! r! r" r, � s zRich_Limit.valuec C sf |d krd | _ d S y| j|�\}}W n tk
r< |}Y nX |� d|� �}t| dd �|krb|| _ d S )Nr: rJ )rJ � _value_parser �getattr)r r, �rate�duration�vr! r! r" r, � s
c C s | j S )N)�_burst)r r! r! r" rG s zRich_Limit.burstc C s\ |d krd | _ d S y| j|�}W n tk
r8 |}Y n
X t|�}t| dd �|krX|| _ d S )NrP )rP � _burst_parser �strrL )r rG �br! r! r" rG s
c C s� d }d| kr| j d�}| s(t|�dkr4ttj| ��|\}}y t|�}W n ttj| ��Y nX |dkrv|d d� }|dk s�|dkr�ttj| ��d t| | d
kr�ttjd| f ��|dkr�|d kr�ttjd| f ��||fS )Nr: r; �second�minute�hour�dayr< rC rD rE rF i' r z %s too fastz %s too slow)rT rU rV rW )rC rD rE rF )r= r> r r �
INVALID_LIMIT�int�DURATION_TO_MULT)r, r@ rM rN r! r! r" rK s&
zRich_Limit._value_parsec C s | j | j�S )N)rK rJ )r r! r! r" rH : s zRich_Limit.value_parsec C sR | d kr d S y t | �}W n ttj| ��Y nX |dk sB|dkrNttj| ��|S )Nr< i��� )rY r r rX )rG rS r! r! r" rQ = s zRich_Limit._burst_parsec C s | j | j�S )N)rQ rP )r r! r! r" rI K s zRich_Limit.burst_parsec C s, d| j � d�}| jd k r(|d| j� �7 }|S )Nz
limit value="�"z burst=)rJ rP )r rC r! r! r" r% N s
zRich_Limit.__str__)N)r& r' r( r# r8 �propertyr, �setterrG � staticmethodrK rH rQ rI r% r! r! r! r" r � s
c @ s> e Zd ZdZdZddd�Zdd� Zd d
� Zd d � Zd
d� Z dS )r i � i� Nr c C sV |d k rt |�| _nd | _|| _d | _d | _d | _d | _d | _d | _|rR| j |� d S )N)
rR r7 �priority�source� destination�element�log�audit�action�_import_from_string)r r7 �rule_strr_ r! r! r" r# X s zRich_Rule.__init__c C s� g }x|t j|�D ]n}d|krp|jd�}t|�dksF|d sF|d rVttjd| ��|j|d |d d�� q|jd|i� qW |jddi� |S ) z Lexical analysis �=r; r r< z internal error in _lexer(): %s)� attr_name�
attr_valuerb �EOL)r Z splitArgsr= r> r r r �append)r rg �tokens�r�attrr! r! r" �_lexeri s
zRich_Rule._lexerc C s� |st tjd��tj|�}d| _d | _d | _d | _d | _ d | _
d | _ d | _ | j
|�}|rv|d jd�dkrvt tjd��i }g }d}�x`|| jd�dko�|dgk�s�|| jd�}|| jd�}|| jd�}|� r�|dHk�r�t tjd| ��� n�|dIk�r�|dk�r | j�r t tjd+��n�|dk�r<| j�r<t tjd,��n�|dJk�rf| j �rft tjd-|| j f ��nh|d"k�r�| j
�r�t tjd.��nH|d#k�r�| j �r�t tjd/��n(|dKk�r�| j �r�t tjd0|| j f ��nt tjd1| ��t|�dk�r�|t|�d2 nd3} | d3k�r�| �r`|�r`|d k�r2t tjd4��n,|dk�rJt tjd5��nt tjd6||f ��n*d|k�r�t tjd7||f ��n
|jd� �nL| dk�rD|d k�r�|dLk�r�t tjd:| ��|| _n||dk�ryt|�| _W n& tk
�r t tjd;| ��Y nX n:|�r6|dk�r d<}
n d=||f }
t tj|
��n
|j|� �n�| dk�r�|dMk�rb|||< nV|dNk�rvd>|d
< nBt|jd
�|jd �|jd �|jd
d?��| _|j� |j� |d2 }�n | dk�r,|dOk�r�|||< nN|dPk�r�d>|d
< n:t|jd
�|jd �|jd
d?��| _|j� |j� |d2 }�n�| dk�rd|dk�rTt|�| _ |j� n t tjd@���nv| d k�r�|dk�r�t|�| _ |j� n t tjdA���n>| dk�r�|dQk�r�|||< n0t|jd�|jd��| _ |j� |j� |d2 }�n�| d k�r&|dk�rt|�| _ |j� n t tjdB���n�| d k�r^|dk�rNt |�| _ |j� n t tjdC���n|| d k�r�t � | _ |j� |j� |d2 }�nN| d k�r�|dRk�r�|||< n@t |jd�|jd�|jd�|jd��| _ |j� |j� |d2 }�n�| d!k�r@|dSk�r |||< n0t |jd�|jd��| _ |j� |j� |d2 }�n�| d"k�r�|dTk�r^|||< nN|d(k�rt|jd(� n8t |jd�|jd�|jd(��| _
|j� |j� |d2 }�n*| d#k�r�|d(k�r�|jd(� n(t!|jd(��| _ |j� |j� |d2 }�n�| d$k�rH|d(k�r |jd(� n(t"|jd(��| _ |j� |j� |d2 }�n�| d%k�r�|d(k�rh|jd(� n(t#|jd(��| _ |j� |j� |d2 }�nF| d&k�r�|dk�r�|||< nF|d(k�r�|jd(� n0t$|jd�|jd(��| _ |j� |j� |d2 }n�| d'k�r`|dk�r|||< nF|d(k�r.|jd(� n0t%|jd�|jd(��| _ |j� |j� |d2 }nz| d(k�r�|dUk�r�||dD|� �< nVdE|k�r�t tjdF��t&|dE |jdG��|d(< |jdEd � |jdGd � |j� |d2 }|d2 }q�W | j'� d S )VNz
empty ruler rb rk �ruleri rj r_ r7 �addressr r r r, r* r+ �to-port�to-addrr) r0 r1 r3 r9 rG zbad attribute '%s'r` ra �service�
icmp-block� icmp-typer- � forward-port� source-portrc rd �accept�drop�reject�markr2 �not�NOTz more than one 'source' elementz#more than one 'destination' elementzFmore than one element. There cannot be both '%s' and '%s' in one rule.zmore than one 'log' elementz more than one 'audit' elementzOmore than one 'action' element. There cannot be both '%s' and '%s' in one rule.zunknown element %sr< r z0'family' outside of rule. Use 'rule family=...'.z4'priority' outside of rule. Use 'rule priority=...'.z:'%s' outside of any element. Use 'rule <element> %s= ...'.z,'%s' outside of rule. Use 'rule ... %s ...'.r4 r5 zH'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead.z(invalid 'priority' attribute value '%s'.zdwrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'.zDattribute '%s' outside of any element. Use 'rule <element> %s= ...'.TFzinvalid 'protocol' elementzinvalid 'service' elementz invalid 'icmp-block' elementzinvalid 'icmp-type' elementzlimit.z limit.valuezinvalid 'limit' elementz limit.burst)r_ r7 rr r r r r, r* r+ rs rt r) r0 r1 r3 r9 rG )rq r` ra r+ ru r* rv rw r- rx ry rc rd rz r{ r| r} r2 r~ r rk )r+ ru r* rv rw r- rx ry )rz r{ r| r} )r4 r5 )rr r r r )r~ r )rr r r )r~ r )r* r+ )r* r+ rs rt )r* r+ )r0 r1 )r, rG )(r r r r ZstripNonPrintableCharactersr_ r7 r` ra rb rc rd re rp �getr> rl rY �
ValueError�INVALID_PRIORITYr �pop�clearr r r r r r r r
r r r r
r r r r r8 ) r rg rm ZattrsZ in_elements�indexrb ri rj Z
in_elementZerr_msgr! r! r" rf z s�
" "
*
"
(
z Rich_Rule._import_from_stringc C s` | j d k r"| j d kr"ttj| j ��| j d krn| jd k rB| jjd k sL| jd k rVttj��t| j �t
krnttj��| j | j k s�| j | j
kr�ttjd| j | j
f ��| j d ko�| jd ks�| jd k o�| j dk�r
| jd kr�ttjd��| jd ko�| jd ko�| j dk�r
ttjd��t| j �tt
tgk�rP| jd k�rP| jd k�rP| jd k�rPttjd��| jd k �rj| jjd k �r�| j d k�r�ttj��| jjd k �r�ttjd��| jjd k �r�ttjd ��tj| j | jj��sjttjt| jj���n�| jjd k �r,| jjd k �rttjd
��tj| jj��sjttj t| jj���n>| jjd k �r^t | jj��sjttj t| jj���n ttjd ��| jd k �r | jjd k �r�| j d k�r�ttj��| jjd k �r�ttj d ��tj| j | jj��s ttjt| jj���n>| jjd k �rt | jj��s ttj t| jj���n ttjd ��t| j �t k�rd| j j!d k�sLt"| j j!�d
k �r`ttj#t| j j!����n�t| j �t$k�r�tj%| j j&��s�ttj'| j j&��| j j(d!k�r`ttj)| j j(���n�t| j �t*k�r�tj+| j j,��s`ttj)| j j,���nvt| j �tk�r<| jd k �rttjd��| jd k �r`| jjd k �r`ttjd���n$t| j �tk�r�| j j!d k�slt"| j j!�d
k �r�ttj-t| j j!���| j�r`ttjd���n�t| j �t.k�r�| j j!d k�s�t"| j j!�d
k �r`ttj-t| j j!����n�t| j �t
k�r�tj%| j j&��sttj'| j j&��| j j(d"k�r.ttj)| j j(��| j j/dk�rZ| j j0dk�rZttj'| j j/��| j j/dk�r�tj%| j j/� �r�ttj'| j j/��| j j0dk�r�tj1| j | j j0� �r�ttj| j j0��| j d k�r�ttj��| jd k �r`ttjd��nrt| j �t2k�r>tj%| j j&��s ttj'| j j&��| j j(d#k�r`ttj)| j j(��n"| j d k �r`ttjdt| j � ��| jd k �r�| jj3�r�| jj3d$k�r�ttj4| jj3��| jj5d k �r�| jj5j6� | jd k �r�t| j�t7t8t9gk�r�ttj:t| j���| jj5d k �r�| jj5j6� | jd k �r\t| j�t8k�r(| jj6| j � nt| j�t;k�rB| jj6� | jj5d k �r\| jj5j6� d S )%Nr4 r5 z/'priority' attribute must be between %d and %d.r zno element, no actionz%no element, no source, no destinationzno action, no log, no auditzaddress and maczaddress and ipsetz
mac and ipsetzinvalid sourcezinvalid destinationr< �tcp�udp�sctp�dccpzmasquerade and actionzmasquerade and mac sourcezicmp-block and actionr zforward-port and actionzUnknown element %s�emerg�alert�crit�error�warning�notice�info�debug)r4 r5 )r� r� r� r� )r� r� r� r� )r� r� r� r� )r� r� r� r� r� r� r� r� )<r7 r r ZINVALID_FAMILYr` r ra ZMISSING_FAMILYr3 rb r
r_ � priority_min� priority_maxr� rc re r r r rd r r r Z
check_addressZ INVALID_ADDRrR Z check_macZ INVALID_MACr Z
INVALID_IPSETZINVALID_DESTINATIONr r) r> ZINVALID_SERVICEr Z
check_portr* Z INVALID_PORTr+ ZINVALID_PROTOCOLr Z
checkProtocolr, ZINVALID_ICMPTYPEr r. r/ Zcheck_single_addressr r1 ZINVALID_LOG_LEVELr2 r8 r
r r ZINVALID_AUDIT_TYPEr )r r! r! r" r8 h s�
zRich_Rule.checkc C s� d}| j r|d| j 7 }| jr,|d| j 7 }| jr@|d| j 7 }| jrT|d| j 7 }| jrh|d| j 7 }| jr||d| j 7 }| jr�|d| j 7 }| jr�|d| j 7 }tj r�tj
|�S |S )Nrq z priority="%d"z family="%s"z %s) r_ r7 r` ra rb rc rd re r ZPY2Zu2b)r r$ r! r! r" r% s$ zRich_Rule.__str__i ���)NNr )
r& r' r( r� r� r# rp rf r8 r% r! r! r! r" r T s
o -Ni i� i�Q ) �__all__Zfirewallr Zfirewall.core.ipsetr Zfirewall.core.baser r Zfirewall.errorsr �objectr r r r r r r r r r
r r r
r r r rZ r r r! r! r! r" �<module> s@
d core/__pycache__/watcher.cpython-36.opt-1.pyc 0000644 00000005256 15035135173 0014741 0 ustar 00 3
��g� � @ s* d gZ ddlmZmZ G dd � d e�ZdS )�Watcher� )�Gio�GLibc @ sd e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dS )r c C s" || _ || _i | _i | _g | _d S )N)� _callback�_timeout� _monitors� _timeouts�_blocked)�self�callbackZtimeout� r � /usr/lib/python3.6/watcher.py�__init__ s
zWatcher.__init__c C s: t jj|�}|jt jjd �| j|< | j| jd| j� d S )N�changed) r �File� new_for_pathZmonitor_directory�FileMonitorFlags�NONEr �connect�_file_changed_cb)r
Z directory�gfiler r r
�
add_watch_dir" s zWatcher.add_watch_dirc C s: t jj|�}|jt jjd �| j|< | j| jd| j� d S )Nr ) r r r Z monitor_filer r r r r )r
�filenamer r r r
�add_watch_file( s zWatcher.add_watch_filec C s
| j j� S )N)r �keys)r
r r r
� get_watches. s zWatcher.get_watchesc C s
|| j kS )N)r )r
r r r r
� has_watch1 s zWatcher.has_watchc C s | j |= d S )N)r )r
r r r r
� remove_watch4 s zWatcher.remove_watchc C s || j kr| j j|� d S )N)r �append)r
r r r r
� block_source7 s
zWatcher.block_sourcec C s || j kr| j j|� d S )N)r �remove)r
r r r r
�unblock_source; s
zWatcher.unblock_sourcec C s4 x.t | jj� �D ] }tj| j| � | j|= qW d S )N)�listr r r �
source_remove)r
r r r r
�clear_timeouts? s zWatcher.clear_timeoutsc C s || j kr| j|� | j|= d S )N)r r r )r
r r r r
�_call_callbackD s
zWatcher._call_callbackc C s� |j � }|| jkr8|| jkr4tj| j| � | j|= d S |tjjksh|tjjksh|tjj ksh|tjj
kr�|| jkr�tj| j| � | j|= tj | j | j
|�| j|< d S )N)Zget_parse_namer r r r# r ZFileMonitorEventZCHANGEDZCREATEDZDELETEDZATTRIBUTE_CHANGEDZtimeout_add_secondsr r% )r
ZmonitorZgio_fileZgio_other_fileZeventr r r r
r I s
zWatcher._file_changed_cbN)�__name__�
__module__� __qualname__r r r r r r r r! r$ r% r r r r r
r s N)�__all__Z
gi.repositoryr r �objectr r r r r
�<module> s core/__pycache__/prog.cpython-36.pyc 0000644 00000001266 15035135173 0013311 0 ustar 00 3
��g� � @ s d dl Z dgZddd�ZdS )� N�runProgc
C s� |d kr g }| g| }d }|r@t |d��}|j� j� }W d Q R X ddi}y tj|tjtjtjd|d�}W n tk
r| d
S X |j|�\}} |j dd �}|j
|fS ) N�rZLANG�CT)�stdin�stderr�stdoutZ close_fds�env� � zutf-8�replace)r r
) �open�read�encode�
subprocess�Popen�PIPEZSTDOUT�OSErrorZ communicate�decode�
returncode)
�prog�argvr �argsZ input_stringZhandler Zprocess�outputZ
err_output� r �/usr/lib/python3.6/prog.pyr s$
)NN)r �__all__r r r r r �<module> s core/__pycache__/fw.cpython-36.opt-1.pyc 0000644 00000066115 15035135173 0013721 0 ustar 00 3
��g�� � @ s� d gZ ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl
m Z ddl
m
Z
ddl
mZ dd l
mZ dd
lmZ dd lmZ dd lmZ dd
lmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl m!Z! ddl"m#Z# ddl$m%Z%m&Z& ddl'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2m3Z3 ddl4m5Z5 dd l6m7Z7 dd l8m9Z9 dd l:m;Z; dd lm<Z< dd l=m>Z> G d!d � d e?�Z@dS )"�Firewall� N)�config)� functions)� ipXtables)�ebtables)�nftables)�ipset)�modules)�FirewallIcmpType)�FirewallService)� FirewallZone)�FirewallDirect)�FirewallConfig)�FirewallPolicies)�
FirewallIPSet)�FirewallTransaction)�FirewallHelper)�FirewallPolicy)�nm_get_bus_name�nm_get_interfaces_in_zone)�log)�firewalld_conf)�Direct)�service_reader)�icmptype_reader)� zone_reader�Zone)� ipset_reader)� IPSET_TYPES)�
helper_reader)�
policy_reader)�errors)�
FirewallErrorc @ s� e Zd Zdedd�Zdd� Zdd� Zdd � Zd
d � Zdfd d
�Zdd� Z dgdd�Z
dd� Z dd� Z dd� Z
dd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zdhd)d*�Zdid+d,�Zd-d.� Zdjd/d0�Zdkd1d2�Zdld3d4�Zd5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z!dAdB� Z"dCdD� Z#dEdF� Z$dGdH� Z%dIdJ� Z&dKdL� Z'dMdN� Z(dmdOdP�Z)dQdR� Z*dSdT� Z+dUdV� Z,dWdX� Z-dYdZ� Z.d[d\� Z/d]d^� Z0d_d`� Z1dadb� Z2dcdd� Z3d(S )nr Fc C s t tj�| _|| _| jr>d| _d| _d| _d| _t | _
d| _ nrt j
| �| _d| _g | _t j| �| _d| _g | _tj� | _d| _tj� | _d| _g | _
tj| �| _d| _ tj� | _t| �| _ t | �| _ t | �| _ t!| �| _"t#| �| _t$� | _%t&| �| _t'| �| _(t)| �| _*| j+� d S )NFT),r r �FIREWALLD_CONF�_firewalld_conf�_offline�ip4tables_enabled�ip6tables_enabled�ebtables_enabled�
ipset_enabledr �ipset_supported_types�nftables_enabledr � ip4tables�ip4tables_backend�ipv4_supported_icmp_types� ip6tables�ip6tables_backend�ipv6_supported_icmp_typesr �ebtables_backendr �
ipset_backendr �nftables_backendr �modules_backendr
�icmptyper �servicer �zoner
�directr r �policiesr r �helperr �policy�_Firewall__init_vars)�selfZoffline� r? �/usr/lib/python3.6/fw.py�__init__C sB
zFirewall.__init__c C sD d| j | j| j| j| j| j| j| j| j| j | j
| j | j | j
| jf S )Nz:%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__r& r' r( �_state�_panic�
_default_zone�_module_refcount�_marks�cleanup_on_exit�cleanup_modules_on_exit�ipv6_rpfilter_enabledr) �_individual_calls� _log_denied)r> r? r? r@ �__repr__k s zFirewall.__repr__c C sj d| _ d| _d| _i | _g | _tj| _tj| _ tj
| _ tj | _
tj| _tj| _tj| _tj| _tj| _d S )NZINITF� )rC rD rE rF rG r ZFALLBACK_CLEANUP_ON_EXITrH Z FALLBACK_CLEANUP_MODULES_ON_EXITrI ZFALLBACK_IPV6_RPFILTERrJ ZFALLBACK_INDIVIDUAL_CALLSrK ZFALLBACK_LOG_DENIEDrL ZFALLBACK_FIREWALL_BACKEND�_firewall_backendZ FALLBACK_FLUSH_ALL_ON_RELOAD�_flush_all_on_reloadZFALLBACK_RFC3964_IPV4�
_rfc3964_ipv4Z FALLBACK_ALLOW_ZONE_DRIFTING�_allow_zone_drifting)r> r? r? r@ Z __init_varst s zFirewall.__init_varsc C s� | j r$d| jj� kr$tjd� d| _ | jrHd| jj� krHtjd� d| _| jrld| jj� krltjd� d| _| j r�| j r�| j r�tj
d� t j d� d S )N�filterziptables is not usable.Fzip6tables is not usable.zebtables is not usable.zNo IPv4 and IPv6 firewall.� )
r& r- �get_available_tablesr �info1r' r0 r( r2 r+ �fatal�sys�exit)r> r? r? r@ �
_check_tables� s
zFirewall._check_tablesc C sz y| j j� W n* tk
r8 tjd� d| _g | _Y nX | j j� | _| jj � | jj
s|| jj rltjd� ntjd� d| _ | j
r�| jjd�| _n| j r�| jj� | _ng | _| jj � | jj
s�| jj r�tjd� ntjd� d| _| j
r�| jjd�| _n | j�r| jj� | _ng | _| jj � | jj
�sN| jj �r>tjd � ntjd
� d| _| j�rv| j �rv| jj �rvtjd � d S ) Nz4ipset not usable, disabling ipset usage in firewall.FzFiptables-restore is missing, using individual calls for IPv4 firewall.zCiptables-restore and iptables are missing, disabling IPv4 firewall.�ipv4zGip6tables-restore is missing, using individual calls for IPv6 firewall.zEip6tables-restore and ip6tables are missing, disabling IPv6 firewall.�ipv6zHebtables-restore is missing, using individual calls for bridge firewall.zEebtables-restore and ebtables are missing, disabling bridge firewall.zSebtables-restore is not supporting the --noflush option, will therefore not be used)r3 Zset_list�
ValueErrorr �warningr) r* Zset_supported_typesr- Z fill_exists�restore_command_existsZcommand_existsr& r+ r4 Zsupported_icmp_typesr. r0 r' r1 r2 r( rK �restore_noflush_option�debug1)r> r? r? r@ � _start_check� sL
zFirewall._start_checkc > C s� t j}tjdt j� y| jj� W n8 tk
rZ } ztj|� tjd� W Y d d }~X �n"X | jj d�rt| jj d�}| jj d�r�| jj d�}|d k r�|j
� dBkr�d| _ tjd| j � | jj d ��r| jj d �}|d k r�|j
� dCkr�d | _ |d k �r|j
� dDk�rd| _ tjd
| j � | jj d��rv| jj d�}|d k �rv|j
� dEk�rvtjd� y| j
j� W n tk
�rt Y nX | jj d��r�| jj d�}|d k �r�|j
� dFk�r�d| _|j
� dGk�r�d | _| j�r�tjd� n
tjd� | jj d��r"| jj d�}|d k �r"|j
� dHk�r"tjd� d | _| jj d��rt| jj d�}|d k�sT|j
� dk�r\d| _n|j
� | _tjd| j� | jj d��r�| jj d�| _tjd| j� | jj d��r�| jj d�}|j
� dIk�r�d| _nd | _tjd| j� | jj d ��r&| jj d �}|j
� dJk�rd| _nd | _tjd | j� | jj d ��r|| jj d �}|j
� dKk�rVd| _nd | _| j�sntjd � tjd | j� | j jtj| j�� | j| j� | j�s�| j � tjd!� y| j
j j� W nZ tk
�r } z<| j
j � �r�tj d"| j
j j |� ntjd"| j
j j |� W Y d d }~X nX | j j!tj| j
�� | j"t j#d#� | j"t j$d#� | j"t j%d$� | j"t j&d$� t'| j(j)� �d%k�r�tj d&� | j"t j*d'� | j"t j+d'� | j"t j,d(� | j"t j-d(� t'| j.j/� �d%k�r�tj d)� | j"t j0d*� | j"t j1d*� t'| j2j3� �d%k�r&tj4d+� t5j6d,� | j"t j7d-� | j"t j8d-� d}x.dLD ]&}|| j2j3� k�rLtj4d1|� d }�qLW |�r�t5j6d,� || j2j3� k�r�d2| j2j3� k�r�d2}nd3| j2j3� k�r�d3}nd.}tj d4||� |}n tjd5|� t9t j:�} t;j<j=t j:��rRtjd6t j: � y | j� W n4 tk
�rP } ztj d7t j:|� W Y d d }~X nX | j>j?| � | j j@tj| �� | jA|�| _B| j�r�d S | jC� tjD� d%k�r�tEjE� }
tF| �} |�s�| jG| d8� |�r�|�s�| jH�r�| jIjJ� �r�| jKd � | jL� |�r|�rtjd9� | jMjN� | jO| d8� | jKd � | jL� | jH�rX| jIjJ� �rXtjd:� | jIjP� tjd;� | jQ| d8� tjd<� | j2jR| d8� | j2jSd | jB| d8� tjd=� | jTjU| d8� | jKd � | jL� | j>jV� �rVtjd>� | j>jW| � y| jKd � | jL� W nX tk
�r> } z$t| jXd?| jY�r&| jYnd@ ��W Y d d } ~ X n tk
�rT � Y nX ~ tjD� d,k�r�tEjE� }
tjZdA|
|
� d S )MNz"Loading firewalld config file '%s'z0Using fallback firewalld configuration settings.� DefaultZoneZ
CleanupOnExit�no�falseFz CleanupOnExit is set to '%s'ZCleanupModulesOnExit�yes�trueTz#CleanupModulesOnExit is set to '%s'ZLockdownzLockdown is enabledZ
IPv6_rpfilterzIPv6 rpfilter is enabledzIPV6 rpfilter is disabledZIndividualCallszIndividualCalls is enabled� LogDeniedZoffzLogDenied is set to '%s'ZFirewallBackendz FirewallBackend is set to '%s'ZFlushAllOnReloadz FlushAllOnReload is set to '%s'Z RFC3964_IPv4zRFC3964_IPv4 is set to '%s'ZAllowZoneDriftingz�AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.z AllowZoneDrifting is set to '%s'zLoading lockdown whitelistz*Failed to load lockdown whitelist '%s': %sr r6 r zNo icmptypes found.r; r7 zNo services found.r8 zNo zones found.rT r< �block�drop�trustedzZone '%s' is not available.ZpublicZexternalz+Default zone '%s' is not valid. Using '%s'.zUsing default zone '%s'z Loading direct rules file '%s'z)Failed to load direct rules file '%s': %s)�use_transactionzUnloading firewall moduleszApplying ipsetszApplying default rule setzApplying used zoneszApplying used policiesz2Applying direct chains rules and passthrough rulesz
Direct: %srN z%Flushing and applying took %f seconds)rd re )rf rg )rd re )rf rg )rd re )rf rg )rf rg )rd re )rd re )rd re )ri rj rk )[r Z
FALLBACK_ZONEr ra r# r$ �read� Exceptionr^ �get�lowerrH rI r: Zenable_lockdownr" rJ rK rL rO rP rQ rR r% Zset_firewalld_conf�copy�deepcopy�_select_firewall_backendrb Zlockdown_whitelistZquery_lockdown�error�filenameZ set_policies�_loaderZFIREWALLD_IPSETSZETC_FIREWALLD_IPSETSZFIREWALLD_ICMPTYPESZETC_FIREWALLD_ICMPTYPES�lenr6 �
get_icmptypesZFIREWALLD_HELPERSZETC_FIREWALLD_HELPERSZFIREWALLD_SERVICESZETC_FIREWALLD_SERVICESr7 � get_servicesZFIREWALLD_ZONESZETC_FIREWALLD_ZONESr8 � get_zonesrW rX rY ZFIREWALLD_POLICIESZETC_FIREWALLD_POLICIESr ZFIREWALLD_DIRECT�os�path�existsr9 Zset_permanent_configZ
set_direct�
check_zonerE rZ ZgetDebugLogLevel�timer �flushr) r Z
has_ipsets�execute�clearr5 �unload_firewall_modules�apply_default_tablesZ apply_ipsets�apply_default_rulesZ apply_zones�change_default_zoner< Zapply_policiesZhas_configurationZ apply_direct�code�msgZdebug2)r> �reload�complete_reloadZ default_zoner� �valuert �zr8 �objZtm1� transaction�eZtm2r? r? r@ �_start� st
.zFirewall._startc C sH y | j � W n& tk
r2 d| _| jd� � Y nX d| _| jd� d S )N�FAILED�ACCEPT�RUNNING)r� rn rC �
set_policy)r> r? r? r@ �start� s
zFirewall.startc C sh t jj|�sd S |rZ|jtj�rV|dkrVt� }t jj|�|_|j |j� ||_d|_
nd}�x|t t j |��D �]h}|j
d�s�|jtj�rl|dkrlt jjd||f �rl| jd||f |dd� qld||f }tjd||� �y�|dk�r�t||�}|j| jj� k�r8| jj|j�}tjd ||j|j|j� | jj|j� n|jjtj��rNd|_
y| jj|� W n< tk
�r� } z tjd
|jt| �f � W Y d d } ~ X nX | jjtj |�� �n�|d k�rFt ||�}|j| j j � k�r| j j |j�}tjd ||j|j|j� | j j!|j� n|jjtj��r$d|_
| j j"|� | jj"tj |�� �n.|dk�rnt#|||d �}|�r�dt jj|�t jj|�d
d� f |_|j |j� tj |�}
|j| j$j%� k�r| j$j&|j�}| j$j'|j� |j(�r�tjd||j||� |j)|� ntjd ||j|j|j� n |jjtj��r,d|_
d|
_
| jj*|
� |�r^tjd||j||� |j)|� n | j$j*|� �n|dk�rDt+||�}|j| j,j-� k�r�| j,j.|j�}tjd ||j|j|j� | j,j/|j� n|jjtj��r�d|_
y| j,j0|� W n< tk
�r, } z tj1d
|jt| �f � W Y d d } ~ X nX | jj0tj |�� �n0|dk�r�t2||�}|j| j3j4� k�r�| j3j5|j�}tjd ||j|j|j� | j3j6|j� n|jjtj��r�d|_
| j3j7|� | jj7tj |�� n�|dk�rht8||�}|j| j9j:� k�r2| j9j;|j�}tjd ||j|j|j� | j9j<|j� n|jjtj��rHd|_
| j9j=|� | jj>tj |�� n tj?d|� W ql tk
�r� } ztj@d||| � W Y d d } ~ X ql tAk
�r� tj@d||� tjB� Y qlX qlW |�rd|j(�rd|j| j$j%� k�rX| j$j&|j�}tjd||j|j|j� y| j$j'|j� W n tAk
�rH Y nX | jjC|j� | j$j*|� d S )Nr8 Fz.xmlz%s/%sT)�combinezLoading %s file '%s'r6 z Overloads %s '%s' ('%s/%s')z %s: %s, ignoring for run-time.r7 )Z
no_check_namer � z Combining %s '%s' ('%s/%s')r r; r< zUnknown reader type %sz Failed to load %s file '%s': %sz Failed to load %s file '%s':z0 Overloading and deactivating %s '%s' ('%s/%s')���)Dr{ r| �isdir�
startswithr Z
ETC_FIREWALLDr �basename�nameZ
check_name�default�sorted�listdir�endswithrv r ra r r6 rx Z get_icmptyperu Zremove_icmptypeZ add_icmptyper" rV �strrq rr r r7 ry Z get_serviceZremove_serviceZ add_servicer r8 rz Zget_zoneZ remove_zone�combinedr� Zadd_zoner r �
get_ipsets� get_ipsetZ remove_ipset� add_ipsetr^ r r; Z get_helpersZ
get_helperZ
remove_helperZ
add_helperr r< � get_policiesZ
get_policyZ
remove_policyZ
add_policyZadd_policy_objectrW rt rn Z exceptionZ forget_zone) r> r| Z reader_typer� Z
combined_zoneru r� r� Zorig_objrt Z
config_objr� r? r? r@ rv s
$
$
zFirewall._loaderc C sp | j j� | jj� | jj� | jj� | jj� | jj� | jj� | jj� | j j� | j
j� | j � d S )N) r6 �cleanupr7 r8 r r; r r9 r: r< r$ r= )r> r? r? r@ r� � s
zFirewall.cleanupc C sN | j sB| jr(| j� | jj� | jd� | jrBtjd� | jj � | j
� d S )Nr� z!Unloading firewall kernel modules) r% rH r� r r� rI r ra r5 r� r� )r> r? r? r@ �stop� s
z
Firewall.stopc C s� d}d}x�t |�D ]�\}}|r0| jj|�\}}n$| j| dkrDd}n| jj|�\}}|dkrn|d7 }||7 }q|r�| jj|d� | j| d7 < q|| jkr| j| d8 < | j| dkr| j|= qW ||fS )Nr rN rT )� enumerater5 � load_modulerF Z
unload_module�
setdefault) r> Z_modules�enableZ
num_failedZ
error_msgs�i�moduleZstatusr� r? r? r@ �handle_modules� s(
zFirewall.handle_modulesc C s |dkrd| _ d S )Nr F)r+ )r> �backendr? r? r@ rs � s z!Firewall._select_firewall_backendc C s4 x | j � D ]}|j|kr
|S q
W ttjd| ��d S )Nz'%s' backend does not exist)� all_backendsr� r" r! Z
UNKNOWN_ERROR)r> r� r� r? r? r@ �get_backend_by_name� s
z Firewall.get_backend_by_namec C s\ | j r | jS |dkr | jr | jS |dkr4| jr4| jS |dkrH| jrH| jS tt j
d| ��d S )Nr[ r\ �ebz-'%s' is not a valid backend or is unavailable) r+ r4 r& r- r' r0 r( r2 r" r! � INVALID_IPV)r> �ipvr? r? r@ �get_backend_by_ipv� s zFirewall.get_backend_by_ipvc C sP |dkr| j r| jS |dkr(| jr(| jS |dkr<| jr<| jS ttjd| ��d S )Nr[ r\ r� z-'%s' is not a valid backend or is unavailable) r& r- r' r0 r( r2 r" r! r� )r> r� r? r? r@ �get_direct_backend_by_ipv� s z"Firewall.get_direct_backend_by_ipvc C s< |dkr| j S |dkr | jS |dkr*| jS |dkr8| jS dS )Nr, r/ r r F)r& r' r( r+ )r> r� r? r? r@ �is_backend_enabled� s zFirewall.is_backend_enabledc C s8 | j r
dS |dkr| jS |dkr&| jS |dkr4| jS dS )NTr[ r\ r� F)r+ r& r' r( )r> r� r? r? r@ �is_ipv_enabled s zFirewall.is_ipv_enabledc C sR g }| j r|j| j� n6| jr*|j| j� | jr<|j| j� | jrN|j| j� |S )N) r+ �appendr4 r& r- r' r0 r( r2 )r> �backendsr? r? r@ �enabled_backends s zFirewall.enabled_backendsc C sP g }| j r|j| j� | jr(|j| j� | jr:|j| j� | jrL|j| j� |S )N) r& r� r- r' r0 r( r2 r+ r4 )r> r� r? r? r@ r� s zFirewall.all_backendsNc C sN |d krt | �}n|}x | j� D ]}|j||j� � q W |d krJ|jd� d S )NT)r r� � add_rulesZbuild_default_tablesr� )r> rl r� r� r? r? r@ r� $ s
z Firewall.apply_default_tablesc C s� |d krt | �}n|}x(| j� D ] }|j| j�}|j||� q W | jd�r~| jd�}d|j� kr~| jr~|j | j�}|j||� | jd�r�| j
r�|j � }|j||� |d kr�|j d� d S )Nr\ �rawT)
r r� Zbuild_default_rulesrL r� r� r� rU rJ Zbuild_rpfilter_rulesrQ Zbuild_rfc3964_ipv4_rulesr� )r> rl r� r� �rulesZ ipv6_backendr? r? r@ r� 0 s"
z Firewall.apply_default_rulesc C s | j r| jj� rdS dS )NTF)r+ r9 Zhas_runtime_configuration)r> r? r? r@ � may_skip_flush_direct_backendsH s z'Firewall.may_skip_flush_direct_backendsc C s` |d krt | �}n|}x2| j� D ]&}|| j� kr2q |j� }|j||� q W |d kr\|jd� d S )NT)r r� r� �build_flush_rulesr� r� )r> rl r� r� r� r? r? r@ �flush_direct_backendsN s
z Firewall.flush_direct_backendsc C sp |d krt | �}n|}tjd� | j� s4| j|d� x$| j� D ]}|j� }|j||� q>W |d krl|jd� d S )NzFlushing rule set)rl T) r r ra r� r� r� r� r� r� )r> rl r� r� r� r? r? r@ r� ] s
zFirewall.flushc C s` |d krt | �}n|}tjd|� x&| j� D ]}|j|�}|j||� q,W |d kr\|jd� d S )NzSetting policy to '%s'T)r r ra r� Zbuild_set_policy_rulesr� r� )r> r< rl r� r� r� r? r? r@ r� o s
zFirewall.set_policyc C sB |sdS | j |�}|s&ttjd| ��| j|�s4dS |j|| j�S )NrN z'%s' is not a valid backend)r� r" r! r� r� �set_rulerL )r> � backend_name�ruler� r? r? r@ r� � s
z
Firewall.rulec C s" t td |��}| j|�}|s,ttjd| ��| j|�s:d S | js\|j s\|dkoX| j j
�rx�t |�D ]�\}}y|j || j
� W qf tk
�r } zjtjtj� � tj|� xFt|d |� �D ]2}y|j |j|�| j
� W q� tk
r� Y q�X q�W |�W Y d d }~X qfX qfW n|j|| j
� d S )Nz'%s' is not a valid backendr )�listrS r� r" r! r� r� rK r_ r2 r` r� r� rL rn r ra � traceback�
format_excrt �reversedZ reverse_ruleZ set_rules)r> r� r� Z_rulesr� r� r� r� r? r? r@ r� � s.
zFirewall.rulesc C s | j rttj��d S )N)rD r" r! Z
PANIC_MODE)r> r? r? r@ � check_panic� s zFirewall.check_panicc C s" |}|| j j� kr ttj|��|S )N)r< r� r" r! ZINVALID_POLICY)r> r< Z_policyr? r? r@ � check_policy� s zFirewall.check_policyc C s8 |}| s|dkr| j � }|| jj� kr4ttj|��|S )NrN )�get_default_zoner8 rz r" r! Z INVALID_ZONE)r> r8 �_zoner? r? r@ r~ � s zFirewall.check_zonec C s t j|�sttj|��d S )N)r ZcheckInterfacer" r! ZINVALID_INTERFACE)r> � interfacer? r? r@ �check_interface� s
zFirewall.check_interfacec C s | j j|� d S )N)r7 �
check_service)r> r7 r? r? r@ r� � s zFirewall.check_servicec C s t j|�sttj|��d S )N)r �
check_portr" r! Z INVALID_PORT)r> Zportr? r? r@ r� � s
zFirewall.check_portc C s* |st tj��|dkr&t tjd| ��d S )N�tcp�udp�sctp�dccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r� r� r� r� )r" r! ZMISSING_PROTOCOLZINVALID_PROTOCOL)r> Zprotocolr? r? r@ � check_tcpudp� s
zFirewall.check_tcpudpc C s t j|�sttj|��d S )N)r ZcheckIPr" r! � INVALID_ADDR)r> Zipr? r? r@ �check_ip� s
zFirewall.check_ipc C sP |dkr t j|�sLttj|��n,|dkr@t j|�sLttj|��n ttjd��d S )Nr[ r\ z'%s' not in {'ipv4'|'ipv6'})r Z checkIPnMaskr" r! r� Z
checkIP6nMaskr� )r> r� �sourcer? r? r@ �
check_address� s
zFirewall.check_addressc C s | j j|� d S )N)r6 �check_icmptype)r> Zicmpr? r? r@ r� � s zFirewall.check_icmptypec C s> t |t�s td|t|�f ��t|�dk r:ttjd| ��d S )Nz%s is %s, expected intr z#timeout '%d' is not positive number)�
isinstance�int� TypeError�typer" r! �
INVALID_VALUE)r> Ztimeoutr? r? r@ �
check_timeout� s
zFirewall.check_timeoutc C s` | j }| j}|sNi }x&| jj� D ]}| jj|�d ||< q W | jj� }| j� }g }x$| jj � D ]} |j
| jj | �� q^W |s�| j d� | j
� | j� d }
y| jd|d� W n& tk
r� } z
| }
W Y d d } ~ X nX |�r(xL|D ]D} | jj| j�s�x0| jj� D ]"}
|
jdk�r� q�|
j| j� � q�W q�W |�s�| j� }||k�r�||k�rRi ||< xFt|| j� �D ]2\}}|d �rd|| | || |< || |= �qdW xb| jj� D ]T}||k�r�x.|| D ]"}| jj|||| | d � �q�W ||= n tjd|� �q�W t|�d k�r6x(t|j� �D ]}tjd
|� ||= �qW ~x�|D ]�} | jj| j��r�xx| j D ]R}y| jj | j|� W n6 t k
�r� } z|j t j!k�r�|�W Y d d }~X nX �qZW n| jj"| � | jj#| j� �q>W | jj$|� t%� }|�r,x@| jj� d g D ],}x$t&|�D ]}| jj|||d � �q
W �q�W || _ | j �sD| j d
� |
�rVd| _'|
�nd| _'d S )N�
interfacesZDROPT)r� r� r � __default__�senderzNew zone '%s'.r z(Lost zone '%s', zone interfaces dropped.rN )r� r� r� r� )(rD rP r8 rz � get_settingsr9 Zget_runtime_configr� r r� r� r� r� r� r� r� rn Z query_ipsetr� r� Z set_destroyr� �items�change_zone_of_interfacer rV rw �keysZentriesZ add_entryr" r� r! �ALREADY_ENABLEDr� Z apply_ipsetZ
set_configr r rC )r> r� rD Z flush_allZ_zone_interfacesr8 Z_direct_config�_old_dzZ _ipset_objs�_nameZstart_exceptionr� r� r� Z_new_dz�iface�settingsZ interface_id�entryr� Z nm_bus_namer� r? r? r@ r� � s�
zFirewall.reloadc C s | j S )N)rC )r> r? r? r@ � get_statea s zFirewall.get_statec C sZ | j rttjd��y| jd� W n. tk
rN } zttj|��W Y d d }~X nX d| _ d S )Nzpanic mode already enabledZPANICT)rD r" r! r� r� rn �COMMAND_FAILED)r> r� r? r? r@ �enable_panic_modef s zFirewall.enable_panic_modec C sZ | j sttjd��y| jd� W n. tk
rN } zttj|��W Y d d }~X nX d| _ d S )Nzpanic mode is not enabledr� F)rD r" r! Z NOT_ENABLEDr� rn r� )r> r� r? r? r@ �disable_panic_modeq s zFirewall.disable_panic_modec C s | j S )N)rD )r> r? r? r@ �query_panic_mode| s zFirewall.query_panic_modec C s | j S )N)rL )r> r? r? r@ �get_log_denied� s zFirewall.get_log_deniedc C sb |t jkr&ttjd|djt j�f ��|| j� krR|| _| jj d|� | jj
� n ttj |��d S )Nz'%s', choose from '%s'z','rh ) r ZLOG_DENIED_VALUESr" r! r� �joinr� rL r$ �set�writeZ ALREADY_SET)r> r� r? r? r@ �set_log_denied� s
zFirewall.set_log_deniedc C s | j S )N)rE )r> r? r? r@ r� � s zFirewall.get_default_zonec C s� | j |�}|| jkr�| j}|| _| jjd|� | jj� | jj||� | jj|�}x@t|d j � �D ] \}}|d rd| jj
d|� qdW n t t j
|��d S )Nrc r� r� rN )r~ rE r$ r� r� r8 r� r� r� r� r� r" r! ZZONE_ALREADY_SET)r> r8 r� r� Z_old_dz_settingsr� r� r? r? r@ �set_default_zone� s
zFirewall.set_default_zonec C sH |j � }x:|j� D ].\}}|s(t|t�r2|||< q||kr||= qW |S )N)rq r� r� �bool)r> Z permanentZruntimer� �keyr� r? r? r@ �'combine_runtime_with_permanent_settings� s
z0Firewall.combine_runtime_with_permanent_settingsc C s i }i }x�t |j� �t |j� �B D ]�}||kr"t|| t�r�t ||krN|| ng �}tt || �| �||< t|t || �A |@ �||< q"t|| t�s�t|| t�r�|| r�|| r�d||< q�|| r�|| r�d||< q"ttjdj t
|| �|���q"W ||fS )NTFz Unhandled setting type {} key {}) r� r� r� r� r� r� r" r! ZINVALID_SETTING�formatr� )r> Z old_settingsZ new_settingsZ add_settingsZremove_settingsr� �oldr? r? r@ � get_added_and_removed_settings� s
z'Firewall.get_added_and_removed_settings)F)FF)F)N)N)N)N)N)F)4�__name__�
__module__� __qualname__rA rM r= rZ rb r� r� rv r� r� r� rs r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r? r? r? r@ r B sh
( ;
s )A�__all__Zos.pathr{ rX rq r r� Zfirewallr r Z
firewall.corer r r r r Zfirewall.core.fw_icmptyper
Zfirewall.core.fw_servicer Zfirewall.core.fw_zoner Zfirewall.core.fw_directr
Zfirewall.core.fw_configr Zfirewall.core.fw_policiesr Zfirewall.core.fw_ipsetr Z firewall.core.fw_transactionr Zfirewall.core.fw_helperr Zfirewall.core.fw_policyr Zfirewall.core.fw_nmr r Zfirewall.core.loggerr Z firewall.core.io.firewalld_confr Zfirewall.core.io.directr Zfirewall.core.io.servicer Zfirewall.core.io.icmptyper Zfirewall.core.io.zoner r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr Zfirewall.core.io.helperr Zfirewall.core.io.policyr r! Zfirewall.errorsr" �objectr r? r? r? r@ �<module> sH core/__pycache__/base.cpython-36.pyc 0000644 00000002172 15035135173 0013251 0 ustar 00 3
��g6 � @ s� d Z dZdZd0ZdddedgZddddgZd d
d d d
dd�Zddddddddddddd d d d gd d!d"d#d$d%d&dd g d'�Zd(d)d*d+d,d-d.gZd/S )1zBase firewall settingsz{chain}_{zone}ZCONTINUE� ZACCEPTz
%%REJECT%%ZDROP�defaultZREJECTZPREZPOST�INZFWDIZFWDOZOUT)Z
PREROUTINGZ POSTROUTINGZINPUTZ
FORWARD_INZ FORWARD_OUTZOUTPUTzicmp-host-prohibitedz host-prohibzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachablez port-unreachzicmp-proto-unreachablez
proto-unreachzicmp-net-prohibitedz
net-prohibz tcp-resetztcp-rstzicmp-admin-prohibitedz admin-prohibzicmp6-adm-prohibitedzadm-prohibitedzicmp6-no-routezno-routezicmp6-addr-unreachablez addr-unreachzicmp6-port-unreachable)Zipv4Zipv6zhash:ipz hash:ip,portz hash:ip,markzhash:netz
hash:net,portzhash:net,ifacezhash:macN���) �__doc__ZDEFAULT_ZONE_TARGETZDEFAULT_POLICY_TARGETZDEFAULT_POLICY_PRIORITYZ ZONE_TARGETSZPOLICY_TARGETSZ SHORTCUTSZ REJECT_TYPESZSOURCE_IPSET_TYPES� r r �/usr/lib/python3.6/base.py�<module> s. core/__pycache__/nftables.cpython-36.opt-1.pyc 0000644 00000130376 15035135173 0015104 0 ustar 00 3
��g� � % @ sl d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m
Z
m Z m Z d dl
mZmZmZmZmZmZmZ d dlmZmZmZmZmZmZm Z d dl m Z dZ e d d
Z d Z!d Z"i d
ddCe" fiddDe" fdde" fd�dd e" fdd e" fdd e" fdd e" fd�d�Z#dEdd�Z$e$ddd �e$dd�e$dd �e$dd �e$ddd �e$ddd �e$ddd �e$dd!d"�e$ddd#�e$ddd"�e$dd$d"�e$ddd%�e$dd!d �e$ddd&�e$ddd �e$dd$�e$ddd'�e$ddd(�e$ddd)�e$dd!�e$dd$d"�e$dd*�e$dd+�e$dd,�e$ddd-�e$dd.�e$dd/�e$dd0�e$dd!d'�e$ddd1�e$dd!d)�e$ddd2�e$dd.d"�e$dd.d �d3�"e$d4dd'�e$d4d$d �e$d4dd)�e$d4dd"�e$d4d�e$d4d �e$d4d �e$d4dd-�e$d4d5�e$d4d6�e$d4d7�e$d4d8�e$d4d9�e$d4d:�e$d4dd �e$d4d;�e$d4d$�e$d4dd �e$d4d<�e$d4dd&�e$d4d=�e$d4d>�e$d4d.�e$d4d.d"�e$d4d.d �e$d4d$d"�e$d4d$d)�d?�d@�Z%G dAdB� dBe&�Z'dS )F� )�absolute_importN)�log)� check_mac� getPortRange� normalizeIP6�check_single_address�
check_address)�
FirewallError�
UNKNOWN_ERROR� INVALID_RULE�INVALID_ICMPTYPE� INVALID_TYPE�
INVALID_ENTRY� INVALID_PORT)� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock)�NftablesZ firewalld�_Z policy_dropZpolicy_�
�
PREROUTING�
prerouting� �d Z postrouting)r � POSTROUTING�input�forward�output)r �INPUT�FORWARD�OUTPUT)�raw�mangle�nat�filterc C sH dd| dd�id|d�ig}|d k rD|j dd| dd�id|d�i� |S )N�match�payload�type)�protocol�fieldz==)�left�op�right�code)�append)r, r+ r1 � fragments� r4 � /usr/lib/python3.6/nftables.py�_icmp_types_fragmentsS s r6 �icmpzdestination-unreachable�
z
echo-replyz echo-request� � �redirect� � zparameter-problem� � � � � zrouter-advertisementzrouter-solicitationz
source-quench� z
time-exceededztimestamp-replyztimestamp-request� � )"zcommunication-prohibitedzdestination-unreachablez
echo-replyz echo-requestzfragmentation-neededzhost-precedence-violationzhost-prohibitedz
host-redirectz host-unknownzhost-unreachablez
ip-header-badznetwork-prohibitedznetwork-redirectznetwork-unknownznetwork-unreachablezparameter-problemzport-unreachablezprecedence-cutoffzprotocol-unreachabler; zrequired-option-missingzrouter-advertisementzrouter-solicitationz
source-quenchzsource-route-failedz
time-exceededztimestamp-replyztimestamp-requestztos-host-redirectztos-host-unreachableztos-network-redirectztos-network-unreachablezttl-zero-during-reassemblyzttl-zero-during-transit�icmpv6zmld-listener-donezmld-listener-queryzmld-listener-reportzmld2-listener-reportznd-neighbor-advertznd-neighbor-solicitzpacket-too-bigz nd-redirectznd-router-advertznd-router-solicit)zaddress-unreachablez
bad-headerz beyond-scopezcommunication-prohibitedzdestination-unreachablez
echo-replyz echo-requestz
failed-policyzmld-listener-donezmld-listener-queryzmld-listener-reportzmld2-listener-reportzneighbour-advertisementzneighbour-solicitationzno-routezpacket-too-bigzparameter-problemzport-unreachabler; z reject-routezrouter-advertisementzrouter-solicitationz
time-exceededzttl-zero-during-reassemblyzttl-zero-during-transitzunknown-header-typezunknown-option)�ipv4�ipv6c @ s` e Zd Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Z d d
� Z
dd� Z d�dd�Z dd� Z
dd� Zdd� Zdd� Zd�dd �Zd d � Zd�d d!�Zd"d#� Zd�d%d&�Zd�d(d)�Zd�d*d+�Zd�d,d-�Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&d�dJdK�Z'dLdM� Z(dNdO� Z)dPdQ� Z*dRdS� Z+d�dTdU�Z,d�dVdW�Z-d�dXdY�Z.dZd[� Z/d�d\d]�Z0d�d^d_�Z1d�d`da�Z2d�dbdc�Z3d�ddde�Z4dfdg� Z5d�dhdi�Z6djdk� Z7d�dldm�Z8dndo� Z9dpdq� Z:drds� Z;dtdu� Z<d�dvdw�Z=d�dxdy�Z>dzd{� Z?d�d|d}�Z@d~d� ZAd�d�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�d��ZHdS )��nftablesTc C sb || _ d| _g | _i | _i | _i | _i | _i | _g g g d�| _t � | _
| j
j d� | j
j d� d S )NT)�inet�ip�ip6)
�_fwZrestore_command_existsZavailable_tables�rule_to_handle�rule_ref_count�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache�created_tablesr rI Zset_echo_outputZset_handle_output)�self�fwr4 r4 r5 �__init__� s znftables.__init__c C s� xdD ]}||krP qW d|| d kr`|| d d d || d d d f}|| d d= n(d|| d kr�d }|| d d= nd S || d d }|r�|dkr�||kr�||| kr�|| j |� n�|dk�r�||kr�g ||< |�r(||| k�r|| j|� || jd
d � d � || j|�}n | jj�r8d
}n t|| �}|| }||= |d
k�rf||d< n |d8 }||d< ||d d d< d S )N�add�insert�deletez%%ZONE_SOURCE%%�rule�zone�addressz%%ZONE_INTERFACE%%�familyc S s | d S )Nr r4 )�xr4 r4 r5 �<lambda>� s z3nftables._run_replace_zone_source.<locals>.<lambda>)�keyr r< �index)rW rX rY )�remover2 �sortra rM �_allow_zone_drifting�len)rT rZ rR �verbZ zone_sourcer] ra �
_verb_snippetr4 r4 r5 �_run_replace_zone_source� sD
z!nftables._run_replace_zone_sourcec C sB d|krdt j|d �iS d|kr4dt j|d �iS ttd��d S )NrX rY rW zFailed to reverse rule)�copy�deepcopyr r
)rT �dictr4 r4 r5 � reverse_rule� s
znftables.reverse_rulec
C s� xd D ]}||krP qW ||| d k�r�|| d | }|| d |= t |�tkr^ttd��|| d d || d d f}|dkr�||ks�||| ks�|| | dkr�ttd ��|| | d
8 < n�||kr�i ||< ||| kr�d|| |< d}xVt|| j� �D ]B}||k�r"|dk�r"P ||| | 7 }||k�r|dk�rP �qW || | d
7 < || } ||= |dk�r�| |d< n |d
8 }| |d< ||d d d < d S )
NrW rX rY rZ z%priority must be followed by a numberr] �chainr z*nonexistent or underflow of priority countr< ra )rW rX rY )r+ �intr r r
�sorted�keys)
rT rZ Zpriority_counts�tokenrf �priorityrm ra �prg r4 r4 r5 �_set_rule_replace_priority� sD
z#nftables._set_rule_replace_priorityc C sf x`d
D ]X}||krd|| krt j|| d �}xd D ]}||kr6||= q6W tj|dd �}|S qW d S ) NrW rX rY rZ ra �handle�positionT)Z sort_keys)rW rX rY )ra ru rv )ri rj �json�dumps)rT rZ rf �rule_keyZnon_keyr4 r4 r5 �
_get_rule_key s
znftables._get_rule_keyc C sL dddddg}dddg}g }g }t j| j�}t j| j�}t j| j�} | jj � }
�x�|D �]�} t| �tkrvtt d| ��x|D ]} | | kr|P q|W | | kr�tt
d| ��| j | �}
|
|
k�rDt j
d| j|
|
|
� | dkr�|
|
d 7 < qVnX|
|
d k�r |
|
d 8 < qVn6|
|
d k�r,|
|
d 8 < ntt d
|
|
|
f ��n|
�r\| dk�r\d |
|
< |j| � t j| �}|
�rttd || d d ��|| d d < | j||d
� | j||d� | j|| � | dk�rdd |d d d |d d d |d d d | j|
d�ii}|j|� qVW dddd iig| i}t j� dk�rVt jd| jtj|�� | jj|�\}}}|dk�r�tdd|tj|�f ��|| _|| _| | _|
| _d}x�|D ]�} |d 7 }| j | �}
|
�s̐q�d| k�r�| j|
= | j|
= �q�x"|D ]} | |d | k�r�P �q�W | |d | k�r$�q�|d | | d d | j|
< �q�W d S ) NrW rX rY �flush�replacez#rule must be a dictionary, rule: %sz no valid verb found, rule: %sz %s: prev rule ref cnt %d, %sr< z)rule ref count bug: rule_key '%s', cnt %drZ �exprz%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%r] �tablerm )r] r~ rm ru rI ZmetainfoZjson_schema_versionr@ z.%s: calling python-nftables with JSON blob: %sr z '%s' failed: %s
JSON blob:
%szpython-nftablesru ) ri rj rP rQ rR rO r+ rk r r
r rz r Zdebug2� __class__r2 �listr( rt rh rN ZgetDebugLogLevelZdebug3rw rx rI Zjson_cmd�
ValueError)rT �rules�
log_deniedZ _valid_verbsZ_valid_add_verbsZ_deduplicated_rulesZ_executed_rulesrP rQ rR rO rZ rf ry Z_ruleZ json_blobZrcr! �errorra r4 r4 r5 � set_rules+ s�
&
znftables.set_rulesc C s | j |g|� dS )N� )r� )rT rZ r� r4 r4 r5 �set_rule� s znftables.set_ruleNc C s |r
|gS t j� S )N)�IPTABLES_TO_NFT_HOOKrp )rT r~ r4 r4 r5 �get_available_tables� s z nftables.get_available_tablesc C sF g }x<dD ]4}|j dd||d�ii� |j dd||d�ii� q
W |S ) NrJ rK rL rW r~ )r] �namerY )rJ rK rL )r2 )rT r~ r� r] r4 r4 r5 �_build_delete_table_rules� s
z"nftables._build_delete_table_rulesc C s� i }i }xB| j d�D ]4}| j|�}|| jkr| j| ||< | j| ||< qW || _|| _i | _i | _i | _x*dD ]"}t| j| krp| j| j t� qpW | j
t�S )NTrJ rK rL )rJ rK rL ) � _build_set_policy_rules_ct_rulesrz rN rO rP rQ rR �
TABLE_NAMErS rb r� )rT Zsaved_rule_to_handleZsaved_rule_ref_countrZ �
policy_keyr] r4 r4 r5 �build_flush_rules� s
znftables.build_flush_rulesc
C sl ddd�| }g }xTdD ]L}|j |ddtd d
|f d d d
diiddddgid�idd igd�ii� qW |S )NrW rY )TFr r r! rZ rJ z%s_%sr( r) �ctr` �state�in�set� established�related)r. r/ r0 �accept)r] r~ rm r} )r r r! )r2 �TABLE_NAME_POLICY)rT �enable�add_delr� �hookr4 r4 r5 r� � s
z)nftables._build_set_policy_rules_ct_rulesc C st g }|dkrt|j dddtd�ii� | jd j t� x>dD ]6}|j dddtd d
|f d |dt d
dd�ii� q:W |dk� r�|j dddtd�ii� | jd j t� x>dD ]6}|j dddtd d |f d |dt d
dd�ii� q�W || jd�7 }nz|dk�rfx4| jd�D ]&}| j|�}|| jk�r |j |� �q W || jt�7 }t| jd k�rp| jd jt� n
t t
d� |S )NZPANICrW r~ rJ )r] r� r r! rm z%s_%sr% r( i, r< �drop)r] r~ r� r+ r� �prio�policy�DROPr r r T�ACCEPTFznot implemented)r r! i���)r r r! ) r2 r� rS �NFT_HOOK_OFFSETr� rz rN r� rb r r
)rT r� r� r� rZ r� r4 r4 r5 �build_set_policy_rules� sH
z nftables.build_set_policy_rulesc C s< t � }x,|r|gntj� D ]}|jt| j� � qW t|�S )N)r� �ICMP_TYPES_FRAGMENTSrp �updater� )rT �ipvZ supportedZ_ipvr4 r4 r5 �supported_icmp_types� s z nftables.supported_icmp_typesc C s> g }x4dD ],}|j dd|td�ii� | j| j t� q
W |S )NrJ rK rL rW r~ )r] r� )rJ rK rL )r2 r� rS )rT Zdefault_tablesr] r4 r4 r5 �build_default_tables s
z nftables.build_default_tables�offc C s� g }x�t d j� D ]�}|jdddtd| ddt d | d t d | d d
�ii� xz| jjrld d d
dgnd d
dgD ]X}|jdddtd||f d�ii� |jdddtd| ddd||f iigd�ii� qvW qW x�d?D ]�}x�t d j� D ]�}|jdd|td| ddt d | d t d | d d
�ii� x~| jj�rJd d d
dgnd d
dgD ]Z}|jdd|td||f d�ii� |jdd|td| ddd||f iigd�ii� �qTW q�W q�W xVt d j� D ]F}|jdddtd| ddt d | d t d | d d
�ii� �q�W |jdddtdd d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtdd d d d d&iid d'd$�id%d igd�ii� |jdddtdd d d(d d)iid*d+d$�id%d igd�ii� x~| jj�r�d d d
dgnd d
dgD ]Z}|jdddtd,d|f d�ii� |jdddtdd ddd,d|f iigd�ii� �q�W |d-k�r�|jdddtdd d d d d iid d!d.gid$�i| j|�d/d0d1iigd�ii� |jdddtdd d d d d iid d!d.gid$�id2d igd�ii� |d-k�r$|jdddtdd | j|�d/d0d3iigd�ii� |jdddtdd d4d5d6d7�igd�ii� |jdddtdd8 d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtdd8 d d d d&iid d'd$�id%d igd�ii� |jdddtdd8 d d(d d)iid*d+d$�id%d igd�ii� xbd@D ]Z}|jdddtd,d8|f d�ii� |jdddtdd8 ddd,d8|f iigd�ii� �qW x�dAD ]�}xz| jj�r�d d
gnd
gD ]^}|jdddtd;d8||f d�ii� |jdddtdd8 ddd;d8||f iigd�ii� �q�W �qvW xbdBD ]Z}|jdddtd,d8|f d�ii� |jdddtdd8 ddd,d8|f iigd�ii� �qW |d-k�r�|jdddtdd8 d d d d iid d!d.gid$�i| j|�d/d0d1iigd�ii� |jdddtdd8 d d d d iid d!d.gid$�id2d igd�ii� |d-k�r6|jdddtdd8 | j|�d/d0d3iigd�ii� |jdddtdd8 d4d5d6d7�igd�ii� |jdddtdd< d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtd=d d(d d>iid*d+d$�id%d igd�ii� xbdCD ]Z}|jdddtd,d<|f d�ii� |jdddtdd< ddd,d<|f iigd�ii� �q�W xbdDD ]Z}|jdddtd,d<|f d�ii� |jdddtdd< ddd,d<|f iigd�ii� �qHW |S )ENr& rW rm rJ z mangle_%sr( z%sr r< )r] r~ r� r+ r� r� � POLICIES_preZ ZONES_SOURCEZZONES�
POLICIES_postz mangle_%s_%s)r] r~ r� rZ �jump�target)r] r~ rm r} rK rL r' znat_%sz nat_%s_%sz filter_%sr" r) r� r` r� r� r� r� r� )r. r/ r0 r� Zstatus�dnat�meta�iifnamez==�loz filter_%s_%sr� Zinvalidr �prefixzSTATE_INVALID_DROP: r� zFINAL_REJECT: �reject�icmpxzadmin-prohibited)r+ r} r# �IN�OUTzfilter_%s_%s_%sr$ �
filter_OUTPUT�oifname)rK rL )r� )r� r� )r� )r� )r� )r� rp r2 r� rM rd �_pkttype_match_fragment)rT r� Z
default_rulesrm Zdispatch_suffixr] � directionr4 r4 r5 �build_default_rules s�
$
(
&
.
&
&
&
.
&
&
&z nftables.build_default_rulesc C s4 |dkrdddgS |dkr dgS |dkr0ddgS g S ) Nr( r" �
FORWARD_IN� FORWARD_OUTr& r r' r r4 )rT r~ r4 r4 r5 �get_zone_table_chains� s
z nftables.get_zone_table_chainsrJ c
s� �dkr\�dkr\g }
|
j �j�|��||||dd� � |
j �j�|��||||dd� � |
S �jjj|���jdk rxdnd��dkr��d kr�d
nd } �jjj|�t| �� g } g }
|r�| jd d
ddiiddt |�id�i� |�r|
jd d
ddiiddt |�id�i� ddd�}|�rlxT|D ]L}�dk�rT�jj
j |�}||k�rT�|| k�rT�q | j�j d|�� �q W |�r�xT|D ]L}�dk�r��jj
j |�}||k�r��|| k�r��qx|
j�j d|�� �qxW � �������fdd�}g }
| �rHx�| D ]P}|
�r xB|
D ]}|
j|||�� �qW n"�dk�r0|�r0n|
j||d �� �q�W n\�dk�rZ|�rZnJ|
�r�xB|
D ]}|
j|d |�� �qfW n"�dk�r�|�r�n|
j|d d �� |
S )Nr' rJ rK )r] rL r �pre�postr TFr) r� r` r� z==r� )r. r/ r0 r� )rG rH �saddr�daddrc s� g }| r|j | � |r |j |� |j ddd�� f ii� �td���f |d�}|j�j��� �rrdd|iiS dd|iiS d S ) Nr� r� z%s_%sz%s_%s_POLICIES_%s)r] r~ rm r} rW rZ rY )r2 r� r� �_policy_priority_fragment)�ingress_fragment�egress_fragment�expr_fragmentsrZ )�_policyrm � chain_suffixr� r] �p_objrT r~ r4 r5 � _generate_policy_dispatch_rule s
zRnftables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule)
�extend�!build_policy_ingress_egress_rulesrM r� Z
get_policyrr �policy_base_chain_name�POLICY_CHAIN_PREFIXr2 r� r[ Z check_source�_rule_addr_fragment)rT r� r� r~ rm Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesr] r� �isSNATZingress_fragmentsZegress_fragmentsZ
ipv_to_family�srcr� �dstr� r� r� r4 )r� rm r� r� r] r� rT r~ r5 r� � sv
z*nftables.build_policy_ingress_egress_rulesFc
C s� |dkrT|dkrTg } | j | j|||||||d�� | j | j|||||||d�� | S |dkrh|dkrhdnd}
| jjj||t|
d�} d d
d d d
d
d �| } |t|�d d
kr�|d t|�d � d }d}
|dkr�|
dd|| f iig}n,ddd| iid|d�i|
dd|| f iig}|�rL| �rLd}|td||f |d�}|j| j � � nP|�rnd}|td||f |d�}n.d}|td||f |d�}|�s�|j| j � � |d |iigS ) Nr' rJ rK rL r TF)r� r� r� )r r r" r� r� r$ r< �+�*�gotor� z%s_%sr) r� r` z==)r. r/ r0 rX z %s_%s_ZONES)r] r~ rm r} rW rY rZ )
r� �!build_zone_source_interface_rulesrM r� r� r� re r� r� �_zone_interface_fragment)rT r� r[ r� � interfacer~ rm r2 r] r� r� r� �opt�actionr� rf rZ r4 r4 r5 r� Q s\
z*nftables.build_zone_source_interface_rulesc C sn |dkr�|dkr�g }|j d�r6| j|td�d � �} nd } td|�sTt|�sT| dkrp|j| j||||||d�� td|�s�t|�s�| dkr�|j| j||||||d�� |S |dkr�|dkr�d nd
}
| jjj ||t
|
d �} d d
d�| } ddddddd�| }
| jj �rd||f }n d||f }d}|t || j
|
|�|dd|| f iigd�}|j| j||�� | d|iigS )Nr' rJ zipset:rG rK rH rL r TF)r� rX rY )TFr� r� )r r r" r� r� r$ z%s_%s_ZONES_SOURCEz %s_%s_ZONESr� r� z%s_%s)r] r~ rm r} rZ )�
startswith�_set_get_familyre r r r� � build_zone_source_address_rulesrM r� r� r� rd r� r� r� �_zone_source_fragment)rT r� r[ r� r\ r~ rm r] r� Z ipset_familyr� r� r� r� Zzone_dispatch_chainr� rZ r4 r4 r5 r� � sB
z(nftables.build_zone_source_address_rulesc
C s |dkrH|dkrHg }|j | j||||d�� |j | j||||d�� |S ddd�| }|dkrj|dkrjd nd
}| jjj||t|d �} g }|j|d |td
|| f d�ii� x0d!D ](}
|j|d |td|| |
f d�ii� q�W xDd"D ]<}
|j|d|td
|| f ddd|| |
f iigd�ii� q�W | jjj| j } | jj
� dk�r�|dk�r�| d#k�r�| } | d k�rhd} |j|d|td
|| f | j | jj
� �dd d | | f iigd�ii� |dk�r| d$k�r| d%k�r�| j � }
n | j
� d i}
|j|d|td
|| f |
gd�ii� |�s|j� |S )&Nr' rJ rK rL rW rY )TFr TF)r� rm z%s_%s)r] r~ r� r� r �deny�allowr� z%s_%s_%srZ r� r� )r] r~ rm r} r� r( �REJECT�
%%REJECT%%r� r� z"filter_%s_%s: "r� )r� r r� r� r� )r� r r� r� r� )r� r� r� )r� r� r� r� )r� r� )r� �build_policy_chain_rulesrM r� r� r� r2 r� Z _policiesr� �get_log_deniedr� �_reject_fragment�lower�reverse)rT r� r� r~ rm r] r� r� r� r� r� r� Z
log_suffix�target_fragmentr4 r4 r5 r� � sZ
&
z!nftables.build_policy_chain_rulesc C s< |dkr i S |d kr,ddddiid |d
�iS t td |��d S )
N�all�unicast� broadcast� multicastr) r� r` �pkttypez==)r. r/ r0 zInvalid pkttype "%s")r� r� r� )r r )rT r� r4 r4 r5 r� � s
z nftables._pkttype_match_fragmentc C s dddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�iddd d�iddd d�iddd
d�iddd
d�idd d
d�iddd d�iddd d�iddd
d�iddd
d�idddd�idddd�idddiidddiid�}|| S )Nr� r7 zhost-prohibited)r+ r} znet-prohibitedzadmin-prohibitedrF znet-unreachablezhost-unreachablezport-unreachabler� zprot-unreachablezaddr-unreachablezno-router+ z tcp reset)zicmp-host-prohibitedz host-prohibzicmp-net-prohibitedz
net-prohibzicmp-admin-prohibitedz admin-prohibzicmp6-adm-prohibitedzadm-prohibitedzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachablezicmp6-port-unreachablez port-unreachzicmp-proto-unreachablez
proto-unreachzicmp6-addr-unreachablez addr-unreachzicmp6-no-routezno-routez tcp-resetztcp-rstr4 )rT Z reject_typeZfragsr4 r4 r5 �_reject_types_fragment� s0
z nftables._reject_types_fragmentc C s dddd�iS )Nr� r� zadmin-prohibited)r+ r} r4 )rT r4 r4 r5 r� s znftables._reject_fragmentc C s ddddiiddddgid �iS )
Nr) r� r` �l4protoz==r� r7 rF )r. r/ r0 r4 )rT r4 r4 r5 �_icmp_match_fragment" s z nftables._icmp_match_fragmentc C sP |si S ddddd�}|j � \}}||| d�}|j� }|d k rH||d< d|iS ) N�secondZminuteZhourZday)�s�m�h�d)�rateZper�burst�limit)Z value_parseZ burst_parse)rT r� Z rich_to_nftr� Zdurationr� r� r4 r4 r5 �_rich_rule_limit_fragment' s z"nftables._rich_rule_limit_fragmentc C s� t |j�tttgkrn<|jrHt |j�tttt gkrRt
t dt |j� ��n
t
t d��|j dkr�t |j�ttgks�t |j�tt gkr�dS t |j�tgks�t |j�ttgkr�dS n|j dk r�dS dS d S )NzUnknown action %szNo rule action specified.r r� r� r� r� )
r+ �elementr r r r� r r r r r r rr )rT � rich_ruler4 r4 r5 �_rich_rule_chain_suffix? s
z nftables._rich_rule_chain_suffixc C s> |j r|j rttd��|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r� r� )r �auditr r rr )rT r� r4 r4 r5 � _rich_rule_chain_suffix_from_logU s
z)nftables._rich_rule_chain_suffix_from_logc C s dd iS )Nz%%ZONE_INTERFACE%%r4 )rT r4 r4 r5 r� ` s z!nftables._zone_interface_fragmentc C sN t d|�rt|�}n,td|�r@|jd�}t|d �d |d }d||d�iS )NrH �/r r< z%%ZONE_SOURCE%%)r[ r\ )r r r �split)rT r[ r\ Z
addr_splitr4 r4 r5 r� c s
z nftables._zone_source_fragmentc C s
d|j iS )Nz%%POLICY_PRIORITY%%)rr )rT r� r4 r4 r5 r� k s z"nftables._policy_priority_fragmentc C s | s|j dkri S d|j iS )Nr z%%RICH_RULE_PRIORITY%%)rr )rT r� r4 r4 r5 � _rich_rule_priority_fragmentn s z%nftables._rich_rule_priority_fragmentc C s� |j s
i S | jjj||t�}ddd�| }| j|�}i } |j jrPd|j j | d< |j jr|d|j jkrhdn|j j}
d|
| d< d td
|||f || j |j j
�d | ig d �} | j | j |�� |d
| iiS )NrW rY )TFz%sr� Zwarning�warn�levelrJ z%s_%s_%sr )r] r~ rm r} rZ )
r rM r� r� r� r� r� r r� r� r� r� r� ) rT r� r� r� r~ r� r� r� r� Z log_optionsr rZ r4 r4 r5 �_rich_rule_logs s&
znftables._rich_rule_logc
C s� |j s
i S | jjj||t�}ddd�| }| j|�}dtd|||f || j|j j�dddiig d �} | j | j
|�� |d
| iiS ) NrW rY )TFrJ z%s_%s_%sr r r� )r] r~ rm r} rZ ) r� rM r� r� r� r� r� r� r� r� r� )
rT r� r� r� r~ r� r� r� r� rZ r4 r4 r5 �_rich_rule_audit� s
znftables._rich_rule_auditc
C s� |j s
i S | jjj||t�}ddd�| }| j|�}d|||f } t|j �tkr\dd i}
�n t|j �tkr�|j jr�| j |j j�}
ndd i}
n�t|j �t
kr�dd i}
n�t|j �t k�rHd}| jjj||t�}d|||f } |j j j
d �} t| �d
k�r,dd d d
iiddd d d
ii| d
gi| d gid�i}
ndd d d
ii| d d�i}
nttdt|j � ��dt| || j|j j�|
g d�} | j| j|�� |d| iiS )NrW rY )TFz%s_%s_%sr� r� r� r& r� r< r� r` �mark�^�&r )r` �valuezUnknown action %srJ )r] r~ rm r} rZ )r� rM r� r� r� r� r+ r r r� r r r� r� re r r r� r� r� r� r� )
rT r� r� r� r~ r� r� r� r� rm Z rule_actionr rZ r4 r4 r5 �_rich_rule_action� sB
, znftables._rich_rule_actionc C s� |j d�r0| j|td�d � d|kr(dnd|�S t|�r>d}n�td|�rNd}nvtd|�r�d}tj|dd�}d |jj |j
d
�i}nDtd |�r�d }t |�}n,d }|j d
�}d t |d �t
|d �d
�i}dd||d�i|r�dnd|d�iS d S )Nzipset:r� TF�etherrG rK )�strictr� )�addrre rH rL r� r r< r) r* )r, r- z!=z==)r. r/ r0 )r� �_set_match_fragmentre r r r � ipaddressZ IPv4NetworkZnetwork_addressZ
compressedZ prefixlenr r� rn )rT Z
addr_fieldr\ �invertr] Znormalized_addressZaddr_lenr4 r4 r5 r� � s(
&
z nftables._rule_addr_fragmentc C s6 |si S |d
kr t td| ��ddddiid|d �iS ) NrG rH zInvalid familyr) r� r` �nfprotoz==)r. r/ r0 )rG rH )r r )rT Z rich_familyr4 r4 r5 �_rich_rule_family_fragment� s
z#nftables._rich_rule_family_fragmentc C s8 |si S |j r|j }n|jr&d|j }| jd||jd�S )Nzipset:r� )r )r �ipsetr� r )rT Z rich_destr\ r4 r4 r5 � _rich_rule_destination_fragment� s
z(nftables._rich_rule_destination_fragmentc C sZ |si S |j r|j }n2t|d�r.|jr.|j}nt|d�rH|jrHd|j }| jd||jd�S )N�macr zipset:r� )r )r �hasattrr r r� r )rT Z rich_sourcer\ r4 r4 r5 �_rich_rule_source_fragment� s
z#nftables._rich_rule_source_fragmentc C sP t |�}t|t�r$|dk r$tt��n(t|�dkr8|d S d|d |d giS d S )Nr r< �range)r �
isinstancern r r re )rT �portr r4 r4 r5 �_port_fragment s
znftables._port_fragmentc C sb ddd�| }d}| j jj||t�} g }
|r>|
j| j|j�� |rT|
j| jd|�� |r||
j| j|j �� |
j| j
|j �� |
jdd|dd �id
| j |�d �i� | s�t
|j�tkr�|
jdd d
diiddddgid �i� g } |�r0| j| j|||||
�� | j| j|||||
�� | j| j|||||
�� n.| j|ddtd|| f |
dd ig d�ii� | S )NrW rY )TFr( r� r) r* �dport)r, r- z==)r. r/ r0 r� r` r� r� r� �new� untrackedrZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r � destinationr �sourcer r+ r� r r r r r� ) rT r� r� �protor r r� r� r~ r� r� r� r4 r4 r5 �build_policy_ports_rules s:
z!nftables.build_policy_ports_rulesc C sZ ddd�| }d}| j jj||t�}g } |r>| j| j|j�� |rT| j| jd|�� |r|| j| j|j �� | j| j
|j �� | jdddd iid
|d �i� | s�t |j
�tkr�| jdd dd
iiddddgid �i� g }
|�r(|
j| j||||| �� |
j| j||||| �� |
j| j||||| �� n.|
j|ddtd||f | dd ig d�ii� |
S )NrW rY )TFr( r� r) r� r` r� z==)r. r/ r0 r� r� r� r� r r rZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r r r r r+ r� r r r r r� ) rT r� r� r, r r� r� r~ r� r� r� r4 r4 r5 �build_policy_protocol_rules2 s8
z$nftables.build_policy_protocol_rulesc C sb ddd�| }d}| j jj||t�} g }
|r>|
j| j|j�� |rT|
j| jd|�� |r||
j| j|j �� |
j| j
|j �� |
jdd|dd �id
| j |�d �i� | s�t
|j�tkr�|
jdd d
diiddddgid �i� g } |�r0| j| j|||||
�� | j| j|||||
�� | j| j|||||
�� n.| j|ddtd|| f |
dd ig d�ii� | S )NrW rY )TFr( r� r) r* �sport)r, r- z==)r. r/ r0 r� r` r� r� r� r r rZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r r r r r r+ r� r r r r r� ) rT r� r� r r r r� r� r~ r� r� r� r4 r4 r5 � build_policy_source_ports_rulesU s:
z(nftables.build_policy_source_ports_rulesc
C s� d}| j jj||t�} ddd�| }
g } |rR| jdddtd||f ||d�ii� g } |rl| j| jd |�� | jd
d |d d
�id| j|�d�i� | jdd||f i� | j|
ddtd| | d�ii� | S )Nr( rW rY )TFz ct helperrJ z helper-%s-%s)r] r~ r� r+ r, r� r) r* r )r, r- z==)r. r/ r0 rZ zfilter_%s_allow)r] r~ rm r} )rM r� r� r� r2 r� r� r )
rT r� r� r r r Z helper_nameZmodule_short_namer~ r� r� r� r� r4 r4 r5 � build_policy_helper_ports_rulesz s.
z(nftables.build_policy_helper_ports_rulesc C s� ddd�| }| j jj||t�}g } |rv|t|�d dkrT|d t|�d � d }ddd d
iid |d �id
d ig}
n| jd|�d
d ig}
dtd| |
d�} | j|d| ii� | S )NrW rY )TFr< r� r� r) r� r` r� z==)r. r/ r0 r� r� rJ zfilter_%s_allow)r] r~ rm r} rZ )rM r� r� r� re r� r� r2 ) rT r� r[ r� r~ r� r r� r� r� r} rZ r4 r4 r5 �build_zone_forward_rules� s" z!nftables.build_zone_forward_rulesc C s� d}| j jj||tdd�}ddd�| }g }|r`|j| j|j�� |j| j|j�� | j |�} nd} |t
d|| f |d d
d d iid
dd�idd ig d�}
|
j | j |�� |d|
iigS )Nr' T)r� rW rY )TFr� z nat_%s_%sr) r� r` r� z!=r� )r. r/ r0 Z
masquerade)r] r~ rm r} rZ )
rM r� r� r� r2 r r r r r� r� r� r� ) rT r� r� r] r� r~ r� r� r� r� rZ r4 r4 r5 �"_build_policy_masquerade_nat_rules� s&
z+nftables._build_policy_masquerade_nat_rulesc
C s^ g }|rD|j r|j dks,|jrDtd|jj�rD|j| j||d|�� nV|r�|j rX|j dksl|jr�td|jj�r�|j| j||d|�� n|j| j||d|�� d}| jjj||t �}ddd�| }g }|r�|j
| j |j �� |j
| j
|j�� | j|�} nd } d
td || f |d d
ddiiddddgid�idd ig d�}
|
j| j|�� |j
|d|
ii� |S )NrH rL rG rK r( rW rY )TFr� rJ z filter_%s_%sr) r� r` r� r� r� r r )r. r/ r0 r� )r] r~ rm r} rZ )r] r r r r� r& rM r� r� r� r2 r r r r� r� r� r� ) rT r� r� r� r� r~ r� r� r� r� rZ r4 r4 r5 � build_policy_masquerade_rules� s8
z&nftables.build_policy_masquerade_rulesc C s$ d} | j jj|| t�}
ddd�| } g } |r\| j| j|j�� | j| j|j�� | j |�}
nd}
| jdd|dd �id
| j
|�d �i� |r�t d |�r�t |�}|r�|d
kr�| jd|| j
|�d�i� q�| jdd|ii� n| jdd| j
|�ii� |t
d|
|
f | d�}|j| j|�� | d|iigS )Nr' rW rY )TFr� r) r* r )r, r- z==)r. r/ r0 rH r� r� )r r r r; r z nat_%s_%s)r] r~ rm r} rZ )rM r� r� r� r2 r r r r r� r r r r� r� r� )rT r� r� r r, �toaddr�toportr] r� r~ r� r� r� r� rZ r4 r4 r5 �$_build_policy_forward_port_nat_rules� s4
z-nftables._build_policy_forward_port_nat_rulesc
C s� g }|rF|j r|j dks&|rFtd|�rF|j| j||||||d|�� n�|r�|j rZ|j dksh|r�td|�r�|j| j||||||d|�� nL|r�td|�r�|j| j||||||d|�� n |j| j||||||d|�� |S )NrH rL rG rK )r] r r� r* ) rT r� r� r r, r) r( r� r� r4 r4 r5 � build_policy_forward_port_rules s z(nftables.build_policy_forward_port_rulesc C s2 |t | krt | | S ttd|| j|f ��d S )Nz)ICMP type '%s' not supported by %s for %s)r� r r r� )rT r� Z icmp_typer4 r4 r5 � _icmp_types_to_nft_fragments( s z%nftables._icmp_types_to_nft_fragmentsc C sB d}| j jj||t�}ddd�| }|r6|jr6|j}n<|jrjg }d|jkrT|jd� d|jkrr|jd� nddg}g } �x�|D �]�}
| j jj|�r�d||f } dd i} nd ||f } | j� } g }
|r�|
j| j |j
�� |
j| j |j�� |
j| j |j
�� |
j| j|
|j�� |�r�| j| j|||||
�� | j| j|||||
�� |j�rf| j| j|||||
�� nN| j|�}d
td |||f |
| j� g d �}|j| j|�� | j|d
|ii� q~| j j� dk�r| j jj|� �r| j|d
d
t| |
| j| j j� �ddd||f iig d �ii� | j|d
d
t| |
| g d �ii� q~W | S )Nr( rW rY )TFrG rH z %s_%s_allowr� z
%s_%s_denyrJ z%s_%s_%s)r] r~ rm r} rZ r� r r� z"%s_%s_ICMP_BLOCK: ")rM r� r� r� �ipvsr r2 �query_icmp_block_inversionr� r r] r r r r� r, r� r r r� r r� r� r� r� r� r� )rT r� r� Zictr� r~ r� r� r- r� r� Z final_chainr� r� r� rZ r4 r4 r5 � build_policy_icmp_block_rules/ sb
"
"
z&nftables.build_policy_icmp_block_rulesc C s� d}| j jj||t�}g }ddd�| }| j jj|�r@| j� }ndd i}|j|ddtd||f d | j� |gd
�ii� | j j � d kr�| j jj|�r�|j|ddtd||f d | j� | j
| j j � �d d
d||f iigd
�ii� |S )Nr( rW rY )TFr� rZ rJ z%s_%sr9 )r] r~ rm ra r} r� r r� z%s_%s_ICMP_BLOCK: ) rM r� r� r� r. r� r2 r� r� r� r� )rT r� r� r~ r� r� r� r� r4 r4 r5 �'build_policy_icmp_block_inversion_rulesk s,
z0nftables.build_policy_icmp_block_inversion_rulesc C s� g }ddddiiddd�iddd d
d gd d
�iddd�ig}|dkrV|j dddii� |j dd i� |j dddtd|d�ii� |j dddtdddddd �idd d d gid�id d igd�ii� |S )!Nr) r� r` r z==rH )r. r/ r0 Zfibr� Ziifr Zoif)�flags�resultFr� r r� zrpfilter_DROP: r� rX rZ rJ Zfilter_PREROUTING)r] r~ rm r} r* rF r+ )r, r- r� znd-router-advertznd-neighbor-solicitr� )r2 r� )rT r� r� r� r4 r4 r5 �build_rpfilter_rules� s0
z nftables.build_rpfilter_rulesc C s� ddddddddd g }d
d � |D �}d d
ddd�idd|id�ig}| j jd"krb|jdddii� |j| jd�� g }|jddd td d |d �ii� |jddd td d!|d �ii� |S )#Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19c S s2 g | ]*}d |j d�d t|j d�d �d�i�qS )r� r� r r< )r re )r� rn )�.0r^ r4 r4 r5 �
<listcomp>� s z5nftables.build_rfc3964_ipv4_rules.<locals>.<listcomp>r) r* rL r� )r, r- z==r� )r. r/ r0 r� r� r r� zRFC3964_IPv4_REJECT: z addr-unreachrW rZ rJ r� r< )r] r~ rm ra r} Zfilter_FORWARDrB )r� r� )rM Z _log_deniedr2 r� r� )rT Z daddr_setr� r� r4 r4 r5 �build_rfc3964_ipv4_rules� s:
z!nftables.build_rfc3964_ipv4_rulesc C s� d}g }|j | j|j�� |j | j|j�� |j | j|j�� g }|j | j|||||�� |j | j|||||�� |j | j |||||�� |S )Nr( )
r2 r r] r r r r r r r )rT r� r� r� r~ r� r� r4 r4 r5 �*build_policy_rich_source_destination_rules� s z3nftables.build_policy_rich_source_destination_rulesc C s |dkr dS dS )NrG rH �ebTF)rG rH r8 r4 )rT r� r4 r4 r5 �is_ipv_supported� s znftables.is_ipv_supportedc
C s� ddd�}|| || ddg|| dd|| g|| dd|| g|| dg|| || || g|| ddg|| dd|| g|| dgdd � }||kr�|| S t td
| ��d S ) NZ ipv4_addrZ ipv6_addr)rG rH Z
inet_protoZ inet_servicer ZifnameZ
ether_addr) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz!ipset type name '%s' is not valid)r r
)rT r� r+ Zipv_addr�typesr4 r4 r5 �_set_type_list� s"
znftables._set_type_listc
C s� |r d|kr |d dkr d}nd}t || j||�d�}x0|jd�d jd�D ]}|dkrLd g|d
< P qLW |r�d|kr�|d |d< d|kr�|d |d< g }x0dD ](}d|i} | j|� |jdd| ii� q�W |S )Nr] �inet6rH rG )r~ r� r+ �:r< �,rK �netr Zintervalr1 ZtimeoutZmaxelem�sizerJ rL rW r� )rK r? r )rJ rK rL )r� r; r� r� r2 )
rT r� r+ �optionsr� Zset_dict�tr� r] Z rule_dictr4 r4 r5 �build_set_create_rules� s*
z nftables.build_set_create_rulesc C s$ | j |||�}| j|| jj� � d S )N)rC r� rM r� )rT r� r+ rA r� r4 r4 r5 �
set_create s znftables.set_createc C s8 x2dD ]*}dd|t |d�ii}| j|| jj� � qW d S )NrJ rK rL rY r� )r] r~ r� )rJ rK rL )r� r� rM r� )rT r� r] rZ r4 r4 r5 � set_destroy s
znftables.set_destroyc C s6 | j jj|�jjd�d jd�}g }x�tt|��D ]�}|| dkrr|jdddii� |jdd |rdd
nd d �i� q2|| d kr�|jd| j|�|r�dndd �i� q2|| dkr�|jdd|r�dndii� q2|| dkr�|jdddii� q2t d|| ��q2W dt|�dk�rd|in|d |�r&dndd | d �iS ) Nr= r< r> r r� r` r� r* Zthr r" )r, r- rK r? r r� r� Zifacer� r� r z-Unsupported ipset type for match fragment: %sr) �concatr z!=z==�@)r. r/ r0 )rK r? r )
rM r � get_ipsetr+ r� r re r2 r� r )rT r� Z
match_destr � type_formatr3 �ir4 r4 r5 r s$ z nftables._set_match_fragmentc C sN | j jj|�}|jjd�d jd�}|jd�}t|�t|�krHttd��g }�x�tt|��D �]�}|| dk�r,y|| j d�}W n& t
k
r� |j d� || } Y n,X |j || d |� � || |d d � } y| j d�}W n t
k
�r |j | � Y n(X |j d| d |� | |d d � gi� q\|| dk�r d|| k�rb|j d|| jd�i� n�y|| j d �}W nL t
k
�r� || }
d |j k�r�|j d d
k�r�t
|
�}
|j |
� Y n^X || d |� }
d |j k�r�|j d d
k�r�t
|
�}
|j d|
t|| |d d � �d�i� q\|j || � q\W t|�dk�rJd|igS |S )Nr= r< r> z+Number of values does not match ipset type.r Ztcp�-r rK r? r� r] r< r� )r re rF )rK r? )rM r rH r+ r� re r r r ra r� r2 rA r rn ) rT r� �entry�objrI Z entry_tokensZfragmentrJ ra Zport_strr r4 r4 r5 �_set_entry_fragment7 sL
( "z nftables._set_entry_fragmentc C s> g }| j ||�}x(dD ] }|jdd|t||d�ii� qW |S )NrJ rK rL rW r� )r] r~ r� �elem)rJ rK rL )rN r2 r� )rT r� rL r� r� r] r4 r4 r5 �build_set_add_rulesk s
z nftables.build_set_add_rulesc C s" | j ||�}| j|| jj� � d S )N)rP r� rM r� )rT r� rL r� r4 r4 r5 �set_addu s znftables.set_addc C sF | j ||�}x4dD ],}dd|t||d�ii}| j|| jj� � qW d S )NrJ rK rL rY r� )r] r~ r� rO )rJ rK rL )rN r� r� rM r� )rT r� rL r� r] rZ r4 r4 r5 �
set_deletey s
znftables.set_deletec C s4 g }x*dD ]"}dd|t |d�ii}|j|� q
W |S )NrJ rK rL r{ r� )r] r~ r� )rJ rK rL )r� r2 )rT r� r� r] rZ r4 r4 r5 �build_set_flush_rules� s
z nftables.build_set_flush_rulesc C s | j |�}| j|| jj� � d S )N)rS r� rM r� )rT r� r� r4 r4 r5 � set_flush� s
znftables.set_flushc C sJ | j jj|�}|jdkr d}n(|jrBd|jkrB|jd dkrBd}nd}|S )Nzhash:macr r] r< rL rK )rM r rH r+ rA )rT r� r r] r4 r4 r5 r� � s
znftables._set_get_familyc C s� g }|j | j|||�� |j | j|�� d}x^|D ]D}|j | j||�� |d7 }|dkr2| j|| jj� � |j� d}q2W | j|| jj� � d S )Nr r< i� )r� rC rS rP r� rM r� �clear) rT Zset_nameZ type_nameZentriesZcreate_optionsZ
entry_optionsr� �chunkrL r4 r4 r5 � set_restore� s
znftables.set_restore)N)N)r� )rJ )FrJ )rJ )rJ )F)NN)NN)NN)NN)N)N)N)N)N)F)N)N)F)NN)I�__name__�
__module__� __qualname__r� Zpolicies_supportedrV rh rl rt rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r� r r r r r r! r# r$ r% r& r' r* r+ r, r/ r0 r3 r6 r7 r9 r; rC rD rE r rN rP rQ rR rS rT r� rW r4 r4 r4 r5 rI � s� /.`
4
R
i
;
-
9
+
$
$
$
'
$
<
#
4
rI ij���i����)N)(Z
__future__r ri rw r
Zfirewall.core.loggerr Zfirewall.functionsr r r r r Zfirewall.errorsr r
r r r
r r Zfirewall.core.richr r r r r r r Znftables.nftablesr r� r� r� r� r� r6 r� �objectrI r4 r4 r4 r5 �<module> s� $$
core/__pycache__/fw_ifcfg.cpython-36.opt-1.pyc 0000644 00000002613 15035135173 0015050 0 ustar 00 3
��g
� @ sT d Z ddgZddlZddlZddlmZ ddlmZ ddlm Z dd� Z
d d� Z dS )
z.Functions to search for and change ifcfg files�search_ifcfg_of_interface�ifcfg_set_zone_of_interface� N)�config)�log)�ifcfgc C s� t jjtj�sdS xttt jtj��D ]`}|jd�s4q$xd
D ]}|j|�r:q:q:W d |krXq$t d
tj|f �}|j
� |j d �| kr$|S q$W d tj| f }t jj|�r�t |�}|j
� |S dS )z6search ifcfg file for the interface in config.IFCFGDIRNzifcfg-�.bak�.orig�.rpmnew�.rpmorig�.rpmsave�-range�.z%s/%sZDEVICEz %s/ifcfg-%s)r r r r
r r ) �os�path�existsr ZIFCFGDIR�sorted�listdir�
startswith�endswithr �read�get)� interface�filenameZignored�
ifcfg_file� r � /usr/lib/python3.6/fw_ifcfg.pyr ! s*
c C sn | dkr d} t |�}|dk rj|jd�| krj|jd�dko>| dk rjtjd| |jf � |jd| � |j� dS )zYSet zone (ZONE=<zone>) in the ifcfg file that uses the interface
(DEVICE=<interface>)N� ZZONEzSetting ZONE=%s in '%s')r r r Zdebug1r �set�write)Zzoner r r r r r ? s ) �__doc__�__all__r Zos.pathZfirewallr Zfirewall.core.loggerr Zfirewall.core.io.ifcfgr r r r r r r �<module> s core/__pycache__/base.cpython-36.opt-1.pyc 0000644 00000002172 15035135173 0014210 0 ustar 00 3
��g6 � @ s� d Z dZdZd0ZdddedgZddddgZd d
d d d
dd�Zddddddddddddd d d d gd d!d"d#d$d%d&dd g d'�Zd(d)d*d+d,d-d.gZd/S )1zBase firewall settingsz{chain}_{zone}ZCONTINUE� ZACCEPTz
%%REJECT%%ZDROP�defaultZREJECTZPREZPOST�INZFWDIZFWDOZOUT)Z
PREROUTINGZ POSTROUTINGZINPUTZ
FORWARD_INZ FORWARD_OUTZOUTPUTzicmp-host-prohibitedz host-prohibzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachablez port-unreachzicmp-proto-unreachablez
proto-unreachzicmp-net-prohibitedz
net-prohibz tcp-resetztcp-rstzicmp-admin-prohibitedz admin-prohibzicmp6-adm-prohibitedzadm-prohibitedzicmp6-no-routezno-routezicmp6-addr-unreachablez addr-unreachzicmp6-port-unreachable)Zipv4Zipv6zhash:ipz hash:ip,portz hash:ip,markzhash:netz
hash:net,portzhash:net,ifacezhash:macN���) �__doc__ZDEFAULT_ZONE_TARGETZDEFAULT_POLICY_TARGETZDEFAULT_POLICY_PRIORITYZ ZONE_TARGETSZPOLICY_TARGETSZ SHORTCUTSZ REJECT_TYPESZSOURCE_IPSET_TYPES� r r �/usr/lib/python3.6/base.py�<module> s. core/__pycache__/ebtables.cpython-36.opt-1.pyc 0000644 00000016336 15035135173 0015066 0 ustar 00 3
��g�$ � @ s& d gZ ddlZddlmZ ddlmZ ddlmZm Z m
Z
ddl m Z ddl
mZ ddlmZmZ ddlZd gd
d d gd
d dgd�Zi Zi Zi Zx�ej� D ]tZg ee< e� ee< x\ee D ]PZee jde � ee jdeef � ee jde � ee j de � q�W q�W G dd � d e �Z dS )�ebtables� N)�runProg)�log)�tempFile�readfile� splitArgs)�COMMANDS)� ipXtables)�
FirewallError� INVALID_IPVZBROUTINGZ
PREROUTINGZ POSTROUTINGZOUTPUTZINPUTZFORWARD)ZbrouteZnat�filterz -N %s_directz-I %s 1 -j %s_directz-I %s_direct 1 -j RETURNz %s_directc @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d
� Z d d � Z
d
d� Z dd� Z dd� Z
dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd/d d!�Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd0d+d,�Zd-d.� Zd S )1r ZebFc C sB t | j | _t d| j | _| j� | _| j� | _| j� g | _ d S )Nz
%s-restore)
r �ipv�_command�_restore_command� _detect_restore_noflush_optionZrestore_noflush_option�_detect_concurrent_option�concurrent_option� fill_exists�available_tables)�self� r � /usr/lib/python3.6/ebtables.py�__init__9 s
zebtables.__init__c C s$ t jj| j�| _t jj| j�| _d S )N)�os�path�existsr Zcommand_existsr Zrestore_command_exists)r r r r r A s zebtables.fill_existsc C s( d}t | jddg�}|d dkr$d}|S )N� z --concurrentz-Lr )r r )r r �retr r r r E s
z"ebtables._detect_concurrent_optionc C s. g }y| j |d� W n tk
r( dS X dS )N�offFT)� set_rules�
ValueError)r �rulesr r r r O s z'ebtables._detect_restore_noflush_optionc C s� g }| j r | j |kr |j| j � |dd� |D �7 }tjd| j| jdj|�� t| j|�\}}|dkr~td| jdj|�|f ��|S )Nc S s g | ] }d | �qS )z%sr )�.0�itemr r r �
<listcomp>^ s z"ebtables.__run.<locals>.<listcomp>z %s: %s %s� r z'%s %s' failed: %s) r �appendr �debug2� __class__r �joinr r )r �argsZ_args�statusr r r r Z__runY s zebtables.__runc C s( x"dD ]}||krt td| ��qW d S )N�
%%REJECT%%�%%ICMP%%� %%LOGTYPE%%z'%s' invalid for ebtables)r, r- r. )r
r )r �rule�strr r r �_rule_validatef s
zebtables._rule_validatec C s |t ko|t | kS )N)�BUILT_IN_CHAINS)r r
�table�chainr r r �is_chain_builtinl s zebtables.is_chain_builtinc C sJ g }|r4|j d|d|g� |j d|d|dddg� n|j d|d|g� |S )Nz-tz-Nz-I�1z-jZRETURNz-X)r& )r �addr3 r4 r! r r r �build_chain_rulesp s zebtables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nz-tz-Iz-D)r0 )r r7 r3 r4 �indexr* r/ r r r �
build_rule{ s zebtables.build_rulec C s
t j|�S )N)r Zcommon_reverse_rule)r r* r r r � reverse_rule� s zebtables.reverse_rulec C s t j|� d S )N)r Zcommon_check_passthrough)r r* r r r �check_passthrough� s zebtables.check_passthroughc C s
t j|�S )N)r Zcommon_reverse_passthrough)r r* r r r �reverse_passthrough� s z ebtables.reverse_passthroughc
C s< t � }d}i }x�|D ]�}|d d � }| j|� xTdD ]L}y|j|�} W n tk
rZ Y q4X t|�| d kr4|j| � |j| �}q4W x^tt|��D ]N} xHtjD ]>}
|
|| kr�|| j d�o�|| j
d� r�d|| || < q�W q�W |j |g �j |� qW xD|D ]<}|j
d| � x&|| D ]}|j
dj|�d � �q W �q W |j� tj|j�} tjd
| j| jd |j| jf � g } | j d � t| j| |jd
�\}
}tj� dk�rt|j�}|d k �rd} xH|D ]@}tjd| |f ddd� |j
d ��s�tjddd� | d7 } �q�W tj |j� |
dk�r8td| jdj| �|f ��d S )Nr �-t�--table� �"z"%s"z*%s
r% �
z %s: %s %sz%s: %dz --noflush)�stdin� z%8d: %sr )�nofmt�nlr )rE z'%s %s' failed: %s)r> r? ) r r1 r9 r �len�pop�range�stringZ
whitespace�
startswith�endswith�
setdefaultr& �writer) �closer �stat�namer r' r( r �st_sizer ZgetDebugLogLevelr Zdebug3�unlink)r r! �
log_deniedZ temp_filer3 Z table_rulesZ_ruler/ �opt�i�crP r* r+ r �lines�liner r r r � sZ
zebtables.set_rulesc C s | j |� | j|�S )N)r1 �_ebtables__run)r r/ rT r r r �set_rule� s
zebtables.set_ruleNc C s� g }|r|gnt j� }xp|D ]h}|| jkr6|j|� q y*| jd|dg� | jj|� |j|� W q tk
r� tjd| � Y q X q W |S )Nz-tz-Lz#ebtables table '%s' does not exist.)r2 �keysr r& rZ r r Zdebug1)r r3 r Ztablesr r r �get_available_tables� s
z ebtables.get_available_tablesc C s i S )Nr )r r3 r r r �get_zone_table_chains� s z ebtables.get_zone_table_chainsc C sF g }x<t j� D ]0}|| j� kr qx dD ]}|jd||g� q&W qW |S )N�-F�-X�-Zz-t)r_ r` ra )r2 r\ r] r& )r r! r3 �flagr r r �build_flush_rules� s
zebtables.build_flush_rulesc C s^ g }|dkrdn|}xDt j� D ]8}|| j� kr0q x$t | D ]}|jd|d||g� q:W q W |S )NZPANICZDROPz-tz-P)r2 r\ r] r& )r Zpolicyr! Z_policyr3 r4 r r r �build_set_policy_rules� s z ebtables.build_set_policy_rulesc C s g S )Nr )r r r r �build_default_tables� s z ebtables.build_default_tablesr c C s� g }x�t D ]�}|| j� kr q
t | d d � }|dkrJ|tkrJ|jt| � d|g}x:|D ]2}t|�tkrx|j|| � qX|j|t|� � qXW q
W |S )Nr z-t)�
DEFAULT_RULESr] � LOG_RULES�extend�type�listr& r )r rT Z
default_rulesr3 Z_default_rules�prefixr/ r r r �build_default_rules� s
z ebtables.build_default_rulesc C s
|| j kS )N)r
)r r
r r r �is_ipv_supported s zebtables.is_ipv_supported)N)r )�__name__�
__module__� __qualname__r
rQ Zpolicies_supportedr r r r rZ r1 r5 r8 r: r; r< r= r r[ r] r^ rc rd re rl rm r r r r r 4 s0
@
) �__all__Zos.pathr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r Zfirewall.configr Z
firewall.corer Zfirewall.errorsr
r rJ r2 rf rg Z
OUR_CHAINSr\ r3 �setr4 r& r7 �objectr r r r r �<module> s.
core/__pycache__/fw_transaction.cpython-36.opt-1.pyc 0000644 00000011650 15035135173 0016320 0 ustar 00 3
��g� � @ sJ d Z dgZddlZddlmZ ddlmZ ddlmZ G dd� de �Z
dS )z!Transaction classes for firewalld�FirewallTransaction� N)�log)�errors)�
FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#S )$r c C s( || _ i | _g | _g | _g | _g | _d S )N)�fw�rules� pre_funcs�
post_funcs�
fail_funcs�modules)�selfr � r
�$/usr/lib/python3.6/fw_transaction.py�__init__! s z FirewallTransaction.__init__c C s2 | j j� | jd d �= | jd d �= | jd d �= d S )N)r �clearr r r
)r r
r
r r ) s
zFirewallTransaction.clearc C s | j j|jg �j|� d S )N)r �
setdefault�name�append)r �backend�ruler
r
r �add_rule/ s z FirewallTransaction.add_rulec C s x|D ]}| j ||� qW d S )N)r )r r r r r
r
r � add_rules2 s
z FirewallTransaction.add_rulesc C s |j | jko|| j|j kS )N)r r )r r r r
r
r �
query_rule6 s z FirewallTransaction.query_rulec C s2 |j | jkr.|| j|j kr.| j|j j|� d S )N)r r �remove)r r r r
r
r � remove_rule9 s z FirewallTransaction.remove_rulec G s | j j||f� d S )N)r r )r �func�argsr
r
r �add_pre= s zFirewallTransaction.add_prec G s | j j||f� d S )N)r r )r r r r
r
r �add_post@ s z FirewallTransaction.add_postc G s | j j||f� d S )N)r
r )r r r r
r
r �add_failC s z FirewallTransaction.add_failc C s || j kr| j j|� d S )N)r r )r �moduler
r
r �
add_moduleF s
z FirewallTransaction.add_modulec C s || j kr| j j|� d S )N)r r )r r r
r
r �
remove_moduleJ s
z!FirewallTransaction.remove_modulec C s x|D ]}| j |� qW d S )N)r! )r r r r
r
r � add_modulesN s
z FirewallTransaction.add_modulesc C s x|D ]}| j |� qW d S )N)r" )r r r r
r
r �remove_modulesR s
z"FirewallTransaction.remove_modulesc C s� t jdt| �|df � i }|sjxp| jD ]<}x6t| j| �D ]$}|j|g �j| jj|�j |�� q<W q(W n(x&| jD ] }|j|g �j
| j| � qrW || j fS )Nz%s.prepare(%s, %s)z...) r �debug4�typer �reversedr r r �get_backend_by_name� reverse_rule�extendr )r �enabler � backend_namer r
r
r �prepareV s zFirewallTransaction.preparec C s t jdt| �|f � | j|�\}}| j� d}d}g }xp|D ]h}y| jj||| � W nB tk
r� } z&d}|}t jt j
� � t j |� W Y d d }~X q>X |j |� q>W |s�| jj
||�} | r�| \}
}|
r�t j|� |�ri } xH|D ]@}g | |< x2t|| �D ]"} | | j | jj|�j| �� �q W q�W xb| D ]Z}y| jj|| | � W n< tk
�r� } z t jt j
� � t j |� W Y d d }~X nX �q0W xh| jD ]^\}
}y |
|� W nF tk
�r� } z(t jt j
� � t j d|
||f � W Y d d }~X nX �q�W ttj|��| j� d S )Nz%s.execute(%s)F� Tz#Calling fail func %s(%s) failed: %s)r r% r& r- �prer r � Exception�debug1� traceback�
format_exc�errorr Zhandle_modulesr' r( r) r
r r ZCOMMAND_FAILED�post)r r+ r r r4 ZerrorMsg�doner, �msgZ
module_returnZstatusZ
undo_rulesr r r r
r
r �executef sV
" & zFirewallTransaction.executec C s| t jdt| � � xd| jD ]Z\}}y ||� W q tk
rr } z(t jtj� � t jd|||f � W Y d d }~X qX qW d S )Nz%s.pre()z"Calling pre func %s(%s) failed: %s) r r% r& r r0 r1 r2 r3 r4 )r r r r7 r
r
r r/ � s zFirewallTransaction.prec C s| t jdt| � � xd| jD ]Z\}}y ||� W q tk
rr } z(t jtj� � t jd|||f � W Y d d }~X qX qW d S )Nz %s.post()z#Calling post func %s(%s) failed: %s) r r% r& r r0 r1 r2 r3 r4 )r r r r7 r
r
r r5 � s zFirewallTransaction.postN)�__name__�
__module__� __qualname__r r r r r r r r r r! r" r# r$ r- r8 r/ r5 r
r
r
r r s" @ ) �__doc__�__all__r2 Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r
r
r
r �<module> s core/__pycache__/__init__.cpython-36.pyc 0000644 00000000161 15035135173 0014072 0 ustar 00 3
��g � @ s d S )N� r r r � /usr/lib/python3.6/__init__.py�<module> s core/__pycache__/__init__.cpython-36.opt-1.pyc 0000644 00000000161 15035135173 0015031 0 ustar 00 3
��g � @ s d S )N� r r r � /usr/lib/python3.6/__init__.py�<module> s core/__pycache__/ipset.cpython-36.opt-1.pyc 0000644 00000021161 15035135173 0014421 0 ustar 00 3
��gq2 � @ s� d Z dddgZddlZddlZddlmZ ddlmZ ddl m
Z
dd l m Z dd
l
mZmZ dd lmZ d Zd
ddddddddddg Zddddd�Zd d d d �ZG d d� de�Zd!d� Zd"d� Zd#d$� Zd%d&� Zd'd(� Z dS ))zThe ipset command wrapper�ipset�check_ipset_name� remove_default_create_options� N)�errors)�
FirewallError)�runProg)�log)�tempFile�readfile)�COMMANDS� zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz
inet|inet6�valuez
value in secs)�family�hashsize�maxelem�timeoutZinetZ1024Z65536)r r r c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd'd
d�Z dd� Z
dd� Z dd� Z d(dd�Z
d)dd�Zdd� Zd*dd �Zd+d d �Zd d � Zd!d"� Zd#d$� Zd%d&� Zd S ),r zipset command wrapper classc C s t d | _d| _d S )Nr )r �_command�name)�self� r �/usr/lib/python3.6/ipset.py�__init__K s
zipset.__init__c C s^ dd� |D �}t jd| j| jdj|�� t| j|�\}}|dkrZtd| jdj|�|f ��|S )zCall ipset with argsc S s g | ] }d | �qS )z%sr )�.0�itemr r r �
<listcomp>R s z ipset.__run.<locals>.<listcomp>z %s: %s %s� r z'%s %s' failed: %s)r �debug2� __class__r �joinr �
ValueError)r �argsZ_args�status�retr r r Z__runO s z ipset.__runc C s t |�tkr ttjd| ��dS )zCheck ipset namez ipset name '%s' is not validN)�len�IPSET_MAXNAMELENr r Z INVALID_NAME)r r r r r �
check_nameZ s zipset.check_namec C s� g }d}y| j dg�}W n0 tk
rH } ztjd| � W Y dd}~X nX |j� }d}xT|D ]L}|r�|j� jdd�}|d |kr�|d tkr�|j|d � |j d�r\d }q\W |S )
z?Return types that are supported by the ipset command and kernel� z--helpzipset error: %sNF� r zSupported set types:T)
� _ipset__runr r Zdebug1�
splitlines�strip�split� IPSET_TYPES�append�
startswith)r r" �outputZex�linesZin_types�line�splitsr r r �set_supported_types` s
zipset.set_supported_typesc C s( t |�tks|tkr$ttjd| ��dS )zCheck ipset typez!ipset type name '%s' is not validN)r# r$ r, r r Z INVALID_TYPE)r � type_namer r r �
check_typeu s zipset.check_typeNc C sd | j |� | j|� d||g}t|t�rZx0|j� D ]$\}}|j|� |dkr2|j|� q2W | j|�S )z+Create an ipset with name, type and options�creater& )r% r5 �
isinstance�dict�itemsr- r( )r �set_namer4 �optionsr �key�valr r r �
set_create{ s
zipset.set_createc C s | j |� | jd|g�S )NZdestroy)r% r( )r r: r r r � set_destroy� s
zipset.set_destroyc C s d||g}| j |�S )N�add)r( )r r: �entryr r r r �set_add� s
z
ipset.set_addc C s d||g}| j |�S )N�del)r( )r r: rA r r r r �
set_delete� s
zipset.set_deletec C s, d||g}|r"|j ddj|� � | j|�S )N�testz%sr )r- r r( )r r: rA r; r r r r rE � s
z
ipset.testc C s2 dg}|r|j |� |r"|j|� | j|�jd�S )N�list�
)r- �extendr( r+ )r r: r; r r r r �set_list� s
zipset.set_listc C s< | j dgd�}i }d }}i }�x|D �] }t|�dk r:q&dd� |jdd�D �}t|�dkr`q&q&|d d
krv|d }q&|d d kr�|d }q&|d d kr&|d j� }d } x^| t|�k �r|| }
|
dk� r�t|�| kr�| d7 } || ||
< ntjd|� i S | d7 } q�W |�r$|�r$|t|�f||< d }}|j� q&W |S )z" Get active ipsets (only headers) z-terse)r; N� c S s g | ] }|j � �qS r )r* )r �xr r r r � s z.ipset.set_get_active_terse.<locals>.<listcomp>�:r' r �NameZTypeZHeaderr r r r �netmaskz&Malformed ipset list -terse output: %s)r r r r rN )rI r# r+ r �errorr �clear) r r0 r" �_nameZ_type�_optionsr1 Zpairr2 �i�optr r r �set_get_active_terse� sD
zipset.set_get_active_tersec C s dg}|r|j |� | j|�S )N�save)r- r( )r r: r r r r rV � s
z
ipset.savec C s� | j |� | j|� t� }d|kr*d| }d||dg}|rlx0|j� D ]$\}} |j|� | dkrD|j| � qDW |jddj|� � |jd| � xN|D ]F}
d|
kr�d|
}
|r�|jd||
dj|�f � q�|jd ||
f � q�W |j� tj |j
�} t j d
| j
| jd |j
| jf � d g}t| j||j
d
�\} }
t j� dk�r�yt|j
� W n tk
�r` Y nVX d}xNt|j
�D ]@}t jd||f ddd� |jd��s�t jddd� |d7 }�qrW tj|j
� | dk�r�td| jdj|�|
f ��|
S )Nr z'%s'r6 z-existr& z%s
z flush %s
z
add %s %s %s
z
add %s %s
z%s: %s restore %sz%s: %dZrestore)�stdinr' rJ z%8d: %sr )�nofmt�nlrG )rX z'%s %s' failed: %s)r% r5 r r9 r- �writer �close�os�statr r r r r �st_sizer ZgetDebugLogLevelr
� ExceptionZdebug3�endswith�unlinkr )r r: r4 �entriesZcreate_optionsZ
entry_optionsZ temp_filer r< r= rA r] r! r" rS r1 r r r � set_restore� sV
zipset.set_restorec C s dg}|r|j |� | j|�S )N�flush)r- r( )r r: r r r r � set_flush s
zipset.set_flushc C s | j d||g�S )N�rename)r( )r Z old_set_nameZ new_set_namer r r rf
s z ipset.renamec C s | j d||g�S )N�swap)r( )r Z
set_name_1Z
set_name_2r r r rg s z
ipset.swapc C s | j dg�S )N�version)r( )r r r r rh s z
ipset.version)N)N)NN)N)NN)�__name__�
__module__� __qualname__�__doc__r r( r% r3 r5 r> r? rB rD rE rI rU rV rc re rf rg rh r r r r r H s&
'
7c C s t | �tkrdS dS )z"Return true if ipset name is validFT)r# r$ )r r r r r s c C s8 | j � }x*tD ]"}||krt| || kr||= qW |S )z( Return only non default create options )�copy� IPSET_DEFAULT_CREATE_OPTIONS)r; rR rT r r r r s
c
C sh g }xX| j d�D ]J}y&|jd� |jttj|dd��� W q tk
rX |j|� Y qX qW dj|�S )z! Normalize IP addresses in entry �,�/F)�strict)r+ �indexr- �str� ipaddress�
ip_networkr r )rA Z_entryZ_partr r r �normalize_ipset_entry& s
rv c C sx t | jd��dkrdS ytj| dd�}W n tk
r< dS X x4|D ],}|jtj|dd��rDttjdj | |���qDW dS )z: Check if entry overlaps any entry in the list of entries ro rJ NF)rq z,Entry '{}' overlaps with existing entry '{}')
r# r+ rt ru r �overlapsr r �
INVALID_ENTRY�format)rA rb Z
entry_networkZitrr r r � check_entry_overlaps_existing2 s
rz c C s~ ydd� | D �} W n t k
r& dS X t| �dkr8dS | j� | jd�}x.| D ]&}|j|�rrttjdj||���|}qPW dS )z> Check if any entry overlaps any entry in the list of entries c S s g | ]}t j|d d��qS )F)rq )rt ru )r rK r r r r E s z1check_for_overlapping_entries.<locals>.<listcomp>Nr z Entry '{}' overlaps entry '{}') r r# �sort�poprw r r rx ry )rb Z prev_networkZcurrent_networkr r r � check_for_overlapping_entriesB s 2
r} ) rl �__all__Zos.pathr\ rt Zfirewallr Zfirewall.errorsr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r
Zfirewall.configr r$ r, ZIPSET_CREATE_OPTIONSrn �objectr r r rv rz r} r r r r �<module> sF
P core/__pycache__/logger.cpython-36.opt-1.pyc 0000644 00000055135 15035135173 0014564 0 ustar 00 3
��g>y � @ s� d dddgZ ddlZddlZddlZddlZddlZddlZddlZddlZddl Z
ddl
Z
G dd � d e �Z G dd� de �Z
G d d
� d
e
�ZG d d � d e �ZG d
d� de �ZG dd� de �Ze� ZdS )� LogTarget�FileLog�Logger�log� Nc @ s2 e Zd ZdZdd� Zd dd�Zdd� Zd d
� Zd S )
r z% Abstract class for logging targets. c C s
d | _ d S )N)�fd)�self� r � /usr/lib/python3.6/logger.py�__init__( s zLogTarget.__init__r c C s t d��d S )Nz%LogTarget.write is an abstract method)�NotImplementedError)r �data�level�logger�is_debugr r r �write+ s zLogTarget.writec C s t d��d S )Nz%LogTarget.flush is an abstract method)r )r r r r �flush. s zLogTarget.flushc C s t d��d S )Nz%LogTarget.close is an abstract method)r )r r r r �close1 s zLogTarget.closeN)r )�__name__�
__module__� __qualname__�__doc__r
r r r r r r r r & s
c @ s. e Zd Zdd� Zd dd�Zdd� Zdd � Zd
S ) �
_StdoutLogc C s t j| � tj| _d S )N)r r
�sys�stdoutr )r r r r r
8 s
z_StdoutLog.__init__r c C s | j j|� | j� d S )N)r r r )r r r
r r r r r r < s z_StdoutLog.writec C s | j � d S )N)r )r r r r r A s z_StdoutLog.closec C s | j j� d S )N)r r )r r r r r D s z_StdoutLog.flushN)r )r r r r
r r r r r r r r 7 s
r c @ s e Zd Zdd� ZdS )�
_StderrLogc C s t j| � tj| _d S )N)r r
r �stderrr )r r r r r
K s
z_StderrLog.__init__N)r r r r
r r r r r J s r c @ s. e Zd Zdd� Zd dd�Zdd� Zdd � Zd
S ) �
_SyslogLogc C s. t j| � tjtjjtjd �tj tj
� d S )Nr ) r r
�syslogZopenlog�os�path�basenamer �argvZLOG_PIDZ
LOG_DAEMON)r r r r r
S s
z_SyslogLog.__init__r c C s� d }|rt j}nF||jkr"t j}n4||jkr4t j}n"||jkrFt j}n||jkrVt j }|j
d�rt|d t |�d � }t |�dkr�|d kr�t j |� n t j ||� d S )N�
� r ) r Z LOG_DEBUG�INFO1ZLOG_INFO�WARNINGZ LOG_WARNING�ERRORZLOG_ERR�FATALZLOG_CRIT�endswith�len)r r r
r r Zpriorityr r r r a s"
z_SyslogLog.writec C s t j� d S )N)r Zcloselog)r r r r r w s z_SyslogLog.closec C s d S )Nr )r r r r r z s z_SyslogLog.flushN)r )r r r r
r r r r r r r r R s
r c @ s< e Zd ZdZddd�Zdd� Zddd �Zd
d � Zd d
� ZdS )r z< FileLog class.
File will be opened on the first write. �wc C s t j| � || _|| _d S )N)r r
�filename�mode)r r+ r, r r r r
� s
zFileLog.__init__c C sv | j r
d S tjtjB }| jjd�r,|tjO }tj| j|d�| _ tj | j d� tj
| j | j�| _ t j | j t j t j
� d S )N�ai� )r r �O_CREAT�O_WRONLYr, �
startswith�O_APPEND�openr+ �fchmod�fdopen�fcntlZF_SETFDZ
FD_CLOEXEC)r �flagsr r r r2 � s
z FileLog.openr c C s( | j s| j� | j j|� | j j� d S )N)r r2 r r )r r r
r r r r r r � s z
FileLog.writec C s | j s
d S | j j� d | _ d S )N)r r )r r r r r � s
z
FileLog.closec C s | j s
d S | j j� d S )N)r r )r r r r r � s z
FileLog.flushN)r* )r ) r r r r r
r2 r r r r r r r r s
c @ s� e Zd ZdZd[Zd\Zd]Zd^Zd_ZdZ e
� Z e � Z
e� Zd`d d
�Zd d � Zdadd�Zdbdd�Zdcdd�Zdddd�Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zed"fd#d$�Z ed"fd%d&�Z ed"fd'd(�Z ed"fd)d*�Z ed"fd+d,�Z ed"fd-d.�Z!d/d0� Z"d1d2� Z#d3d4� Z$d5d6� Z%d7d8� Z&d9d:� Z'd;d<� Z(d=d>� Z)d?d@� Z*dAdB� Z+dCdD� Z,dedEdF�Z-dGdH� Z.dfdIdJ�Z/ed"dfdKdL�Z0ed"dfdMdN�Z1ed"dfdOdP�Z2dgdQdR�Z3dSdT� Z4dUdV� Z5dWdX� Z6dhdYdZ�Z7d"S )ir aL
Format string:
%(class)s Calling class the function belongs to, else empty
%(date)s Date using Logger.date_format, see time module
%(domain)s Full Domain: %(module)s.%(class)s.%(function)s
%(file)s Filename of the module
%(function)s Function name, empty in __main__
%(label)s Label according to log function call from Logger.label
%(level)d Internal logging level
%(line)d Line number in module
%(module)s Module name
%(message)s Log message
Standard levels:
FATAL Fatal error messages
ERROR Error messages
WARNING Warning messages
INFOx, x in [1..5] Information
DEBUGy, y in [1..10] Debug messages
NO_INFO No info output
NO_DEBUG No debug output
INFO_MAX Maximum info level
DEBUG_MAX Maximum debug level
x and y depend on info_max and debug_max from Logger class
initialization. See __init__ function.
Default logging targets:
stdout Logs to stdout
stderr Logs to stderr
syslog Logs to syslog
Additional arguments for logging functions (fatal, error, warning, info
and debug):
nl Disable newline at the end with nl=0, default is nl=1.
fmt Format string for this logging entry, overloads global format
string. Example: fmt="%(file)s:%(line)d %(message)s"
nofmt Only output message with nofmt=1. The nofmt argument wins over
the fmt argument.
Example:
from logger import log
log.setInfoLogLevel(log.INFO1)
log.setDebugLogLevel(log.DEBUG1)
for i in range(1, log.INFO_MAX+1):
log.setInfoLogLabel(i, "INFO%d: " % i)
log.setFormat("%(date)s %(module)s:%(line)d [%(domain)s] %(label)s: "
"%(level)d %(message)s")
log.setDateFormat("%Y-%m-%d %H:%M:%S")
fl = FileLog("/tmp/log", "a")
log.addInfoLogging("*", fl)
log.addDebugLogging("*", fl)
log.addInfoLogging("*", log.syslog, fmt="%(label)s%(message)s")
log.debug3("debug3")
log.debug2("debug2")
log.debug1("debug1")
log.info2("info2")
log.info1("info1")
log.warning("warning\n", nl=0)
log.error("error\n", nl=0)
log.fatal("fatal")
log.info(log.INFO1, "nofmt info", nofmt=1)
� � � � r# r �
c C s� i | _ i | _d| _d| _i | _i | _i | _i | _i | _i | _ |dk rPt
d| ��|dk rdt
d| ��| j | _ || _
d| _|| _| j| jd� | j| jd� | j| jd� | j| j d� xNtd| j
d �D ]:}t| d | |� | j|d� t| d
| d d � | |�� q�W xTtd| jd �D ]@}t| d
| |� | j|d| � t| d| dd � | |�� �qW | j| j� | j| j� | jd� | jd� | j d| j | j| j| j g� | j d| j dd� t| j| j
d �D �� | j d| j dd� td| jd �D �� dS )z Logger class initialization � r# z Logger: info_max %d is too lowr z Logger: debug_max %d is too lowz
FATAL ERROR: zERROR: z WARNING: zINFO%dzinfo%dc s � �fdd�S )Nc s � j �| f|�|�S )N)�info)�message�args�kwargs)r �xr r �<lambda> s z3Logger.__init__.<locals>.<lambda>.<locals>.<lambda>r )r rA r )r rA r rB s z!Logger.__init__.<locals>.<lambda>zDEBUG%dz DEBUG%d: zdebug%dc s � �fdd�S )Nc s � j �| f|�|�S )N)�debug)r> r? r@ )r rA r r rB ) s z3Logger.__init__.<locals>.<lambda>.<locals>.<lambda>r )r rA r )r rA r rB ( s z%(label)s%(message)sz%d %b %Y %H:%M:%S�*c S s g | ]}|�qS r r )�.0�ir r r �
<listcomp>4 s z#Logger.__init__.<locals>.<listcomp>c S s g | ]}|�qS r r )rE rF r r r rG 6 s N) �_level� _debug_level�_format� _date_format�_label� _debug_label�_logging�_debug_logging�_domains�_debug_domains�
ValueErrorr% �NO_INFO�INFO_MAX�NO_DEBUG� DEBUG_MAX�setInfoLogLabelr' � TRACEBACKr& �range�setattr�setDebugLogLabel�setInfoLogLevelr$ �setDebugLogLevel� setFormat�
setDateFormat�setInfoLoggingr r �setDebugLogging)r Zinfo_maxZ debug_maxrH r r r r
� sX
zLogger.__init__c C sN xHt | j| jd �D ]2}|| jkr$qx | j| D ]\}}}|j� q0W qW dS )z Close all logging targets r# N)rY r' rV rN r )r r
�dummy�targetr r r r 8 s
z Logger.closerD c C s$ | j |� || jkr | j| S | jS )z Get info log level. )� _checkDomainrH �NOTHING)r �domainr r r �getInfoLogLevel@ s
zLogger.getInfoLogLevelc C s8 | j |� || jk r| j}|| jkr*| j}|| j|< dS )z% Set log level [NOTHING .. INFO_MAX] N)rd re rT rH )r r
rf r r r r\ G s
zLogger.setInfoLogLevelc C s* | j |� || jkr$| j| | j S | jS )z Get debug log level. )rd rI rU )r rf r r r �getDebugLogLevelP s
zLogger.getDebugLogLevelc C s: | j |� |dk rd}|| jkr&| j}|| j | j|< dS )z- Set debug log level [NO_DEBUG .. DEBUG_MAX] r N)rd rV rU rI )r r
rf r r r r] W s
zLogger.setDebugLogLevelc C s | j S )N)rJ )r r r r � getFormat` s zLogger.getFormatc C s
|| _ d S )N)rJ )r rJ r r r r^ c s zLogger.setFormatc C s | j S )N)rK )r r r r �
getDateFormatf s zLogger.getDateFormatc C s
|| _ d S )N)rK )r rJ r r r r_ i s zLogger.setDateFormatc C s: | j |�}x*|D ]"}| j|| j| jd� || j|< qW dS )zU Set log label for level. Level can be a single level or an array
of levels. )� min_level� max_levelN)�
_getLevels�_checkLogLevelr' rT rL )r r
�label�levelsr r r rW l s
zLogger.setInfoLogLabelc C s> | j |dd�}x*|D ]"}| j|| j| jd� || j|< qW dS )zU Set log label for level. Level can be a single level or an array
of levels. r# )r )rk rl N)rm rn r$ rV rM )r r
ro rp r r r r[ u s
zLogger.setDebugLogLabelNc C s | j ||||dd� dS )z� Set info log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r )r N)� _setLogging)r rf rc r
�fmtr r r r` ~ s zLogger.setInfoLoggingc C s | j ||||dd� dS )z� Set debug log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r# )r N)rq )r rf rc r
rr r r r ra � s zLogger.setDebugLoggingc C s | j ||||dd� dS )z� Add info log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r )r N)� _addLogging)r rf rc r
rr r r r �addInfoLogging� s zLogger.addInfoLoggingc C s | j ||||dd� dS )z� Add debg log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r# )r N)rs )r rf rc r
rr r r r �addDebugLogging� s zLogger.addDebugLoggingc C s | j ||||dd� dS )z� Delete info log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r )r N)� _delLogging)r rf rc r
rr r r r �delInfoLogging� s zLogger.delInfoLoggingc C s | j ||||dd� dS )z� Delete debug log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. r# )r N)rv )r rf rc r
rr r r r �delDebugLogging� s zLogger.delDebugLoggingc C s | j |dd�S )zN Is there currently any info logging for this log level (and
domain)? r )r )�_isLoggingHere)r r
r r r �isInfoLoggingHere� s zLogger.isInfoLoggingHerec C s | j |dd�S )zO Is there currently any debug logging for this log level (and
domain)? r# )r )ry )r r
r r r �isDebugLoggingHere� s zLogger.isDebugLoggingHerec O s, | j |� d|d< | j| j|f|�|� dS )z Fatal error log. r r N)� _checkKWargs�_logr' )r rJ r? r@ r r r �fatal� s
z Logger.fatalc O s, | j |� d|d< | j| j|f|�|� dS )z Error log. r r N)r| r} r& )r rJ r? r@ r r r �error� s
z Logger.errorc O s, | j |� d|d< | j| j|f|�|� dS )z Warning log. r r N)r| r} r% )r rJ r? r@ r r r �warning� s
zLogger.warningc O sB | j |d| jd� | j|� d|d< | j|| j |f|�|� dS )z� Information log using info level [1..info_max].
There are additional infox functions according to info_max from
__init__r# )rk rl r r N)rn rT r| r} rS )r r
rJ r? r@ r r r r= � s
z Logger.infoc O s< | j |d| jd� | j|� d|d< | j||f|�|� dS )z� Debug log using debug level [1..debug_max].
There are additional debugx functions according to debug_max
from __init__r# )rk rl r N)rn rV r| r} )r r
rJ r? r@ r r r rC � s
z Logger.debugc C s | j | jtj� g i d� d S )N)r? r@ )r} rX � traceback�
format_exc)r r r r � exception� s zLogger.exceptionc C s& ||k s||kr"t d|||f ��d S )Nz*Level %d out of range, should be [%d..%d].)rR )r r
rk rl r r r rn � s zLogger._checkLogLevelc C s2 |sd S x$|j � D ]}|dkrtd| ��qW d S )N�nlrr �nofmtz0Key '%s' is not allowed as argument for logging.)r� rr r� )�keysrR )r r@ �keyr r r r| � s
zLogger._checkKWargsc C s | s|dkrt d| ��d S )Nr< zDomain '%s' is not valid.)rR )r rf r r r rd � s zLogger._checkDomainc C s� || j krft|t�s t|t�r$|}n|g}xp|D ]0}|rL| j|d| jd� q0| j|| j| jd� q0W n6|r�dd� t| j | j�D �}ndd� t| j| j�D �}|S )z Generate log level array. r# )rk rl c S s g | ]}|�qS r r )rE rF r r r rG � s z%Logger._getLevels.<locals>.<listcomp>c S s g | ]}|�qS r r )rE rF r r r rG � s )
�ALL�
isinstance�list�tuplern rV r' rT rY ZDEBUG1)r r
r rp r r r rm � s
zLogger._getLevelsc C sN t |t�st |t�r|}n|g}x(|D ] }t|jt�s&td|jj ��q&W |S )z Generate target array. z '%s' is no valid logging target.)r� r� r� �
issubclass� __class__r rR r )r rc �targetsZ_targetr r r � _getTargets� s
zLogger._getTargetsc C s� |r | j }| j}d| jd f}n | j}| j}| j| jd f}t|�dkrP|j� xVt |d |d �D ]@}||krrqdx0|| D ]$\}}}||kr||j
|g �j |� q|W qdW dS )z% Generate dict with domain by level. r# r N) rQ rO rV rP rN r' rT r) �clearrY �
setdefault�append)r r rP rN Z_ranger
rf rb r r r � _genDomains s zLogger._genDomainsc C sl | j |� | j||�}| j|�}|r,| j}n| j}x*|D ]"}x |D ]}|||fg||< qBW q8W | j|� d S )N)rd rm r� rO rN r� ) r rf rc r
rr r rp r� rN r r r rq s
zLogger._setLoggingc C st | j |� | j||�}| j|�}|r,| j}n| j}x2|D ]*}x$|D ] }|j|g �j|||f� qBW q8W | j|� d S )N)rd rm r� rO rN r� r� r� ) r rf rc r
rr r rp r� rN r r r rs - s
zLogger._addLoggingc
C s� | j |� | j||�}| j|�}|r,| j}n| j}x�|D ]|} xv|D ]n}| |krPqB|||f|| kr�|| j|||f� t|| �dkr�|| = qB|| jkrBtd| ||j j
|f ��qBW q8W | j |� d S )Nr zDNo mathing logging for level %d, domain %s, target %s and format %s.) rd rm r� rO rN �remover) r� rR r� r r� )
r rf rc r
rr r rp r� rN rH r r r rv < s&
zLogger._delLoggingc C st | j ||�}|sdS |d d }|r,| j}n| j}x<|| D ]0\}}}|dksh|j|�shtj|d |�r<dS q<W dS )NFrf �.rD T)�_genDictrO rN r0 �fnmatch� fnmatchcase)r r
r �_dict� point_domainrN rf rb r r r ry U s
zLogger._isLoggingHerec C s� |j jdkrD|j jd }||jkrD|j| }| j|j|j �}|rD|S tj|j �}|j }|j|j kr�t
|j |j d�r�|j |j j |kr�dS xT|j j � D ]F\}}t
|tj�r�t
||j�r�t||j�}t
|tj�r�|j |kr�|S q�W dS )z7 Function to get calling class. Returns class or None. r Z func_codeN)�f_code� co_argcount� co_varnames�f_locals�
_getClass2r� �inspectZ getmodule�co_name�__dict__�hasattr�__code__�itemsr� �typesZ ClassType�getattr� FunctionType) r �frameZselfname�_self�obj�module�coderb �valuer r r � _getClassi s*
zLogger._getClassc C sV x,|j j� D ] }t|tj�r |j|kr |S q W x"|jD ]}| j||�}|r6|S q6W dS )z@ Internal function to get calling class. Returns class or None. N)r� �valuesr� r� r� r� � __bases__r� )r r� r� r� �baseZ_objr r r r� � s
zLogger._getClass2c O sl d}d|kr|d }d}d|kr(|d }d}d|kr<|d }| j ||�}|sPd S t|�dkrj|| |d< n&t|�dkr�||d |d< n||d< |d d } |r�| j}
n| j}
g } x�|
| D ]�\} }
}|
| kr�q�| d ks�| j| d �s�tj|d | �r�|�s| j}d
|k�r|d
}|�r0|
j|d || |� n|
j|| || |� |�rZ|
jd || |� | j |
� q�W d S ) Nr r r# r� r� r> rf r� rD rr r" )
r� r) rO rN r0 r� r� rJ r r� )r r
rJ r? r@ r r� r� r� r� rN Z used_targetsrf rc r r r r} � sL
z Logger._logc C s g }d}|r | j }| j}| j}n| j}| j}| j}xN|D ]F}|dkrh|| |kr~d}t|�dkrdg }P q8|| |kr8|j|� q8W | r�t|�dk r�dS ||kr�dS tj � } x$| r�| j
r�| j d | j kr�| j
} q�W | s�t
d��| j d }
|
d } x |D ]}| j|�r�g }P q�W | j} t|
�}
xx|| D ]l}|jd�}|dk�rD�q&n |dk�r\|d|� }n|}|
t|�k�r�|
j|��s�dS n|j|
��s&dS �q&W d
}||k�r�|| }| j| j|
d
| jd
||tj| jtj� �d � }|d d
k�r�d
|d < d}x&|| D ]}|dk�r�q�d}P �q�W | jjd�dk�sR| jjd�dk�sR|�sRt|�dk�rl| j| �}|�rl|j|d< d
|d |d< |d d
k�r�|d d |d 7 < |d d
k�r�|d d |d 7 < t|�dk �r�|S |d d }x0|D ](}|j|��stj |d |��r�|S �q�W dS )z Internal function. FrD Tr r# Nr z Frame information not available.r� r< ) �file�liner� �class�functionrf ro r
Zdater� �?z %(domain)z%(class)r� r� rf ) rI rQ rM rH rP rL r) r� r� Z currentframe�f_back� f_globalsr rR r0 r� �find� co_filename�f_linenor� �timeZstrftimerK Z localtimerJ r� r r� r� )r r
r Z
check_domainsZ simple_matchr� rP rL rf �fZ module_nameZ point_module�co�_lenrF �dZ level_strZ
domain_neededr� r� r r r r� � s�
zLogger._genDict���������������)r7 r; )rD )rD )rD )rD )r )r )r )r )8r r r r r� re r' rX r& r% r r r r r r r
r rg r\ rh r] ri r^ rj r_ rW r[ r` ra rt ru rw rx rz r{ r~ r r� r= rC r� rn r| rd rm r� r� rq rs rv ry r� r� r} r� r r r r r � sd G
;
4)�__all__r r� r� r� r� r r� r5 Zos.pathr �objectr r r r r r r r r r r �<module> s. -( *4 core/__pycache__/fw_direct.cpython-36.opt-1.pyc 0000644 00000031230 15035135173 0015241 0 ustar 00 3
��g�W � @ sn d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl
m Z ddl m
Z
G d d � d e�Zd
S ) �FirewallDirect� )�LastUpdatedOrderedDict)� ipXtables)�ebtables)�FirewallTransaction)�log)�errors)�
FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dNdd�Z dd� Z dd� Z
dOdd�Zdd� Zd d � Zd d � Zd d!� ZdPd"d#�ZdQd$d%�Zd&d'� Zd(d)� Zd*d+� ZdRd,d-�ZdSd.d/�Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z dTd<d=�Z dUd>d?�Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dLdM� Z(dS )Vr c C s || _ | j� d S )N)�_fw�_FirewallDirect__init_vars)�self�fw� r � /usr/lib/python3.6/fw_direct.py�__init__' s zFirewallDirect.__init__c C s d| j | j| j| jf S )Nz%s(%r, %r, %r))� __class__�_chains�_rules�_rule_priority_positions)r r r r �__repr__+ s zFirewallDirect.__repr__c C s" i | _ i | _i | _i | _d | _d S )N)r r r �
_passthroughs�_obj)r r r r Z __init_vars/ s
zFirewallDirect.__init_varsc C s | j � d S )N)r )r r r r �cleanup6 s zFirewallDirect.cleanupc C s
t | j�S )N)r r
)r r r r �new_transaction; s z FirewallDirect.new_transactionc C s
|| _ d S )N)r )r �objr r r �set_permanent_config@ s z#FirewallDirect.set_permanent_configc C s* t | j�t | j� t | j� dkr&dS dS )Nr TF)�lenr r r )r r r r �has_runtime_configurationC s "z(FirewallDirect.has_runtime_configurationc C sB | j � r dS t| jj� �t| jj� � t| jj� � dkr>dS dS )NTr F)r r r �get_all_chains�
get_all_rules�get_all_passthroughs)r r r r �has_configurationH s z FirewallDirect.has_configurationNc C sP |d kr| j � }n|}| j| jj� | jj� | jj� f|� |d krL|jd� d S )NT)r �
set_configr r r r �execute)r �use_transaction� transactionr r r � apply_directQ s
zFirewallDirect.apply_directc C s i }i }i }xL| j D ]B}|\}}x4| j | D ]&}| jj|||�s,|j|g �j|� q,W qW xf| jD ]\}|\}}}xL| j| D ]>\} }
| jj|||| |
�s|||kr�t� ||< | || | |
f< q|W qbW xP| jD ]F}x@| j| D ]2}
| jj ||
�s�||k� r�g ||< || j|
� q�W q�W |||fS )N)
r r � query_chain�
setdefault�appendr �
query_ruler r �query_passthrough) r Zchains�rulesZ passthroughs�table_id�ipv�table�chain�chain_id�priority�argsr r r �get_runtime_configb s,
z!FirewallDirect.get_runtime_configc C s | j | j| jfS )N)r r r )r r r r �
get_config� s zFirewallDirect.get_configc C s� |d kr| j � }n|}|\}}}x||D ]t}|\}} xf|| D ]Z}
| j|| |
�s<y| j|| |
|d� W q< tk
r� } ztjt| �� W Y d d } ~ X q<X q<W q&W x�|D ]�} | \}} }
xt|| D ]h\}
}| j|| |
|
|�s�y| j|| |
|
||d� W q� tk
�r" } ztjt| �� W Y d d } ~ X q�X q�W q�W xx|D ]p}xh|| D ]\}| j ||��s@y| j
|||d� W n2 tk
�r� } ztjt| �� W Y d d } ~ X nX �q@W �q2W |d k�r�|j d� d S )N)r$ T) r r' � add_chainr r Zwarning�strr* �add_ruler+ �add_passthroughr# )r Zconfr$ r% r r r r- r. r/ r0 �errorr1 r2 r3 r r r r" � s@
(
(
,
zFirewallDirect.set_configc C s* dddg}||kr&t tjd||f ��d S )N�ipv4�ipv6Zebz'%s' not in '%s')r r Z INVALID_IPV)r r. Zipvsr r r �
_check_ipv� s
zFirewallDirect._check_ipvc C sF | j |� |dkr tjj� ntjj� }||krBttjd||f ��d S )Nr; r< z'%s' not in '%s')r; r< )r= r �BUILT_IN_CHAINS�keysr r r Z
INVALID_TABLE)r r. r/ Ztablesr r r �_check_ipv_table� s
z FirewallDirect._check_ipv_tablec C s� |dkr4t j| }| jjr i }qH| jj|�j| }ntj| }tj| }||kr`tt j
d| ��||krxtt j
d| ��|dkr�| jj j |�d k r�tt j
d| ��d S )Nr; r< z chain '%s' is built-in chainzchain '%s' is reservedzChain '%s' is reserved)r; r< )r; r< )r r> r
�nftables_enabled�get_direct_backend_by_ipv�
our_chainsr Z
OUR_CHAINSr r Z
BUILTIN_CHAIN�zoneZzone_from_chainZ
INVALID_CHAIN)r r. r/ r0 Zbuilt_in_chainsrC r r r �_check_builtin_chain� s"
z#FirewallDirect._check_builtin_chainc C sH |r| j j|g �j|� n*| j | j|� t| j | �dkrD| j |= d S )Nr )r r( r) �remover )r r- r0 �addr r r �_register_chain� s
z FirewallDirect._register_chainc C sV |d kr| j � }n|}| jj� r.|j| jj� | jd||||� |d krR|jd� d S )NT)r r
� may_skip_flush_direct_backends�add_pre�flush_direct_backends�_chainr# )r r. r/ r0 r$ r% r r r r6 � s
zFirewallDirect.add_chainc C s> |d kr| j � }n|}| jd||||� |d kr:|jd� d S )NFT)r rL r# )r r. r/ r0 r$ r% r r r � remove_chain� s
zFirewallDirect.remove_chainc C s: | j ||� | j|||� ||f}|| jko8|| j| kS )N)r@ rE r )r r. r/ r0 r- r r r r' � s
zFirewallDirect.query_chainc C s, | j ||� ||f}|| jkr(| j| S g S )N)r@ r )r r. r/ r- r r r �
get_chains� s
zFirewallDirect.get_chainsc C sD g }x:| j D ]0}|\}}x"| j | D ]}|j|||f� q$W q W |S )N)r r) )r �r�keyr. r/ r0 r r r r s z FirewallDirect.get_all_chainsc C sZ |d kr| j � }n|}| jj� r.|j| jj� | jd||||||� |d krV|jd� d S )NT)r r
rI rJ rK �_ruler# )r r. r/ r0 r2 r3 r$ r% r r r r8 s
zFirewallDirect.add_rulec C sB |d kr| j � }n|}| jd||||||� |d kr>|jd� d S )NFT)r rQ r# )r r. r/ r0 r2 r3 r$ r% r r r � remove_rule s
zFirewallDirect.remove_rulec C s2 | j ||� |||f}|| jko0||f| j| kS )N)r@ r )r r. r/ r0 r2 r3 r1 r r r r* # s
zFirewallDirect.query_rulec C s6 | j ||� |||f}|| jkr2t| j| j� �S g S )N)r@ r �listr? )r r. r/ r0 r1 r r r � get_rules) s
zFirewallDirect.get_rulesc C sR g }xH| j D ]>}|\}}}x.| j | D ] \}}|j||||t|�f� q&W q W |S )N)r r) rS )r rO rP r. r/ r0 r2 r3 r r r r 0 s
z FirewallDirect.get_all_rulesc C s� |rr|| j krt� | j |< || j | |< || jkr<i | j|< || j| krb| j| | |7 < q�|| j| |< n<| j | |= t| j | �dkr�| j |= | j| | |8 < d S )Nr )r r r r )r �rule_idr1 r2 �enable�countr r r �_register_rule8 s
z FirewallDirect._register_rulec C sV y| j j| j j|�j|�S tk
rP } z tj|� ttj |��W Y d d }~X nX d S )N)
r
�rulerB �name� Exceptionr Zdebug2r r ZCOMMAND_FAILED)r r. r3 �msgr r r � passthroughL s
zFirewallDirect.passthroughc C sX |r*|| j krg | j |< | j | j|� n*| j | j|� t| j | �dkrT| j |= d S )Nr )r r) rF r )r r. r3 rV r r r �_register_passthroughT s
z$FirewallDirect._register_passthroughc C sX |d kr| j � }n|}| jj� r.|j| jj� | jd|t|�|� |d krT|jd� d S )NT)r r
rI rJ rK � _passthroughrS r# )r r. r3 r$ r% r r r r9 ^ s
z FirewallDirect.add_passthroughc C s@ |d kr| j � }n|}| jd|t|�|� |d kr<|jd� d S )NFT)r r_ rS r# )r r. r3 r$ r% r r r �remove_passthroughl s
z!FirewallDirect.remove_passthroughc C s || j kot|�| j | kS )N)r �tuple)r r. r3 r r r r+ w s
z FirewallDirect.query_passthroughc C s> g }x4| j D ]*}x$| j | D ]}|j|t|�f� q W q W |S )N)r r) rS )r rO r. r3 r r r r { s
z#FirewallDirect.get_all_passthroughsc C s4 g }|| j kr0x | j | D ]}|jt|�� qW |S )N)r r) rS )r r. rO r3 r r r �get_passthroughs� s
z FirewallDirect.get_passthroughsc C s� g }x�|D ]�}d}x�|D ]�}y|j |�}W n tk
r> Y qX t|�|krd||d krd}||d jd�}x.|D ]&} |dd� }
| |
|d < |j|
� qxW qW |s
|j|� q
W |S )z5Split values combined with commas for options in optsF�,� TN)�index�
ValueErrorr �splitr) ) r r, ZoptsZ out_rulesrY Z processed�opt�i�items�itemrQ r r r � split_value� s$
zFirewallDirect.split_valuec
C s* | j ||� | jj r2|dkr2| jjj||||� |}| jj|�} | jj rd| j|||�rdd| }n:| jjr�|dd � dkr�| j|||d d� �r�|d d� }|||f}
||f} |r�|
| jkr�| | j|
kr�tt j
d||||f ��nB|
| jk�s| | j|
k�rtt j d||||f ��| j|
| }d} d }
|
| j k�r�t
| j |
j� �}d }x@|t|�k �r�||| k�r�| | j |
|| 7 } |d7 }�qTW t|�g}| j|d
d g�}| j|d d
g�}x<|D ]4}|j| | j|||| t|��� | d7 } |
d7 }
�q�W | j| |
|||
� |j| j| |
|| |
� d S )Nr; r< z %s_direct� Z_directz"rule '%s' already is in '%s:%s:%s'z rule '%s' is not in '%s:%s:%s'rd r z-sz--sourcez-dz
--destination)r; r< i����i����i����)r@ r
rA rD �create_zone_base_by_chainrB Zis_chain_builtinr r r �ALREADY_ENABLED� NOT_ENABLEDr �sortedr? r rS rl r8 Z
build_rulera rX �add_fail)r rV r. r/ r0 r2 r3 r% rL �backendr1 rU re rW Z positions�jZ args_list�_argsr r r rQ � sZ
(
zFirewallDirect._rulec C s� | j ||� | j|||� ||f}|rV|| jkr�|| j| kr�ttjd|||f ��n.|| jksn|| j| kr�ttjd|||f ��| jj|�}|j ||j
|||�� | j |||� |j | j ||| � d S )Nz chain '%s' already is in '%s:%s'z chain '%s' is not in '%s:%s')
r@ rE r r r ro rp r
rB Z add_rulesZbuild_chain_rulesrH rr )r rG r. r/ r0 r% r- rs r r r rL s$
zFirewallDirect._chainc
C s� | j |� t|�}|rD|| jkrp|| j| krpttjd||f ��n,|| jks\|| j| krpttjd||f ��| jj|�}|r�|j |� |dkr�|j
|�\}}|r�|r�| jj j |||� |} n
|j
|�} |j|| � | j|||� |j| j||| � d S )Nzpassthrough '%s', '%s'r; r< )r; r< )r= ra r r r ro rp r
rB Zcheck_passthroughZ passthrough_parse_table_chainrD rn Zreverse_passthroughr8 r^ rr )
r rV r. r3 r% Z
tuple_argsrs r/ r0 ru r r r r_ ' s0
zFirewallDirect._passthrough)N)N)N)N)N)N)N)N))�__name__�
__module__� __qualname__r r r r r r r r! r& r4 r5 r" r= r@ rE rH r6 rM r' rN r r8 rR r* rT r rX r] r^ r9 r` r+ r rb rl rQ rL r_ r r r r r & sL
'
jN)�__all__Zfirewall.fw_typesr Z
firewall.corer r Z firewall.core.fw_transactionr Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_helper.cpython-36.pyc 0000644 00000003705 15035135173 0014315 0 ustar 00 3
��g) � @ s6 d Z dgZddlmZ ddlmZ G dd� de�ZdS )zhelper backend�FirewallHelper� )�errors)�
FirewallErrorc @ s\ e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dS )r c C s || _ i | _d S )N)Z_fw�_helpers)�self�fw� r � /usr/lib/python3.6/fw_helper.py�__init__ s zFirewallHelper.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r r r r �__repr__" s zFirewallHelper.__repr__c C s | j j� d S )N)r �clear)r r r r �cleanup' s zFirewallHelper.cleanupc C s || j � krttj|��d S )N)� get_helpersr r �INVALID_HELPER)r �namer r r � check_helper* s zFirewallHelper.check_helperc C s || j � kS )N)r )r r r r r � query_helper. s zFirewallHelper.query_helperc C s t | jj� �S )N)�sortedr �keys)r r r r r 1 s zFirewallHelper.get_helpersc C s t | j�dkS )Nr )�lenr )r r r r � has_helpers4 s zFirewallHelper.has_helpersc C s | j |� | j| S )N)r r )r r r r r �
get_helper7 s
zFirewallHelper.get_helperc C s || j |j< d S )N)r r )r �objr r r �
add_helper; s zFirewallHelper.add_helperc C s" || j krttj|��| j |= d S )N)r r r r )r r r r r �
remove_helper> s
z FirewallHelper.remove_helperN)
�__name__�
__module__� __qualname__r
r r r r r r r r r r r r r r s N)�__doc__�__all__Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/ebtables.py 0000644 00000022256 15035135173 0007641 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "ebtables" ]
import os.path
from firewall.core.prog import runProg
from firewall.core.logger import log
from firewall.functions import tempFile, readfile, splitArgs
from firewall.config import COMMANDS
from firewall.core import ipXtables # some common stuff lives there
from firewall.errors import FirewallError, INVALID_IPV
import string
BUILT_IN_CHAINS = {
"broute": [ "BROUTING" ],
"nat": [ "PREROUTING", "POSTROUTING", "OUTPUT" ],
"filter": [ "INPUT", "OUTPUT", "FORWARD" ],
}
DEFAULT_RULES = { }
LOG_RULES = { }
OUR_CHAINS = {} # chains created by firewalld
for table in BUILT_IN_CHAINS.keys():
DEFAULT_RULES[table] = [ ]
OUR_CHAINS[table] = set()
for chain in BUILT_IN_CHAINS[table]:
DEFAULT_RULES[table].append("-N %s_direct" % chain)
DEFAULT_RULES[table].append("-I %s 1 -j %s_direct" % (chain, chain))
DEFAULT_RULES[table].append("-I %s_direct 1 -j RETURN" % chain)
OUR_CHAINS[table].add("%s_direct" % chain)
class ebtables(object):
ipv = "eb"
name = "ebtables"
policies_supported = False # ebtables only supported with direct interface
def __init__(self):
self._command = COMMANDS[self.ipv]
self._restore_command = COMMANDS["%s-restore" % self.ipv]
self.restore_noflush_option = self._detect_restore_noflush_option()
self.concurrent_option = self._detect_concurrent_option()
self.fill_exists()
self.available_tables = []
def fill_exists(self):
self.command_exists = os.path.exists(self._command)
self.restore_command_exists = os.path.exists(self._restore_command)
def _detect_concurrent_option(self):
# Do not change any rules, just try to use the --concurrent option
# with -L
concurrent_option = ""
ret = runProg(self._command, ["--concurrent", "-L"])
if ret[0] == 0:
concurrent_option = "--concurrent" # concurrent for ebtables lock
return concurrent_option
def _detect_restore_noflush_option(self):
# Do not change any rules, just try to use the restore command
# with --noflush
rules = [ ]
try:
self.set_rules(rules, "off")
except ValueError:
return False
return True
def __run(self, args):
# convert to string list
_args = [ ]
if self.concurrent_option and self.concurrent_option not in args:
_args.append(self.concurrent_option)
_args += ["%s" % item for item in args]
log.debug2("%s: %s %s", self.__class__, self._command, " ".join(_args))
(status, ret) = runProg(self._command, _args)
if status != 0:
raise ValueError("'%s %s' failed: %s" % (self._command,
" ".join(args), ret))
return ret
def _rule_validate(self, rule):
for str in ["%%REJECT%%", "%%ICMP%%", "%%LOGTYPE%%"]:
if str in rule:
raise FirewallError(INVALID_IPV,
"'%s' invalid for ebtables" % str)
def is_chain_builtin(self, ipv, table, chain):
return table in BUILT_IN_CHAINS and \
chain in BUILT_IN_CHAINS[table]
def build_chain_rules(self, add, table, chain):
rules = []
if add:
rules.append([ "-t", table, "-N", chain ])
rules.append([ "-t", table, "-I", chain, "1", "-j", "RETURN" ])
else:
rules.append([ "-t", table, "-X", chain ])
return rules
def build_rule(self, add, table, chain, index, args):
rule = [ "-t", table ]
if add:
rule += [ "-I", chain, str(index) ]
else:
rule += [ "-D", chain ]
rule += args
return rule
def reverse_rule(self, args):
return ipXtables.common_reverse_rule(args)
def check_passthrough(self, args):
ipXtables.common_check_passthrough(args)
def reverse_passthrough(self, args):
return ipXtables.common_reverse_passthrough(args)
def set_rules(self, rules, log_denied):
temp_file = tempFile()
table = "filter"
table_rules = { }
for _rule in rules:
rule = _rule[:]
self._rule_validate(rule)
# get table form rule
for opt in [ "-t", "--table" ]:
try:
i = rule.index(opt)
except ValueError:
pass
else:
if len(rule) >= i+1:
rule.pop(i)
table = rule.pop(i)
# we can not use joinArgs here, because it would use "'" instead
# of '"' for the start and end of the string, this breaks
# iptables-restore
for i in range(len(rule)):
for c in string.whitespace:
if c in rule[i] and not (rule[i].startswith('"') and
rule[i].endswith('"')):
rule[i] = '"%s"' % rule[i]
table_rules.setdefault(table, []).append(rule)
for table in table_rules:
temp_file.write("*%s\n" % table)
for rule in table_rules[table]:
temp_file.write(" ".join(rule) + "\n")
temp_file.close()
stat = os.stat(temp_file.name)
log.debug2("%s: %s %s", self.__class__, self._restore_command,
"%s: %d" % (temp_file.name, stat.st_size))
args = [ ]
args.append("--noflush")
(status, ret) = runProg(self._restore_command, args,
stdin=temp_file.name)
if log.getDebugLogLevel() > 2:
lines = readfile(temp_file.name)
if lines is not None:
i = 1
for line in lines:
log.debug3("%8d: %s" % (i, line), nofmt=1, nl=0)
if not line.endswith("\n"):
log.debug3("", nofmt=1)
i += 1
os.unlink(temp_file.name)
if status != 0:
raise ValueError("'%s %s' failed: %s" % (self._restore_command,
" ".join(args), ret))
def set_rule(self, rule, log_denied):
self._rule_validate(rule)
return self.__run(rule)
def get_available_tables(self, table=None):
ret = []
tables = [ table ] if table else BUILT_IN_CHAINS.keys()
for table in tables:
if table in self.available_tables:
ret.append(table)
else:
try:
self.__run(["-t", table, "-L"])
self.available_tables.append(table)
ret.append(table)
except ValueError:
log.debug1("ebtables table '%s' does not exist." % table)
return ret
def get_zone_table_chains(self, table):
return {}
def build_flush_rules(self):
rules = []
for table in BUILT_IN_CHAINS.keys():
if table not in self.get_available_tables():
continue
# Flush firewall rules: -F
# Delete firewall chains: -X
# Set counter to zero: -Z
for flag in [ "-F", "-X", "-Z" ]:
rules.append(["-t", table, flag])
return rules
def build_set_policy_rules(self, policy):
rules = []
_policy = "DROP" if policy == "PANIC" else policy
for table in BUILT_IN_CHAINS.keys():
if table not in self.get_available_tables():
continue
for chain in BUILT_IN_CHAINS[table]:
rules.append(["-t", table, "-P", chain, _policy])
return rules
def build_default_tables(self):
# nothing to do, they always exist
return []
def build_default_rules(self, log_denied="off"):
default_rules = []
for table in DEFAULT_RULES:
if table not in self.get_available_tables():
continue
_default_rules = DEFAULT_RULES[table][:]
if log_denied != "off" and table in LOG_RULES:
_default_rules.extend(LOG_RULES[table])
prefix = [ "-t", table ]
for rule in _default_rules:
if type(rule) == list:
default_rules.append(prefix + rule)
else:
default_rules.append(prefix + splitArgs(rule))
return default_rules
def is_ipv_supported(self, ipv):
return ipv == self.ipv
core/rich.py 0000644 00000102070 15035135173 0006776 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2013-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "Rich_Source", "Rich_Destination", "Rich_Service", "Rich_Port",
"Rich_Protocol", "Rich_Masquerade", "Rich_IcmpBlock",
"Rich_IcmpType",
"Rich_SourcePort", "Rich_ForwardPort", "Rich_Log", "Rich_Audit",
"Rich_Accept", "Rich_Reject", "Rich_Drop", "Rich_Mark",
"Rich_Limit", "Rich_Rule" ]
from firewall import functions
from firewall.core.ipset import check_ipset_name
from firewall.core.base import REJECT_TYPES
from firewall import errors
from firewall.errors import FirewallError
class Rich_Source(object):
def __init__(self, addr, mac, ipset, invert=False):
self.addr = addr
if self.addr == "":
self.addr = None
self.mac = mac
if self.mac == "" or self.mac is None:
self.mac = None
elif self.mac is not None:
self.mac = self.mac.upper()
self.ipset = ipset
if self.ipset == "":
self.ipset = None
self.invert = invert
if self.addr is None and self.mac is None and self.ipset is None:
raise FirewallError(errors.INVALID_RULE,
"no address, mac and ipset")
def __str__(self):
ret = 'source%s ' % (" NOT" if self.invert else "")
if self.addr is not None:
return ret + 'address="%s"' % self.addr
elif self.mac is not None:
return ret + 'mac="%s"' % self.mac
elif self.ipset is not None:
return ret + 'ipset="%s"' % self.ipset
else:
raise FirewallError(errors.INVALID_RULE,
"no address, mac and ipset")
class Rich_Destination(object):
def __init__(self, addr, ipset, invert=False):
self.addr = addr
if self.addr == "":
self.addr = None
self.ipset = ipset
if self.ipset == "":
self.ipset = None
self.invert = invert
if self.addr is None and self.ipset is None:
raise FirewallError(errors.INVALID_RULE,
"no address and ipset")
def __str__(self):
ret = 'destination%s ' % (" NOT" if self.invert else "")
if self.addr is not None:
return ret + 'address="%s"' % self.addr
elif self.ipset is not None:
return ret + 'ipset="%s"' % self.ipset
else:
raise FirewallError(errors.INVALID_RULE,
"no address and ipset")
class Rich_Service(object):
def __init__(self, name):
self.name = name
def __str__(self):
return 'service name="%s"' % (self.name)
class Rich_Port(object):
def __init__(self, port, protocol):
self.port = port
self.protocol = protocol
def __str__(self):
return 'port port="%s" protocol="%s"' % (self.port, self.protocol)
class Rich_SourcePort(Rich_Port):
def __str__(self):
return 'source-port port="%s" protocol="%s"' % (self.port,
self.protocol)
class Rich_Protocol(object):
def __init__(self, value):
self.value = value
def __str__(self):
return 'protocol value="%s"' % (self.value)
class Rich_Masquerade(object):
def __init__(self):
pass
def __str__(self):
return 'masquerade'
class Rich_IcmpBlock(object):
def __init__(self, name):
self.name = name
def __str__(self):
return 'icmp-block name="%s"' % (self.name)
class Rich_IcmpType(object):
def __init__(self, name):
self.name = name
def __str__(self):
return 'icmp-type name="%s"' % (self.name)
class Rich_ForwardPort(object):
def __init__(self, port, protocol, to_port, to_address):
self.port = port
self.protocol = protocol
self.to_port = to_port
self.to_address = to_address
# replace None with "" in to_port and/or to_address
if self.to_port is None:
self.to_port = ""
if self.to_address is None:
self.to_address = ""
def __str__(self):
return 'forward-port port="%s" protocol="%s"%s%s' % \
(self.port, self.protocol,
' to-port="%s"' % self.to_port if self.to_port != "" else '',
' to-addr="%s"' % self.to_address if self.to_address != "" else '')
class Rich_Log(object):
def __init__(self, prefix=None, level=None, limit=None):
#TODO check default level in iptables
self.prefix = prefix
self.level = level
self.limit = limit
def __str__(self):
return 'log%s%s%s' % \
(' prefix="%s"' % (self.prefix) if self.prefix else "",
' level="%s"' % (self.level) if self.level else "",
" %s" % self.limit if self.limit else "")
class Rich_Audit(object):
def __init__(self, limit=None):
#TODO check default level in iptables
self.limit = limit
def __str__(self):
return 'audit%s' % (" %s" % self.limit if self.limit else "")
class Rich_Accept(object):
def __init__(self, limit=None):
self.limit = limit
def __str__(self):
return "accept%s" % (" %s" % self.limit if self.limit else "")
class Rich_Reject(object):
def __init__(self, _type=None, limit=None):
self.type = _type
self.limit = limit
def __str__(self):
return "reject%s%s" % (' type="%s"' % self.type if self.type else "",
" %s" % self.limit if self.limit else "")
def check(self, family):
if self.type:
if not family:
raise FirewallError(errors.INVALID_RULE, "When using reject type you must specify also rule family.")
if family in ['ipv4', 'ipv6'] and \
self.type not in REJECT_TYPES[family]:
valid_types = ", ".join(REJECT_TYPES[family])
raise FirewallError(errors.INVALID_RULE, "Wrong reject type %s.\nUse one of: %s." % (self.type, valid_types))
class Rich_Drop(Rich_Accept):
def __str__(self):
return "drop%s" % (" %s" % self.limit if self.limit else "")
class Rich_Mark(object):
def __init__(self, _set, limit=None):
self.set = _set
self.limit = limit
def __str__(self):
return "mark set=%s%s" % (self.set,
" %s" % self.limit if self.limit else "")
def check(self):
if self.set is not None:
x = self.set
else:
raise FirewallError(errors.INVALID_MARK, "no value set")
if "/" in x:
splits = x.split("/")
if len(splits) != 2:
raise FirewallError(errors.INVALID_MARK, x)
if not functions.checkUINT32(splits[0]) or \
not functions.checkUINT32(splits[1]):
# value and mask are uint32
raise FirewallError(errors.INVALID_MARK, x)
else:
if not functions.checkUINT32(x):
# value is uint32
raise FirewallError(errors.INVALID_MARK, x)
DURATION_TO_MULT = {
"s": 1,
"m": 60,
"h": 60 * 60,
"d": 24 * 60 * 60,
}
class Rich_Limit(object):
def __init__(self, value, burst=None):
self.value = value
self.burst = burst
def check(self):
self.value_parse()
self.burst_parse()
@property
def value(self):
return self._value
@value.setter
def value(self, value):
if value is None:
self._value = None
return
try:
rate, duration = self._value_parse(value)
except FirewallError:
# The value is invalid. We cannot normalize it.
v = value
else:
v = f"{rate}/{duration}"
if getattr(self, "_value", None) != v:
self._value = v
@property
def burst(self):
return self._burst
@burst.setter
def burst(self, burst):
if burst is None:
self._burst = None
return
try:
b = self._burst_parse(burst)
except FirewallError:
b = burst
else:
b = str(burst)
if getattr(self, "_burst", None) != b:
self._burst = b
@staticmethod
def _value_parse(value):
splits = None
if "/" in value:
splits = value.split("/")
if not splits or len(splits) != 2:
raise FirewallError(errors.INVALID_LIMIT, value)
(rate, duration) = splits
try:
rate = int(rate)
except:
raise FirewallError(errors.INVALID_LIMIT, value)
if duration in ["second", "minute", "hour", "day"]:
duration = duration[:1]
if rate < 1 or duration not in ["s", "m", "h", "d"]:
raise FirewallError(errors.INVALID_LIMIT, value)
if 10000 * DURATION_TO_MULT[duration] // rate == 0:
raise FirewallError(errors.INVALID_LIMIT, "%s too fast" % (value,))
if rate == 1 and duration == "d":
# iptables (v1.4.21) doesn't accept 1/d
raise FirewallError(errors.INVALID_LIMIT, "%s too slow" % (value,))
return rate, duration
def value_parse(self):
return self._value_parse(self._value)
@staticmethod
def _burst_parse(burst):
if burst is None:
return None
try:
b = int(burst)
except:
raise FirewallError(errors.INVALID_LIMIT, burst)
if b < 1 or b > 10_000_000:
raise FirewallError(errors.INVALID_LIMIT, burst)
return b
def burst_parse(self):
return self._burst_parse(self._burst)
def __str__(self):
s = f'limit value="{self._value}"'
if self._burst is not None:
s += f" burst={self._burst}"
return s
class Rich_Rule(object):
priority_min = -32768
priority_max = 32767
def __init__(self, family=None, rule_str=None, priority=0):
if family is not None:
self.family = str(family)
else:
self.family = None
self.priority = priority
self.source = None
self.destination = None
self.element = None
self.log = None
self.audit = None
self.action = None
if rule_str:
self._import_from_string(rule_str)
def _lexer(self, rule_str):
""" Lexical analysis """
tokens = []
for r in functions.splitArgs(rule_str):
if "=" in r:
attr = r.split('=')
if len(attr) != 2 or not attr[0] or not attr[1]:
raise FirewallError(errors.INVALID_RULE,
'internal error in _lexer(): %s' % r)
tokens.append({'attr_name':attr[0], 'attr_value':attr[1]})
else:
tokens.append({'element':r})
tokens.append({'element':'EOL'})
return tokens
def _import_from_string(self, rule_str):
if not rule_str:
raise FirewallError(errors.INVALID_RULE, 'empty rule')
rule_str = functions.stripNonPrintableCharacters(rule_str)
self.priority = 0
self.family = None
self.source = None
self.destination = None
self.element = None
self.log = None
self.audit = None
self.action = None
tokens = self._lexer(rule_str)
if tokens and tokens[0].get('element') == 'EOL':
raise FirewallError(errors.INVALID_RULE, 'empty rule')
attrs = {} # attributes of elements
in_elements = [] # stack with elements we are in
index = 0 # index into tokens
while not (tokens[index].get('element') == 'EOL' and in_elements == ['rule']):
element = tokens[index].get('element')
attr_name = tokens[index].get('attr_name')
attr_value = tokens[index].get('attr_value')
#print ("in_elements: ", in_elements)
#print ("index: %s, element: %s, attribute: %s=%s" % (index, element, attr_name, attr_value))
if attr_name: # attribute
if attr_name not in ['priority', 'family', 'address', 'mac', 'ipset',
'invert', 'value',
'port', 'protocol', 'to-port', 'to-addr',
'name', 'prefix', 'level', 'type',
'set', 'burst']:
raise FirewallError(errors.INVALID_RULE, "bad attribute '%s'" % attr_name)
else: # element
if element in ['rule', 'source', 'destination', 'protocol',
'service', 'port', 'icmp-block', 'icmp-type', 'masquerade',
'forward-port', 'source-port', 'log', 'audit',
'accept', 'drop', 'reject', 'mark', 'limit', 'not', 'NOT', 'EOL']:
if element == 'source' and self.source:
raise FirewallError(errors.INVALID_RULE, "more than one 'source' element")
elif element == 'destination' and self.destination:
raise FirewallError(errors.INVALID_RULE, "more than one 'destination' element")
elif element in ['protocol', 'service', 'port',
'icmp-block', 'icmp-type',
'masquerade', 'forward-port',
'source-port'] and self.element:
raise FirewallError(errors.INVALID_RULE, "more than one element. There cannot be both '%s' and '%s' in one rule." % (element, self.element))
elif element == 'log' and self.log:
raise FirewallError(errors.INVALID_RULE, "more than one 'log' element")
elif element == 'audit' and self.audit:
raise FirewallError(errors.INVALID_RULE, "more than one 'audit' element")
elif element in ['accept', 'drop', 'reject', 'mark'] and self.action:
raise FirewallError(errors.INVALID_RULE, "more than one 'action' element. There cannot be both '%s' and '%s' in one rule." % (element, self.action))
else:
raise FirewallError(errors.INVALID_RULE, "unknown element %s" % element)
in_element = in_elements[len(in_elements)-1] if len(in_elements) > 0 else ''
if in_element == '':
if not element and attr_name:
if attr_name == 'family':
raise FirewallError(errors.INVALID_RULE, "'family' outside of rule. Use 'rule family=...'.")
elif attr_name == 'priority':
raise FirewallError(errors.INVALID_RULE, "'priority' outside of rule. Use 'rule priority=...'.")
else:
raise FirewallError(errors.INVALID_RULE, "'%s' outside of any element. Use 'rule <element> %s= ...'." % (attr_name, attr_name))
elif 'rule' not in element:
raise FirewallError(errors.INVALID_RULE, "'%s' outside of rule. Use 'rule ... %s ...'." % (element, element))
else:
in_elements.append('rule') # push into stack
elif in_element == 'rule':
if attr_name == 'family':
if attr_value not in ['ipv4', 'ipv6']:
raise FirewallError(errors.INVALID_RULE, "'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead." % attr_value)
self.family = attr_value
elif attr_name == 'priority':
try:
self.priority = int(attr_value)
except ValueError:
raise FirewallError(errors.INVALID_PRIORITY, "invalid 'priority' attribute value '%s'." % attr_value)
elif attr_name:
if attr_name == 'protocol':
err_msg = "wrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'."
else:
err_msg = "attribute '%s' outside of any element. Use 'rule <element> %s= ...'." % (attr_name, attr_name)
raise FirewallError(errors.INVALID_RULE, err_msg)
else:
in_elements.append(element) # push into stack
elif in_element == 'source':
if attr_name in ['address', 'mac', 'ipset', 'invert']:
attrs[attr_name] = attr_value
elif element in ['not', 'NOT']:
attrs['invert'] = True
else:
self.source = Rich_Source(attrs.get('address'), attrs.get('mac'), attrs.get('ipset'), attrs.get('invert', False))
in_elements.pop() # source
attrs.clear()
index = index -1 # return token to input
elif in_element == 'destination':
if attr_name in ['address', 'ipset', 'invert']:
attrs[attr_name] = attr_value
elif element in ['not', 'NOT']:
attrs['invert'] = True
else:
self.destination = Rich_Destination(attrs.get('address'), attrs.get('ipset'), attrs.get('invert', False))
in_elements.pop() # destination
attrs.clear()
index = index -1 # return token to input
elif in_element == 'protocol':
if attr_name == 'value':
self.element = Rich_Protocol(attr_value)
in_elements.pop() # protocol
else:
raise FirewallError(errors.INVALID_RULE, "invalid 'protocol' element")
elif in_element == 'service':
if attr_name == 'name':
self.element = Rich_Service(attr_value)
in_elements.pop() # service
else:
raise FirewallError(errors.INVALID_RULE, "invalid 'service' element")
elif in_element == 'port':
if attr_name in ['port', 'protocol']:
attrs[attr_name] = attr_value
else:
self.element = Rich_Port(attrs.get('port'), attrs.get('protocol'))
in_elements.pop() # port
attrs.clear()
index = index -1 # return token to input
elif in_element == 'icmp-block':
if attr_name == 'name':
self.element = Rich_IcmpBlock(attr_value)
in_elements.pop() # icmp-block
else:
raise FirewallError(errors.INVALID_RULE, "invalid 'icmp-block' element")
elif in_element == 'icmp-type':
if attr_name == 'name':
self.element = Rich_IcmpType(attr_value)
in_elements.pop() # icmp-type
else:
raise FirewallError(errors.INVALID_RULE, "invalid 'icmp-type' element")
elif in_element == 'masquerade':
self.element = Rich_Masquerade()
in_elements.pop()
attrs.clear()
index = index -1 # return token to input
elif in_element == 'forward-port':
if attr_name in ['port', 'protocol', 'to-port', 'to-addr']:
attrs[attr_name] = attr_value
else:
self.element = Rich_ForwardPort(attrs.get('port'), attrs.get('protocol'), attrs.get('to-port'), attrs.get('to-addr'))
in_elements.pop() # forward-port
attrs.clear()
index = index -1 # return token to input
elif in_element == 'source-port':
if attr_name in ['port', 'protocol']:
attrs[attr_name] = attr_value
else:
self.element = Rich_SourcePort(attrs.get('port'), attrs.get('protocol'))
in_elements.pop() # source-port
attrs.clear()
index = index -1 # return token to input
elif in_element == 'log':
if attr_name in ['prefix', 'level']:
attrs[attr_name] = attr_value
elif element == 'limit':
in_elements.append('limit')
else:
self.log = Rich_Log(attrs.get('prefix'), attrs.get('level'), attrs.get('limit'))
in_elements.pop() # log
attrs.clear()
index = index -1 # return token to input
elif in_element == 'audit':
if element == 'limit':
in_elements.append('limit')
else:
self.audit = Rich_Audit(attrs.get('limit'))
in_elements.pop() # audit
attrs.clear()
index = index -1 # return token to input
elif in_element == 'accept':
if element == 'limit':
in_elements.append('limit')
else:
self.action = Rich_Accept(attrs.get('limit'))
in_elements.pop() # accept
attrs.clear()
index = index -1 # return token to input
elif in_element == 'drop':
if element == 'limit':
in_elements.append('limit')
else:
self.action = Rich_Drop(attrs.get('limit'))
in_elements.pop() # drop
attrs.clear()
index = index -1 # return token to input
elif in_element == 'reject':
if attr_name == 'type':
attrs[attr_name] = attr_value
elif element == 'limit':
in_elements.append('limit')
else:
self.action = Rich_Reject(attrs.get('type'), attrs.get('limit'))
in_elements.pop() # accept
attrs.clear()
index = index -1 # return token to input
elif in_element == 'mark':
if attr_name == 'set':
attrs[attr_name] = attr_value
elif element == 'limit':
in_elements.append('limit')
else:
self.action = Rich_Mark(attrs.get('set'),
attrs.get('limit'))
in_elements.pop() # accept
attrs.clear()
index = index -1 # return token to input
elif in_element == 'limit':
if attr_name in ["value", "burst"]:
attrs[f"limit.{attr_name}"] = attr_value
else:
if "limit.value" not in attrs:
raise FirewallError(
errors.INVALID_RULE, "invalid 'limit' element"
)
attrs["limit"] = Rich_Limit(
attrs["limit.value"], attrs.get("limit.burst")
)
attrs.pop("limit.value", None)
attrs.pop("limit.burst", None)
in_elements.pop() # limit
index = index - 1 # return token to input
index = index + 1
self.check()
def check(self):
if self.family is not None and self.family not in [ "ipv4", "ipv6" ]:
raise FirewallError(errors.INVALID_FAMILY, self.family)
if self.family is None:
if (self.source is not None and self.source.addr is not None) or \
self.destination is not None:
raise FirewallError(errors.MISSING_FAMILY)
if type(self.element) == Rich_ForwardPort:
raise FirewallError(errors.MISSING_FAMILY)
if self.priority < self.priority_min or self.priority > self.priority_max:
raise FirewallError(errors.INVALID_PRIORITY, "'priority' attribute must be between %d and %d." \
% (self.priority_min, self.priority_max))
if self.element is None and \
(self.log is None or (self.log is not None and self.priority == 0)):
if self.action is None:
raise FirewallError(errors.INVALID_RULE, "no element, no action")
if self.source is None and self.destination is None and self.priority == 0:
raise FirewallError(errors.INVALID_RULE, "no element, no source, no destination")
if type(self.element) not in [ Rich_IcmpBlock,
Rich_ForwardPort,
Rich_Masquerade ]:
if self.log is None and self.audit is None and \
self.action is None:
raise FirewallError(errors.INVALID_RULE, "no action, no log, no audit")
# source
if self.source is not None:
if self.source.addr is not None:
if self.family is None:
raise FirewallError(errors.INVALID_FAMILY)
if self.source.mac is not None:
raise FirewallError(errors.INVALID_RULE, "address and mac")
if self.source.ipset is not None:
raise FirewallError(errors.INVALID_RULE, "address and ipset")
if not functions.check_address(self.family, self.source.addr):
raise FirewallError(errors.INVALID_ADDR, str(self.source.addr))
elif self.source.mac is not None:
if self.source.ipset is not None:
raise FirewallError(errors.INVALID_RULE, "mac and ipset")
if not functions.check_mac(self.source.mac):
raise FirewallError(errors.INVALID_MAC, str(self.source.mac))
elif self.source.ipset is not None:
if not check_ipset_name(self.source.ipset):
raise FirewallError(errors.INVALID_IPSET, str(self.source.ipset))
else:
raise FirewallError(errors.INVALID_RULE, "invalid source")
# destination
if self.destination is not None:
if self.destination.addr is not None:
if self.family is None:
raise FirewallError(errors.INVALID_FAMILY)
if self.destination.ipset is not None:
raise FirewallError(errors.INVALID_DESTINATION, "address and ipset")
if not functions.check_address(self.family, self.destination.addr):
raise FirewallError(errors.INVALID_ADDR, str(self.destination.addr))
elif self.destination.ipset is not None:
if not check_ipset_name(self.destination.ipset):
raise FirewallError(errors.INVALID_IPSET, str(self.destination.ipset))
else:
raise FirewallError(errors.INVALID_RULE, "invalid destination")
# service
if type(self.element) == Rich_Service:
# service availability needs to be checked in Firewall, here is no
# knowledge about this, therefore only simple check
if self.element.name is None or len(self.element.name) < 1:
raise FirewallError(errors.INVALID_SERVICE, str(self.element.name))
# port
elif type(self.element) == Rich_Port:
if not functions.check_port(self.element.port):
raise FirewallError(errors.INVALID_PORT, self.element.port)
if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]:
raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol)
# protocol
elif type(self.element) == Rich_Protocol:
if not functions.checkProtocol(self.element.value):
raise FirewallError(errors.INVALID_PROTOCOL, self.element.value)
# masquerade
elif type(self.element) == Rich_Masquerade:
if self.action is not None:
raise FirewallError(errors.INVALID_RULE, "masquerade and action")
if self.source is not None and self.source.mac is not None:
raise FirewallError(errors.INVALID_RULE, "masquerade and mac source")
# icmp-block
elif type(self.element) == Rich_IcmpBlock:
# icmp type availability needs to be checked in Firewall, here is no
# knowledge about this, therefore only simple check
if self.element.name is None or len(self.element.name) < 1:
raise FirewallError(errors.INVALID_ICMPTYPE, str(self.element.name))
if self.action:
raise FirewallError(errors.INVALID_RULE, "icmp-block and action")
# icmp-type
elif type(self.element) == Rich_IcmpType:
# icmp type availability needs to be checked in Firewall, here is no
# knowledge about this, therefore only simple check
if self.element.name is None or len(self.element.name) < 1:
raise FirewallError(errors.INVALID_ICMPTYPE, str(self.element.name))
# forward-port
elif type(self.element) == Rich_ForwardPort:
if not functions.check_port(self.element.port):
raise FirewallError(errors.INVALID_PORT, self.element.port)
if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]:
raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol)
if self.element.to_port == "" and self.element.to_address == "":
raise FirewallError(errors.INVALID_PORT, self.element.to_port)
if self.element.to_port != "" and \
not functions.check_port(self.element.to_port):
raise FirewallError(errors.INVALID_PORT, self.element.to_port)
if self.element.to_address != "" and \
not functions.check_single_address(self.family,
self.element.to_address):
raise FirewallError(errors.INVALID_ADDR, self.element.to_address)
if self.family is None:
raise FirewallError(errors.INVALID_FAMILY)
if self.action is not None:
raise FirewallError(errors.INVALID_RULE, "forward-port and action")
# source-port
elif type(self.element) == Rich_SourcePort:
if not functions.check_port(self.element.port):
raise FirewallError(errors.INVALID_PORT, self.element.port)
if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]:
raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol)
# other element and not empty?
elif self.element is not None:
raise FirewallError(errors.INVALID_RULE, "Unknown element %s" %
type(self.element))
# log
if self.log is not None:
if self.log.level and \
self.log.level not in [ "emerg", "alert", "crit", "error",
"warning", "notice", "info", "debug" ]:
raise FirewallError(errors.INVALID_LOG_LEVEL, self.log.level)
if self.log.limit is not None:
self.log.limit.check()
# audit
if self.audit is not None:
if type(self.action) not in [ Rich_Accept, Rich_Reject, Rich_Drop ]:
raise FirewallError(errors.INVALID_AUDIT_TYPE, type(self.action))
if self.audit.limit is not None:
self.audit.limit.check()
# action
if self.action is not None:
if type(self.action) == Rich_Reject:
self.action.check(self.family)
elif type(self.action) == Rich_Mark:
self.action.check()
if self.action.limit is not None:
self.action.limit.check()
def __str__(self):
ret = 'rule'
if self.priority:
ret += ' priority="%d"' % self.priority
if self.family:
ret += ' family="%s"' % self.family
if self.source:
ret += " %s" % self.source
if self.destination:
ret += " %s" % self.destination
if self.element:
ret += " %s" % self.element
if self.log:
ret += " %s" % self.log
if self.audit:
ret += " %s" % self.audit
if self.action:
ret += " %s" % self.action
return (functions.u2b(ret)) if functions.PY2 else ret
#class Rich_RawRule(object):
#class Rich_RuleSet(object):
#class Rich_AddressList(object):
core/fw_config.py 0000644 00000136430 15035135173 0010021 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "FirewallConfig" ]
import copy
import os
import os.path
import shutil
from firewall import config
from firewall.core.logger import log
from firewall.core.io.icmptype import IcmpType, icmptype_reader, icmptype_writer
from firewall.core.io.service import Service, service_reader, service_writer
from firewall.core.io.zone import Zone, zone_reader, zone_writer
from firewall.core.io.ipset import IPSet, ipset_reader, ipset_writer
from firewall.core.io.helper import Helper, helper_reader, helper_writer
from firewall.core.io.policy import Policy, policy_reader, policy_writer
from firewall import errors
from firewall.errors import FirewallError
class FirewallConfig(object):
def __init__(self, fw):
self._fw = fw
self.__init_vars()
def __repr__(self):
return '%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r)' % \
(self.__class__,
self._ipsets, self._icmptypes, self._services, self._zones,
self._helpers, self.policy_objects,
self._builtin_ipsets, self._builtin_icmptypes,
self._builtin_services, self._builtin_zones, self._builtin_helpers,
self._builtin_policy_objects,
self._firewalld_conf, self._policies, self._direct)
def __init_vars(self):
self._ipsets = { }
self._icmptypes = { }
self._services = { }
self._zones = { }
self._helpers = { }
self._policy_objects = { }
self._builtin_ipsets = { }
self._builtin_icmptypes = { }
self._builtin_services = { }
self._builtin_zones = { }
self._builtin_helpers = { }
self._builtin_policy_objects = { }
self._firewalld_conf = None
self._policies = None
self._direct = None
def cleanup(self):
for x in list(self._builtin_ipsets.keys()):
self._builtin_ipsets[x].cleanup()
del self._builtin_ipsets[x]
for x in list(self._ipsets.keys()):
self._ipsets[x].cleanup()
del self._ipsets[x]
for x in list(self._builtin_icmptypes.keys()):
self._builtin_icmptypes[x].cleanup()
del self._builtin_icmptypes[x]
for x in list(self._icmptypes.keys()):
self._icmptypes[x].cleanup()
del self._icmptypes[x]
for x in list(self._builtin_services.keys()):
self._builtin_services[x].cleanup()
del self._builtin_services[x]
for x in list(self._services.keys()):
self._services[x].cleanup()
del self._services[x]
for x in list(self._builtin_zones.keys()):
self._builtin_zones[x].cleanup()
del self._builtin_zones[x]
for x in list(self._zones.keys()):
self._zones[x].cleanup()
del self._zones[x]
for x in list(self._builtin_helpers.keys()):
self._builtin_helpers[x].cleanup()
del self._builtin_helpers[x]
for x in list(self._helpers.keys()):
self._helpers[x].cleanup()
del self._helpers[x]
if self._firewalld_conf:
self._firewalld_conf.cleanup()
del self._firewalld_conf
self._firewalld_conf = None
if self._policies:
self._policies.cleanup()
del self._policies
self._policies = None
if self._direct:
self._direct.cleanup()
del self._direct
self._direct = None
self.__init_vars()
# access check
def lockdown_enabled(self):
return self._fw.policies.query_lockdown()
def access_check(self, key, value):
return self._fw.policies.access_check(key, value)
# firewalld_conf
def set_firewalld_conf(self, conf):
self._firewalld_conf = conf
def get_firewalld_conf(self):
return self._firewalld_conf
def update_firewalld_conf(self):
if not os.path.exists(config.FIREWALLD_CONF):
self._firewalld_conf.clear()
else:
self._firewalld_conf.read()
# policies
def set_policies(self, policies):
self._policies = policies
def get_policies(self):
return self._policies
def update_lockdown_whitelist(self):
if not os.path.exists(config.LOCKDOWN_WHITELIST):
self._policies.lockdown_whitelist.cleanup()
else:
self._policies.lockdown_whitelist.read()
# direct
def set_direct(self, direct):
self._direct = direct
def get_direct(self):
return self._direct
def update_direct(self):
if not os.path.exists(config.FIREWALLD_DIRECT):
self._direct.cleanup()
else:
self._direct.read()
# ipset
def get_ipsets(self):
return sorted(set(list(self._ipsets.keys()) + \
list(self._builtin_ipsets.keys())))
def add_ipset(self, obj):
if obj.builtin:
self._builtin_ipsets[obj.name] = obj
else:
self._ipsets[obj.name] = obj
def get_ipset(self, name):
if name in self._ipsets:
return self._ipsets[name]
elif name in self._builtin_ipsets:
return self._builtin_ipsets[name]
raise FirewallError(errors.INVALID_IPSET, name)
def load_ipset_defaults(self, obj):
if obj.name not in self._ipsets:
raise FirewallError(errors.NO_DEFAULTS, obj.name)
elif self._ipsets[obj.name] != obj:
raise FirewallError(errors.NO_DEFAULTS,
"self._ipsets[%s] != obj" % obj.name)
elif obj.name not in self._builtin_ipsets:
raise FirewallError(errors.NO_DEFAULTS,
"'%s' not a built-in ipset" % obj.name)
self._remove_ipset(obj)
return self._builtin_ipsets[obj.name]
def get_ipset_config(self, obj):
return obj.export_config()
def set_ipset_config(self, obj, conf):
if obj.builtin:
x = copy.copy(obj)
x.import_config(conf)
x.path = config.ETC_FIREWALLD_IPSETS
x.builtin = False
if obj.path != x.path:
x.default = False
self.add_ipset(x)
ipset_writer(x)
return x
else:
obj.import_config(conf)
ipset_writer(obj)
return obj
def new_ipset(self, name, conf):
if name in self._ipsets or name in self._builtin_ipsets:
raise FirewallError(errors.NAME_CONFLICT,
"new_ipset(): '%s'" % name)
x = IPSet()
x.check_name(name)
x.import_config(conf)
x.name = name
x.filename = "%s.xml" % name
x.path = config.ETC_FIREWALLD_IPSETS
# It is not possible to add a new one with a name of a buitin
x.builtin = False
x.default = True
ipset_writer(x)
self.add_ipset(x)
return x
def update_ipset_from_path(self, name):
filename = os.path.basename(name)
path = os.path.dirname(name)
if not os.path.exists(name):
# removed file
if path == config.ETC_FIREWALLD_IPSETS:
# removed custom ipset
for x in self._ipsets.keys():
obj = self._ipsets[x]
if obj.filename == filename:
del self._ipsets[x]
if obj.name in self._builtin_ipsets:
return ("update", self._builtin_ipsets[obj.name])
return ("remove", obj)
else:
# removed builtin ipset
for x in self._builtin_ipsets.keys():
obj = self._builtin_ipsets[x]
if obj.filename == filename:
del self._builtin_ipsets[x]
if obj.name not in self._ipsets:
# update dbus ipset
return ("remove", obj)
else:
# builtin hidden, no update needed
return (None, None)
# ipset not known to firewalld, yet (timeout, ..)
return (None, None)
# new or updated file
log.debug1("Loading ipset file '%s'", name)
try:
obj = ipset_reader(filename, path)
except Exception as msg:
log.error("Failed to load ipset file '%s': %s", filename, msg)
return (None, None)
# new ipset
if obj.name not in self._builtin_ipsets and obj.name not in self._ipsets:
self.add_ipset(obj)
return ("new", obj)
# updated ipset
if path == config.ETC_FIREWALLD_IPSETS:
# custom ipset update
if obj.name in self._ipsets:
obj.default = self._ipsets[obj.name].default
self._ipsets[obj.name] = obj
return ("update", obj)
else:
if obj.name in self._builtin_ipsets:
# builtin ipset update
del self._builtin_ipsets[obj.name]
self._builtin_ipsets[obj.name] = obj
if obj.name not in self._ipsets:
# update dbus ipset
return ("update", obj)
else:
# builtin hidden, no update needed
return (None, None)
# ipset not known to firewalld, yet (timeout, ..)
return (None, None)
def _remove_ipset(self, obj):
if obj.name not in self._ipsets:
raise FirewallError(errors.INVALID_IPSET, obj.name)
if obj.path != config.ETC_FIREWALLD_IPSETS:
raise FirewallError(errors.INVALID_DIRECTORY,
"'%s' != '%s'" % (obj.path,
config.ETC_FIREWALLD_IPSETS))
name = "%s/%s.xml" % (obj.path, obj.name)
try:
shutil.move(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
os.remove(name)
del self._ipsets[obj.name]
def check_builtin_ipset(self, obj):
if obj.builtin or not obj.default:
raise FirewallError(errors.BUILTIN_IPSET,
"'%s' is built-in ipset" % obj.name)
def remove_ipset(self, obj):
self.check_builtin_ipset(obj)
self._remove_ipset(obj)
def rename_ipset(self, obj, name):
self.check_builtin_ipset(obj)
new_ipset = self._copy_ipset(obj, name)
self._remove_ipset(obj)
return new_ipset
def _copy_ipset(self, obj, name):
return self.new_ipset(name, obj.export_config())
# icmptypes
def get_icmptypes(self):
return sorted(set(list(self._icmptypes.keys()) + \
list(self._builtin_icmptypes.keys())))
def add_icmptype(self, obj):
if obj.builtin:
self._builtin_icmptypes[obj.name] = obj
else:
self._icmptypes[obj.name] = obj
def get_icmptype(self, name):
if name in self._icmptypes:
return self._icmptypes[name]
elif name in self._builtin_icmptypes:
return self._builtin_icmptypes[name]
raise FirewallError(errors.INVALID_ICMPTYPE, name)
def load_icmptype_defaults(self, obj):
if obj.name not in self._icmptypes:
raise FirewallError(errors.NO_DEFAULTS, obj.name)
elif self._icmptypes[obj.name] != obj:
raise FirewallError(errors.NO_DEFAULTS,
"self._icmptypes[%s] != obj" % obj.name)
elif obj.name not in self._builtin_icmptypes:
raise FirewallError(errors.NO_DEFAULTS,
"'%s' not a built-in icmptype" % obj.name)
self._remove_icmptype(obj)
return self._builtin_icmptypes[obj.name]
def get_icmptype_config(self, obj):
return obj.export_config()
def set_icmptype_config(self, obj, conf):
if obj.builtin:
x = copy.copy(obj)
x.import_config(conf)
x.path = config.ETC_FIREWALLD_ICMPTYPES
x.builtin = False
if obj.path != x.path:
x.default = False
self.add_icmptype(x)
icmptype_writer(x)
return x
else:
obj.import_config(conf)
icmptype_writer(obj)
return obj
def new_icmptype(self, name, conf):
if name in self._icmptypes or name in self._builtin_icmptypes:
raise FirewallError(errors.NAME_CONFLICT,
"new_icmptype(): '%s'" % name)
x = IcmpType()
x.check_name(name)
x.import_config(conf)
x.name = name
x.filename = "%s.xml" % name
x.path = config.ETC_FIREWALLD_ICMPTYPES
# It is not possible to add a new one with a name of a buitin
x.builtin = False
x.default = True
icmptype_writer(x)
self.add_icmptype(x)
return x
def update_icmptype_from_path(self, name):
filename = os.path.basename(name)
path = os.path.dirname(name)
if not os.path.exists(name):
# removed file
if path == config.ETC_FIREWALLD_ICMPTYPES:
# removed custom icmptype
for x in self._icmptypes.keys():
obj = self._icmptypes[x]
if obj.filename == filename:
del self._icmptypes[x]
if obj.name in self._builtin_icmptypes:
return ("update", self._builtin_icmptypes[obj.name])
return ("remove", obj)
else:
# removed builtin icmptype
for x in self._builtin_icmptypes.keys():
obj = self._builtin_icmptypes[x]
if obj.filename == filename:
del self._builtin_icmptypes[x]
if obj.name not in self._icmptypes:
# update dbus icmptype
return ("remove", obj)
else:
# builtin hidden, no update needed
return (None, None)
# icmptype not known to firewalld, yet (timeout, ..)
return (None, None)
# new or updated file
log.debug1("Loading icmptype file '%s'", name)
try:
obj = icmptype_reader(filename, path)
except Exception as msg:
log.error("Failed to load icmptype file '%s': %s", filename, msg)
return (None, None)
# new icmptype
if obj.name not in self._builtin_icmptypes and obj.name not in self._icmptypes:
self.add_icmptype(obj)
return ("new", obj)
# updated icmptype
if path == config.ETC_FIREWALLD_ICMPTYPES:
# custom icmptype update
if obj.name in self._icmptypes:
obj.default = self._icmptypes[obj.name].default
self._icmptypes[obj.name] = obj
return ("update", obj)
else:
if obj.name in self._builtin_icmptypes:
# builtin icmptype update
del self._builtin_icmptypes[obj.name]
self._builtin_icmptypes[obj.name] = obj
if obj.name not in self._icmptypes:
# update dbus icmptype
return ("update", obj)
else:
# builtin hidden, no update needed
return (None, None)
# icmptype not known to firewalld, yet (timeout, ..)
return (None, None)
def _remove_icmptype(self, obj):
if obj.name not in self._icmptypes:
raise FirewallError(errors.INVALID_ICMPTYPE, obj.name)
if obj.path != config.ETC_FIREWALLD_ICMPTYPES:
raise FirewallError(errors.INVALID_DIRECTORY,
"'%s' != '%s'" % \
(obj.path, config.ETC_FIREWALLD_ICMPTYPES))
name = "%s/%s.xml" % (obj.path, obj.name)
try:
shutil.move(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
os.remove(name)
del self._icmptypes[obj.name]
def check_builtin_icmptype(self, obj):
if obj.builtin or not obj.default:
raise FirewallError(errors.BUILTIN_ICMPTYPE,
"'%s' is built-in icmp type" % obj.name)
def remove_icmptype(self, obj):
self.check_builtin_icmptype(obj)
self._remove_icmptype(obj)
def rename_icmptype(self, obj, name):
self.check_builtin_icmptype(obj)
new_icmptype = self._copy_icmptype(obj, name)
self._remove_icmptype(obj)
return new_icmptype
def _copy_icmptype(self, obj, name):
return self.new_icmptype(name, obj.export_config())
# services
def get_services(self):
return sorted(set(list(self._services.keys()) + \
list(self._builtin_services.keys())))
def add_service(self, obj):
if obj.builtin:
self._builtin_services[obj.name] = obj
else:
self._services[obj.name] = obj
def get_service(self, name):
if name in self._services:
return self._services[name]
elif name in self._builtin_services:
return self._builtin_services[name]
raise FirewallError(errors.INVALID_SERVICE, "get_service(): '%s'" % name)
def load_service_defaults(self, obj):
if obj.name not in self._services:
raise FirewallError(errors.NO_DEFAULTS, obj.name)
elif self._services[obj.name] != obj:
raise FirewallError(errors.NO_DEFAULTS,
"self._services[%s] != obj" % obj.name)
elif obj.name not in self._builtin_services:
raise FirewallError(errors.NO_DEFAULTS,
"'%s' not a built-in service" % obj.name)
self._remove_service(obj)
return self._builtin_services[obj.name]
def get_service_config(self, obj):
conf_dict = obj.export_config_dict()
conf_list = []
for i in range(8): # tuple based dbus API has 8 elements
if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict:
# old API needs the empty elements as well. Grab it from the
# object otherwise we don't know the type.
conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0])))
else:
conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]])
return tuple(conf_list)
def get_service_config_dict(self, obj):
return obj.export_config_dict()
def set_service_config(self, obj, conf):
conf_dict = {}
for i,value in enumerate(conf):
conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]] = value
if obj.builtin:
x = copy.copy(obj)
x.import_config_dict(conf_dict)
x.path = config.ETC_FIREWALLD_SERVICES
x.builtin = False
if obj.path != x.path:
x.default = False
self.add_service(x)
service_writer(x)
return x
else:
obj.import_config_dict(conf_dict)
service_writer(obj)
return obj
def set_service_config_dict(self, obj, conf):
if obj.builtin:
x = copy.copy(obj)
x.import_config_dict(conf)
x.path = config.ETC_FIREWALLD_SERVICES
x.builtin = False
if obj.path != x.path:
x.default = False
self.add_service(x)
service_writer(x)
return x
else:
obj.import_config_dict(conf)
service_writer(obj)
return obj
def new_service(self, name, conf):
if name in self._services or name in self._builtin_services:
raise FirewallError(errors.NAME_CONFLICT,
"new_service(): '%s'" % name)
conf_dict = {}
for i,value in enumerate(conf):
conf_dict[Service.IMPORT_EXPORT_STRUCTURE[i][0]] = value
x = Service()
x.check_name(name)
x.import_config_dict(conf_dict)
x.name = name
x.filename = "%s.xml" % name
x.path = config.ETC_FIREWALLD_SERVICES
# It is not possible to add a new one with a name of a buitin
x.builtin = False
x.default = True
service_writer(x)
self.add_service(x)
return x
def new_service_dict(self, name, conf):
if name in self._services or name in self._builtin_services:
raise FirewallError(errors.NAME_CONFLICT,
"new_service(): '%s'" % name)
x = Service()
x.check_name(name)
x.import_config_dict(conf)
x.name = name
x.filename = "%s.xml" % name
x.path = config.ETC_FIREWALLD_SERVICES
# It is not possible to add a new one with a name of a buitin
x.builtin = False
x.default = True
service_writer(x)
self.add_service(x)
return x
def update_service_from_path(self, name):
filename = os.path.basename(name)
path = os.path.dirname(name)
if not os.path.exists(name):
# removed file
if path == config.ETC_FIREWALLD_SERVICES:
# removed custom service
for x in self._services.keys():
obj = self._services[x]
if obj.filename == filename:
del self._services[x]
if obj.name in self._builtin_services:
return ("update", self._builtin_services[obj.name])
return ("remove", obj)
else:
# removed builtin service
for x in self._builtin_services.keys():
obj = self._builtin_services[x]
if obj.filename == filename:
del self._builtin_services[x]
if obj.name not in self._services:
# update dbus service
return ("remove", obj)
else:
# builtin hidden, no update needed
return (None, None)
# service not known to firewalld, yet (timeout, ..)
return (None, None)
# new or updated file
log.debug1("Loading service file '%s'", name)
try:
obj = service_reader(filename, path)
except Exception as msg:
log.error("Failed to load service file '%s': %s", filename, msg)
return (None, None)
# new service
if obj.name not in self._builtin_services and obj.name not in self._services:
self.add_service(obj)
return ("new", obj)
# updated service
if path == config.ETC_FIREWALLD_SERVICES:
# custom service update
if obj.name in self._services:
obj.default = self._services[obj.name].default
self._services[obj.name] = obj
return ("update", obj)
else:
if obj.name in self._builtin_services:
# builtin service update
del self._builtin_services[obj.name]
self._builtin_services[obj.name] = obj
if obj.name not in self._services:
# update dbus service
return ("update", obj)
else:
# builtin hidden, no update needed
return (None, None)
# service not known to firewalld, yet (timeout, ..)
return (None, None)
def _remove_service(self, obj):
if obj.name not in self._services:
raise FirewallError(errors.INVALID_SERVICE, obj.name)
if obj.path != config.ETC_FIREWALLD_SERVICES:
raise FirewallError(errors.INVALID_DIRECTORY,
"'%s' != '%s'" % \
(obj.path, config.ETC_FIREWALLD_SERVICES))
name = "%s/%s.xml" % (obj.path, obj.name)
try:
shutil.move(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
os.remove(name)
del self._services[obj.name]
def check_builtin_service(self, obj):
if obj.builtin or not obj.default:
raise FirewallError(errors.BUILTIN_SERVICE,
"'%s' is built-in service" % obj.name)
def remove_service(self, obj):
self.check_builtin_service(obj)
self._remove_service(obj)
def rename_service(self, obj, name):
self.check_builtin_service(obj)
new_service = self._copy_service(obj, name)
self._remove_service(obj)
return new_service
def _copy_service(self, obj, name):
return self.new_service_dict(name, obj.export_config_dict())
# zones
def get_zones(self):
return sorted(set(list(self._zones.keys()) + \
list(self._builtin_zones.keys())))
def add_zone(self, obj):
if obj.builtin:
self._builtin_zones[obj.name] = obj
else:
self._zones[obj.name] = obj
def forget_zone(self, name):
if name in self._builtin_zones:
del self._builtin_zones[name]
if name in self._zones:
del self._zones[name]
def get_zone(self, name):
if name in self._zones:
return self._zones[name]
elif name in self._builtin_zones:
return self._builtin_zones[name]
raise FirewallError(errors.INVALID_ZONE, "get_zone(): %s" % name)
def load_zone_defaults(self, obj):
if obj.name not in self._zones:
raise FirewallError(errors.NO_DEFAULTS, obj.name)
elif self._zones[obj.name] != obj:
raise FirewallError(errors.NO_DEFAULTS,
"self._zones[%s] != obj" % obj.name)
elif obj.name not in self._builtin_zones:
raise FirewallError(errors.NO_DEFAULTS,
"'%s' not a built-in zone" % obj.name)
self._remove_zone(obj)
return self._builtin_zones[obj.name]
def get_zone_config(self, obj):
conf_dict = obj.export_config_dict()
conf_list = []
for i in range(16): # tuple based dbus API has 16 elements
if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict:
# old API needs the empty elements as well. Grab it from the
# object otherwise we don't know the type.
conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0])))
else:
conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]])
return tuple(conf_list)
def get_zone_config_dict(self, obj):
return obj.export_config_dict()
def set_zone_config(self, obj, conf):
conf_dict = {}
for i,value in enumerate(conf):
conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]] = value
if obj.builtin:
x = copy.copy(obj)
x.fw_config = self
x.import_config_dict(conf_dict)
x.path = config.ETC_FIREWALLD_ZONES
x.builtin = False
if obj.path != x.path:
x.default = False
self.add_zone(x)
zone_writer(x)
return x
else:
obj.fw_config = self
obj.import_config_dict(conf_dict)
zone_writer(obj)
return obj
def set_zone_config_dict(self, obj, conf):
if obj.builtin:
x = copy.copy(obj)
x.fw_config = self
x.import_config_dict(conf)
x.path = config.ETC_FIREWALLD_ZONES
x.builtin = False
if obj.path != x.path:
x.default = False
self.add_zone(x)
zone_writer(x)
return x
else:
obj.fw_config = self
obj.import_config_dict(conf)
zone_writer(obj)
return obj
def new_zone(self, name, conf):
if name in self._zones or name in self._builtin_zones:
raise FirewallError(errors.NAME_CONFLICT, "new_zone(): '%s'" % name)
conf_dict = {}
for i,value in enumerate(conf):
conf_dict[Zone.IMPORT_EXPORT_STRUCTURE[i][0]] = value
x = Zone()
x.fw_config = self
x.check_name(name)
x.import_config_dict(conf_dict)
x.name = name
x.filename = "%s.xml" % name
x.path = config.ETC_FIREWALLD_ZONES
# It is not possible to add a new one with a name of a buitin
x.builtin = False
x.default = True
zone_writer(x)
self.add_zone(x)
return x
def new_zone_dict(self, name, conf):
if name in self._zones or name in self._builtin_zones:
raise FirewallError(errors.NAME_CONFLICT, "new_zone(): '%s'" % name)
x = Zone()
x.fw_config = self
x.check_name(name)
x.import_config_dict(conf)
x.name = name
x.filename = "%s.xml" % name
x.path = config.ETC_FIREWALLD_ZONES
# It is not possible to add a new one with a name of a buitin
x.builtin = False
x.default = True
zone_writer(x)
self.add_zone(x)
return x
def update_zone_from_path(self, name):
filename = os.path.basename(name)
path = os.path.dirname(name)
if not os.path.exists(name):
# removed file
if path.startswith(config.ETC_FIREWALLD_ZONES):
# removed custom zone
for x in self._zones.keys():
obj = self._zones[x]
if obj.filename == filename:
del self._zones[x]
if obj.name in self._builtin_zones:
return ("update", self._builtin_zones[obj.name])
return ("remove", obj)
else:
# removed builtin zone
for x in self._builtin_zones.keys():
obj = self._builtin_zones[x]
if obj.filename == filename:
del self._builtin_zones[x]
if obj.name not in self._zones:
# update dbus zone
return ("remove", obj)
else:
# builtin hidden, no update needed
return (None, None)
# zone not known to firewalld, yet (timeout, ..)
return (None, None)
# new or updated file
log.debug1("Loading zone file '%s'", name)
try:
obj = zone_reader(filename, path)
except Exception as msg:
log.error("Failed to load zone file '%s': %s", filename, msg)
return (None, None)
obj.fw_config = self
if path.startswith(config.ETC_FIREWALLD_ZONES) and \
len(path) > len(config.ETC_FIREWALLD_ZONES):
# custom combined zone part
obj.name = "%s/%s" % (os.path.basename(path),
os.path.basename(filename)[0:-4])
# new zone
if obj.name not in self._builtin_zones and obj.name not in self._zones:
self.add_zone(obj)
return ("new", obj)
# updated zone
if path.startswith(config.ETC_FIREWALLD_ZONES):
# custom zone update
if obj.name in self._zones:
obj.default = self._zones[obj.name].default
self._zones[obj.name] = obj
return ("update", obj)
else:
if obj.name in self._builtin_zones:
# builtin zone update
del self._builtin_zones[obj.name]
self._builtin_zones[obj.name] = obj
if obj.name not in self._zones:
# update dbus zone
return ("update", obj)
else:
# builtin hidden, no update needed
return (None, None)
# zone not known to firewalld, yet (timeout, ..)
return (None, None)
def _remove_zone(self, obj):
if obj.name not in self._zones:
raise FirewallError(errors.INVALID_ZONE, obj.name)
if not obj.path.startswith(config.ETC_FIREWALLD_ZONES):
raise FirewallError(errors.INVALID_DIRECTORY,
"'%s' doesn't start with '%s'" % \
(obj.path, config.ETC_FIREWALLD_ZONES))
name = "%s/%s.xml" % (obj.path, obj.name)
try:
shutil.move(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
os.remove(name)
del self._zones[obj.name]
def check_builtin_zone(self, obj):
if obj.builtin or not obj.default:
raise FirewallError(errors.BUILTIN_ZONE,
"'%s' is built-in zone" % obj.name)
def remove_zone(self, obj):
self.check_builtin_zone(obj)
self._remove_zone(obj)
def rename_zone(self, obj, name):
self.check_builtin_zone(obj)
obj_conf = obj.export_config_dict()
self._remove_zone(obj)
try:
new_zone = self.new_zone_dict(name, obj_conf)
except:
# re-add original if rename failed
self.new_zone_dict(obj.name, obj_conf)
raise
return new_zone
# policy objects
def get_policy_objects(self):
return sorted(set(list(self._policy_objects.keys()) + \
list(self._builtin_policy_objects.keys())))
def add_policy_object(self, obj):
if obj.builtin:
self._builtin_policy_objects[obj.name] = obj
else:
self._policy_objects[obj.name] = obj
def get_policy_object(self, name):
if name in self._policy_objects:
return self._policy_objects[name]
elif name in self._builtin_policy_objects:
return self._builtin_policy_objects[name]
raise FirewallError(errors.INVALID_POLICY, "get_policy_object(): %s" % name)
def load_policy_object_defaults(self, obj):
if obj.name not in self._policy_objects:
raise FirewallError(errors.NO_DEFAULTS, obj.name)
elif self._policy_objects[obj.name] != obj:
raise FirewallError(errors.NO_DEFAULTS,
"self._policy_objects[%s] != obj" % obj.name)
elif obj.name not in self._builtin_policy_objects:
raise FirewallError(errors.NO_DEFAULTS,
"'%s' not a built-in policy" % obj.name)
self._remove_policy_object(obj)
return self._builtin_policy_objects[obj.name]
def get_policy_object_config_dict(self, obj):
return obj.export_config_dict()
def set_policy_object_config_dict(self, obj, conf):
if obj.builtin:
x = copy.copy(obj)
x.fw_config = self
x.import_config_dict(conf)
x.path = config.ETC_FIREWALLD_POLICIES
x.builtin = False
if obj.path != x.path:
x.default = False
self.add_policy_object(x)
policy_writer(x)
return x
else:
obj.fw_config = self
obj.import_config_dict(conf)
policy_writer(obj)
return obj
def new_policy_object_dict(self, name, conf):
if name in self._policy_objects or name in self._builtin_policy_objects:
raise FirewallError(errors.NAME_CONFLICT, "new_policy_object(): '%s'" % name)
x = Policy()
x.fw_config = self
x.check_name(name)
x.import_config_dict(conf)
x.name = name
x.filename = "%s.xml" % name
x.path = config.ETC_FIREWALLD_POLICIES
# It is not possible to add a new one with a name of a buitin
x.builtin = False
x.default = True
policy_writer(x)
self.add_policy_object(x)
return x
def update_policy_object_from_path(self, name):
filename = os.path.basename(name)
path = os.path.dirname(name)
if not os.path.exists(name):
# removed file
if path.startswith(config.ETC_FIREWALLD_POLICIES):
# removed custom policy_object
for x in self._policy_objects.keys():
obj = self._policy_objects[x]
if obj.filename == filename:
del self._policy_objects[x]
if obj.name in self._builtin_policy_objects:
return ("update", self._builtin_policy_objects[obj.name])
return ("remove", obj)
else:
# removed builtin policy_object
for x in self._builtin_policy_objects.keys():
obj = self._builtin_policy_objects[x]
if obj.filename == filename:
del self._builtin_policy_objects[x]
if obj.name not in self._policy_objects:
# update dbus policy_object
return ("remove", obj)
else:
# builtin hidden, no update needed
return (None, None)
# policy_object not known to firewalld, yet (timeout, ..)
return (None, None)
# new or updated file
log.debug1("Loading policy file '%s'", name)
try:
obj = policy_reader(filename, path)
except Exception as msg:
log.error("Failed to load policy file '%s': %s", filename, msg)
return (None, None)
obj.fw_config = self
if path.startswith(config.ETC_FIREWALLD_POLICIES) and \
len(path) > len(config.ETC_FIREWALLD_POLICIES):
# custom combined policy_object part
obj.name = "%s/%s" % (os.path.basename(path),
os.path.basename(filename)[0:-4])
# new policy_object
if obj.name not in self._builtin_policy_objects and obj.name not in self._policy_objects:
self.add_policy_object(obj)
return ("new", obj)
# updated policy_object
if path.startswith(config.ETC_FIREWALLD_POLICIES):
# custom policy_object update
if obj.name in self._policy_objects:
obj.default = self._policy_objects[obj.name].default
self._policy_objects[obj.name] = obj
return ("update", obj)
else:
if obj.name in self._builtin_policy_objects:
# builtin policy_object update
del self._builtin_policy_objects[obj.name]
self._builtin_policy_objects[obj.name] = obj
if obj.name not in self._policy_objects:
# update dbus policy_object
return ("update", obj)
else:
# builtin hidden, no update needed
return (None, None)
# policy_object not known to firewalld, yet (timeout, ..)
return (None, None)
def _remove_policy_object(self, obj):
if obj.name not in self._policy_objects:
raise FirewallError(errors.INVALID_POLICY, obj.name)
if not obj.path.startswith(config.ETC_FIREWALLD_POLICIES):
raise FirewallError(errors.INVALID_DIRECTORY,
"'%s' doesn't start with '%s'" % \
(obj.path, config.ETC_FIREWALLD_POLICIES))
name = "%s/%s.xml" % (obj.path, obj.name)
try:
shutil.move(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
os.remove(name)
del self._policy_objects[obj.name]
def check_builtin_policy_object(self, obj):
if obj.builtin or not obj.default:
raise FirewallError(errors.BUILTIN_POLICY,
"'%s' is built-in policy" % obj.name)
def remove_policy_object(self, obj):
self.check_builtin_policy_object(obj)
self._remove_policy_object(obj)
def rename_policy_object(self, obj, name):
self.check_builtin_policy_object(obj)
new_policy_object = self._copy_policy_object(obj, name)
self._remove_policy_object(obj)
return new_policy_object
def _copy_policy_object(self, obj, name):
return self.new_policy_object_dict(name, obj.export_config_dict())
# helper
def get_helpers(self):
return sorted(set(list(self._helpers.keys()) + \
list(self._builtin_helpers.keys())))
def add_helper(self, obj):
if obj.builtin:
self._builtin_helpers[obj.name] = obj
else:
self._helpers[obj.name] = obj
def get_helper(self, name):
if name in self._helpers:
return self._helpers[name]
elif name in self._builtin_helpers:
return self._builtin_helpers[name]
raise FirewallError(errors.INVALID_HELPER, name)
def load_helper_defaults(self, obj):
if obj.name not in self._helpers:
raise FirewallError(errors.NO_DEFAULTS, obj.name)
elif self._helpers[obj.name] != obj:
raise FirewallError(errors.NO_DEFAULTS,
"self._helpers[%s] != obj" % obj.name)
elif obj.name not in self._builtin_helpers:
raise FirewallError(errors.NO_DEFAULTS,
"'%s' not a built-in helper" % obj.name)
self._remove_helper(obj)
return self._builtin_helpers[obj.name]
def get_helper_config(self, obj):
return obj.export_config()
def set_helper_config(self, obj, conf):
if obj.builtin:
x = copy.copy(obj)
x.import_config(conf)
x.path = config.ETC_FIREWALLD_HELPERS
x.builtin = False
if obj.path != x.path:
x.default = False
self.add_helper(x)
helper_writer(x)
return x
else:
obj.import_config(conf)
helper_writer(obj)
return obj
def new_helper(self, name, conf):
if name in self._helpers or name in self._builtin_helpers:
raise FirewallError(errors.NAME_CONFLICT,
"new_helper(): '%s'" % name)
x = Helper()
x.check_name(name)
x.import_config(conf)
x.name = name
x.filename = "%s.xml" % name
x.path = config.ETC_FIREWALLD_HELPERS
# It is not possible to add a new one with a name of a buitin
x.builtin = False
x.default = True
helper_writer(x)
self.add_helper(x)
return x
def update_helper_from_path(self, name):
filename = os.path.basename(name)
path = os.path.dirname(name)
if not os.path.exists(name):
# removed file
if path == config.ETC_FIREWALLD_HELPERS:
# removed custom helper
for x in self._helpers.keys():
obj = self._helpers[x]
if obj.filename == filename:
del self._helpers[x]
if obj.name in self._builtin_helpers:
return ("update", self._builtin_helpers[obj.name])
return ("remove", obj)
else:
# removed builtin helper
for x in self._builtin_helpers.keys():
obj = self._builtin_helpers[x]
if obj.filename == filename:
del self._builtin_helpers[x]
if obj.name not in self._helpers:
# update dbus helper
return ("remove", obj)
else:
# builtin hidden, no update needed
return (None, None)
# helper not known to firewalld, yet (timeout, ..)
return (None, None)
# new or updated file
log.debug1("Loading helper file '%s'", name)
try:
obj = helper_reader(filename, path)
except Exception as msg:
log.error("Failed to load helper file '%s': %s", filename, msg)
return (None, None)
# new helper
if obj.name not in self._builtin_helpers and obj.name not in self._helpers:
self.add_helper(obj)
return ("new", obj)
# updated helper
if path == config.ETC_FIREWALLD_HELPERS:
# custom helper update
if obj.name in self._helpers:
obj.default = self._helpers[obj.name].default
self._helpers[obj.name] = obj
return ("update", obj)
else:
if obj.name in self._builtin_helpers:
# builtin helper update
del self._builtin_helpers[obj.name]
self._builtin_helpers[obj.name] = obj
if obj.name not in self._helpers:
# update dbus helper
return ("update", obj)
else:
# builtin hidden, no update needed
return (None, None)
# helper not known to firewalld, yet (timeout, ..)
return (None, None)
def _remove_helper(self, obj):
if obj.name not in self._helpers:
raise FirewallError(errors.INVALID_HELPER, obj.name)
if obj.path != config.ETC_FIREWALLD_HELPERS:
raise FirewallError(errors.INVALID_DIRECTORY,
"'%s' != '%s'" % (obj.path,
config.ETC_FIREWALLD_HELPERS))
name = "%s/%s.xml" % (obj.path, obj.name)
try:
shutil.move(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
os.remove(name)
del self._helpers[obj.name]
def check_builtin_helper(self, obj):
if obj.builtin or not obj.default:
raise FirewallError(errors.BUILTIN_HELPER,
"'%s' is built-in helper" % obj.name)
def remove_helper(self, obj):
self.check_builtin_helper(obj)
self._remove_helper(obj)
def rename_helper(self, obj, name):
self.check_builtin_helper(obj)
new_helper = self._copy_helper(obj, name)
self._remove_helper(obj)
return new_helper
def _copy_helper(self, obj, name):
return self.new_helper(name, obj.export_config())
core/logger.py 0000644 00000074476 15035135173 0007352 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2005-2007,2012 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "LogTarget", "FileLog", "Logger", "log" ]
import sys
import types
import time
import inspect
import fnmatch
import syslog
import traceback
import fcntl
import os.path
import os
# ---------------------------------------------------------------------------
# abstract class for logging targets
class LogTarget(object):
""" Abstract class for logging targets. """
def __init__(self):
self.fd = None
def write(self, data, level, logger, is_debug=0):
raise NotImplementedError("LogTarget.write is an abstract method")
def flush(self):
raise NotImplementedError("LogTarget.flush is an abstract method")
def close(self):
raise NotImplementedError("LogTarget.close is an abstract method")
# ---------------------------------------------------------------------------
# private class for stdout
class _StdoutLog(LogTarget):
def __init__(self):
LogTarget.__init__(self)
self.fd = sys.stdout
def write(self, data, level, logger, is_debug=0):
# ignore level
self.fd.write(data)
self.flush()
def close(self):
self.flush()
def flush(self):
self.fd.flush()
# ---------------------------------------------------------------------------
# private class for stderr
class _StderrLog(_StdoutLog):
def __init__(self):
_StdoutLog.__init__(self)
self.fd = sys.stderr
# ---------------------------------------------------------------------------
# private class for syslog
class _SyslogLog(LogTarget):
def __init__(self):
# Only initialize LogTarget here as fs should be None
LogTarget.__init__(self)
#
# Derived from: https://github.com/canvon/firewalld/commit/af0edfee1cc1891b7b13f302ca5911b24e9b0f13
#
# Work around Python issue 27875, "Syslogs /usr/sbin/foo as /foo
# instead of as foo"
# (but using openlog explicitly might be better anyway)
#
# Set ident to basename, log PID as well, and log to facility "daemon".
syslog.openlog(os.path.basename(sys.argv[0]),
syslog.LOG_PID, syslog.LOG_DAEMON)
def write(self, data, level, logger, is_debug=0):
priority = None
if is_debug:
priority = syslog.LOG_DEBUG
else:
if level >= logger.INFO1:
priority = syslog.LOG_INFO
elif level == logger.WARNING:
priority = syslog.LOG_WARNING
elif level == logger.ERROR:
priority = syslog.LOG_ERR
elif level == logger.FATAL:
priority = syslog.LOG_CRIT
if data.endswith("\n"):
data = data[:len(data)-1]
if len(data) > 0:
if priority is None:
syslog.syslog(data)
else:
syslog.syslog(priority, data)
def close(self):
syslog.closelog()
def flush(self):
pass
# ---------------------------------------------------------------------------
class FileLog(LogTarget):
""" FileLog class.
File will be opened on the first write. """
def __init__(self, filename, mode="w"):
LogTarget.__init__(self)
self.filename = filename
self.mode = mode
def open(self):
if self.fd:
return
flags = os.O_CREAT | os.O_WRONLY
if self.mode.startswith('a'):
flags |= os.O_APPEND
self.fd = os.open(self.filename, flags, 0o640)
# Make sure that existing file has correct perms
os.fchmod(self.fd, 0o640)
# Make it an object
self.fd = os.fdopen(self.fd, self.mode)
fcntl.fcntl(self.fd, fcntl.F_SETFD, fcntl.FD_CLOEXEC)
def write(self, data, level, logger, is_debug=0):
if not self.fd:
self.open()
self.fd.write(data)
self.fd.flush()
def close(self):
if not self.fd:
return
self.fd.close()
self.fd = None
def flush(self):
if not self.fd:
return
self.fd.flush()
# ---------------------------------------------------------------------------
class Logger(object):
r"""
Format string:
%(class)s Calling class the function belongs to, else empty
%(date)s Date using Logger.date_format, see time module
%(domain)s Full Domain: %(module)s.%(class)s.%(function)s
%(file)s Filename of the module
%(function)s Function name, empty in __main__
%(label)s Label according to log function call from Logger.label
%(level)d Internal logging level
%(line)d Line number in module
%(module)s Module name
%(message)s Log message
Standard levels:
FATAL Fatal error messages
ERROR Error messages
WARNING Warning messages
INFOx, x in [1..5] Information
DEBUGy, y in [1..10] Debug messages
NO_INFO No info output
NO_DEBUG No debug output
INFO_MAX Maximum info level
DEBUG_MAX Maximum debug level
x and y depend on info_max and debug_max from Logger class
initialization. See __init__ function.
Default logging targets:
stdout Logs to stdout
stderr Logs to stderr
syslog Logs to syslog
Additional arguments for logging functions (fatal, error, warning, info
and debug):
nl Disable newline at the end with nl=0, default is nl=1.
fmt Format string for this logging entry, overloads global format
string. Example: fmt="%(file)s:%(line)d %(message)s"
nofmt Only output message with nofmt=1. The nofmt argument wins over
the fmt argument.
Example:
from logger import log
log.setInfoLogLevel(log.INFO1)
log.setDebugLogLevel(log.DEBUG1)
for i in range(1, log.INFO_MAX+1):
log.setInfoLogLabel(i, "INFO%d: " % i)
log.setFormat("%(date)s %(module)s:%(line)d [%(domain)s] %(label)s: "
"%(level)d %(message)s")
log.setDateFormat("%Y-%m-%d %H:%M:%S")
fl = FileLog("/tmp/log", "a")
log.addInfoLogging("*", fl)
log.addDebugLogging("*", fl)
log.addInfoLogging("*", log.syslog, fmt="%(label)s%(message)s")
log.debug3("debug3")
log.debug2("debug2")
log.debug1("debug1")
log.info2("info2")
log.info1("info1")
log.warning("warning\n", nl=0)
log.error("error\n", nl=0)
log.fatal("fatal")
log.info(log.INFO1, "nofmt info", nofmt=1)
"""
ALL = -5
NOTHING = -4
FATAL = -3
TRACEBACK = -2
ERROR = -1
WARNING = 0
# Additional levels are generated in class initilization
stdout = _StdoutLog()
stderr = _StderrLog()
syslog = _SyslogLog()
def __init__(self, info_max=5, debug_max=10):
""" Logger class initialization """
self._level = { }
self._debug_level = { }
self._format = ""
self._date_format = ""
self._label = { }
self._debug_label = { }
self._logging = { }
self._debug_logging = { }
self._domains = { }
self._debug_domains = { }
# INFO1 is required for standard log level
if info_max < 1:
raise ValueError("Logger: info_max %d is too low" % info_max)
if debug_max < 0:
raise ValueError("Logger: debug_max %d is too low" % debug_max)
self.NO_INFO = self.WARNING # = 0
self.INFO_MAX = info_max
self.NO_DEBUG = 0
self.DEBUG_MAX = debug_max
self.setInfoLogLabel(self.FATAL, "FATAL ERROR: ")
self.setInfoLogLabel(self.TRACEBACK, "")
self.setInfoLogLabel(self.ERROR, "ERROR: ")
self.setInfoLogLabel(self.WARNING, "WARNING: ")
# generate info levels and infox functions
for _level in range(1, self.INFO_MAX+1):
setattr(self, "INFO%d" % _level, _level)
self.setInfoLogLabel(_level, "")
setattr(self, "info%d" % (_level),
(lambda self, x:
lambda message, *args, **kwargs:
self.info(x, message, *args, **kwargs))(self, _level)) # pylint: disable=E0602
# generate debug levels and debugx functions
for _level in range(1, self.DEBUG_MAX+1):
setattr(self, "DEBUG%d" % _level, _level)
self.setDebugLogLabel(_level, "DEBUG%d: " % _level)
setattr(self, "debug%d" % (_level),
(lambda self, x:
lambda message, *args, **kwargs:
self.debug(x, message, *args, **kwargs))(self, _level)) # pylint: disable=E0602
# set initial log levels, formats and targets
self.setInfoLogLevel(self.INFO1)
self.setDebugLogLevel(self.NO_DEBUG)
self.setFormat("%(label)s%(message)s")
self.setDateFormat("%d %b %Y %H:%M:%S")
self.setInfoLogging("*", self.stderr, [ self.FATAL, self.ERROR,
self.WARNING ])
self.setInfoLogging("*", self.stdout,
[ i for i in range(self.INFO1, self.INFO_MAX+1) ])
self.setDebugLogging("*", self.stdout,
[ i for i in range(1, self.DEBUG_MAX+1) ])
def close(self):
""" Close all logging targets """
for level in range(self.FATAL, self.DEBUG_MAX+1):
if level not in self._logging:
continue
for (dummy, target, dummy) in self._logging[level]:
target.close()
def getInfoLogLevel(self, domain="*"):
""" Get info log level. """
self._checkDomain(domain)
if domain in self._level:
return self._level[domain]
return self.NOTHING
def setInfoLogLevel(self, level, domain="*"):
""" Set log level [NOTHING .. INFO_MAX] """
self._checkDomain(domain)
if level < self.NOTHING:
level = self.NOTHING
if level > self.INFO_MAX:
level = self.INFO_MAX
self._level[domain] = level
def getDebugLogLevel(self, domain="*"):
""" Get debug log level. """
self._checkDomain(domain)
if domain in self._debug_level:
return self._debug_level[domain] + self.NO_DEBUG
return self.NO_DEBUG
def setDebugLogLevel(self, level, domain="*"):
""" Set debug log level [NO_DEBUG .. DEBUG_MAX] """
self._checkDomain(domain)
if level < 0:
level = 0
if level > self.DEBUG_MAX:
level = self.DEBUG_MAX
self._debug_level[domain] = level - self.NO_DEBUG
def getFormat(self):
return self._format
def setFormat(self, _format):
self._format = _format
def getDateFormat(self):
return self._date_format
def setDateFormat(self, _format):
self._date_format = _format
def setInfoLogLabel(self, level, label):
""" Set log label for level. Level can be a single level or an array
of levels. """
levels = self._getLevels(level)
for level in levels:
self._checkLogLevel(level, min_level=self.FATAL,
max_level=self.INFO_MAX)
self._label[level] = label
def setDebugLogLabel(self, level, label):
""" Set log label for level. Level can be a single level or an array
of levels. """
levels = self._getLevels(level, is_debug=1)
for level in levels:
self._checkLogLevel(level, min_level=self.INFO1,
max_level=self.DEBUG_MAX)
self._debug_label[level] = label
def setInfoLogging(self, domain, target, level=ALL, fmt=None):
""" Set info log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. """
self._setLogging(domain, target, level, fmt, is_debug=0)
def setDebugLogging(self, domain, target, level=ALL, fmt=None):
""" Set debug log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. """
self._setLogging(domain, target, level, fmt, is_debug=1)
def addInfoLogging(self, domain, target, level=ALL, fmt=None):
""" Add info log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. """
self._addLogging(domain, target, level, fmt, is_debug=0)
def addDebugLogging(self, domain, target, level=ALL, fmt=None):
""" Add debg log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. """
self._addLogging(domain, target, level, fmt, is_debug=1)
def delInfoLogging(self, domain, target, level=ALL, fmt=None):
""" Delete info log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. """
self._delLogging(domain, target, level, fmt, is_debug=0)
def delDebugLogging(self, domain, target, level=ALL, fmt=None):
""" Delete debug log target for domain and level. Level can be a single
level or an array of levels. Use level ALL to set for all levels.
If no format is specified, the default format will be used. """
self._delLogging(domain, target, level, fmt, is_debug=1)
def isInfoLoggingHere(self, level):
""" Is there currently any info logging for this log level (and
domain)? """
return self._isLoggingHere(level, is_debug=0)
def isDebugLoggingHere(self, level):
""" Is there currently any debug logging for this log level (and
domain)? """
return self._isLoggingHere(level, is_debug=1)
### log functions
def fatal(self, _format, *args, **kwargs):
""" Fatal error log. """
self._checkKWargs(kwargs)
kwargs["is_debug"] = 0
self._log(self.FATAL, _format, *args, **kwargs)
def error(self, _format, *args, **kwargs):
""" Error log. """
self._checkKWargs(kwargs)
kwargs["is_debug"] = 0
self._log(self.ERROR, _format, *args, **kwargs)
def warning(self, _format, *args, **kwargs):
""" Warning log. """
self._checkKWargs(kwargs)
kwargs["is_debug"] = 0
self._log(self.WARNING, _format, *args, **kwargs)
def info(self, level, _format, *args, **kwargs):
""" Information log using info level [1..info_max].
There are additional infox functions according to info_max from
__init__"""
self._checkLogLevel(level, min_level=1, max_level=self.INFO_MAX)
self._checkKWargs(kwargs)
kwargs["is_debug"] = 0
self._log(level+self.NO_INFO, _format, *args, **kwargs)
def debug(self, level, _format, *args, **kwargs):
""" Debug log using debug level [1..debug_max].
There are additional debugx functions according to debug_max
from __init__"""
self._checkLogLevel(level, min_level=1, max_level=self.DEBUG_MAX)
self._checkKWargs(kwargs)
kwargs["is_debug"] = 1
self._log(level, _format, *args, **kwargs)
def exception(self):
self._log(self.TRACEBACK, traceback.format_exc(), args=[], kwargs={})
### internal functions
def _checkLogLevel(self, level, min_level, max_level):
if level < min_level or level > max_level:
raise ValueError("Level %d out of range, should be [%d..%d]." % \
(level, min_level, max_level))
def _checkKWargs(self, kwargs):
if not kwargs:
return
for key in kwargs.keys():
if key not in [ "nl", "fmt", "nofmt" ]:
raise ValueError("Key '%s' is not allowed as argument for logging." % key)
def _checkDomain(self, domain):
if not domain or domain == "":
raise ValueError("Domain '%s' is not valid." % domain)
def _getLevels(self, level, is_debug=0):
""" Generate log level array. """
if level != self.ALL:
if isinstance(level, list) or isinstance(level, tuple):
levels = level
else:
levels = [ level ]
for level in levels:
if is_debug:
self._checkLogLevel(level, min_level=1,
max_level=self.DEBUG_MAX)
else:
self._checkLogLevel(level, min_level=self.FATAL,
max_level=self.INFO_MAX)
else:
if is_debug:
levels = [ i for i in range(self.DEBUG1, self.DEBUG_MAX) ]
else:
levels = [ i for i in range(self.FATAL, self.INFO_MAX) ]
return levels
def _getTargets(self, target):
""" Generate target array. """
if isinstance(target, list) or isinstance(target, tuple):
targets = target
else:
targets = [ target ]
for _target in targets:
if not issubclass(_target.__class__, LogTarget):
raise ValueError("'%s' is no valid logging target." % \
_target.__class__.__name__)
return targets
def _genDomains(self, is_debug=0):
# private method for self._domains array creation, speeds up
""" Generate dict with domain by level. """
if is_debug:
_domains = self._debug_domains
_logging = self._debug_logging
_range = ( 1, self.DEBUG_MAX+1 )
else:
_domains = self._domains
_logging = self._logging
_range = ( self.FATAL, self.INFO_MAX+1 )
if len(_domains) > 0:
_domains.clear()
for level in range(_range[0], _range[1]):
if level not in _logging:
continue
for (domain, dummy, dummy) in _logging[level]:
if domain not in _domains:
_domains.setdefault(level, [ ]).append(domain)
def _setLogging(self, domain, target, level=ALL, fmt=None, is_debug=0):
self._checkDomain(domain)
levels = self._getLevels(level, is_debug)
targets = self._getTargets(target)
if is_debug:
_logging = self._debug_logging
else:
_logging = self._logging
for level in levels:
for target in targets:
_logging[level] = [ (domain, target, fmt) ]
self._genDomains(is_debug)
def _addLogging(self, domain, target, level=ALL, fmt=None, is_debug=0):
self._checkDomain(domain)
levels = self._getLevels(level, is_debug)
targets = self._getTargets(target)
if is_debug:
_logging = self._debug_logging
else:
_logging = self._logging
for level in levels:
for target in targets:
_logging.setdefault(level, [ ]).append((domain, target, fmt))
self._genDomains(is_debug)
def _delLogging(self, domain, target, level=ALL, fmt=None, is_debug=0):
self._checkDomain(domain)
levels = self._getLevels(level, is_debug)
targets = self._getTargets(target)
if is_debug:
_logging = self._debug_logging
else:
_logging = self._logging
for _level in levels:
for target in targets:
if _level not in _logging:
continue
if (domain, target, fmt) in _logging[_level]:
_logging[_level].remove( (domain, target, fmt) )
if len(_logging[_level]) == 0:
del _logging[_level]
continue
if level != self.ALL:
raise ValueError("No mathing logging for " \
"level %d, domain %s, target %s and format %s." % \
(_level, domain, target.__class__.__name__, fmt))
self._genDomains(is_debug)
def _isLoggingHere(self, level, is_debug=0):
_dict = self._genDict(level, is_debug)
if not _dict:
return False
point_domain = _dict["domain"] + "."
if is_debug:
_logging = self._debug_logging
else:
_logging = self._logging
# do we need to log?
for (domain, dummy, dummy) in _logging[level]:
if domain == "*" or \
point_domain.startswith(domain) or \
fnmatch.fnmatchcase(_dict["domain"], domain):
return True
return False
def _getClass(self, frame):
""" Function to get calling class. Returns class or None. """
# get class by first function argument, if there are any
if frame.f_code.co_argcount > 0:
selfname = frame.f_code.co_varnames[0]
if selfname in frame.f_locals:
_self = frame.f_locals[selfname]
obj = self._getClass2(_self.__class__, frame.f_code)
if obj:
return obj
module = inspect.getmodule(frame.f_code)
code = frame.f_code
# function in module?
if code.co_name in module.__dict__:
if hasattr(module.__dict__[code.co_name], "func_code") and \
module.__dict__[code.co_name].__code__ == code:
return None
# class in module
for (dummy, obj) in module.__dict__.items():
if isinstance(obj, types.ClassType):
if hasattr(obj, code.co_name):
value = getattr(obj, code.co_name)
if isinstance(value, types.FunctionType):
if value.__code__ == code:
return obj
# nothing found
return None
def _getClass2(self, obj, code):
""" Internal function to get calling class. Returns class or None. """
for value in obj.__dict__.values():
if isinstance(value, types.FunctionType):
if value.__code__ == code:
return obj
for base in obj.__bases__:
_obj = self._getClass2(base, code)
if _obj:
return _obj
return None
# internal log class
def _log(self, level, _format, *args, **kwargs):
is_debug = 0
if "is_debug" in kwargs:
is_debug = kwargs["is_debug"]
nl = 1
if "nl" in kwargs:
nl = kwargs["nl"]
nofmt = 0
if "nofmt" in kwargs:
nofmt = kwargs["nofmt"]
_dict = self._genDict(level, is_debug)
if not _dict:
return
if len(args) > 1:
_dict['message'] = _format % args
elif len(args) == 1: # needed for _format % _dict
_dict['message'] = _format % args[0]
else:
_dict['message'] = _format
point_domain = _dict["domain"] + "."
if is_debug:
_logging = self._debug_logging
else:
_logging = self._logging
used_targets = [ ]
# log to target(s)
for (domain, target, _format) in _logging[level]:
if target in used_targets:
continue
if domain == "*" \
or point_domain.startswith(domain+".") \
or fnmatch.fnmatchcase(_dict["domain"], domain):
if not _format:
_format = self._format
if "fmt" in kwargs:
_format = kwargs["fmt"]
if nofmt:
target.write(_dict["message"], level, self, is_debug)
else:
target.write(_format % _dict, level, self, is_debug)
if nl: # newline
target.write("\n", level, self, is_debug)
used_targets.append(target)
# internal function to generate the dict, needed for logging
def _genDict(self, level, is_debug=0):
""" Internal function. """
check_domains = [ ]
simple_match = False
if is_debug:
_dict = self._debug_level
_domains = self._debug_domains
_label = self._debug_label
else:
_dict = self._level
_domains = self._domains
_label = self._label
# no debug
for domain in _dict:
if domain == "*":
# '*' matches everything: simple match
if _dict[domain] >= level:
simple_match = True
if len(check_domains) > 0:
check_domains = [ ]
break
else:
if _dict[domain] >= level:
check_domains.append(domain)
if not simple_match and len(check_domains) < 1:
return None
if level not in _domains:
return None
f = inspect.currentframe()
# go outside of logger module as long as there is a lower frame
while f and f.f_back and f.f_globals["__name__"] == self.__module__:
f = f.f_back
if not f:
raise ValueError("Frame information not available.")
# get module name
module_name = f.f_globals["__name__"]
# simple module match test for all entries of check_domain
point_module = module_name + "."
for domain in check_domains:
if point_module.startswith(domain):
# found domain in module name
check_domains = [ ]
break
# get code
co = f.f_code
# optimization: bail out early if domain can not match at all
_len = len(module_name)
for domain in _domains[level]:
i = domain.find("*")
if i == 0:
continue
elif i > 0:
d = domain[:i]
else:
d = domain
if _len >= len(d):
if not module_name.startswith(d):
return None
else:
if not d.startswith(module_name):
return None
# generate _dict for format output
level_str = ""
if level in _label:
level_str = _label[level]
_dict = { 'file': co.co_filename,
'line': f.f_lineno,
'module': module_name,
'class': '',
'function': co.co_name,
'domain': '',
'label' : level_str,
'level' : level,
'date' : time.strftime(self._date_format, time.localtime()) }
if _dict["function"] == "?":
_dict["function"] = ""
# domain match needed?
domain_needed = False
for domain in _domains[level]:
# standard domain, matches everything
if domain == "*":
continue
# domain is needed
domain_needed = True
break
# do we need to get the class object?
if self._format.find("%(domain)") >= 0 or \
self._format.find("%(class)") >= 0 or \
domain_needed or \
len(check_domains) > 0:
obj = self._getClass(f)
if obj:
_dict["class"] = obj.__name__
# build domain string
_dict["domain"] = "" + _dict["module"]
if _dict["class"] != "":
_dict["domain"] += "." + _dict["class"]
if _dict["function"] != "":
_dict["domain"] += "." + _dict["function"]
if len(check_domains) < 1:
return _dict
point_domain = _dict["domain"] + "."
for domain in check_domains:
if point_domain.startswith(domain) or \
fnmatch.fnmatchcase(_dict["domain"], domain):
return _dict
return None
# ---------------------------------------------------------------------------
# Global logging object.
log = Logger()
# ---------------------------------------------------------------------------
"""
# Example
if __name__ == '__main__':
log.setInfoLogLevel(log.INFO2)
log.setDebugLogLevel(log.DEBUG5)
for i in range(log.INFO1, log.INFO_MAX+1):
log.setInfoLogLabel(i, "INFO%d: " % i)
for i in range(log.DEBUG1, log.DEBUG_MAX+1):
log.setDebugLogLabel(i, "DEBUG%d: " % i)
log.setFormat("%(date)s %(module)s:%(line)d %(label)s"
"%(message)s")
log.setDateFormat("%Y-%m-%d %H:%M:%S")
fl = FileLog("/tmp/log", "a")
log.addInfoLogging("*", fl)
log.delDebugLogging("*", log.stdout)
log.setDebugLogging("*", log.stdout, [ log.DEBUG1, log.DEBUG2 ] )
log.addDebugLogging("*", fl)
# log.addInfoLogging("*", log.syslog, fmt="%(label)s%(message)s")
# log.addDebugLogging("*", log.syslog, fmt="%(label)s%(message)s")
log.debug10("debug10")
log.debug9("debug9")
log.debug8("debug8")
log.debug7("debug7")
log.debug6("debug6")
log.debug5("debug5")
log.debug4("debug4")
log.debug3("debug3")
log.debug2("debug2", fmt="%(file)s:%(line)d %(message)s")
log.debug1("debug1", nofmt=1)
log.info5("info5")
log.info4("info4")
log.info3("info3")
log.info2("info2")
log.info1("info1")
log.warning("warning\n", nl=0)
log.error("error ", nl=0)
log.error("error", nofmt=1)
log.fatal("fatal")
log.info(log.INFO1, "nofmt info", nofmt=1)
log.info(log.INFO2, "info2 fmt", fmt="%(file)s:%(line)d %(message)s")
try:
a = b
except Exception as e:
log.exception()
"""
# vim:ts=4:sw=4:showmatch:expandtab
core/ipset.py 0000644 00000031161 15035135173 0007177 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2015-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""The ipset command wrapper"""
__all__ = [ "ipset", "check_ipset_name", "remove_default_create_options" ]
import os.path
import ipaddress
from firewall import errors
from firewall.errors import FirewallError
from firewall.core.prog import runProg
from firewall.core.logger import log
from firewall.functions import tempFile, readfile
from firewall.config import COMMANDS
IPSET_MAXNAMELEN = 32
IPSET_TYPES = [
# bitmap and set types are currently not supported
# "bitmap:ip",
# "bitmap:ip,mac",
# "bitmap:port",
# "list:set",
"hash:ip",
"hash:ip,port",
"hash:ip,port,ip",
"hash:ip,port,net",
"hash:ip,mark",
"hash:net",
"hash:net,net",
"hash:net,port",
"hash:net,port,net",
"hash:net,iface",
"hash:mac",
]
IPSET_CREATE_OPTIONS = {
"family": "inet|inet6",
"hashsize": "value",
"maxelem": "value",
"timeout": "value in secs",
#"counters": None,
#"comment": None,
}
IPSET_DEFAULT_CREATE_OPTIONS = {
"family": "inet",
"hashsize": "1024",
"maxelem": "65536",
}
class ipset(object):
"""ipset command wrapper class"""
def __init__(self):
self._command = COMMANDS["ipset"]
self.name = "ipset"
def __run(self, args):
"""Call ipset with args"""
# convert to string list
_args = ["%s" % item for item in args]
log.debug2("%s: %s %s", self.__class__, self._command, " ".join(_args))
(status, ret) = runProg(self._command, _args)
if status != 0:
raise ValueError("'%s %s' failed: %s" % (self._command,
" ".join(_args), ret))
return ret
def check_name(self, name):
"""Check ipset name"""
if len(name) > IPSET_MAXNAMELEN:
raise FirewallError(errors.INVALID_NAME,
"ipset name '%s' is not valid" % name)
def set_supported_types(self):
"""Return types that are supported by the ipset command and kernel"""
ret = [ ]
output = ""
try:
output = self.__run(["--help"])
except ValueError as ex:
log.debug1("ipset error: %s" % ex)
lines = output.splitlines()
in_types = False
for line in lines:
#print(line)
if in_types:
splits = line.strip().split(None, 2)
if splits[0] not in ret and splits[0] in IPSET_TYPES:
ret.append(splits[0])
if line.startswith("Supported set types:"):
in_types = True
return ret
def check_type(self, type_name):
"""Check ipset type"""
if len(type_name) > IPSET_MAXNAMELEN or type_name not in IPSET_TYPES:
raise FirewallError(errors.INVALID_TYPE,
"ipset type name '%s' is not valid" % type_name)
def set_create(self, set_name, type_name, options=None):
"""Create an ipset with name, type and options"""
self.check_name(set_name)
self.check_type(type_name)
args = [ "create", set_name, type_name ]
if isinstance(options, dict):
for key, val in options.items():
args.append(key)
if val != "":
args.append(val)
return self.__run(args)
def set_destroy(self, set_name):
self.check_name(set_name)
return self.__run([ "destroy", set_name ])
def set_add(self, set_name, entry):
args = [ "add", set_name, entry ]
return self.__run(args)
def set_delete(self, set_name, entry):
args = [ "del", set_name, entry ]
return self.__run(args)
def test(self, set_name, entry, options=None):
args = [ "test", set_name, entry ]
if options:
args.append("%s" % " ".join(options))
return self.__run(args)
def set_list(self, set_name=None, options=None):
args = [ "list" ]
if set_name:
args.append(set_name)
if options:
args.extend(options)
return self.__run(args).split("\n")
def set_get_active_terse(self):
""" Get active ipsets (only headers) """
lines = self.set_list(options=["-terse"])
ret = { }
_name = _type = None
_options = { }
for line in lines:
if len(line) < 1:
continue
pair = [ x.strip() for x in line.split(":", 1) ]
if len(pair) != 2:
continue
elif pair[0] == "Name":
_name = pair[1]
elif pair[0] == "Type":
_type = pair[1]
elif pair[0] == "Header":
splits = pair[1].split()
i = 0
while i < len(splits):
opt = splits[i]
if opt in [ "family", "hashsize", "maxelem", "timeout",
"netmask" ]:
if len(splits) > i:
i += 1
_options[opt] = splits[i]
else:
log.error("Malformed ipset list -terse output: %s",
line)
return { }
i += 1
if _name and _type:
ret[_name] = (_type,
remove_default_create_options(_options))
_name = _type = None
_options.clear()
return ret
def save(self, set_name=None):
args = [ "save" ]
if set_name:
args.append(set_name)
return self.__run(args)
def set_restore(self, set_name, type_name, entries,
create_options=None, entry_options=None):
self.check_name(set_name)
self.check_type(type_name)
temp_file = tempFile()
if ' ' in set_name:
set_name = "'%s'" % set_name
args = [ "create", set_name, type_name, "-exist" ]
if create_options:
for key, val in create_options.items():
args.append(key)
if val != "":
args.append(val)
temp_file.write("%s\n" % " ".join(args))
temp_file.write("flush %s\n" % set_name)
for entry in entries:
if ' ' in entry:
entry = "'%s'" % entry
if entry_options:
temp_file.write("add %s %s %s\n" % \
(set_name, entry, " ".join(entry_options)))
else:
temp_file.write("add %s %s\n" % (set_name, entry))
temp_file.close()
stat = os.stat(temp_file.name)
log.debug2("%s: %s restore %s", self.__class__, self._command,
"%s: %d" % (temp_file.name, stat.st_size))
args = [ "restore" ]
(status, ret) = runProg(self._command, args,
stdin=temp_file.name)
if log.getDebugLogLevel() > 2:
try:
readfile(temp_file.name)
except Exception:
pass
else:
i = 1
for line in readfile(temp_file.name):
log.debug3("%8d: %s" % (i, line), nofmt=1, nl=0)
if not line.endswith("\n"):
log.debug3("", nofmt=1)
i += 1
os.unlink(temp_file.name)
if status != 0:
raise ValueError("'%s %s' failed: %s" % (self._command,
" ".join(args), ret))
return ret
def set_flush(self, set_name):
args = [ "flush" ]
if set_name:
args.append(set_name)
return self.__run(args)
def rename(self, old_set_name, new_set_name):
return self.__run([ "rename", old_set_name, new_set_name ])
def swap(self, set_name_1, set_name_2):
return self.__run([ "swap", set_name_1, set_name_2 ])
def version(self):
return self.__run([ "version" ])
def check_ipset_name(name):
"""Return true if ipset name is valid"""
if len(name) > IPSET_MAXNAMELEN:
return False
return True
def remove_default_create_options(options):
""" Return only non default create options """
_options = options.copy()
for opt in IPSET_DEFAULT_CREATE_OPTIONS:
if opt in _options and \
IPSET_DEFAULT_CREATE_OPTIONS[opt] == _options[opt]:
del _options[opt]
return _options
def normalize_ipset_entry(entry):
""" Normalize IP addresses in entry """
_entry = []
for _part in entry.split(","):
try:
_part.index("/")
_entry.append(str(ipaddress.ip_network(_part, strict=False)))
except ValueError:
_entry.append(_part)
return ",".join(_entry)
def check_entry_overlaps_existing(entry, entries):
""" Check if entry overlaps any entry in the list of entries """
# Only check simple types
if len(entry.split(",")) > 1:
return
try:
entry_network = ipaddress.ip_network(entry, strict=False)
except ValueError:
# could not parse the new IP address, maybe a MAC
return
for itr in entries:
if entry_network.overlaps(ipaddress.ip_network(itr, strict=False)):
raise FirewallError(errors.INVALID_ENTRY, "Entry '{}' overlaps with existing entry '{}'".format(entry, itr))
def check_for_overlapping_entries(entries):
""" Check if any entry overlaps any entry in the list of entries """
try:
entries = [ipaddress.ip_network(x, strict=False) for x in entries]
except ValueError:
# at least one entry can not be parsed
return
if len(entries) == 0:
return
# We can take advantage of some facts of IPv4Network/IPv6Network and
# how Python sorts the networks to quickly detect overlaps.
#
# Facts:
#
# 1. IPv{4,6}Network are normalized to remove host bits, e.g.
# 10.1.1.0/16 will become 10.1.0.0/16.
#
# 2. IPv{4,6}Network objects are sorted by:
# a. IP address (network bits)
# then
# b. netmask (significant bits count)
#
# Because of the above we have these properties:
#
# 1. big networks (netA) are sorted before smaller networks (netB)
# that overlap the big network (netA)
# - e.g. 10.1.128.0/17 (netA) sorts before 10.1.129.0/24 (netB)
# 2. same value addresses (network bits) are grouped together even
# if the number of network bits vary. e.g. /16 vs /24
# - recall that address are normalized to remove host bits
# - e.g. 10.1.128.0/17 (netA) sorts before 10.1.128.0/24 (netC)
# 3. non-overlapping networks (netD, netE) are always sorted before or
# after networks that overlap (netB, netC) the current one (netA)
# - e.g. 10.1.128.0/17 (netA) sorts before 10.2.128.0/16 (netD)
# - e.g. 10.1.128.0/17 (netA) sorts after 9.1.128.0/17 (netE)
# - e.g. 9.1.128.0/17 (netE) sorts before 10.1.129.0/24 (netB)
#
# With this we know the sorted list looks like:
#
# list: [ netE, netA, netB, netC, netD ]
#
# netE = non-overlapping network
# netA = big network
# netB = smaller network that overlaps netA (subnet)
# netC = smaller network that overlaps netA (subnet)
# netD = non-overlapping network
#
# If networks netB and netC exist in the list, they overlap and are
# adjacent to netA.
#
# Checking for overlaps on a sorted list is thus:
#
# 1. compare adjacent elements in the list for overlaps
#
# Recall that we only need to detect a single overlap. We do not need to
# detect them all.
#
entries.sort()
prev_network = entries.pop(0)
for current_network in entries:
if prev_network.overlaps(current_network):
raise FirewallError(errors.INVALID_ENTRY, "Entry '{}' overlaps entry '{}'".format(prev_network, current_network))
prev_network = current_network
core/fw_direct.py 0000644 00000053766 15035135173 0010040 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "FirewallDirect" ]
from firewall.fw_types import LastUpdatedOrderedDict
from firewall.core import ipXtables
from firewall.core import ebtables
from firewall.core.fw_transaction import FirewallTransaction
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
############################################################################
#
# class Firewall
#
############################################################################
class FirewallDirect(object):
def __init__(self, fw):
self._fw = fw
self.__init_vars()
def __repr__(self):
return '%s(%r, %r, %r)' % (self.__class__, self._chains, self._rules,
self._rule_priority_positions)
def __init_vars(self):
self._chains = { }
self._rules = { }
self._rule_priority_positions = { }
self._passthroughs = { }
self._obj = None
def cleanup(self):
self.__init_vars()
# transaction
def new_transaction(self):
return FirewallTransaction(self._fw)
# configuration
def set_permanent_config(self, obj):
self._obj = obj
def has_runtime_configuration(self):
if len(self._chains) + len(self._rules) + len(self._passthroughs) > 0:
return True
return False
def has_configuration(self):
if self.has_runtime_configuration():
return True
if len(self._obj.get_all_chains()) + \
len(self._obj.get_all_rules()) + \
len(self._obj.get_all_passthroughs()) > 0:
return True
return False
def apply_direct(self, use_transaction=None):
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
# Apply permanent configuration and save the obj to be able to
# remove permanent configuration settings within get_runtime_config
# for use in firewalld reload.
self.set_config((self._obj.get_all_chains(),
self._obj.get_all_rules(),
self._obj.get_all_passthroughs()),
transaction)
if use_transaction is None:
transaction.execute(True)
def get_runtime_config(self):
# Return only runtime changes
# Remove all chains, rules and passthroughs that are in self._obj
# (permanent config applied in firewalld _start.
chains = { }
rules = { }
passthroughs = { }
for table_id in self._chains:
(ipv, table) = table_id
for chain in self._chains[table_id]:
if not self._obj.query_chain(ipv, table, chain):
chains.setdefault(table_id, [ ]).append(chain)
for chain_id in self._rules:
(ipv, table, chain) = chain_id
for (priority, args) in self._rules[chain_id]:
if not self._obj.query_rule(ipv, table, chain, priority, args):
if chain_id not in rules:
rules[chain_id] = LastUpdatedOrderedDict()
rules[chain_id][(priority, args)] = priority
for ipv in self._passthroughs:
for args in self._passthroughs[ipv]:
if not self._obj.query_passthrough(ipv, args):
if ipv not in passthroughs:
passthroughs[ipv] = [ ]
passthroughs[ipv].append(args)
return (chains, rules, passthroughs)
def get_config(self):
return (self._chains, self._rules, self._passthroughs)
def set_config(self, conf, use_transaction=None):
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
(_chains, _rules, _passthroughs) = conf
for table_id in _chains:
(ipv, table) = table_id
for chain in _chains[table_id]:
if not self.query_chain(ipv, table, chain):
try:
self.add_chain(ipv, table, chain,
use_transaction=transaction)
except FirewallError as error:
log.warning(str(error))
for chain_id in _rules:
(ipv, table, chain) = chain_id
for (priority, args) in _rules[chain_id]:
if not self.query_rule(ipv, table, chain, priority, args):
try:
self.add_rule(ipv, table, chain, priority, args,
use_transaction=transaction)
except FirewallError as error:
log.warning(str(error))
for ipv in _passthroughs:
for args in _passthroughs[ipv]:
if not self.query_passthrough(ipv, args):
try:
self.add_passthrough(ipv, args,
use_transaction=transaction)
except FirewallError as error:
log.warning(str(error))
if use_transaction is None:
transaction.execute(True)
def _check_ipv(self, ipv):
ipvs = ['ipv4', 'ipv6', 'eb']
if ipv not in ipvs:
raise FirewallError(errors.INVALID_IPV,
"'%s' not in '%s'" % (ipv, ipvs))
def _check_ipv_table(self, ipv, table):
self._check_ipv(ipv)
tables = ipXtables.BUILT_IN_CHAINS.keys() if ipv in [ 'ipv4', 'ipv6' ] \
else ebtables.BUILT_IN_CHAINS.keys()
if table not in tables:
raise FirewallError(errors.INVALID_TABLE,
"'%s' not in '%s'" % (table, tables))
def _check_builtin_chain(self, ipv, table, chain):
if ipv in ['ipv4', 'ipv6']:
built_in_chains = ipXtables.BUILT_IN_CHAINS[table]
if self._fw.nftables_enabled:
our_chains = {}
else:
our_chains = self._fw.get_direct_backend_by_ipv(ipv).our_chains[table]
else:
built_in_chains = ebtables.BUILT_IN_CHAINS[table]
our_chains = ebtables.OUR_CHAINS[table]
if chain in built_in_chains:
raise FirewallError(errors.BUILTIN_CHAIN,
"chain '%s' is built-in chain" % chain)
if chain in our_chains:
raise FirewallError(errors.BUILTIN_CHAIN,
"chain '%s' is reserved" % chain)
if ipv in [ "ipv4", "ipv6" ]:
if self._fw.zone.zone_from_chain(chain) is not None:
raise FirewallError(errors.INVALID_CHAIN,
"Chain '%s' is reserved" % chain)
def _register_chain(self, table_id, chain, add):
if add:
self._chains.setdefault(table_id, [ ]).append(chain)
else:
self._chains[table_id].remove(chain)
if len(self._chains[table_id]) == 0:
del self._chains[table_id]
def add_chain(self, ipv, table, chain, use_transaction=None):
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if self._fw.may_skip_flush_direct_backends():
transaction.add_pre(self._fw.flush_direct_backends)
#TODO: policy="ACCEPT"
self._chain(True, ipv, table, chain, transaction)
if use_transaction is None:
transaction.execute(True)
def remove_chain(self, ipv, table, chain, use_transaction=None):
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
self._chain(False, ipv, table, chain, transaction)
if use_transaction is None:
transaction.execute(True)
def query_chain(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
self._check_builtin_chain(ipv, table, chain)
table_id = (ipv, table)
return (table_id in self._chains and
chain in self._chains[table_id])
def get_chains(self, ipv, table):
self._check_ipv_table(ipv, table)
table_id = (ipv, table)
if table_id in self._chains:
return self._chains[table_id]
return [ ]
def get_all_chains(self):
r = [ ]
for key in self._chains:
(ipv, table) = key
for chain in self._chains[key]:
r.append((ipv, table, chain))
return r
def add_rule(self, ipv, table, chain, priority, args, use_transaction=None):
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if self._fw.may_skip_flush_direct_backends():
transaction.add_pre(self._fw.flush_direct_backends)
self._rule(True, ipv, table, chain, priority, args, transaction)
if use_transaction is None:
transaction.execute(True)
def remove_rule(self, ipv, table, chain, priority, args,
use_transaction=None):
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
self._rule(False, ipv, table, chain, priority, args, transaction)
if use_transaction is None:
transaction.execute(True)
def query_rule(self, ipv, table, chain, priority, args):
self._check_ipv_table(ipv, table)
chain_id = (ipv, table, chain)
return chain_id in self._rules and \
(priority, args) in self._rules[chain_id]
def get_rules(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
chain_id = (ipv, table, chain)
if chain_id in self._rules:
return list(self._rules[chain_id].keys())
return [ ]
def get_all_rules(self):
r = [ ]
for key in self._rules:
(ipv, table, chain) = key
for (priority, args) in self._rules[key]:
r.append((ipv, table, chain, priority, list(args)))
return r
def _register_rule(self, rule_id, chain_id, priority, enable, count):
if enable:
if chain_id not in self._rules:
self._rules[chain_id] = LastUpdatedOrderedDict()
self._rules[chain_id][rule_id] = priority
if chain_id not in self._rule_priority_positions:
self._rule_priority_positions[chain_id] = { }
if priority in self._rule_priority_positions[chain_id]:
self._rule_priority_positions[chain_id][priority] += count
else:
self._rule_priority_positions[chain_id][priority] = count
else:
del self._rules[chain_id][rule_id]
if len(self._rules[chain_id]) == 0:
del self._rules[chain_id]
self._rule_priority_positions[chain_id][priority] -= count
# DIRECT PASSTHROUGH (untracked)
def passthrough(self, ipv, args):
try:
return self._fw.rule(self._fw.get_direct_backend_by_ipv(ipv).name, args)
except Exception as msg:
log.debug2(msg)
raise FirewallError(errors.COMMAND_FAILED, msg)
def _register_passthrough(self, ipv, args, enable):
if enable:
if ipv not in self._passthroughs:
self._passthroughs[ipv] = [ ]
self._passthroughs[ipv].append(args)
else:
self._passthroughs[ipv].remove(args)
if len(self._passthroughs[ipv]) == 0:
del self._passthroughs[ipv]
def add_passthrough(self, ipv, args, use_transaction=None):
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if self._fw.may_skip_flush_direct_backends():
transaction.add_pre(self._fw.flush_direct_backends)
self._passthrough(True, ipv, list(args), transaction)
if use_transaction is None:
transaction.execute(True)
def remove_passthrough(self, ipv, args, use_transaction=None):
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
self._passthrough(False, ipv, list(args), transaction)
if use_transaction is None:
transaction.execute(True)
def query_passthrough(self, ipv, args):
return ipv in self._passthroughs and \
tuple(args) in self._passthroughs[ipv]
def get_all_passthroughs(self):
r = [ ]
for ipv in self._passthroughs:
for args in self._passthroughs[ipv]:
r.append((ipv, list(args)))
return r
def get_passthroughs(self, ipv):
r = [ ]
if ipv in self._passthroughs:
for args in self._passthroughs[ipv]:
r.append(list(args))
return r
def split_value(self, rules, opts):
"""Split values combined with commas for options in opts"""
out_rules = [ ]
for rule in rules:
processed = False
for opt in opts:
try:
i = rule.index(opt)
except ValueError:
pass
else:
if len(rule) > i and "," in rule[i+1]:
# For all items in the comma separated list in index
# i of the rule, a new rule is created with a single
# item from this list
processed = True
items = rule[i+1].split(",")
for item in items:
_rule = rule[:]
_rule[i+1] = item
out_rules.append(_rule)
if not processed:
out_rules.append(rule)
return out_rules
def _rule(self, enable, ipv, table, chain, priority, args, transaction):
self._check_ipv_table(ipv, table)
# Do not create zone chains if we're using nftables. Only allow direct
# rules in the built in chains.
if not self._fw.nftables_enabled \
and ipv in [ "ipv4", "ipv6" ]:
self._fw.zone.create_zone_base_by_chain(ipv, table, chain,
transaction)
_chain = chain
backend = self._fw.get_direct_backend_by_ipv(ipv)
# if nftables is in use, just put the direct rules in the chain
# specified by the user. i.e. don't append _direct.
if not self._fw.nftables_enabled \
and backend.is_chain_builtin(ipv, table, chain):
_chain = "%s_direct" % (chain)
elif self._fw.nftables_enabled and chain[-7:] == "_direct" \
and backend.is_chain_builtin(ipv, table, chain[:-7]):
# strip _direct suffix. If we're using nftables we don't bother
# creating the *_direct chains for builtin chains.
_chain = chain[:-7]
chain_id = (ipv, table, chain)
rule_id = (priority, args)
if enable:
if chain_id in self._rules and \
rule_id in self._rules[chain_id]:
raise FirewallError(errors.ALREADY_ENABLED,
"rule '%s' already is in '%s:%s:%s'" % \
(args, ipv, table, chain))
else:
if chain_id not in self._rules or \
rule_id not in self._rules[chain_id]:
raise FirewallError(errors.NOT_ENABLED,
"rule '%s' is not in '%s:%s:%s'" % \
(args, ipv, table, chain))
# get priority of rule
priority = self._rules[chain_id][rule_id]
# If a rule gets added, the initial rule index position within the
# ipv, table and chain combination (chain_id) is 1.
# Tf the chain_id exists in _rule_priority_positions, there are already
# other rules for this chain_id. The number of rules for a priority
# less or equal to the priority of the new rule will increase the
# index of the new rule. The index is the ip*tables -I insert rule
# number.
#
# Example: We have the following rules for chain_id (ipv4, filter,
# INPUT) already:
# ipv4, filter, INPUT, 1, -i, foo1, -j, ACCEPT
# ipv4, filter, INPUT, 2, -i, foo2, -j, ACCEPT
# ipv4, filter, INPUT, 2, -i, foo2_1, -j, ACCEPT
# ipv4, filter, INPUT, 3, -i, foo3, -j, ACCEPT
# This results in the following _rule_priority_positions structure:
# _rule_priority_positions[(ipv4,filter,INPUT)][1] = 1
# _rule_priority_positions[(ipv4,filter,INPUT)][2] = 2
# _rule_priority_positions[(ipv4,filter,INPUT)][3] = 1
# The new rule
# ipv4, filter, INPUT, 2, -i, foo2_2, -j, ACCEPT
# has the same pritority as the second rule before and will be added
# right after it.
# The initial index is 1 and the chain_id is already in
# _rule_priority_positions. Therefore the index will increase for
# the number of rules in every rule position in
# _rule_priority_positions[(ipv4,filter,INPUT)].keys()
# where position is smaller or equal to the entry in keys.
# With the example from above:
# The priority of the new rule is 2. Therefore for all keys in
# _rule_priority_positions[chain_id] where priority is 1 or 2, the
# number of the rules will increase the index of the rule.
# For _rule_priority_positions[chain_id][1]: index += 1
# _rule_priority_positions[chain_id][2]: index += 2
# index will be 4 in the end and the rule in the table chain
# combination will be added at index 4.
# If there are no rules in the table chain combination, a new rule
# has index 1.
index = 1
count = 0
if chain_id in self._rule_priority_positions:
positions = sorted(self._rule_priority_positions[chain_id].keys())
j = 0
while j < len(positions) and priority >= positions[j]:
index += self._rule_priority_positions[chain_id][positions[j]]
j += 1
# split the direct rule in some cases as iptables-restore can't handle
# compound args.
#
args_list = [list(args)]
args_list = self.split_value(args_list, [ "-s", "--source" ])
args_list = self.split_value(args_list, [ "-d", "--destination" ])
for _args in args_list:
transaction.add_rule(backend, backend.build_rule(enable, table, _chain, index, tuple(_args)))
index += 1
count += 1
self._register_rule(rule_id, chain_id, priority, enable, count)
transaction.add_fail(self._register_rule,
rule_id, chain_id, priority, not enable, count)
def _chain(self, add, ipv, table, chain, transaction):
self._check_ipv_table(ipv, table)
self._check_builtin_chain(ipv, table, chain)
table_id = (ipv, table)
if add:
if table_id in self._chains and \
chain in self._chains[table_id]:
raise FirewallError(errors.ALREADY_ENABLED,
"chain '%s' already is in '%s:%s'" % \
(chain, ipv, table))
else:
if table_id not in self._chains or \
chain not in self._chains[table_id]:
raise FirewallError(errors.NOT_ENABLED,
"chain '%s' is not in '%s:%s'" % \
(chain, ipv, table))
backend = self._fw.get_direct_backend_by_ipv(ipv)
transaction.add_rules(backend, backend.build_chain_rules(add, table, chain))
self._register_chain(table_id, chain, add)
transaction.add_fail(self._register_chain, table_id, chain, not add)
def _passthrough(self, enable, ipv, args, transaction):
self._check_ipv(ipv)
tuple_args = tuple(args)
if enable:
if ipv in self._passthroughs and \
tuple_args in self._passthroughs[ipv]:
raise FirewallError(errors.ALREADY_ENABLED,
"passthrough '%s', '%s'" % (ipv, args))
else:
if ipv not in self._passthroughs or \
tuple_args not in self._passthroughs[ipv]:
raise FirewallError(errors.NOT_ENABLED,
"passthrough '%s', '%s'" % (ipv, args))
backend = self._fw.get_direct_backend_by_ipv(ipv)
if enable:
backend.check_passthrough(args)
# try to find out if a zone chain should be used
if ipv in [ "ipv4", "ipv6" ]:
table, chain = backend.passthrough_parse_table_chain(args)
if table and chain:
self._fw.zone.create_zone_base_by_chain(ipv, table, chain)
_args = args
else:
_args = backend.reverse_passthrough(args)
transaction.add_rule(backend, _args)
self._register_passthrough(ipv, tuple_args, enable)
transaction.add_fail(self._register_passthrough, ipv, tuple_args,
not enable)
core/fw_transaction.py 0000644 00000014246 15035135173 0011101 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""Transaction classes for firewalld"""
__all__ = [ "FirewallTransaction" ]
import traceback
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class FirewallTransaction(object):
def __init__(self, fw):
self.fw = fw
self.rules = { } # [ ( backend.name, [ rule,.. ] ),.. ]
self.pre_funcs = [ ] # [ (func, args),.. ]
self.post_funcs = [ ] # [ (func, args),.. ]
self.fail_funcs = [ ] # [ (func, args),.. ]
self.modules = [ ] # [ module,.. ]
def clear(self):
self.rules.clear()
del self.pre_funcs[:]
del self.post_funcs[:]
del self.fail_funcs[:]
def add_rule(self, backend, rule):
self.rules.setdefault(backend.name, [ ]).append(rule)
def add_rules(self, backend, rules):
for rule in rules:
self.add_rule(backend, rule)
def query_rule(self, backend, rule):
return backend.name in self.rules and rule in self.rules[backend.name]
def remove_rule(self, backend, rule):
if backend.name in self.rules and rule in self.rules[backend.name]:
self.rules[backend.name].remove(rule)
def add_pre(self, func, *args):
self.pre_funcs.append((func, args))
def add_post(self, func, *args):
self.post_funcs.append((func, args))
def add_fail(self, func, *args):
self.fail_funcs.append((func, args))
def add_module(self, module):
if module not in self.modules:
self.modules.append(module)
def remove_module(self, module):
if module in self.modules:
self.modules.remove(module)
def add_modules(self, modules):
for module in modules:
self.add_module(module)
def remove_modules(self, modules):
for module in modules:
self.remove_module(module)
def prepare(self, enable):
log.debug4("%s.prepare(%s, %s)" % (type(self), enable, "..."))
rules = { }
if not enable:
# reverse rule order for cleanup
for backend_name in self.rules:
for rule in reversed(self.rules[backend_name]):
rules.setdefault(backend_name, [ ]).append(
self.fw.get_backend_by_name(backend_name).reverse_rule(rule))
else:
for backend_name in self.rules:
rules.setdefault(backend_name, [ ]).extend(self.rules[backend_name])
return rules, self.modules
def execute(self, enable):
log.debug4("%s.execute(%s)" % (type(self), enable))
rules, modules = self.prepare(enable)
# pre
self.pre()
# stage 1: apply rules
error = False
errorMsg = ""
done = [ ]
for backend_name in rules:
try:
self.fw.rules(backend_name, rules[backend_name])
except Exception as msg:
error = True
errorMsg = msg
log.debug1(traceback.format_exc())
log.error(msg)
else:
done.append(backend_name)
# stage 2: load modules
if not error:
module_return = self.fw.handle_modules(modules, enable)
if module_return:
# Debug log about issues loading modules, but don't error. The
# modules may be builtin or CONFIG_MODULES=n, in which case
# modprobe will fail. Or we may be running inside a container
# that doesn't have sufficient privileges. Unfortunately there
# is no way for us to know.
(status, msg) = module_return
if status:
log.debug1(msg)
# error case: revert rules
if error:
undo_rules = { }
for backend_name in done:
undo_rules[backend_name] = [ ]
for rule in reversed(rules[backend_name]):
undo_rules[backend_name].append(
self.fw.get_backend_by_name(backend_name).reverse_rule(rule))
for backend_name in undo_rules:
try:
self.fw.rules(backend_name, undo_rules[backend_name])
except Exception as msg:
log.debug1(traceback.format_exc())
log.error(msg)
# call failure functions
for (func, args) in self.fail_funcs:
try:
func(*args)
except Exception as msg:
log.debug1(traceback.format_exc())
log.error("Calling fail func %s(%s) failed: %s" % \
(func, args, msg))
raise FirewallError(errors.COMMAND_FAILED, errorMsg)
# post
self.post()
def pre(self):
log.debug4("%s.pre()" % type(self))
for (func, args) in self.pre_funcs:
try:
func(*args)
except Exception as msg:
log.debug1(traceback.format_exc())
log.error("Calling pre func %s(%s) failed: %s" % \
(func, args, msg))
def post(self):
log.debug4("%s.post()" % type(self))
for (func, args) in self.post_funcs:
try:
func(*args)
except Exception as msg:
log.debug1(traceback.format_exc())
log.error("Calling post func %s(%s) failed: %s" % \
(func, args, msg))
core/watcher.py 0000644 00000006234 15035135173 0007513 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2012-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "Watcher" ]
from gi.repository import Gio, GLib
class Watcher(object):
def __init__(self, callback, timeout):
self._callback = callback
self._timeout = timeout
self._monitors = { }
self._timeouts = { }
self._blocked = [ ]
def add_watch_dir(self, directory):
gfile = Gio.File.new_for_path(directory)
self._monitors[directory] = gfile.monitor_directory(\
Gio.FileMonitorFlags.NONE, None)
self._monitors[directory].connect("changed", self._file_changed_cb)
def add_watch_file(self, filename):
gfile = Gio.File.new_for_path(filename)
self._monitors[filename] = gfile.monitor_file(\
Gio.FileMonitorFlags.NONE, None)
self._monitors[filename].connect("changed", self._file_changed_cb)
def get_watches(self):
return self._monitors.keys()
def has_watch(self, filename):
return filename in self._monitors
def remove_watch(self, filename):
del self._monitors[filename]
def block_source(self, filename):
if filename not in self._blocked:
self._blocked.append(filename)
def unblock_source(self, filename):
if filename in self._blocked:
self._blocked.remove(filename)
def clear_timeouts(self):
for filename in list(self._timeouts.keys()):
GLib.source_remove(self._timeouts[filename])
del self._timeouts[filename]
def _call_callback(self, filename):
if filename not in self._blocked:
self._callback(filename)
del self._timeouts[filename]
def _file_changed_cb(self, monitor, gio_file, gio_other_file, event):
filename = gio_file.get_parse_name()
if filename in self._blocked:
if filename in self._timeouts:
GLib.source_remove(self._timeouts[filename])
del self._timeouts[filename]
return
if event == Gio.FileMonitorEvent.CHANGED or \
event == Gio.FileMonitorEvent.CREATED or \
event == Gio.FileMonitorEvent.DELETED or \
event == Gio.FileMonitorEvent.ATTRIBUTE_CHANGED:
if filename in self._timeouts:
GLib.source_remove(self._timeouts[filename])
del self._timeouts[filename]
self._timeouts[filename] = GLib.timeout_add_seconds(\
self._timeout, self._call_callback, filename)
core/fw_policies.py 0000644 00000005363 15035135173 0010363 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "FirewallPolicies" ]
from firewall import config
from firewall.core.logger import log
from firewall.core.io.lockdown_whitelist import LockdownWhitelist
from firewall import errors
from firewall.errors import FirewallError
class FirewallPolicies(object):
def __init__(self):
self._lockdown = False
self.lockdown_whitelist = LockdownWhitelist(config.LOCKDOWN_WHITELIST)
def __repr__(self):
return '%s(%r, %r)' % (self.__class__, self._lockdown,
self.lockdown_whitelist)
def cleanup(self):
self._lockdown = False
self.lockdown_whitelist.cleanup()
# lockdown
def access_check(self, key, value):
if key == "context":
log.debug2('Doing access check for context "%s"' % value)
if self.lockdown_whitelist.match_context(value):
log.debug3('context matches.')
return True
elif key == "uid":
log.debug2('Doing access check for uid %d' % value)
if self.lockdown_whitelist.match_uid(value):
log.debug3('uid matches.')
return True
elif key == "user":
log.debug2('Doing access check for user "%s"' % value)
if self.lockdown_whitelist.match_user(value):
log.debug3('user matches.')
return True
elif key == "command":
log.debug2('Doing access check for command "%s"' % value)
if self.lockdown_whitelist.match_command(value):
log.debug3('command matches.')
return True
return False
def enable_lockdown(self):
if self._lockdown:
raise FirewallError(errors.ALREADY_ENABLED, "enable_lockdown()")
self._lockdown = True
def disable_lockdown(self):
if not self._lockdown:
raise FirewallError(errors.NOT_ENABLED, "disable_lockdown()")
self._lockdown = False
def query_lockdown(self):
return self._lockdown
core/fw_nm.py 0000644 00000016022 15035135173 0007160 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""Functions for NetworkManager interaction"""
__all__ = [ "check_nm_imported", "nm_is_imported",
"nm_get_zone_of_connection", "nm_set_zone_of_connection",
"nm_get_connections", "nm_get_connection_of_interface",
"nm_get_bus_name", "nm_get_dbus_interface" ]
import gi
from gi.repository import GLib
try:
gi.require_version('NM', '1.0')
except ValueError:
_nm_imported = False
else:
try:
from gi.repository import NM
_nm_imported = True
except (ImportError, ValueError, GLib.Error):
_nm_imported = False
_nm_client = None
from firewall import errors
from firewall.errors import FirewallError
from firewall.core.logger import log
import dbus
def check_nm_imported():
"""Check function to raise a MISSING_IMPORT error if the import of NM failed
"""
if not _nm_imported:
raise FirewallError(errors.MISSING_IMPORT, "gi.repository.NM = 1.0")
def nm_is_imported():
"""Returns true if NM has been properly imported
@return True if import was successful, False otherwirse
"""
return _nm_imported
def nm_get_client():
"""Returns the NM client object or None if the import of NM failed
@return NM.Client instance if import was successful, None otherwise
"""
global _nm_client
if not _nm_client:
_nm_client = NM.Client.new(None)
return _nm_client
def nm_get_zone_of_connection(connection):
"""Get zone of connection from NM
@param connection name
@return zone string setting of connection, empty string if not set, None if connection is unknown
"""
check_nm_imported()
con = nm_get_client().get_connection_by_uuid(connection)
if con is None:
return None
setting_con = con.get_setting_connection()
if setting_con is None:
return None
try:
if con.get_flags() & (NM.SettingsConnectionFlags.NM_GENERATED
| NM.SettingsConnectionFlags.NM_VOLATILE):
return ""
except AttributeError:
# Prior to NetworkManager 1.12, we can only guess
# that a connection was generated/volatile.
if con.get_unsaved():
return ""
zone = setting_con.get_zone()
if zone is None:
zone = ""
return zone
def nm_set_zone_of_connection(zone, connection):
"""Set the zone for a connection
@param zone name
@param connection name
@return True if zone was set, else False
"""
check_nm_imported()
con = nm_get_client().get_connection_by_uuid(connection)
if con is None:
return False
setting_con = con.get_setting_connection()
if setting_con is None:
return False
if zone == "":
zone = None
setting_con.set_property("zone", zone)
return con.commit_changes(True, None)
def nm_get_connections(connections, connections_name):
"""Get active connections from NM
@param connections return dict
@param connections_name return dict
"""
connections.clear()
connections_name.clear()
check_nm_imported()
active_connections = nm_get_client().get_active_connections()
for active_con in active_connections:
# ignore vpn devices for now
if active_con.get_vpn():
continue
name = active_con.get_id()
uuid = active_con.get_uuid()
devices = active_con.get_devices()
connections_name[uuid] = name
for dev in devices:
ip_iface = dev.get_ip_iface()
if ip_iface:
connections[ip_iface] = uuid
def nm_get_interfaces():
"""Get active interfaces from NM
@returns list of interface names
"""
check_nm_imported()
active_interfaces = []
for active_con in nm_get_client().get_active_connections():
# ignore vpn devices for now
if active_con.get_vpn():
continue
try:
con = active_con.get_connection()
if con.get_flags() & (NM.SettingsConnectionFlags.NM_GENERATED
| NM.SettingsConnectionFlags.NM_VOLATILE):
continue
except AttributeError:
# Prior to NetworkManager 1.12, we can only guess
# that a connection was generated/volatile.
if con.get_unsaved():
continue
for dev in active_con.get_devices():
ip_iface = dev.get_ip_iface()
if ip_iface:
active_interfaces.append(ip_iface)
return active_interfaces
def nm_get_interfaces_in_zone(zone):
interfaces = []
for interface in nm_get_interfaces():
conn = nm_get_connection_of_interface(interface)
if zone == nm_get_zone_of_connection(conn):
interfaces.append(interface)
return interfaces
def nm_get_device_by_ip_iface(interface):
"""Get device from NM which has the given IP interface
@param interface name
@returns NM.Device instance or None
"""
check_nm_imported()
for device in nm_get_client().get_devices():
ip_iface = device.get_ip_iface()
if ip_iface is None:
continue
if ip_iface == interface:
return device
return None
def nm_get_connection_of_interface(interface):
"""Get connection from NM that is using the interface
@param interface name
@returns connection that is using interface or None
"""
check_nm_imported()
device = nm_get_device_by_ip_iface(interface)
if device is None:
return None
active_con = device.get_active_connection()
if active_con is None:
return None
try:
con = active_con.get_connection()
if con.get_flags() & NM.SettingsConnectionFlags.NM_GENERATED:
return None
except AttributeError:
# Prior to NetworkManager 1.12, we can only guess
# that a connection was generated.
if con.get_unsaved():
return None
return active_con.get_uuid()
def nm_get_bus_name():
if not _nm_imported:
return None
try:
bus = dbus.SystemBus()
obj = bus.get_object(NM.DBUS_INTERFACE, NM.DBUS_PATH)
name = obj.bus_name
del obj, bus
return name
except Exception:
log.debug2("Failed to get bus name of NetworkManager")
return None
def nm_get_dbus_interface():
if not _nm_imported:
return ""
return NM.DBUS_INTERFACE
core/fw_icmptype.py 0000644 00000004665 15035135173 0010412 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "FirewallIcmpType" ]
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class FirewallIcmpType(object):
def __init__(self, fw):
self._fw = fw
self._icmptypes = { }
def __repr__(self):
return '%s(%r)' % (self.__class__, self._icmptypes)
def cleanup(self):
self._icmptypes.clear()
# zones
def get_icmptypes(self):
return sorted(self._icmptypes.keys())
def check_icmptype(self, icmptype):
if icmptype not in self._icmptypes:
raise FirewallError(errors.INVALID_ICMPTYPE, icmptype)
def get_icmptype(self, icmptype):
self.check_icmptype(icmptype)
return self._icmptypes[icmptype]
def add_icmptype(self, obj):
orig_ipvs = obj.destination
if len(orig_ipvs) == 0:
orig_ipvs = [ "ipv4", "ipv6" ]
for ipv in orig_ipvs:
if ipv == "ipv4":
if not self._fw.ip4tables_enabled and not self._fw.nftables_enabled:
continue
supported_icmps = self._fw.ipv4_supported_icmp_types
elif ipv == "ipv6":
if not self._fw.ip6tables_enabled and not self._fw.nftables_enabled:
continue
supported_icmps = self._fw.ipv6_supported_icmp_types
else:
supported_icmps = [ ]
if obj.name.lower() not in supported_icmps:
log.info1("ICMP type '%s' is not supported by the kernel for %s." % (obj.name, ipv))
self._icmptypes[obj.name] = obj
def remove_icmptype(self, icmptype):
self.check_icmptype(icmptype)
del self._icmptypes[icmptype]
core/icmp.py 0000644 00000006035 15035135173 0007005 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2017 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "ICMP_TYPES", "ICMPV6_TYPES",
"check_icmp_type", "check_icmpv6_type" ]
ICMP_TYPES = {
"echo-reply": "0/0",
"pong": "0/0",
"network-unreachable": "3/0",
"host-unreachable": "3/1",
"protocol-unreachable": "3/2",
"port-unreachable": "3/3",
"fragmentation-needed": "3/4",
"source-route-failed": "3/5",
"network-unknown": "3/6",
"host-unknown": "3/7",
"network-prohibited": "3/9",
"host-prohibited": "3/10",
"TOS-network-unreachable": "3/11",
"TOS-host-unreachable": "3/12",
"communication-prohibited": "3/13",
"host-precedence-violation": "3/14",
"precedence-cutoff": "3/15",
"source-quench": "4/0",
"network-redirect": "5/0",
"host-redirect": "5/1",
"TOS-network-redirect": "5/2",
"TOS-host-redirect": "5/3",
"echo-request": "8/0",
"ping": "8/0",
"router-advertisement": "9/0",
"router-solicitation": "10/0",
"ttl-zero-during-transit": "11/0",
"ttl-zero-during-reassembly": "11/1",
"ip-header-bad": "12/0",
"required-option-missing": "12/1",
"timestamp-request": "13/0",
"timestamp-reply": "14/0",
"address-mask-request": "17/0",
"address-mask-reply": "18/0",
}
ICMPV6_TYPES = {
"no-route": "1/0",
"communication-prohibited": "1/1",
"address-unreachable": "1/3",
"port-unreachable": "1/4",
"packet-too-big": "2/0",
"ttl-zero-during-transit": "3/0",
"ttl-zero-during-reassembly": "3/1",
"bad-header": "4/0",
"unknown-header-type": "4/1",
"unknown-option": "4/2",
"echo-request": "128/0",
"ping": "128/0",
"echo-reply": "129/0",
"pong": "129/0",
"router-solicitation": "133/0",
"router-advertisement": "134/0",
"neighbour-solicitation": "135/0",
"neigbour-solicitation": "135/0",
"neighbour-advertisement": "136/0",
"neigbour-advertisement": "136/0",
"redirect": "137/0",
}
def check_icmp_name(_name):
if _name in ICMP_TYPES:
return True
return False
def check_icmp_type(_type):
if _type in ICMP_TYPES.values():
return True
return False
def check_icmpv6_name(_name):
if _name in ICMP_TYPES:
return True
return False
def check_icmpv6_type(_type):
if _type in ICMPV6_TYPES.values():
return True
return False
core/fw.py 0000644 00000142345 15035135173 0006476 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
__all__ = [ "Firewall" ]
import os.path
import sys
import copy
import time
import traceback
from firewall import config
from firewall import functions
from firewall.core import ipXtables
from firewall.core import ebtables
from firewall.core import nftables
from firewall.core import ipset
from firewall.core import modules
from firewall.core.fw_icmptype import FirewallIcmpType
from firewall.core.fw_service import FirewallService
from firewall.core.fw_zone import FirewallZone
from firewall.core.fw_direct import FirewallDirect
from firewall.core.fw_config import FirewallConfig
from firewall.core.fw_policies import FirewallPolicies
from firewall.core.fw_ipset import FirewallIPSet
from firewall.core.fw_transaction import FirewallTransaction
from firewall.core.fw_helper import FirewallHelper
from firewall.core.fw_policy import FirewallPolicy
from firewall.core.fw_nm import nm_get_bus_name, nm_get_interfaces_in_zone
from firewall.core.logger import log
from firewall.core.io.firewalld_conf import firewalld_conf
from firewall.core.io.direct import Direct
from firewall.core.io.service import service_reader
from firewall.core.io.icmptype import icmptype_reader
from firewall.core.io.zone import zone_reader, Zone
from firewall.core.io.ipset import ipset_reader
from firewall.core.ipset import IPSET_TYPES
from firewall.core.io.helper import helper_reader
from firewall.core.io.policy import policy_reader
from firewall import errors
from firewall.errors import FirewallError
############################################################################
#
# class Firewall
#
############################################################################
class Firewall(object):
def __init__(self, offline=False):
self._firewalld_conf = firewalld_conf(config.FIREWALLD_CONF)
self._offline = offline
if self._offline:
self.ip4tables_enabled = False
self.ip6tables_enabled = False
self.ebtables_enabled = False
self.ipset_enabled = False
self.ipset_supported_types = IPSET_TYPES
self.nftables_enabled = False
else:
self.ip4tables_backend = ipXtables.ip4tables(self)
self.ip4tables_enabled = True
self.ipv4_supported_icmp_types = [ ]
self.ip6tables_backend = ipXtables.ip6tables(self)
self.ip6tables_enabled = True
self.ipv6_supported_icmp_types = [ ]
self.ebtables_backend = ebtables.ebtables()
self.ebtables_enabled = True
self.ipset_backend = ipset.ipset()
self.ipset_enabled = True
self.ipset_supported_types = [ ]
self.nftables_backend = nftables.nftables(self)
self.nftables_enabled = True
self.modules_backend = modules.modules()
self.icmptype = FirewallIcmpType(self)
self.service = FirewallService(self)
self.zone = FirewallZone(self)
self.direct = FirewallDirect(self)
self.config = FirewallConfig(self)
self.policies = FirewallPolicies()
self.ipset = FirewallIPSet(self)
self.helper = FirewallHelper(self)
self.policy = FirewallPolicy(self)
self.__init_vars()
def __repr__(self):
return '%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r)' % \
(self.__class__, self.ip4tables_enabled, self.ip6tables_enabled,
self.ebtables_enabled, self._state, self._panic,
self._default_zone, self._module_refcount, self._marks,
self.cleanup_on_exit, self.cleanup_modules_on_exit,
self.ipv6_rpfilter_enabled, self.ipset_enabled,
self._individual_calls, self._log_denied)
def __init_vars(self):
self._state = "INIT"
self._panic = False
self._default_zone = ""
self._module_refcount = { }
self._marks = [ ]
# fallback settings will be overloaded by firewalld.conf
self.cleanup_on_exit = config.FALLBACK_CLEANUP_ON_EXIT
self.cleanup_modules_on_exit = config.FALLBACK_CLEANUP_MODULES_ON_EXIT
self.ipv6_rpfilter_enabled = config.FALLBACK_IPV6_RPFILTER
self._individual_calls = config.FALLBACK_INDIVIDUAL_CALLS
self._log_denied = config.FALLBACK_LOG_DENIED
self._firewall_backend = config.FALLBACK_FIREWALL_BACKEND
self._flush_all_on_reload = config.FALLBACK_FLUSH_ALL_ON_RELOAD
self._rfc3964_ipv4 = config.FALLBACK_RFC3964_IPV4
self._allow_zone_drifting = config.FALLBACK_ALLOW_ZONE_DRIFTING
def _check_tables(self):
# check if iptables, ip6tables and ebtables are usable, else disable
if self.ip4tables_enabled and \
"filter" not in self.ip4tables_backend.get_available_tables():
log.info1("iptables is not usable.")
self.ip4tables_enabled = False
if self.ip6tables_enabled and \
"filter" not in self.ip6tables_backend.get_available_tables():
log.info1("ip6tables is not usable.")
self.ip6tables_enabled = False
if self.ebtables_enabled and \
"filter" not in self.ebtables_backend.get_available_tables():
log.info1("ebtables is not usable.")
self.ebtables_enabled = False
# is there at least support for ipv4 or ipv6
if not self.ip4tables_enabled and not self.ip6tables_enabled \
and not self.nftables_enabled:
log.fatal("No IPv4 and IPv6 firewall.")
sys.exit(1)
def _start_check(self):
try:
self.ipset_backend.set_list()
except ValueError:
log.warning("ipset not usable, disabling ipset usage in firewall.")
# ipset is not usable, no supported types
self.ipset_enabled = False
self.ipset_supported_types = [ ]
else:
# ipset is usable, get all supported types
self.ipset_supported_types = self.ipset_backend.set_supported_types()
self.ip4tables_backend.fill_exists()
if not self.ip4tables_backend.restore_command_exists:
if self.ip4tables_backend.command_exists:
log.warning("iptables-restore is missing, using "
"individual calls for IPv4 firewall.")
else:
log.warning("iptables-restore and iptables are missing, "
"disabling IPv4 firewall.")
self.ip4tables_enabled = False
if self.nftables_enabled:
self.ipv4_supported_icmp_types = self.nftables_backend.supported_icmp_types("ipv4")
else:
if self.ip4tables_enabled:
self.ipv4_supported_icmp_types = self.ip4tables_backend.supported_icmp_types()
else:
self.ipv4_supported_icmp_types = [ ]
self.ip6tables_backend.fill_exists()
if not self.ip6tables_backend.restore_command_exists:
if self.ip6tables_backend.command_exists:
log.warning("ip6tables-restore is missing, using "
"individual calls for IPv6 firewall.")
else:
log.warning("ip6tables-restore and ip6tables are missing, "
"disabling IPv6 firewall.")
self.ip6tables_enabled = False
if self.nftables_enabled:
self.ipv6_supported_icmp_types = self.nftables_backend.supported_icmp_types("ipv6")
else:
if self.ip6tables_enabled:
self.ipv6_supported_icmp_types = self.ip6tables_backend.supported_icmp_types()
else:
self.ipv6_supported_icmp_types = [ ]
self.ebtables_backend.fill_exists()
if not self.ebtables_backend.restore_command_exists:
if self.ebtables_backend.command_exists:
log.warning("ebtables-restore is missing, using "
"individual calls for bridge firewall.")
else:
log.warning("ebtables-restore and ebtables are missing, "
"disabling bridge firewall.")
self.ebtables_enabled = False
if self.ebtables_enabled and not self._individual_calls and \
not self.ebtables_backend.restore_noflush_option:
log.debug1("ebtables-restore is not supporting the --noflush "
"option, will therefore not be used")
def _start(self, reload=False, complete_reload=False):
# initialize firewall
default_zone = config.FALLBACK_ZONE
# load firewalld config
log.debug1("Loading firewalld config file '%s'", config.FIREWALLD_CONF)
try:
self._firewalld_conf.read()
except Exception as msg:
log.warning(msg)
log.warning("Using fallback firewalld configuration settings.")
else:
if self._firewalld_conf.get("DefaultZone"):
default_zone = self._firewalld_conf.get("DefaultZone")
if self._firewalld_conf.get("CleanupOnExit"):
value = self._firewalld_conf.get("CleanupOnExit")
if value is not None and value.lower() in [ "no", "false" ]:
self.cleanup_on_exit = False
log.debug1("CleanupOnExit is set to '%s'",
self.cleanup_on_exit)
if self._firewalld_conf.get("CleanupModulesOnExit"):
value = self._firewalld_conf.get("CleanupModulesOnExit")
if value is not None and value.lower() in [ "yes", "true" ]:
self.cleanup_modules_on_exit = True
if value is not None and value.lower() in [ "no", "false" ]:
self.cleanup_modules_on_exit = False
log.debug1("CleanupModulesOnExit is set to '%s'",
self.cleanup_modules_on_exit)
if self._firewalld_conf.get("Lockdown"):
value = self._firewalld_conf.get("Lockdown")
if value is not None and value.lower() in [ "yes", "true" ]:
log.debug1("Lockdown is enabled")
try:
self.policies.enable_lockdown()
except FirewallError:
# already enabled, this is probably reload
pass
if self._firewalld_conf.get("IPv6_rpfilter"):
value = self._firewalld_conf.get("IPv6_rpfilter")
if value is not None:
if value.lower() in [ "no", "false" ]:
self.ipv6_rpfilter_enabled = False
if value.lower() in [ "yes", "true" ]:
self.ipv6_rpfilter_enabled = True
if self.ipv6_rpfilter_enabled:
log.debug1("IPv6 rpfilter is enabled")
else:
log.debug1("IPV6 rpfilter is disabled")
if self._firewalld_conf.get("IndividualCalls"):
value = self._firewalld_conf.get("IndividualCalls")
if value is not None and value.lower() in [ "yes", "true" ]:
log.debug1("IndividualCalls is enabled")
self._individual_calls = True
if self._firewalld_conf.get("LogDenied"):
value = self._firewalld_conf.get("LogDenied")
if value is None or value.lower() == "no":
self._log_denied = "off"
else:
self._log_denied = value.lower()
log.debug1("LogDenied is set to '%s'", self._log_denied)
if self._firewalld_conf.get("FirewallBackend"):
self._firewall_backend = self._firewalld_conf.get("FirewallBackend")
log.debug1("FirewallBackend is set to '%s'",
self._firewall_backend)
if self._firewalld_conf.get("FlushAllOnReload"):
value = self._firewalld_conf.get("FlushAllOnReload")
if value.lower() in [ "no", "false" ]:
self._flush_all_on_reload = False
else:
self._flush_all_on_reload = True
log.debug1("FlushAllOnReload is set to '%s'",
self._flush_all_on_reload)
if self._firewalld_conf.get("RFC3964_IPv4"):
value = self._firewalld_conf.get("RFC3964_IPv4")
if value.lower() in [ "no", "false" ]:
self._rfc3964_ipv4 = False
else:
self._rfc3964_ipv4 = True
log.debug1("RFC3964_IPv4 is set to '%s'",
self._rfc3964_ipv4)
if self._firewalld_conf.get("AllowZoneDrifting"):
value = self._firewalld_conf.get("AllowZoneDrifting")
if value.lower() in [ "no", "false" ]:
self._allow_zone_drifting = False
else:
self._allow_zone_drifting = True
if not self._offline:
log.warning("AllowZoneDrifting is enabled. This is considered "
"an insecure configuration option. It will be "
"removed in a future release. Please consider "
"disabling it now.")
log.debug1("AllowZoneDrifting is set to '%s'",
self._allow_zone_drifting)
self.config.set_firewalld_conf(copy.deepcopy(self._firewalld_conf))
self._select_firewall_backend(self._firewall_backend)
if not self._offline:
self._start_check()
# load lockdown whitelist
log.debug1("Loading lockdown whitelist")
try:
self.policies.lockdown_whitelist.read()
except Exception as msg:
if self.policies.query_lockdown():
log.error("Failed to load lockdown whitelist '%s': %s",
self.policies.lockdown_whitelist.filename, msg)
else:
log.debug1("Failed to load lockdown whitelist '%s': %s",
self.policies.lockdown_whitelist.filename, msg)
# copy policies to config interface
self.config.set_policies(copy.deepcopy(self.policies))
# load ipset files
self._loader(config.FIREWALLD_IPSETS, "ipset")
self._loader(config.ETC_FIREWALLD_IPSETS, "ipset")
# load icmptype files
self._loader(config.FIREWALLD_ICMPTYPES, "icmptype")
self._loader(config.ETC_FIREWALLD_ICMPTYPES, "icmptype")
if len(self.icmptype.get_icmptypes()) == 0:
log.error("No icmptypes found.")
# load helper files
self._loader(config.FIREWALLD_HELPERS, "helper")
self._loader(config.ETC_FIREWALLD_HELPERS, "helper")
# load service files
self._loader(config.FIREWALLD_SERVICES, "service")
self._loader(config.ETC_FIREWALLD_SERVICES, "service")
if len(self.service.get_services()) == 0:
log.error("No services found.")
# load zone files
self._loader(config.FIREWALLD_ZONES, "zone")
self._loader(config.ETC_FIREWALLD_ZONES, "zone")
if len(self.zone.get_zones()) == 0:
log.fatal("No zones found.")
sys.exit(1)
# load policy files
self._loader(config.FIREWALLD_POLICIES, "policy")
self._loader(config.ETC_FIREWALLD_POLICIES, "policy")
# check minimum required zones
error = False
for z in [ "block", "drop", "trusted" ]:
if z not in self.zone.get_zones():
log.fatal("Zone '%s' is not available.", z)
error = True
if error:
sys.exit(1)
# check if default_zone is a valid zone
if default_zone not in self.zone.get_zones():
if "public" in self.zone.get_zones():
zone = "public"
elif "external" in self.zone.get_zones():
zone = "external"
else:
zone = "block" # block is a base zone, therefore it has to exist
log.error("Default zone '%s' is not valid. Using '%s'.",
default_zone, zone)
default_zone = zone
else:
log.debug1("Using default zone '%s'", default_zone)
# load direct rules
obj = Direct(config.FIREWALLD_DIRECT)
if os.path.exists(config.FIREWALLD_DIRECT):
log.debug1("Loading direct rules file '%s'" % \
config.FIREWALLD_DIRECT)
try:
obj.read()
except Exception as msg:
log.error("Failed to load direct rules file '%s': %s",
config.FIREWALLD_DIRECT, msg)
self.direct.set_permanent_config(obj)
self.config.set_direct(copy.deepcopy(obj))
self._default_zone = self.check_zone(default_zone)
if self._offline:
return
# check if needed tables are there
self._check_tables()
if log.getDebugLogLevel() > 0:
# get time before flushing and applying
tm1 = time.time()
# Start transaction
transaction = FirewallTransaction(self)
# flush rules
if not reload:
self.flush(use_transaction=transaction)
# If modules need to be unloaded in complete reload or if there are
# ipsets to get applied, limit the transaction to flush.
#
# Future optimization for the ipset case in reload: The transaction
# only needs to be split here if there are conflicting ipset types in
# exsting ipsets and the configuration in firewalld.
if (reload and complete_reload) or \
(self.ipset_enabled and self.ipset.has_ipsets()):
transaction.execute(True)
transaction.clear()
# complete reload: unload modules also
if reload and complete_reload:
log.debug1("Unloading firewall modules")
self.modules_backend.unload_firewall_modules()
self.apply_default_tables(use_transaction=transaction)
transaction.execute(True)
transaction.clear()
# apply settings for loaded ipsets while reloading here
if self.ipset_enabled and self.ipset.has_ipsets():
log.debug1("Applying ipsets")
self.ipset.apply_ipsets()
# Start or continue with transaction
# apply default rules
log.debug1("Applying default rule set")
self.apply_default_rules(use_transaction=transaction)
# apply settings for loaded zones
log.debug1("Applying used zones")
self.zone.apply_zones(use_transaction=transaction)
self.zone.change_default_zone(None, self._default_zone,
use_transaction=transaction)
# apply policies
log.debug1("Applying used policies")
self.policy.apply_policies(use_transaction=transaction)
# Execute transaction
transaction.execute(True)
# Start new transaction for direct rules
transaction.clear()
# apply direct chains, rules and passthrough rules
if self.direct.has_configuration():
log.debug1("Applying direct chains rules and passthrough rules")
self.direct.apply_direct(transaction)
# since direct rules are easy to make syntax errors lets highlight
# the cause if the transaction fails.
try:
transaction.execute(True)
transaction.clear()
except FirewallError as e:
raise FirewallError(e.code, "Direct: %s" % (e.msg if e.msg else ""))
except Exception:
raise
del transaction
if log.getDebugLogLevel() > 1:
# get time after flushing and applying
tm2 = time.time()
log.debug2("Flushing and applying took %f seconds" % (tm2 - tm1))
def start(self):
try:
self._start()
except Exception:
self._state = "FAILED"
self.set_policy("ACCEPT")
raise
else:
self._state = "RUNNING"
self.set_policy("ACCEPT")
def _loader(self, path, reader_type, combine=False):
# combine: several zone files are getting combined into one obj
if not os.path.isdir(path):
return
if combine:
if path.startswith(config.ETC_FIREWALLD) and reader_type == "zone":
combined_zone = Zone()
combined_zone.name = os.path.basename(path)
combined_zone.check_name(combined_zone.name)
combined_zone.path = path
combined_zone.default = False
else:
combine = False
for filename in sorted(os.listdir(path)):
if not filename.endswith(".xml"):
if path.startswith(config.ETC_FIREWALLD) and \
reader_type == "zone" and \
os.path.isdir("%s/%s" % (path, filename)):
self._loader("%s/%s" % (path, filename), reader_type,
combine=True)
continue
name = "%s/%s" % (path, filename)
log.debug1("Loading %s file '%s'", reader_type, name)
try:
if reader_type == "icmptype":
obj = icmptype_reader(filename, path)
if obj.name in self.icmptype.get_icmptypes():
orig_obj = self.icmptype.get_icmptype(obj.name)
log.debug1(" Overloads %s '%s' ('%s/%s')", reader_type,
orig_obj.name, orig_obj.path,
orig_obj.filename)
self.icmptype.remove_icmptype(orig_obj.name)
elif obj.path.startswith(config.ETC_FIREWALLD):
obj.default = True
try:
self.icmptype.add_icmptype(obj)
except FirewallError as error:
log.info1("%s: %s, ignoring for run-time." % \
(obj.name, str(error)))
# add a deep copy to the configuration interface
self.config.add_icmptype(copy.deepcopy(obj))
elif reader_type == "service":
obj = service_reader(filename, path)
if obj.name in self.service.get_services():
orig_obj = self.service.get_service(obj.name)
log.debug1(" Overloads %s '%s' ('%s/%s')", reader_type,
orig_obj.name, orig_obj.path,
orig_obj.filename)
self.service.remove_service(orig_obj.name)
elif obj.path.startswith(config.ETC_FIREWALLD):
obj.default = True
self.service.add_service(obj)
# add a deep copy to the configuration interface
self.config.add_service(copy.deepcopy(obj))
elif reader_type == "zone":
obj = zone_reader(filename, path, no_check_name=combine)
if combine:
# Change name for permanent configuration
obj.name = "%s/%s" % (
os.path.basename(path),
os.path.basename(filename)[0:-4])
obj.check_name(obj.name)
# Copy object before combine
config_obj = copy.deepcopy(obj)
if obj.name in self.zone.get_zones():
orig_obj = self.zone.get_zone(obj.name)
self.zone.remove_zone(orig_obj.name)
if orig_obj.combined:
log.debug1(" Combining %s '%s' ('%s/%s')",
reader_type, obj.name,
path, filename)
obj.combine(orig_obj)
else:
log.debug1(" Overloads %s '%s' ('%s/%s')",
reader_type,
orig_obj.name, orig_obj.path,
orig_obj.filename)
elif obj.path.startswith(config.ETC_FIREWALLD):
obj.default = True
config_obj.default = True
self.config.add_zone(config_obj)
if combine:
log.debug1(" Combining %s '%s' ('%s/%s')",
reader_type, combined_zone.name,
path, filename)
combined_zone.combine(obj)
else:
self.zone.add_zone(obj)
elif reader_type == "ipset":
obj = ipset_reader(filename, path)
if obj.name in self.ipset.get_ipsets():
orig_obj = self.ipset.get_ipset(obj.name)
log.debug1(" Overloads %s '%s' ('%s/%s')", reader_type,
orig_obj.name, orig_obj.path,
orig_obj.filename)
self.ipset.remove_ipset(orig_obj.name)
elif obj.path.startswith(config.ETC_FIREWALLD):
obj.default = True
try:
self.ipset.add_ipset(obj)
except FirewallError as error:
log.warning("%s: %s, ignoring for run-time." % \
(obj.name, str(error)))
# add a deep copy to the configuration interface
self.config.add_ipset(copy.deepcopy(obj))
elif reader_type == "helper":
obj = helper_reader(filename, path)
if obj.name in self.helper.get_helpers():
orig_obj = self.helper.get_helper(obj.name)
log.debug1(" Overloads %s '%s' ('%s/%s')", reader_type,
orig_obj.name, orig_obj.path,
orig_obj.filename)
self.helper.remove_helper(orig_obj.name)
elif obj.path.startswith(config.ETC_FIREWALLD):
obj.default = True
self.helper.add_helper(obj)
# add a deep copy to the configuration interface
self.config.add_helper(copy.deepcopy(obj))
elif reader_type == "policy":
obj = policy_reader(filename, path)
if obj.name in self.policy.get_policies():
orig_obj = self.policy.get_policy(obj.name)
log.debug1(" Overloads %s '%s' ('%s/%s')", reader_type,
orig_obj.name, orig_obj.path,
orig_obj.filename)
self.policy.remove_policy(orig_obj.name)
elif obj.path.startswith(config.ETC_FIREWALLD):
obj.default = True
self.policy.add_policy(obj)
# add a deep copy to the configuration interface
self.config.add_policy_object(copy.deepcopy(obj))
else:
log.fatal("Unknown reader type %s", reader_type)
except FirewallError as msg:
log.error("Failed to load %s file '%s': %s", reader_type,
name, msg)
except Exception:
log.error("Failed to load %s file '%s':", reader_type, name)
log.exception()
if combine and combined_zone.combined:
if combined_zone.name in self.zone.get_zones():
orig_obj = self.zone.get_zone(combined_zone.name)
log.debug1(" Overloading and deactivating %s '%s' ('%s/%s')",
reader_type, orig_obj.name, orig_obj.path,
orig_obj.filename)
try:
self.zone.remove_zone(combined_zone.name)
except Exception:
pass
self.config.forget_zone(combined_zone.name)
self.zone.add_zone(combined_zone)
def cleanup(self):
self.icmptype.cleanup()
self.service.cleanup()
self.zone.cleanup()
self.ipset.cleanup()
self.helper.cleanup()
self.config.cleanup()
self.direct.cleanup()
self.policies.cleanup()
self.policy.cleanup()
self._firewalld_conf.cleanup()
self.__init_vars()
def stop(self):
if not self._offline:
if self.cleanup_on_exit:
self.flush()
self.ipset.flush()
self.set_policy("ACCEPT")
if self.cleanup_modules_on_exit:
log.debug1('Unloading firewall kernel modules')
self.modules_backend.unload_firewall_modules()
self.cleanup()
# handle modules
def handle_modules(self, _modules, enable):
num_failed = 0
error_msgs = ""
for i,module in enumerate(_modules):
if enable:
(status, msg) = self.modules_backend.load_module(module)
else:
if self._module_refcount[module] > 1:
status = 0 # module referenced more then one, do not unload
else:
(status, msg) = self.modules_backend.unload_module(module)
if status != 0:
num_failed += 1
error_msgs += msg
continue
if enable:
self._module_refcount.setdefault(module, 0)
self._module_refcount[module] += 1
else:
if module in self._module_refcount:
self._module_refcount[module] -= 1
if self._module_refcount[module] == 0:
del self._module_refcount[module]
return (num_failed, error_msgs)
def _select_firewall_backend(self, backend):
if backend != "nftables":
self.nftables_enabled = False
# even if using nftables, the other backends are enabled for use with
# the direct interface. nftables is used for the firewalld primitives.
def get_backend_by_name(self, name):
for backend in self.all_backends():
if backend.name == name:
return backend
raise FirewallError(errors.UNKNOWN_ERROR,
"'%s' backend does not exist" % name)
def get_backend_by_ipv(self, ipv):
if self.nftables_enabled:
return self.nftables_backend
if ipv == "ipv4" and self.ip4tables_enabled:
return self.ip4tables_backend
elif ipv == "ipv6" and self.ip6tables_enabled:
return self.ip6tables_backend
elif ipv == "eb" and self.ebtables_enabled:
return self.ebtables_backend
raise FirewallError(errors.INVALID_IPV,
"'%s' is not a valid backend or is unavailable" % ipv)
def get_direct_backend_by_ipv(self, ipv):
if ipv == "ipv4" and self.ip4tables_enabled:
return self.ip4tables_backend
elif ipv == "ipv6" and self.ip6tables_enabled:
return self.ip6tables_backend
elif ipv == "eb" and self.ebtables_enabled:
return self.ebtables_backend
raise FirewallError(errors.INVALID_IPV,
"'%s' is not a valid backend or is unavailable" % ipv)
def is_backend_enabled(self, name):
if name == "ip4tables":
return self.ip4tables_enabled
elif name == "ip6tables":
return self.ip6tables_enabled
elif name == "ebtables":
return self.ebtables_enabled
elif name == "nftables":
return self.nftables_enabled
return False
def is_ipv_enabled(self, ipv):
if self.nftables_enabled:
return True
if ipv == "ipv4":
return self.ip4tables_enabled
elif ipv == "ipv6":
return self.ip6tables_enabled
elif ipv == "eb":
return self.ebtables_enabled
return False
def enabled_backends(self):
backends = []
if self.nftables_enabled:
backends.append(self.nftables_backend)
else:
if self.ip4tables_enabled:
backends.append(self.ip4tables_backend)
if self.ip6tables_enabled:
backends.append(self.ip6tables_backend)
if self.ebtables_enabled:
backends.append(self.ebtables_backend)
return backends
def all_backends(self):
backends = []
if self.ip4tables_enabled:
backends.append(self.ip4tables_backend)
if self.ip6tables_enabled:
backends.append(self.ip6tables_backend)
if self.ebtables_enabled:
backends.append(self.ebtables_backend)
if self.nftables_enabled:
backends.append(self.nftables_backend)
return backends
def apply_default_tables(self, use_transaction=None):
if use_transaction is None:
transaction = FirewallTransaction(self)
else:
transaction = use_transaction
for backend in self.enabled_backends():
transaction.add_rules(backend, backend.build_default_tables())
if use_transaction is None:
transaction.execute(True)
def apply_default_rules(self, use_transaction=None):
if use_transaction is None:
transaction = FirewallTransaction(self)
else:
transaction = use_transaction
for backend in self.enabled_backends():
rules = backend.build_default_rules(self._log_denied)
transaction.add_rules(backend, rules)
if self.is_ipv_enabled("ipv6"):
ipv6_backend = self.get_backend_by_ipv("ipv6")
if "raw" in ipv6_backend.get_available_tables():
if self.ipv6_rpfilter_enabled:
rules = ipv6_backend.build_rpfilter_rules(self._log_denied)
transaction.add_rules(ipv6_backend, rules)
if self.is_ipv_enabled("ipv6") and self._rfc3964_ipv4:
rules = ipv6_backend.build_rfc3964_ipv4_rules()
transaction.add_rules(ipv6_backend, rules)
if use_transaction is None:
transaction.execute(True)
def may_skip_flush_direct_backends(self):
if self.nftables_enabled and not self.direct.has_runtime_configuration():
return True
return False
def flush_direct_backends(self, use_transaction=None):
if use_transaction is None:
transaction = FirewallTransaction(self)
else:
transaction = use_transaction
for backend in self.all_backends():
if backend in self.enabled_backends():
continue
rules = backend.build_flush_rules()
transaction.add_rules(backend, rules)
if use_transaction is None:
transaction.execute(True)
def flush(self, use_transaction=None):
if use_transaction is None:
transaction = FirewallTransaction(self)
else:
transaction = use_transaction
log.debug1("Flushing rule set")
if not self.may_skip_flush_direct_backends():
self.flush_direct_backends(use_transaction=transaction)
for backend in self.enabled_backends():
rules = backend.build_flush_rules()
transaction.add_rules(backend, rules)
if use_transaction is None:
transaction.execute(True)
def set_policy(self, policy, use_transaction=None):
if use_transaction is None:
transaction = FirewallTransaction(self)
else:
transaction = use_transaction
log.debug1("Setting policy to '%s'", policy)
for backend in self.enabled_backends():
rules = backend.build_set_policy_rules(policy)
transaction.add_rules(backend, rules)
if use_transaction is None:
transaction.execute(True)
# rule function used in handle_ functions
def rule(self, backend_name, rule):
if not rule:
return ""
backend = self.get_backend_by_name(backend_name)
if not backend:
raise FirewallError(errors.INVALID_IPV,
"'%s' is not a valid backend" % backend_name)
if not self.is_backend_enabled(backend_name):
return ""
return backend.set_rule(rule, self._log_denied)
def rules(self, backend_name, rules):
_rules = list(filter(None, rules))
backend = self.get_backend_by_name(backend_name)
if not backend:
raise FirewallError(errors.INVALID_IPV,
"'%s' is not a valid backend" % backend_name)
if not self.is_backend_enabled(backend_name):
return
if self._individual_calls or \
not backend.restore_command_exists or \
(backend_name == "ebtables" and not self.ebtables_backend.restore_noflush_option):
for i,rule in enumerate(_rules):
try:
backend.set_rule(rule, self._log_denied)
except Exception as msg:
log.debug1(traceback.format_exc())
log.error(msg)
for rule in reversed(_rules[:i]):
try:
backend.set_rule(backend.reverse_rule(rule), self._log_denied)
except Exception:
# ignore errors here
pass
raise msg
else:
backend.set_rules(_rules, self._log_denied)
# check functions
def check_panic(self):
if self._panic:
raise FirewallError(errors.PANIC_MODE)
def check_policy(self, policy):
_policy = policy
if _policy not in self.policy.get_policies():
raise FirewallError(errors.INVALID_POLICY, _policy)
return _policy
def check_zone(self, zone):
_zone = zone
if not _zone or _zone == "":
_zone = self.get_default_zone()
if _zone not in self.zone.get_zones():
raise FirewallError(errors.INVALID_ZONE, _zone)
return _zone
def check_interface(self, interface):
if not functions.checkInterface(interface):
raise FirewallError(errors.INVALID_INTERFACE, interface)
def check_service(self, service):
self.service.check_service(service)
def check_port(self, port):
if not functions.check_port(port):
raise FirewallError(errors.INVALID_PORT, port)
def check_tcpudp(self, protocol):
if not protocol:
raise FirewallError(errors.MISSING_PROTOCOL)
if protocol not in [ "tcp", "udp", "sctp", "dccp" ]:
raise FirewallError(errors.INVALID_PROTOCOL,
"'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \
protocol)
def check_ip(self, ip):
if not functions.checkIP(ip):
raise FirewallError(errors.INVALID_ADDR, ip)
def check_address(self, ipv, source):
if ipv == "ipv4":
if not functions.checkIPnMask(source):
raise FirewallError(errors.INVALID_ADDR, source)
elif ipv == "ipv6":
if not functions.checkIP6nMask(source):
raise FirewallError(errors.INVALID_ADDR, source)
else:
raise FirewallError(errors.INVALID_IPV,
"'%s' not in {'ipv4'|'ipv6'}")
def check_icmptype(self, icmp):
self.icmptype.check_icmptype(icmp)
def check_timeout(self, timeout):
if not isinstance(timeout, int):
raise TypeError("%s is %s, expected int" % (timeout, type(timeout)))
if int(timeout) < 0:
raise FirewallError(errors.INVALID_VALUE,
"timeout '%d' is not positive number" % timeout)
# RELOAD
def reload(self, stop=False):
_panic = self._panic
# must stash this. The value may change after _start()
flush_all = self._flush_all_on_reload
if not flush_all:
# save zone interfaces
_zone_interfaces = { }
for zone in self.zone.get_zones():
_zone_interfaces[zone] = self.zone.get_settings(zone)["interfaces"]
# save direct config
_direct_config = self.direct.get_runtime_config()
_old_dz = self.get_default_zone()
_ipset_objs = []
for _name in self.ipset.get_ipsets():
_ipset_objs.append(self.ipset.get_ipset(_name))
if not _panic:
self.set_policy("DROP")
self.flush()
self.cleanup()
start_exception = None
try:
self._start(reload=True, complete_reload=stop)
except Exception as e:
# save the exception for later, but continue restoring interfaces,
# etc. We'll re-raise it at the end.
start_exception = e
# destroy ipsets no longer in the permanent configuration
if flush_all:
for obj in _ipset_objs:
if not self.ipset.query_ipset(obj.name):
for backend in self.ipset.backends():
# nftables sets are part of the normal firewall ruleset.
if backend.name == "nftables":
continue
backend.set_destroy(obj.name)
if not flush_all:
# handle interfaces in the default zone and move them to the new
# default zone if it changed
_new_dz = self.get_default_zone()
if _new_dz != _old_dz:
# if_new_dz has been introduced with the reload, we need to add it
# https://github.com/firewalld/firewalld/issues/53
if _new_dz not in _zone_interfaces:
_zone_interfaces[_new_dz] = { }
# default zone changed. Move interfaces from old default zone to
# the new one.
for iface, settings in list(_zone_interfaces[_old_dz].items()):
if settings["__default__"]:
# move only those that were added to default zone
# (not those that were added to specific zone same as
# default)
_zone_interfaces[_new_dz][iface] = \
_zone_interfaces[_old_dz][iface]
del _zone_interfaces[_old_dz][iface]
# add interfaces to zones again
for zone in self.zone.get_zones():
if zone in _zone_interfaces:
for interface_id in _zone_interfaces[zone]:
self.zone.change_zone_of_interface(zone, interface_id,
_zone_interfaces[zone][interface_id]["sender"])
del _zone_interfaces[zone]
else:
log.info1("New zone '%s'.", zone)
if len(_zone_interfaces) > 0:
for zone in list(_zone_interfaces.keys()):
log.info1("Lost zone '%s', zone interfaces dropped.", zone)
del _zone_interfaces[zone]
del _zone_interfaces
# restore runtime-only ipsets
for obj in _ipset_objs:
if self.ipset.query_ipset(obj.name):
for entry in obj.entries:
try:
self.ipset.add_entry(obj.name, entry)
except FirewallError as msg:
if msg.code != errors.ALREADY_ENABLED:
raise msg
else:
self.ipset.add_ipset(obj)
self.ipset.apply_ipset(obj.name)
# restore direct config
self.direct.set_config(_direct_config)
# Restore permanent interfaces from NetworkManager
nm_bus_name = nm_get_bus_name()
if nm_bus_name:
for zone in self.zone.get_zones() + [""]:
for interface in nm_get_interfaces_in_zone(zone):
self.zone.change_zone_of_interface(zone, interface, sender=nm_bus_name)
self._panic = _panic
if not self._panic:
self.set_policy("ACCEPT")
if start_exception:
self._state = "FAILED"
raise start_exception
else:
self._state = "RUNNING"
# STATE
def get_state(self):
return self._state
# PANIC MODE
def enable_panic_mode(self):
if self._panic:
raise FirewallError(errors.ALREADY_ENABLED,
"panic mode already enabled")
try:
self.set_policy("PANIC")
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
self._panic = True
def disable_panic_mode(self):
if not self._panic:
raise FirewallError(errors.NOT_ENABLED,
"panic mode is not enabled")
try:
self.set_policy("ACCEPT")
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
self._panic = False
def query_panic_mode(self):
return self._panic
# LOG DENIED
def get_log_denied(self):
return self._log_denied
def set_log_denied(self, value):
if value not in config.LOG_DENIED_VALUES:
raise FirewallError(errors.INVALID_VALUE,
"'%s', choose from '%s'" % \
(value, "','".join(config.LOG_DENIED_VALUES)))
if value != self.get_log_denied():
self._log_denied = value
self._firewalld_conf.set("LogDenied", value)
self._firewalld_conf.write()
else:
raise FirewallError(errors.ALREADY_SET, value)
# DEFAULT ZONE
def get_default_zone(self):
return self._default_zone
def set_default_zone(self, zone):
_zone = self.check_zone(zone)
if _zone != self._default_zone:
_old_dz = self._default_zone
self._default_zone = _zone
self._firewalld_conf.set("DefaultZone", _zone)
self._firewalld_conf.write()
# remove old default zone from ZONES and add new default zone
self.zone.change_default_zone(_old_dz, _zone)
# Move interfaces from old default zone to the new one.
_old_dz_settings = self.zone.get_settings(_old_dz)
for iface, settings in list(_old_dz_settings["interfaces"].items()):
if settings["__default__"]:
# move only those that were added to default zone
# (not those that were added to specific zone same as default)
self.zone.change_zone_of_interface("", iface)
else:
raise FirewallError(errors.ZONE_ALREADY_SET, _zone)
def combine_runtime_with_permanent_settings(self, permanent, runtime):
combined = permanent.copy()
for key,value in runtime.items():
# omit empty entries
if value or isinstance(value, bool):
combined[key] = value
# make sure to remove values that were in permanent, but no
# longer in runtime.
elif key in combined:
del combined[key]
return combined
def get_added_and_removed_settings(self, old_settings, new_settings):
add_settings = {}
remove_settings = {}
for key in (set(old_settings.keys()) | set(new_settings.keys())):
if key in new_settings:
if isinstance(new_settings[key], list):
old = set(old_settings[key] if key in old_settings else [])
add_settings[key] = list(set(new_settings[key]) - old)
remove_settings[key] = list((old ^ set(new_settings[key])) & old)
# check for bool or int because dbus.Boolean is a subclass of
# int (because bool can't be subclassed).
elif isinstance(new_settings[key], bool) or isinstance(new_settings[key], int):
if not old_settings[key] and new_settings[key]:
add_settings[key] = True
elif old_settings[key] and not new_settings[key]:
remove_settings[key] = False
else:
raise FirewallError(errors.INVALID_SETTING, "Unhandled setting type {} key {}".format(type(new_settings[key]), key))
return (add_settings, remove_settings)
core/fw_policy.py 0000644 00000253075 15035135173 0010060 0 ustar 00 # -*- coding: utf-8 -*-
#
# SPDX-License-Identifier: GPL-2.0-or-later
import time
import copy
from firewall.core.logger import log
from firewall.functions import portStr, checkIPnMask, checkIP6nMask, \
checkProtocol, enable_ip_forwarding, check_single_address, \
portInPortRange, get_nf_conntrack_short_name, coalescePortRange, breakPortRange
from firewall.core.rich import Rich_Rule, Rich_Accept, \
Rich_Service, Rich_Port, Rich_Protocol, \
Rich_Masquerade, Rich_ForwardPort, Rich_SourcePort, Rich_IcmpBlock, \
Rich_IcmpType, Rich_Mark
from firewall.core.fw_transaction import FirewallTransaction
from firewall import errors
from firewall.errors import FirewallError
from firewall.fw_types import LastUpdatedOrderedDict
from firewall.core.base import SOURCE_IPSET_TYPES
class FirewallPolicy(object):
def __init__(self, fw):
self._fw = fw
self._chains = { }
self._policies = { }
def __repr__(self):
return '%s(%r, %r)' % (self.__class__, self._chains, self._policies)
def cleanup(self):
self._chains.clear()
self._policies.clear()
# transaction
def new_transaction(self):
return FirewallTransaction(self._fw)
# policies
def get_policies(self):
return sorted(self._policies.keys())
def get_policies_not_derived_from_zone(self):
policies = []
for p in self.get_policies():
p_obj = self.get_policy(p)
if not p_obj.derived_from_zone:
policies.append(p)
return sorted(policies)
def get_active_policies_not_derived_from_zone(self):
active_policies = []
for policy in self.get_policies_not_derived_from_zone():
settings = self.get_settings(policy)
if (set(settings["ingress_zones"]) & (set(self._fw.zone.get_active_zones()) | set(["HOST", "ANY"]))) and \
(set(settings["egress_zones"]) & (set(self._fw.zone.get_active_zones()) | set(["HOST", "ANY"]))):
active_policies.append(policy)
return active_policies
def get_policy(self, policy):
p = self._fw.check_policy(policy)
return self._policies[p]
def add_policy(self, obj):
obj.settings = { x : LastUpdatedOrderedDict()
for x in [ "services", "ports",
"masquerade", "forward_ports",
"source_ports",
"icmp_blocks", "rules",
"protocols", "icmp_block_inversion",
"ingress_zones", "egress_zones" ] }
self._policies[obj.name] = obj
self.copy_permanent_to_runtime(obj.name)
def remove_policy(self, policy):
obj = self._policies[policy]
if obj.applied:
self.unapply_policy_settings(policy)
obj.settings.clear()
del self._policies[policy]
def copy_permanent_to_runtime(self, policy):
obj = self._policies[policy]
if obj.applied:
return
for args in obj.ingress_zones:
self.add_ingress_zone(policy, args, allow_apply=False)
for args in obj.egress_zones:
self.add_egress_zone(policy, args, allow_apply=False)
for args in obj.icmp_blocks:
self.add_icmp_block(policy, args)
for args in obj.forward_ports:
self.add_forward_port(policy, *args)
for args in obj.services:
self.add_service(policy, args)
for args in obj.ports:
try:
self.add_port(policy, *args)
except FirewallError as error:
if error.code in [errors.ALREADY_ENABLED]:
log.warning(error)
else:
raise error
for args in obj.protocols:
self.add_protocol(policy, args)
for args in obj.source_ports:
try:
self.add_source_port(policy, *args)
except FirewallError as error:
if error.code in [errors.ALREADY_ENABLED]:
log.warning(error)
else:
raise error
for args in obj.rules:
self.add_rule(policy, args)
if obj.masquerade:
self.add_masquerade(policy)
def apply_policies(self, use_transaction=None):
for policy in self.get_policies():
p_obj = self._policies[policy]
if p_obj.derived_from_zone:
continue
if policy in self.get_active_policies_not_derived_from_zone():
log.debug1("Applying policy '%s'", policy)
self.apply_policy_settings(policy, use_transaction=use_transaction)
def set_policy_applied(self, policy, applied):
obj = self._policies[policy]
obj.applied = applied
# settings
# generate settings record with sender, timeout
def __gen_settings(self, timeout, sender):
ret = {
"date": time.time(),
"sender": sender,
"timeout": timeout,
}
return ret
def get_settings(self, policy):
return self.get_policy(policy).settings
def _policy_settings(self, enable, policy, use_transaction=None):
_policy = self._fw.check_policy(policy)
obj = self._policies[_policy]
if (enable and obj.applied) or (not enable and not obj.applied):
return
if enable:
obj.applied = True
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if enable:
# build the base chain layout of the policy
for (table, chain) in self._get_table_chains_for_policy_dispatch(policy) if not obj.derived_from_zone \
else self._get_table_chains_for_zone_dispatch(policy):
self.gen_chain_rules(policy, True, table, chain, transaction)
settings = self.get_settings(policy)
if not obj.derived_from_zone:
self._ingress_egress_zones(enable, _policy, transaction)
for key in settings:
for args in settings[key]:
if key == "icmp_blocks":
self._icmp_block(enable, _policy, args, transaction)
elif key == "icmp_block_inversion":
continue
elif key == "forward_ports":
self._forward_port(enable, _policy, transaction,
*args)
elif key == "services":
self._service(enable, _policy, args, transaction)
elif key == "ports":
self._port(enable, _policy, args[0], args[1],
transaction)
elif key == "protocols":
self._protocol(enable, _policy, args, transaction)
elif key == "source_ports":
self._source_port(enable, _policy, args[0], args[1],
transaction)
elif key == "masquerade":
self._masquerade(enable, _policy, transaction)
elif key == "rules":
self.__rule(enable, _policy, Rich_Rule(rule_str=args),
transaction)
elif key == "ingress_zones":
continue
elif key == "egress_zones":
continue
else:
log.warning("Policy '%s': Unknown setting '%s:%s', "
"unable to apply", policy, key, args)
if not enable:
for (table, chain) in self._get_table_chains_for_policy_dispatch(policy) if not obj.derived_from_zone \
else self._get_table_chains_for_zone_dispatch(policy):
self.gen_chain_rules(policy, False, table, chain, transaction)
obj.applied = False
if use_transaction is None:
transaction.execute(enable)
def apply_policy_settings(self, policy, use_transaction=None):
self._policy_settings(True, policy, use_transaction=use_transaction)
def unapply_policy_settings(self, policy, use_transaction=None):
self._policy_settings(False, policy, use_transaction=use_transaction)
def get_config_with_settings_dict(self, policy):
"""
:return: exported config updated with runtime settings
"""
permanent = self.get_policy(policy).export_config_dict()
runtime = { "services": self.list_services(policy),
"ports": self.list_ports(policy),
"icmp_blocks": self.list_icmp_blocks(policy),
"masquerade": self.query_masquerade(policy),
"forward_ports": self.list_forward_ports(policy),
"rich_rules": self.list_rules(policy),
"protocols": self.list_protocols(policy),
"source_ports": self.list_source_ports(policy),
"ingress_zones": self.list_ingress_zones(policy),
"egress_zones": self.list_egress_zones(policy),
}
return self._fw.combine_runtime_with_permanent_settings(permanent, runtime)
def set_config_with_settings_dict(self, policy, settings, sender):
# stupid wrappers to convert rich rule string to rich rule object
from firewall.core.rich import Rich_Rule
def add_rule_wrapper(policy, rule_str, timeout=0, sender=None):
self.add_rule(policy, Rich_Rule(rule_str=rule_str), timeout=0, sender=sender)
def remove_rule_wrapper(policy, rule_str):
self.remove_rule(policy, Rich_Rule(rule_str=rule_str))
setting_to_fn = {
"services": (self.add_service, self.remove_service),
"ports": (self.add_port, self.remove_port),
"icmp_blocks": (self.add_icmp_block, self.remove_icmp_block),
"masquerade": (self.add_masquerade, self.remove_masquerade),
"forward_ports": (self.add_forward_port, self.remove_forward_port),
"rich_rules": (add_rule_wrapper, remove_rule_wrapper),
"protocols": (self.add_protocol, self.remove_protocol),
"source_ports": (self.add_source_port, self.remove_source_port),
"ingress_zones": (self.add_ingress_zone, self.remove_ingress_zone),
"egress_zones": (self.add_egress_zone, self.remove_egress_zone),
}
old_settings = self.get_config_with_settings_dict(policy)
(add_settings, remove_settings) = self._fw.get_added_and_removed_settings(old_settings, settings)
for key in remove_settings:
if isinstance(remove_settings[key], list):
for args in remove_settings[key]:
if isinstance(args, tuple):
setting_to_fn[key][1](policy, *args)
else:
setting_to_fn[key][1](policy, args)
else: # bool
setting_to_fn[key][1](policy)
for key in add_settings:
if isinstance(add_settings[key], list):
for args in add_settings[key]:
if isinstance(args, tuple):
setting_to_fn[key][0](policy, *args, timeout=0, sender=sender)
else:
setting_to_fn[key][0](policy, args, timeout=0, sender=sender)
else: # bool
setting_to_fn[key][0](policy, timeout=0, sender=sender)
# ingress zones
def check_ingress_zone(self, zone):
if not zone:
raise FirewallError(errors.INVALID_ZONE)
if zone not in ["HOST", "ANY"]:
self._fw.check_zone(zone)
def __ingress_zone_id(self, zone):
self.check_ingress_zone(zone)
return zone
def add_ingress_zone(self, policy, zone, timeout=0, sender=None,
use_transaction=None, allow_apply=True):
_policy = self._fw.check_policy(policy)
self._fw.check_timeout(timeout)
self._fw.check_panic()
_obj = self._policies[_policy]
zone_id = self.__ingress_zone_id(zone)
if zone_id in _obj.settings["ingress_zones"]:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s' already in '%s'" % (zone, _policy))
if "ANY" in _obj.settings["ingress_zones"] or "HOST" in _obj.settings["ingress_zones"] or \
zone in ["ANY", "HOST"] and _obj.settings["ingress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'ingress-zones' may only contain one of: many regular zones, ANY, or HOST")
if zone == "HOST" and "HOST" in _obj.settings["egress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'HOST' can only appear in either ingress or egress zones, but not both")
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if allow_apply:
if _obj.applied:
self._ingress_egress_zones(False, _policy, transaction)
# register early so backends can access updated zone list
self.__register_ingress_zone(_obj, zone_id, timeout, sender)
transaction.add_fail(self.__unregister_ingress_zone, _obj, zone_id)
if not _obj.applied:
if _policy in self.get_active_policies_not_derived_from_zone():
self.apply_policy_settings(_policy, use_transaction=transaction)
transaction.add_fail(self.set_policy_applied, _policy, False)
else:
self._ingress_egress_zones(True, _policy, transaction)
else:
self.__register_ingress_zone(_obj, zone_id, timeout, sender)
transaction.add_fail(self.__unregister_ingress_zone, _obj, zone_id)
if use_transaction is None:
transaction.execute(True)
def __register_ingress_zone(self, _obj, zone_id, timeout, sender):
_obj.settings["ingress_zones"][zone_id] = self.__gen_settings(timeout, sender)
def remove_ingress_zone(self, policy, zone, use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
zone_id = self.__ingress_zone_id(zone)
if zone_id not in _obj.settings["ingress_zones"]:
raise FirewallError(errors.NOT_ENABLED,
"'%s' not in '%s'" % (zone, _policy))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
if len(_obj.settings["ingress_zones"]) == 1:
self.unapply_policy_settings(_policy, transaction)
else:
self._ingress_egress_zones(False, _policy, transaction)
# unregister early so backends have updated zone list
self.__unregister_ingress_zone(_obj, zone_id)
transaction.add_fail(self.__register_ingress_zone, _obj, zone_id, None, None)
if _policy in self.get_active_policies_not_derived_from_zone():
self._ingress_egress_zones(True, _policy, transaction)
else:
transaction.add_post(self.__unregister_ingress_zone, _obj, zone_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __unregister_ingress_zone(self, _obj, zone_id):
if zone_id in _obj.settings["ingress_zones"]:
del _obj.settings["ingress_zones"][zone_id]
def query_ingress_zone(self, policy, zone):
return self.__ingress_zone_id(zone) in self.get_settings(policy)["ingress_zones"]
def list_ingress_zones(self, policy):
return list(self.get_settings(policy)["ingress_zones"].keys())
# egress zones
def check_egress_zone(self, zone):
if not zone:
raise FirewallError(errors.INVALID_ZONE)
if zone not in ["HOST", "ANY"]:
self._fw.check_zone(zone)
def __egress_zone_id(self, zone):
self.check_egress_zone(zone)
return zone
def add_egress_zone(self, policy, zone, timeout=0, sender=None,
use_transaction=None, allow_apply=True):
_policy = self._fw.check_policy(policy)
self._fw.check_timeout(timeout)
self._fw.check_panic()
_obj = self._policies[_policy]
zone_id = self.__egress_zone_id(zone)
if zone_id in _obj.settings["egress_zones"]:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s' already in '%s'" % (zone, _policy))
if "ANY" in _obj.settings["egress_zones"] or "HOST" in _obj.settings["egress_zones"] or \
zone in ["ANY", "HOST"] and _obj.settings["egress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'egress-zones' may only contain one of: many regular zones, ANY, or HOST")
if zone == "HOST" and "HOST" in _obj.settings["ingress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'HOST' can only appear in either ingress or egress zones, but not both")
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if allow_apply:
if _obj.applied:
self._ingress_egress_zones(False, _policy, transaction)
# register early so backends can access updated zone list
self.__register_egress_zone(_obj, zone_id, timeout, sender)
transaction.add_fail(self.__unregister_egress_zone, _obj, zone_id)
if not _obj.applied:
if _policy in self.get_active_policies_not_derived_from_zone():
self.apply_policy_settings(_policy, use_transaction=transaction)
transaction.add_fail(self.set_policy_applied, _policy, False)
else:
self._ingress_egress_zones(True, _policy, transaction)
else:
self.__register_egress_zone(_obj, zone_id, timeout, sender)
transaction.add_fail(self.__unregister_egress_zone, _obj, zone_id)
if use_transaction is None:
transaction.execute(True)
def __register_egress_zone(self, _obj, zone_id, timeout, sender):
_obj.settings["egress_zones"][zone_id] = self.__gen_settings(timeout, sender)
def remove_egress_zone(self, policy, zone, use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
zone_id = self.__egress_zone_id(zone)
if zone_id not in _obj.settings["egress_zones"]:
raise FirewallError(errors.NOT_ENABLED,
"'%s' not in '%s'" % (zone, _policy))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
if len(_obj.settings["egress_zones"]) == 1:
self.unapply_policy_settings(_policy, transaction)
else:
self._ingress_egress_zones(False, _policy, transaction)
# unregister early so backends have updated zone list
self.__unregister_egress_zone(_obj, zone_id)
transaction.add_fail(self.__register_egress_zone, _obj, zone_id, None, None)
if _policy in self.get_active_policies_not_derived_from_zone():
self._ingress_egress_zones(True, _policy, transaction)
else:
transaction.add_post(self.__unregister_egress_zone, _obj, zone_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __unregister_egress_zone(self, _obj, zone_id):
if zone_id in _obj.settings["egress_zones"]:
del _obj.settings["egress_zones"][zone_id]
def query_egress_zone(self, policy, zone):
return self.__egress_zone_id(zone) in self.get_settings(policy)["egress_zones"]
def list_egress_zones(self, policy):
return list(self.get_settings(policy)["egress_zones"].keys())
# RICH LANGUAGE
def check_rule(self, rule):
rule.check()
def __rule_id(self, rule):
self.check_rule(rule)
return str(rule)
def _rule_source_ipv(self, source):
if not source:
return None
if source.addr:
if checkIPnMask(source.addr):
return "ipv4"
elif checkIP6nMask(source.addr):
return "ipv6"
elif hasattr(source, "mac") and source.mac:
return ""
elif hasattr(source, "ipset") and source.ipset:
self._check_ipset_type_for_source(source.ipset)
self._check_ipset_applied(source.ipset)
return self._ipset_family(source.ipset)
return None
def __rule(self, enable, policy, rule, transaction):
self._rule_prepare(enable, policy, rule, transaction)
def add_rule(self, policy, rule, timeout=0, sender=None,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_timeout(timeout)
self._fw.check_panic()
_obj = self._policies[_policy]
rule_id = self.__rule_id(rule)
if rule_id in _obj.settings["rules"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.ALREADY_ENABLED,
"'%s' already in '%s'" % (rule, _name))
if not _obj.derived_from_zone:
if rule.element and isinstance(rule.element, Rich_Masquerade):
if "HOST" in _obj.settings["egress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for egress zone 'HOST'")
if "HOST" in _obj.settings["ingress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for ingress zone 'HOST'")
for zone in _obj.settings["ingress_zones"]:
if zone == "ANY":
continue
if self._fw.zone.list_interfaces(zone):
raise FirewallError(errors.INVALID_ZONE, "'masquerade' cannot be used in a policy if an ingress zone has assigned interfaces")
if rule.element and isinstance(rule.element, Rich_ForwardPort):
if "HOST" in _obj.settings["egress_zones"]:
if rule.element.to_address:
raise FirewallError(errors.INVALID_FORWARD, "A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'")
elif _obj.settings["egress_zones"]:
if not rule.element.to_address:
raise FirewallError(errors.INVALID_FORWARD, "'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone")
for zone in _obj.settings["egress_zones"]:
if zone == "ANY":
continue
if self._fw.zone.list_interfaces(zone):
raise FirewallError(errors.INVALID_ZONE, "'forward-port' cannot be used in a policy if an egress zone has assigned interfaces")
if rule.action and isinstance(rule.action, Rich_Mark):
for zone in _obj.settings["egress_zones"]:
if zone in ["ANY", "HOST"]:
continue
if self._fw.zone.list_interfaces(zone):
raise FirewallError(errors.INVALID_ZONE, "'mark' action cannot be used in a policy if an egress zone has assigned interfaces")
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self.__rule(True, _policy, rule, transaction)
self.__register_rule(_obj, rule_id, timeout, sender)
transaction.add_fail(self.__unregister_rule, _obj, rule_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __register_rule(self, _obj, rule_id, timeout, sender):
_obj.settings["rules"][rule_id] = self.__gen_settings(
timeout, sender)
def remove_rule(self, policy, rule,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
rule_id = self.__rule_id(rule)
if rule_id not in _obj.settings["rules"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.NOT_ENABLED,
"'%s' not in '%s'" % (rule, _name))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self.__rule(False, _policy, rule, transaction)
transaction.add_post(self.__unregister_rule, _obj, rule_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __unregister_rule(self, _obj, rule_id):
if rule_id in _obj.settings["rules"]:
del _obj.settings["rules"][rule_id]
def query_rule(self, policy, rule):
return self.__rule_id(rule) in self.get_settings(policy)["rules"]
def list_rules(self, policy):
return list(self.get_settings(policy)["rules"].keys())
# SERVICES
def check_service(self, service):
self._fw.check_service(service)
def __service_id(self, service):
self.check_service(service)
return service
def add_service(self, policy, service, timeout=0, sender=None,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_timeout(timeout)
self._fw.check_panic()
_obj = self._policies[_policy]
service_id = self.__service_id(service)
if service_id in _obj.settings["services"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.ALREADY_ENABLED,
"'%s' already in '%s'" % (service, _name))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._service(True, _policy, service, transaction)
self.__register_service(_obj, service_id, timeout, sender)
transaction.add_fail(self.__unregister_service, _obj, service_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __register_service(self, _obj, service_id, timeout, sender):
_obj.settings["services"][service_id] = \
self.__gen_settings(timeout, sender)
def remove_service(self, policy, service,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
service_id = self.__service_id(service)
if service_id not in _obj.settings["services"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.NOT_ENABLED,
"'%s' not in '%s'" % (service, _name))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._service(False, _policy, service, transaction)
transaction.add_post(self.__unregister_service, _obj, service_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __unregister_service(self, _obj, service_id):
if service_id in _obj.settings["services"]:
del _obj.settings["services"][service_id]
def query_service(self, policy, service):
return self.__service_id(service) in self.get_settings(policy)["services"]
def list_services(self, policy):
return self.get_settings(policy)["services"].keys()
def get_helpers_for_service_helpers(self, helpers):
_helpers = [ ]
for helper in helpers:
try:
_helper = self._fw.helper.get_helper(helper)
except FirewallError:
raise FirewallError(errors.INVALID_HELPER, helper)
_helpers.append(_helper)
return _helpers
def get_helpers_for_service_modules(self, modules, enable):
# If automatic helper assignment is turned off, helpers that
# do not have ports defined will be replaced by the helpers
# that the helper.module defines.
_helpers = [ ]
for module in modules:
try:
helper = self._fw.helper.get_helper(module)
except FirewallError:
raise FirewallError(errors.INVALID_HELPER, module)
if len(helper.ports) < 1:
_module_short_name = get_nf_conntrack_short_name(helper.module)
try:
_helper = self._fw.helper.get_helper(_module_short_name)
_helpers.append(_helper)
except FirewallError:
if enable:
log.warning("Helper '%s' is not available" % _module_short_name)
continue
else:
_helpers.append(helper)
return _helpers
# PORTS
def check_port(self, port, protocol):
self._fw.check_port(port)
self._fw.check_tcpudp(protocol)
def __port_id(self, port, protocol):
self.check_port(port, protocol)
return (portStr(port, "-"), protocol)
def add_port(self, policy, port, protocol, timeout=0, sender=None,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_timeout(timeout)
self._fw.check_panic()
_obj = self._policies[_policy]
existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.settings["ports"]))
for port_id in existing_port_ids:
if portInPortRange(port, port_id[0]):
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.ALREADY_ENABLED,
"'%s:%s' already in '%s'" % (port, protocol, _name))
added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids])
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
for range in added_ranges:
self._port(True, _policy, portStr(range, "-"), protocol, transaction)
for range in removed_ranges:
self._port(False, _policy, portStr(range, "-"), protocol, transaction)
for range in added_ranges:
port_id = self.__port_id(range, protocol)
self.__register_port(_obj, port_id, timeout, sender)
transaction.add_fail(self.__unregister_port, _obj, port_id)
for range in removed_ranges:
port_id = self.__port_id(range, protocol)
transaction.add_post(self.__unregister_port, _obj, port_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __register_port(self, _obj, port_id, timeout, sender):
_obj.settings["ports"][port_id] = \
self.__gen_settings(timeout, sender)
def remove_port(self, policy, port, protocol,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.settings["ports"]))
for port_id in existing_port_ids:
if portInPortRange(port, port_id[0]):
break
else:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.NOT_ENABLED,
"'%s:%s' not in '%s'" % (port, protocol, _name))
added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids])
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
for range in added_ranges:
self._port(True, _policy, portStr(range, "-"), protocol, transaction)
for range in removed_ranges:
self._port(False, _policy, portStr(range, "-"), protocol, transaction)
for range in added_ranges:
port_id = self.__port_id(range, protocol)
self.__register_port(_obj, port_id, 0, None)
transaction.add_fail(self.__unregister_port, _obj, port_id)
for range in removed_ranges:
port_id = self.__port_id(range, protocol)
transaction.add_post(self.__unregister_port, _obj, port_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __unregister_port(self, _obj, port_id):
if port_id in _obj.settings["ports"]:
del _obj.settings["ports"][port_id]
def query_port(self, policy, port, protocol):
for (_port, _protocol) in self.get_settings(policy)["ports"]:
if portInPortRange(port, _port) and protocol == _protocol:
return True
return False
def list_ports(self, policy):
return list(self.get_settings(policy)["ports"].keys())
# PROTOCOLS
def check_protocol(self, protocol):
if not checkProtocol(protocol):
raise FirewallError(errors.INVALID_PROTOCOL, protocol)
def __protocol_id(self, protocol):
self.check_protocol(protocol)
return protocol
def add_protocol(self, policy, protocol, timeout=0, sender=None,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_timeout(timeout)
self._fw.check_panic()
_obj = self._policies[_policy]
protocol_id = self.__protocol_id(protocol)
if protocol_id in _obj.settings["protocols"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.ALREADY_ENABLED,
"'%s' already in '%s'" % (protocol, _name))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._protocol(True, _policy, protocol, transaction)
self.__register_protocol(_obj, protocol_id, timeout, sender)
transaction.add_fail(self.__unregister_protocol, _obj, protocol_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __register_protocol(self, _obj, protocol_id, timeout, sender):
_obj.settings["protocols"][protocol_id] = \
self.__gen_settings(timeout, sender)
def remove_protocol(self, policy, protocol,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
protocol_id = self.__protocol_id(protocol)
if protocol_id not in _obj.settings["protocols"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.NOT_ENABLED,
"'%s' not in '%s'" % (protocol, _name))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._protocol(False, _policy, protocol, transaction)
transaction.add_post(self.__unregister_protocol, _obj,
protocol_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __unregister_protocol(self, _obj, protocol_id):
if protocol_id in _obj.settings["protocols"]:
del _obj.settings["protocols"][protocol_id]
def query_protocol(self, policy, protocol):
return self.__protocol_id(protocol) in self.get_settings(policy)["protocols"]
def list_protocols(self, policy):
return list(self.get_settings(policy)["protocols"].keys())
# SOURCE PORTS
def __source_port_id(self, port, protocol):
self.check_port(port, protocol)
return (portStr(port, "-"), protocol)
def add_source_port(self, policy, port, protocol, timeout=0, sender=None,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_timeout(timeout)
self._fw.check_panic()
_obj = self._policies[_policy]
existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.settings["source_ports"]))
for port_id in existing_port_ids:
if portInPortRange(port, port_id[0]):
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.ALREADY_ENABLED,
"'%s:%s' already in '%s'" % (port, protocol, _name))
added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids])
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
for range in added_ranges:
self._source_port(True, _policy, portStr(range, "-"), protocol, transaction)
for range in removed_ranges:
self._source_port(False, _policy, portStr(range, "-"), protocol, transaction)
for range in added_ranges:
port_id = self.__source_port_id(range, protocol)
self.__register_source_port(_obj, port_id, timeout, sender)
transaction.add_fail(self.__unregister_source_port, _obj, port_id)
for range in removed_ranges:
port_id = self.__source_port_id(range, protocol)
transaction.add_post(self.__unregister_source_port, _obj, port_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __register_source_port(self, _obj, port_id, timeout, sender):
_obj.settings["source_ports"][port_id] = \
self.__gen_settings(timeout, sender)
def remove_source_port(self, policy, port, protocol,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.settings["source_ports"]))
for port_id in existing_port_ids:
if portInPortRange(port, port_id[0]):
break
else:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.NOT_ENABLED,
"'%s:%s' not in '%s'" % (port, protocol, _name))
added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids])
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
for range in added_ranges:
self._source_port(True, _policy, portStr(range, "-"), protocol, transaction)
for range in removed_ranges:
self._source_port(False, _policy, portStr(range, "-"), protocol, transaction)
for range in added_ranges:
port_id = self.__source_port_id(range, protocol)
self.__register_source_port(_obj, port_id, 0, None)
transaction.add_fail(self.__unregister_source_port, _obj, port_id)
for range in removed_ranges:
port_id = self.__source_port_id(range, protocol)
transaction.add_post(self.__unregister_source_port, _obj, port_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __unregister_source_port(self, _obj, port_id):
if port_id in _obj.settings["source_ports"]:
del _obj.settings["source_ports"][port_id]
def query_source_port(self, policy, port, protocol):
for (_port, _protocol) in self.get_settings(policy)["source_ports"]:
if portInPortRange(port, _port) and protocol == _protocol:
return True
return False
def list_source_ports(self, policy):
return list(self.get_settings(policy)["source_ports"].keys())
# MASQUERADE
def __masquerade_id(self):
return True
def add_masquerade(self, policy, timeout=0, sender=None,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_timeout(timeout)
self._fw.check_panic()
_obj = self._policies[_policy]
masquerade_id = self.__masquerade_id()
if masquerade_id in _obj.settings["masquerade"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.ALREADY_ENABLED,
"masquerade already enabled in '%s'" % _name)
if not _obj.derived_from_zone:
if "HOST" in _obj.settings["egress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for egress zone 'HOST'")
if "HOST" in _obj.settings["ingress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for ingress zone 'HOST'")
for zone in _obj.settings["ingress_zones"]:
if zone == "ANY":
continue
if self._fw.zone.list_interfaces(zone):
raise FirewallError(errors.INVALID_ZONE, "'masquerade' cannot be used in a policy if an ingress zone has assigned interfaces")
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._masquerade(True, _policy, transaction)
self.__register_masquerade(_obj, masquerade_id, timeout, sender)
transaction.add_fail(self.__unregister_masquerade, _obj, masquerade_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __register_masquerade(self, _obj, masquerade_id, timeout, sender):
_obj.settings["masquerade"][masquerade_id] = \
self.__gen_settings(timeout, sender)
def remove_masquerade(self, policy, use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
masquerade_id = self.__masquerade_id()
if masquerade_id not in _obj.settings["masquerade"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.NOT_ENABLED,
"masquerade not enabled in '%s'" % _name)
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._masquerade(False, _policy, transaction)
transaction.add_post(self.__unregister_masquerade, _obj, masquerade_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __unregister_masquerade(self, _obj, masquerade_id):
if masquerade_id in _obj.settings["masquerade"]:
del _obj.settings["masquerade"][masquerade_id]
def query_masquerade(self, policy):
return self.__masquerade_id() in self.get_settings(policy)["masquerade"]
# PORT FORWARDING
def check_forward_port(self, ipv, port, protocol, toport=None, toaddr=None):
self._fw.check_port(port)
self._fw.check_tcpudp(protocol)
if toport:
self._fw.check_port(toport)
if toaddr:
if not check_single_address(ipv, toaddr):
raise FirewallError(errors.INVALID_ADDR, toaddr)
if not toport and not toaddr:
raise FirewallError(
errors.INVALID_FORWARD,
"port-forwarding is missing to-port AND to-addr")
def __forward_port_id(self, port, protocol, toport=None, toaddr=None):
if check_single_address("ipv6", toaddr):
self.check_forward_port("ipv6", port, protocol, toport, toaddr)
else:
self.check_forward_port("ipv4", port, protocol, toport, toaddr)
return (portStr(port, "-"), protocol,
portStr(toport, "-"), str(toaddr))
def add_forward_port(self, policy, port, protocol, toport=None,
toaddr=None, timeout=0, sender=None,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_timeout(timeout)
self._fw.check_panic()
_obj = self._policies[_policy]
forward_id = self.__forward_port_id(port, protocol, toport, toaddr)
if forward_id in _obj.settings["forward_ports"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.ALREADY_ENABLED,
"'%s:%s:%s:%s' already in '%s'" % \
(port, protocol, toport, toaddr, _name))
if not _obj.derived_from_zone:
if "HOST" in _obj.settings["egress_zones"]:
if toaddr:
raise FirewallError(errors.INVALID_FORWARD, "A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'")
elif _obj.settings["egress_zones"]:
if not toaddr:
raise FirewallError(errors.INVALID_FORWARD, "'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone")
for zone in _obj.settings["egress_zones"]:
if zone == "ANY":
continue
if self._fw.zone.list_interfaces(zone):
raise FirewallError(errors.INVALID_ZONE, "'forward-port' cannot be used in a policy if an egress zone has assigned interfaces")
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._forward_port(True, _policy, transaction, port, protocol,
toport, toaddr)
self.__register_forward_port(_obj, forward_id, timeout, sender)
transaction.add_fail(self.__unregister_forward_port, _obj, forward_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __register_forward_port(self, _obj, forward_id, timeout, sender):
_obj.settings["forward_ports"][forward_id] = \
self.__gen_settings(timeout, sender)
def remove_forward_port(self, policy, port, protocol, toport=None,
toaddr=None, use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
forward_id = self.__forward_port_id(port, protocol, toport, toaddr)
if forward_id not in _obj.settings["forward_ports"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.NOT_ENABLED,
"'%s:%s:%s:%s' not in '%s'" % \
(port, protocol, toport, toaddr, _name))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._forward_port(False, _policy, transaction, port, protocol,
toport, toaddr)
transaction.add_post(self.__unregister_forward_port, _obj, forward_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __unregister_forward_port(self, _obj, forward_id):
if forward_id in _obj.settings["forward_ports"]:
del _obj.settings["forward_ports"][forward_id]
def query_forward_port(self, policy, port, protocol, toport=None,
toaddr=None):
forward_id = self.__forward_port_id(port, protocol, toport, toaddr)
return forward_id in self.get_settings(policy)["forward_ports"]
def list_forward_ports(self, policy):
return list(self.get_settings(policy)["forward_ports"].keys())
# ICMP BLOCK
def check_icmp_block(self, icmp):
self._fw.check_icmptype(icmp)
def __icmp_block_id(self, icmp):
self.check_icmp_block(icmp)
return icmp
def add_icmp_block(self, policy, icmp, timeout=0, sender=None,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_timeout(timeout)
self._fw.check_panic()
_obj = self._policies[_policy]
icmp_id = self.__icmp_block_id(icmp)
if icmp_id in _obj.settings["icmp_blocks"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.ALREADY_ENABLED,
"'%s' already in '%s'" % (icmp, _name))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._icmp_block(True, _policy, icmp, transaction)
self.__register_icmp_block(_obj, icmp_id, timeout, sender)
transaction.add_fail(self.__unregister_icmp_block, _obj, icmp_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __register_icmp_block(self, _obj, icmp_id, timeout, sender):
_obj.settings["icmp_blocks"][icmp_id] = \
self.__gen_settings(timeout, sender)
def remove_icmp_block(self, policy, icmp, use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
icmp_id = self.__icmp_block_id(icmp)
if icmp_id not in _obj.settings["icmp_blocks"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(errors.NOT_ENABLED,
"'%s' not in '%s'" % (icmp, _name))
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
self._icmp_block(False, _policy, icmp, transaction)
transaction.add_post(self.__unregister_icmp_block, _obj, icmp_id)
if use_transaction is None:
transaction.execute(True)
return _policy
def __unregister_icmp_block(self, _obj, icmp_id):
if icmp_id in _obj.settings["icmp_blocks"]:
del _obj.settings["icmp_blocks"][icmp_id]
def query_icmp_block(self, policy, icmp):
return self.__icmp_block_id(icmp) in self.get_settings(policy)["icmp_blocks"]
def list_icmp_blocks(self, policy):
return self.get_settings(policy)["icmp_blocks"].keys()
# ICMP BLOCK INVERSION
def __icmp_block_inversion_id(self):
return True
def add_icmp_block_inversion(self, policy, sender=None,
use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
icmp_block_inversion_id = self.__icmp_block_inversion_id()
if icmp_block_inversion_id in _obj.settings["icmp_block_inversion"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(
errors.ALREADY_ENABLED,
"icmp-block-inversion already enabled in '%s'" % _name)
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
# undo icmp blocks
for args in self.get_settings(_policy)["icmp_blocks"]:
self._icmp_block(False, _policy, args, transaction)
self._icmp_block_inversion(False, _policy, transaction)
self.__register_icmp_block_inversion(_obj, icmp_block_inversion_id,
sender)
transaction.add_fail(self.__undo_icmp_block_inversion, _policy, _obj,
icmp_block_inversion_id)
# redo icmp blocks
if _obj.applied:
for args in self.get_settings(_policy)["icmp_blocks"]:
self._icmp_block(True, _policy, args, transaction)
self._icmp_block_inversion(True, _policy, transaction)
if use_transaction is None:
transaction.execute(True)
return _policy
def __register_icmp_block_inversion(self, _obj, icmp_block_inversion_id,
sender):
_obj.settings["icmp_block_inversion"][icmp_block_inversion_id] = \
self.__gen_settings(0, sender)
def __undo_icmp_block_inversion(self, _policy, _obj, icmp_block_inversion_id):
transaction = self.new_transaction()
# undo icmp blocks
if _obj.applied:
for args in self.get_settings(_policy)["icmp_blocks"]:
self._icmp_block(False, _policy, args, transaction)
if icmp_block_inversion_id in _obj.settings["icmp_block_inversion"]:
del _obj.settings["icmp_block_inversion"][icmp_block_inversion_id]
# redo icmp blocks
if _obj.applied:
for args in self.get_settings(_policy)["icmp_blocks"]:
self._icmp_block(True, _policy, args, transaction)
transaction.execute(True)
def remove_icmp_block_inversion(self, policy, use_transaction=None):
_policy = self._fw.check_policy(policy)
self._fw.check_panic()
_obj = self._policies[_policy]
icmp_block_inversion_id = self.__icmp_block_inversion_id()
if icmp_block_inversion_id not in _obj.settings["icmp_block_inversion"]:
_name = _obj.derived_from_zone if _obj.derived_from_zone else _policy
raise FirewallError(
errors.NOT_ENABLED,
"icmp-block-inversion not enabled in '%s'" % _name)
if use_transaction is None:
transaction = self.new_transaction()
else:
transaction = use_transaction
if _obj.applied:
# undo icmp blocks
for args in self.get_settings(_policy)["icmp_blocks"]:
self._icmp_block(False, _policy, args, transaction)
self._icmp_block_inversion(False, _policy, transaction)
self.__unregister_icmp_block_inversion(_obj,
icmp_block_inversion_id)
transaction.add_fail(self.__register_icmp_block_inversion, _obj,
icmp_block_inversion_id, None)
# redo icmp blocks
if _obj.applied:
for args in self.get_settings(_policy)["icmp_blocks"]:
self._icmp_block(True, _policy, args, transaction)
self._icmp_block_inversion(True, _policy, transaction)
if use_transaction is None:
transaction.execute(True)
return _policy
def __unregister_icmp_block_inversion(self, _obj, icmp_block_inversion_id):
if icmp_block_inversion_id in _obj.settings["icmp_block_inversion"]:
del _obj.settings["icmp_block_inversion"][icmp_block_inversion_id]
def query_icmp_block_inversion(self, policy):
return self.__icmp_block_inversion_id() in \
self.get_settings(policy)["icmp_block_inversion"]
def gen_chain_rules(self, policy, create, table, chain, transaction):
obj = self._fw.policy.get_policy(policy)
if obj.derived_from_zone:
# For policies derived from zones, use only the first policy in the
# list to track chain creation. The chain names are converted to
# zone-based names as such they're "global" for all zone derived
# policies.
tracking_policy = self._fw.zone._zone_policies[obj.derived_from_zone][0]
else:
tracking_policy = policy
if create:
if tracking_policy in self._chains and \
(table, chain) in self._chains[tracking_policy]:
return
else:
if tracking_policy not in self._chains or \
(table, chain) not in self._chains[tracking_policy]:
return
for backend in self._fw.enabled_backends():
if backend.policies_supported and \
table in backend.get_available_tables():
rules = backend.build_policy_chain_rules(create, policy, table, chain)
transaction.add_rules(backend, rules)
self._register_chains(tracking_policy, create, [(table, chain)])
transaction.add_fail(self._register_chains, tracking_policy, not create, [(table, chain)])
def _register_chains(self, policy, create, tables):
for (table, chain) in tables:
if create:
self._chains.setdefault(policy, []).append((table, chain))
else:
self._chains[policy].remove((table, chain))
if len(self._chains[policy]) == 0:
del self._chains[policy]
# IPSETS
def _ipset_family(self, name):
if self._fw.ipset.get_type(name) == "hash:mac":
return None
return self._fw.ipset.get_family(name)
def __ipset_type(self, name):
return self._fw.ipset.get_type(name)
def _ipset_match_flags(self, name, flag):
return ",".join([flag] * self._fw.ipset.get_dimension(name))
def _check_ipset_applied(self, name):
return self._fw.ipset.check_applied(name)
def _check_ipset_type_for_source(self, name):
_type = self.__ipset_type(name)
if _type not in SOURCE_IPSET_TYPES:
raise FirewallError(
errors.INVALID_IPSET,
"ipset '%s' with type '%s' not usable as source" % \
(name, _type))
def _rule_prepare(self, enable, policy, rule, transaction, included_services=None):
# First apply any services this service may include
if type(rule.element) == Rich_Service:
svc = self._fw.service.get_service(rule.element.name)
if included_services is None:
included_services = [rule.element.name]
for include in svc.includes:
if include in included_services:
continue
self.check_service(include)
included_services.append(include)
_rule = copy.deepcopy(rule)
_rule.element.name = include
self._rule_prepare(enable, policy, _rule, transaction, included_services=included_services)
ipvs = []
if rule.family:
ipvs = [ rule.family ]
elif rule.element and (isinstance(rule.element, Rich_IcmpBlock) or isinstance(rule.element, Rich_IcmpType)):
ict = self._fw.config.get_icmptype(rule.element.name)
if ict.destination:
ipvs = [ipv for ipv in ["ipv4", "ipv6"] if ipv in ict.destination]
source_ipv = self._rule_source_ipv(rule.source)
if source_ipv:
if rule.family:
# rule family is defined by user, no way to change it
if rule.family != source_ipv:
raise FirewallError(errors.INVALID_RULE,
"Source address family '%s' conflicts with rule family '%s'." % (source_ipv, rule.family))
else:
# use the source family as rule family
ipvs = [ source_ipv ]
if not ipvs:
ipvs = ["ipv4", "ipv6"]
# clamp ipvs to those that are actually enabled.
ipvs = [ipv for ipv in ipvs if self._fw.is_ipv_enabled(ipv)]
# add an element to object to allow backends to know what ipvs this applies to
rule.ipvs = ipvs
for backend in set([self._fw.get_backend_by_ipv(x) for x in ipvs]):
# SERVICE
if type(rule.element) == Rich_Service:
svc = self._fw.service.get_service(rule.element.name)
destinations = []
if len(svc.destination) > 0:
if rule.destination:
# we can not use two destinations at the same time
raise FirewallError(errors.INVALID_RULE,
"Destination conflict with service.")
for ipv in ipvs:
if ipv in svc.destination and backend.is_ipv_supported(ipv):
destinations.append(svc.destination[ipv])
else:
# dummy for the following for loop
destinations.append(None)
for destination in destinations:
if type(rule.action) == Rich_Accept:
# only load modules for accept action
helpers = self.get_helpers_for_service_modules(svc.modules,
enable)
helpers += self.get_helpers_for_service_helpers(svc.helpers)
helpers = sorted(set(helpers), key=lambda x: x.name)
modules = [ ]
for helper in helpers:
module = helper.module
_module_short_name = get_nf_conntrack_short_name(module)
nat_module = module.replace("conntrack", "nat")
modules.append(nat_module)
if helper.family != "" and not backend.is_ipv_supported(helper.family):
# no support for family ipv, continue
continue
if len(helper.ports) < 1:
modules.append(module)
else:
for (port,proto) in helper.ports:
rules = backend.build_policy_helper_ports_rules(
enable, policy, proto, port,
destination, helper.name, _module_short_name)
transaction.add_rules(backend, rules)
transaction.add_modules(modules)
# create rules
for (port,proto) in svc.ports:
rules = backend.build_policy_ports_rules(
enable, policy, proto, port, destination, rule)
transaction.add_rules(backend, rules)
for proto in svc.protocols:
rules = backend.build_policy_protocol_rules(
enable, policy, proto, destination, rule)
transaction.add_rules(backend, rules)
# create rules
for (port,proto) in svc.source_ports:
rules = backend.build_policy_source_ports_rules(
enable, policy, proto, port, destination, rule)
transaction.add_rules(backend, rules)
# PORT
elif type(rule.element) == Rich_Port:
port = rule.element.port
protocol = rule.element.protocol
self.check_port(port, protocol)
rules = backend.build_policy_ports_rules(
enable, policy, protocol, port, None, rule)
transaction.add_rules(backend, rules)
# PROTOCOL
elif type(rule.element) == Rich_Protocol:
protocol = rule.element.value
self.check_protocol(protocol)
rules = backend.build_policy_protocol_rules(
enable, policy, protocol, None, rule)
transaction.add_rules(backend, rules)
# MASQUERADE
elif type(rule.element) == Rich_Masquerade:
if enable:
for ipv in ipvs:
if backend.is_ipv_supported(ipv):
transaction.add_post(enable_ip_forwarding, ipv)
rules = backend.build_policy_masquerade_rules(enable, policy, rule)
transaction.add_rules(backend, rules)
# FORWARD PORT
elif type(rule.element) == Rich_ForwardPort:
port = rule.element.port
protocol = rule.element.protocol
toport = rule.element.to_port
toaddr = rule.element.to_address
for ipv in ipvs:
if backend.is_ipv_supported(ipv):
self.check_forward_port(ipv, port, protocol, toport, toaddr)
if toaddr and enable:
transaction.add_post(enable_ip_forwarding, ipv)
rules = backend.build_policy_forward_port_rules(
enable, policy, port, protocol, toport,
toaddr, rule)
transaction.add_rules(backend, rules)
# SOURCE PORT
elif type(rule.element) == Rich_SourcePort:
port = rule.element.port
protocol = rule.element.protocol
self.check_port(port, protocol)
rules = backend.build_policy_source_ports_rules(
enable, policy, protocol, port, None, rule)
transaction.add_rules(backend, rules)
# ICMP BLOCK and ICMP TYPE
elif type(rule.element) == Rich_IcmpBlock or \
type(rule.element) == Rich_IcmpType:
ict = self._fw.config.get_icmptype(rule.element.name)
if rule.family and ict.destination and \
rule.family not in ict.destination:
raise FirewallError(errors.INVALID_ICMPTYPE,
"rich rule family '%s' conflicts with icmp type '%s'" % \
(rule.family, rule.element.name))
if type(rule.element) == Rich_IcmpBlock and \
rule.action and type(rule.action) == Rich_Accept:
# icmp block might have reject or drop action, but not accept
raise FirewallError(errors.INVALID_RULE,
"IcmpBlock not usable with accept action")
rules = backend.build_policy_icmp_block_rules(enable, policy, ict, rule)
transaction.add_rules(backend, rules)
elif rule.element is None:
rules = backend.build_policy_rich_source_destination_rules(
enable, policy, rule)
transaction.add_rules(backend, rules)
# EVERYTHING ELSE
else:
raise FirewallError(errors.INVALID_RULE, "Unknown element %s" %
type(rule.element))
def _service(self, enable, policy, service, transaction, included_services=None):
svc = self._fw.service.get_service(service)
helpers = self.get_helpers_for_service_modules(svc.modules, enable)
helpers += self.get_helpers_for_service_helpers(svc.helpers)
helpers = sorted(set(helpers), key=lambda x: x.name)
# First apply any services this service may include
if included_services is None:
included_services = [service]
for include in svc.includes:
if include in included_services:
continue
self.check_service(include)
included_services.append(include)
self._service(enable, policy, include, transaction, included_services=included_services)
# build a list of (backend, destination). The destination may be ipv4,
# ipv6 or None
#
backends_ipv = []
for ipv in ["ipv4", "ipv6"]:
if not self._fw.is_ipv_enabled(ipv):
continue
backend = self._fw.get_backend_by_ipv(ipv)
if len(svc.destination) > 0:
if ipv in svc.destination:
backends_ipv.append((backend, svc.destination[ipv]))
else:
if (backend, None) not in backends_ipv:
backends_ipv.append((backend, None))
for (backend,destination) in backends_ipv:
for helper in helpers:
module = helper.module
_module_short_name = get_nf_conntrack_short_name(module)
nat_module = helper.module.replace("conntrack", "nat")
transaction.add_module(nat_module)
if helper.family != "" and not backend.is_ipv_supported(helper.family):
# no support for family ipv, continue
continue
if len(helper.ports) < 1:
transaction.add_module(module)
else:
for (port,proto) in helper.ports:
rules = backend.build_policy_helper_ports_rules(
enable, policy, proto, port,
destination, helper.name, _module_short_name)
transaction.add_rules(backend, rules)
for (port,proto) in svc.ports:
rules = backend.build_policy_ports_rules(enable, policy, proto,
port, destination)
transaction.add_rules(backend, rules)
for protocol in svc.protocols:
rules = backend.build_policy_protocol_rules(
enable, policy, protocol, destination)
transaction.add_rules(backend, rules)
for (port,proto) in svc.source_ports:
rules = backend.build_policy_source_ports_rules(
enable, policy, proto, port, destination)
transaction.add_rules(backend, rules)
def _port(self, enable, policy, port, protocol, transaction):
for backend in self._fw.enabled_backends():
if not backend.policies_supported:
continue
rules = backend.build_policy_ports_rules(enable, policy, protocol,
port)
transaction.add_rules(backend, rules)
def _protocol(self, enable, policy, protocol, transaction):
for backend in self._fw.enabled_backends():
if not backend.policies_supported:
continue
rules = backend.build_policy_protocol_rules(enable, policy, protocol)
transaction.add_rules(backend, rules)
def _source_port(self, enable, policy, port, protocol, transaction):
for backend in self._fw.enabled_backends():
if not backend.policies_supported:
continue
rules = backend.build_policy_source_ports_rules(enable, policy, protocol, port)
transaction.add_rules(backend, rules)
def _masquerade(self, enable, policy, transaction):
ipv = "ipv4"
transaction.add_post(enable_ip_forwarding, ipv)
backend = self._fw.get_backend_by_ipv(ipv)
rules = backend.build_policy_masquerade_rules(enable, policy)
transaction.add_rules(backend, rules)
def _forward_port(self, enable, policy, transaction, port, protocol,
toport=None, toaddr=None):
if check_single_address("ipv6", toaddr):
ipv = "ipv6"
else:
ipv = "ipv4"
if toaddr and enable:
transaction.add_post(enable_ip_forwarding, ipv)
backend = self._fw.get_backend_by_ipv(ipv)
rules = backend.build_policy_forward_port_rules(
enable, policy, port, protocol, toport,
toaddr)
transaction.add_rules(backend, rules)
def _icmp_block(self, enable, policy, icmp, transaction):
ict = self._fw.config.get_icmptype(icmp)
for backend in self._fw.enabled_backends():
if not backend.policies_supported:
continue
skip_backend = False
if ict.destination:
for ipv in ["ipv4", "ipv6"]:
if ipv in ict.destination:
if not backend.is_ipv_supported(ipv):
skip_backend = True
break
if skip_backend:
continue
rules = backend.build_policy_icmp_block_rules(enable, policy, ict)
transaction.add_rules(backend, rules)
def _icmp_block_inversion(self, enable, policy, transaction):
target = self._policies[policy].target
# Do not add general icmp accept rules into a trusted, block or drop
# policy.
if target in [ "DROP", "%%REJECT%%", "REJECT" ]:
return
if not self.query_icmp_block_inversion(policy) and target == "ACCEPT":
# ibi target and policy target are ACCEPT, no need to add an extra
# rule
return
for backend in self._fw.enabled_backends():
if not backend.policies_supported:
continue
rules = backend.build_policy_icmp_block_inversion_rules(enable, policy)
transaction.add_rules(backend, rules)
def check_ingress_egress(self, policy, ingress_zones, egress_zones,
ingress_interfaces, egress_interfaces,
ingress_sources, egress_sources):
for zone in ingress_zones:
self.check_ingress_zone(zone)
for zone in egress_zones:
self.check_egress_zone(zone)
if ("ANY" in ingress_zones or "HOST" in ingress_zones) and \
len(ingress_zones) > 1:
raise FirewallError(errors.INVALID_ZONE, "'ingress-zones' may only contain one of: many regular zones, ANY, or HOST")
if ("ANY" in egress_zones or "HOST" in egress_zones) and \
len(egress_zones) > 1:
raise FirewallError(errors.INVALID_ZONE, "'egress-zones' may only contain one of: many regular zones, ANY, or HOST")
if (egress_interfaces or egress_sources) and \
not ingress_interfaces and not ingress_sources and \
"HOST" not in ingress_zones and "ANY" not in ingress_zones:
raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" has no ingress" % (policy))
if (ingress_interfaces or ingress_sources) and \
not egress_interfaces and not egress_sources and \
"HOST" not in egress_zones and "ANY" not in egress_zones:
raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" has no egress" % (policy))
def check_ingress_egress_chain(self, policy, table, chain,
ingress_zones, egress_zones,
ingress_interfaces, egress_interfaces,
ingress_sources, egress_sources):
if chain == "PREROUTING":
# raw,prerouting is used for conntrack helpers (services), so we
# need to allow it if egress-zones contains an actual zone
if table != "raw":
if egress_interfaces:
raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" egress-zones may not include a zone with added interfaces." % (policy))
elif chain == "POSTROUTING":
if "HOST" in ingress_zones:
raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" ingress-zones may not include HOST." % (policy))
if "HOST" in egress_zones:
raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" egress-zones may not include HOST." % (policy))
if ingress_interfaces:
raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" ingress-zones may not include a zone with added interfaces." % (policy))
elif chain == "FORWARD":
if "HOST" in ingress_zones:
raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" ingress-zones may not include HOST." % (policy))
if "HOST" in egress_zones:
raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" egress-zones may not include HOST." % (policy))
elif chain == "INPUT":
if "HOST" not in egress_zones:
raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" egress-zones must include only HOST." % (policy))
elif chain == "OUTPUT":
if "HOST" not in ingress_zones:
raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" ingress-zones must include only HOST." % (policy))
def _ingress_egress_zones_transaction(self, enable, policy):
transaction = self.new_transaction()
self._ingress_egress_zones(enable, policy, transaction)
transaction.execute(True)
def _ingress_egress_zones(self, enable, policy, transaction):
obj = self._policies[policy]
ingress_zones = obj.settings["ingress_zones"]
egress_zones = obj.settings["egress_zones"]
ingress_interfaces = set()
egress_interfaces = set()
ingress_sources = set()
egress_sources = set()
for zone in ingress_zones:
if zone in ["ANY", "HOST"]:
continue
ingress_interfaces |= set(self._fw.zone.list_interfaces(zone))
ingress_sources |= set(self._fw.zone.list_sources(zone))
for zone in egress_zones:
if zone in ["ANY", "HOST"]:
continue
egress_interfaces |= set(self._fw.zone.list_interfaces(zone))
egress_sources |= set(self._fw.zone.list_sources(zone))
self.check_ingress_egress(policy, ingress_zones, egress_zones,
ingress_interfaces, egress_interfaces,
ingress_sources, egress_sources)
for backend in self._fw.enabled_backends():
if not backend.policies_supported:
continue
for (table, chain) in self._get_table_chains_for_policy_dispatch(policy):
self.check_ingress_egress_chain(policy, table, chain,
ingress_zones, egress_zones,
ingress_interfaces, egress_interfaces,
ingress_sources, egress_sources)
rules = backend.build_policy_ingress_egress_rules(enable, policy, table, chain,
ingress_interfaces, egress_interfaces,
ingress_sources, egress_sources)
transaction.add_rules(backend, rules)
def _get_table_chains_for_policy_dispatch(self, policy):
"""Create a list of (table, chain) needed for policy dispatch"""
obj = self._policies[policy]
if "ANY" in obj.settings["ingress_zones"] and "HOST" in obj.settings["egress_zones"]:
# any --> HOST
tc = [("filter", "INPUT"), ("nat", "PREROUTING"),
("mangle", "PREROUTING")]
# iptables backend needs to put conntrack helper rules in raw
# prerouting.
if not self._fw.nftables_enabled:
tc.append(("raw", "PREROUTING"))
return tc
elif "HOST" in obj.settings["egress_zones"]:
# zone --> HOST
tc = [("filter", "INPUT")]
# iptables backend needs to put conntrack helper rules in raw
# prerouting.
if not self._fw.nftables_enabled:
tc.append(("raw", "PREROUTING"))
return tc
elif "HOST" in obj.settings["ingress_zones"]:
# HOST --> zone/any
return [("filter", "OUTPUT")]
elif "ANY" in obj.settings["ingress_zones"] and "ANY" in obj.settings["egress_zones"]:
# any --> any
tc = [("filter", "FORWARD"), ("nat", "PREROUTING"),
("nat", "POSTROUTING"), ("mangle", "PREROUTING")]
# iptables backend needs to put conntrack helper rules in raw
# prerouting.
if not self._fw.nftables_enabled:
tc.append(("raw", "PREROUTING"))
return tc
elif "ANY" in obj.settings["egress_zones"]:
# zone --> any
tc = [("filter", "FORWARD"), ("nat", "PREROUTING"),
("mangle", "PREROUTING")]
# iptables backend needs to put conntrack helper rules in raw
# prerouting.
if not self._fw.nftables_enabled:
tc.append(("raw", "PREROUTING"))
for zone in obj.settings["ingress_zones"]:
if self._fw.zone.get_settings(zone)["interfaces"]:
break
else:
tc.append(("nat", "POSTROUTING"))
return tc
elif "ANY" in obj.settings["ingress_zones"]:
# any --> zone
tc = [("filter", "FORWARD"), ("nat", "POSTROUTING")]
# iptables backend needs to put conntrack helper rules in raw
# prerouting.
if not self._fw.nftables_enabled:
tc.append(("raw", "PREROUTING"))
for zone in obj.settings["egress_zones"]:
if self._fw.zone.get_settings(zone)["interfaces"]:
break
else:
tc.append(("nat", "PREROUTING"))
tc.append(("mangle", "PREROUTING"))
return tc
else:
# zone -> zone
tc = [("filter", "FORWARD")]
# iptables backend needs to put conntrack helper rules in raw
# prerouting.
if not self._fw.nftables_enabled:
tc.append(("raw", "PREROUTING"))
for zone in obj.settings["ingress_zones"]:
if self._fw.zone.get_settings(zone)["interfaces"]:
break
else:
tc.append(("nat", "POSTROUTING"))
for zone in obj.settings["egress_zones"]:
if self._fw.zone.get_settings(zone)["interfaces"]:
break
else:
tc.append(("nat", "PREROUTING"))
tc.append(("mangle", "PREROUTING"))
return tc
def _get_table_chains_for_zone_dispatch(self, policy):
"""Create a list of (table, chain) needed for zone dispatch"""
obj = self._policies[policy]
if "HOST" in obj.settings["egress_zones"]:
# zone --> Host
tc = [("filter", "INPUT")]
# iptables backend needs to put conntrack helper rules in raw
# prerouting.
if not self._fw.nftables_enabled:
tc.append(("raw", "PREROUTING"))
return tc
elif "ANY" in obj.settings["egress_zones"]:
# zone --> any
return [("filter", "FORWARD_IN"), ("nat", "PREROUTING"),
("mangle", "PREROUTING")]
elif "ANY" in obj.settings["ingress_zones"]:
# any --> zone
return [("filter", "FORWARD_OUT"), ("nat", "POSTROUTING")]
else:
return FirewallError("Invalid policy: %s" % (policy))
def policy_base_chain_name(self, policy, table, policy_prefix, isSNAT=False):
obj = self._fw.policy.get_policy(policy)
if obj.derived_from_zone:
suffix = obj.derived_from_zone
else:
suffix = policy_prefix + policy
if "HOST" in obj.settings["egress_zones"]:
# zone/any --> Host
if table == "filter":
return "IN_" + suffix
if table == "raw":
# NOTE: nftables doesn't actually use this. Only iptables
return "PRE_" + suffix
if not obj.derived_from_zone:
if table in ["mangle", "nat"]:
return "PRE_" + suffix
elif "HOST" in obj.settings["ingress_zones"]:
# HOST --> zone/any
if not obj.derived_from_zone:
if table == "filter":
return "OUT_" + suffix
elif "ANY" in obj.settings["egress_zones"]:
# zone/any --> any
if table == "filter":
if obj.derived_from_zone:
return "FWDI_" + suffix
else:
return "FWD_" + suffix
elif table == "nat":
if isSNAT:
return "POST_" + suffix
else:
return "PRE_" + suffix
elif table in ["mangle", "raw"]:
return "PRE_" + suffix
elif "ANY" in obj.settings["ingress_zones"]:
# any --> zone
if table == "filter":
if obj.derived_from_zone:
return "FWDO_" + suffix
else:
return "FWD_" + suffix
elif table == "nat":
if isSNAT:
return "POST_" + suffix
else:
return "PRE_" + suffix
elif table in ["mangle", "raw"]:
if not obj.derived_from_zone:
return "PRE_" + suffix
elif not obj.derived_from_zone:
# zone --> zone
if table == "filter":
return "FWD_" + suffix
elif table == "nat":
if isSNAT:
return "POST_" + suffix
else:
return "PRE_" + suffix
elif table in ["mangle", "raw"]:
return "PRE_" + suffix
return FirewallError("Can't convert policy to chain name: %s, %s, %s" % (policy, table, isSNAT))
core/fw_helper.py 0000644 00000003451 15035135173 0010027 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2015-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""helper backend"""
__all__ = [ "FirewallHelper" ]
from firewall import errors
from firewall.errors import FirewallError
class FirewallHelper(object):
def __init__(self, fw):
self._fw = fw
self._helpers = { }
def __repr__(self):
return '%s(%r)' % (self.__class__, self._helpers)
# helpers
def cleanup(self):
self._helpers.clear()
def check_helper(self, name):
if name not in self.get_helpers():
raise FirewallError(errors.INVALID_HELPER, name)
def query_helper(self, name):
return name in self.get_helpers()
def get_helpers(self):
return sorted(self._helpers.keys())
def has_helpers(self):
return len(self._helpers) > 0
def get_helper(self, name):
self.check_helper(name)
return self._helpers[name]
def add_helper(self, obj):
self._helpers[obj.name] = obj
def remove_helper(self, name):
if name not in self._helpers:
raise FirewallError(errors.INVALID_HELPER, name)
del self._helpers[name]
core/fw_ipset.py 0000644 00000022712 15035135173 0007675 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2015-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""ipset backend"""
__all__ = [ "FirewallIPSet" ]
from firewall.core.logger import log
from firewall.core.ipset import remove_default_create_options as rm_def_cr_opts, \
normalize_ipset_entry, check_entry_overlaps_existing, \
check_for_overlapping_entries
from firewall.core.io.ipset import IPSet
from firewall import errors
from firewall.errors import FirewallError
class FirewallIPSet(object):
def __init__(self, fw):
self._fw = fw
self._ipsets = { }
def __repr__(self):
return '%s(%r)' % (self.__class__, self._ipsets)
# ipsets
def cleanup(self):
self._ipsets.clear()
def check_ipset(self, name):
if name not in self.get_ipsets():
raise FirewallError(errors.INVALID_IPSET, name)
def query_ipset(self, name):
return name in self.get_ipsets()
def get_ipsets(self):
return sorted(self._ipsets.keys())
def has_ipsets(self):
return len(self._ipsets) > 0
def get_ipset(self, name, applied=False):
self.check_ipset(name)
obj = self._ipsets[name]
if applied:
self.check_applied_obj(obj)
return obj
def backends(self):
backends = []
if self._fw.nftables_enabled:
backends.append(self._fw.nftables_backend)
if self._fw.ipset_enabled:
backends.append(self._fw.ipset_backend)
return backends
def add_ipset(self, obj):
if obj.type not in self._fw.ipset_supported_types:
raise FirewallError(errors.INVALID_TYPE,
"'%s' is not supported by ipset." % obj.type)
self._ipsets[obj.name] = obj
def remove_ipset(self, name, keep=False):
obj = self._ipsets[name]
if obj.applied and not keep:
try:
for backend in self.backends():
backend.set_destroy(name)
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
else:
log.debug1("Keeping ipset '%s' because of timeout option", name)
del self._ipsets[name]
def apply_ipset(self, name):
obj = self._ipsets[name]
for backend in self.backends():
if backend.name == "ipset":
active = backend.set_get_active_terse()
if name in active and ("timeout" not in obj.options or \
obj.options["timeout"] == "0" or \
obj.type != active[name][0] or \
rm_def_cr_opts(obj.options) != \
active[name][1]):
try:
backend.set_destroy(name)
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
if self._fw._individual_calls:
try:
backend.set_create(obj.name, obj.type, obj.options)
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
else:
obj.applied = True
if "timeout" in obj.options and \
obj.options["timeout"] != "0":
# no entries visible for ipsets with timeout
continue
try:
backend.set_flush(obj.name)
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
for entry in obj.entries:
try:
backend.set_add(obj.name, entry)
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
else:
try:
backend.set_restore(obj.name, obj.type,
obj.entries, obj.options,
None)
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
else:
obj.applied = True
def apply_ipsets(self):
for name in self.get_ipsets():
obj = self._ipsets[name]
obj.applied = False
log.debug1("Applying ipset '%s'" % name)
self.apply_ipset(name)
def flush(self):
for backend in self.backends():
# nftables sets are part of the normal firewall ruleset.
if backend.name == "nftables":
continue
for ipset in self.get_ipsets():
try:
self.check_applied(ipset)
backend.set_destroy(ipset)
except FirewallError as msg:
if msg.code != errors.NOT_APPLIED:
raise msg
# TYPE
def get_type(self, name, applied=True):
return self.get_ipset(name, applied=applied).type
# DIMENSION
def get_dimension(self, name):
return len(self.get_ipset(name, applied=True).type.split(","))
def check_applied(self, name):
obj = self.get_ipset(name)
self.check_applied_obj(obj)
def check_applied_obj(self, obj):
if not obj.applied:
raise FirewallError(
errors.NOT_APPLIED, obj.name)
# OPTIONS
def get_family(self, name, applied=True):
obj = self.get_ipset(name, applied=applied)
if "family" in obj.options:
if obj.options["family"] == "inet6":
return "ipv6"
return "ipv4"
# ENTRIES
def add_entry(self, name, entry):
obj = self.get_ipset(name, applied=True)
entry = normalize_ipset_entry(entry)
IPSet.check_entry(entry, obj.options, obj.type)
if entry in obj.entries:
raise FirewallError(errors.ALREADY_ENABLED,
"'%s' already is in '%s'" % (entry, name))
check_entry_overlaps_existing(entry, obj.entries)
try:
for backend in self.backends():
backend.set_add(obj.name, entry)
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
else:
if "timeout" not in obj.options or obj.options["timeout"] == "0":
# no entries visible for ipsets with timeout
obj.entries.append(entry)
def remove_entry(self, name, entry):
obj = self.get_ipset(name, applied=True)
entry = normalize_ipset_entry(entry)
# no entry check for removal
if entry not in obj.entries:
raise FirewallError(errors.NOT_ENABLED,
"'%s' not in '%s'" % (entry, name))
try:
for backend in self.backends():
backend.set_delete(obj.name, entry)
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
else:
if "timeout" not in obj.options or obj.options["timeout"] == "0":
# no entries visible for ipsets with timeout
obj.entries.remove(entry)
def query_entry(self, name, entry):
obj = self.get_ipset(name, applied=True)
entry = normalize_ipset_entry(entry)
if "timeout" in obj.options and obj.options["timeout"] != "0":
# no entries visible for ipsets with timeout
raise FirewallError(errors.IPSET_WITH_TIMEOUT, name)
return entry in obj.entries
def get_entries(self, name):
obj = self.get_ipset(name, applied=True)
return obj.entries
def set_entries(self, name, entries):
obj = self.get_ipset(name, applied=True)
check_for_overlapping_entries(entries)
for entry in entries:
IPSet.check_entry(entry, obj.options, obj.type)
if "timeout" not in obj.options or obj.options["timeout"] == "0":
# no entries visible for ipsets with timeout
obj.entries = entries
try:
for backend in self.backends():
backend.set_flush(obj.name)
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
else:
obj.applied = True
try:
for backend in self.backends():
if self._fw._individual_calls:
for entry in obj.entries:
backend.set_add(obj.name, entry)
else:
backend.set_restore(obj.name, obj.type, obj.entries,
obj.options, None)
except Exception as msg:
raise FirewallError(errors.COMMAND_FAILED, msg)
else:
obj.applied = True
return
core/base.py 0000644 00000004066 15035135173 0006771 0 ustar 00 # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
"""Base firewall settings"""
DEFAULT_ZONE_TARGET = "{chain}_{zone}"
DEFAULT_POLICY_TARGET = "CONTINUE"
DEFAULT_POLICY_PRIORITY = -1
ZONE_TARGETS = [ "ACCEPT", "%%REJECT%%", "DROP", DEFAULT_ZONE_TARGET,
"default" ]
POLICY_TARGETS = [ "ACCEPT", "REJECT", "DROP", "CONTINUE" ]
SHORTCUTS = {
"PREROUTING": "PRE",
"POSTROUTING": "POST",
"INPUT": "IN",
"FORWARD_IN": "FWDI",
"FORWARD_OUT": "FWDO",
"OUTPUT": "OUT",
}
REJECT_TYPES = {
"ipv4": [ "icmp-host-prohibited", "host-prohib", "icmp-net-unreachable",
"net-unreach", "icmp-host-unreachable", "host-unreach",
"icmp-port-unreachable", "port-unreach", "icmp-proto-unreachable",
"proto-unreach", "icmp-net-prohibited", "net-prohib", "tcp-reset",
"tcp-rst", "icmp-admin-prohibited", "admin-prohib" ],
"ipv6": [ "icmp6-adm-prohibited", "adm-prohibited", "icmp6-no-route",
"no-route", "icmp6-addr-unreachable", "addr-unreach",
"icmp6-port-unreachable", "port-unreach", "tcp-reset" ]
}
# ipset types that can be used as a source in zones
# The match-set option will be src or src,src according to the
# dimension of the ipset.
SOURCE_IPSET_TYPES = [
"hash:ip", "hash:ip,port", "hash:ip,mark",
"hash:net", "hash:net,port", "hash:net,iface",
"hash:mac"
]